Hello, I am the project manager for the open source Bacula project, and I have been a bit surprised by recent emails talking about checksumming binaries. My experience is that you cannot simply apply a checksum to a binary and compare it to another binary to determine if the code is the same. Having long ago written a linker, this seems to me obvious since the compiling and linking process can write out bytes that come from uninitialized memory, which means there are certain areas of binaries that will be random, unless you have compilers and linkers that methodically clear all static memory that is not initialized. In addition, although the binary is likely to be constructed of the various object files in the same order each time, this is not 100% guaranteed especially if a linker uses multiple threads to find and pull together the object files needed to build the binary.
As a test this morning, I produced 16 Windows binaries as release by the Bacula project. They are build on a Linux machine (Ubuntu 12.04) using cross-compiling primarily with GNU g++. After producing the binaries, I took the "md5sum" of each of the files. I then re-ran the exact same build script with no changes made in anything since the first binaries and produced a second set of binaries. Not surprisingly, the md5sums of the second set of binaries do not match those of the first set. My conclusion is that any attempt to checksum binaries for determining if they come from the same source code will be very difficult to get right. Best regards, Kern Sibbald Bacula Project Manager
