build: add reproducible release bundles

cmd/rvbox-server/main.go

@@ -26,12 +26,22 @@ import (
 	"google.golang.org/grpc"
 )
 
+// buildVersion is set by scripts/release for published artifacts. Development
+// and test builds intentionally retain the explicit non-release value.
+var buildVersion = "dev"
+
 func main() {
 	var configPath string
 	var checkConfig bool
+	var version bool
 	flag.StringVar(&configPath, "config", "", "absolute server TOML configuration path")
 	flag.BoolVar(&checkConfig, "check-config", false, "validate server configuration and exit")
+	flag.BoolVar(&version, "version", false, "print build version and exit")
 	flag.Parse()
+	if version {
+		fmt.Fprintln(os.Stdout, buildVersion)
+		return
+	}
 	if configPath == "" {
 		log.Print("rvbox-server: --config is required")
 		os.Exit(2)

cmd/rvbox/main.go

@@ -26,6 +26,9 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
+// buildVersion is set by scripts/release for published artifacts.
+var buildVersion = "dev"
+
 func main() {
 	if err := run(os.Args[1:], os.Stdout, os.Stderr); err != nil {
 		fmt.Fprintln(os.Stderr, "rvbox:", err)
@@ -39,6 +42,10 @@ var nativeTestContextFailures map[clientwindows.ExecutionContext]bool
 // --service with an explicit config path; tray/helper modes cannot silently
 // turn an ordinary process invocation into a privileged service.
 func run(args []string, output, diagnostics io.Writer) error {
+	if len(args) == 1 && args[0] == "--version" {
+		_, err := fmt.Fprintln(output, buildVersion)
+		return err
+	}
 	if len(args) == 0 {
 		return errors.New("an internal mode is required (use --help)")
 	}

cmd/rvbox/main_test.go

@@ -23,6 +23,14 @@ func TestClientModeSelectionRequiresExactlyOneMode_HP_WINCLI_01(t *testing.T) {
 	}
 }
 
+func TestClientVersionDoesNotRequireConfiguration_HP_WINCLI_03(t *testing.T) {
+	t.Parallel()
+	var output, diagnostics bytes.Buffer
+	if err := run([]string{"--version"}, &output, &diagnostics); err != nil || output.String() != "dev\n" {
+		t.Fatalf("version = %q, %v", output.String(), err)
+	}
+}
+
 func TestClientHTTPClientAcceptsMatchingSelfSignedLeaf(t *testing.T) {
 	t.Parallel()
 	server := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {

cmd/rvc/main.go

@@ -25,6 +25,9 @@ import (
 
 const defaultControlSocket = "/run/rvbox/server.sock"
 
+// buildVersion is set by scripts/release for published artifacts.
+var buildVersion = "dev"
+
 func main() {
 	if err := run(os.Args[1:], os.Stdout, os.Stderr); err != nil {
 		fmt.Fprintln(os.Stderr, "rvc:", err)
@@ -33,6 +36,10 @@ func main() {
 }
 
 func run(args []string, output, diagnostics io.Writer) error {
+	if len(args) == 1 && args[0] == "--version" {
+		_, err := fmt.Fprintln(output, buildVersion)
+		return err
+	}
 	if len(args) == 0 {
 		return errors.New("a command is required (stat or run)")
 	}

cmd/rvc/main_test.go

@@ -50,6 +50,14 @@ func TestGlobalRequestIDIsInjectedOnlyForMutations_HP_CTL_12(t *testing.T) {
 	}
 }
 
+func TestVersionDoesNotRequireControlSocket_HP_CTL_16(t *testing.T) {
+	t.Parallel()
+	var output, diagnostics bytes.Buffer
+	if err := run([]string{"--version"}, &output, &diagnostics); err != nil || output.String() != "dev\n" {
+		t.Fatalf("version = %q, %v", output.String(), err)
+	}
+}
+
 func TestRenderCommandStatShowsExpiryRetentionAndWindowsIdentity_HP_CTL_13(t *testing.T) {
 	t.Parallel()
 	expiry := time.Date(2026, 9, 6, 12, 0, 0, 0, time.UTC)