4 ms·
If you're worried enough, I think there's some trick where you use multiple different C compilers made by different organizations to build (let's say) gcc. Then
by orblivion 7y ago
If you're worried enough, I think there's some trick where you use multiple different C compilers made by different organizations to build (let's say) gcc. Then you use all those gccs to rebuild gcc in a deterministic way. If all of those rebuilt gccs are byte-for-byte the same, then either it's safe, or all of the initial compilers you used were in cahoots. Depending on who you pick to start, that's arguably very unlikely.
- thfuran 7y ago>If all of those rebuilt gccs are byte-for-byte the same Isn't that pretty unlikely even if all the compilers are uncompromised?
- delroth 7y agoNo, that's what reproducible builds are all about: https://reproducible-builds.org/ https://reproducible-builds.org/ Debian is currently sitting at around 93% of packages being reproducibly built. NixOS is close to 99% of the minimal install image set (https://r13y.com/ https://r13y.com/).
- tjoff 7y agoReproducible builds don't mean compiling with different compilers, or even different versions of the same compiler, to result in the same binary.
- comex 7y agoThat's why you don't compare the GCC binaries built by different compilers. Instead, you use each of those GCC binaries (which may use different machine code but should implement the exact same functionality) to build another GCC, and you compare those binaries. That should result in identical binaries as long as GCC: - is deterministic, - does not invoke undefined behavior, and - was correctly compiled by the original compilers.