From fc33a74c78914b9f00f8cbf795b8a86aca6d1a29 Mon Sep 17 00:00:00 2001
From: Malte Poll <1780588+malt3@users.noreply.github.com>
Date: Wed, 1 Mar 2023 11:55:12 +0100
Subject: [PATCH] constants: make VersionInfo readonly (#1316)

The variable VersionInfo is supposed to be set by `go build -X ...` during link time but should not be modified at runtime.
This change ensures the underlying var is private and can only be accessed by a public getter.
---
 CMakeLists.txt                                 |  4 ++--
 Dockerfile.build                               |  6 +++---
 bootstrapper/cmd/bootstrapper/run.go           |  2 +-
 .../cmd/configfetchmeasurements_test.go        |  1 -
 cli/internal/cmd/upgradecheck.go               |  2 +-
 cli/internal/cmd/upgradecheck_test.go          |  1 -
 cli/internal/cmd/version.go                    |  2 +-
 cli/internal/cmd/version_test.go               |  2 +-
 cli/internal/helm/client.go                    |  4 ++--
 cli/internal/helm/loader.go                    |  4 ++--
 disk-mapper/cmd/main.go                        |  2 +-
 internal/compatibility/compatibility.go        |  5 ++---
 internal/compatibility/compatibility_test.go   |  4 +---
 internal/config/config.go                      |  2 +-
 internal/config/validation.go                  | 18 ++++++++++--------
 internal/config/validation_test.go             |  4 +---
 internal/constants/constants.go                |  9 +++++++--
 internal/semver/semver.go                      |  2 +-
 joinservice/Dockerfile                         |  2 +-
 joinservice/cmd/main.go                        |  2 +-
 keyservice/Dockerfile                          |  2 +-
 keyservice/cmd/main.go                         |  2 +-
 verify/Dockerfile                              |  2 +-
 verify/cmd/main.go                             |  2 +-
 24 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index f15093693..d05824ea0 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -46,7 +46,7 @@ add_custom_target(upgrade-agent ALL
 # cli
 #
 add_custom_target(cli ALL
-  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/constellation -tags='${CLI_BUILD_TAGS}' -ldflags "-buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}"
+  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/constellation -tags='${CLI_BUILD_TAGS}' -ldflags "-buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}"
   WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/cli
   BYPRODUCTS constellation
 )
@@ -73,7 +73,7 @@ add_custom_target(debugd ALL
 # cdbg
 #
 add_custom_target(cdbg ALL
-  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/cdbg -buildvcs=false -ldflags "-buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}"
+  CGO_ENABLED=0 go build -o ${CMAKE_BINARY_DIR}/cdbg -buildvcs=false -ldflags "-buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}"
   WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}/debugd/cmd/cdbg
   BYPRODUCTS cdbg
 )
diff --git a/Dockerfile.build b/Dockerfile.build
index 665d462b1..4a541ff29 100644
--- a/Dockerfile.build
+++ b/Dockerfile.build
@@ -28,19 +28,19 @@ FROM build AS build-bootstrapper
 WORKDIR /constellation/bootstrapper/
 
 ARG PROJECT_VERSION
-RUN --mount=type=cache,target=/root/.cache/go-build go build -o bootstrapper -tags=disable_tpm_simulator -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}" ./cmd/bootstrapper/
+RUN --mount=type=cache,target=/root/.cache/go-build go build -o bootstrapper -tags=disable_tpm_simulator -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}" ./cmd/bootstrapper/
 
 FROM build AS build-disk-mapper
 WORKDIR /constellation/disk-mapper/
 
 ARG PROJECT_VERSION
-RUN --mount=type=cache,target=/root/.cache/go-build go build -o disk-mapper -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}" ./cmd/
+RUN --mount=type=cache,target=/root/.cache/go-build go build -o disk-mapper -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}" ./cmd/
 
 FROM build AS build-upgrade-agent
 WORKDIR /constellation/upgrade-agent/
 
 ARG PROJECT_VERSION
-RUN --mount=type=cache,target=/root/.cache/go-build go build -o upgrade-agent -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}" ./cmd/
+RUN --mount=type=cache,target=/root/.cache/go-build go build -o upgrade-agent -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}" ./cmd/
 
 FROM scratch AS bootstrapper
 COPY --from=build-bootstrapper /constellation/bootstrapper/bootstrapper /
diff --git a/bootstrapper/cmd/bootstrapper/run.go b/bootstrapper/cmd/bootstrapper/run.go
index a37258e27..0a6639b2e 100644
--- a/bootstrapper/cmd/bootstrapper/run.go
+++ b/bootstrapper/cmd/bootstrapper/run.go
@@ -32,7 +32,7 @@ func run(issuer atls.Issuer, tpm vtpm.TPMOpenFunc, fileHandler file.Handler,
 ) {
 	defer cloudLogger.Close()
 
-	log.With(zap.String("version", constants.VersionInfo)).Infof("Starting bootstrapper")
+	log.With(zap.String("version", constants.VersionInfo())).Infof("Starting bootstrapper")
 	cloudLogger.Disclose("bootstrapper started running...")
 
 	uuid, err := getDiskUUID()
diff --git a/cli/internal/cmd/configfetchmeasurements_test.go b/cli/internal/cmd/configfetchmeasurements_test.go
index 5cdc79eef..7f13fe309 100644
--- a/cli/internal/cmd/configfetchmeasurements_test.go
+++ b/cli/internal/cmd/configfetchmeasurements_test.go
@@ -250,7 +250,6 @@ func TestConfigFetchMeasurements(t *testing.T) {
 
 			gcpConfig := defaultConfigWithExpectedMeasurements(t, config.Default(), cloudprovider.GCP)
 			gcpConfig.Image = "v999.999.999"
-			constants.VersionInfo = "v999.999.999"
 
 			err := fileHandler.WriteYAML(constants.ConfigFilename, gcpConfig, file.OptMkdirAll)
 			require.NoError(err)
diff --git a/cli/internal/cmd/upgradecheck.go b/cli/internal/cmd/upgradecheck.go
index fe12a4684..e19cab8ef 100644
--- a/cli/internal/cmd/upgradecheck.go
+++ b/cli/internal/cmd/upgradecheck.go
@@ -79,7 +79,7 @@ func runUpgradeCheck(cmd *cobra.Command, args []string) error {
 			client:         http.DefaultClient,
 			rekor:          rekor,
 			flags:          flags,
-			cliVersion:     compatibility.EnsurePrefixV(constants.VersionInfo),
+			cliVersion:     compatibility.EnsurePrefixV(constants.VersionInfo()),
 			log:            log,
 		},
 		log: log,
diff --git a/cli/internal/cmd/upgradecheck_test.go b/cli/internal/cmd/upgradecheck_test.go
index a9682491d..65c1fe097 100644
--- a/cli/internal/cmd/upgradecheck_test.go
+++ b/cli/internal/cmd/upgradecheck_test.go
@@ -233,7 +233,6 @@ func TestUpgradeCheck(t *testing.T) {
 			assert := assert.New(t)
 			require := require.New(t)
 
-			constants.VersionInfo = "v0.0.0"
 			fileHandler := file.NewHandler(afero.NewMemMapFs())
 			cfg := defaultConfigWithExpectedMeasurements(t, config.Default(), tc.csp)
 			require.NoError(fileHandler.WriteYAML(tc.flags.configPath, cfg))
diff --git a/cli/internal/cmd/version.go b/cli/internal/cmd/version.go
index 1c801123b..828a6abcc 100644
--- a/cli/internal/cmd/version.go
+++ b/cli/internal/cmd/version.go
@@ -34,7 +34,7 @@ func runVersion(cmd *cobra.Command, args []string) {
 
 	commit, state, date, goVersion, compiler, platform := parseBuildInfo(buildInfo)
 
-	cmd.Printf("Version:\t%s (%s)\n", constants.VersionInfo, constants.VersionBuild)
+	cmd.Printf("Version:\t%s (%s)\n", constants.VersionInfo(), constants.VersionBuild)
 	cmd.Printf("GitCommit:\t%s\n", commit)
 	cmd.Printf("GitTreeState:\t%s\n", state)
 	cmd.Printf("BuildDate:\t%s\n", date)
diff --git a/cli/internal/cmd/version_test.go b/cli/internal/cmd/version_test.go
index 4cb06c70f..8ac18fc00 100644
--- a/cli/internal/cmd/version_test.go
+++ b/cli/internal/cmd/version_test.go
@@ -28,7 +28,7 @@ func TestVersionCmd(t *testing.T) {
 
 	s, err := io.ReadAll(b)
 	assert.NoError(err)
-	assert.Contains(string(s), constants.VersionInfo)
+	assert.Contains(string(s), constants.VersionInfo())
 }
 
 func TestParseBuildInfo(t *testing.T) {
diff --git a/cli/internal/helm/client.go b/cli/internal/helm/client.go
index b33ec8364..ffe02533b 100644
--- a/cli/internal/helm/client.go
+++ b/cli/internal/helm/client.go
@@ -149,11 +149,11 @@ func (c *Client) upgradeRelease(
 		values = loader.loadCertManagerValues()
 	case conOperatorsReleaseName:
 		// ensure that the operator chart has the same version as the CLI
-		updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo))
+		updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo()))
 		values, err = loader.loadOperatorsValues()
 	case conServicesReleaseName:
 		// ensure that the services chart has the same version as the CLI
-		updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo))
+		updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo()))
 		values, err = loader.loadConstellationServicesValues()
 	default:
 		return fmt.Errorf("invalid release name: %s", releaseName)
diff --git a/cli/internal/helm/loader.go b/cli/internal/helm/loader.go
index 68bd23aac..e89895361 100644
--- a/cli/internal/helm/loader.go
+++ b/cli/internal/helm/loader.go
@@ -283,7 +283,7 @@ func (i *ChartLoader) loadOperators() (helm.Release, error) {
 		return helm.Release{}, fmt.Errorf("loading operators chart: %w", err)
 	}
 
-	updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo))
+	updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo()))
 
 	values, err := i.loadOperatorsValues()
 	if err != nil {
@@ -370,7 +370,7 @@ func (i *ChartLoader) loadConstellationServices() (helm.Release, error) {
 		return helm.Release{}, fmt.Errorf("loading constellation-services chart: %w", err)
 	}
 
-	updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo))
+	updateVersions(chart, compatibility.EnsurePrefixV(constants.VersionInfo()))
 
 	values, err := i.loadConstellationServicesValues()
 	if err != nil {
diff --git a/disk-mapper/cmd/main.go b/disk-mapper/cmd/main.go
index d3f164a82..e574f96cd 100644
--- a/disk-mapper/cmd/main.go
+++ b/disk-mapper/cmd/main.go
@@ -57,7 +57,7 @@ func main() {
 
 	flag.Parse()
 	log := logger.New(logger.JSONLog, logger.VerbosityFromInt(*verbosity))
-	log.With(zap.String("version", constants.VersionInfo), zap.String("cloudProvider", *csp)).
+	log.With(zap.String("version", constants.VersionInfo()), zap.String("cloudProvider", *csp)).
 		Infof("Starting disk-mapper")
 
 	// set up metadata API and quote issuer for aTLS connections
diff --git a/internal/compatibility/compatibility.go b/internal/compatibility/compatibility.go
index 39c700e46..e089a7ddd 100644
--- a/internal/compatibility/compatibility.go
+++ b/internal/compatibility/compatibility.go
@@ -14,7 +14,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/edgelesssys/constellation/v2/internal/constants"
 	"golang.org/x/mod/semver"
 )
 
@@ -93,8 +92,8 @@ func IsValidUpgrade(a, b string) error {
 }
 
 // BinaryWith tests that this binarie's version is greater or equal than some target version, but not further away than one minor version.
-func BinaryWith(target string) error {
-	binaryVersion := EnsurePrefixV(constants.VersionInfo)
+func BinaryWith(binaryVersion, target string) error {
+	binaryVersion = EnsurePrefixV(binaryVersion)
 	target = EnsurePrefixV(target)
 	if !semver.IsValid(binaryVersion) || !semver.IsValid(target) {
 		return ErrSemVer
diff --git a/internal/compatibility/compatibility_test.go b/internal/compatibility/compatibility_test.go
index 37f185757..35c4e7517 100644
--- a/internal/compatibility/compatibility_test.go
+++ b/internal/compatibility/compatibility_test.go
@@ -9,7 +9,6 @@ package compatibility
 import (
 	"testing"
 
-	"github.com/edgelesssys/constellation/v2/internal/constants"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -144,8 +143,7 @@ func TestBinaryWith(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			assert := assert.New(t)
 
-			constants.VersionInfo = tc.cli
-			err := BinaryWith(tc.target)
+			err := BinaryWith(tc.cli, tc.target)
 			if tc.wantError {
 				assert.Error(err)
 				return
diff --git a/internal/config/config.go b/internal/config/config.go
index 90583b94b..151231be8 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -279,7 +279,7 @@ func Default() *Config {
 		Version:             Version2,
 		Image:               defaultImage,
 		Name:                defaultName,
-		MicroserviceVersion: compatibility.EnsurePrefixV(constants.VersionInfo),
+		MicroserviceVersion: compatibility.EnsurePrefixV(constants.VersionInfo()),
 		KubernetesVersion:   string(versions.Default),
 		StateDiskSizeGB:     30,
 		DebugCluster:        toPtr(false),
diff --git a/internal/config/validation.go b/internal/config/validation.go
index 1f2160389..b5b9110f2 100644
--- a/internal/config/validation.go
+++ b/internal/config/validation.go
@@ -366,18 +366,19 @@ func registerVersionCompatibilityError(ut ut.Translator) error {
 }
 
 func translateVersionCompatibilityError(ut ut.Translator, fe validator.FieldError) string {
-	err := validateVersionCompatibilityHelper(fe.Field(), fe.Value().(string))
+	binaryVersion := constants.VersionInfo()
+	err := validateVersionCompatibilityHelper(binaryVersion, fe.Field(), fe.Value().(string))
 	var msg string
 
 	switch {
 	case errors.Is(err, compatibility.ErrSemVer):
 		msg = fmt.Sprintf("configured version (%s) does not adhere to SemVer syntax", fe.Value().(string))
 	case errors.Is(err, compatibility.ErrMajorMismatch):
-		msg = fmt.Sprintf("the CLI's major version (%s) has to match your configured major version (%s). Use --force to ignore the version mismatch.", constants.VersionInfo, fe.Value().(string))
+		msg = fmt.Sprintf("the CLI's major version (%s) has to match your configured major version (%s). Use --force to ignore the version mismatch.", constants.VersionInfo(), fe.Value().(string))
 	case errors.Is(err, compatibility.ErrMinorDrift):
-		msg = fmt.Sprintf("the CLI's minor version (%s) and the configured version (%s) are more than one minor version apart. Use --force to ignore the version mismatch.", constants.VersionInfo, fe.Value().(string))
+		msg = fmt.Sprintf("the CLI's minor version (%s) and the configured version (%s) are more than one minor version apart. Use --force to ignore the version mismatch.", constants.VersionInfo(), fe.Value().(string))
 	case errors.Is(err, compatibility.ErrOutdatedCLI):
-		msg = fmt.Sprintf("the CLI's version (%s) is older than the configured version (%s). Use --force to ignore the version mismatch.", constants.VersionInfo, fe.Value().(string))
+		msg = fmt.Sprintf("the CLI's version (%s) is older than the configured version (%s). Use --force to ignore the version mismatch.", constants.VersionInfo(), fe.Value().(string))
 	default:
 		msg = err.Error()
 	}
@@ -389,14 +390,15 @@ func translateVersionCompatibilityError(ut ut.Translator, fe validator.FieldErro
 
 // Check that the validated field and the CLI version are not more than one minor version apart.
 func validateVersionCompatibility(fl validator.FieldLevel) bool {
-	if err := validateVersionCompatibilityHelper(fl.FieldName(), fl.Field().String()); err != nil {
+	binaryVersion := constants.VersionInfo()
+	if err := validateVersionCompatibilityHelper(binaryVersion, fl.FieldName(), fl.Field().String()); err != nil {
 		return false
 	}
 
 	return true
 }
 
-func validateVersionCompatibilityHelper(fieldName string, configuredVersion string) error {
+func validateVersionCompatibilityHelper(binaryVersion, fieldName, configuredVersion string) error {
 	if fieldName == "Image" {
 		imageVersion, err := versionsapi.NewVersionFromShortPath(configuredVersion, versionsapi.VersionKindImage)
 		if err != nil {
@@ -406,14 +408,14 @@ func validateVersionCompatibilityHelper(fieldName string, configuredVersion stri
 	}
 
 	if fieldName == "MicroserviceVersion" {
-		cliVersion := compatibility.EnsurePrefixV(constants.VersionInfo)
+		cliVersion := compatibility.EnsurePrefixV(binaryVersion)
 		serviceVersion := compatibility.EnsurePrefixV(configuredVersion)
 		if semver.Compare(cliVersion, serviceVersion) == -1 {
 			return fmt.Errorf("the CLI's version (%s) is older than the configured version (%s)", cliVersion, serviceVersion)
 		}
 	}
 
-	return compatibility.BinaryWith(configuredVersion)
+	return compatibility.BinaryWith(binaryVersion, configuredVersion)
 }
 
 func returnsTrue(fl validator.FieldLevel) bool {
diff --git a/internal/config/validation_test.go b/internal/config/validation_test.go
index df804300a..f87917ea3 100644
--- a/internal/config/validation_test.go
+++ b/internal/config/validation_test.go
@@ -9,7 +9,6 @@ package config
 import (
 	"testing"
 
-	"github.com/edgelesssys/constellation/v2/internal/constants"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -39,8 +38,7 @@ func TestValidateVersionCompatibilityHelper(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			assert := assert.New(t)
 
-			constants.VersionInfo = tc.cli
-			err := validateVersionCompatibilityHelper("Image", tc.target)
+			err := validateVersionCompatibilityHelper(tc.cli, "Image", tc.target)
 			if tc.wantError {
 				assert.Error(err)
 				return
diff --git a/internal/constants/constants.go b/internal/constants/constants.go
index 2fbd77be0..51470e0b6 100644
--- a/internal/constants/constants.go
+++ b/internal/constants/constants.go
@@ -182,5 +182,10 @@ const (
 	CDNAPIPrefix = "constellation/v1"
 )
 
-// VersionInfo is the version of a binary. Left as a separate variable to allow override during build.
-var VersionInfo = "0.0.0"
+// VersionInfo returns the version of a binary.
+func VersionInfo() string {
+	return versionInfo
+}
+
+// versionInfo is the version of a binary. Left as a separate variable to allow override during build.
+var versionInfo = "0.0.0"
diff --git a/internal/semver/semver.go b/internal/semver/semver.go
index 9045f1d9d..6da9a899c 100644
--- a/internal/semver/semver.go
+++ b/internal/semver/semver.go
@@ -70,7 +70,7 @@ func (v Semver) IsUpgradeTo(other Semver) bool {
 // CompatibleWithBinary returns if a version is compatible version of the current built binary.
 // It checks if the version of the binary is equal or greater than the current version and allows a drift of at most one minor version.
 func (v Semver) CompatibleWithBinary() bool {
-	binaryVersion, err := NewSemver(constants.VersionInfo)
+	binaryVersion, err := NewSemver(constants.VersionInfo())
 	if err != nil {
 		return false
 	}
diff --git a/joinservice/Dockerfile b/joinservice/Dockerfile
index 412e0d588..062e2d714 100644
--- a/joinservice/Dockerfile
+++ b/joinservice/Dockerfile
@@ -23,7 +23,7 @@ RUN rm -rf ./hack/
 
 WORKDIR /constellation/joinservice
 ARG PROJECT_VERSION=0.0.0
-RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -o join-service -trimpath -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}" ./cmd/
+RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -o join-service -trimpath -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}" ./cmd/
 
 # Use gcr.io/distroless/static here since we need CA certificates to be installed for aTLS operations on GCP.
 FROM gcr.io/distroless/static@sha256:5b2fa762fb6ebf66ff88ae1db2dc4ad8fc6ddf1164477297dfac1a09f20e7339 as release
diff --git a/joinservice/cmd/main.go b/joinservice/cmd/main.go
index e408f916d..c0f547262 100644
--- a/joinservice/cmd/main.go
+++ b/joinservice/cmd/main.go
@@ -45,7 +45,7 @@ func main() {
 	flag.Parse()
 
 	log := logger.New(logger.JSONLog, logger.VerbosityFromInt(*verbosity))
-	log.With(zap.String("version", constants.VersionInfo), zap.String("cloudProvider", *provider)).
+	log.With(zap.String("version", constants.VersionInfo()), zap.String("cloudProvider", *provider)).
 		Infof("Constellation Node Join Service")
 
 	handler := file.NewHandler(afero.NewOsFs())
diff --git a/keyservice/Dockerfile b/keyservice/Dockerfile
index 26fae3ba6..7ec91d60d 100644
--- a/keyservice/Dockerfile
+++ b/keyservice/Dockerfile
@@ -24,7 +24,7 @@ RUN rm -rf ./hack/
 RUN mkdir -p /constellation/build
 WORKDIR /constellation/keyservice/cmd
 ARG PROJECT_VERSION=0.0.0
-RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -o /constellation/build/keyservice -trimpath -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}"
+RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -o /constellation/build/keyservice -trimpath -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}"
 
 FROM gcr.io/distroless/static:nonroot@sha256:9ec950c09380320e203369982691eb821df6a6974edf9f4bb8e661d4b77b9d99 as release
 COPY --from=build /constellation/build/keyservice /keyservice
diff --git a/keyservice/cmd/main.go b/keyservice/cmd/main.go
index 927d113b8..da6354866 100644
--- a/keyservice/cmd/main.go
+++ b/keyservice/cmd/main.go
@@ -33,7 +33,7 @@ func main() {
 	flag.Parse()
 	log := logger.New(logger.JSONLog, logger.VerbosityFromInt(*verbosity))
 
-	log.With(zap.String("version", constants.VersionInfo)).
+	log.With(zap.String("version", constants.VersionInfo())).
 		Infof("Constellation Key Management Service")
 
 	// read master secret and salt
diff --git a/verify/Dockerfile b/verify/Dockerfile
index 08d659b29..54e81d77e 100644
--- a/verify/Dockerfile
+++ b/verify/Dockerfile
@@ -23,7 +23,7 @@ RUN rm -rf ./hack/
 
 WORKDIR /constellation/verify
 ARG PROJECT_VERSION=0.0.0
-RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -o verify-service -trimpath -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.VersionInfo=${PROJECT_VERSION}" ./cmd/
+RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -o verify-service -trimpath -buildvcs=false -ldflags "-s -w -buildid='' -X github.com/edgelesssys/constellation/v2/internal/constants.versionInfo=${PROJECT_VERSION}" ./cmd/
 
 FROM scratch AS release
 COPY --from=build /constellation/verify/verify-service /verify
diff --git a/verify/cmd/main.go b/verify/cmd/main.go
index 18683d484..7e1965163 100644
--- a/verify/cmd/main.go
+++ b/verify/cmd/main.go
@@ -29,7 +29,7 @@ func main() {
 	flag.Parse()
 	log := logger.New(logger.JSONLog, logger.VerbosityFromInt(*verbosity))
 
-	log.With(zap.String("version", constants.VersionInfo), zap.String("cloudProvider", *provider)).
+	log.With(zap.String("version", constants.VersionInfo()), zap.String("cloudProvider", *provider)).
 		Infof("Constellation Verification Service")
 
 	var issuer server.AttestationIssuer