Support using sha256 as --build-id kind

[serge-sans-paille]

Summary

Both sha1 and md5 are considered deprecated, it would be great to support a more recent/secure hashing algorithm to compute build id

[serge-sans-paille]

No test case yet, I'll add them if the commit makes sense.

[MaskRay]

The SHA-1 deprecation, AFIAK, is for digital signature.
ld.lld's --build-id feature, as I know, has no validation tool. It is used for "approximation of true uniqueness across all binaries that might be used by overlapping sets of people" (https://fedoraproject.org/w/index.php?title=RolandMcGrath/BuildID&oldid=16098), not for security purposes.
So I think the description

Both sha1 and md5 are considered deprecated,

does not apply.

That said, adding the option is straightforward/simply. If useful, we can add it, but the justification needs to be higher than "Transport Layer Security has phased out SHA-1, so we follow suit"
Will GNU ld add this option?

[joerg]

Exactly. This patch only provides a way to tick a checkbox on a stupid compliance list. SHA2 provides no security benefit here for the price of slower linking. If we want to use a more modern cryptographic hash function, the primary criterion should be performance, IMO.

[serge-sans-paille]

In D113991#3135869, @joerg wrote:

Exactly. This patch only provides a way to tick a checkbox on a stupid compliance list. SHA2 provides no security benefit here for the price of slower linking. If we want to use a more modern cryptographic hash function, the primary criterion should be performance, IMO.

I second that opinion :-) Then blake2 (see https://en.wikipedia.org/wiki/BLAKE_(hash_function)) would be a good match. The reference implementation is covered by the Apache Public License 2.0 so that would be fine license wise, and it claims to be "faster than MD5, SHA-1, SHA-2, and SHA-3, on 64-bit x86-64 and ARM architectures"

[MaskRay]

In 2020-01 I did notice that build-id may be a performance bottleneck. The need to import external code made me unsure whether it is justified.

If you are motivated, you may check the benchmark and check this issue for SHF_STRINGS|SHF_MERGE https://bugs.llvm.org/show_bug.cgi?id=37029

Also note that our SHA1 impl is inefficient. There is room for improvement, e.g. D69295

[MaskRay]

I created D121531 to use BLAKE3.

[serge-sans-paille]

Blake3 adopted instead

lld/ELF/Config.h

enum ELFKind {
   ELF64BEKind
 };
 
 // For -Bno-symbolic, -Bsymbolic-non-weak-functions, -Bsymbolic-functions,
 // -Bsymbolic.
 enum class BsymbolicKind { None, NonWeakFunctions, Functions, All };
 
 // For --build-id.
-enum class BuildIdKind { None, Fast, Md5, Sha1, Hexstring, Uuid };
+enum class BuildIdKind { None, Fast, Md5, Sha1, Sha256, Hexstring, Uuid };
 
 // For --discard-{all,locals,none}.
 enum class DiscardPolicy { Default, All, Locals, None };
 
 // For --icf={none,safe,all}.
 enum class ICFLevel { None, Safe, All };
 
 // For --strip-{all,debug}.

lld/ELF/Driver.cpp

getBuildId(opt::InputArgList &args) {
 
   StringRef s = arg->getValue();
   if (s == "fast")
     return {BuildIdKind::Fast, {}};
   if (s == "md5")
     return {BuildIdKind::Md5, {}};
   if (s == "sha1" || s == "tree")
     return {BuildIdKind::Sha1, {}};
+  if (s == "sha256")
+    return {BuildIdKind::Sha256, {}};
   if (s == "uuid")
     return {BuildIdKind::Uuid, {}};
   if (s.startswith("0x"))
     return {BuildIdKind::Hexstring, parseHex(s.substr(2))};
 
   if (s != "none")
     error("unknown --build-id style: " + s);
   return {BuildIdKind::None, {}};

lld/ELF/SyntheticSections.cpp

static size_t getHashSize() {
   switch (config->buildId) {
   case BuildIdKind::Fast:
     return 8;
   case BuildIdKind::Md5:
   case BuildIdKind::Uuid:
     return 16;
   case BuildIdKind::Sha1:
     return 20;
+  case BuildIdKind::Sha256:
+    return 32;
   case BuildIdKind::Hexstring:
     return config->buildIdVector.size();
   default:
     llvm_unreachable("unknown BuildIdKind");
   }
 }
 
 // This class represents a linker-synthesized .note.gnu.property section.

lld/ELF/Writer.cpp

 #include "lld/Common/Filesystem.h"
 #include "lld/Common/Memory.h"
 #include "lld/Common/Strings.h"
 #include "llvm/ADT/StringMap.h"
 #include "llvm/ADT/StringSwitch.h"
 #include "llvm/Support/Parallel.h"
 #include "llvm/Support/RandomNumberGenerator.h"
 #include "llvm/Support/SHA1.h"
+#include "llvm/Support/SHA256.h"
 #include "llvm/Support/TimeProfiler.h"
 #include "llvm/Support/xxhash.h"
 #include <climits>
 
 #define DEBUG_TYPE "lld"
 
 using namespace llvm;
 using namespace llvm::ELF;
computeHash(buildId, buf, [&](uint8_t *dest, ArrayRef<uint8_t> arr) {
       memcpy(dest, MD5::hash(arr).data(), hashSize);
     });
     break;
   case BuildIdKind::Sha1:
     computeHash(buildId, buf, [&](uint8_t *dest, ArrayRef<uint8_t> arr) {
       memcpy(dest, SHA1::hash(arr).data(), hashSize);
     });
     break;
+  case BuildIdKind::Sha256:
+    computeHash(buildId, buf, [&](uint8_t *dest, ArrayRef<uint8_t> arr) {
+      memcpy(dest, SHA256::hash(arr).data(), hashSize);
+    });
+    break;
   case BuildIdKind::Uuid:
     if (auto ec = llvm::getRandomBytes(buildId.data(), hashSize))
       error("entropy source failure: " + ec.message());
     break;
   default:
     llvm_unreachable("unknown BuildIdKind");
   }
   for (Partition &part : partitions)