Fully Countering Trusting Trust Through Diverse Double-Compiling (2009)
jacques_chester: You&#x27;re absolutely right that recreating things bit-for-bit identical can require some real elbow grease.  I had to overcome bugs in the Tiny C compiler (tcc) and gcc to make them work, as described in the paper.  Date&#x2F;time stamps can create problems too.<p>But all these problems are quite doable.  Nobody claims that gcc is small, yet I managed to get that working.  Compiler makers can follow a few guidelines to make it much easier, see: <a href="http:&#x2F;&#x2F;www.dwheeler.com&#x2F;trusting-trust&#x2F;dissertation&#x2F;html&#x2F;wheeler-trusting-trust-ddc.html#4.Guidelines for Compiler Suppliers" rel="nofollow">http:&#x2F;&#x2F;www.dwheeler.com&#x2F;trusting-trust&#x2F;dissertation&#x2F;html&#x2F;whe...</a>
Check out the graph at the Debian Reproducible Builds project at <a href="https:&#x2F;&#x2F;wiki.debian.org&#x2F;ReproducibleBuilds" rel="nofollow">https:&#x2F;&#x2F;wiki.debian.org&#x2F;ReproducibleBuilds</a> - yes, some packages don&#x27;t reproduce bit-for-bit, but they&#x27;ve made a tremendous amount of progress and managed it for most packages.<p>You can see some related information at this page: <a href="http:&#x2F;&#x2F;www.dwheeler.com&#x2F;trusting-trust&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.dwheeler.com&#x2F;trusting-trust&#x2F;</a> including a video of me discussing the paper.