but what about the C compiler that you received in the package?

it is an untrusted executable too and could insert viruses into the build.

The true GNU will assemble lex and yacc and build their own compiler, then they will download and build all the library functions from their source and then they will download the gnucleus source and build that next but the GNU finds that to link his EXE he now needs M$ libraries that he won't be able to compile because there is no source.

of course how true GNU could he be running windows...