Update golangci-lint to v2.12.2 with canonical config (#29)

Bumps golangci-lint from v2.1.6 (digest-only pin in the `Dockerfile` lint stage) to v2.12.2, pinned by tag and digest (Debian-based image).

Replaces `.golangci.yml` with the canonical strict config: all linters enabled except the standard disable list (`exhaustruct`, `depguard`, `godot`, `wsl`, `wrapcheck`, `varnamelen`), `lll` at 88, `funlen` 80/50, `cyclop` 15, `dupl` 100, and test files are now linted (the old config had `tests: false`, an enable-only list of ~20 linters, `lll` 120, and a blanket exclusion of `internal/macse`).

The stricter config surfaced ~1550 findings, all fixed:

- `wsl_v5` (439) / `nlreturn` (24): blank-line insertions
- `lll` (309): line wrapping at 88 columns; long literals split with `+` concatenation, values unchanged
- `noinlineerr` (130): `if err := ...` split into assignment plus check
- `paralleltest` (116): `t.Parallel()` added to tests without shared state; reasoned `//nolint` where `t.Setenv` or shared fixtures forbid it
- `err113` (97): package-level sentinel errors (new `internal/vault/errors.go`), `%w` wrapping, `errors.Is`
- `perfsprint` (74) / `modernize` (39) / `intrange`: `strconv`, `errors.New`, `slices.Contains`, `any`, `SplitSeq`
- `goconst` (40) / `dupword` (41) / `testifylint` (42) / `thelper` (33): constants, assertion fixes, `t.Helper()`
- `noctx` (22): `exec.CommandContext` for gpg/CLI invocations
- `testpackage` (18): black-box tests moved to `_test` packages where they use only exported identifiers; white-box files carry a reasoned `//nolint`
- `funlen`/`cyclop`/`gocognit`/`nestif`/`dupl`: behavior-preserving helper extraction
- assorted singletons: `gosec`, `gosmopolitan`, `funcorder`, `nonamedreturns`, `makezero`, `prealloc`, `godox`, `nolintlint`, `ireturn`, `nilnil`, `gochecknoinits`

## User-visible strings

**None changed.** Every error message this branch composes is byte-identical to the one `main` composes.

The `err113` sentinels are shaped so `fmt.Errorf` reassembles the original text around them: the sentinel carries the fixed words and the caller supplies the interpolated value in the position it has always occupied. Where the value sits mid-sentence the sentinel holds only a fragment (e.g. `vault.ErrVaultNotFound` is `"does not exist"`, composed by its caller as `vault <name> does not exist`); each such sentinel documents the message it participates in.

Verified mechanically, not by inspection: every `fmt.Errorf` and `errors.New` call site in both trees is parsed, the `Error()` text of any sentinel passed to `%w` is substituted in, and the resulting sets of composed message templates are compared. All 350 templates `main` produces are still produced, character for character. The set of lost or altered messages is empty.

## `unlocker list`

`findUnlockerIDByMetadata` returns `(string, error)` rather than signalling failure with an empty ID, so an unreadable `unlockers.d` is no longer indistinguishable from "no matching entry". `UnlockersList` skips such an entry with a warning naming the directory — its behavior before the scan was extracted into a helper — instead of emitting a row under a synthesized fallback ID that no `unlocker remove` or `unlocker select` can match and that suppresses the current-unlocker marker. The duplicate-check and shell-completion callers skip on the same condition, matching their pre-extraction behavior. Covered by `internal/cli/unlockers_list_test.go`.

`TODO.md` records the change plus follow-ups (version-completion TODOs formerly in code comments, darwin-gated files exceeding 88 columns that Linux CI does not lint).

`make check` is green and the pinned v2.12.2 image reports `0 issues.` Note the test suite needs the memlock ulimit from `script/cibuild` for the 10MB memguard test; that requirement is pre-existing.

Not changed: `script/bootstrap` installs golangci-lint via the system package manager (no version pin to bump), and `script/lint` invokes whatever `golangci-lint` is on PATH. golangci-lint v2.12 deprecates `gomodguard` in favor of `gomodguard_v2` (warning only); the canonical config owns that decision.

Co-authored-by: sneak <sneak@sneak.berlin>
Reviewed-on: #29
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/vault/vault.go

@@ -23,12 +23,14 @@ type Vault struct {
 // NewVault creates a new Vault instance
 func NewVault(fs afero.Fs, stateDir string, name string) *Vault {
 	secret.Debug("Creating NewVault instance")
+
 	v := &Vault{
 		Name:        name,
 		fs:          fs,
 		stateDir:    stateDir,
 		longTermKey: nil,
 	}
+
 	secret.Debug("Created NewVault instance successfully")
 
 	return v
@@ -54,7 +56,8 @@ func (v *Vault) ClearLongTermKey() {
 	v.longTermKey = nil
 }
 
-// GetOrDeriveLongTermKey gets the long-term key from memory or derives it from available sources
+// GetOrDeriveLongTermKey gets the long-term key from memory or derives it
+// from available sources
 func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 	// If we have it in memory, return it
 	if !v.Locked() {
@@ -65,55 +68,12 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 
 	// Try to derive from environment mnemonic first
 	if envMnemonic := os.Getenv(secret.EnvMnemonic); envMnemonic != "" {
-		secret.Debug("Using mnemonic from environment for long-term key derivation", "vault_name", v.Name)
-
-		// Load vault metadata to get the derivation index
-		vaultDir, err := v.GetDirectory()
-		if err != nil {
-			return nil, fmt.Errorf("failed to get vault directory: %w", err)
-		}
-
-		metadata, err := LoadVaultMetadata(v.fs, vaultDir)
-		if err != nil {
-			secret.Debug("Failed to load vault metadata", "error", err, "vault_name", v.Name)
-
-			return nil, fmt.Errorf("failed to load vault metadata: %w", err)
-		}
-
-		ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
-		if err != nil {
-			secret.Debug("Failed to derive long-term key from mnemonic", "error", err, "vault_name", v.Name)
-
-			return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
-		}
-
-		// Verify that the derived key matches the stored public key hash
-		derivedPubKeyHash := ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
-		if derivedPubKeyHash != metadata.PublicKeyHash {
-			secret.Debug("Derived public key hash does not match stored hash",
-				"vault_name", v.Name,
-				"derived_hash", derivedPubKeyHash,
-				"stored_hash", metadata.PublicKeyHash,
-				"derivation_index", metadata.DerivationIndex)
-
-			return nil, fmt.Errorf("derived public key does not match vault: mnemonic may be incorrect")
-		}
-
-		secret.DebugWith("Successfully derived long-term key from mnemonic",
-			slog.String("vault_name", v.Name),
-			slog.String("public_key", ltIdentity.Recipient().String()),
-			slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
-		)
-
-		// Cache the derived key by unlocking the vault
-		v.Unlock(ltIdentity)
-		secret.Debug("Vault is unlocked (lt key in memory) via mnemonic", "vault_name", v.Name)
-
-		return ltIdentity, nil
+		return v.deriveLongTermKeyFromMnemonic(envMnemonic)
 	}
 
 	// No mnemonic available, try to use current unlocker
-	secret.Debug("No mnemonic available, using current unlocker to unlock vault", "vault_name", v.Name)
+	secret.Debug("No mnemonic available, using current unlocker to unlock vault",
+		"vault_name", v.Name)
 
 	// Get current unlocker
 	unlocker, err := v.GetCurrentUnlocker()
@@ -151,10 +111,130 @@ func (v *Vault) GetOrDeriveLongTermKey() (*age.X25519Identity, error) {
 	return ltIdentity, nil
 }
 
-// unlockLongTermKey extracts the vault's long-term key using the given unlocker.
-// SE unlockers decrypt the long-term key directly; other unlockers use an intermediate identity.
-func (v *Vault) unlockLongTermKey(unlocker secret.Unlocker) (*age.X25519Identity, error) {
-	if unlocker.GetType() == "secure-enclave" {
+// GetDirectory returns the vault's directory path
+func (v *Vault) GetDirectory() (string, error) {
+	return filepath.Join(v.stateDir, "vaults.d", v.Name), nil
+}
+
+// GetName returns the vault's name (for VaultInterface compatibility)
+func (v *Vault) GetName() string {
+	return v.Name
+}
+
+// GetFilesystem returns the vault's filesystem (for VaultInterface
+// compatibility)
+//
+//nolint:ireturn // afero.Fs is the interface required by VaultInterface
+func (v *Vault) GetFilesystem() afero.Fs {
+	return v.fs
+}
+
+// NumSecrets returns the number of secrets in the vault
+func (v *Vault) NumSecrets() (int, error) {
+	vaultDir, err := v.GetDirectory()
+	if err != nil {
+		return 0, fmt.Errorf("failed to get vault directory: %w", err)
+	}
+
+	secretsDir := filepath.Join(vaultDir, "secrets.d")
+
+	exists, _ := afero.DirExists(v.fs, secretsDir)
+	if !exists {
+		return 0, nil
+	}
+
+	entries, err := afero.ReadDir(v.fs, secretsDir)
+	if err != nil {
+		return 0, fmt.Errorf("failed to read secrets directory: %w", err)
+	}
+
+	// Count only directories that have a "current" version pointer file
+	count := 0
+
+	for _, entry := range entries {
+		if !entry.IsDir() {
+			continue
+		}
+
+		// A valid secret has a "current" file pointing to the active version
+		secretDir := filepath.Join(secretsDir, entry.Name())
+		currentFile := filepath.Join(secretDir, "current")
+
+		exists, err := afero.Exists(v.fs, currentFile)
+		if err != nil {
+			continue // Skip directories we can't read
+		}
+
+		if exists {
+			count++
+		}
+	}
+
+	return count, nil
+}
+
+// deriveLongTermKeyFromMnemonic derives the long-term key from the given
+// mnemonic, verifies it against the vault metadata, and caches it in memory.
+func (v *Vault) deriveLongTermKeyFromMnemonic(
+	envMnemonic string,
+) (*age.X25519Identity, error) {
+	secret.Debug("Using mnemonic from environment for long-term key derivation",
+		"vault_name", v.Name)
+
+	// Load vault metadata to get the derivation index
+	vaultDir, err := v.GetDirectory()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get vault directory: %w", err)
+	}
+
+	metadata, err := LoadVaultMetadata(v.fs, vaultDir)
+	if err != nil {
+		secret.Debug("Failed to load vault metadata", "error", err, "vault_name", v.Name)
+
+		return nil, fmt.Errorf("failed to load vault metadata: %w", err)
+	}
+
+	ltIdentity, err := agehd.DeriveIdentity(envMnemonic, metadata.DerivationIndex)
+	if err != nil {
+		secret.Debug("Failed to derive long-term key from mnemonic",
+			"error", err, "vault_name", v.Name)
+
+		return nil, fmt.Errorf("failed to derive long-term key from mnemonic: %w", err)
+	}
+
+	// Verify that the derived key matches the stored public key hash
+	derivedPubKeyHash := ComputeDoubleSHA256([]byte(ltIdentity.Recipient().String()))
+	if derivedPubKeyHash != metadata.PublicKeyHash {
+		secret.Debug("Derived public key hash does not match stored hash",
+			"vault_name", v.Name,
+			"derived_hash", derivedPubKeyHash,
+			"stored_hash", metadata.PublicKeyHash,
+			"derivation_index", metadata.DerivationIndex)
+
+		return nil, ErrMnemonicMismatch
+	}
+
+	secret.DebugWith("Successfully derived long-term key from mnemonic",
+		slog.String("vault_name", v.Name),
+		slog.String("public_key", ltIdentity.Recipient().String()),
+		slog.Uint64("derivation_index", uint64(metadata.DerivationIndex)),
+	)
+
+	// Cache the derived key by unlocking the vault
+	v.Unlock(ltIdentity)
+	secret.Debug("Vault is unlocked (lt key in memory) via mnemonic",
+		"vault_name", v.Name)
+
+	return ltIdentity, nil
+}
+
+// unlockLongTermKey extracts the vault's long-term key using the given
+// unlocker. SE unlockers decrypt the long-term key directly; other unlockers
+// use an intermediate identity.
+func (v *Vault) unlockLongTermKey(
+	unlocker secret.Unlocker,
+) (*age.X25519Identity, error) {
+	if unlocker.GetType() == unlockerTypeSecureEnclave {
 		secret.Debug("SE unlocker: decrypting long-term key directly via Secure Enclave")
 
 		ltIdentity, err := unlocker.GetIdentity()
@@ -178,7 +258,8 @@ func (v *Vault) unlockLongTermKey(unlocker secret.Unlocker) (*age.X25519Identity
 		return nil, fmt.Errorf("failed to read encrypted long-term private key: %w", err)
 	}
 
-	ltPrivKeyBuffer, err := secret.DecryptWithIdentity(encryptedLtPrivKey, unlockerIdentity)
+	ltPrivKeyBuffer, err := secret.DecryptWithIdentity(
+		encryptedLtPrivKey, unlockerIdentity)
 	if err != nil {
 		return nil, fmt.Errorf("failed to decrypt long-term private key: %w", err)
 	}
@@ -191,59 +272,3 @@ func (v *Vault) unlockLongTermKey(unlocker secret.Unlocker) (*age.X25519Identity
 
 	return ltIdentity, nil
 }
-
-// GetDirectory returns the vault's directory path
-func (v *Vault) GetDirectory() (string, error) {
-	return filepath.Join(v.stateDir, "vaults.d", v.Name), nil
-}
-
-// GetName returns the vault's name (for VaultInterface compatibility)
-func (v *Vault) GetName() string {
-	return v.Name
-}
-
-// GetFilesystem returns the vault's filesystem (for VaultInterface compatibility)
-func (v *Vault) GetFilesystem() afero.Fs {
-	return v.fs
-}
-
-// NumSecrets returns the number of secrets in the vault
-func (v *Vault) NumSecrets() (int, error) {
-	vaultDir, err := v.GetDirectory()
-	if err != nil {
-		return 0, fmt.Errorf("failed to get vault directory: %w", err)
-	}
-
-	secretsDir := filepath.Join(vaultDir, "secrets.d")
-	exists, _ := afero.DirExists(v.fs, secretsDir)
-	if !exists {
-		return 0, nil
-	}
-
-	entries, err := afero.ReadDir(v.fs, secretsDir)
-	if err != nil {
-		return 0, fmt.Errorf("failed to read secrets directory: %w", err)
-	}
-
-	// Count only directories that have a "current" version pointer file
-	count := 0
-	for _, entry := range entries {
-		if !entry.IsDir() {
-			continue
-		}
-
-		// A valid secret has a "current" file pointing to the active version
-		secretDir := filepath.Join(secretsDir, entry.Name())
-		currentFile := filepath.Join(secretDir, "current")
-		exists, err := afero.Exists(v.fs, currentFile)
-		if err != nil {
-			continue // Skip directories we can't read
-		}
-
-		if exists {
-			count++
-		}
-	}
-
-	return count, nil
-}