fix: keep dot-separated pre-release identifiers in Go ldflags versions (#5422)

The ldflags version regexes stopped at the first dot after the patch
number, so v1.28.0-rc.1 was reported as v1.28.0-rc.

Signed-off-by: Guillaume Marty <279286709+LemonCondor@users.noreply.github.com>
Co-authored-by: Guillaume Marty <279286709+LemonCondor@users.noreply.github.com>

syft/pkg/cataloger/golang/parse_go_binary.go

@@ -41,8 +41,8 @@ var (
 	// inject the correct version into the main module of the build process
 
 	knownBuildFlagPatterns = []*regexp.Regexp{
-		regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([rR]elease)?([gG]it)?([bB]uild)?[vV]er(sion)?=(\S+/)*(?P<version>v?\d+.\d+.\d+[-\w]*)`),
+		regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([rR]elease)?([gG]it)?([bB]uild)?[vV]er(sion)?=(\S+/)*(?P<version>v?\d+.\d+.\d+[-\w]*(?:\.[-\w]+)*)`),
-		regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([tT]ag)=(\S+/)*(?P<version>v?\d+.\d+.\d+[-\w]*)`),
+		regexp.MustCompile(`(?m)\.[a-zA-Z0-9]*([tT]ag)=(\S+/)*(?P<version>v?\d+.\d+.\d+[-\w]*(?:\.[-\w]+)*)`),
 	}
 )
 

syft/pkg/cataloger/golang/parse_go_binary_test.go

@@ -1285,6 +1285,20 @@ func Test_extractVersionFromLDFlags(t *testing.T) {
 			wantMajorVersion: "2",
 			wantFullVersion:  "v2.4.5",
 		},
+		{
+			name:             "pre-release version with dot-separated identifiers",
+			mainModule:       "github.com/foo/bar",
+			ldflags:          `	build	-ldflags="-s -w -X 'github.com/foo/bar/version.gitVersion=v1.28.0-rc.1' -X github.com/foo/bar/version.gitCommit=abc123"`,
+			wantMajorVersion: "1",
+			wantFullVersion:  "v1.28.0-rc.1",
+		},
+		{
+			name:             "pre-release version with multiple dot-separated identifiers",
+			mainModule:       "github.com/foo/bar",
+			ldflags:          `	build	-ldflags="-X main.version=2.0.0-beta.2.1"`,
+			wantMajorVersion: "2",
+			wantFullVersion:  "v2.0.0-beta.2.1",
+		},
 		///////////////////////////////////////////////////////////////////
 		// don't know how to handle these... yet
 		//{