[eks-operator] VEX related improvements for the build process

[macedogm]

The VEX Hub initiative in rancher/vexhub is now a mature project in Rancher where we generate VEX reports for known false-positive CVEs in our projects (images and binaries).

In order for VEX to fully work and for security scanners (e.g., Trivy) to correctly match a VEX entry in our VEX Hub with a Go binary being scanned, the Go binary must have its full package path inside of it. Example:

> go version -m bin/eks-operator | head -n 3
bin/eks-operator: go1.23.4
	path	github.com/rancher/eks-operator
	mod	github.com/rancher/eks-operator	(devel)	

When a Go binary is compiled by specifying directly the file as go build main.go as opposed to go build ., the binary won't contain the package path.

> go version -m bin/eks-operator | head -n 2

bin/eks-operator: go1.23.4
	path	command-line-arguments

In the above case, the security scanner won't be able to match the binary with its respective VEX entry.

Further automation that we developed internally also relies on identifying the commit ID from where the binary was built. Example:

> go version -m bin/eks-operator
(...)
	build	-ldflags="-X github.com/rancher/eks-operator/pkg/version.GitCommit=550fce8486ceda01335b28267d741ee628df0c59             -X github.com/rancher/eks-operator/pkg/version.Version=v0.0.0-550fce8"
(...)
	build	vcs.revision=550fce8486ceda01335b28267d741ee628df0c59
(...)

Some branches of eks-operator have the needed package path, but lack the commit ID. We'll propose some PRs to help improve the build process and add the needed information for Rancher's VEX Hub project. None of those PRs are expected to affect the code's behavior and features, as they are only metadata information.

[macedogm]

PRs:

• VEX related improvements in the build process #1068
• [v2.10] VEX related improvements in the build process #1069
• [v2.9] VEX related improvements in the build process #1070
• [v2.8] VEX related improvements in the build process #1071

CC @mbologna and @kkaempf

[kkaempf]

@macedogm all PRs have been merged.
Do you request QA on this ?

[kkaempf]

closing as fixed

[macedogm]

@kkaempf:

Do you request QA on this ?

No, this shouldn't be needed.