You will not be able to tell whether they'd be silly bugs or malicious. The evil compiler authors have no need to collude, other than act to frustrate DDC. And you won't know they are evil.
Also, as per Thompson, you need to verify not just the compiler, but large parts of the system. David says DDC could be applied there too. Other people in these comments have noted just how difficult it is to get reliable builds at system levels and how short-scoped they are in time (even if you can get a reliably reproducible build).
Further, even if all your compilers DO build the same binary, you are still trusting the compiler authors have not colluded AND that all compilers have independent authors/distribution-teams. While it may be possible to have more confidence in these assumptions than in assuming 1 compiler is not subverted, these assumptions are still not absolutely, 100% safe.
Thompson's point was that you simply can not escape having to have /some/ degree of trust, UNLESS, you create ALL the underlying system yourself. It still stands.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds