Merge pull request #1582 from jedevc/lint-fixups

Linting tidy-ups

.golangci.yml

@@ -22,6 +22,8 @@ linters:
     - staticcheck
     - typecheck
     - nolintlint
+    - gosec
+    - forbidigo
   disable-all: true
 
 linters-settings:
@@ -32,6 +34,15 @@ linters-settings:
       # The io/ioutil package has been deprecated.
       # https://go.dev/doc/go1.16#ioutil
       - io/ioutil
+  forbidigo:
+    forbid:
+      - '^fmt\.Errorf(# use errors\.Errorf instead)?$'
+  gosec:
+    excludes:
+      - G204  # Audit use of command execution
+      - G402  # TLS MinVersion too low
+    config:
+      G306: "0644"
 
 issues:
   exclude-rules:

bake/bake.go

@@ -3,7 +3,6 @@ package bake
 import (
 	"context"
 	"encoding/csv"
-	"fmt"
 	"io"
 	"os"
 	"path"
@@ -228,7 +227,7 @@ func ParseFiles(files []File, defaults map[string]string) (_ *Config, err error)
 				}
 				hclFiles = append(hclFiles, hf)
 			} else if composeErr != nil {
-				return nil, fmt.Errorf("failed to parse %s: parsing yaml: %v, parsing hcl: %w", f.Name, composeErr, err)
+				return nil, errors.Wrapf(err, "failed to parse %s: parsing yaml: %v, parsing hcl", f.Name, composeErr)
 			} else {
 				return nil, err
 			}

bake/compose.go

@@ -78,6 +78,7 @@ func ParseCompose(cfgs []compose.ConfigFile, envs map[string]string) (*Config, e
 			// compose does not support nil values for labels
 			labels := map[string]*string{}
 			for k, v := range s.Build.Labels {
+				v := v
 				labels[k] = &v
 			}
 

bake/remote.go

@@ -34,9 +34,9 @@ func ReadRemoteFiles(ctx context.Context, nodes []builder.Node, url string, name
 	var files []File
 
 	var node *builder.Node
-	for _, n := range nodes {
+	for i, n := range nodes {
 		if n.Err == nil {
-			node = &n
+			node = &nodes[i]
 			continue
 		}
 	}

commands/build.go

@@ -5,7 +5,6 @@ import (
 	"encoding/base64"
 	"encoding/csv"
 	"encoding/json"
-	"fmt"
 	"io"
 	"os"
 	"runtime"
@@ -358,7 +357,7 @@ func launchControllerAndRunBuild(dockerCli command.Cli, options buildOptions) er
 	// Start build
 	ref, err := c.Build(ctx, options.BuildOptions, pr, os.Stdout, os.Stderr, options.progress)
 	if err != nil {
-		return fmt.Errorf("failed to build: %w", err) // TODO: allow invoke even on error
+		return errors.Wrapf(err, "failed to build") // TODO: allow invoke even on error
 	}
 	if err := pw.Close(); err != nil {
 		logrus.Debug("failed to close stdin pipe writer")

controller/controller.go

@@ -2,12 +2,12 @@ package controller
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/docker/buildx/controller/control"
 	"github.com/docker/buildx/controller/local"
 	"github.com/docker/buildx/controller/remote"
 	"github.com/docker/cli/cli/command"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -21,7 +21,7 @@ func NewController(ctx context.Context, opts control.ControlOptions, dockerCli c
 	logrus.Infof("connecting to buildx server")
 	c, err = remote.NewRemoteBuildxController(ctx, dockerCli, opts)
 	if err != nil {
-		return nil, fmt.Errorf("failed to use buildx server; use --detach=false: %w", err)
+		return nil, errors.Wrap(err, "failed to use buildx server; use --detach=false")
 	}
 	return c, nil
 }

controller/local/controller.go

@@ -2,7 +2,6 @@ package local
 
 import (
 	"context"
-	"fmt"
 	"io"
 
 	"github.com/containerd/console"
@@ -11,6 +10,7 @@ import (
 	"github.com/docker/buildx/controller/control"
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/docker/cli/cli/command"
+	"github.com/pkg/errors"
 )
 
 func NewLocalBuildxController(ctx context.Context, dockerCli command.Cli) control.BuildxController {
@@ -28,10 +28,10 @@ type localController struct {
 
 func (b *localController) Invoke(ctx context.Context, ref string, cfg controllerapi.ContainerConfig, ioIn io.ReadCloser, ioOut io.WriteCloser, ioErr io.WriteCloser) error {
 	if ref != b.ref {
-		return fmt.Errorf("unknown ref %q", ref)
+		return errors.Errorf("unknown ref %q", ref)
 	}
 	if b.resultCtx == nil {
-		return fmt.Errorf("no build result is registered")
+		return errors.New("no build result is registered")
 	}
 	ccfg := build.ContainerConfig{
 		ResultCtx:  b.resultCtx,

controller/remote/client.go

@@ -2,7 +2,6 @@ package remote
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"sync"
 	"time"
@@ -77,7 +76,7 @@ func (c *Client) Disconnect(ctx context.Context, key string) error {
 
 func (c *Client) Invoke(ctx context.Context, ref string, containerConfig pb.ContainerConfig, in io.ReadCloser, stdout io.WriteCloser, stderr io.WriteCloser) error {
 	if ref == "" {
-		return fmt.Errorf("build reference must be specified")
+		return errors.New("build reference must be specified")
 	}
 	stream, err := c.client().Invoke(ctx)
 	if err != nil {
@@ -207,7 +206,7 @@ func (c *Client) build(ctx context.Context, ref string, options pb.BuildOptions,
 					},
 				},
 			}); err != nil {
-				return fmt.Errorf("failed to init input: %w", err)
+				return errors.Wrap(err, "failed to init input")
 			}
 
 			inReader, inWriter := io.Pipe()

controller/remote/controller.go

@@ -25,6 +25,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/moby/buildkit/client"
 	"github.com/pelletier/go-toml"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
@@ -70,7 +71,7 @@ func NewRemoteBuildxController(ctx context.Context, dockerCli command.Cli, opts
 		go wait()
 		c, err = newBuildxClientAndCheck(filepath.Join(serverRoot, "buildx.sock"), 10, time.Second)
 		if err != nil {
-			return nil, fmt.Errorf("cannot connect to the buildx server: %w", err)
+			return nil, errors.Wrap(err, "cannot connect to the buildx server")
 		}
 	}
 	return &buildxController{c, serverRoot}, nil
@@ -91,14 +92,14 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 			// Parse config
 			config, err := getConfig(dockerCli, serverConfigPath)
 			if err != nil {
-				return fmt.Errorf("failed to get config")
+				return err
 			}
 			if config.LogLevel == "" {
 				logrus.SetLevel(logrus.InfoLevel)
 			} else {
 				lvl, err := logrus.ParseLevel(config.LogLevel)
 				if err != nil {
-					return fmt.Errorf("failed to prepare logger: %w", err)
+					return errors.Wrap(err, "failed to prepare logger")
 				}
 				logrus.SetLevel(lvl)
 			}
@@ -147,7 +148,7 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 			go func() {
 				defer close(doneCh)
 				if err := rpc.Serve(l); err != nil {
-					errCh <- fmt.Errorf("error on serving via socket %q: %w", addr, err)
+					errCh <- errors.Wrapf(err, "error on serving via socket %q", addr)
 				}
 			}()
 			var s os.Signal
@@ -173,7 +174,7 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 func getLogFilePath(dockerCli command.Cli, configPath string) (string, error) {
 	config, err := getConfig(dockerCli, configPath)
 	if err != nil {
-		return "", fmt.Errorf("failed to get config")
+		return "", err
 	}
 	logFile := config.LogFile
 	if logFile == "" {
@@ -196,10 +197,10 @@ func getConfig(dockerCli command.Cli, configPath string) (*serverConfig, error)
 	var config serverConfig
 	tree, err := toml.LoadFile(configPath)
 	if err != nil && !(os.IsNotExist(err) && defaultConfigPath) {
-		return nil, fmt.Errorf("failed to load config file %q", configPath)
+		return nil, errors.Wrapf(err, "failed to read config %q", configPath)
 	} else if err == nil {
 		if err := tree.Unmarshal(&config); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal config file %q", configPath)
+			return nil, errors.Wrapf(err, "failed to unmarshal config %q", configPath)
 		}
 	}
 	return &config, nil
@@ -211,7 +212,7 @@ func prepareRootDir(dockerCli command.Cli, config *serverConfig) (string, error)
 		rootDir = rootDataDir(dockerCli)
 	}
 	if rootDir == "" {
-		return "", fmt.Errorf("buildx root dir must be determined")
+		return "", errors.New("buildx root dir must be determined")
 	}
 	if err := os.MkdirAll(rootDir, 0700); err != nil {
 		return "", err
@@ -239,7 +240,7 @@ func newBuildxClientAndCheck(addr string, checkNum int, duration time.Duration)
 			lastErr = nil
 			break
 		}
-		err = fmt.Errorf("failed to access server (tried %d times): %w", i, err)
+		err = errors.Wrapf(err, "failed to access server (tried %d times)", i)
 		logrus.Debugf("connection failure: %v", err)
 		lastErr = err
 		time.Sleep(duration)
@@ -274,7 +275,7 @@ func (c *buildxController) Kill(ctx context.Context) error {
 		return err
 	}
 	if pid <= 0 {
-		return fmt.Errorf("no PID is recorded for buildx server")
+		return errors.New("no PID is recorded for buildx server")
 	}
 	p, err := os.FindProcess(int(pid))
 	if err != nil {

controller/remote/controller_nolinux.go

@@ -4,15 +4,15 @@ package remote
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/docker/buildx/controller/control"
 	"github.com/docker/cli/cli/command"
+	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
 func NewRemoteBuildxController(ctx context.Context, dockerCli command.Cli, opts control.ControlOptions) (control.BuildxController, error) {
-	return nil, fmt.Errorf("remote buildx unsupported")
+	return nil, errors.New("remote buildx unsupported")
 }
 
 func AddControllerCommands(cmd *cobra.Command, dockerCli command.Cli) {}

controller/remote/io.go

@@ -2,14 +2,13 @@ package remote
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"io"
 	"syscall"
 	"time"
 
 	"github.com/docker/buildx/controller/pb"
 	"github.com/moby/sys/signal"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sync/errgroup"
 )
@@ -42,14 +41,14 @@ func serveIO(attachCtx context.Context, srv msgStream, initFn func(*pb.InitMessa
 	}
 	init := msg.GetInit()
 	if init == nil {
-		return fmt.Errorf("unexpected message: %T; wanted init", msg.GetInput())
+		return errors.Errorf("unexpected message: %T; wanted init", msg.GetInput())
 	}
 	ref := init.Ref
 	if ref == "" {
-		return fmt.Errorf("no ref is provided")
+		return errors.New("no ref is provided")
 	}
 	if err := initFn(init); err != nil {
-		return fmt.Errorf("failed to initialize IO server: %w", err)
+		return errors.Wrap(err, "failed to initialize IO server")
 	}
 
 	if stdout != nil {
@@ -124,7 +123,7 @@ func serveIO(attachCtx context.Context, srv msgStream, initFn func(*pb.InitMessa
 			}
 			if file := msg.GetFile(); file != nil {
 				if file.Fd != 0 {
-					return fmt.Errorf("unexpected fd: %v", file.Fd)
+					return errors.Errorf("unexpected fd: %v", file.Fd)
 				}
 				if stdin == nil {
 					continue // no stdin destination is specified so ignore the data
@@ -154,7 +153,7 @@ func serveIO(attachCtx context.Context, srv msgStream, initFn func(*pb.InitMessa
 					ioConfig.signalFn(ctx, syscallSignal)
 				}
 			} else {
-				return fmt.Errorf("unexpected message: %T", msg.GetInput())
+				return errors.Errorf("unexpected message: %T", msg.GetInput())
 			}
 		}
 	})
@@ -183,7 +182,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 			Init: initMessage,
 		},
 	}); err != nil {
-		return fmt.Errorf("failed to init: %w", err)
+		return errors.Wrap(err, "failed to init")
 	}
 
 	if cfg.stdin != nil {
@@ -228,7 +227,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 						},
 					},
 				}); err != nil {
-					return fmt.Errorf("failed to send signal: %w", err)
+					return errors.Wrap(err, "failed to send signal")
 				}
 			}
 		})
@@ -253,7 +252,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 						},
 					},
 				}); err != nil {
-					return fmt.Errorf("failed to send resize: %w", err)
+					return errors.Wrap(err, "failed to send resize")
 				}
 			}
 		})
@@ -301,7 +300,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 				case 2:
 					out = cfg.stderr
 				default:
-					return fmt.Errorf("unsupported fd %d", file.Fd)
+					return errors.Errorf("unsupported fd %d", file.Fd)
 
 				}
 				if out == nil {
@@ -317,7 +316,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 					eofs[file.Fd] = struct{}{}
 				}
 			} else {
-				return fmt.Errorf("unexpected message: %T", msg.GetInput())
+				return errors.Errorf("unexpected message: %T", msg.GetInput())
 			}
 		}
 	})

controller/remote/server.go

@@ -2,8 +2,6 @@ package remote
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"io"
 	"sync"
 	"time"
@@ -14,6 +12,7 @@ import (
 	"github.com/docker/buildx/version"
 	controlapi "github.com/moby/buildkit/api/services/control"
 	"github.com/moby/buildkit/client"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sync/errgroup"
 )
@@ -71,7 +70,7 @@ func (m *Server) List(ctx context.Context, req *pb.ListRequest) (res *pb.ListRes
 func (m *Server) Disconnect(ctx context.Context, req *pb.DisconnectRequest) (res *pb.DisconnectResponse, err error) {
 	key := req.Ref
 	if key == "" {
-		return nil, fmt.Errorf("disconnect: empty key")
+		return nil, errors.New("disconnect: empty key")
 	}
 
 	m.sessionMu.Lock()
@@ -108,7 +107,7 @@ func (m *Server) Close() error {
 func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResponse, error) {
 	ref := req.Ref
 	if ref == "" {
-		return nil, fmt.Errorf("build: empty key")
+		return nil, errors.New("build: empty key")
 	}
 
 	// Prepare status channel and session if not exists
@@ -119,7 +118,7 @@ func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResp
 	s, ok := m.session[ref]
 	if ok && m.session[ref].statusChan != nil {
 		m.sessionMu.Unlock()
-		return &pb.BuildResponse{}, fmt.Errorf("build or status ongoing or status didn't called")
+		return &pb.BuildResponse{}, errors.New("build or status ongoing or status didn't call")
 	}
 	statusChan := make(chan *client.SolveStatus)
 	s.statusChan = statusChan
@@ -143,7 +142,7 @@ func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResp
 		m.session[ref] = s
 	} else {
 		m.sessionMu.Unlock()
-		return nil, fmt.Errorf("build: unknown key %v", ref)
+		return nil, errors.Errorf("build: unknown key %v", ref)
 	}
 	m.sessionMu.Unlock()
 	defer inR.Close()
@@ -159,7 +158,7 @@ func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResp
 		m.session[ref] = s
 	} else {
 		m.sessionMu.Unlock()
-		return nil, fmt.Errorf("build: unknown key %v", ref)
+		return nil, errors.Errorf("build: unknown key %v", ref)
 	}
 	m.sessionMu.Unlock()
 
@@ -169,7 +168,7 @@ func (m *Server) Build(ctx context.Context, req *pb.BuildRequest) (*pb.BuildResp
 func (m *Server) Status(req *pb.StatusRequest, stream pb.Controller_StatusServer) error {
 	ref := req.Ref
 	if ref == "" {
-		return fmt.Errorf("status: empty key")
+		return errors.New("status: empty key")
 	}
 
 	// Wait and get status channel prepared by Build()
@@ -212,11 +211,11 @@ func (m *Server) Input(stream pb.Controller_InputServer) (err error) {
 	}
 	init := msg.GetInit()
 	if init == nil {
-		return fmt.Errorf("unexpected message: %T; wanted init", msg.GetInit())
+		return errors.Errorf("unexpected message: %T; wanted init", msg.GetInit())
 	}
 	ref := init.Ref
 	if ref == "" {
-		return fmt.Errorf("input: no ref is provided")
+		return errors.New("input: no ref is provided")
 	}
 
 	// Wait and get input stream pipe prepared by Build()
@@ -271,7 +270,7 @@ func (m *Server) Input(stream pb.Controller_InputServer) (err error) {
 			select {
 			case msg = <-msgCh:
 			case <-ctx.Done():
-				return fmt.Errorf("canceled: %w", ctx.Err())
+				return errors.Wrap(ctx.Err(), "canceled")
 			}
 			if msg == nil {
 				return nil
@@ -332,7 +331,7 @@ func (m *Server) Invoke(srv pb.Controller_InvokeServer) error {
 				m.session[ref] = s
 			} else {
 				m.sessionMu.Unlock()
-				return fmt.Errorf("invoke: unknown key %v", ref)
+				return errors.Errorf("invoke: unknown key %v", ref)
 			}
 			m.sessionMu.Unlock()
 
@@ -340,7 +339,7 @@ func (m *Server) Invoke(srv pb.Controller_InvokeServer) error {
 			m.sessionMu.Lock()
 			if _, ok := m.session[ref]; !ok || m.session[ref].result == nil {
 				m.sessionMu.Unlock()
-				return fmt.Errorf("unknown reference: %q", ref)
+				return errors.Errorf("unknown reference: %q", ref)
 			}
 			resultCtx = m.session[ref].result
 			m.sessionMu.Unlock()
@@ -361,10 +360,10 @@ func (m *Server) Invoke(srv pb.Controller_InvokeServer) error {
 			return err
 		}
 		if cfg == nil {
-			return fmt.Errorf("no container config is provided")
+			return errors.New("no container config is provided")
 		}
 		if resultCtx == nil {
-			return fmt.Errorf("no result is provided")
+			return errors.New("no result is provided")
 		}
 		ccfg := build.ContainerConfig{
 			ResultCtx:  resultCtx,

driver/kubernetes/podchooser/podchooser.go

@@ -37,7 +37,7 @@ func (pc *RandomPodChooser) ChoosePod(ctx context.Context) (*corev1.Pod, error)
 	if randSource == nil {
 		randSource = rand.NewSource(time.Now().Unix())
 	}
-	rnd := rand.New(randSource)
+	rnd := rand.New(randSource) //nolint:gosec // no strong seeding required
 	n := rnd.Int() % len(pods)
 	logrus.Debugf("RandomPodChooser.ChoosePod(): len(pods)=%d, n=%d", len(pods), n)
 	return pods[n], nil