Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image). Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`). The stricter config surfaced ~1550 findings, all fixed: - `wsl_v5` (439) / `nlreturn` (24): blank-line insertions - `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged - `noinlineerr` (130): `if err := ...` split into assignment plus check - `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it - `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is` - `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq` - `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()` - `noctx` (22): `exec.CommandContext` for gpg/CLI invocations - `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint` - `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction - assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits` ## User-visible strings **None changed.** Every error message this branch composes is byte-identical to the one `main` composes. The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in. Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty. ## `unlocker list` `findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`. `TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint). `make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing. Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #29 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
2026-08-10 15:23:33 +02:00
parent 6e5e0db999
commit 41cea400a7
60 changed files with 6867 additions and 4875 deletions
--- a/internal/vault/management.go
+++ b/internal/vault/management.go
@@ -15,10 +15,13 @@ import (
 )

 // Register the GetCurrentVault function with the secret package
+//
+//nolint:gochecknoinits // registers the vault accessor with the secret package
 func init() {
-	secret.RegisterGetCurrentVaultFunc(func(fs afero.Fs, stateDir string) (secret.VaultInterface, error) {
-		return GetCurrentVault(fs, stateDir)
-	})
+	secret.RegisterGetCurrentVaultFunc(
+		func(fs afero.Fs, stateDir string) (secret.VaultInterface, error) {
+			return GetCurrentVault(fs, stateDir)
+		})
 }

 // isValidVaultName validates vault names according to the format [a-z0-9\.\-\_]+
@@ -27,6 +30,7 @@ func isValidVaultName(name string) bool {
 	if name == "" {
 		return false
 	}
+
 	matched, _ := regexp.MatchString(`^[a-z0-9\.\-\_]+$`, name)

 	return matched
@@ -65,9 +69,11 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {
 	currentVaultPath := filepath.Join(stateDir, "currentvault")

 	secret.Debug("Checking current vault symlink", "path", currentVaultPath)
+
 	_, err := fs.Stat(currentVaultPath)
 	if err != nil {
-		secret.Debug("Failed to stat current vault symlink", "error", err, "path", currentVaultPath)
+		secret.Debug("Failed to stat current vault symlink",
+			"error", err, "path", currentVaultPath)

 		return nil, fmt.Errorf("failed to read current vault symlink: %w", err)
 	}
@@ -76,6 +82,7 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {

 	// Resolve the symlink to get the actual vault directory
 	secret.Debug("Resolving vault symlink")
+
 	targetPath, err := ResolveVaultSymlink(fs, currentVaultPath)
 	if err != nil {
 		return nil, err
@@ -88,7 +95,8 @@ func GetCurrentVault(fs afero.Fs, stateDir string) (*Vault, error) {
 	vaultName := filepath.Base(targetPath)
 	secret.Debug("Extracted vault name", "vault_name", vaultName)

-	secret.Debug("Current vault resolved", "vault_name", vaultName, "target_path", targetPath)
+	secret.Debug("Current vault resolved",
+		"vault_name", vaultName, "target_path", targetPath)

 	// Create and return the vault
 	return NewVault(fs, stateDir, vaultName), nil
@@ -103,6 +111,7 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {
 	if err != nil {
 		return nil, fmt.Errorf("failed to check if vaults directory exists: %w", err)
 	}
+
 	if !exists {
 		return []string{}, nil
 	}
@@ -115,6 +124,7 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {

 	// Extract vault names
 	var vaults []string
+
 	for _, entry := range entries {
 		if entry.IsDir() {
 			vaults = append(vaults, entry.Name())
@@ -124,22 +134,26 @@ func ListVaults(fs afero.Fs, stateDir string) ([]string, error) {
 	return vaults, nil
 }

-// processMnemonicForVault handles mnemonic processing for vault creation
-func processMnemonicForVault(fs afero.Fs, stateDir, vaultDir, vaultName string) (
-	derivationIndex uint32, publicKeyHash string, familyHash string, err error) {
+// processMnemonicForVault handles mnemonic processing for vault creation.
+// It returns the derivation index, public key hash, and family hash.
+func processMnemonicForVault(
+	fs afero.Fs, stateDir, vaultDir, vaultName string,
+) (uint32, string, string, error) {
 	// Check if mnemonic is available in environment
 	mnemonic := os.Getenv(secret.EnvMnemonic)

 	if mnemonic == "" {
-		secret.Debug("No mnemonic in environment, vault created without long-term key", "vault", vaultName)
+		secret.Debug("No mnemonic in environment, vault created without long-term key",
+			"vault", vaultName)
 		// Use 0 for derivation index when no mnemonic is provided
 		return 0, "", "", nil
 	}

-	secret.Debug("Mnemonic found in environment, deriving long-term key", "vault", vaultName)
+	secret.Debug("Mnemonic found in environment, deriving long-term key",
+		"vault", vaultName)

 	// Get the next available derivation index for this mnemonic
-	derivationIndex, err = GetNextDerivationIndex(fs, stateDir, mnemonic)
+	derivationIndex, err := GetNextDerivationIndex(fs, stateDir, mnemonic)
 	if err != nil {
 		return 0, "", "", fmt.Errorf("failed to get next derivation index: %w", err)
 	}
@@ -152,14 +166,18 @@ func processMnemonicForVault(fs afero.Fs, stateDir, vaultDir, vaultName string)

 	// Write the public key
 	ltPubKey := ltIdentity.Recipient().String()
+
 	ltPubKeyPath := filepath.Join(vaultDir, "pub.age")
-	if err := afero.WriteFile(fs, ltPubKeyPath, []byte(ltPubKey), secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(fs, ltPubKeyPath, []byte(ltPubKey), secret.FilePerms)
+	if err != nil {
 		return 0, "", "", fmt.Errorf("failed to write long-term public key: %w", err)
 	}
+
 	secret.Debug("Wrote long-term public key", "path", ltPubKeyPath)

 	// Compute verification hash from actual derivation index
-	publicKeyHash = ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+	publicKeyHash := ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))

 	// Compute family hash from index 0 (same for all vaults with this mnemonic)
 	// This is used to identify which vaults belong to the same mnemonic family
@@ -167,7 +185,8 @@ func processMnemonicForVault(fs afero.Fs, stateDir, vaultDir, vaultName string)
 	if err != nil {
 		return 0, "", "", fmt.Errorf("failed to derive identity for index 0: %w", err)
 	}
-	familyHash = ComputeDoubleSHA256([]byte(identity0.Recipient().String()))
+
+	familyHash := ComputeDoubleSHA256([]byte(identity0.Recipient().String()))

 	return derivationIndex, publicKeyHash, familyHash, nil
 }
@@ -180,8 +199,12 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 	if !isValidVaultName(name) {
 		secret.Debug("Invalid vault name provided", "vault_name", name)

-		return nil, fmt.Errorf("invalid vault name '%s': must match pattern [a-z0-9.\\-_]+", name)
+		return nil, fmt.Errorf(
+			"%w '%s': must match pattern [a-z0-9.\\-_]+",
+			ErrInvalidVaultName, name,
+		)
 	}
+
 	secret.Debug("Vault name validation passed", "vault_name", name)

 	// Create vault directory structure
@@ -189,24 +212,30 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 	secret.Debug("Creating vault directory structure", "vault_dir", vaultDir)

 	// Create main vault directory
-	if err := fs.MkdirAll(vaultDir, secret.DirPerms); err != nil {
+	err := fs.MkdirAll(vaultDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create vault directory: %w", err)
 	}

 	// Create secrets directory
 	secretsDir := filepath.Join(vaultDir, "secrets.d")
-	if err := fs.MkdirAll(secretsDir, secret.DirPerms); err != nil {
+
+	err = fs.MkdirAll(secretsDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create secrets directory: %w", err)
 	}

 	// Create unlockers directory
 	unlockersDir := filepath.Join(vaultDir, "unlockers.d")
-	if err := fs.MkdirAll(unlockersDir, secret.DirPerms); err != nil {
+
+	err = fs.MkdirAll(unlockersDir, secret.DirPerms)
+	if err != nil {
 		return nil, fmt.Errorf("failed to create unlockers directory: %w", err)
 	}

 	// Process mnemonic if available
-	derivationIndex, publicKeyHash, familyHash, err := processMnemonicForVault(fs, stateDir, vaultDir, name)
+	derivationIndex, publicKeyHash, familyHash, err := processMnemonicForVault(
+		fs, stateDir, vaultDir, name)
 	if err != nil {
 		return nil, err
 	}
@@ -218,13 +247,17 @@ func CreateVault(fs afero.Fs, stateDir string, name string) (*Vault, error) {
 		PublicKeyHash:      publicKeyHash,
 		MnemonicFamilyHash: familyHash,
 	}
-	if err := SaveVaultMetadata(fs, vaultDir, metadata); err != nil {
+
+	err = SaveVaultMetadata(fs, vaultDir, metadata)
+	if err != nil {
 		return nil, fmt.Errorf("failed to save vault metadata: %w", err)
 	}

 	// Select the newly created vault as current
 	secret.Debug("Selecting newly created vault as current", "name", name)
-	if err := SelectVault(fs, stateDir, name); err != nil {
+
+	err = SelectVault(fs, stateDir, name)
+	if err != nil {
 		return nil, fmt.Errorf("failed to select vault: %w", err)
 	}

@@ -242,32 +275,42 @@ func SelectVault(fs afero.Fs, stateDir string, name string) error {
 	if !isValidVaultName(name) {
 		secret.Debug("Invalid vault name provided", "vault_name", name)

-		return fmt.Errorf("invalid vault name '%s': must match pattern [a-z0-9.\\-_]+", name)
+		return fmt.Errorf(
+			"%w '%s': must match pattern [a-z0-9.\\-_]+",
+			ErrInvalidVaultName, name,
+		)
 	}
+
 	secret.Debug("Vault name validation passed", "vault_name", name)

 	// Check if vault exists
 	vaultDir := filepath.Join(stateDir, "vaults.d", name)
+
 	exists, err := afero.DirExists(fs, vaultDir)
 	if err != nil {
 		return fmt.Errorf("failed to check if vault exists: %w", err)
 	}
+
 	if !exists {
-		return fmt.Errorf("vault %s does not exist", name)
+		return fmt.Errorf("vault %s %w", name, ErrVaultNotFound)
 	}

 	// Create or update the currentvault file with just the vault name
 	currentVaultPath := filepath.Join(stateDir, "currentvault")

 	// Remove existing file if it exists
-	if _, err := fs.Stat(currentVaultPath); err == nil {
+	_, err = fs.Stat(currentVaultPath)
+	if err == nil {
 		secret.Debug("Removing existing currentvault file", "path", currentVaultPath)
+
 		_ = fs.Remove(currentVaultPath)
 	}

 	// Write just the vault name to the file
 	secret.Debug("Writing currentvault file", "vault_name", name)
-	if err := afero.WriteFile(fs, currentVaultPath, []byte(name), secret.FilePerms); err != nil {
+
+	err = afero.WriteFile(fs, currentVaultPath, []byte(name), secret.FilePerms)
+	if err != nil {
 		return fmt.Errorf("failed to select vault: %w", err)
 	}