Are RPM Fusion packages trustworthy and safe to install?

Question

I come from Debian GNU/Linux which has a rich set of repositories. So I barely need to use third party repos.

What bothers me in Fedora is the need for some hard to compile packages (In terms of time and dependency chain) which makes it more reasonable to install them using a third party repository like RPM Fusion.

What I'm concerned about is that are RPM Fusion packages trustworthy and safe to install?

By trustworthy, what I mean is in term of security and privacy not tampered with to include malicious code or behavior. Or does anybody checks the upstream code to make sure it's safe?

I'm used to work with repositories like SlackBuilds and AUR which you can check the build scripts and see what is happening (being downloaded, etc).

Is it possible to prove that RPM Fusion packages have been built without being manipulated? for example: there is a build script and a CI CD taking care of building the packages which can be trusted.

---

There is also another (kinda) similar unanswered question: Security of Fedora third party repo RPMFusion

Answer 1

are RPM Fusion packages trustworthy and safe to install?

By trustworthy, what I mean is in term of security and privacy not tampered with to include malicious code or behavior. Or does anybody checks the upstream code to make sure it's safe?

As far as tampering goes, there are two aspects to consider. The first is the relationship between the installable binaries and the source code; see below for details there. Maintainers can’t upload their own binaries, all the binaries come from the build infrastructure. This leads to the second aspect, which is whether the build infrastructure is trustworthy; there’s no easy answer to that. The infrastructure uses Koji but there’s no way for outsiders to check what’s running on the build infrastructure!

As far as checking upstream code goes, that’s up to the maintainers.

Is it possible to prove that RPM Fusion packages have been built without being manipulated?

The builds aren’t reproducible in general, but you can examine the package build scripts in the RPM Fusion git repositories, and trace each build on Koji. Individual builds (e.g. this gstreamer plugins build) show which git hash they were built from, and provide all the build logs and artifacts; you can thus attempt to reproduce each step locally and compare your results with the published artifacts.