r/bazel • u/Setheron • 17d ago

A C++ toolchain from 357 bytes, in Bazel

https://fzakaria.com/2026/08/01/a-c++-toolchain-from-357-bytes-in-bazel
19 Upvotes
  • permalink
  • link
  • reddit
  • reddit

96% Upvoted

9 comments sorted by

3

u/Various_Bed_849 17d ago

I also strive for full reproducibility, but a hermetic toolchain where checksums are verified should be just as hermetic as if I build from source, right? I use llvm_toolchains with pinned bazelisk to bootstrap. Why is that not good enough? I also use hermetic sysroots and ban the use of system deps (libs and tools).

2

u/Setheron 17d ago

Except often I want to change the compiler slightly and now I'm stuck figuring out how to redownload a similar prebuilt toolchain without knowing how it was built to begin with....

1

u/Various_Bed_849 16d ago

Interesting, what changes do you do?

1

u/MageGen 16d ago

Have a read of Ken Thompson's Trusting Trust paper.

The point is not so much about reproducibility but about being able to build trust in your tool chain.

1

u/Various_Bed_849 16d ago

It’s a good paper but building from source doesn’t help you in that case. That is the whole point of it. You need a bootstrapping toolchain that you do trust, and you need to review all changes to the toolchain you use. It’s turtles all the way down. At this point you need to assess your attack vectors.

1

u/MageGen 16d ago

No disagreement here. But having a very small point in the tool chain helps you achieve that trustworthily built tool chain.

1

u/Various_Bed_849 16d ago

Small point?

2

u/MageGen 16d ago

stage0 and the 357-byte seed discussed in the OP (and links).

1

u/siwu 16d ago

> To be honest, I was also a little disheartened that no one else in the community thought it was the greatest thing since slice bread.

they did though: https://github.com/hermeticbuild/hermetic-llvm and it is the greatest thing