Verified it worked:

I'm not certain this information should get encoded into shipping artifacts. That SHA doesn't represent the shipping state. This information will be most certainly incorrect during servicing or in case of security fixes that are made directly against the VMR.

IOW this is an intermediate (an implementation detail about how we build the product) that shouldn't ship to customers.

Question: Do we only want to do this for nightlies? Should it be disabled for official builds?

That would be an option. Or only adding this in Debug / non-Release Configuration builds?

@ViktorHofer I don't agree. When we added this feature we discussed this and everyone is aware that it is not 100% correct at all times, but its still very useful to know what the origin is.

Question: Do we only want to do this for nightlies? Should it be disabled for official builds?

That would be an option. Or only adding this in Debug / non-Release Configuration builds?

What we're trying to improve is how easy it is to investigate performance issues. Debug/non-release builds aren't used for benchmarking, nightlies are used. So that could be a good option if we want to avoid the metadata in official builds.

Agreed. I think this is reasonable as an informational only.