fix: harden release validation

scripts/test-release.sh

@@ -5,15 +5,52 @@ repo=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
 work=$(mktemp -d)
 trap 'rm -rf "$work"' EXIT HUP INT TERM
 
+assert_no_process_test_seam() {
+  artifact=$1
+  if LC_ALL=C grep -a -F \
+    -e 'proxyctl_process_test' \
+    -e 'PROXYCTL_PROCESS_TEST_HOME' \
+    "$artifact" >/dev/null
+  then
+    printf 'release artifact contains the process-test seam: %s\n' "$artifact" >&2
+    return 1
+  fi
+}
+
 VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/first"
 VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/second"
+GOFLAGS='-tags=proxyctl_process_test' \
+  VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/malicious-goflags"
+printf 'GOFLAGS=-tags=proxyctl_process_test\n' >"$work/malicious-goenv"
+GOENV="$work/malicious-goenv" \
+  VERSION=v1.0.0 "$repo/scripts/build-release.sh" "$work/malicious-goenv-build"
 
 for arch in amd64 arm64; do
   binary="proxyctl-linux-$arch"
   test -x "$work/first/$binary"
   cmp "$work/first/$binary" "$work/second/$binary"
+  cmp "$work/first/$binary" "$work/malicious-goflags/$binary"
+  cmp "$work/first/$binary" "$work/malicious-goenv-build/$binary"
+  assert_no_process_test_seam "$work/first/$binary"
+  assert_no_process_test_seam "$work/malicious-goflags/$binary"
+  assert_no_process_test_seam "$work/malicious-goenv-build/$binary"
 done
 cmp "$work/first/SHA256SUMS" "$work/second/SHA256SUMS"
+cmp "$work/first/SHA256SUMS" "$work/malicious-goflags/SHA256SUMS"
+cmp "$work/first/SHA256SUMS" "$work/malicious-goenv-build/SHA256SUMS"
+
+(
+  cd "$repo"
+  GOENV=off GOFLAGS= CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -mod=readonly -buildvcs=false -trimpath \
+    -tags=proxyctl_process_test -o "$work/known-contaminated" ./cmd/proxyctl
+)
+if assert_no_process_test_seam "$work/known-contaminated"; then
+  echo 'release artifact validation accepted a known contaminated binary' >&2
+  exit 1
+fi
+printf 'process-test seam scan rejected a known contaminated binary\n'
+
 (
   cd "$work/first"
   sha256sum -c SHA256SUMS