How does garble remove buildinfo?

[Blank-c]

So far, I have seen DetectItEasy detecting the compiler used, passed arguements, go version etc.

How does garble remove all this sensitive information?

[mvdan]

Mainly in here:

garble/main.go

Lines 2172 to 2178 in 059c1d6

	// Starting in Go 1.17, Go's version is implicitly injected by the linker.
	// It's the same method as -X, so we can override it with an extra flag.
	flags = append(flags, "-X=runtime.buildVersion=unknown")
	// Ensure we strip the -buildid flag, to not leak any build IDs for the
	// link operation or the main package's compilation.
	flags = flagSetValue(flags, "-buildid", "")

If any information isn't being removed from a build by garble, please raise an issue following the template.

[timonwong]

FYI: moduleinfo can be stripped using -X=runtime.modinfo=