Famous Unix and C developer Ken Thompson has a classic article on the concept of “trust” and its ability to be verified by examining the source code, arguing the triviality of moving malware into the compiler toolchain.
While this is true, it never struck me as a practical or realistic threat, though in principle perhaps at a DOD level of espionage you might find someone attempting an attack like this with the compiler or even on the chip level.
My first encounter of this article was as a rebuttal from very skilled developer who argued that open source software isn’t preventing malicious activity by being open for source code audit since the compiler could have the malicious code and you could infect the compiler. However, this seems to me be be an argument as if to say because a lock can be picked we should not lock the deadbolt on our door.
All that aside, I am curious whether Nix style reproducible builds represent a significant hedge against this attack, since this would detect any malicious code in the compiler.