Re:Guix Reduces Bootstrap Seed by Half
by orblivion on Wednesday October 09, 2019 @10:49AM
(#21203769)
If you're worried enough, I think there's some trick where you use multiple different C compilers made by different organizations to build (let's say) gcc. Then you use all those gccs to rebuild gcc in a deterministic way. If all of those rebuilt gccs are byte-for-byte the same, then either it's safe, or all of the initial compilers you used were in cahoots. Depending on who you pick to start, that's arguably very unlikely.
[ Parent
| on HN ]
Re:Guix Reduces Bootstrap Seed by Half
by thfuran on Wednesday October 09, 2019 @01:24PM
(#21205466)
>If all of those rebuilt gccs are byte-for-byte the same
Isn't that pretty unlikely even if all the compilers are uncompromised?
Re:Guix Reduces Bootstrap Seed by Half
by delroth on Wednesday October 09, 2019 @01:41PM
(#21205689)
No, that's what reproducible builds are all about: https://reproducible-builds.org/
Debian is currently sitting at around 93% of packages being reproducibly built. NixOS is close to 99% of the minimal install image set (https://r13y.com/).
Reproducible builds don't mean compiling with different compilers, or even different versions of the same compiler, to result in the same binary.
That's why you don't compare the GCC binaries built by different compilers. Instead, you use each of those GCC binaries (which may use different machine code but should implement the exact same functionality) to build another GCC, and you compare those binaries. That should result in identical binaries as long as GCC:
- is deterministic,
- does not invoke undefined behavior, and
- was correctly compiled by the original compilers.