How to reduce our vulnerability from self-hosted compilers

[Mark H Weaver]

We are starting to add more self-hosted compilers, where our build
recipes are downloading pre-compiled binaries from upstream.  I'd like
to propose a policy for dealing with this in such a way that protects us
as much as possible from upstream security breaches.

So far, with self-hosted compilers other than GCC, our recipes are
simply downloading pre-compiled binaries for the latest version of the
compiler.  This makes us more vulnerable than necessary, because it
means that every time we update one of these compilers, that is a new
opportunity to get hacked.

Instead, I would prefer to do something closer to what we do in our core
bootstrap.  We should produce our own bootstrap binaries for each of
these self-hosted compilers.  Like our GCC bootstrap binaries, these
binaries should be updated very rarely.  Then, we should use our own
bootstrap binaries to build the latest version of any self-hosted
compiler.  In some cases, if the bootstrap binaries are too old to build
the latest compiler, this might involve multiple steps.

Just as we have recipes to produce bootstrap gcc and binutils, we should
have recipes to build bootstrap binaries for each self-hosted compiler
in our system.  Each time we produce an updated bootstrap compiler from
an earlier one, it should be done with our deterministic package such
that this update step can be independently verified by anyone who wishes
to do so.

What do you think?

      Mark