version: add way to display a version when using go get or go install

Makefile

@@ -40,7 +40,7 @@ endif
 
 PKG=github.com/sigstore/cosign/cmd/cosign/cli
 
-LDFLAGS="-X $(PKG).gitVersion=$(GIT_VERSION) -X $(PKG).gitCommit=$(GIT_HASH) -X $(PKG).gitTreeState=$(GIT_TREESTATE) -X $(PKG).buildDate=$(BUILD_DATE)"
+LDFLAGS="-X $(PKG).GitVersion=$(GIT_VERSION) -X $(PKG).gitCommit=$(GIT_HASH) -X $(PKG).gitTreeState=$(GIT_TREESTATE) -X $(PKG).buildDate=$(BUILD_DATE)"
 
 .PHONY: all lint test clean cosign cross
 

cmd/cosign/cli/version.go

@@ -35,7 +35,7 @@ import (
 var (
 	// Output of "git describe". The prerequisite is that the branch should be
 	// tagged using the correct versioning strategy.
-	gitVersion = "unknown"
+	GitVersion string = "devel"
 	// SHA1 from git, output of $(git rev-parse HEAD)
 	gitCommit = "unknown"
 	// State of git tree, either "clean" or "dirty"
@@ -82,10 +82,8 @@ type Info struct {
 }
 
 func VersionInfo() Info {
-	// These variables typically come from -ldflags settings and in
-	// their absence fallback to the global defaults set above.
 	return Info{
-		GitVersion:   gitVersion,
+		GitVersion:   GitVersion,
 		GitCommit:    gitCommit,
 		GitTreeState: gitTreeState,
 		BuildDate:    buildDate,

cmd/cosign/main.go

@@ -20,6 +20,7 @@ import (
 	"flag"
 	"fmt"
 	"os"
+	"runtime/debug"
 
 	"github.com/google/go-containerregistry/pkg/logs"
 	"github.com/peterbourgon/ff/v3/ffcli"
@@ -34,7 +35,7 @@ import (
 
 var (
 	rootFlagSet    = flag.NewFlagSet("cosign", flag.ExitOnError)
-	debug          = rootFlagSet.Bool("d", false, "log debug output")
+	logDebug       = rootFlagSet.Bool("d", false, "log debug output")
 	outputFilename = rootFlagSet.String("output-file", "", "log output to a file")
 )
 
@@ -93,7 +94,7 @@ func main() {
 		os.Stdout = out
 	}
 
-	if *debug {
+	if *logDebug {
 		logs.Debug.SetOutput(os.Stderr)
 	}
 
@@ -106,3 +107,19 @@ func printErrAndExit(err error) {
 	fmt.Fprintf(os.Stderr, "error: %v\n", err)
 	os.Exit(1)
 }
+
+func init() {
+	// look for the default version and replace it, if found, from runtime build info
+	if cli.GitVersion != "devel" {
+		return
+	}
+
+	bi, ok := debug.ReadBuildInfo()
+	if !ok {
+		return
+	}
+
+	// Version is set in artifacts built with -X github.com/sigstore/cosign/cli.GitVersion=1.2.3
+	// Ensure version is also set when installed via go install github.com/sigstore/cosign/cmd/cosign
+	cli.GitVersion = bi.Main.Version
+}