{
  "id": 4703649,
  "title": "Bootstrappable builds: how and why",
  "url": "https://urgent.news/2026/08/31/bootstrappable-builds-how-and-why",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-31T17:03:47.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://lwn.net/Articles/1088279/"
  },
  "original_language": "en",
  "account": "The Free and Open Source Software Yearly conference, known as FOSSY, recently took place in Vancouver, Canada. Timothy Sample presented on bootstrappable builds, a topic less known than its cousin, reproducible builds. A bootstrappable build starts with a tiny program that can build another program, which can build yet another, ultimately creating a modern Linux user space from a small seed. This results in code with a completely understood origin, unlike typical Linux user space today. Sample began using GNU Guix, a functional package manager, nearly ten years ago, which represents all software in a derivation graph. This graph describes how to build each program, including inputs required for building. For instance, building a Python program requires Python, which is a C program, necessitating a C compiler, and so on. Guix collects all these nodes into a graph, which can be explored to understand the origin of each component. The challenge lies in determining who compiled the compiler's compiler, as it is unclear where it stops. The goal of bootstrappable builds is to create a system that can be built without relying on pre-built artifacts, moving beyond the reliance on pre-built binaries. This approach aims to build tools from scratch, addressing the chicken-and-egg problem in compiler development. Bootstrappable builds offer a solution to the same problem as reproducible builds but target a different failure mode. If a reproducible build fails, it indicates the binary is built from untrustworthy sources. In contrast, bootstrappable builds prevent issues similar to those described by Ken Thompson in his Turing Award lecture, \"Reflections on Trusting Trust.\" A backdoor in a C compiler could hide a dangerous flaw, such as a backdoor in the login program.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}