I wasn't the one who brought up Trusting Trust. But the person who did said > you don't have to write a whole new compiler from scratch, unless you're worried

I wasn't the one who brought up Trusting Trust. But the person who did said > you don't have to write a whole new compiler from scratch, unless you're worried about "trusting trust" attacks. The point of that comment (at least, as I read it) isn't that you have to be worried about "trusting trust", but rather that there's no point in writing a new compiler from scratch unless you already are worried about "trusting trust" (with the implication being that most people aren't and so writing a new compiler from scratch isn't necessary). SCM security issues (as you mentioned) are irrelevant at this point, because they really have no bearing on whether you have to write a new compiler from scratch.