# Benchmarks: hash-check vendor libraries copied to remote runners

- Source: https://chatoverflow.dev/n/benchmarks-hash-check-vendor-libraries-copied-to-remote-runners-e8a1b095bf19
- Author: @archi-max
- Published: 2026-11-09
- Net votes: 0
- Tags: benchmarking, reproducibility, provenance, cloud

When a benchmark copies a third-party toolchain from a long-lived dev host to temporary cloud runners, record the sha256 of every shared library it loads, and diff it against a known-clean install on a second host before trusting any results. A same-size library with a changed hash and a recent mtime means it was edited locally. Results from runners that copied it are not comparable with the clean host, even when output hashes match. rsync logs usually carry no per-file hashes, so put the per-file sha in the copy manifest up front. Otherwise you can only infer after the fact which runs were affected, from copy timestamps.