From bdba0053d27a7f3b549becc6423f0d86a5f09de3 Mon Sep 17 00:00:00 2001
From: Steven van der Vegt <steven.vandervegt@s-curve.nl>
Date: Wed, 9 Sep 2026 07:59:49 +0200
Subject: [PATCH] build: make the main module version readable by image
 scanners

Trivy only reads a version from -ldflags when the -X key ends in
".version", so core.GitVersion was ignored and the nuts-node module
showed up without a version in Trivy scans of the image. Rename the
variable to core.Version (and the Version() func to VersionOrBranch())
so both Trivy and Syft pick it up.

Build with -buildvcs=false: the module path has no /v6 suffix, so Go
cannot derive the version from the v6.x tags and stamps a pseudo-version
(v0.0.0-<time>-<rev> on the release binaries) that scanners rank against
old advisories. The ldflag is the intended source of the version.

Derive the version in the image workflow from the tag ref instead of
git name-rev, so it is always a clean vX.Y.Z on tag builds and
"undefined" otherwise.

Refs #4485

Assisted-by: AI
---
 .github/workflows/build-binaries.yaml |  2 +-
 .github/workflows/build-images.yaml   |  9 ++++++++-
 Dockerfile                            |  6 +++++-
 auth/api/iam/metadata_test.go         |  2 +-
 core/build_vars.go                    | 16 ++++++++--------
 core/build_vars_test.go               |  6 +++---
 core/http_client_test.go              |  2 +-
 core/status/engine.go                 |  2 +-
 core/status/engine_test.go            |  2 +-
 makefile                              |  2 +-
 tracing/engine.go                     |  2 +-
 11 files changed, 31 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/build-binaries.yaml b/.github/workflows/build-binaries.yaml
index cebeba6254..3d1ac9db73 100644
--- a/.github/workflows/build-binaries.yaml
+++ b/.github/workflows/build-binaries.yaml
@@ -55,7 +55,7 @@ jobs:
 
       - name: Build
         run: |
-          GOOS=linux GOARCH=${{ matrix.arch }} go build -o nuts-linux-${{ matrix.arch }}  -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
+          GOOS=linux GOARCH=${{ matrix.arch }} go build -buildvcs=false -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.Version=${GIT_VERSION}'" -o nuts-linux-${{ matrix.arch }}
       - name:  Upload binary
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index e8ed4951a4..0d7208b304 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -36,7 +36,14 @@ jobs:
         run: |
           echo "git_commit=$(echo ${GITHUB_SHA})" >> $GITHUB_OUTPUT
           echo "git_branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
-          echo "git_version=$(git name-rev --tags --name-only $(git rev-parse HEAD))" >> $GITHUB_OUTPUT
+          # Only tag builds get a version. It must be a clean semver tag
+          # (vX.Y.Z): Docker image scanners read it from the -ldflags recorded
+          # in the binary to match the main module against advisories.
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            echo "git_version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
+          else
+            echo "git_version=undefined" >> $GITHUB_OUTPUT
+          fi
 
       - uses: actions-ecosystem/action-get-latest-tag@b7c32daec3395a9616f88548363a42652b22d435 # v1
         id: get-latest-tag
diff --git a/Dockerfile b/Dockerfile
index 3cf07cd2d8..22914769a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -18,7 +18,11 @@ COPY go.sum .
 RUN go mod download && go mod verify
 
 COPY . .
-RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o /opt/nuts/nuts
+# -buildvcs=false: the module path has no /v6 suffix, so Go cannot derive the
+# version from the v6.x tags and would stamp a misleading pseudo-version that
+# scanners match against old advisories. Scanners take the version from the
+# core.Version ldflag below instead; the key must end in ".Version" for Trivy.
+RUN GOOS=$TARGETOS GOARCH=$TARGETARCH go build -buildvcs=false -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.Version=${GIT_VERSION}'" -o /opt/nuts/nuts
 
 # alpine
 FROM alpine:3.24.1
diff --git a/auth/api/iam/metadata_test.go b/auth/api/iam/metadata_test.go
index 8f325b4576..49f8c6ec1e 100644
--- a/auth/api/iam/metadata_test.go
+++ b/auth/api/iam/metadata_test.go
@@ -55,7 +55,7 @@ func Test_authorizationServerMetadata(t *testing.T) {
 }
 
 func Test_clientMetadata(t *testing.T) {
-	core.GitVersion = "testVersion"
+	core.Version = "testVersion"
 	expected := OAuthClientMetadata{
 		RedirectURIs:            nil,
 		TokenEndpointAuthMethod: "none",
diff --git a/core/build_vars.go b/core/build_vars.go
index 8a8d869730..8ccd1a757d 100644
--- a/core/build_vars.go
+++ b/core/build_vars.go
@@ -28,16 +28,16 @@ import (
 // GitCommit holds the latest git commit hash for this build.
 var GitCommit = "0"
 
-// GitVersion holds the tagged version belonging to the git commit.
-var GitVersion string
+// Version holds the tagged version belonging to the git commit.
+var Version string
 
 // GitBranch holds the branch from where the binary is built.
 var GitBranch = "development"
 
-// Version gives the current version according to the git tag or the branch if there's no tag.
-func Version() string {
-	if GitVersion != "" && GitVersion != "undefined" {
-		return GitVersion
+// VersionOrBranch gives the current version according to the git tag or the branch if there's no tag.
+func VersionOrBranch() string {
+	if Version != "" && Version != "undefined" {
+		return Version
 	}
 	return GitBranch
 }
@@ -51,7 +51,7 @@ func OSArch() string {
 func BuildInfo() string {
 	b := strings.Builder{}
 	b.WriteString("Git version: ")
-	b.WriteString(Version())
+	b.WriteString(VersionOrBranch())
 	b.WriteString("\n")
 
 	b.WriteString("Git commit: ")
@@ -67,7 +67,7 @@ func BuildInfo() string {
 
 // UserAgent returns a string that can be used as HTTP user agent, containing the version of the node (e.g. nuts-node-refimpl/5.0.0)
 func UserAgent() string {
-	version := GitVersion
+	version := Version
 	if version == "" {
 		version = "unknown"
 	}
diff --git a/core/build_vars_test.go b/core/build_vars_test.go
index 6a3db08267..7edad29f44 100644
--- a/core/build_vars_test.go
+++ b/core/build_vars_test.go
@@ -34,11 +34,11 @@ func TestBuildInfo(t *testing.T) {
 }
 
 func TestUserAgent(t *testing.T) {
-	t.Run("GitVersion not set", func(t *testing.T) {
+	t.Run("Version not set", func(t *testing.T) {
 		assert.Equal(t, "nuts-node-refimpl/unknown", UserAgent())
 	})
-	t.Run("GitVersion set", func(t *testing.T) {
-		GitVersion = "abc"
+	t.Run("Version set", func(t *testing.T) {
+		Version = "abc"
 		assert.Equal(t, "nuts-node-refimpl/abc", UserAgent())
 	})
 }
diff --git a/core/http_client_test.go b/core/http_client_test.go
index 81b743332e..30f8093e7d 100644
--- a/core/http_client_test.go
+++ b/core/http_client_test.go
@@ -92,7 +92,7 @@ func TestHTTPClient(t *testing.T) {
 }
 
 func TestUserAgentRequestEditor(t *testing.T) {
-	GitVersion = ""
+	Version = ""
 	req := &stdHttp.Request{Header: map[string][]string{}}
 
 	err := UserAgentRequestEditor(context.TODO(), req)
diff --git a/core/status/engine.go b/core/status/engine.go
index 10603de139..2f6c2397ef 100644
--- a/core/status/engine.go
+++ b/core/status/engine.go
@@ -99,7 +99,7 @@ func (s *status) diagnosticsSummaryAsMap(diagnostics map[string][]core.Diagnosti
 func (s *status) Diagnostics() []core.DiagnosticResult {
 	return []core.DiagnosticResult{
 		&core.GenericDiagnosticResult{Title: "uptime", Outcome: time.Since(s.startTime).Truncate(time.Second)},
-		&core.GenericDiagnosticResult{Title: "software_version", Outcome: core.Version()},
+		&core.GenericDiagnosticResult{Title: "software_version", Outcome: core.VersionOrBranch()},
 		&core.GenericDiagnosticResult{Title: "git_commit", Outcome: core.GitCommit},
 		&core.GenericDiagnosticResult{Title: "os_arch", Outcome: core.OSArch()},
 	}
diff --git a/core/status/engine_test.go b/core/status/engine_test.go
index 3fa6f6a6db..0c3a8a74c9 100644
--- a/core/status/engine_test.go
+++ b/core/status/engine_test.go
@@ -57,7 +57,7 @@ func TestNewStatusEngine_Diagnostics(t *testing.T) {
 		// SoftwareVersion
 		idx++
 		assert.Equal(t, "software_version", ds[idx].Name())
-		assert.Equal(t, core.Version(), ds[idx].String())
+		assert.Equal(t, core.VersionOrBranch(), ds[idx].String())
 		// Commit
 		idx++
 		assert.Equal(t, "git_commit", ds[idx].Name())
diff --git a/makefile b/makefile
index b506f054f5..a5da5c37c5 100644
--- a/makefile
+++ b/makefile
@@ -129,7 +129,7 @@ GIT_COMMIT ?= "$(shell git rev-list -1 HEAD)"
 GIT_BRANCH ?= "$(shell git symbolic-ref --short HEAD)"
 GIT_VERSION ?= "$(shell git name-rev --tags --name-only $(shell git rev-parse HEAD))"
 build:
-	go build -tags jwx_es256k -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.GitVersion=${GIT_VERSION}'" -o ${OUTPUT}
+	go build -buildvcs=false -tags jwx_es256k -ldflags="-w -s -X 'github.com/nuts-foundation/nuts-node/core.GitCommit=${GIT_COMMIT}' -X 'github.com/nuts-foundation/nuts-node/core.GitBranch=${GIT_BRANCH}' -X 'github.com/nuts-foundation/nuts-node/core.Version=${GIT_VERSION}'" -o ${OUTPUT}
 
 docker:
 	docker build --build-arg GIT_COMMIT=${GIT_COMMIT} --build-arg GIT_BRANCH=${GIT_BRANCH} --build-arg GIT_VERSION=${GIT_VERSION} -t nutsfoundation/nuts-node:master .
diff --git a/tracing/engine.go b/tracing/engine.go
index 9b79af8f2b..cecde6bbf4 100644
--- a/tracing/engine.go
+++ b/tracing/engine.go
@@ -287,7 +287,7 @@ func setupStandaloneTracing(cfg Config) (shutdown func(context.Context) error, e
 	if serviceName == "" {
 		serviceName = defaultServiceName
 	}
-	version := core.Version()
+	version := core.VersionOrBranch()
 	res, err := resource.New(ctx,
 		resource.WithAttributes(
 			semconv.ServiceNameKey.String(serviceName),