Trustworthiness of third-party debian repositories

1

Hi there,

First of all, I’m impressed with what I’ve seen so far and I’m planning to deploy Vaultwarden at work.

My only problem thus far is that there isn’t an official debian package – neither from debian, nor the Vaultwarden team.

I don’t have a problem with installing from a third-party package repository but as this is security-critical software, I’d like to put some effort into verifying them.

Namely, I have found two candidates:

Now, I don’t want to ask something as vague and subjective as “are these trustworthy?”, so I’m looking for answers to two more specific questions:

  1. Are the authors of these (dionysius and gvtulder) people who are active and known within the Vaultwarden community?
  2. How do I verify that executables from a specific released package haven’t been modified? I tried comparing checksums of the executables for the latter repository with the ones in the official docker images as the documentation of that repo says the binaries are extracted from those images – but I either didn’t find the correct docker tag they came from (tried 3 or 4 different ones) or the executables have been modified. For the former, I’m not sure if it can be done with reasonable effort unless the build process goes for reproducible builds, but as I found no mention of that, I’m assuming that’s currently not a thing.

If anyone can help me sort this out, I’d be grateful.

2

I think neither are code contributors but if I recall correctly dionysius has raised a couple of issues in both the main vaultwarden repository and the bw_web_builds one.

I have not looked at Gijs’ repository. If you look at dionysius’ repository you will see that the vaultwarden binary is build from source via GitHub actions. Whether you can trust this build process or not I have no idea. I mean I’m not sure if Vaultwarden or the web-vault currently can be built reproducibly.

3

Thanks for your reply, Stefan!

I did indeed find issues opened by dionysius on GH. :slight_smile:

I’ll mess around with docker on a local VM to try and see if I can establish a positive track record for Gijs’ repository (will report back if I manage). But if not, I’ll switch to the one offered by dionysius.

Beginning to question my choice of going with Debian, already managing three third-party package repositories (and a custom build for an nginx plugin) for central pieces of our infra – all of which are available through ports/packages on FreeBSD – which also has a vaultwarden port… :thinking: