> Is it possible to flag certain bits of data as known-to-change and evaluate the rest of the build in isolation? This is what I do. I'm working with a hardwar

> Is it possible to flag certain bits of data as known-to-change and evaluate the rest of the build in isolation? This is what I do. I'm working with a hardware vendor that is not particularly security-conscious. I have to send them compiled binaries as part of a build pipeline, which they then modify in a non-deterministic way. Fortunately the changes are limited to data which has no impact on the function of the software. So I've created hashes of all the individual components that make up the binaries, and I skip hashing the parts that they modify. It's not ideal, but I can be reasonably confident that the binaries I compile function the same as the binaries that my hardware vendor distributes.