Files

check / check (push) Successful in 2m0s

Details

Update golangci-lint to v2.12.2 with canonical config (closes #30 )

- Replace .golangci.yml with the canonical strict config (all linters
  enabled except the standard disable list; lll 88, funlen 80/50,
  cyclop 15, dupl 100; test files now linted)
- Pin the Dockerfile lint stage to golangci/golangci-lint:v2.12.2 by
  tag and digest (Debian-based)
- Fix all ~1550 findings surfaced by the new config: line wrapping,
  wsl_v5/nlreturn blank lines, noinlineerr splits, err113 sentinel
  errors, perfsprint/modernize rewrites, goconst constants, thelper,
  testifylint, noctx CommandContext, testpackage conversions,
  t.Parallel() where safe, and complexity/dupl helper extraction
- Record the change and follow-up items in TODO.md

User-visible strings
--------------------

No user-visible string changes remain. Every error message this branch
composes is byte-identical to the one main composes.

The err113 sentinels are shaped so that fmt.Errorf reassembles the
original text around them: a sentinel carries the fixed words of the
message and the caller supplies the interpolated value in the position
it has always occupied. Where the value sits in the middle of the
sentence the sentinel therefore holds only a fragment (for example
vault.ErrVaultNotFound is "does not exist", composed by its caller as
"vault <name> does not exist"); each such sentinel documents the
message it participates in.

Verified mechanically rather than by inspection: every fmt.Errorf and
errors.New call site in both trees was parsed, the Error() text of any
sentinel passed to %w substituted in, and the resulting sets of
composed message templates compared. All 350 templates main produces
are still produced, character for character; the set of messages lost
or altered is empty.

unlocker list
-------------

findUnlockerIDByMetadata now returns (string, error) instead of
signalling failure with an empty ID. An unreadable unlockers.d is no
longer indistinguishable from "no matching entry", so UnlockersList
skips the entry with a warning naming the directory, as it did before
the scan was extracted into a helper, rather than emitting a row under
a synthesized fallback ID that no unlocker remove or unlocker select
can match and that suppresses the current-unlocker marker. The
duplicate-check and shell-completion callers skip on the same
condition, matching their pre-extraction behavior. Covered by tests in
internal/cli/unlockers_list_test.go.

2026-08-09 02:00:27 +00:00

5.8 KiB

Raw Blame History

Workflow

branch (from main)
do the work in Next Step
move Next Step to the top of Completed Steps
move the top item of Future Steps into Next Step
commit (TODO.md changes in the same commit as the work)
merge to main if the branch is not protected, otherwise open a PR
push

Status

pre-1.0. No git tags. TODO.md carries open 1.0 security blockers. Work in flight on branch secure-enclave-unlocker (clean tree as of 2026-07-06).

Next Step

Bring the repo into policy compliance in one commit:

Add fmt-check and hooks targets to the Makefile (test/lint/fmt/check/ docker already exist).
Add REPO_POLICIES.md and .editorconfig.
Add .gitea/workflows/check.yml running make check.
Verify Dockerfile base images are pinned by sha256.

Completed Steps

2026-08-07: Updated golangci-lint to v2.12.2 with the canonical .golangci.yml (all linters enabled minus the standard disable list, lll 88, tests linted); bumped the Dockerfile lint-stage image to the tagged v2.12.2 Debian digest; fixed all ~1550 new findings across internal/ and pkg/ (line wrapping, wsl_v5 blank lines, sentinel errors for err113, t.Parallel() where safe, _test package conversions, complexity/dupl helper extraction) on branch golangci-v2.12.2. Reworked after review: the err113 sentinels in internal/vault, internal/secret, internal/cli and pkg/bip85 were reshaped so every composed error message is byte-identical to main, and findUnlockerIDByMetadata now returns an error so unlocker list skips an unreadable unlockers.d entry with a warning instead of emitting a fabricated fallback ID.
2026-07-07 Adopted scripts-to-rule-them-all: script/ entrypoints, Makefile shims, README Entrypoints section
2026-03-11: Secure Enclave unlocker for hardware-backed secret protection, plus review fixes (stub panics, derivation index, tests, README) on branch secure-enclave-unlocker.
2026-02-28: Repo cleanup, removed stale .cursorrules and coverage.out.
Audit fix wave (issues #1, #2, #3, #13, #14): skip unlockers with missing metadata, allow uppercase secret names, fix hardcoded derivation index, validate names in GetSecretVersion against path traversal, return errors instead of panicking, add Warn() on silent anomalies.
Memory security hardening: LockedBuffer used through encrypt/decrypt paths (Save/EncryptWithPassphrase/GetValue/gpg helpers), deprecated bare-[]byte APIs removed.
Per-secret keypair architecture, vault package refactor, versioning with --version, comprehensive test suite with in-memory filesystem.
Debug logging system (slog, GODEBUG flag, TTY-aware output).
Renamed SEP unlocker to Keychain, reorganized import commands.
2025-05-28: Initial implementation (vault, age encryption, mnemonic, CLI).

Future Steps

Compliance (after Next Step lands): keep main green under the new .gitea workflow; run make check before every merge.
Implement version-number shell completion for the second arg of secret version promote and secret version rm (internal/cli/version.go; was an in-code TODO removed for godox).
Cover mnemonic-vs-xprv identity consistency in pkg/agehd/agehd_test.go TestMnemonicVsXPRVConsistency (was an in-code FIXME removed for godox).
Darwin-gated files (internal/secret/keychainunlocker.go, seunlocker_darwin.go, internal/macse/macse_darwin.go, related tests) are not linted on the Linux CI runner and still contain lines over the new 88-column limit; they will surface if lint ever runs on macOS.
Merge secure-enclave-unlocker to main once review is done.
1.0 critical security blockers (from repo TODO.md):
- Command injection: GPG key IDs passed unescaped to exec.Command (pgpunlocker.go:323-327); data.String() passed unescaped to the security command (keychainunlocker.go:472-476).
- Memory security: KeychainData stores AgePrivKeyPassphrase as a plain string (keychainunlocker.go:342,393-396); age identity .String() creates unprotected copies (keychainunlocker.go:356, pgpunlocker.go:256, version.go:155); age secret key held in a plain string in cli/crypto.go:86,91,113; private keys exposed via buffer.Bytes() to GPGEncryptFunc and EncryptWithPassphrase.
- Race conditions: no file locking in vault/secrets.go:142-176; non-atomic writes can leave the vault inconsistent.
- Input validation: dots in secret names risk path traversal (vault/secrets.go:75-99); no maximum secret size (DoS).
- Timing attacks: bytes.Equal passphrase compare (cli/init.go: 209-216); non-constant-time public key compare (vault.go:95-100).
High priority:
- Return errors instead of panicking on corrupted metadata (pgpunlocker.go:116, keychainunlocker.go:141).
- Secure temporary file handling and cleanup.
- Print cobra usage only for argument errors, not internal failures.
- Initialize a default unlock key at vault creation.
- Confirmation prompts for destructive operations (keys rm, vault deletion).
- Add secret rm and vault deletion commands.
Medium priority:
- Standardize error messages; stop leaking internals.
- Graceful handling of corrupted or missing key files with recovery suggestions.
- Validate GPG key existence before creating PGP unlock keys.
- Split oversized CLI functions.
- Document env var security (SB_UNLOCK_PASSPHRASE, SB_SECRET_MNEMONIC); clear after use.
- mlock/munlock for sensitive allocations.
Cleanups: read statedir from environment or default instead of passing it around.
Enhancements: help examples, shell completion, colored output, --quiet flag, name suggestions on miss, audit logging, hardware integration tests (Keychain, GPG), naming consistency, vault export/import, batch operations, search, secret metadata (descriptions, tags).