Nothinman
Elite Member
The patches can all be legit and you could still slip one extra one in there. In the case of my batchfile technique, it would just require one more line in the batchfile and one more executable in the package. Doing a quick Google search for "Trojanized Linux Distro" showed I'm not the only one who's ever thought of this.
If you can get the person to install a trojaned patch then you can probably get them to install any number of other things too.
Of course you have to trust the person running the mirror that you're getting software from, that goes without saying. Although the security of packages differs between distributions, for example RH/FC sign every package while Debian/Ubuntu only sign the APT package list so while RH/FC will verify the signature on package install install (i.e. rpm -i blah.rpm) Debian/Ubuntu only verify on download so if you install a .deb manually with 'dpkg -i trojan.deb' it'll install just fine without any warnings.