From 4f43725705f5b7ddcf61387ad10fcbc13e4367cb Mon Sep 17 00:00:00 2001
From: sneak <sneak@sneak.berlin>
Date: Sun, 9 Aug 2026 00:50:49 +0000
Subject: [PATCH] fix: remove dead nolint:gosec suppressions added for a stale
 toolchain

The 15 //nolint:gosec G703/G704 directives added in 13e9f2c suppressed
findings that only a stale local golangci-lint (v2.10.1) reports; the
repo's pinned golangci-lint:v2.12.2-alpine never raises gosec G703/G704
on these lines, so nolintlint correctly flagged every directive as an
unused suppression and failed the pinned lint build.

Verified with the authoritative docker build --target lint . using the
pinned image, and separately with a locally installed pinned v2.12.2
binary: both report 0 issues after removal.
---
 internal/config/config.go           |  3 +--
 internal/httpfetcher/httpfetcher.go |  1 -
 internal/imgcache/storage.go        | 21 +++++++++------------
 3 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index 839cc48..49b5d25 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -299,7 +299,7 @@ func (c *Config) ensureStateDirWritable() error {
 			keyStateDir, probePath, err)
 	}
 
-	err = os.Remove(probePath) //nolint:gosec // G703: our own probe file, not user input
+	err = os.Remove(probePath)
 	if err != nil {
 		return fmt.Errorf("config key %q: cannot remove probe file %q: %w",
 			keyStateDir, probePath, err)
@@ -411,7 +411,6 @@ func loadConfigFile(log *slog.Logger, appName string) (*smartconfig.Config, erro
 	for _, path := range configPaths {
 		cleanPath := filepath.Clean(path)
 
-		//nolint:gosec // G703: config path is operator-supplied by design
 		_, statErr := os.Stat(cleanPath)
 		if statErr == nil {
 			// A config file that exists but does not parse is a fatal
diff --git a/internal/httpfetcher/httpfetcher.go b/internal/httpfetcher/httpfetcher.go
index edd78d7..0abf1fa 100644
--- a/internal/httpfetcher/httpfetcher.go
+++ b/internal/httpfetcher/httpfetcher.go
@@ -233,7 +233,6 @@ func (f *HTTPFetcher) Fetch(ctx context.Context, url string) (*FetchResult, erro
 
 	startTime := time.Now()
 
-	//nolint:gosec // G704: dialer enforces SSRF protection (ssrfSafeDialer)
 	resp, err := f.client.Do(req)
 
 	fetchDuration := time.Since(startTime)
diff --git a/internal/imgcache/storage.go b/internal/imgcache/storage.go
index 0577f42..55abdcc 100644
--- a/internal/imgcache/storage.go
+++ b/internal/imgcache/storage.go
@@ -94,23 +94,22 @@ func (s *ContentStorage) Store(r io.Reader) (ContentHash, int64, error) {
 	_, err = tmpFile.Write(data)
 	if err != nil {
 		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return "", 0, fmt.Errorf("failed to write content: %w", err)
 	}
 
 	err = tmpFile.Close()
 	if err != nil {
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return "", 0, fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomic rename
-	//nolint:gosec // G703: tmp file is ours, path is derived from content hash
 	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
 	if err != nil {
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return "", 0, fmt.Errorf("failed to rename temp file: %w", err)
 	}
@@ -254,23 +253,22 @@ func (s *MetadataStorage) Store(
 	_, err = tmpFile.Write(data)
 	if err != nil {
 		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return fmt.Errorf("failed to write metadata: %w", err)
 	}
 
 	err = tmpFile.Close()
 	if err != nil {
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomic rename
-	//nolint:gosec // G703: tmp file is ours, path is derived from cache key
 	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
 	if err != nil {
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return fmt.Errorf("failed to rename temp file: %w", err)
 	}
@@ -412,23 +410,22 @@ func (s *VariantStorage) Store(
 	_, err = tmpFile.Write(data)
 	if err != nil {
 		_ = tmpFile.Close()
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return 0, fmt.Errorf("failed to write content: %w", err)
 	}
 
 	err = tmpFile.Close()
 	if err != nil {
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return 0, fmt.Errorf("failed to close temp file: %w", err)
 	}
 
 	// Atomic rename content
-	//nolint:gosec // G703: tmp file is ours, path is derived from cache key
 	err = os.Rename(filepath.Clean(tmpPath), filepath.Clean(path))
 	if err != nil {
-		_ = os.Remove(tmpPath) //nolint:gosec // G703: our own temp file, not user input
+		_ = os.Remove(tmpPath)
 
 		return 0, fmt.Errorf("failed to rename temp file: %w", err)
 	}