Include crypto hash of Portable PDB content in the PE debug directory as a new record

[tmat]

See dotnet/roslyn#24429 for corresponding work item in Roslyn compilers.

Background

The PE file (.dll, .exe) currently stores a GUID and a 4B timestamp, which comprise PDB ID, in the debug directory that uniquely identify the content of the Portable PDB. PDB ID is calculated using SHA1 hash in deterministic builds and as random time-based bits in non-deterministic build.

PDB ID allows the debugger to find the right PDB for given PE file. PDB ID is however not good enough for security purposes, when we need to detect whether the PDB content was tempered with. To allow such check we need to use stronger hash. The hash algorithm also needs to be configurable so that it can be upgraded to even stronger one in future.

Proposal

When emitting Portable PDB the compiler uses a given crypto algorithm (SHA-256 by default) to calculate hash of the PDB content. It stores the algorithm id and the full hash to a new debug directory entry. In deterministic build it uses 20B of the hash to calculate PDB ID.

This work is currently scoped to Portable PDBs only, not to Windows PDBs. We will follow up on Windows PDBs later once required native PDB APIs are available.

(details TBD)

[tmat]

@KevinRansom FYI

[KevinRansom]

Spec: https://github.com/dotnet/corefx/blob/master/src/System.Reflection.Metadata/specs/PE-COFF.md#pdb-checksum-debug-directory-entry-type-19

PR: dotnet/roslyn#24711