Modules information (runtime.modinfo) cannot be stripped from final binary

[yuvalavra]

What did you do?

Compiled a striped go binary.

$ go build -ldflags="-s -w" -trimpath

What did you expect to see?

Module information stripped from the binary.

What did you see instead?

Go includes module information in the binary in runtime.modinfo.

$ go version -m hello
hello: go1.14.2
	path	example.com/user/hello
	mod	example.com/user/hello	(devel)	
	dep	github.com/google/go-cmp	v0.5.2	h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=

In production environments, this kind of information can be used by attackers to target vulnerable dependencies. Consider allowing users to strip that information either through the current stripping flags or via a new flag.

[yuvalavra]

Found a way to remove this information, use -linkshared. Closing.