Skip to content

Commit e38dec9

Browse files
hslatmanhslatman
authored
Merge pull request #2167 from smallstep/herman/upgrade-linter
Fix new `golangci-lint` issues
2 parents 86c04f0 + 27944b4 commit e38dec9

33 files changed

+308
-112
lines changed

‎acme/api/revoke.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -180,7 +180,7 @@ func isAccountAuthorized(_ context.Context, dbCert *acme.Certificate, certToBeRe
180180
func wrapRevokeErr(err error) *acme.Error {
181181
t := err.Error()
182182
if strings.Contains(t, "is already revoked") {
183-
return acme.NewError(acme.ErrorAlreadyRevokedType, t) //nolint:govet // allow non-constant error messages
183+
return acme.NewError(acme.ErrorAlreadyRevokedType, t)
184184
}
185185
return acme.WrapErrorISE(err, "error when revoking certificate")
186186
}
@@ -190,9 +190,9 @@ func wrapRevokeErr(err error) *acme.Error {
190190
func wrapUnauthorizedError(cert *x509.Certificate, unauthorizedIdentifiers []acme.Identifier, msg string, err error) *acme.Error {
191191
var acmeErr *acme.Error
192192
if err == nil {
193-
acmeErr = acme.NewError(acme.ErrorUnauthorizedType, msg) //nolint:govet // allow non-constant error messages
193+
acmeErr = acme.NewError(acme.ErrorUnauthorizedType, msg)
194194
} else {
195-
acmeErr = acme.WrapError(acme.ErrorUnauthorizedType, err, msg) //nolint:govet // allow non-constant error messages
195+
acmeErr = acme.WrapError(acme.ErrorUnauthorizedType, err, msg)
196196
}
197197
acmeErr.Status = http.StatusForbidden // RFC8555 7.6 shows example with 403
198198

‎acme/challenge.go

+11-5
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ import (
3939
"github.com/smallstep/certificates/acme/wire"
4040
"github.com/smallstep/certificates/authority/provisioner"
4141
wireprovisioner "github.com/smallstep/certificates/authority/provisioner/wire"
42+
"github.com/smallstep/certificates/internal/cast"
4243
)
4344

4445
type ChallengeType string
@@ -229,7 +230,7 @@ func tlsAlert(err error) uint8 {
229230
if errors.As(err, &opErr) {
230231
v := reflect.ValueOf(opErr.Err)
231232
if v.Kind() == reflect.Uint8 {
232-
return uint8(v.Uint())
233+
return uint8(v.Uint()) //nolint:gosec // handled by checking its type
233234
}
234235
}
235236
return 0
@@ -978,9 +979,9 @@ type tpmAttestationData struct {
978979
type coseAlgorithmIdentifier int32
979980

980981
const (
981-
coseAlgES256 coseAlgorithmIdentifier = -7
982-
coseAlgRS256 coseAlgorithmIdentifier = -257
983-
coseAlgRS1 coseAlgorithmIdentifier = -65535 // deprecated, but (still) often used in TPMs
982+
coseAlgES256 = coseAlgorithmIdentifier(-7)
983+
coseAlgRS256 = coseAlgorithmIdentifier(-257)
984+
coseAlgRS1 = coseAlgorithmIdentifier(-65535) // deprecated, but (still) often used in TPMs
984985
)
985986

986987
func doTPMAttestationFormat(_ context.Context, prov Provisioner, ch *Challenge, jwk *jose.JSONWebKey, att *attestationObject) (*tpmAttestationData, error) {
@@ -1105,8 +1106,13 @@ func doTPMAttestationFormat(_ context.Context, prov Provisioner, ch *Challenge,
11051106
return nil, NewDetailedError(ErrorBadAttestationStatementType, "invalid alg in attestation statement")
11061107
}
11071108

1109+
algI32, err := cast.SafeInt32(alg)
1110+
if err != nil {
1111+
return nil, WrapDetailedError(ErrorBadAttestationStatementType, err, "invalid alg %d in attestation statement", alg)
1112+
}
1113+
11081114
var hash crypto.Hash
1109-
switch coseAlgorithmIdentifier(alg) {
1115+
switch coseAlgorithmIdentifier(algI32) {
11101116
case coseAlgRS256, coseAlgES256:
11111117
hash = crypto.SHA256
11121118
case coseAlgRS1:

‎acme/linker.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func GetUnescapedPathSuffix(typ LinkType, provisionerName string, inputs ...stri
8686
case AccountLinkType, OrderLinkType, AuthzLinkType, CertificateLinkType:
8787
return fmt.Sprintf("/%s/%s/%s", provisionerName, typ, inputs[0])
8888
case ChallengeLinkType:
89-
return fmt.Sprintf("/%s/%s/%s/%s", provisionerName, typ, inputs[0], inputs[1])
89+
return fmt.Sprintf("/%s/%s/%s/%s", provisionerName, typ, inputs[0], inputs[1]) //nolint:gosec // operating on internally defined inputs
9090
case OrdersByAccountLinkType:
9191
return fmt.Sprintf("/%s/%s/%s/orders", provisionerName, AccountLinkType, inputs[0])
9292
case FinalizeLinkType:

‎acme/order.go

-1
Original file line numberDiff line numberDiff line change
@@ -309,7 +309,6 @@ func (o *Order) Finalize(ctx context.Context, db DB, csr *x509.CertificateReques
309309
// Add subproblem for webhook errors, others can be added later.
310310
var webhookErr *webhook.Error
311311
if errors.As(err, &webhookErr) {
312-
//nolint:govet // ignore non-constant format string
313312
acmeError := NewDetailedError(ErrorUnauthorizedType, webhookErr.Error())
314313
acmeError.AddSubproblems(Subproblem{
315314
Type: fmt.Sprintf("urn:smallstep:acme:error:%s", webhookErr.Code),

‎api/api.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import (
44
"bytes"
55
"context"
66
"crypto"
7-
"crypto/dsa" // support legacy algorithms
7+
"crypto/dsa" //nolint:staticcheck // support legacy algorithms
88
"crypto/ecdsa"
99
"crypto/ed25519"
1010
"crypto/rsa"
@@ -31,6 +31,7 @@ import (
3131
"github.com/smallstep/certificates/authority/config"
3232
"github.com/smallstep/certificates/authority/provisioner"
3333
"github.com/smallstep/certificates/errs"
34+
"github.com/smallstep/certificates/internal/cast"
3435
"github.com/smallstep/certificates/logging"
3536
)
3637

@@ -595,8 +596,8 @@ func LogSSHCertificate(w http.ResponseWriter, cert *ssh.Certificate) {
595596
m := map[string]interface{}{
596597
"serial": cert.Serial,
597598
"principals": cert.ValidPrincipals,
598-
"valid-from": time.Unix(int64(cert.ValidAfter), 0).Format(time.RFC3339),
599-
"valid-to": time.Unix(int64(cert.ValidBefore), 0).Format(time.RFC3339),
599+
"valid-from": time.Unix(cast.Int64(cert.ValidAfter), 0).Format(time.RFC3339),
600+
"valid-to": time.Unix(cast.Int64(cert.ValidBefore), 0).Format(time.RFC3339),
600601
"certificate": certificate,
601602
"certificate-type": certificateType,
602603
}

‎api/ssh.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"github.com/smallstep/certificates/authority/config"
2121
"github.com/smallstep/certificates/authority/provisioner"
2222
"github.com/smallstep/certificates/errs"
23+
"github.com/smallstep/certificates/internal/cast"
2324
"github.com/smallstep/certificates/templates"
2425
)
2526

@@ -331,8 +332,8 @@ func SSHSign(w http.ResponseWriter, r *http.Request) {
331332
// Enforce the same duration as ssh certificate.
332333
signOpts = append(signOpts, &identityModifier{
333334
Identity: getIdentityURI(cr),
334-
NotBefore: time.Unix(int64(cert.ValidAfter), 0),
335-
NotAfter: time.Unix(int64(cert.ValidBefore), 0),
335+
NotBefore: time.Unix(cast.Int64(cert.ValidAfter), 0),
336+
NotAfter: time.Unix(cast.Int64(cert.ValidBefore), 0),
336337
})
337338

338339
certChain, err := a.SignWithContext(ctx, cr, provisioner.SignOptions{}, signOpts...)

‎api/sshRekey.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"github.com/smallstep/certificates/api/render"
1111
"github.com/smallstep/certificates/authority/provisioner"
1212
"github.com/smallstep/certificates/errs"
13+
"github.com/smallstep/certificates/internal/cast"
1314
)
1415

1516
// SSHRekeyRequest is the request body of an SSH certificate request.
@@ -80,8 +81,8 @@ func SSHRekey(w http.ResponseWriter, r *http.Request) {
8081
}
8182

8283
// Match identity cert with the SSH cert
83-
notBefore := time.Unix(int64(oldCert.ValidAfter), 0)
84-
notAfter := time.Unix(int64(oldCert.ValidBefore), 0)
84+
notBefore := time.Unix(cast.Int64(oldCert.ValidAfter), 0)
85+
notAfter := time.Unix(cast.Int64(oldCert.ValidBefore), 0)
8586

8687
identity, err := renewIdentityCertificate(r, notBefore, notAfter)
8788
if err != nil {

‎api/sshRenew.go

+3-2
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/smallstep/certificates/api/render"
1212
"github.com/smallstep/certificates/authority/provisioner"
1313
"github.com/smallstep/certificates/errs"
14+
"github.com/smallstep/certificates/internal/cast"
1415
)
1516

1617
// SSHRenewRequest is the request body of an SSH certificate request.
@@ -72,8 +73,8 @@ func SSHRenew(w http.ResponseWriter, r *http.Request) {
7273
}
7374

7475
// Match identity cert with the SSH cert
75-
notBefore := time.Unix(int64(oldCert.ValidAfter), 0)
76-
notAfter := time.Unix(int64(oldCert.ValidBefore), 0)
76+
notBefore := time.Unix(cast.Int64(oldCert.ValidAfter), 0)
77+
notAfter := time.Unix(cast.Int64(oldCert.ValidBefore), 0)
7778

7879
identity, err := renewIdentityCertificate(r, notBefore, notAfter)
7980
if err != nil {

‎authority/admin/api/webhook.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ func (war *webhookAdminResponder) UpdateProvisionerWebhook(w http.ResponseWriter
202202
}
203203
if !found {
204204
msg := fmt.Sprintf("provisioner %q has no webhook with the name %q", prov.Name, newWebhook.Name)
205-
err := admin.NewError(admin.ErrorNotFoundType, msg) //nolint:govet // allow non-constant error messages
205+
err := admin.NewError(admin.ErrorNotFoundType, msg)
206206
render.Error(w, r, err)
207207
return
208208
}

‎authority/linkedca.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/smallstep/certificates/authority/admin"
2929
"github.com/smallstep/certificates/authority/provisioner"
3030
"github.com/smallstep/certificates/db"
31+
"github.com/smallstep/certificates/internal/cast"
3132
)
3233

3334
const uuidPattern = "^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$"
@@ -336,7 +337,7 @@ func (c *linkedCaClient) Revoke(crt *x509.Certificate, rci *db.RevokedCertificat
336337
Serial: rci.Serial,
337338
PemCertificate: serializeCertificate(crt),
338339
Reason: rci.Reason,
339-
ReasonCode: linkedca.RevocationReasonCode(rci.ReasonCode),
340+
ReasonCode: linkedca.RevocationReasonCode(cast.Int32(rci.ReasonCode)),
340341
Passive: true,
341342
})
342343

@@ -350,7 +351,7 @@ func (c *linkedCaClient) RevokeSSH(cert *ssh.Certificate, rci *db.RevokedCertifi
350351
Serial: rci.Serial,
351352
Certificate: serializeSSHCertificate(cert),
352353
Reason: rci.Reason,
353-
ReasonCode: linkedca.RevocationReasonCode(rci.ReasonCode),
354+
ReasonCode: linkedca.RevocationReasonCode(cast.Int32(rci.ReasonCode)),
354355
Passive: true,
355356
})
356357

@@ -403,7 +404,7 @@ func createProvisionerIdentity(p provisioner.Interface) *linkedca.ProvisionerIde
403404
}
404405
return &linkedca.ProvisionerIdentity{
405406
Id: p.GetID(),
406-
Type: linkedca.Provisioner_Type(p.GetType()),
407+
Type: linkedca.Provisioner_Type(cast.Int32(int(p.GetType()))),
407408
Name: p.GetName(),
408409
}
409410
}

‎authority/provisioner/collection.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,10 @@ import (
1212
"strings"
1313
"sync"
1414

15-
"github.com/smallstep/certificates/authority/admin"
1615
"go.step.sm/crypto/jose"
16+
17+
"github.com/smallstep/certificates/authority/admin"
18+
"github.com/smallstep/certificates/internal/cast"
1719
)
1820

1921
// DefaultProvisionersLimit is the default limit for listing provisioners.
@@ -210,7 +212,7 @@ func (c *Collection) Store(p Interface) error {
210212
// 0x00000000, 0x00000001, 0x00000002, ...
211213
bi := make([]byte, 4)
212214
sum := provisionerSum(p)
213-
binary.BigEndian.PutUint32(bi, uint32(c.sorted.Len()))
215+
binary.BigEndian.PutUint32(bi, cast.Uint32(c.sorted.Len()))
214216
sum[0], sum[1], sum[2], sum[3] = bi[0], bi[1], bi[2], bi[3]
215217
c.sorted = append(c.sorted, uidProvisioner{
216218
provisioner: p,

‎authority/provisioner/controller.go

+7-4
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,14 @@ import (
88
"time"
99

1010
"github.com/pkg/errors"
11+
"golang.org/x/crypto/ssh"
12+
13+
"github.com/smallstep/linkedca"
14+
1115
"github.com/smallstep/certificates/errs"
16+
"github.com/smallstep/certificates/internal/cast"
1217
"github.com/smallstep/certificates/internal/httptransport"
1318
"github.com/smallstep/certificates/webhook"
14-
"github.com/smallstep/linkedca"
15-
"golang.org/x/crypto/ssh"
1619
)
1720

1821
// Controller wraps a provisioner with other attributes useful in callback
@@ -189,10 +192,10 @@ func DefaultAuthorizeSSHRenew(_ context.Context, p *Controller, cert *ssh.Certif
189192
}
190193

191194
unixNow := time.Now().Unix()
192-
if after := int64(cert.ValidAfter); after < 0 || unixNow < int64(cert.ValidAfter) {
195+
if after := cast.Int64(cert.ValidAfter); after < 0 || unixNow < cast.Int64(cert.ValidAfter) {
193196
return errs.Unauthorized("certificate is not yet valid")
194197
}
195-
if before := int64(cert.ValidBefore); cert.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before || before < 0) && !p.Claimer.AllowRenewalAfterExpiry() {
198+
if before := cast.Int64(cert.ValidBefore); cert.ValidBefore != uint64(ssh.CertTimeInfinity) && (unixNow >= before || before < 0) && !p.Claimer.AllowRenewalAfterExpiry() {
196199
return errs.Unauthorized("certificate has expired")
197200
}
198201

‎authority/provisioner/jwk.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"go.step.sm/crypto/x509util"
1515

1616
"github.com/smallstep/certificates/errs"
17+
"github.com/smallstep/certificates/internal/cast"
1718
)
1819

1920
// jwtPayload extends jwt.Claims with step attributes.
@@ -249,7 +250,7 @@ func (p *JWK) AuthorizeSSHSign(_ context.Context, token string) ([]SignOption, e
249250
// Use options in the token.
250251
if opts.CertType != "" {
251252
if certType, err = sshutil.CertTypeFromString(opts.CertType); err != nil {
252-
return nil, errs.BadRequestErr(err, err.Error()) //nolint:govet // allow non-constant error messages
253+
return nil, errs.BadRequestErr(err, err.Error())
253254
}
254255
}
255256
if opts.KeyID != "" {
@@ -274,10 +275,10 @@ func (p *JWK) AuthorizeSSHSign(_ context.Context, token string) ([]SignOption, e
274275
// Add modifiers from custom claims
275276
t := now()
276277
if !opts.ValidAfter.IsZero() {
277-
signOptions = append(signOptions, sshCertValidAfterModifier(opts.ValidAfter.RelativeTime(t).Unix()))
278+
signOptions = append(signOptions, sshCertValidAfterModifier(cast.Uint64(opts.ValidAfter.RelativeTime(t).Unix())))
278279
}
279280
if !opts.ValidBefore.IsZero() {
280-
signOptions = append(signOptions, sshCertValidBeforeModifier(opts.ValidBefore.RelativeTime(t).Unix()))
281+
signOptions = append(signOptions, sshCertValidBeforeModifier(cast.Uint64(opts.ValidBefore.RelativeTime(t).Unix())))
281282
}
282283

283284
return append(signOptions,

‎authority/provisioner/nebula.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,16 @@ import (
1414

1515
"github.com/pkg/errors"
1616
nebula "github.com/slackhq/nebula/cert"
17+
"golang.org/x/crypto/ssh"
1718

1819
"github.com/smallstep/linkedca"
1920
"go.step.sm/crypto/jose"
2021
"go.step.sm/crypto/sshutil"
2122
"go.step.sm/crypto/x25519"
2223
"go.step.sm/crypto/x509util"
23-
"golang.org/x/crypto/ssh"
2424

2525
"github.com/smallstep/certificates/errs"
26+
"github.com/smallstep/certificates/internal/cast"
2627
)
2728

2829
const (
@@ -237,10 +238,10 @@ func (p *Nebula) AuthorizeSSHSign(_ context.Context, token string) ([]SignOption
237238
// Add modifiers from custom claims
238239
t := now()
239240
if !opts.ValidAfter.IsZero() {
240-
signOptions = append(signOptions, sshCertValidAfterModifier(opts.ValidAfter.RelativeTime(t).Unix()))
241+
signOptions = append(signOptions, sshCertValidAfterModifier(cast.Uint64(opts.ValidAfter.RelativeTime(t).Unix())))
241242
}
242243
if !opts.ValidBefore.IsZero() {
243-
signOptions = append(signOptions, sshCertValidBeforeModifier(opts.ValidBefore.RelativeTime(t).Unix()))
244+
signOptions = append(signOptions, sshCertValidBeforeModifier(cast.Uint64(opts.ValidBefore.RelativeTime(t).Unix())))
244245
}
245246
}
246247

0 commit comments

Comments
 (0)