Status: Development
This document defines the required attributes of Mapping
messages.
A message representing a Mapping
MUST have at least one of the following
process attributes:
process.executable.build_id.gnu
process.executable.build_id.go
process.executable.build_id.htlhash
If possible all the above listed attributes SHOULD be present in a Mapping
. To promote interoperability, it is RECOMMENDED for process.executable.build_id.htlhash
to be present in every Mapping
. For the use and purpose of process.executable.build_id.go
see golang/go#68652.
In some environments GNU and/or Go build_id values are stripped or not usable - for example Alpine Linux which is often used as a base for Docker environments. For that reason and to promote interoperability, a deterministic build_id generation algorithm that hashes the first and last page of a file together with its length is defined as:
Input ← Concat(File[:4096], File[-4096:], BigEndianUInt64(Len(File)))
Digest ← SHA256(Input)
BuildID ← Digest[:16]
where Input
is the concatenation of the first and last 4096 bytes of the file (may overlap, not padded) and the 8 byte big-endian serialization of the file length. The resulting BuildID
is the truncation of the hash digest to 16 bytes (128 bits), in hex string form.