Re: Of Bounties and Mercenaries

[Joe Buck <Joe dot Buck at synopsys dot COM>]

On Wed, Apr 07, 2004 at 12:33:28PM -0700, Tom Lord wrote:
> 
>     > From: Bernd Jendrissek <berndj@prism.co.za>
> 
>     > That's why it's a good idea to bootstrap GCC regularly with a non-GCC
>     > compiler.  (I guess an ancient GCC would be a sufficiently close
>     > approximation to a non-GCC compiler as most people will bother to get.
>     > I happen to have gcc-2.7.2.3 around, and in my copious free time I
>     > occasionally (in between bouts of FreeCiv) try to get gcc-2.5.8 going.)
> 
>     > Truly profound, this bootstrapping stuff.  Read that paper, co-newbies.
>     > (And no, I'm not smoking anything.)
> 
> 
> Well, it's a classic paper for a good reason.
> 
> I say: give it to students.  Every generation or 2 of students should
> rebuild the bootstrapping path starting from raw iron.  The students
> will come out smarter and we all have a more secure foundation.

If you're really worried about the Ken Thompson hack, bootstrap starting
from several non-GCC compilers and determine whether you always get the
same bits.  Use cross-compilation too.  You then will prove that either
your GCC binary does not have the Thompson hack, or else that all the
free and proprietary compilers you tried have the same hack, so cleverly
designed as to be cross-platform.