9cc66c0f32
Currently in Go, a release that is built via `go build main.go` will always be labeled with its version as being `(devel)` (even if building from the [git tag commit](https://github.com/golang/go/issues/50603)): ```sh go version -m /usr/local/bin/nats-server | grep nats-server/v2 dep github.com/nats-io/nats-server/v2 (devel) ``` And in order to include the release version of the module in the binary it has to be built using `go install`: ```sh go install github.com/nats-io/nats-server/v2@v2.9.15 | grep nats-server/v2 path github.com/nats-io/nats-server/v2 mod github.com/nats-io/nats-server/v2 v2.9.15 h1:MuwEJheIwpvFgqvbs20W8Ish2azcygjf4Z0liVu2I4c= ``` This changes to build the package with `go build .` which is going to be enough to fix the trivy / grype issues. This also adds the `trimpath` build flag to remove the filesystem paths from where the binary was built. This should help reducing some of the false positives from vulnerability scanners which are not matching with the proper version of the binary as in #3992 with a `malformed version` warning. Fixes #3992
NATS is a simple, secure and performant communications system for digital systems, services and devices. NATS is part of the Cloud Native Computing Foundation (CNCF). NATS has over 40 client language implementations, and its server can run on-premise, in the cloud, at the edge, and even on a Raspberry Pi. NATS can secure and simplify design and operation of modern distributed systems.
Documentation
- Official Website
- Official Documentation
- FAQ
- Watch a video overview of NATS.
- Watch this video from SCALE 13x to learn more about its origin story and design philosophy.
Contact
- Twitter: Follow us on Twitter!
- Google Groups: Where you can ask questions
- Slack: Click here to join. You can ask question to our maintainers and to the rich and active community.
Contributing
If you are interested in contributing to NATS, read about our...
Roadmap
The NATS product roadmap can be found here.
Security
Security Audit
A third party security audit was performed by Cure53, you can see the full report here.
Reporting Security Vulnerabilities
If you've found a vulnerability or a potential vulnerability in the NATS server, please let us know at nats-security.
License
Unless otherwise noted, the NATS source files are distributed under the Apache Version 2.0 license found in the LICENSE file.