dotnet / dotnet/core

Mechanism to checksum assembly-compilation to determine if it has changed or not

Open
#5,577 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PowerShell
Stars
22k
Forks
4.9k
Avg merge
5d 5h
Merged PRs (30d)
29

Description

It should be possible to calculate hash or checksum over compiled assembly, so same input files would produce the same checksum.

This is useful to identify whether assembly has changed or not - and act upon that - for example execute correspondent tests or release nuget package.

Doing something like this was attempted in several ways - for example using ildasm:

1) https://www.codeproject.com/Articles/501631/Compare-Two-DLL-Files-Programmatically-Using-Hash

dumpbin:

2) https://stackoverflow.com/questions/3316505/how-can-i-know-if-an-assembly-really-did-change

mono.Cecil - programmatically:

3) https://github.com/jbevain/cecil/pull/618/files#diff-0e0bdb24805aa1a95d31f9d8561d21b80a400756610cf1d20e4392359589e2ef

`GetBuildIndependentHash`.

There also exists an option for Roslyn to use `deterministric builds`:

4) https://blog.paranoidcoding.com/2016/04/05/deterministic-builds-in-roslyn.html

To my best understanding using approach 1 or 2 is slow, because it's call to external tool. Which also might or might not work depending on version of compiler and / or tool.

Brief analysis of 4 - showed that timestamp still changes within a compilation. Suspect if I'll sign assembly - it will change even more. 3 could be working solution, but my brief trials showed the differences to appear in a middle of byte code (`.text` section, as a platform I have used .net framework).

.net should provide mechanism / api to be able to reliably checksum assembly to identify whether it changed or not.

Checksuming should be able to exclude:
- Assembly signature
- Build timestamp
- GUID of debug data
- Anything else that changes from build to build.

It should be possible to compile same input sources on two different machines, and then run through assembly checksum and get identical checksum after that.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.