Make the build consistent across archs for Go to correctly report the package path inside the binary #32
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The amd64 build process is passing directly the
./main.go
file for the build. According to golang/go#36793, this results in Go not properly identifying the package and module path and then marking the compiled binary ascommand-line-arguments
. This doesn't happen with the arm64 build.The resulting effect is the following:
wharfie-amd64
wharfie-arm64
The
wharfie-amd64
binary lacks themod github.com/rancher/wharfie
identification. Although this is a minor thing and that doesn't affect the binary itself, it actually blocks security scanners, for example Trivy, from correctly matching the binary (and its path/module origin) with a VEX entry, as an example, see this entry.This was identified internally when a false-positive vulnerability that was supposed to be suppressed was still being reported in the scanning reports.