I recommend reading this paper, as it gives some understanding of the things that are possible with an infected toolchain: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

Some modern compiled languages such as Zig and Go can be officially bootstrapped from a C toolchain. And a C toolchain can be bootstrapped with Guix using only a 357-byte blob. This gives some good confidence that you can bootstrap a malware free toolchain using auditable source artifacts.

Rust however, does not have an official way to be bootstrapped from a C compiler, which means developers must use a previous version of the compiler to build a new version. In this situation, you can never be sure a malware was not injected in a previous version of the compiler (see the Ken Thompson paper for an example). There's no way to know because you are using a unauditable blob to create another blob.

This is why someone created mrustc, a Rust compiler implemented in pure C++, so that Rust can be bootstrapped from a C toolchain (see also: https://users.rust-lang.org/t/understanding-how-the-rust-com...).

The mrustc solution is not good because there are essentially 2 implementations of the same compiler that have to be kept in sync. It would be much better if Rust used a solution like Zig's: https://ziglang.org/news/goodbye-cpp/

This was interesting, cheers!