#bootstrappablebuilds — Public Fediverse posts

@nixos_org @nzbr

While we're on the topic: work on minimal-bootstrap in #nixpkgs has actually been picked up again since this thesis was written (October 2025).

Not only that but, as of a few hours ago, the PR implementing the last step of hooking it up to become the actual bootstrap stdenv in Nixpkgs has been merged!

https://github.com/NixOS/nixpkgs/pull/479322

#fullsourcebootstrap #reproduciblebuilds #stage0 #minimalbootstrap #bootstrappablebuilds

@filippo Meanwhile, bootstrapping a current OpenJDK involves compiling multiple ancient packages (each with its own set of outdated dependencies, of course) and then going up all the way from Java 7, version by version.

@stikonas has described this tedious process and developed some ebuilds for Gentoo here: https://git.stikonas.eu/andrius/gentoo-bootstrap

This also applies to Rust in a way, but at least it's not as bad there – not yet, as the old versions might eventually succumb to bitrot, too.

Please, dear programming language community, can we do better at this? For resilience, for reproducibility, for reliability, for portability and for preservation?

#bootstrappablebuilds #bootstrapping #reproduciblebuilds #trustingtrust #gentoo #openjdk #rust

Edit: Added &c=my-comment to the URL,
please like my comment, or otherwise help me to reach LaurieWired? Boost=❤️ #askfedi

@regtur @reproducible_builds @guix @ekaitz_zarraga
@nlnet
@fsf
@fsfe
@gnutools
Seems #fedi didn't do their thing just yet, so I logged into the Evil Empire and added a comment. Not sure if that will do any good, tho. I guess maybe one or two of you who read this, and still have a Google account, could like my comment, but there are already comments with > 3K likes, so yeah.

Also, no idea how to reach them; they're talking about trust, and then only seem to on Big Tech platforms like TPPKAB (the platform previously known as birdsite), instagram, etc.

<https://www.youtube.com/watch?v=Fu3laL5VYdM&lc=UgxAf-w-tTYM5syB3x94AaABAg>
#bootstrappablebuilds #guix #gnu #reproducibleBuilds #supplyChainSecurity #trustingTrust

@regtur
Wait what? #GNU #Mes isn't being mentioned? Not even in the comments?
Fediverse do your thing!

cc: @lauriewired @reproducible_builds
@guix
@ekaitz_zarraga
@nlnet #bootstrappable
#bootstrappablebuilds
#guix
#trustingtrust

#GNU Mes 0.27.1 released: A bug-fix release that supports

* development build with gcc-14
* building with M2-Planet 1.12.0
* building on x86-linux with M2-Planet 1.13.0
* building bootstrappable-tcc using 1.00.02 <= NYACC <= 2.02.2

<https://lists.gnu.org/archive/html/info-gnu/2025-08/msg00005.html>

Thanks to @ekaitz_zarraga and @stikonas!

#GnuMes
#bootstrappable
#BootstrappableBuilds
#ReproducibleBuilds
@reproducible_builds
@fsf
@fsfe
@gnutools
@nlnet

Bootstrapping of an older version of re2c:

https://git.stikonas.eu/andrius/re2c-bootstrap

#bootstrappableBuilds

A talk about live-bootstrap and builder-hex0 by Rick Masters:

https://www.youtube.com/watch?v=ycLdhqn5VI4

https://github.com/ironmeld/builder-hex0

https://github.com/fosslinux/live-bootstrap

#bootstrappableBuilds

I was just reviewing the new x86 hex0 bootstrap seed: https://github.com/oriansj/stage0-posix-x86/blob/master/hex0_x86.hex0. Big thanks to Noah Goldstein for making it smaller.

Now it is only 190 bytes. Excluding ELF header that's only 106 bytes of code.

For a couple of years hex0 binary was 256 bytes and before that hex0 was 357 bytes (this is the number that is still mentioned in https://guix.gnu.org/manual/devel/en/html_node/Full_002dSource-Bootstrap.html).

#bootstrappableBuilds #stage0

@filip The current project is focused on running the compiler in a Scheme implementation, and generating native code with a C compiler.

The bootstrapping story is really a question of "how much Scheme" and "how much C". I'd love for Pre-Scheme to run on GNU Mes, but that hasn't been investigated yet. I'm in touch with folks in the bootstrapping community who are experts in minimal C compilers, and intend to do a detailed analysis of compatibility at some point. Early diagnosis is that Pre-Scheme isn't very demanding of a C compiler and targeting minimal compilers should be possible.

Beyond that, there's the possibility for adding new backends to the Pre-Scheme compiler. The original compiler described in "Compilation By Program Transformation" emitted m68k assembly. The paper "A Tractable Native-Code Scheme System" describes re-purposing the compiler as a bytecode optimizer, which involved writing a backend to emit Scheme 48 bytecode. I also have colleagues who are very interested in the possibility of a WebAssembly backend.

https://prescheme.org/references.html

#prescheme #bootstrappablebuilds

@harrysintonen @vegard These days we also have #BootstrappableBuilds that prevent this kind of attack (at least at the software level).

@rsc @timbray Indeed. #ReproducibleBuilds and #BootstrappableBuilds cannot replace auditing source.

@khinsen @SReyCoyrehourcq @zimoun @civodul Wouldn't hurt to contact upstream about the cycle they created and ask if they have or are working on a solution
#bootstrappablebuilds

There is now an interesting guide by @mid_kid (https://mid-kid.root.sx/git/mid-kid/bootstrap/src/branch/master/gentoo-2024/gentoo.txt) on installing #Gentoo from just source and a tiny 200 byte kernel. At the moment it's a bit longish and starts with #livebootstrap then pivots to #LFS to obtain 64-bit toolchain and finally bootstraps #Gentoo from there.

Potentially some steps could be optimized, and #LFS removed but it works.

#BootstrappableBuilds

I think it just makes no sense to, at some arbitrary level, say: "Listen, we're not going to build this package from source, because: 'Well, we actually don't have any good reason for it but we just won't.'"

#bootstrappable
#bootstrappability
#bootstrappableBuilds
#freeSoftware

I've just updated my gentoo-bootstrap overlay (https://gitlab.com/stikonas/gentoo-bootstrap) with fixes to GCC →OpenJDK 8 bootstrap. (There was a bit of breakage due to some old ecj tarballs disappearing from distfiles.gentoo.org)

#Gentoo #Java #OpenJDK #BootstrappableBuilds

#GNU Mes 0.26 released: With greatly enhanced #Guile compatibility, Guile-style modules, and supporting Gash and Gash-Utils.

https://lists.gnu.org/archive/html/info-gnu/2023-12/msg00000.html

Thanks to the amazing work of Timothy Sample (and myself :)

#GnuMes
#bootstrappable
#BootstrappableBuilds
#ReproducibleBuilds
@fsf
@fsfe

#GNU Mes 0.25 released: Supporting the bootstrap for riscv64-linux.

https://lists.gnu.org/archive/html/info-gnu/2023-11/msg00001.html

Thanks to the amazing work of @ekaitz_zarraga and
@stikonas!

#GnuMes
#bootstrappable
#BootstrappableBuilds
#ReproducibleBuilds
@fsf
@fsfe

@indieterminacy Yes, that was an interesting read.
Also, quite encouraging that #ReproducibleBuilds is finally gaining some influence, and similarly discouraging that #Bootstrappablebuilds and the full-source Bootstrap isn't widely known about.

https://bootstrappable.org
https://todon.nl/@janneke/110265435316816890

@yrlf @jschauma Reproducible Builds don't help here, you can be reproducibly malicious. What you need is a bit stronger, i.e. #BootstrappableBuilds. If you build the world starting from a tiny sub 1KiB binary, you can prove that there is no self replicating backdoor coming from software. You could still have one from lower levels, e.g. hardware. Those are both significantly harder to implement but also hard to solve.

@janneke @jschauma @nixos_org @emilyposting Also Freedesktop SDK (with the exception of rust) uses #bootstrappableBuilds.

@jschauma
A good thing then that Guix implemented the full source Bootstrap.

Also @nixos_org is now prototyping and implementing the full source Bootstrap right now, thanks to @emilyposting.

Let's just hope that other distributions may wake up and follow soon.

https://todon.nl/@janneke/110265435316816890

#GNU #Guix #bootstrappableBuilds

@rml @cpli Also, Guix pioneered and implemented the full source Bootstrap, which thanks to @emilyposting is als coming to @nixos_org RSN.
https://todon.nl/@janneke/110265435316816890
#bootstrappableBuilds

@ekaitz_zarraga and I have finally bootstrapped #TinyCC on #RISCV starting from GNU #Mes and #MesCC (and eventually tiny #hex0 binary if you go further back).

The binary that we have built is self-hosting and can build itself, though perhaps a few more bugfixes will be needed to reach the newest version of tcc.

@janneke
@efraim
#bootstrappableBuilds
#reproducibleBuilds

#RISCV support in #Mes’s bootstrappable #TinyCC

https://ekaitz.elenq.tech/bootstrapGcc6.html
#bootstrappablebuilds

@janneke @aziz @fsf @fsfe @reproducible_builds @ekaitz_zarraga Indeed! Right now we can bootstrap all the way from #hex0 to #Mes, then use #MesCC to build very first build of #tinycc (we can call it mes-tcc). mes-tcc can then build the next build of tinycc (boot0-tcc). Unfortunately, at the moment boot0-tcc segfaults. Today, I fixed one crash which was due to Global Offset Table being all zeros but it turns out we are now hitting another segfault, so more work is needed.

#bootstrappableBuilds

@amszmidt
That's right, they do not help: they're essential!

Without Reproducible builds and Bootstrappable builds, free software, and certainly software freedom, is an illusion at best.

Re: Trusting Trust, see for example the excellent talk by @vagrantc

https://archive.org/details/fossy2023_Breaking_the_Chains_of_Trustin

#RebproducibleBuilds
#Bootstrappable
#BootstrappableBuilds