Backport to 1.9?

I don't think this will be correct or reliable. We already should have checked this in a more reliable way elsewhere. What we did not check is the checksum value matches (we check the pkgimages, but specifically exclude the sysimg from that test by setting it to zero)

Hm... I thought we were already doing this. This is a fine strategy, but I would prefer Base just being a normal package in the dependent module list that we verify

Hmm, actually Base is listed in the depmods, so indeed the build_id and uuid are already checked.

What we did not check is the checksum value matches (we check the pkgimages, but specifically exclude the sysimg from that test by setting it to zero)

@vtjnash, can you link to where we set it to zero? AFAICT the issue is that we don't check the checksum of each depmod:
https://github.com/JuliaLang/julia/blob/master/src/staticdata_utils.c#L1145-L1159

and the check at package-loading time only checks the checksum of the package itself:

So is the right fix to start encoding the sysimage checksum in each package header? I'm not certain I understand what your comment really means, hoping to clarify my understanding of what you mean.

Those build_ids are actually checksums for the pkgimag, but we don't load the checksum for the sysimg into those.

I see, so it sounds like the right fix is to stop using 0 as the build_id for the sysimage. I can make that change, hopefully by tomorrow.