build.go: validate -version argument against regex from lib/build

build.go

@@ -272,6 +272,11 @@ func main() {
 
 	initTargets()
 
+	if version != "unknown-dev" && !buildpkg.AllowedVersionExp.MatchString(version) {
+		// app with unallowed versions shouldn't be built because it won't run
+		log.Fatalf("Invalid version string %q;\n\tdoes not match regexp %v", version, buildpkg.AllowedVersionExp)
+	}
+
 	// Invoking build.go with no parameters at all builds everything (incrementally),
 	// which is what you want for maximum error checking during development.
 	if flag.NArg() == 0 {

lib/build/build.go

@@ -36,7 +36,7 @@ var (
 	LongVersion string
 	Extra       string
 
-	allowedVersionExp = regexp.MustCompile(`^v\d+\.\d+\.\d+(-[a-z0-9]+)*(\.\d+)*(\+\d+-g[0-9a-f]+|\+[0-9a-z]+)?(-[^\s]+)?$`)
+	AllowedVersionExp = regexp.MustCompile(`^v\d+\.\d+\.\d+(-[a-z0-9]+)*(\.\d+)*(\+\d+-g[0-9a-f]+|\+[0-9a-z]+)?(-[^\s]+)?$`)
 
 	envTags = []string{
 		"STGUIASSETS",
@@ -51,8 +51,8 @@ const versionExtraAllowedChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRST
 func init() {
 	if Version != "unknown-dev" {
 		// If not a generic dev build, version string should come from git describe
-		if !allowedVersionExp.MatchString(Version) {
-			log.Fatalf("Invalid version string %q;\n\tdoes not match regexp %v", Version, allowedVersionExp)
+		if !AllowedVersionExp.MatchString(Version) {
+			log.Fatalf("Invalid version string %q;\n\tdoes not match regexp %v", Version, AllowedVersionExp)
 		}
 	}
 	setBuildData()

lib/build/build_test.go

@@ -35,7 +35,7 @@ func TestAllowedVersions(t *testing.T) {
 	}
 
 	for i, c := range testcases {
-		if allowed := allowedVersionExp.MatchString(c.ver); allowed != c.allowed {
+		if allowed := AllowedVersionExp.MatchString(c.ver); allowed != c.allowed {
 			t.Errorf("%d: incorrect result %v != %v for %q", i, allowed, c.allowed, c.ver)
 		}
 	}