Fix gosec, govet, and errorlint linter errors

Co-authored-by: Junie <junie@jetbrains.com>

internal/barrier/barrier.go

@@ -39,8 +39,8 @@ type Barrier interface {
 // AESGCMBarrier implements Barrier using AES-256-GCM encryption.
 type AESGCMBarrier struct {
 	db  *sql.DB
+	mek []byte
 	mu  sync.RWMutex
-	mek []byte // nil when sealed
 }
 
 // NewAESGCMBarrier creates a new AES-GCM barrier backed by the given database.
@@ -151,7 +151,7 @@ func (b *AESGCMBarrier) List(ctx context.Context, prefix string) ([]string, erro
 	if err != nil {
 		return nil, fmt.Errorf("barrier: list %q: %w", prefix, err)
 	}
-	defer rows.Close()
+	defer func() { _ = rows.Close() }()
 
 	var paths []string
 	for rows.Next() {

internal/barrier/barrier_test.go

@@ -2,6 +2,7 @@ package barrier
 
 import (
 	"context"
+	"errors"
 	"path/filepath"
 	"testing"
 
@@ -78,7 +79,7 @@ func TestBarrierGetNotFound(t *testing.T) {
 	b.Unseal(mek)
 
 	_, err := b.Get(ctx, "nonexistent")
-	if err != ErrNotFound {
+	if !errors.Is(err, ErrNotFound) {
 		t.Fatalf("expected ErrNotFound, got: %v", err)
 	}
 }
@@ -96,7 +97,7 @@ func TestBarrierDelete(t *testing.T) {
 		t.Fatalf("Delete: %v", err)
 	}
 	_, err := b.Get(ctx, "test/delete-me")
-	if err != ErrNotFound {
+	if !errors.Is(err, ErrNotFound) {
 		t.Fatalf("expected ErrNotFound after delete, got: %v", err)
 	}
 }
@@ -127,16 +128,16 @@ func TestBarrierSealedOperations(t *testing.T) {
 	defer cleanup()
 	ctx := context.Background()
 
-	if _, err := b.Get(ctx, "test"); err != ErrSealed {
+	if _, err := b.Get(ctx, "test"); !errors.Is(err, ErrSealed) {
 		t.Fatalf("Get when sealed: expected ErrSealed, got: %v", err)
 	}
-	if err := b.Put(ctx, "test", []byte("data")); err != ErrSealed {
+	if err := b.Put(ctx, "test", []byte("data")); !errors.Is(err, ErrSealed) {
 		t.Fatalf("Put when sealed: expected ErrSealed, got: %v", err)
 	}
-	if err := b.Delete(ctx, "test"); err != ErrSealed {
+	if err := b.Delete(ctx, "test"); !errors.Is(err, ErrSealed) {
 		t.Fatalf("Delete when sealed: expected ErrSealed, got: %v", err)
 	}
-	if _, err := b.List(ctx, "test"); err != ErrSealed {
+	if _, err := b.List(ctx, "test"); !errors.Is(err, ErrSealed) {
 		t.Fatalf("List when sealed: expected ErrSealed, got: %v", err)
 	}
 }