feat(go): parse main mod version from build info settings

[oatovar]

Description

• Parse the build info for -ldflags. If included, the flags will be further parsed, and searched for -X sub-flags. These sub-flags are commonly used to set the binary version during build time. A common pattern is to run go build -ldflags='-X main.version=<semver>' so that the main package's version variable is replaced with the latest tag. It's not guaranteed that this flag will propogate into the binary. See cmd/go: using --trimpath in go build removes -ldflags from go version -m output golang/go#63432 for more info.

• Flag parsing reuses the pflags library that's used by the main Trivy binary. This keeps the implementation concise, and a bit more robust than creating a custom flag parser for -X flag commonly passed to -ldflags.

• Add simple binary to test for validity of ldflags parsing.

• The documentation has been updated to reflect the improved accuracy of the Go binary parser.

Related issues

• Relates to Detect the version of the Go binary itself #1837
• Relates to Allow users to scan vulnerabilities in the Go binary itself #6521

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

Output in CycloneDX

    {
      "bom-ref": "pkg:golang/github.com/aquasecurity/trivy@0.50.1-65-ge80e222e9",
      "type": "library",
      "name": "github.com/aquasecurity/trivy",
      "version": "0.50.1-65-ge80e222e9",
      "purl": "pkg:golang/github.com/aquasecurity/trivy@0.50.1-65-ge80e222e9",
      "properties": [
        {
          "name": "aquasecurity:trivy:LayerDiffID",
          "value": "sha256:41f456757360f81ad1905937cc923e2d07edb9f590e1de739e18a56543b905c1"
        },
        {
          "name": "aquasecurity:trivy:PkgType",
          "value": "gobinary"
        }
      ]
    }

[oatovar]

I used a test project to test the new parsing ability with test data. I wasn't sure how to generate the test data otherwise. Please let me know if there's something that I've missed about this.

[oatovar]

Fixed the unit test that changed after the merge conflict. 😢 I forgot to run mage test:unit before pushing that resolution, sorry.

[knqyf263]

Thanks for your great contribution! Looks almost good. I left some comments.

We'd love to include it in v0.51.0, which will be released this week. Please let me know if you don't have time. We'll add small tweaks and wrap it up.

[knqyf263]

What if validating semver?

Suggested change

	if strings.HasSuffix(key, "version") || strings.HasSuffix(key, "ver") {
	if (strings.HasSuffix(key, "version") || strings.HasSuffix(key, "ver")) && semver.IsValid(value) {

[knqyf263]

I don't think we need the original usage here.

[knqyf263]

StringToStringVarP possibly simplifies parsing.

Suggested change

	var x []string
	fset.StringSliceVarP(&x, "", "X", nil, `Set the value of the string variable in importpath named name to value.
	This is only effective if the variable is declared in the source code either uninitialized
	or initialized to a constant string expression. -X will not work if the initializer makes
	a function call or refers to other variables.
	Note that before Go 1.5 this option took two separate arguments.`)
	if err := fset.Parse(flags); err != nil {
	p.logger.Error("Could not parse -ldflags found in build info", "err", err)
	return ""
	}
	for _, xx := range x {
	// It's valid to set the -X flags with quotes so we trim any that might
	// have been provided: Ex:
	//
	// -X main.version=1.0.0
	// -X=main.version=1.0.0
	// -X 'main.version=1.0.0'
	// -X='main.version=1.0.0'
	// -X="main.version=1.0.0"
	// -X "main.version=1.0.0"
	xx = strings.Trim(xx, `'"`)
	key, val, found := strings.Cut(xx, "=")
	if !found {
	p.logger.Debug("Unable to parse an -ldflags -X flag value", "got", xx)
	continue
	}
	var x map[string]string
	fset.StringToStringVarP(&x, "", "X", nil, "")
	if err := fset.Parse(flags); err != nil {
	p.logger.Error("Could not parse -ldflags found in build info", "err", err)
	return ""
	}
	for key, value := range x {
	key = strings.ToLower(key)
	// The check for a 'ver' prefix enables the parser to pick up Trivy's own version value that's set.
	if (strings.HasSuffix(key, "version") || strings.HasSuffix(key, "ver")) && semver.IsValid(value) {
	return value
	}
	}```

[knqyf263]

The input is so varied that it is worth exporting this method and writing tests for it.

Suggested change

	func (p *Parser) parseLDFlags(name string, flags []string) string {
	func (p *Parser) ParseLDFlags(name string, flags []string) string {

func TestParser_ParseLDFlags(t *testing.T) {
	type args struct {
		name  string
		flags []string
	}
	tests := []struct {
		name string
		args args
		want string
	}{
		{
			name: "normal",
			args: args{
				name: "github.com/aquasecurity/trivy",
				flags: []string{
					"-s",
					"-w",
					"-X=foo=bar",
					"-X='github.com/aquasecurity/trivy/pkg/version.ver=0.50.1'",
				},
			},
			want: "0.50.1",
		},
		{
			name: "empty",
			args: args{
				name:  "github.com/aquasecurity/test",
				flags: []string{},
			},
			want: "",
		},
                ... (more tests) ...
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			p := binary.NewParser().(*binary.Parser)
			assert.Equal(t, tt.want, p.ParseLDFlags(tt.args.name, tt.args.flags))
		})
	}
}

[knqyf263]

Suggested change

	log.Debug("Parsing dependency's build info settings", "dependency", name, "-ldflags", flags)
	p.logger.Debug("Parsing dependency's build info settings", "dependency", name, "-ldflags", flags)

[oatovar]

@knqyf263 Thank you for the review. Having use the pflag library in the past, I had overlooked the StringToStringVarP functionality - it's very powerful! I've applied your suggestions, and I think the PR is ready for another review.

[knqyf263]

Great! I'll take another look today.

[knqyf263]

Looks good! I left very small comments.

[oatovar]

Thank you for catching those errors 😄 I've applied them all.

[knqyf263]

Thanks for your contribution!