Buildinfo is not always available

[06kellyjac]

I package for nixpkgs and in our builds we don't have .git either because we fetch the release source tar.gz which doesn't have .git or we do a git clone and then delete the .git dir because it's not reproducible.

I believe debian also handles things in a similar way since someone working on debian posted a script that should be able to clean up the .git dir

NixOS/nixpkgs#100498 (comment) (cc: @Nihlus)

We could apply the script to the .git dir and keep it but just being able to set the ldflags is probably still desirable, especially since there are some cases of people complaining about buildinfo breaking reproducibility and people wanting to strip it

golang/go#52372

And after https://go-review.googlesource.com/c/go/+/414794/ -trimpath will allow for removing it

[Nihlus]

To add to my linked-to comment; retaining the .git directory in reproducible source is generally more work than benefit, provided the end user can create an equivalent source tarball themselves. It's mainly useful when the source uses git as part of its build to retrieve some type of information about itself, such as the current tagged version. Unless you have a reason to keep it, it's often better to run something like git archive or git ls-files to create a tarball of a given tag.

[saschagrunert]

Hey @06kellyjac and @Nihlus, thank you for opening this issue.

Are we speaking about this part of the library?

release-utils/version/version.go

Lines 67 to 81 in 352552e

	func init() {
	buildInfo := getBuildInfo()
	gitVersion = getGitVersion(buildInfo)
	gitCommit = getCommit(buildInfo)
	gitTreeState = getDirty(buildInfo)
	buildDate = getBuildDate(buildInfo)
	}
	func getBuildInfo() *debug.BuildInfo {
	bi, ok := debug.ReadBuildInfo()
	if !ok {
	return nil
	}
	return bi
	}

I guess you can inject at least the gitVersion via -X, for example:

package main

import (
	"fmt"

	"sigs.k8s.io/release-utils/version"
)

func main() {
	fmt.Print(version.GetVersionInfo().GitVersion)
}

> go run -ldflags '-X sigs.k8s.io/release-utils/version.gitVersion=foobar' main.go
foobar

Would the same approach work for the other variables? (It does not work right now because of the "unknown" fallback in the code).

[06kellyjac]

yep, just gitVersion falls back, the rest dont

sigstore/rekor#913

[saschagrunert]

Having a fix in mind in #61