Drop -s from the documented source build example - #42
Merged
Conversation
The release pipeline deliberately keeps -w and omits -s so govulncheck -mode=binary can see which packages a published artifact actually links, and scripts/assert-go-symbols.sh fails the build when the Go symbol table is missing. The README still demonstrated -s -w, which contradicts that policy and reproduces the unassessable binaries the guard exists to prevent.
LouisLotter
approved these changes
Sep 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
x/cryptoremediation tracked by cve-reporter#57 needs no source change —mainalready carriesgolang.org/x/crypto v0.56.0, at or above the fixed version of all three reported HIGH advisories. This pull request therefore does not bump anything; it closes the one residual source inconsistency left by #37, which was raised as a review suggestion on the previous cycle..goreleaser.ymldeliberately passes-wwithout-ssogovulncheck -mode=binarycan see which packages a published artifact actually links, andscripts/assert-go-symbols.shfails the build when the Go symbol table is missing.README.mdstill demonstrated-s -w, which contradicts that policy and tells a reader to reproduce exactly the unassessable binary the guard exists to reject.This is not hypothetical: the published
v0.8.4Windows asset embeds-ldflags="-s -w ...", so it predates the-sremoval and is itself unassessable.The
-s -wuses inscripts/assert-go-symbols-test.share intentional negative-test fixtures and are left alone.Context: why no dependency change is in this diff
main(v0.56.0)CVE-2026-568540.55.0CVE-2026-568550.56.0CVE-2026-786620.56.0All four scanner rows are reported against
installed: v0.53.0, which is what the publishedv0.8.4assets carry — not whatmainbuilds. Clearing them at the scanner requires a release abovev0.8.4, which is a human decision and is tracked on the issue.Test plan
go mod verify— all modules verified;go mod tidy -diffempty.goreleaser.ymltargets cross-built with release ldflags; each binary reportsgo1.26.6and embedsgolang.org/x/crypto v0.56.0go tool nmfindsruntime.mainin every rebuilt artifact (documented flags now match what the guard accepts)