strip Go version information from the binary too

Fixes #44.

main.go

@@ -870,6 +870,12 @@ func transformLink(args []string) ([]string, error) {
 	// link operation or the main package's compilation.
 	flags = flagSetValue(flags, "-buildid", "")
 
+	// Ensure that we don't leak the Go version that built this binary. This
+	// is present as a string in the runtime package, and the linker has no
+	// flag like -buildid to omit it, so we manually replace the values.
+	flags = append(flags, "-X", "runtime/internal/sys.TheVersion=unknown")
+	flags = append(flags, "-X", "runtime.buildVersion=unknown")
+
 	flags = append(flags, "-w", "-s")
 	return append(flags, paths...), nil
 }

testdata/scripts/basic.txt

@@ -19,6 +19,12 @@ cmp stderr main.stderr
 go tool buildid main$exe
 ! stdout .
 
+# The build version needs to be missing too.
+go version main$exe
+stdout 'unknown'
+! stdout 'go1'
+! stdout 'devel'
+
 ! binsubstr main$exe ${WORK@R} 'globalVar' 'globalFunc'
 
 [short] stop # checking that the build is reproducible is slow