I believe this is this is the dependency chain your live-bootstrap works through: https://github.com/oriansj/talk-notes/raw/master/live-bootst...
While we can definitely discuss whether it's practical for anyone to actually audit all that source code (no it is not), proving a 356 bytes codestream isn't malicious seems like a good foundation to argue about.
Perhaps this bit is key as you could cross reference the two:
> Furthermore, having an alternative bootstrap automation tool allows people to have greater trust in the bootstrap procedure.
Interesting thought exercise.
Edit: Avoid this subject unless you want to be nerd sniped and spiral into paranoia.
In particular, this the very first step: https://github.com/oriansj/stage0-posix/blob/master/x86/hex0... (or its hand-edited binary version ?)
Edit: this how it's "assembled":
sed 's/[;#].*$//g' $input_file | xxd -r -p > $output_file
See: https://github.com/oriansj/bootstrap-seeds/blob/master/READM...