Remediate all lint findings under the canonical golangci-lint config

Fix every finding surfaced by the canonical .golangci.yml with
golangci-lint v2.12.2 (refs #61), behavior-preserving throughout:

- err113: dynamic errors replaced with package-level sentinels and %w
  wrapping; direct comparisons converted to errors.Is
- goprintffuncname: printf-style helpers renamed with an f suffix
  (ui.Writer message methods, cli.ReportErrorf, database.Fatalf,
  vaultik stdoutf) and all call sites updated
- revive: stuttering type names renamed (blob.Handler, blob.WithReader,
  blob.ChunkPosition, storage.URL, storage.Info), doc comments added,
  unused parameters blanked, package comments added
- contextcheck/noctx: ctx threaded through blob.Packer
  (AddChunk/Flush/FinalizeBlob/PackChunks) and scanner call sites;
  context-aware exec and sql variants used
- funlen/cyclop/gocognit/nestif/dupl: oversized or duplicated
  functions split into focused helpers across production and test code
- paralleltest/tparallel/thelper/usetesting/testpackage: tests
  parallelized where safe (global log.Initialize kept in the serial
  phase), helpers marked, t.TempDir adopted, external test packages
  where only exported API is used
- gosec: integer conversions clamped or justified, header timeouts
  added, remaining findings suppressed with per-site justifications
- mnd/goconst/lll/wsl_v5/nlreturn/noinlineerr/errcheck and other
  mechanical findings fixed directly

Remove the deprecated log.LogOptions alias (callers migrated to
log.Options). make check is green.

internal/crypto/encryption.go

@@ -1,3 +1,5 @@
+// Package crypto provides thread-safe age encryption and decryption
+// helpers used to protect blob and metadata content.
 package crypto
 
 import (
@@ -11,6 +13,10 @@ import (
 	"go.uber.org/fx"
 )
 
+// ErrNoRecipients is returned when an encryptor is created or updated
+// without any recipient public keys.
+var ErrNoRecipients = errors.New("at least one recipient is required")
+
 // Encryptor provides thread-safe encryption using the age encryption library.
 // It supports encrypting data for multiple recipients simultaneously, allowing
 // any of the corresponding private keys to decrypt the data. This is useful
@@ -26,7 +32,7 @@ type Encryptor struct {
 // public keys are invalid or if no recipients are specified.
 func NewEncryptor(publicKeys []string) (*Encryptor, error) {
 	if len(publicKeys) == 0 {
-		return nil, errors.New("at least one recipient is required")
+		return nil, ErrNoRecipients
 	}
 
 	recipients := make([]age.Recipient, 0, len(publicKeys))
@@ -62,12 +68,14 @@ func (e *Encryptor) Encrypt(data []byte) ([]byte, error) {
 	}
 
 	// Write data
-	if _, err := w.Write(data); err != nil {
+	_, err = w.Write(data)
+	if err != nil {
 		return nil, fmt.Errorf("writing encrypted data: %w", err)
 	}
 
 	// Close to flush
-	if err := w.Close(); err != nil {
+	err = w.Close()
+	if err != nil {
 		return nil, fmt.Errorf("closing encrypted writer: %w", err)
 	}
 
@@ -90,12 +98,14 @@ func (e *Encryptor) EncryptStream(dst io.Writer, src io.Reader) error {
 	}
 
 	// Copy data
-	if _, err := io.Copy(w, src); err != nil {
+	_, err = io.Copy(w, src)
+	if err != nil {
 		return fmt.Errorf("copying encrypted data: %w", err)
 	}
 
 	// Close to flush
-	if err := w.Close(); err != nil {
+	err = w.Close()
+	if err != nil {
 		return fmt.Errorf("closing encrypted writer: %w", err)
 	}
 
@@ -128,7 +138,7 @@ func (e *Encryptor) EncryptWriter(dst io.Writer) (io.WriteCloser, error) {
 // of the public keys are invalid or if no recipients are specified.
 func (e *Encryptor) UpdateRecipients(publicKeys []string) error {
 	if len(publicKeys) == 0 {
-		return errors.New("at least one recipient is required")
+		return ErrNoRecipients
 	}
 
 	recipients := make([]age.Recipient, 0, len(publicKeys))
@@ -209,4 +219,6 @@ func (d *Decryptor) DecryptStream(src io.Reader) (io.Reader, error) {
 }
 
 // Module exports the crypto module for fx dependency injection.
+//
+//nolint:gochecknoglobals // fx module definitions are package globals
 var Module = fx.Module("crypto")

internal/crypto/encryption_test.go

@@ -1,13 +1,16 @@
-package crypto
+package crypto_test
 
 import (
 	"bytes"
 	"testing"
 
 	"filippo.io/age"
+	"sneak.berlin/go/vaultik/internal/crypto"
 )
 
 func TestEncryptor(t *testing.T) {
+	t.Parallel()
+
 	// Generate a test key pair
 	identity, err := age.GenerateX25519Identity()
 	if err != nil {
@@ -17,7 +20,7 @@ func TestEncryptor(t *testing.T) {
 	publicKey := identity.Recipient().String()
 
 	// Create encryptor
-	enc, err := NewEncryptor([]string{publicKey})
+	enc, err := crypto.NewEncryptor([]string{publicKey})
 	if err != nil {
 		t.Fatalf("failed to create encryptor: %v", err)
 	}
@@ -43,7 +46,9 @@ func TestEncryptor(t *testing.T) {
 	}
 
 	var decrypted bytes.Buffer
-	if _, err := decrypted.ReadFrom(r); err != nil {
+
+	_, err = decrypted.ReadFrom(r)
+	if err != nil {
 		t.Fatalf("failed to read decrypted data: %v", err)
 	}
 
@@ -53,6 +58,8 @@ func TestEncryptor(t *testing.T) {
 }
 
 func TestEncryptorMultipleRecipients(t *testing.T) {
+	t.Parallel()
+
 	// Generate three test key pairs
 	identity1, err := age.GenerateX25519Identity()
 	if err != nil {
@@ -76,7 +83,7 @@ func TestEncryptorMultipleRecipients(t *testing.T) {
 	}
 
 	// Create encryptor with multiple recipients
-	enc, err := NewEncryptor(publicKeys)
+	enc, err := crypto.NewEncryptor(publicKeys)
 	if err != nil {
 		t.Fatalf("failed to create encryptor: %v", err)
 	}
@@ -99,7 +106,9 @@ func TestEncryptorMultipleRecipients(t *testing.T) {
 		}
 
 		var decrypted bytes.Buffer
-		if _, err := decrypted.ReadFrom(r); err != nil {
+
+		_, err = decrypted.ReadFrom(r)
+		if err != nil {
 			t.Fatalf("recipient %d failed to read decrypted data: %v", i+1, err)
 		}
 
@@ -110,6 +119,8 @@ func TestEncryptorMultipleRecipients(t *testing.T) {
 }
 
 func TestEncryptorUpdateRecipients(t *testing.T) {
+	t.Parallel()
+
 	// Generate two identities
 	identity1, _ := age.GenerateX25519Identity()
 	identity2, _ := age.GenerateX25519Identity()
@@ -118,7 +129,7 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 	publicKey2 := identity2.Recipient().String()
 
 	// Create encryptor with first key
-	enc, err := NewEncryptor([]string{publicKey1})
+	enc, err := crypto.NewEncryptor([]string{publicKey1})
 	if err != nil {
 		t.Fatalf("failed to create encryptor: %v", err)
 	}
@@ -132,7 +143,8 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 	}
 
 	// Update to second key
-	if err := enc.UpdateRecipients([]string{publicKey2}); err != nil {
+	err = enc.UpdateRecipients([]string{publicKey2})
+	if err != nil {
 		t.Fatalf("failed to update recipients: %v", err)
 	}
 
@@ -143,20 +155,24 @@ func TestEncryptorUpdateRecipients(t *testing.T) {
 	}
 
 	// First ciphertext should only decrypt with first identity
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext1), identity1); err != nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext1), identity1)
+	if err != nil {
 		t.Error("failed to decrypt with identity1")
 	}
 
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext1), identity2); err == nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext1), identity2)
+	if err == nil {
 		t.Error("should not decrypt with identity2")
 	}
 
 	// Second ciphertext should only decrypt with second identity
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext2), identity2); err != nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext2), identity2)
+	if err != nil {
 		t.Error("failed to decrypt with identity2")
 	}
 
-	if _, err := age.Decrypt(bytes.NewReader(ciphertext2), identity1); err == nil {
+	_, err = age.Decrypt(bytes.NewReader(ciphertext2), identity1)
+	if err == nil {
 		t.Error("should not decrypt with identity1")
 	}
 }