fix(audit): keep trimpath rewrites and directory fields apart from selectors

src/application/releaseExposure/ReleaseExposureService.test.ts

@@ -1444,6 +1444,7 @@ describe("ReleaseExposureService Go rooted linker flag paths", () => {
     [`-L=/tmp/private,sdk -s -w`, "/tmp/private,sdk"],
     [`all=-L=/tmp/private,sdk`, "/tmp/private,sdk"],
     [`-tmpdir /srv/obj,1`, "/srv/obj,1"],
+    [`-L "/tmp/private=-sdk"`, "/tmp/private=-sdk"],
   ])("keeps the whole rooted argument in %s", async (value, path) => {
     const report = await goReport(goModule([{ key: "-ldflags", value }]));
     const check = report.checks.find((item) => item.id === "go.build_paths");
@@ -1452,6 +1453,18 @@ describe("ReleaseExposureService Go rooted linker flag paths", () => {
   });
 });
 
+describe("ReleaseExposureService Go trimpath rewrites", () => {
+  it("keeps the rooted half of a relative -trimpath rewrite", async () => {
+    const report = await goReport(
+      goModule([{ key: "-gcflags", value: "-trimpath=src=/srv/build" }]),
+    );
+    const check = report.checks.find((item) => item.id === "go.build_paths");
+    expect(check?.observation.samples).toEqual(
+      expect.arrayContaining(["/srv/build"]),
+    );
+  });
+});
+
 describe("ReleaseExposureService Go relative flag paths", () => {
   it("keeps relative paths given to compiler path flags, attached or not", async () => {
     const report = await goReport(

src/application/releaseExposure/ReleaseExposureService.ts

@@ -983,9 +983,11 @@ const goToolFlagPaths = (
       attached.length === 0 && next !== undefined && !next.startsWith("-");
     const argument = fromNext ? next : attached;
     if (argument.length === 0) continue;
-    if (GO_PATH_LIST_FLAG.test(flag) && filesystemPath(argument) !== null)
-      continue;
+    const list = GO_PATH_LIST_FLAG.test(flag);
+    if (list && filesystemPath(argument) !== null) continue;
     paths.push(argument);
+    // A rewrite list's rooted parts are still read by `flagPaths`.
+    if (list) continue;
     fields.add(flag);
     if (fromNext) fields.add(next);
   }
@@ -1032,7 +1034,9 @@ const goSettingPaths = (key: string, value: string): string[] => {
   return [
     ...flagPaths(
       own.filter(
-        (field) => !whole.fields.has(field.replace(GO_PACKAGE_SELECTOR, "")),
+        (field) =>
+          !whole.fields.has(field) &&
+          !whole.fields.has(field.replace(GO_PACKAGE_SELECTOR, "")),
       ),
     ),
     ...whole.paths,