From 639de5db64d7762e375fe41964f47e7f1b7f666f Mon Sep 17 00:00:00 2001 From: Guillaume Marty Date: Tue, 3 Nov 2026 16:20:09 +0100 Subject: [PATCH] fix: keep dot-separated pre-release identifiers in Go ldflags versions (#5422) The ldflags version regexes stopped at the first dot after the patch number, so v1.28.0-rc.1 was reported as v1.28.0-rc. Signed-off-by: Guillaume Marty <279286709+LemonCondor@users.noreply.github.com> Co-authored-by: Guillaume Marty <279286709+LemonCondor@users.noreply.github.com> --- syft/pkg/cataloger/golang/parse_go_binary.go | 4 ++-- syft/pkg/cataloger/golang/parse_go_binary_test.go | 14 ++++++++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/syft/pkg/cataloger/golang/parse_go_binary.go b/syft/pkg/cataloger/golang/parse_go_binary.go index 002e44d43..0ba8eafa3 100644 --- a/syft/pkg/cataloger/golang/parse_go_binary.go +++ b/syft/pkg/cataloger/golang/parse_go_binary.go @@ -41,8 +41,8 @@ var ( // inject the correct version into the main module of the build process knownBuildFlagPatterns = []*regexp.Regexp{ - regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([rR]elease)?([gG]it)?([bB]uild)?[vV]er(sion)?=(\S+/)*(?Pv?\d+.\d+.\d+[-\w]*)`), - regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([tT]ag)=(\S+/)*(?Pv?\d+.\d+.\d+[-\w]*)`), + regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([rR]elease)?([gG]it)?([bB]uild)?[vV]er(sion)?=(\S+/)*(?Pv?\d+.\d+.\d+[-\w]*(?:\.[-\w]+)*)`), + regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([tT]ag)=(\S+/)*(?Pv?\d+.\d+.\d+[-\w]*(?:\.[-\w]+)*)`), } ) diff --git a/syft/pkg/cataloger/golang/parse_go_binary_test.go b/syft/pkg/cataloger/golang/parse_go_binary_test.go index 1b5b58f23..5430c2933 100644 --- a/syft/pkg/cataloger/golang/parse_go_binary_test.go +++ b/syft/pkg/cataloger/golang/parse_go_binary_test.go @@ -1285,6 +1285,20 @@ func Test_extractVersionFromLDFlags(t *testing.T) { wantMajorVersion: "2", wantFullVersion: "v2.4.5", }, + { + name: "pre-release version with dot-separated identifiers", + mainModule: "github.com/foo/bar", + ldflags: ` build -ldflags="-s -w -X 'github.com/foo/bar/version.gitVersion=v1.28.0-rc.1' -X github.com/foo/bar/version.gitCommit=abc123"`, + wantMajorVersion: "1", + wantFullVersion: "v1.28.0-rc.1", + }, + { + name: "pre-release version with multiple dot-separated identifiers", + mainModule: "github.com/foo/bar", + ldflags: ` build -ldflags="-X main.version=2.0.0-beta.2.1"`, + wantMajorVersion: "2", + wantFullVersion: "v2.0.0-beta.2.1", + }, /////////////////////////////////////////////////////////////////// // don't know how to handle these... yet //{