Update golangci-lint to v2.12.2 with canonical config (#62)

Updates golangci-lint to v2.12.2 everywhere it is pinned and installs the canonical `.golangci.yml`, then remediates every finding the new linter/config surfaces so `make check` is green. ## Version bump - `Dockerfile` lint stage: `golangci/golangci-lint:v2.11.3-alpine` -> `v2.12.2-alpine` (digest-pinned, date comment updated) - `Makefile` `deps` target: `go install` moved from the old v1 module path at `@latest` to the pinned `github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2` - `.golangci.yml` replaced with the canonical config (v2 schema; settings under `linters.settings` so the thresholds actually apply; `default: all` with the standard six disables) - `script/bootstrap` installs golangci-lint via the system package manager and carries no version pin, so it is unchanged - CI (`.gitea/workflows/check.yml`) only runs `script/cibuild`, so it needed no change ## Lint remediation The canonical config surfaced ~3,300 findings across 56k lines. All are fixed, behavior-preserving; incorporates and supersedes the per-package mechanical passes already merged to `main` (refs #61). Highlights: - `err113`: dynamic errors replaced with package sentinels + `%w` wrapping; comparisons via `errors.Is` - `goprintffuncname`: printf-style helpers renamed with an `f` suffix (`ui.Writer` message methods, `cli.ReportErrorf`, `database.Fatalf`) and all call sites updated - `revive` stutter renames: `blob.Handler`, `blob.WithReader`, `blob.ChunkPosition`, `storage.URL`, `storage.Info`; missing doc comments added - `contextcheck`/`noctx`: `context.Context` threaded through `blob.Packer` and the scanner call sites; context-aware `exec`/`sql` variants - `funlen`/`cyclop`/`gocognit`/`dupl`: oversized and duplicated functions split into focused helpers (production and test code) - tests: `t.Parallel()` added where safe (global logger init kept in the serial phase for `-race`), `t.TempDir()`/`t.Helper()` adopted, several suites converted to external test packages - `gosec`: bounded integer conversions, `ReadHeaderTimeout` on the test HTTP server; remaining warnings suppressed per-site with justifications - remaining `nolint` directives are rare, targeted, and each carries a reason (e.g. `nilnil` not-found contract in the repository layer, fx module globals, on-disk snake_case struct tags) - removed the deprecated `log.LogOptions` alias (callers migrated to `log.Options`) `make check` (tests with `-race`, lint, fmt-check) passes. Co-authored-by: sneak <sneak@sneak.berlin> Reviewed-on: #62 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>
2026-08-07 23:22:48 +02:00
parent b87b72d4b9
commit cc58583130
126 changed files with 8184 additions and 5470 deletions
--- a/internal/vaultik/verify.go
+++ b/internal/vaultik/verify.go
@@ -4,19 +4,37 @@ import (
 	"crypto/sha256"
 	"database/sql"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"hash"
 	"io"
 	"os"
 	"time"

-	"github.com/dustin/go-humanize"
 	"github.com/klauspost/compress/zstd"
+
+	// Blank import registers the pure-Go sqlite driver for database/sql.
 	_ "modernc.org/sqlite"
 	"sneak.berlin/go/vaultik/internal/log"
 	"sneak.berlin/go/vaultik/internal/snapshot"
 )

+// Sentinel errors for snapshot verification failures.
+var (
+	errVerificationFailed = errors.New("verification failed")
+	errSecretKeyRequired  = errors.New(
+		"VAULTIK_AGE_SECRET_KEY not set; required for deep verification")
+	errChunksOutOfOrder  = errors.New("chunks out of order")
+	errChunkHashMismatch = errors.New("chunk hash mismatch")
+	errTrailingBlobData  = errors.New(
+		"blob has unexpected trailing bytes not covered by chunk list")
+	errManifestExtraBlob = errors.New("manifest contains blob not in database")
+	errBlobSizeMismatch  = errors.New("blob size mismatch")
+)
+
+// verifyStatusFailed is the JSON status value for a failed verification.
+const verifyStatusFailed = "failed"
+
 // VerifyOptions contains options for the verify command
 type VerifyOptions struct {
 	Deep bool
@@ -24,6 +42,8 @@ type VerifyOptions struct {
 }

 // VerifyResult contains the result of a snapshot verification
+//
+//nolint:tagliatelle // snake_case is the established JSON output format
 type VerifyResult struct {
 	SnapshotID   string `json:"snapshot_id"`
 	Status       string `json:"status"` // "ok" or "failed"
@@ -37,8 +57,10 @@ type VerifyResult struct {
 }

 // deepVerifyFailure records a failure in the result and returns it appropriately
-func (v *Vaultik) deepVerifyFailure(result *VerifyResult, opts *VerifyOptions, msg string, err error) error {
-	result.Status = "failed"
+func (v *Vaultik) deepVerifyFailure(
+	result *VerifyResult, opts *VerifyOptions, msg string, err error,
+) error {
+	result.Status = verifyStatusFailed

 	result.ErrorMessage = msg
 	if opts.JSON {
@@ -49,7 +71,7 @@ func (v *Vaultik) deepVerifyFailure(result *VerifyResult, opts *VerifyOptions, m
 		return err
 	}

-	return fmt.Errorf("%s", msg)
+	return fmt.Errorf("%w: %s", errVerificationFailed, msg)
 }

 // RunDeepVerify executes deep verification operation
@@ -60,15 +82,14 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 	}

 	if !v.CanDecrypt() {
-		msg := "VAULTIK_AGE_SECRET_KEY not set; required for deep verification"
-
-		return v.deepVerifyFailure(result, opts, msg, fmt.Errorf("%s", msg))
+		return v.deepVerifyFailure(result, opts,
+			errSecretKeyRequired.Error(), errSecretKeyRequired)
 	}

 	log.Info("Starting snapshot verification", "snapshot_id", snapshotID, "mode", "deep")

 	if !opts.JSON {
-		v.printfStdout("Deep verification of snapshot: %s\n\n", snapshotID)
+		v.stdoutf("Deep verification of snapshot: %s\n\n", snapshotID)
 	}

 	manifest, tempDB, dbBlobs, err := v.loadVerificationData(snapshotID, opts, result)
@@ -104,16 +125,18 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {

 	log.Info("✓ Verification completed successfully",
 		"snapshot_id", snapshotID, "mode", "deep", "blobs_verified", len(dbBlobs))
-	v.printfStdout("\n✓ Verification completed successfully\n")
-	v.printfStdout("  Snapshot:       %s\n", snapshotID)
-	v.printfStdout("  Blobs verified: %d\n", len(dbBlobs))
-	v.printfStdout("  Total size:     %s\n", humanize.Bytes(uint64(totalSize)))
+	v.stdoutf("\n✓ Verification completed successfully\n")
+	v.stdoutf("  Snapshot:       %s\n", snapshotID)
+	v.stdoutf("  Blobs verified: %d\n", len(dbBlobs))
+	v.stdoutf("  Total size:     %s\n", ubytes(totalSize))

 	return nil
 }

 // loadVerificationData downloads manifest, database, and blob list for verification
-func (v *Vaultik) loadVerificationData(snapshotID string, opts *VerifyOptions, result *VerifyResult) (*snapshot.Manifest, *tempDB, []snapshot.BlobInfo, error) {
+func (v *Vaultik) loadVerificationData(
+	snapshotID string, opts *VerifyOptions, result *VerifyResult,
+) (*snapshot.Manifest, *tempDB, []snapshot.BlobInfo, error) {
 	// All remote paths use the hashed key derived from the human ID.
 	remoteKey := snapshot.RemoteSnapshotKey(snapshotID)

@@ -122,7 +145,7 @@ func (v *Vaultik) loadVerificationData(snapshotID string, opts *VerifyOptions, r
 	log.Info("Downloading manifest", "path", manifestPath)

 	if !opts.JSON {
-		v.printfStdout("Downloading manifest...\n")
+		v.stdoutf("Downloading manifest...\n")
 	}

 	manifestReader, err := v.Storage.Get(v.ctx, manifestPath)
@@ -143,11 +166,12 @@ func (v *Vaultik) loadVerificationData(snapshotID string, opts *VerifyOptions, r

 	log.Info("Manifest loaded",
 		"manifest_blob_count", manifest.BlobCount,
-		"manifest_total_size", humanize.Bytes(uint64(manifest.TotalCompressedSize)))
+		"manifest_total_size", ubytes(manifest.TotalCompressedSize))

 	if !opts.JSON {
-		v.printfStdout("Manifest loaded: %d blobs (%s)\n", manifest.BlobCount, humanize.Bytes(uint64(manifest.TotalCompressedSize)))
-		v.printfStdout("Downloading and decrypting database...\n")
+		v.stdoutf("Manifest loaded: %d blobs (%s)\n",
+			manifest.BlobCount, ubytes(manifest.TotalCompressedSize))
+		v.stdoutf("Downloading and decrypting database...\n")
 	}

 	// Download and decrypt database
@@ -163,7 +187,7 @@ func (v *Vaultik) loadVerificationData(snapshotID string, opts *VerifyOptions, r

 	defer func() { _ = dbReader.Close() }()

-	tdb, err := v.decryptAndLoadDatabase(dbReader, v.Config.AgeSecretKey)
+	tdb, err := v.decryptAndLoadDatabase(dbReader)
 	if err != nil {
 		return nil, nil, nil, v.deepVerifyFailure(result, opts,
 			fmt.Sprintf("failed to decrypt database: %v", err),
@@ -186,19 +210,28 @@ func (v *Vaultik) loadVerificationData(snapshotID string, opts *VerifyOptions, r

 	log.Info("Database loaded",
 		"db_blob_count", len(dbBlobs),
-		"db_total_size", humanize.Bytes(uint64(dbTotalSize)))
+		"db_total_size", ubytes(dbTotalSize))

 	if !opts.JSON {
-		v.printfStdout("Database loaded: %d blobs (%s)\n", len(dbBlobs), humanize.Bytes(uint64(dbTotalSize)))
+		v.stdoutf("Database loaded: %d blobs (%s)\n",
+			len(dbBlobs), ubytes(dbTotalSize))
 	}

 	return manifest, tdb, dbBlobs, nil
 }

-// runVerificationSteps executes manifest verification, blob existence check, and deep content verification
-func (v *Vaultik) runVerificationSteps(manifest *snapshot.Manifest, dbBlobs []snapshot.BlobInfo, tdb *tempDB, opts *VerifyOptions, result *VerifyResult, totalSize int64) error {
+// runVerificationSteps executes manifest verification, blob existence
+// check, and deep content verification.
+func (v *Vaultik) runVerificationSteps(
+	manifest *snapshot.Manifest,
+	dbBlobs []snapshot.BlobInfo,
+	tdb *tempDB,
+	opts *VerifyOptions,
+	result *VerifyResult,
+	totalSize int64,
+) error {
 	if !opts.JSON {
-		v.printfStdout("Verifying manifest against database...\n")
+		v.stdoutf("Verifying manifest against database...\n")
 	}

 	err := v.verifyManifestAgainstDatabase(manifest, dbBlobs)
@@ -207,8 +240,8 @@ func (v *Vaultik) runVerificationSteps(manifest *snapshot.Manifest, dbBlobs []sn
 	}

 	if !opts.JSON {
-		v.printfStdout("Manifest verified.\n")
-		v.printfStdout("Checking blob existence in remote storage...\n")
+		v.stdoutf("Manifest verified.\n")
+		v.stdoutf("Checking blob existence in remote storage...\n")
 	}

 	err = v.verifyBlobExistenceFromDB(dbBlobs)
@@ -217,8 +250,9 @@ func (v *Vaultik) runVerificationSteps(manifest *snapshot.Manifest, dbBlobs []sn
 	}

 	if !opts.JSON {
-		v.printfStdout("All blobs exist.\n")
-		v.printfStdout("Downloading and verifying blob contents (%d blobs, %s)...\n", len(dbBlobs), humanize.Bytes(uint64(totalSize)))
+		v.stdoutf("All blobs exist.\n")
+		v.stdoutf("Downloading and verifying blob contents (%d blobs, %s)...\n",
+			len(dbBlobs), ubytes(totalSize))
 	}

 	err = v.performDeepVerificationFromDB(dbBlobs, tdb.DB, opts)
@@ -243,8 +277,9 @@ func (t *tempDB) Close() error {
 	return err
 }

-// decryptAndLoadDatabase decrypts and loads the binary SQLite database from the encrypted stream
-func (v *Vaultik) decryptAndLoadDatabase(reader io.ReadCloser, secretKey string) (*tempDB, error) {
+// decryptAndLoadDatabase decrypts and loads the binary SQLite database
+// from the encrypted stream.
+func (v *Vaultik) decryptAndLoadDatabase(reader io.ReadCloser) (*tempDB, error) {
 	// Get decryptor
 	decryptor, err := v.GetDecryptor()
 	if err != nil {
@@ -285,7 +320,7 @@ func (v *Vaultik) decryptAndLoadDatabase(reader io.ReadCloser, secretKey string)

 	_ = tempFile.Close()

-	log.Info("Database decompressed", "size", humanize.Bytes(uint64(written)))
+	log.Info("Database decompressed", "size", ubytes(written))

 	// Open the database
 	db, err := sql.Open("sqlite", tempPath)
@@ -346,15 +381,17 @@ func (v *Vaultik) verifyBlob(blobInfo snapshot.BlobInfo, db *sql.DB) error {
 	log.Info("Blob verified",
 		"hash", blobInfo.Hash[:16]+"...",
 		"chunks", chunkCount,
-		"size", humanize.Bytes(uint64(blobInfo.CompressedSize)),
+		"size", ubytes(blobInfo.CompressedSize),
 	)

 	return nil
 }

-// verifyBlobChunks queries blob chunks from the database and verifies each chunk's hash
-// against the decompressed blob stream
-func (v *Vaultik) verifyBlobChunks(db *sql.DB, blobHash string, decompressor io.Reader) (int, error) {
+// verifyBlobChunks queries blob chunks from the database and verifies
+// each chunk's hash against the decompressed blob stream.
+func (v *Vaultik) verifyBlobChunks(
+	db *sql.DB, blobHash string, decompressor io.Reader,
+) (int, error) {
 	query := `
 		SELECT bc.chunk_hash, bc.offset, bc.length
 		FROM blob_chunks bc
@@ -389,7 +426,8 @@ func (v *Vaultik) verifyBlobChunks(db *sql.DB, blobHash string, decompressor io.

 		// Verify chunk ordering
 		if offset <= lastOffset {
-			return 0, fmt.Errorf("chunks out of order: offset %d after %d", offset, lastOffset)
+			return 0, fmt.Errorf("%w: offset %d after %d",
+				errChunksOutOfOrder, offset, lastOffset)
 		}

 		lastOffset = offset
@@ -423,8 +461,8 @@ func (v *Vaultik) verifyBlobChunks(db *sql.DB, blobHash string, decompressor io.
 		calculatedHash := hex.EncodeToString(hasher.Sum(nil))

 		if calculatedHash != chunkHash {
-			return 0, fmt.Errorf("chunk hash mismatch at offset %d: calculated %s, expected %s",
-				offset, calculatedHash, chunkHash)
+			return 0, fmt.Errorf("%w at offset %d: calculated %s, expected %s",
+				errChunkHashMismatch, offset, calculatedHash, chunkHash)
 		}

 		chunkCount++
@@ -438,31 +476,37 @@ func (v *Vaultik) verifyBlobChunks(db *sql.DB, blobHash string, decompressor io.
 	return chunkCount, nil
 }

-// verifyBlobFinalIntegrity checks that no trailing data exists in the decompressed stream
-// and that the encrypted blob hash matches the expected value
-func (v *Vaultik) verifyBlobFinalIntegrity(decompressor io.Reader, blobHasher hash.Hash, expectedHash string) error {
-	// Verify no remaining data in blob - if chunk list is accurate, blob should be fully consumed
+// verifyBlobFinalIntegrity checks that no trailing data exists in the
+// decompressed stream and that the encrypted blob hash matches the
+// expected value.
+func (v *Vaultik) verifyBlobFinalIntegrity(
+	decompressor io.Reader, blobHasher hash.Hash, expectedHash string,
+) error {
+	// Verify no remaining data in blob - if the chunk list is accurate,
+	// the blob should be fully consumed.
 	remaining, err := io.Copy(io.Discard, decompressor)
 	if err != nil {
 		return fmt.Errorf("failed to check for remaining blob data: %w", err)
 	}

 	if remaining > 0 {
-		return fmt.Errorf("blob has %d unexpected trailing bytes not covered by chunk list", remaining)
+		return fmt.Errorf("%w: %d bytes", errTrailingBlobData, remaining)
 	}

 	// Verify blob hash matches the encrypted data we downloaded
 	calculatedBlobHash := hex.EncodeToString(blobHasher.Sum(nil))
 	if calculatedBlobHash != expectedHash {
-		return fmt.Errorf("blob hash mismatch: calculated %s, expected %s",
-			calculatedBlobHash, expectedHash)
+		return fmt.Errorf("%w: calculated %s, expected %s",
+			errBlobHashMismatch, calculatedBlobHash, expectedHash)
 	}

 	return nil
 }

 // getBlobsFromDatabase gets all blobs for the snapshot from the database
-func (v *Vaultik) getBlobsFromDatabase(snapshotID string, db *sql.DB) ([]snapshot.BlobInfo, error) {
+func (v *Vaultik) getBlobsFromDatabase(
+	snapshotID string, db *sql.DB,
+) ([]snapshot.BlobInfo, error) {
 	query := `
 		SELECT b.blob_hash, b.compressed_size
 		FROM snapshot_blobs sb
@@ -505,8 +549,11 @@ func (v *Vaultik) getBlobsFromDatabase(snapshotID string, db *sql.DB) ([]snapsho
 	return blobs, nil
 }

-// verifyManifestAgainstDatabase verifies the manifest matches the authoritative database
-func (v *Vaultik) verifyManifestAgainstDatabase(manifest *snapshot.Manifest, dbBlobs []snapshot.BlobInfo) error {
+// verifyManifestAgainstDatabase verifies the manifest matches the
+// authoritative database.
+func (v *Vaultik) verifyManifestAgainstDatabase(
+	manifest *snapshot.Manifest, dbBlobs []snapshot.BlobInfo,
+) error {
 	log.Info("Verifying manifest against database")

 	// Build map of database blobs
@@ -534,12 +581,13 @@ func (v *Vaultik) verifyManifestAgainstDatabase(manifest *snapshot.Manifest, dbB
 	for hash, manifestSize := range manifestBlobMap {
 		dbSize, exists := dbBlobMap[hash]
 		if !exists {
-			return fmt.Errorf("manifest contains blob %s not in database", hash)
+			return fmt.Errorf("%w: %s", errManifestExtraBlob, hash)
 		}

 		if dbSize != manifestSize {
-			return fmt.Errorf("blob %s size mismatch: database has %d bytes, manifest has %d bytes",
-				hash, dbSize, manifestSize)
+			return fmt.Errorf(
+				"%w: blob %s: database has %d bytes, manifest has %d bytes",
+				errBlobSizeMismatch, hash, dbSize, manifestSize)
 		}
 	}

@@ -567,16 +615,18 @@ func (v *Vaultik) verifyBlobExistenceFromDB(blobs []snapshot.BlobInfo) error {

 		// Verify size matches
 		if stat.Size != blob.CompressedSize {
-			return fmt.Errorf("blob %s size mismatch: S3 has %d bytes, database has %d bytes",
-				blob.Hash, stat.Size, blob.CompressedSize)
+			return fmt.Errorf(
+				"%w: blob %s: S3 has %d bytes, database has %d bytes",
+				errBlobSizeMismatch, blob.Hash, stat.Size, blob.CompressedSize)
 		}

 		// Progress update every 100 blobs
-		if (i+1)%100 == 0 || i == len(blobs)-1 {
+		if (i+1)%progressLogEvery == 0 || i == len(blobs)-1 {
 			log.Info("Blob existence check progress",
 				"checked", i+1,
 				"total", len(blobs),
-				"percent", fmt.Sprintf("%.1f%%", float64(i+1)/float64(len(blobs))*100),
+				"percent", fmt.Sprintf("%.1f%%",
+					float64(i+1)/float64(len(blobs))*percentScale),
 			)
 		}
 	}
@@ -586,8 +636,11 @@ func (v *Vaultik) verifyBlobExistenceFromDB(blobs []snapshot.BlobInfo) error {
 	return nil
 }

-// performDeepVerificationFromDB downloads and verifies the content of each blob using database as source
-func (v *Vaultik) performDeepVerificationFromDB(blobs []snapshot.BlobInfo, db *sql.DB, opts *VerifyOptions) error {
+// performDeepVerificationFromDB downloads and verifies the content of
+// each blob using the database as source.
+func (v *Vaultik) performDeepVerificationFromDB(
+	blobs []snapshot.BlobInfo, db *sql.DB, opts *VerifyOptions,
+) error {
 	// Calculate total bytes for ETA
 	var totalBytesExpected int64
 	for _, b := range blobs {
@@ -596,7 +649,7 @@ func (v *Vaultik) performDeepVerificationFromDB(blobs []snapshot.BlobInfo, db *s

 	log.Info("Starting deep verification - downloading and verifying all blobs",
 		"blob_count", len(blobs),
-		"total_size", humanize.Bytes(uint64(totalBytesExpected)),
+		"total_size", ubytes(totalBytesExpected),
 	)

 	startTime := time.Now()
@@ -630,18 +683,18 @@ func (v *Vaultik) performDeepVerificationFromDB(blobs []snapshot.BlobInfo, db *s
 			"blobs_total", len(blobs),
 			"blobs_remaining", remaining,
 			"bytes_done", bytesProcessed,
-			"bytes_done_human", humanize.Bytes(uint64(bytesProcessed)),
+			"bytes_done_human", ubytes(bytesProcessed),
 			"bytes_total", totalBytesExpected,
-			"bytes_total_human", humanize.Bytes(uint64(totalBytesExpected)),
+			"bytes_total_human", ubytes(totalBytesExpected),
 			"elapsed", elapsed.Round(time.Second),
 			"eta", eta.Round(time.Second),
 		)

 		if !opts.JSON {
-			v.printfStdout("  Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s\n",
+			v.stdoutf("  Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s\n",
 				i+1, len(blobs), remaining,
-				humanize.Bytes(uint64(bytesProcessed)),
-				humanize.Bytes(uint64(totalBytesExpected)),
+				ubytes(bytesProcessed),
+				ubytes(totalBytesExpected),
 				elapsed.Round(time.Second),
 				eta.Round(time.Second))
 		}
@@ -651,7 +704,7 @@ func (v *Vaultik) performDeepVerificationFromDB(blobs []snapshot.BlobInfo, db *s
 	log.Info("✓ Deep verification completed successfully",
 		"blobs_verified", len(blobs),
 		"total_bytes", bytesProcessed,
-		"total_bytes_human", humanize.Bytes(uint64(bytesProcessed)),
+		"total_bytes_human", ubytes(bytesProcessed),
 		"duration", totalElapsed.Round(time.Second),
 	)