🌱 Trusting Trust: Bootstrapping Nix From a Verified Seed

A quick pointer 👉.. I wrote a post over at the Helsing engineering blog about bootstrapping Nix from a manually verified 256-byte seed, and what it actually takes to answer Ken Thompson's trusting-trust question.

The short version

Back in 1984, Ken Thompson's Reflections on Trusting Trust showed that a compromised compiler can hide a backdoor in the binaries it produces, including in itself, while leaving every line of source code clean. You cannot read a backdoor out of a binary 🕳️.. so how far down does your trust actually reach?

At work we tried to give that a concrete answer. The post walks through a three-step bootstrap:

• Build Nix from pinned source, with every dependency tracked in an SBOM, ending at a statically linked binary with zero runtime dependencies.
• Start the toolchain from stage0-posix instead of inheriting a pre-built compiler, beginning from a 256-byte hex0 seed small enough to read by hand.
• Audit that seed exhaustively, 121 checks over the ELF header, every instruction, every jump target, and all five syscalls it makes. No network, no mmap, no ptrace, no fork, no exec.

The result turns Thompson's philosophical "can you ever really trust a tool you didn't build yourself?" into something you can actually verify, grounded in a tiny pile of readable code instead of an inherited binary 🔍.

Go read it

The full write-up, with the audit walkthrough and the SBOM reasoning, lives here:

👉 Trusting trust: bootstrapping Nix from source on the Helsing blog.