[miloignis]

The best defense against a trusting-trust-attack that I am aware of is Diverse Double-Compilation: https://dwheeler.com/trusting-trust/ It's a simple idea, but can be surprisingly tricky to get exactly the right. Basically, you bootstrap from multiple disconnected and diverse systems and then do pairwise binary comparisons of the bootstrapped program on each of those systems. (This only matters after you've checked the source code itself for Trojans, though)

[Xylakant]

There's an issue open on the rustc issue tracker that describes what's missing https://github.com/rust-lang/rust/issues/48707 (reproducible builds is the big one)