Don't forget to channel Ken Thompson ("Reflections on Trusting Trust") -- you can read the source code, but where did you get the compiler?

This can be mitigated by Bootstrappable builds: https://news.ycombinator.com/item?id=41368835