0

I understand that repeat builds of an assembly from the same source code produce binaries with tiny differences: http://blog.paranoidcoding.com/2016/04/05/deterministic-builds-in-roslyn.html

  • MVID: a GUID identifying the PE which is newly generated for every PE produced by the compiler 1.
  • PDB ID: a GUID identifying the PDB matching PDB which is newly generated on every build.
  • Date / Time stamp: Seconds since the epoch which is calculated on every build.

What does that imply for Assembly.Evidence ? Is it consistent between repeat builds (from the same source code)?

In particular, Assembly.Evidence.OfType<Hash>. How is the hash calculated? Does it depend on the variables above? Ideally for me, the hash would depend on the rest of the assembly, excluding the identifiers that vary.

Colonel Panic
  • 132,665
  • 89
  • 401
  • 465

1 Answers1

-1

Easy enough to test:

using System;
using System.Reflection;
using System.Security.Policy;

namespace PlayAreaCSCon
{
    internal static class Program
    {
        static void Main(string[] args)
        {
            foreach(var b in (new Hash(Assembly.GetExecutingAssembly()).SHA1))
            {
                Console.Write("{0} ", b);
            }
            Console.WriteLine();
            Console.WriteLine("Complete");
            Console.ReadLine();
        }
    }
}

First run:

142 101 89 23 98 132 149 74 68 183 142 168 97 165 177 25 31 209 15 108
Complete

Do a clean/build, and run again:

58 42 138 106 209 240 236 116 168 108 220 244 104 190 71 211 254 9 11 176
Complete

So, no, Assembly.Evidence (specifically, any involving Hash) is not consistent between builds.

Damien_The_Unbeliever
  • 234,701
  • 27
  • 340
  • 448
  • The OP already knows that the assembly changes, he's fretting over the Evidence property. I don't know why either. – Hans Passant Sep 13 '18 at 11:52
  • @HansPassant - yes, and I'm demonstrating what the `Hash` evidence class actually produces when you pass it an assembly, which I though was the essence of what they wanted to see. – Damien_The_Unbeliever Sep 13 '18 at 11:53