Results 1 to 4 of 4

Thread: Packaged Steam for 20.04 LTS Binary Mismatch

  1. #1
    Join Date
    Oct 2021
    Beans
    3

    Packaged Steam for 20.04 LTS Binary Mismatch

    Hello folks,

    I was comparing the Steam installer file from Valve with the one available on Ubuntu.
    I found the installer version is 1.0.0.61 so I located the equivalent package from Valves PPA.
    After comparing the steam executables I realized that they are not the same file. You can find them in the links below:


    http://security.ubuntu.com/ubuntu/po...untu3_i386.deb
    or apt download steam
    binary: steam_1.0.0.61-2ubuntu3_i386/data/usr/lib/games/steam/steam


    https://repo.steampowered.com/steam/...0.0.61_all.deb
    binary: steam-launcher_1.0.0.61_all/data/usr/lib/steam/bootstraplinux_ubuntu12_32/ubuntu12_32/steam


    I checked the source for that package from Ubuntu and it has a matching binary to the one from Valve. However the final packaged installer ended up with a different binary.


    http://security.ubuntu.com/ubuntu/po...61.orig.tar.xz
    binary: steam_1.0.0.61-2ubuntu3_i386/data/usr/lib/games/steam


    I thought they might have packaged a slightly updated version of that installer but I have no way of verifying that.


    I was wondering if I'm missing something in my comparison?
    Also how can we verify the integrity of provided binaries in this instance?

    Your input would be greatly appreciated.
    Last edited by corestarfish; October 27th, 2021 at 04:54 AM.

  2. #2
    Join Date
    Oct 2021
    Beans
    3

    Re: Packaged Steam for 20.04 LTS Binary Mismatch

    I got my answer in the launchpad. This is due to the use of dwz and strip command to remove certain parts of the binary file.

  3. #3
    Join Date
    Mar 2011
    Location
    19th Hole
    Beans
    Hidden!
    Distro
    Ubuntu 20.04 Focal Fossa

    Re: Packaged Steam for 20.04 LTS Binary Mismatch

    Actually, you ask a good question and have commendable security savvy. It would never have occurred to me to compare binaries.

    For the vast majority of Ubuntu users, the default practice is to just trust the binaries. As a non-programmer, that's the only real world option available to me. However, those more knowledgeable and/or more security conscious have the option of compiling from source—that being the whole point/advantage of FOSS.

  4. #4
    Join Date
    Oct 2021
    Beans
    3

    Re: Packaged Steam for 20.04 LTS Binary Mismatch

    Thank you.
    I was not sure if I should go with the older installing method with a deb file, or the available package on Ubuntu which is always more convenient, and I decided to compare the installers.
    The great thing is that there is transparency in place therefore build logs and source files are available, so people from the community were able to point me to the right direction and I was able to reproduce the same results with the provided steps in log files.
    Also seeing how many knowledgeable and helpful people are involved in this community makes Ubuntu even more trustworthy for me.

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •