UPSTREAM: <carry>: add source commit into binaries when linking

- Removes extra GIT_COMMIT set
- fixup Dockerfiles after rebase
- consider "" unset so build-info can fill commit/date
- double quote go flags & honor GIT_COMMIT if set
- improve robustness of build-info parsing
- Trim whitespace on all version fields
- isUnset and valueOrUnknown now call strings.TrimSpace
- Avoid clobbering values injected via ldflags
- set repoState from build-info only when repoState is still unset
- set version from build-info only when unset and build-info value is non-empty

Author: bentito

Makefile

@@ -259,7 +259,10 @@ E2E_REGISTRY_IMAGE=localhost/e2e-test-registry:devel
 image-registry: export GOOS=linux
 image-registry: export GOARCH=amd64
 image-registry: ## Build the testdata catalog used for e2e tests and push it to the image registry
-	go build $(GO_BUILD_FLAGS) $(GO_BUILD_EXTRA_FLAGS) -tags '$(GO_BUILD_TAGS)' -ldflags '$(GO_BUILD_LDFLAGS)' -gcflags '$(GO_BUILD_GCFLAGS)' -asmflags '$(GO_BUILD_ASMFLAGS)' -o ./testdata/push/bin/push         ./testdata/push/push.go
+	# Use double quotes (not single quotes) for build flags like -ldflags, -tags, etc.
+	# Single quotes are passed literally and not stripped by `go build`, which can cause errors
+	# or inject unintended characters into the binary (e.g., version metadata).
+	go build $(GO_BUILD_FLAGS) $(GO_BUILD_EXTRA_FLAGS) -tags '$(GO_BUILD_TAGS)' -ldflags "$(GO_BUILD_LDFLAGS)" -gcflags '$(GO_BUILD_GCFLAGS)' -asmflags '$(GO_BUILD_ASMFLAGS)' -o ./testdata/push/bin/push         ./testdata/push/push.go
 	$(CONTAINER_RUNTIME) build -f ./testdata/Dockerfile -t $(E2E_REGISTRY_IMAGE) ./testdata
 	$(CONTAINER_RUNTIME) save $(E2E_REGISTRY_IMAGE) | $(KIND) load image-archive /dev/stdin --name $(KIND_CLUSTER_NAME)
 	./testdata/build-test-registry.sh $(E2E_REGISTRY_NAMESPACE) $(E2E_REGISTRY_NAME) $(E2E_REGISTRY_IMAGE)
@@ -372,13 +375,16 @@ export GO_BUILD_GCFLAGS := all=-trimpath=$(PWD)
 export GO_BUILD_EXTRA_FLAGS :=
 export GO_BUILD_LDFLAGS := -s -w \
     -X '$(VERSION_PATH).version=$(VERSION)' \
-    -X '$(VERSION_PATH).gitCommit=$(GIT_COMMIT)' \
+    -X '$(VERSION_PATH).gitCommit=$(GIT_COMMIT)'
 
 BINARIES=operator-controller catalogd
 
 .PHONY: $(BINARIES)
 $(BINARIES):
-	go build $(GO_BUILD_FLAGS) $(GO_BUILD_EXTRA_FLAGS) -tags '$(GO_BUILD_TAGS)' -ldflags '$(GO_BUILD_LDFLAGS)' -gcflags '$(GO_BUILD_GCFLAGS)' -asmflags '$(GO_BUILD_ASMFLAGS)' -o $(BUILDBIN)/$@ ./cmd/$@
+	# use double quotes around $(GO_BUILD_LDFLAGS) to avoid conflicts with the
+	# single quotes that are embedded inside the variable itself. this prevents
+	# malformed arguments such as "malformed import path \" \"" when the git commit is empty.
+	go build $(GO_BUILD_FLAGS) $(GO_BUILD_EXTRA_FLAGS) -tags '$(GO_BUILD_TAGS)' -ldflags "$(GO_BUILD_LDFLAGS)" -gcflags '$(GO_BUILD_GCFLAGS)' -asmflags '$(GO_BUILD_ASMFLAGS)' -o $(BUILDBIN)/$@ ./cmd/$@
 
 .PHONY: build-deps
 build-deps: manifests generate fmt

internal/shared/version/version.go

@@ -3,6 +3,7 @@ package version
 import (
 	"fmt"
 	"runtime/debug"
+	"strings"
 )
 
 var (
@@ -17,8 +18,32 @@ var (
 	}
 )
 
+// isUnset returns true when the provided string should be treated as an
+// "unset" value. Builds that inject ldflags such as "-X var=" will set the
+// variable to the empty string, which previously prevented the runtime build
+// information gathered via debug.ReadBuildInfo from populating the field. For
+// the purposes of version reporting we treat both the empty string and the
+// literal "unknown" as unset.
+func isUnset(s string) bool {
+	// trim any surrounding whitespace to ensure accurate unset detection
+	s = strings.TrimSpace(s)
+	return s == "" || s == "unknown"
+}
+
 func String() string {
-	return fmt.Sprintf("version: %q, commit: %q, date: %q, state: %q", version, gitCommit, commitDate, repoState)
+	return fmt.Sprintf("version: %q, commit: %q, date: %q, state: %q",
+		valueOrUnknown(version),
+		valueOrUnknown(gitCommit),
+		valueOrUnknown(commitDate),
+		valueOrUnknown(repoState))
+}
+
+func valueOrUnknown(v string) string {
+	v = strings.TrimSpace(v)
+	if v == "" {
+		return "unknown"
+	}
+	return v
 }
 
 func init() {
@@ -29,18 +54,20 @@ func init() {
 	for _, setting := range info.Settings {
 		switch setting.Key {
 		case "vcs.revision":
-			if gitCommit == "unknown" {
+			if isUnset(gitCommit) {
 				gitCommit = setting.Value
 			}
 		case "vcs.time":
-			commitDate = setting.Value
+			if isUnset(commitDate) {
+				commitDate = setting.Value
+			}
 		case "vcs.modified":
-			if v, ok := stateMap[setting.Value]; ok {
+			if v, ok := stateMap[setting.Value]; ok && isUnset(repoState) {
 				repoState = v
 			}
 		}
 	}
-	if version == "unknown" {
+	if isUnset(version) && info.Main.Version != "" {
 		version = info.Main.Version
 	}
 }

openshift/Makefile

@@ -7,6 +7,16 @@ include $(addprefix $(DIR)/vendor/github.com/openshift/build-machinery-go/make/,
 
 include $(DIR)/.bingo/Variables.mk
 
+# Prefer the upstream source commit that the Dockerfile passes in via
+# `ENV GIT_COMMIT=<sha>`. If that variable is not already defined fall back to
+# the commit recorded by the OpenShift image build pipeline.
+ifeq ($(origin GIT_COMMIT), undefined)
+GIT_COMMIT := $(OPENSHIFT_BUILD_COMMIT)   # populated by OpenShift build machinery
+endif
+export GIT_COMMIT
+VERSION_PATH            := github.com/operator-framework/operator-controller/internal/shared/version
+export GO_BUILD_LDFLAGS := -s -w -X '$(VERSION_PATH).gitCommit=$(GIT_COMMIT)'
+
 .PHONY: verify
 verify: ## Run downstream-specific verify
 	$(MAKE) tidy fmt generate -C $(DIR)/../
@@ -46,7 +56,6 @@ test-experimental-e2e: ## Run the experimental e2e tests.
 	cd $(DIR)/../; \
 	go test $(DOWNSTREAM_EXPERIMENTAL_E2E_FLAGS) ./test/experimental-e2e/...;
 
-export GIT_COMMIT := ${SOURCE_GIT_COMMIT}
 PHONY: go-build-local
 go-build-local:
-	$(MAKE) -n -f Makefile go-build-local
+	$(MAKE) -f Makefile go-build-local

openshift/catalogd.Dockerfile

@@ -1,9 +1,10 @@
 FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builder
 
+ARG SOURCE_GIT_COMMIT
 ENV GIT_COMMIT=${SOURCE_GIT_COMMIT}
 WORKDIR /build
 COPY . .
-RUN make -f openshift/Makefile go-build-local
+RUN make go-build-local
 
 FROM registry.ci.openshift.org/ocp/4.20:base-rhel9
 USER 1001

openshift/operator-controller.Dockerfile

@@ -1,5 +1,6 @@
 FROM registry.ci.openshift.org/ocp/builder:rhel-9-golang-1.24-openshift-4.20 AS builder
 
+ARG SOURCE_GIT_COMMIT
 ENV GIT_COMMIT=${SOURCE_GIT_COMMIT}
 WORKDIR /build
 COPY . .