Thanks for addressing my concern! [0]
Disclaimer: I don't know if my comment had anything to do with this post.
On a more cynical note however, I guess this works because all of the other tools involved (eg, sha256sum, git, clang++, ... and maybe the OS and anything running under the same user) are not implemented in Zig, since if they were, they could be infected with the Ken Thompson Virus (referenced near the start of the article), affecting the checksum.
For me it’s equally about resilience as it is about trust. The more independent paths exist to a functioning software ecosystem, the better positioned we are to recover from disasters of all kinds that might fragment our software world: legal, technological, sociopolitical. Bootstrapping efforts really get at the root of the problem, so I’m always excited to see them.
Great! And wonderful to see people building off the excellent work by all the people involved in bootstrappability from the Guix world (the GNU Mes people, I suppose, in particular).
Nice! I was planning to try this at some point to bootstrap my environment, so nice to know its possible.
Why not use gnu cmp instead of sha256sum?