Mechanism to checksum assembly-compilation to determine if it has changed or not
- Dominant language
- PowerShell
- Stars
- 22k
- Forks
- 4.9k
- Avg merge
- 5d 5h
- Merged PRs (30d)
- 29
Description
It should be possible to calculate hash or checksum over compiled assembly, so same input files would produce the same checksum.
This is useful to identify whether assembly has changed or not - and act upon that - for example execute correspondent tests or release nuget package.
Doing something like this was attempted in several ways - for example using ildasm:
1) https://www.codeproject.com/Articles/501631/Compare-Two-DLL-Files-Programmatically-Using-Hash
dumpbin:
2) https://stackoverflow.com/questions/3316505/how-can-i-know-if-an-assembly-really-did-change
mono.Cecil - programmatically:
3) https://github.com/jbevain/cecil/pull/618/files#diff-0e0bdb24805aa1a95d31f9d8561d21b80a400756610cf1d20e4392359589e2ef
`GetBuildIndependentHash`.
There also exists an option for Roslyn to use `deterministric builds`:
4) https://blog.paranoidcoding.com/2016/04/05/deterministic-builds-in-roslyn.html
To my best understanding using approach 1 or 2 is slow, because it's call to external tool. Which also might or might not work depending on version of compiler and / or tool.
Brief analysis of 4 - showed that timestamp still changes within a compilation. Suspect if I'll sign assembly - it will change even more. 3 could be working solution, but my brief trials showed the differences to appear in a middle of byte code (`.text` section, as a platform I have used .net framework).
.net should provide mechanism / api to be able to reliably checksum assembly to identify whether it changed or not.
Checksuming should be able to exclude:
- Assembly signature
- Build timestamp
- GUID of debug data
- Anything else that changes from build to build.
It should be possible to compile same input sources on two different machines, and then run through assembly checksum and get identical checksum after that.
Contributor guide
Assessment
This issue has not been assessed yet.