The cmake step (configure) was actually run by symlinking vanilla clang and then was swapped back before the make step. The asciicasts were manually made so you will notice one starts before the other so they are roughly the same. I do really like your attention to detail though :)
"trusting trust" is a very interesting topic for a cloud compiler for sure. Funnily enough I was at the llvm developer meetup this month getting feedback on this exact topic.
There are many approaches to this. The easiest gain here avoiding that is using this for built bots. You use this service to speed up PR approval and discover breakages much faster, then build locally for your final release version to share with anyone.
For companies that need to have control of their own service for that reason we can provide enterprise accounts where they use their own cloud provider.
In general we download prebuilt compiler toolchains every day and use them without knowing if they are compromised. I don't see this as any different and would take same steps with an important product that needs protection from that problem before making a release version.
"trusting trust" is a very interesting topic for a cloud compiler for sure. Funnily enough I was at the llvm developer meetup this month getting feedback on this exact topic.
There are many approaches to this. The easiest gain here avoiding that is using this for built bots. You use this service to speed up PR approval and discover breakages much faster, then build locally for your final release version to share with anyone.
For companies that need to have control of their own service for that reason we can provide enterprise accounts where they use their own cloud provider.
In general we download prebuilt compiler toolchains every day and use them without knowing if they are compromised. I don't see this as any different and would take same steps with an important product that needs protection from that problem before making a release version.