feat(go): detect version from ELF symbol table for binaries built with -trimpath (#10197)

Author: knqyf263

docs/guide/coverage/language/golang.md

@@ -104,6 +104,7 @@ $ trivy rootfs ./your_binary
 Go binaries installed using the `go install` command contains correct (semver) version for the main module and therefore are detected by Trivy.
 In other cases, Go uses the `(devel)` version[^2].
 In this case, Trivy will attempt to parse any `-ldflags` as it's a common practice to pass versions this way.
+If the `-ldflags` are not available (e.g., due to the Go `-trimpath` flag), Trivy will attempt to extract the version from the ELF symbol table.
 If unsuccessful, the version will be empty[^3].
 
 ### Standard Library { #go-binary-stdlib }

pkg/dependency/parser/golang/binary/elf.go

@@ -0,0 +1,82 @@
+package binary
+
+import (
+	"debug/elf"
+	"io"
+	"strings"
+
+	"github.com/aquasecurity/trivy/pkg/log"
+)
+
+// elfSymbolVersion attempts to extract the version from the ELF symbol table.
+//
+// When Go builds with `-ldflags "-X main.version=1.0.0"`, the linker creates `.str`-suffixed
+// symbols (e.g. `main.version.str`) containing the string value. Trivy normally extracts
+// these values by parsing the `-ldflags` recorded in the binary's buildinfo. However, when
+// `-trimpath` is used, Go does not record `-ldflags` in the buildinfo due to a known bug
+// (https://go.dev/issue/63432), making the existing ldflags parsing ineffective.
+// The `.str` symbols in the ELF symbol table remain intact regardless of `-trimpath`,
+// so reading them directly serves as a fallback.
+//
+// This only works for unstripped ELF binaries where `.symtab` is present.
+// Binaries built with `-ldflags "-s -w"` strip the symbol table and cannot be handled here.
+func (p *Parser) elfSymbolVersion(r io.ReaderAt, moduleName string) string {
+	f, err := elf.NewFile(r)
+	if err != nil {
+		p.logger.Debug("Not an ELF binary, skipping symbol table lookup", log.Err(err))
+		return ""
+	}
+	defer f.Close()
+
+	syms, err := f.Symbols()
+	if err != nil {
+		p.logger.Debug("No symbol table found (binary may be stripped)", log.Err(err))
+		return ""
+	}
+
+	// foundVersions uses the same 3-tier priority as ParseLDFlags:
+	//   [0]: <module_path>/cmd/**/*.version.str
+	//   [1]: defaultVersionPrefixes (main, common, version, cmd)
+	//   [2]: other
+	var foundVersions = make([][]string, 3)
+	for i := range syms {
+		sym := &syms[i]
+		if !strings.HasSuffix(sym.Name, ".str") || sym.Size == 0 {
+			continue
+		}
+
+		// Strip ".str" suffix to get the original key (e.g. "main.version")
+		key := strings.TrimSuffix(sym.Name, ".str")
+		if !isVersionXKey(key) {
+			continue
+		}
+
+		val := readELFSymbolString(f, sym)
+		if val == "" || !isValidSemVer(val) {
+			continue
+		}
+
+		classifyVersion(foundVersions, key, moduleName, val)
+	}
+
+	return p.chooseVersion(moduleName, foundVersions)
+}
+
+// readELFSymbolString reads the string value of an ELF symbol.
+// The offset is computed as sym.Value (virtual address) minus the section's base address,
+// following the same pattern as Go's cmd/internal/objfile/elf.go (symbolData function).
+// cf. https://go.dev/src/cmd/internal/objfile/elf.go
+func readELFSymbolString(f *elf.File, sym *elf.Symbol) string {
+	if int(sym.Section) >= len(f.Sections) {
+		return ""
+	}
+
+	sec := f.Sections[sym.Section]
+	offset := sym.Value - sec.Addr
+	buf := make([]byte, sym.Size)
+	if _, err := sec.ReadAt(buf, int64(offset)); err != nil {
+		return ""
+	}
+
+	return strings.TrimRight(string(buf), "\x00")
+}

pkg/dependency/parser/golang/binary/export_test.go

@@ -1,8 +1,15 @@
 package binary
 
+import "io"
+
 // Bridge to expose binary parser internals to tests in the binary_test package.
 
 // ChooseMainVersion exports chooseMainVersion for testing.
-func (p *Parser) ChooseMainVersion(version, ldflagsVersion string) string {
-	return p.chooseMainVersion(version, ldflagsVersion)
+func (p *Parser) ChooseMainVersion(version, ldflagsVersion, elfVersion string) string {
+	return p.chooseMainVersion(version, ldflagsVersion, elfVersion)
+}
+
+// ELFSymbolVersion exports elfSymbolVersion for testing.
+func (p *Parser) ELFSymbolVersion(r io.ReaderAt, name string) string {
+	return p.elfSymbolVersion(r, name)
 }

pkg/dependency/parser/golang/binary/parse.go

@@ -110,7 +110,8 @@ func (p *Parser) Parse(_ context.Context, r xio.ReadSeekerAt) ([]ftypes.Package,
 		// See https://github.com/aquasecurity/trivy/issues/1837#issuecomment-1832523477.
 		version := p.checkVersion(info.Main.Path, info.Main.Version)
 		ldflagsVersion := p.ParseLDFlags(info.Main.Path, ldflags)
-		version = p.chooseMainVersion(version, ldflagsVersion)
+		elfVersion := p.elfSymbolVersion(r, info.Main.Path)
+		version = p.chooseMainVersion(version, ldflagsVersion, elfVersion)
 
 		root := ftypes.Package{
 			ID:           dependency.ID(ftypes.GoBinary, info.Main.Path, version),
@@ -148,15 +149,29 @@ func (p *Parser) checkVersion(name, version string) string {
 }
 
 // chooseMainVersion determines which version to use for the main module.
-// It prefers the ldflags version when:
-// - The build info version is empty, OR
-// - The build info version is a pseudo-version AND ldflags version is available
-// This handles cases where actual release versions are injected via -ldflags.
-func (p *Parser) chooseMainVersion(version, ldflagsVersion string) string {
-	if version == "" || (module.IsPseudoVersion(version) && ldflagsVersion != "") {
+// The priority order is:
+//  1. Build info version (if it is a real semver, e.g. "v1.2.3" from `go install`)
+//  2. ldflags version (e.g. `-ldflags "-X main.version=v1.0.0"`)
+//  3. ELF symbol table version (fallback when `-trimpath` hides `-ldflags`)
+//  4. Original version as-is (may be empty or a pseudo-version)
+//
+// Examples:
+//
+//	chooseMainVersion("v1.2.3", "v1.0.0", "v1.0.0") => "v1.2.3"  (real semver wins)
+//	chooseMainVersion("v0.0.0-2024...", "v1.0.0", "") => "v1.0.0" (ldflags over pseudo)
+//	chooseMainVersion("v0.0.0-2024...", "", "v2.0.0") => "v2.0.0" (ELF over pseudo)
+//	chooseMainVersion("", "", "")                     => ""        (nothing available)
+func (p *Parser) chooseMainVersion(version, ldflagsVersion, elfVersion string) string {
+	switch {
+	case version != "" && !module.IsPseudoVersion(version):
+		return version
+	case ldflagsVersion != "":
 		return ldflagsVersion
+	case elfVersion != "":
+		return elfVersion
+	default:
+		return version
 	}
-	return version
 }
 
 func (p *Parser) ldFlags(settings []debug.BuildSetting) []string {
@@ -216,14 +231,7 @@ func (p *Parser) ParseLDFlags(name string, flags []string) string {
 		key = strings.TrimLeft(key, `'`)
 		val = strings.TrimRight(val, `'`)
 		if isVersionXKey(key) && isValidSemVer(val) {
-			switch {
-			case strings.HasPrefix(key, name+"/cmd/"):
-				foundVersions[0] = append(foundVersions[0], val)
-			case defaultVersionPrefixes.Contains(versionPrefix(key)):
-				foundVersions[1] = append(foundVersions[1], val)
-			default:
-				foundVersions[2] = append(foundVersions[2], val)
-			}
+			classifyVersion(foundVersions, key, name, val)
 		}
 	}
 
@@ -267,6 +275,23 @@ func isValidSemVer(ver string) bool {
 	return semver.IsValid(ver) || semver.IsValid("v"+ver)
 }
 
+// classifyVersion categorizes a version value into one of three priority tiers
+// based on its key:
+//
+//	[0]: <module_path>/cmd/**/*.version
+//	[1]: defaultVersionPrefixes (main, common, version, cmd)
+//	[2]: other
+func classifyVersion(foundVersions [][]string, key, moduleName, val string) {
+	switch {
+	case strings.HasPrefix(key, moduleName+"/cmd/"):
+		foundVersions[0] = append(foundVersions[0], val)
+	case defaultVersionPrefixes.Contains(versionPrefix(key)):
+		foundVersions[1] = append(foundVersions[1], val)
+	default:
+		foundVersions[2] = append(foundVersions[2], val)
+	}
+}
+
 // versionPrefix returns version prefix from `-ldflags` flag key
 // e.g.
 //   - `github.com/aquasecurity/trivy/pkg/version/app.ver` => `version`

pkg/dependency/parser/golang/binary/parse_test.go

@@ -240,6 +240,7 @@ func TestParser_ChooseMainVersion(t *testing.T) {
 		name           string
 		version        string
 		ldflagsVersion string
+		elfVersion     string
 		want           string
 	}{
 		{
@@ -278,11 +279,94 @@ func TestParser_ChooseMainVersion(t *testing.T) {
 			ldflagsVersion: "",
 			want:           "v2.0.0-20251210145848-560ea94fc7d6",
 		},
+		{
+			name:       "pseudo-version with ELF version",
+			version:    "v0.0.0-20210121094942-22b2f8951d46",
+			elfVersion: "v1.0.0",
+			want:       "v1.0.0",
+		},
+		{
+			name:           "pseudo-version with both ldflags and ELF prefers ldflags",
+			version:        "v0.0.0-20210121094942-22b2f8951d46",
+			ldflagsVersion: "v1.2.3",
+			elfVersion:     "v1.0.0",
+			want:           "v1.2.3",
+		},
+		{
+			name:       "empty version with ELF version",
+			version:    "",
+			elfVersion: "v2.0.0",
+			want:       "v2.0.0",
+		},
+		{
+			name:           "empty version with both ldflags and ELF prefers ldflags",
+			version:        "",
+			ldflagsVersion: "v1.2.3",
+			elfVersion:     "v2.0.0",
+			want:           "v1.2.3",
+		},
+		{
+			name:       "regular semver version with ELF version keeps original",
+			version:    "v1.2.3",
+			elfVersion: "v1.2.4",
+			want:       "v1.2.3",
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			p := binary.NewParser()
-			got := p.ChooseMainVersion(tt.version, tt.ldflagsVersion)
+			got := p.ChooseMainVersion(tt.version, tt.ldflagsVersion, tt.elfVersion)
+			assert.Equal(t, tt.want, got)
+		})
+	}
+}
+
+func TestParser_ELFSymbolVersion(t *testing.T) {
+	tests := []struct {
+		name       string
+		inputFile  string
+		moduleName string
+		want       string
+	}{
+		{
+			name:       "ELF with version symbol",
+			inputFile:  "testdata/main-version-via-ldflags.elf",
+			moduleName: "github.com/aquasecurity/test",
+			want:       "v1.0.0",
+		},
+		{
+			name:       "ELF without version symbols",
+			inputFile:  "testdata/test.elf",
+			moduleName: "github.com/aquasecurity/test",
+			want:       "",
+		},
+		{
+			name:       "PE binary (not ELF)",
+			inputFile:  "testdata/test.exe",
+			moduleName: "github.com/aquasecurity/test",
+			want:       "",
+		},
+		{
+			name:       "Mach-O binary (not ELF)",
+			inputFile:  "testdata/test.macho",
+			moduleName: "github.com/aquasecurity/test",
+			want:       "",
+		},
+		{
+			name:       "dummy file",
+			inputFile:  "testdata/dummy",
+			moduleName: "test",
+			want:       "",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			f, err := os.Open(tt.inputFile)
+			require.NoError(t, err)
+			defer f.Close()
+
+			p := binary.NewParser()
+			got := p.ELFSymbolVersion(f, tt.moduleName)
 			assert.Equal(t, tt.want, got)
 		})
 	}