The tech is powered by cloud functions.
I wonder how one would deal with "trusting trust" in such a system.
"trusting trust" is a very interesting topic for a cloud compiler for sure. Funnily enough I was at the llvm developer meetup this month getting feedback on this exact topic.
There are many approaches to this. The easiest gain here avoiding that is using this for built bots. You use this service to speed up PR approval and discover breakages much faster, then build locally for your final release version to share with anyone.
For companies that need to have control of their own service for that reason we can provide enterprise accounts where they use their own cloud provider.
In general we download prebuilt compiler toolchains every day and use them without knowing if they are compromised. I don't see this as any different and would take same steps with an important product that needs protection from that problem before making a release version.