How can I use GCC's -Wl,--build-id option to embed a verifiable identifier in an executable for backup restoration validation?

Using GCC -Wl,--build-id for backup restoration validation

To embed a verifiable identifier in a GCC‑linked executable and later confirm that a restored backup is byte‑for‑byte identical, use the linker option -Wl,--build-id (optionally specifying the hash algorithm). The identifier is stored in a .note.gnu.build-id section; extracting and comparing this value tells you whether the restored file matches the original.

Confirmed facts

• The -Wl,--build-id option is understood by the GNU linker (ld) and has been available in GCC toolchains for many releases.
• When used, the linker creates a .note.gnu.build-id section containing a cryptographic hash of the final linked file. By default the hash is MD5; you can request SHA‑1 or SHA‑256 with =sha1 or =sha256, or disable it with =none.
• The hash changes whenever any input object file, compiler flag, linker version, or library changes—even if the source code is unchanged.
• Extracting the value after linking can be done with readelf -n <file> or objdump -s .note.gnu.build-id <file>; the output is a hexadecimal digest that uniquely identifies that exact binary.

Likely explanation / steps

1. Compile (or link) your program requesting a specific hash, e.g. SHA‑256:

   gcc -Wl,--build-id=sha256 -o myprog myprog.c

2. Extract the build‑ID from the freshly built binary and record it:

   readelf -n myprog

   Look for the line showing the hex digest (e.g., Build ID: a1b2c3…). Store this value alongside your backup metadata.
3. Create the backup of the executable (e.g., cp myprog /backup/).
4. When needed, restore the binary to its target location.
5. Verify the restored copy by extracting its build‑ID and comparing it to the stored value:

   readelf -n /path/to/restored/myprog

   If the displayed digest matches the stored one exactly, the restored file is byte‑for‑byte identical to the original at backup time.

Assumptions and uncertainty

The build‑ID depends on the complete set of linked objects, the exact versions of GCC and the GNU linker, and all compiler/linker flags used. If you strip the binary with strip --strip-all, the .note.gnu.build-id section will be removed unless you explicitly keep it (e.g., strip --keep-section=.note.gnu.build-id). Different linker versions or non‑GNU linkers may not generate or interpret the section, so the workflow assumes a GNU toolchain on both build and restore environments.

Missing diagnostic detail

If readelf -n on either the original or restored binary shows no .note.gnu.build-id section, confirm that the executable was linked with the GNU linker and that the section was not stripped. This check determines whether the described verification method applies to your specific toolchain.