> And what about the hardware on which the build runs? Is it reproducible? ;) "Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) - Counter

> And what about the hardware on which the build runs? Is it reproducible? ;) "Fully Countering Trusting Trust through Diverse Double-Compiling (DDC) - Countering Trojan Horse attacks on Compilers" https://dwheeler.com/trusting-trust/ https://dwheeler.com/trusting-trust/ If the build is reproducible inside VMs, then the build can be done on different architectures: say x86 and ARM. If we end up with the same live image, then we're talking something entirely different altogether: either both x86 and ARM are backdoored the same way or the attack is software. Or there's no backdoor (which is a possibility we have to fancy too).