From 00923182d53d451103953fb24fb79892d65abf0f Mon Sep 17 00:00:00 2001
From: Laurent Goderre <laurent.goderre@docker.com>
Date: Mon, 22 Jul 2024 16:28:26 -0400
Subject: [PATCH] wip

---
 src/cmd/go/internal/load/pkg.go      | 21 +++++++++++----------
 src/cmd/go/internal/load/pkg_test.go |  4 ++--
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/src/cmd/go/internal/load/pkg.go b/src/cmd/go/internal/load/pkg.go
index f7ba1b53ff7..e38d225b6d3 100644
--- a/src/cmd/go/internal/load/pkg.go
+++ b/src/cmd/go/internal/load/pkg.go
@@ -20,6 +20,7 @@ import (
 	"os"
 	pathpkg "path"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"runtime/debug"
 	"slices"
@@ -2343,12 +2344,8 @@ func (p *Package) setBuildInfo(ctx context.Context, autoVCS bool) {
 		// since it can include system paths through various linker flags (notably
 		// -extar, -extld, and -extldflags).
 		//
-		// TODO: since we control cmd/link, in theory we can parse ldflags to
-		// determine whether they may refer to system paths. If we do that, we can
-		// redact only those paths from the recorded -ldflags setting and still
-		// record the system-independent parts of the flags.
-		if !cfg.BuildTrimpath {
-			ldflags = trimLdFlags(ldflags)
+		if cfg.BuildTrimpath {
+			ldflags = trimPathsFromLdFlags(ldflags)
 		}
 		appendSetting("-ldflags", ldflags)
 	}
@@ -2506,10 +2503,14 @@ omitVCS:
 	p.Internal.BuildInfo = info
 }
 
-// trimLdFlags replaces know paths with variable and removes
-// flags with absolute paths
-func trimLdFlags(flags string) string {
-	return flags
+// trimLdFlags removes system paths from the ldflag.
+// since we control cmd/link, in theory we parse ldflags to
+// determine whether they refer to system paths. We then can
+// redact only those paths from the recorded -ldflags setting and still
+// record the system-independent parts of the flags.
+func trimPathsFromLdFlags(flags string) string {
+	re := regexp.MustCompile(`(?:(['"])|\s)(?:-[A-Z])?\/[aA-zZ0-9][^\s'"]+`)
+	return re.ReplaceAllString(flags, `$1`)
 }
 
 // SafeArg reports whether arg is a "safe" command-line argument,
diff --git a/src/cmd/go/internal/load/pkg_test.go b/src/cmd/go/internal/load/pkg_test.go
index e14e9ed908b..49a4aa77501 100644
--- a/src/cmd/go/internal/load/pkg_test.go
+++ b/src/cmd/go/internal/load/pkg_test.go
@@ -256,14 +256,14 @@ build	GOOS=bar
 				"os":       "bar",
 				"compiler": "baz",
 				"cgo":      "false",
-				"ldflags":  "-flag1 -flag2",
+				"ldflags":  "all=-buildid '1649548598' -linkmode external -extldflags '-L/media/path1 -L/media/path2 -Wl,-z,now -Wl,-z,relro' -X 'github.com/foo/bar/app.Version=v1.2.3'",
 				"trimpath": "true",
 			},
 			pkg:     Package{},
 			autoVCS: true,
 			want: `build	-buildmode=
 build	-compiler=baz
-build	-ldflags="-flag1 -flag2"
+build	-ldflags="all=-buildid '1649548598' -linkmode external -extldflags ' -Wl,-z,now -Wl,-z,relro' -X 'github.com/foo/bar/app.Version=v1.2.3'"
 build	-trimpath=true
 build	CGO_ENABLED=0
 build	GOARCH=foo