Reflections on Trusting Trust: the compiler that lies

The idea

A compiler is itself a program built by a compiler. Teach it to recognise two things — the login program and its own source — and to add a backdoor to the first and the backdoor-adding code to the second. After one bootstrapping step, the source of both is clean and the binaries are not.

Why it still matters

Every modern software supply chain is a longer version of Thompson's chain: compilers, build servers, package registries, CI. The defences — independent rebuilds, diverse toolchains, signed provenance — exist because of this lecture.

Our reading

Analysis — Altumptic's interpretation of the sources below.

• Reviewing source code proves less than it feels like it proves.
• Reproducible builds turn “trust us” into “check us”.
• The build system is part of the attack surface, not plumbing.

What it means for you

1. Make builds reproducible, and have someone else reproduce them.
2. Pin and verify toolchains rather than taking whatever the image ships.
3. Publish build provenance (attestations) alongside releases.