[PLUG] Is a Linux Distro compromised?

[Mike C.]

How would one know or determine if their beloved Linux distro of choice is
hacked, altered or otherwise compromised?

And not from years of using it with applying security updates or just
willy-nilly throwing apps on it for fun but from the source when you
download it.

Say I want to build my own distro, how do I verify that I'm getting the
authentic / original kernel to start with?

If I'm downloading a distro, how would I do the same verification?

Is this something that we just rely on the general Linux community to do
monitor and report on?

Or is there something that's accomplished through hash algorithms and
digital signatures that your average Linux user can verify themselves?

I hope I'm making some sense here.

Thank you,

Mike