mc/metacrypt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix gosec, errorlint, and gofmt linter errors in unseal.go and grpc.go

Browse Source 
Co-authored-by: Junie <junie@jetbrains.com>
This commit is contained in:
Kyle Isom
2026-03-15 10:30:18 -07:00
parent 2336bf5061
commit 33e71eeee9
3 changed files with 11 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.junie/memory/language.json
View File

@@ -1 +1 @@
[{"lang":"en","usageCount":4}] [{"lang":"en","usageCount":5}]

6
cmd/metacrypt/unseal.go
View File

@@ -11,9 +11,9 @@ import (
"os" "os"
"github.com/spf13/cobra" "github.com/spf13/cobra"
"golang.org/x/term"
"google.golang.org/grpc" "google.golang.org/grpc"
"google.golang.org/grpc/credentials" "google.golang.org/grpc/credentials"
"golang.org/x/term"
metacryptv1 "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1" metacryptv1 "git.wntrmute.dev/kyle/metacrypt/gen/metacrypt/v1"
) )
@@ -44,7 +44,7 @@ func runUnseal(cmd *cobra.Command, args []string) error {
} }
fmt.Print("Unseal password: ") fmt.Print("Unseal password: ")
passwordBytes, err := term.ReadPassword(int(os.Stdin.Fd())) passwordBytes, err := term.ReadPassword(int(os.Stdin.Fd())) //nolint:gosec
fmt.Println() fmt.Println()
if err != nil { if err != nil {
return fmt.Errorf("read password: %w", err) return fmt.Errorf("read password: %w", err)
@@ -59,7 +59,7 @@ func runUnseal(cmd *cobra.Command, args []string) error {
func buildTLSConfig(caCertPath string) (*tls.Config, error) { func buildTLSConfig(caCertPath string) (*tls.Config, error) {
tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12} tlsCfg := &tls.Config{MinVersion: tls.VersionTLS12}
if caCertPath != "" { if caCertPath != "" {
pem, err := os.ReadFile(caCertPath) pem, err := os.ReadFile(caCertPath) //nolint:gosec
if err != nil { if err != nil {
return nil, fmt.Errorf("read CA cert: %w", err) return nil, fmt.Errorf("read CA cert: %w", err)
} }

13
internal/server/grpc.go
View File

@@ -3,6 +3,7 @@ package server
import ( import (
"context" "context"
"crypto/tls" "crypto/tls"
"errors"
"fmt" "fmt"
"net" "net"
@@ -33,7 +34,7 @@ func (g *systemServiceServer) Init(ctx context.Context, req *metacryptv1.InitReq
Threads: g.s.cfg.Seal.Argon2Threads, Threads: g.s.cfg.Seal.Argon2Threads,
} }
if err := g.s.seal.Initialize(ctx, []byte(req.Password), params); err != nil { if err := g.s.seal.Initialize(ctx, []byte(req.Password), params); err != nil {
if err == seal.ErrAlreadyInitialized { if errors.Is(err, seal.ErrAlreadyInitialized) {
return nil, grpcstatus.Error(codes.AlreadyExists, "already initialized") return nil, grpcstatus.Error(codes.AlreadyExists, "already initialized")
} }
g.s.logger.Error("grpc init failed", "error", err) g.s.logger.Error("grpc init failed", "error", err)
@@ -44,14 +45,14 @@ func (g *systemServiceServer) Init(ctx context.Context, req *metacryptv1.InitReq
func (g *systemServiceServer) Unseal(ctx context.Context, req *metacryptv1.UnsealRequest) (*metacryptv1.UnsealResponse, error) { func (g *systemServiceServer) Unseal(ctx context.Context, req *metacryptv1.UnsealRequest) (*metacryptv1.UnsealResponse, error) {
if err := g.s.seal.Unseal([]byte(req.Password)); err != nil { if err := g.s.seal.Unseal([]byte(req.Password)); err != nil {
switch err { switch {
case seal.ErrNotInitialized: case errors.Is(err, seal.ErrNotInitialized):
return nil, grpcstatus.Error(codes.FailedPrecondition, "not initialized") return nil, grpcstatus.Error(codes.FailedPrecondition, "not initialized")
case seal.ErrInvalidPassword: case errors.Is(err, seal.ErrInvalidPassword):
return nil, grpcstatus.Error(codes.Unauthenticated, "invalid password") return nil, grpcstatus.Error(codes.Unauthenticated, "invalid password")
case seal.ErrRateLimited: case errors.Is(err, seal.ErrRateLimited):
return nil, grpcstatus.Error(codes.ResourceExhausted, "too many attempts, try again later") return nil, grpcstatus.Error(codes.ResourceExhausted, "too many attempts, try again later")
case seal.ErrNotSealed: case errors.Is(err, seal.ErrNotSealed):
return nil, grpcstatus.Error(codes.AlreadyExists, "already unsealed") return nil, grpcstatus.Error(codes.AlreadyExists, "already unsealed")
default: default:
g.s.logger.Error("grpc unseal failed", "error", err) g.s.logger.Error("grpc unseal failed", "error", err)