Technology

Developer details bootstrappable builds to reduce pre-compiled code dependencies

At the FOSSY conference, Timothy Sample outlined how starting from tiny initial seed programs helps prevent trusting-trust security vulnerabilities.

Updated Aug 28, 2026 · 05:21 UTC1 reports

The short version

Software developer Timothy Sample presented on bootstrappable builds at the FOSSY conference, explaining how Linux user spaces can be compiled starting from minimal initial seeds.
The method aims to prevent trusting-trust attacks, where invisible backdoors are embedded directly inside compiler binaries rather than source code.
The GNU Guix distribution has reduced its initial bootstrap seed from a 250MB pre-compiled binary blob down to hex0, a program of roughly 256 bytes.
Challenges remain, including long multi-step build chains for self-hosting languages like Rust and the ongoing exclusion of the Linux kernel from the process.

Bootstrappable builds construct software starting from a tiny initial program, progressively compiling larger tools until an entire operating system's user space is built without relying on pre-built binary blobs.[Hacker News]
GNU Guix originally depended on a 250MB statically linked binary seed to construct its packages, but developers reduced the seed to hex0, a program of approximately 256 bytes.[Hacker News]
Bootstrapping techniques rely on purpose-built tools, like mrustc for Rust, or archaeological digs that compile successive historic versions of a program's source code.[Hacker News]
Recent research demonstrated a trusting-trust attack against NixOS where a backdoored strip program modified every compiled binary on the system in a way undetected by source-code analysis.[Hacker News]

The timeframe for fully eliminating statically linked Guile binaries from the GNU Guix bootstrap process remains uncertain as developers continue working on the transition.[Hacker News]
It is unknown how kernel bootstrapping will be integrated at scale, as GNU Guix currently assumes an existing kernel while live-bootstrap explores experimental solutions like Fiwix.[Hacker News]