The Free and Open Source Software Yearly conference, known as FOSSY, took place at the University of British Columbia (UBC) in Vancouver, Canada, after being held in Portland, Oregon for the previous three years. The conference featured a variety of talks, including one by Timothy Sample on bootstrappable builds, a concept that is less widely known than reproducible builds. A bootstrappable build begins with a minimal program that can create larger programs, ultimately allowing for the construction of a complete Linux user space from a small seed, ensuring a clear origin of the code.
Sample engaged attendees by asking if they were familiar with bootstrappable builds, noting that many were aware of the term. He shared that he began exploring this concept nearly ten years ago while using GNU Guix, a functional package manager inspired by Nix. In both Guix and Nix, software is represented in a derivation graph that outlines how to build each program, detailing the necessary inputs and their respective build processes. Sample illustrated the complexity of modern software by discussing the dependencies of a Python program, which requires a C compiler, leading to further dependencies.
For systems like Debian, the build process often relies on pre-built binaries, while Guix initially depended on a large, statically linked collection of GNU user-space programs. Bootstrappable builds aim to eliminate reliance on pre-built artifacts, allowing for a build process that starts from scratch. Sample likened this to making yogurt or sourdough bread, where an existing product is needed to begin the process.
Reproducible builds provide assurance that a binary matches its source code, while bootstrappable builds address a different issue: verifying the integrity of the build process itself. Sample referenced Ken Thompson's Turing Award lecture, which highlighted potential vulnerabilities in compilers, including the risk of hidden backdoors.
The security benefits of bootstrappable builds are significant, as they help ensure that the source code corresponds to the running program. Sample emphasized the importance of clear and understandable code, which can be inspected and verified. He discussed the proactive approach to bootstrapping, which involves maintaining non-self-hosted versions of compilers alongside self-hosted ones to prevent hidden flaws.
Sample also described techniques used by the bootstrappable-builds community to address challenges with self-hosting, including an archaeological approach that traces the history of a project to find earlier, non-self-hosted versions. He noted that while this process can be slow and complex, it is necessary for verification.
The talk included examples of build chains in various programming languages, highlighting the complexities involved in bootstrapping modern tools. Sample mentioned that Guix's current seed is only 256 bytes, a significant reduction from previous versions, and discussed ongoing efforts to improve the bootstrapping process, including addressing the kernel bootstrapping issue.
A related project, live-bootstrap, works with Guix and explores bootstrapping kernels, although it is noted to be more complicated. Sample concluded by presenting the detailed steps involved in bootstrapping a base Linux system, emphasizing the complexity and the need for further improvements in the process.