Add serverVersion var set via ldflags

[wallyqs]

Setting a serverVersion variable which is set via ldflags to help security scanners like syft detect the version when inspecting the binary. Goreleaser is modified to set this ldflag and a test is added to make sure that the VERSION constant matches the tag from the release.

Result:

$ export TRAVIS_TAG=v2.10.18

$ go test -race -v -run=TestVersionMatchesTag ./server --trimpath -ldflags="-X=github.com/nats-io/nats-server/v2/server.serverVersion=$TRAVIS_TAG" -count=1 -vet=off

# Example failure
=== RUN   TestVersionMatchesTag
    server_test.go:144: Version (2.11.0-dev) does not match tag (2.10.18)
--- FAIL: TestVersionMatchesTag (0.00s)

$ go build --trimpath -ldflags="-X 'github.com/nats-io/nats-server/v2/server.serverVersion=$TRAVIS_TAG'" .

$ syft ./nats-server
NAME                               VERSION   TYPE     
...   
github.com/nats-io/nats-server/v2  v2.10.18  go-module    
...

[LaurentGoderre]

@wallyqs serverVersion isn't one of the detected one. The one that are supported are BuildVersion, GitVersion, ReleaseVersion or Tag. With that being said the flag can be there and not pointing to an actual variable in the code and Syft and it would work.

Nevermind, it works

[LaurentGoderre]

Funny it kind of went full circle to the original PR. Thank you so much for being open to this change!

[LaurentGoderre]

@wallyqs is this going to be backported for 2.9.x?

[wallyqs]

@LaurentGoderre no, there are no releases planned for v2.9 series

[LaurentGoderre]

@wallyqs the ldflag section is absent from the binary in the release because of the -trimpath flag. Is that something that is required?

[wallyqs]

@LaurentGoderre yes we need the --trimpath flag to have reproducible builds (https://go.dev/blog/rebuild). Latest release though seems to be ok for syft?

syft ./nats-server-v2.10.18-darwin-arm64/nats-server 
NAME                               VERSION   TYPE        
github.com/klauspost/compress      v1.17.9   go-module    
github.com/minio/highwayhash       v1.0.3    go-module    
github.com/nats-io/jwt/v2          v2.5.8    go-module    
github.com/nats-io/nats-server/v2  v2.10.18  go-module    
github.com/nats-io/nkeys           v0.4.7    go-module    
github.com/nats-io/nuid            v1.0.1    go-module    
go.uber.org/automaxprocs           v1.5.3    go-module    
golang.org/x/crypto                v0.25.0   go-module    
golang.org/x/sys                   v0.22.0   go-module    
golang.org/x/time                  v0.5.0    go-module    
stdlib                             go1.22.5  go-module  

[LaurentGoderre]

With the default Syft config yes but it gets them by doing a regex for anything that looks like a version in the binary. With Docker Scout we use a stricter rule and rely on the ldflag in the binary.

[LaurentGoderre]

Ha!! seems like you ran into this too!! golang/go#63432

[wallyqs]

@LaurentGoderre yes... that is what I was afraid we would stumble upon eventually (#5599 (comment)), but at least now situation has improved since syft does manage to get the version right.