If your system is compromised, nothing is trustable. Not the kernel, not the sync utilities (which on a FreeBSD system would be the first thing to alter), not anything. I did not miss the part about syncing to master. If there's a rootkit it will either make sure your sync still has its changes, or it will simply not install files silently. It could also modify your compiler to produce backdoors in your executables (For more on this one in particular, look at this http://www.acm.org/classics/sep95/Turing Award Lecture by Ken Thompson, one of the original people involved with Unix. This has been done before, and can be done again.
I repeat--If your system has been compromised, you can only rely on things that are non-modifyable by the system (I.E. BIOS ROM, unconnected disks). Your filesystem driver cannot be trusted. Expect it to lie whenever it needs to. Assume that the rootkit will not do anything that will help you find it. Syncing your source tree depends on way too many things that would be compromised to rely on (filesystem, network driver, sync utilities, libc, etc). The same goes for any other software update of any kind (excluding livecds -- assuming said rootkit didn't change your BIOS).
Ok, so I've been mulling over a little idea, for a OSS project:
Given the current availibility of CMU Sphinx & (multiple?)TTS projects, I think it would be a good idea to combine them to form a "voice shell" of some kind--something not unlike Speakable Items on OSX, but capable of opening arbitrary applications (ala Katapult) or executing shell commands using some specific dictation syntax.
In every hierarchy the cream rises until it sours. -- Dr. Laurence J. Peter