Update golangci-lint to v2.12.2 with canonical config (closes #30)

- Replace .golangci.yml with the canonical strict config (all linters enabled except the standard disable list; lll 88, funlen 80/50, cyclop 15, dupl 100; test files now linted) - Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by tag and digest (Debian-based) - Fix all ~1550 findings surfaced by the new config: line wrapping, wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel errors, perfsprint/modernize rewrites, goconst constants, thelper, testifylint, noctx CommandContext, testpackage conversions, t.Parallel() where safe, and complexity/dupl helper extraction - Record the change and follow-up items in TODO.md User-visible strings -------------------- No user-visible string changes remain. Every error message this branch composes is byte-identical to the one main composes. The err113 sentinels are shaped so that fmt.Errorf reassembles the original text around them: a sentinel carries the fixed words of the message and the caller supplies the interpolated value in the position it has always occupied. Where the value sits in the middle of the sentence the sentinel therefore holds only a fragment (for example vault.ErrVaultNotFound is "does not exist", composed by its caller as "vault <name> does not exist"); each such sentinel documents the message it participates in. Verified mechanically rather than by inspection: every fmt.Errorf and errors.New call site in both trees was parsed, the Error() text of any sentinel passed to %w substituted in, and the resulting sets of composed message templates compared. All 350 templates main produces are still produced, character for character; the set of messages lost or altered is empty. unlocker list ------------- findUnlockerIDByMetadata now returns (string, error) instead of signalling failure with an empty ID. An unreadable unlockers.d is no longer indistinguishable from "no matching entry", so UnlockersList skips the entry with a warning naming the directory, as it did before the scan was extracted into a helper, rather than emitting a row under a synthesized fallback ID that no unlocker remove or unlocker select can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by tests in internal/cli/unlockers_list_test.go.
2026-08-07 17:27:23 +00:00
parent 6e5e0db999
commit 397011a592
60 changed files with 6867 additions and 4875 deletions
--- a/internal/vault/management.go
+++ b/internal/vault/management.go
@@ -15,10 +15,13 @@ import (
 )

 // Register the GetCurrentVault function with the secret package
+//
+//nolint:gochecknoinits // registers the vault accessor with the secret package
 func init() {
-	secret.RegisterGetCurrentVaultFunc(func(fs afero.Fs, stateDir string) (secret.VaultInterface, error) {
-		return GetCurrentVault(fs, stateDir)
-	})
+	secret.RegisterGetCurrentVaultFunc(
+		func(fs afero.Fs, stateDir string) (secret.VaultInterface, error) {
+			return GetCurrentVault(fs, stateDir)
+		})
 }

 // isValidVaultName validates vault names according to the format [a-z0-9\.\-\_]+
@@ -27,6 +30,7 @@ func isValidVaultName(name string) bool {
 	if name == "" {
 		return false
 	}
+
 	matched, _ := regexp.MatchString(`^[a-z0-9\.\-\_]+$`, name)

 	return matched
@@ -65,9 +69,11 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {
 	currentVaultPath := filepath.Join(stateDir, "currentvault")

 	secret.Debug("Checking current vault symlink", "path", currentVaultPath)
+
 	_, err := fs.Stat(currentVaultPath)
 	if err != nil {
-		secret.Debug("Failed to stat current vault symlink", "error", err, "path", currentVaultPath)
+		secret.Debug("Failed to stat current vault symlink",
+			"error", err, "path", currentVaultPath)

 		return nil, fmt.Errorf("failed to read current vault symlink: %w", err)
 	}
@@ -76,6 +82,7 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {

 	// Resolve the symlink to get the actual vault directory
 	secret.Debug("Resolving vault symlink")
+
 	targetPath, err := ResolveVaultSymlink(fs, currentVaultPath)
 	if err != nil {
 		return nil, err
@@ -88,7 +95,8 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {
 	vaultName := filepath.Base(targetPath)
 	secret.Debug("Extracted vault name", "vault_name", vaultName)

-	secret.Debug("Current vault resolved", "vault_name", vaultName, "target_path", targetPath)
+	secret.Debug("Current vault resolved",
+		"vault_name", vaultName, "target_path", targetPath)

 	// Create and return the vault
 	return NewVault(fs, stateDir, vaultName), nil
@@ -103,6 +111,7 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to check if vaults directory exists: %w", err)
 	}
+
 	if !exists {
 		return []string{}, nil
 	}
@@ -115,6 +124,7 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {

 	// Extract vault names
 	var vaults []string
+
 	for _, entry := range entries {
 		if entry.IsDir() {
 			vaults = append(vaults, entry.Name())
@@ -124,22 +134,26 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {
 	return vaults, nil
 }

-// processMnemonicForVault handles mnemonic processing for vault creation
-func processMnemonicForVault(fs afero.Fs, stateDir, vaultDir, vaultName string) (
-	derivationIndex uint32, publicKeyHash string, familyHash string, err error) {
+// processMnemonicForVault handles mnemonic processing for vault creation.
+// It returns the derivation index, public key hash, and family hash.
+func processMnemonicForVault(
+	fs afero.Fs, stateDir, vaultDir, vaultName string,
+) (uint32, string, string, error) {
 	// Check if mnemonic is available in environment
 	mnemonic := os.Getenv(secret.EnvMnemonic)

 	if mnemonic == "" {
-		secret.Debug("No mnemonic in environment, vault created without long-term key", "vault", vaultName)
+		secret.Debug("No mnemonic in environment, vault created without long-term key",
+			"vault", vaultName)
 		// Use 0 for derivation index when no mnemonic is provided
 		return 0, "", "", nil
 	}

-	secret.Debug("Mnemonic found in environment, deriving long-term key", "vault", vaultName)
+	secret.Debug("Mnemonic found in environment, deriving long-term key",
+		"vault", vaultName)

 	// Get the next available derivation index for this mnemonic
-	derivationIndex, err = GetNextDerivationIndex(fs, stateDir, mnemonic)
+	derivationIndex, err := GetNextDerivationIndex(fs, stateDir, mnemonic)
 	if err != nil {
 		return 0, "", "", fmt.Errorf("failed to get next derivation index: %w", err)
 	}
@@ -152,14 +166,18 @@ func processMnemonicForVault(fs afero.Fs, stateDir, vaultDir, vaultName string)

 	// Write the public key
 	ltPubKey := ltIdentity.Recipient().String()
+
 	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-	if err := afero.WriteFile(fs, ltPubKeyPath, []byte(ltPubKey), secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(fs, ltPubKeyPath, []byte(ltPubKey), secret.FilePerms)
+	if err != nil {
 		return 0, "", "", fmt.Errorf("failed to write long-term public key: %w", err)
 	}
+
 	secret.Debug("Wrote long-term public key", "path", ltPubKeyPath)

 	// Compute verification hash from actual derivation index
-	publicKeyHash = ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+	publicKeyHash := ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))

 	// Compute family hash from index 0 (same for all vaults with this mnemonic)
 	// This is used to identify which vaults belong to the same mnemonic family
@@ -167,7 +185,8 @@ func processMnemonicForVault(fs afero.Fs, stateDir, vaultDir, vaultName string)
 	if err != nil {
 		return 0, "", "", fmt.Errorf("failed to derive identity for index 0: %w", err)
 	}
-	familyHash = ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+
+	familyHash := ComputeDoubleSHA256([]byte(identity0.Recipient().String()))

 	return derivationIndex, publicKeyHash, familyHash, nil
 }
@@ -180,8 +199,12 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 	if !isValidVaultName(name) {
 		secret.Debug("Invalid vault name provided", "vault_name", name)

-		return nil, fmt.Errorf("invalid vault name '%s': must match pattern [a-z0-9.\\-_]+", name)
+		return nil, fmt.Errorf(
+			"%w '%s': must match pattern [a-z0-9.\\-_]+",
+			ErrInvalidVaultName, name,
+		)
 	}
+
 	secret.Debug("Vault name validation passed", "vault_name", name)

 	// Create vault directory structure
@@ -189,24 +212,30 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 	secret.Debug("Creating vault directory structure", "vault_dir", vaultDir)

 	// Create main vault directory
-	if err := fs.MkdirAll(vaultDir, secret.DirPerms); err != nil {
+	err := fs.MkdirAll(vaultDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create vault directory: %w", err)
 	}

 	// Create secrets directory
 	secretsDir := filepath.Join(vaultDir, "secrets.d")
-	if err := fs.MkdirAll(secretsDir, secret.DirPerms); err != nil {
+
+	err = fs.MkdirAll(secretsDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create secrets directory: %w", err)
 	}

 	// Create unlockers directory
 	unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-	if err := fs.MkdirAll(unlockersDir, secret.DirPerms); err != nil {
+
+	err = fs.MkdirAll(unlockersDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create unlockers directory: %w", err)
 	}

 	// Process mnemonic if available
-	derivationIndex, publicKeyHash, familyHash, err := processMnemonicForVault(fs, stateDir, vaultDir, name)
+	derivationIndex, publicKeyHash, familyHash, err := processMnemonicForVault(
+		fs, stateDir, vaultDir, name)
 	if err != nil {
 		return nil, err
 	}
@@ -218,13 +247,17 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 		PublicKeyHash:      publicKeyHash,
 		MnemonicFamilyHash: familyHash,
 	}
-	if err := SaveVaultMetadata(fs, vaultDir, metadata); err != nil {
+
+	err = SaveVaultMetadata(fs, vaultDir, metadata)
+	if err != nil {
 		return nil, fmt.Errorf("failed to save vault metadata: %w", err)
 	}

 	// Select the newly created vault as current
 	secret.Debug("Selecting newly created vault as current", "name", name)
-	if err := SelectVault(fs, stateDir, name); err != nil {
+
+	err = SelectVault(fs, stateDir, name)
+	if err != nil {
 		return nil, fmt.Errorf("failed to select vault: %w", err)
 	}

@@ -242,32 +275,42 @@ func SelectVault(fs afero.Fs, stateDir string, name string) error {
 	if !isValidVaultName(name) {
 		secret.Debug("Invalid vault name provided", "vault_name", name)

-		return fmt.Errorf("invalid vault name '%s': must match pattern [a-z0-9.\\-_]+", name)
+		return fmt.Errorf(
+			"%w '%s': must match pattern [a-z0-9.\\-_]+",
+			ErrInvalidVaultName, name,
+		)
 	}
+
 	secret.Debug("Vault name validation passed", "vault_name", name)

 	// Check if vault exists
 	vaultDir := filepath.Join(stateDir, "vaults.d", name)
+
 	exists, err := afero.DirExists(fs, vaultDir)
 	if err != nil {
 		return fmt.Errorf("failed to check if vault exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("vault %s does not exist", name)
+		return fmt.Errorf("vault %s %w", name, ErrVaultNotFound)
 	}

 	// Create or update the currentvault file with just the vault name
 	currentVaultPath := filepath.Join(stateDir, "currentvault")

 	// Remove existing file if it exists
-	if _, err := fs.Stat(currentVaultPath); err == nil {
+	_, err = fs.Stat(currentVaultPath)
+	if err == nil {
 		secret.Debug("Removing existing currentvault file", "path", currentVaultPath)
+
 		_ = fs.Remove(currentVaultPath)
 	}

 	// Write just the vault name to the file
 	secret.Debug("Writing currentvault file", "vault_name", name)
-	if err := afero.WriteFile(fs, currentVaultPath, []byte(name), secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(fs, currentVaultPath, []byte(name), secret.FilePerms)
+	if err != nil {
 		return fmt.Errorf("failed to select vault: %w", err)
 	}