fix(composer): add -trimpath flag to Go build commands for consistency (#339)

I am getting errors when re-uploading the `.so` file to the dynamic
module directory which is solved by adding this flag.

This also makes the output more consistent when comparing the sha256sum
(?)

---------

Signed-off-by: Sjouke de Vries <info@sdvservices.nl>

Author: sjoukedv

cli/internal/extensions/libcomposer.go

@@ -74,7 +74,7 @@ func BuildExtensionFromPath(logger *slog.Logger, dirs *xdg.Directories, manifest
 	// Build the extension and save the binary in the local cache directory for composer to load.
 	dest := LocalCacheExtension(dirs, manifest)
 	// #nosec G204
-	cmd = exec.Command("go", "build", "-buildmode=plugin", "-o", dest, "./standalone")
+	cmd = exec.Command("go", "build", "-trimpath", "-buildmode=plugin", "-o", dest, "./standalone")
 	cmd.Dir = path
 	logger.Debug("building local extension", "version", manifest.Version, "path", path, "cmd", cmd.String())
 	output, err = cmd.CombinedOutput()

extensions/composer/Dockerfile.plugin

@@ -20,7 +20,7 @@ RUN go mod download all
 # BUILD_TAG is used to to include coraza waf build tags, populated by Makefile.plugin via --build-arg
 ARG BUILD_TAG=""
 # Build go plugin
-RUN CGO_ENABLED=1 go build -buildmode=plugin ${BUILD_TAG} -o plugin.so ./$EXTENSION_PATH/standalone
+RUN CGO_ENABLED=1 go build -trimpath -buildmode=plugin ${BUILD_TAG} -o plugin.so ./$EXTENSION_PATH/standalone
 
 FROM scratch AS final
 

extensions/composer/Makefile

@@ -127,7 +127,7 @@ create_builder:
 
 .PHONY: build
 build:
-	CGO_ENABLED=1 go build -buildmode=c-shared $(COMPOSER_BUILD_TAG) -o lib$(NAME).so ./main
+	CGO_ENABLED=1 go build -trimpath -buildmode=c-shared $(COMPOSER_BUILD_TAG) -o lib$(NAME).so ./main
 
 .PHONY: install
 install: build

extensions/composer/Makefile.plugin

@@ -95,7 +95,7 @@ create_builder:
 
 .PHONY: build
 build:
-	CGO_ENABLED=1 go build -buildmode=plugin $(PLUGIN_BUILD_TAG) -o $(NAME).so ./$(EXTENSION_PATH)/standalone
+	CGO_ENABLED=1 go build -trimpath -buildmode=plugin $(PLUGIN_BUILD_TAG) -o $(NAME).so ./$(EXTENSION_PATH)/standalone
 
 .PHONY: install
 install: build

extensions/composer/goplugin-loader/README.md

@@ -25,6 +25,7 @@ Plugins must:
 
 - Be compiled with the same Go version as the host binary
 - Use `-buildmode=plugin` when building
+- Use the same build flags as the host binary, including `-trimpath` when the host uses it
 - Have identical versions of all shared dependencies
 - Export a `WellKnownHttpFilterConfigFactories` function with signature:
   ```go