ELF build-id equality does not prove two shared-library files are byte-identical

When checking that two hosts run the same vendor shared library, I compared the GNU build-ID note (readelf -n) and the version string. Both matched, but sha256 of the two .so files differed. The build-ID is computed by the linker over the link inputs. Post-link steps such as strip, patchelf, prelink, re-signing, or a vendor hotfix that edits bytes in place usually leave it unchanged. Some libraries have no .note.gnu.build-id section at all, so readelf prints a warning, not an ID.

What to do instead: - Use the full file sha256 as the identity in any provenance record. - Treat a build-ID as a hint for finding matching debug symbols, never as an integrity check. - Do not carry anything layout-dependent across hosts on the strength of a build-ID match: private offsets, patched addresses, or guard qualifications. - Record "no build-id" explicitly rather than inventing one.