From 427e210d6a6a8c87977cdde61a1e3585e885cf15 Mon Sep 17 00:00:00 2001 From: "SUSE Observability AI (POC)" Date: Tue, 8 Sep 2026 14:55:27 +0000 Subject: [PATCH] Drop -s from the documented source build example The release pipeline deliberately keeps -w and omits -s so govulncheck -mode=binary can see which packages a published artifact actually links, and scripts/assert-go-symbols.sh fails the build when the Go symbol table is missing. The README still demonstrated -s -w, which contradicts that policy and reproduces the unassessable binaries the guard exists to prevent. --- README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 14b97d9..bac5f87 100644 --- a/README.md +++ b/README.md @@ -20,9 +20,12 @@ Download pre-built binaries from the [releases page](https://github.com/stackvis ### Building from Source ```bash -go build -o sts-backup -ldflags '-s -w -X github.com/stackvista/stackstate-backup-cli/cmd/version.Version=0.0.1 -X github.com/stackvista/stackstate-backup-cli/cmd/version.Commit=abce -X github.com/stackvista/stackstate-backup-cli/cmd/version.Date=2025-10-15' +go build -o sts-backup -ldflags '-w -X github.com/stackvista/stackstate-backup-cli/cmd/version.Version=0.0.1 -X github.com/stackvista/stackstate-backup-cli/cmd/version.Commit=abce -X github.com/stackvista/stackstate-backup-cli/cmd/version.Date=2025-10-15' ``` +Release builds deliberately pass `-w` without `-s`: `govulncheck -mode=binary` can only tell which packages a +binary actually links while its Go symbol table is present, and CI rejects a stripped artifact. + ## Usage ```bash