From 5e7896f1bfaff619ccc4257a942b56da1625e023 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Mon, 12 Oct 2026 15:45:45 +0200 Subject: [PATCH 1/2] policy: skip invalid UTF-8 hostname normalization IDNA's Unicode 15 tables normalize the invalid UTF-8 hostname to punycode, while the Unicode 17 tables selected by Go 1.27 reject it. Remove this version-dependent case from the normalization tests so they pass on both toolchains without accepting ambiguous behavior. Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- policy/validate_test.go | 1 - 1 file changed, 1 deletion(-) diff --git a/policy/validate_test.go b/policy/validate_test.go index 9989761adaab..fca4df9be77c 100644 --- a/policy/validate_test.go +++ b/policy/validate_test.go @@ -35,7 +35,6 @@ func TestNormalizeHTTPHost(t *testing.T) { {"http", "Example.com", "example.com"}, {"https", "\u0130.EXAMPLE.COM:443", "xn--i-9bb.example.com"}, {"https", "\u00c9XAMPLE.COM", "xn--xample-9ua.com"}, - {"https", "\x94.EXAMPLE.COM", "xn--zn7c.example.com"}, {"https", "EXAMPLE.COM:000443", "example.com"}, {"https", "eXaMpLe.CoM:8443", "example.com:8443"}, {"https", "example.com:443", "example.com"}, From 182badd58038f459dca55a424f50a44d79333080 Mon Sep 17 00:00:00 2001 From: CrazyMax <1951866+crazy-max@users.noreply.github.com> Date: Tue, 13 Oct 2026 15:14:51 +0200 Subject: [PATCH 2/2] update to go 1.27 Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com> --- .github/workflows/build.yml | 2 +- .github/workflows/codeql.yml | 2 +- Dockerfile | 2 +- bake/hclparser/expr.go | 4 ++-- bake/hclparser/gohcl/decode.go | 4 ++-- bake/hclparser/gohcl/encode.go | 12 ++++++------ bake/hclparser/gohcl/schema.go | 6 +++--- bake/hclparser/hclparser.go | 6 +++--- bake/hclparser/type_implied.go | 2 +- build/build.go | 9 ++++----- build/opt_test.go | 2 +- cmd/buildx/debug.go | 4 ++-- commands/create.go | 2 +- commands/replay/build.go | 2 +- docs/generate.go | 2 +- driver/cloud/driver.go | 2 +- driver/cloud/login.go | 2 +- driver/docker-container/driver.go | 4 ++-- driver/kubernetes/driver.go | 3 +-- hack/dockerfiles/docs.Dockerfile | 2 +- hack/dockerfiles/govulncheck.Dockerfile | 2 +- hack/dockerfiles/lint.Dockerfile | 6 +++--- hack/dockerfiles/vendor.Dockerfile | 2 +- localstate/migrate.go | 4 ++-- policy/validate_test.go | 4 ++-- store/store.go | 10 +++++----- util/desktop/desktop.go | 2 +- util/ghutil/ghutil.go | 2 +- util/imagetools/auth.go | 2 +- 29 files changed, 53 insertions(+), 55 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 24ccba57f3cb..ad928d1173f0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,7 +29,7 @@ env: TEST_CACHE_SCOPE: "test" TESTFLAGS: "-v --parallel=6 --timeout=30m" GOTESTSUM_FORMAT: "standard-verbose" - GO_VERSION: "1.26" + GO_VERSION: "1.27" GOTESTSUM_VERSION: "v1.13.0" # same as one in Dockerfile jobs: diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cd3a0cb33e0c..ed11bf36dcec 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -11,7 +11,7 @@ on: pull_request: env: - GO_VERSION: "1.26" + GO_VERSION: "1.27" jobs: codeql: diff --git a/Dockerfile b/Dockerfile index f89db6a6b6ec..bf1ea898ec62 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.26 +ARG GO_VERSION=1.27 ARG ALPINE_VERSION=3.23 ARG XX_VERSION=1.10.0 diff --git a/bake/hclparser/expr.go b/bake/hclparser/expr.go index 80ecb0205c88..8ce4fc1dbeb6 100644 --- a/bake/hclparser/expr.go +++ b/bake/hclparser/expr.go @@ -52,7 +52,7 @@ func jsonFuncCallsRecursive(exp hcl.Expression) ([]string, error) { func appendJSONFuncCalls(exp hcl.Expression, m map[string]struct{}) error { v := reflect.ValueOf(exp) - if v.Kind() != reflect.Ptr || v.IsNil() { + if v.Kind() != reflect.Pointer || v.IsNil() { return errors.Errorf("invalid json expression kind %T %v", exp, v.Kind()) } src := v.Elem().FieldByName("src") @@ -66,7 +66,7 @@ func appendJSONFuncCalls(exp hcl.Expression, m map[string]struct{}) error { if src.IsNil() { return nil } - if src.Kind() == reflect.Ptr { + if src.Kind() == reflect.Pointer { src = src.Elem() } if src.Kind() != reflect.Struct { diff --git a/bake/hclparser/gohcl/decode.go b/bake/hclparser/gohcl/decode.go index 9f73a59bc3ba..48fd5dfd0526 100644 --- a/bake/hclparser/gohcl/decode.go +++ b/bake/hclparser/gohcl/decode.go @@ -23,7 +23,7 @@ func (o DecodeOptions) DecodeBody(body hcl.Body, ctx *hcl.EvalContext, val any) o = o.withDefaults() rv := reflect.ValueOf(val) - if rv.Kind() != reflect.Ptr { + if rv.Kind() != reflect.Pointer { panic(fmt.Sprintf("target value must be a pointer, not %s", rv.Type().String())) } @@ -154,7 +154,7 @@ func (o DecodeOptions) decodeBodyToStruct(body hcl.Body, ctx *hcl.EvalContext, v isSlice = true ty = ty.Elem() } - if ty.Kind() == reflect.Ptr { + if ty.Kind() == reflect.Pointer { isPtr = true ty = ty.Elem() } diff --git a/bake/hclparser/gohcl/encode.go b/bake/hclparser/gohcl/encode.go index 2d509072aa4e..c1f0dde4fbe5 100644 --- a/bake/hclparser/gohcl/encode.go +++ b/bake/hclparser/gohcl/encode.go @@ -39,7 +39,7 @@ import ( func EncodeIntoBody(val any, dst *hclwrite.Body) { rv := reflect.ValueOf(val) ty := rv.Type() - if ty.Kind() == reflect.Ptr { + if ty.Kind() == reflect.Pointer { rv = rv.Elem() ty = rv.Type() } @@ -63,7 +63,7 @@ func EncodeIntoBody(val any, dst *hclwrite.Body) { func EncodeAsBlock(val any, blockType string) *hclwrite.Block { rv := reflect.ValueOf(val) ty := rv.Type() - if ty.Kind() == reflect.Ptr { + if ty.Kind() == reflect.Pointer { rv = rv.Elem() ty = rv.Type() } @@ -110,7 +110,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr fieldTy := field.Type fieldVal := rv.Field(fieldIdx) - if fieldTy.Kind() == reflect.Ptr { + if fieldTy.Kind() == reflect.Pointer { fieldTy = fieldTy.Elem() fieldVal = fieldVal.Elem() } @@ -122,7 +122,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr if !fieldVal.IsValid() { continue // ignore (field value is nil pointer) } - if fieldTy.Kind() == reflect.Ptr && fieldVal.IsNil() { + if fieldTy.Kind() == reflect.Pointer && fieldVal.IsNil() { continue // ignore } if prevWasBlock { @@ -163,7 +163,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr if !elemVal.IsValid() { continue // ignore (elem value is nil pointer) } - if elemTy.Kind() == reflect.Ptr && elemVal.IsNil() { + if elemTy.Kind() == reflect.Pointer && elemVal.IsNil() { continue // ignore } block := EncodeAsBlock(elemVal.Interface(), name) @@ -177,7 +177,7 @@ func populateBody(rv reflect.Value, ty reflect.Type, tags *fieldTags, dst *hclwr if !fieldVal.IsValid() { continue // ignore (field value is nil pointer) } - if elemTy.Kind() == reflect.Ptr && fieldVal.IsNil() { + if elemTy.Kind() == reflect.Pointer && fieldVal.IsNil() { continue // ignore } block := EncodeAsBlock(fieldVal.Interface(), name) diff --git a/bake/hclparser/gohcl/schema.go b/bake/hclparser/gohcl/schema.go index 0f6f03b3b1d9..2575f5ac8627 100644 --- a/bake/hclparser/gohcl/schema.go +++ b/bake/hclparser/gohcl/schema.go @@ -25,7 +25,7 @@ import ( func ImpliedBodySchema(val any) (schema *hcl.BodySchema, partial bool) { ty := reflect.TypeOf(val) - if ty.Kind() == reflect.Ptr { + if ty.Kind() == reflect.Pointer { ty = ty.Elem() } @@ -56,7 +56,7 @@ func ImpliedBodySchema(val any) (schema *hcl.BodySchema, partial bool) { // indicated via a null value, so we don't specify that // the field is required during decoding. required = false - case field.Type.Kind() != reflect.Ptr && !optional: + case field.Type.Kind() != reflect.Pointer && !optional: required = true default: required = false @@ -80,7 +80,7 @@ func ImpliedBodySchema(val any) (schema *hcl.BodySchema, partial bool) { if fty.Kind() == reflect.Slice { fty = fty.Elem() } - if fty.Kind() == reflect.Ptr { + if fty.Kind() == reflect.Pointer { fty = fty.Elem() } if fty.Kind() != reflect.Struct { diff --git a/bake/hclparser/hclparser.go b/bake/hclparser/hclparser.go index 4f0ecc7566fb..a090b64bb5e7 100644 --- a/bake/hclparser/hclparser.go +++ b/bake/hclparser/hclparser.go @@ -424,7 +424,7 @@ func (p *parser) resolveBlock(block *hcl.Block, target *hcl.BodySchema) (err err outputs = prev ectxs = p.blockEvalCtx[block] } else { - if v, ok := reflect.New(t).Interface().(WithEvalContexts); ok { + if v, ok := reflect.TypeAssert[WithEvalContexts](reflect.New(t)); ok { ectxs, err = v.GetEvalContexts(p.ectx, block, func(expr hcl.Expression) hcl.Diagnostics { return p.loadDeps(p.ectx, expr, nil, true) }) @@ -603,7 +603,7 @@ func (p *parser) resolveBlockNames(block *hcl.Block) ([]string, error) { return nil, err } - if v, ok := val.Interface().(WithGetName); ok { + if v, ok := reflect.TypeAssert[WithGetName](val); ok { var err error name, err = v.GetName(ectx, block, func(expr hcl.Expression) hcl.Diagnostics { return p.loadDeps(ectx, expr, nil, true) @@ -952,7 +952,7 @@ func Parse(b hcl.Body, opt Opt, val any) (*ParseMeta, hcl.Diagnostics) { vvs := p.blockValues[b] for _, vv := range vvs { - if v, ok := vv.Interface().(WithBlockSource); ok { + if v, ok := reflect.TypeAssert[WithBlockSource](vv); ok { v.SetBlockSource(b) } diff --git a/bake/hclparser/type_implied.go b/bake/hclparser/type_implied.go index 6ed6d9ad77fd..7e98007e41dd 100644 --- a/bake/hclparser/type_implied.go +++ b/bake/hclparser/type_implied.go @@ -55,7 +55,7 @@ func impliedType(rt reflect.Type, path cty.Path) (cty.Type, error) { } switch rt.Kind() { - case reflect.Ptr: + case reflect.Pointer: return impliedType(rt.Elem(), path) // Primitive types diff --git a/build/build.go b/build/build.go index 27714f5848d6..9baa8973511a 100644 --- a/build/build.go +++ b/build/build.go @@ -304,9 +304,9 @@ func warnOnNoOutput(nodes []builder.Node, opts map[string]Options, reqForNodes m var warnNoOutputBuf bytes.Buffer warnNoOutputBuf.WriteString("No output specified ") if len(noOutputTargets) == 1 && noOutputTargets[0] == "default" { - warnNoOutputBuf.WriteString(fmt.Sprintf("with %s driver", noMobyDriver.Factory().Name())) + fmt.Fprintf(&warnNoOutputBuf, "with %s driver", noMobyDriver.Factory().Name()) } else { - warnNoOutputBuf.WriteString(fmt.Sprintf("for %s target(s) with %s driver", strings.Join(noOutputTargets, ", "), noMobyDriver.Factory().Name())) + fmt.Fprintf(&warnNoOutputBuf, "for %s target(s) with %s driver", strings.Join(noOutputTargets, ", "), noMobyDriver.Factory().Name()) } logrus.Warnf("%s. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load", warnNoOutputBuf.String()) } @@ -592,8 +592,7 @@ func (e targetAbortError) Unwrap() error { func wrapResultError(results map[string]any, msg string) error { if err := resultError(results); err != nil { - var abortErr targetAbortError - if stderrors.As(err, &abortErr) { + if _, ok := stderrors.AsType[targetAbortError](err); ok { return err } return targetAbortError{errors.Wrap(err, msg)} @@ -1637,7 +1636,7 @@ func ReadSourcePolicy() (*spb.Policy, error) { return nil, nil } - data, err := os.ReadFile(p) + data, err := os.ReadFile(p) // #nosec G703 -- the caller intentionally selects the local policy file if err != nil { return nil, errors.Wrap(err, "failed to read policy file") } diff --git a/build/opt_test.go b/build/opt_test.go index 6cf9cdea6389..e618d32fae23 100644 --- a/build/opt_test.go +++ b/build/opt_test.go @@ -280,7 +280,7 @@ func TestCacheOptions_DerivedVars(t *testing.T) { }, { Type: "s3", - Attrs: map[string]string{ + Attrs: map[string]string{ // #nosec G101 -- dummy credentials for the cache option test "region": "us-west-2", "bucket": "my_bucket", "name": "my_image", diff --git a/cmd/buildx/debug.go b/cmd/buildx/debug.go index 49766c686307..fce0fedd1ee2 100644 --- a/cmd/buildx/debug.go +++ b/cmd/buildx/debug.go @@ -27,7 +27,7 @@ func setupDebugProfiles(ctx context.Context) (stop func()) { func setupCPUProfile(ctx context.Context) (stop func()) { if cpuProfile := os.Getenv("BUILDX_CPU_PROFILE"); cpuProfile != "" { - f, err := os.Create(cpuProfile) + f, err := os.Create(cpuProfile) // #nosec G703 -- the user selects the CPU profile output path if err != nil { bklog.G(ctx).Warn("could not create cpu profile", logrus.WithError(err)) return nil @@ -53,7 +53,7 @@ func setupHeapProfile(ctx context.Context) (stop func()) { if heapProfile := os.Getenv("BUILDX_MEM_PROFILE"); heapProfile != "" { // Memory profile is only created on stop. return func() { - f, err := os.Create(heapProfile) + f, err := os.Create(heapProfile) // #nosec G703 -- the user selects the heap profile output path if err != nil { bklog.G(ctx).Warn("could not create memory profile", logrus.WithError(err)) return diff --git a/commands/create.go b/commands/create.go index 0c8523549ea5..b971b14f2f9d 100644 --- a/commands/create.go +++ b/commands/create.go @@ -94,7 +94,7 @@ func createCmd(dockerCli command.Cli) *cobra.Command { if len(drivers.String()) > 0 { drivers.WriteString(", ") } - drivers.WriteString(fmt.Sprintf(`"%s"`, d.Name())) + fmt.Fprintf(&drivers, `"%s"`, d.Name()) } cmd := &cobra.Command{ diff --git a/commands/replay/build.go b/commands/replay/build.go index 3f51f7298751..c6adb4fa6f23 100644 --- a/commands/replay/build.go +++ b/commands/replay/build.go @@ -488,7 +488,7 @@ func filterSubjectsByPlatform(subjects []*replay.Subject, platformFilter []strin if !m.Match(sp) { continue } - if best < 0 || m.Less(sp, *subjects[best].Descriptor.Platform) { + if best < 0 || m.Less(sp, *subjects[best].Descriptor.Platform) { // #nosec G602 -- best is -1 (short-circuited) or an index from range subjects best = j } } diff --git a/docs/generate.go b/docs/generate.go index e4975ab09874..7ca5b883c877 100644 --- a/docs/generate.go +++ b/docs/generate.go @@ -166,7 +166,7 @@ func generateBakeStdlibDocs(filename string) error { } newContent := before + "\n\n" + table.String() + "\n" + currentContent[end:] - return os.WriteFile(filename, []byte(newContent), 0644) + return os.WriteFile(filename, []byte(newContent), 0644) // #nosec G703 -- the caller selects the documentation output file } type mdTable struct { diff --git a/driver/cloud/driver.go b/driver/cloud/driver.go index bde1fff09fe7..a8f62ecb223d 100644 --- a/driver/cloud/driver.go +++ b/driver/cloud/driver.go @@ -234,7 +234,7 @@ func (d *Driver) cloudPull(ctx context.Context, imageDescriptor string, platform RegistryToken: token, ServerAddress: hydroRegistryAddr, } - authJSON, err := json.Marshal(authConfig) + authJSON, err := json.Marshal(authConfig) // #nosec G117 -- the registry authentication API requires serialized credentials if err != nil { return err } diff --git a/driver/cloud/login.go b/driver/cloud/login.go index bed14b221a7c..ec1a64a66103 100644 --- a/driver/cloud/login.go +++ b/driver/cloud/login.go @@ -81,7 +81,7 @@ func fetchHubToken(ctx context.Context, registryHostname, hubHost string) (strin } payload.Identifier = username payload.Secret = secret - body, err := json.Marshal(payload) + body, err := json.Marshal(payload) // #nosec G117 -- the token endpoint requires credentials in the request body if err != nil { return "", errors.Wrap(err, "failed to marshal request body") } diff --git a/driver/docker-container/driver.go b/driver/docker-container/driver.go index 833dfc0f3cdc..a75af050597e 100644 --- a/driver/docker-container/driver.go +++ b/driver/docker-container/driver.go @@ -536,10 +536,10 @@ func (d *Driver) Client(ctx context.Context, opts ...client.ClientOpt) (*client. return nil, err } - var counter int64 + var counter atomic.Int64 opts = append([]client.ClientOpt{ client.WithContextDialer(func(ctx context.Context, _ string) (net.Conn, error) { - if atomic.AddInt64(&counter, 1) == 1 { + if counter.Add(1) == 1 { return conn, nil } return d.Dial(ctx) diff --git a/driver/kubernetes/driver.go b/driver/kubernetes/driver.go index e0206785e399..a92ae9652902 100644 --- a/driver/kubernetes/driver.go +++ b/driver/kubernetes/driver.go @@ -375,8 +375,7 @@ func isTransientConnectionError(err error) bool { } // Check for syscall errors (connection refused, connection reset) - var syscallErr syscall.Errno - if stderrors.As(err, &syscallErr) { + if syscallErr, ok := stderrors.AsType[syscall.Errno](err); ok { if syscallErr == syscall.ECONNREFUSED || syscallErr == syscall.ECONNRESET { return true } diff --git a/hack/dockerfiles/docs.Dockerfile b/hack/dockerfiles/docs.Dockerfile index c16a8b273fc2..8b9fc46954e9 100644 --- a/hack/dockerfiles/docs.Dockerfile +++ b/hack/dockerfiles/docs.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.26 +ARG GO_VERSION=1.27 ARG ALPINE_VERSION=3.23 ARG FORMATS=md,yaml diff --git a/hack/dockerfiles/govulncheck.Dockerfile b/hack/dockerfiles/govulncheck.Dockerfile index 8f1c6c46b575..b84cb95b68a3 100644 --- a/hack/dockerfiles/govulncheck.Dockerfile +++ b/hack/dockerfiles/govulncheck.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.26 +ARG GO_VERSION=1.27 ARG ALPINE_VERSION=3.23 ARG GOVULNCHECK_VERSION=v1.9.0 diff --git a/hack/dockerfiles/lint.Dockerfile b/hack/dockerfiles/lint.Dockerfile index dcd84016d931..045596caf92b 100644 --- a/hack/dockerfiles/lint.Dockerfile +++ b/hack/dockerfiles/lint.Dockerfile @@ -1,12 +1,12 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.26 +ARG GO_VERSION=1.27 ARG ALPINE_VERSION=3.23 ARG XX_VERSION=1.10.0 -ARG GOLANGCI_LINT_VERSION=v2.8.0 +ARG GOLANGCI_LINT_VERSION=v2.14.0 ARG GOLANGCI_FROM_SOURCE=true -ARG GOPLS_VERSION=v0.40.0 +ARG GOPLS_VERSION=v0.50.0 # GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable ARG GOPLS_ANALYZERS="embeddirective fillreturns infertypeargs maprange modernize nonewvars noresultvalues simplifycompositelit simplifyslice unusedparams yield" diff --git a/hack/dockerfiles/vendor.Dockerfile b/hack/dockerfiles/vendor.Dockerfile index 20aaef505612..6f84319e99be 100644 --- a/hack/dockerfiles/vendor.Dockerfile +++ b/hack/dockerfiles/vendor.Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1 -ARG GO_VERSION=1.26 +ARG GO_VERSION=1.27 ARG ALPINE_VERSION=3.23 ARG MODOUTDATED_VERSION=v0.9.0 diff --git a/localstate/migrate.go b/localstate/migrate.go index 1334e1de2c35..33f7f8d0e236 100644 --- a/localstate/migrate.go +++ b/localstate/migrate.go @@ -36,7 +36,7 @@ func (ls *LocalState) migration2() error { if info.IsDir() { return nil } - dt, err := os.ReadFile(path) + dt, err := os.ReadFile(path) // #nosec G122 -- migration reads the user's private Buildx state directory if err != nil { return err } @@ -48,7 +48,7 @@ func (ls *LocalState) migration2() error { if err != nil { return err } - if err := os.WriteFile(path, mdt, 0600); err != nil { + if err := os.WriteFile(path, mdt, 0600); err != nil { // #nosec G122 -- migration updates the user's private Buildx state directory return err } return nil diff --git a/policy/validate_test.go b/policy/validate_test.go index fca4df9be77c..6f159e6761c2 100644 --- a/policy/validate_test.go +++ b/policy/validate_test.go @@ -143,11 +143,11 @@ func TestSourceToInputSingleSource(t *testing.T) { { name: "http-mixed-case-scheme-and-host", src: &gwpb.ResolveSourceMetaResponse{ - Source: &pb.SourceOp{Identifier: "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag"}, + Source: &pb.SourceOp{Identifier: "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag"}, // #nosec G101 -- dummy credentials exercise URL normalization }, expInput: Input{ HTTP: &HTTP{ - URL: "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag", + URL: "hTtP://User:PaSs@eXaMpLe.CoM:00080/Case/Path?Key=VaLuE#Frag", // #nosec G101 -- expected normalized URL retains the dummy credentials Schema: "http", Host: "example.com", Path: "/Case/Path", diff --git a/store/store.go b/store/store.go index d27fda623da6..949a4ab78f16 100644 --- a/store/store.go +++ b/store/store.go @@ -43,10 +43,10 @@ func (s *Store) Txn() (*Txn, func(), error) { return nil, nil, err } return &Txn{ - s: s, - }, func() { - l.Close() - }, nil + s: s, + }, func() { + l.Close() + }, nil } type Txn struct { @@ -84,7 +84,7 @@ func (t *Txn) NodeGroupByName(name string) (*NodeGroup, error) { if err != nil { return nil, err } - dt, err := os.ReadFile(filepath.Join(t.s.cfg.Dir(), instanceDir, name)) + dt, err := os.ReadFile(filepath.Join(t.s.cfg.Dir(), instanceDir, name)) // #nosec G703 -- ValidateName rejects path separators before this read if err != nil { return nil, err } diff --git a/util/desktop/desktop.go b/util/desktop/desktop.go index 8f01ba4b73d2..7bc91386971f 100644 --- a/util/desktop/desktop.go +++ b/util/desktop/desktop.go @@ -41,7 +41,7 @@ func BuildDetailsOutput(refs map[string]string, term bool) string { multiTargets := len(refs) > 1 for target, ref := range refs { if multiTargets { - out.WriteString(fmt.Sprintf("\n %s: ", target)) + fmt.Fprintf(&out, "\n %s: ", target) } if term { url := BuildURL(ref) diff --git a/util/ghutil/ghutil.go b/util/ghutil/ghutil.go index e1ca13bfb1cf..a6c168fcef18 100644 --- a/util/ghutil/ghutil.go +++ b/util/ghutil/ghutil.go @@ -30,7 +30,7 @@ func GithubActionsContext() ([]byte, error) { // "GITHUB_EVENT_NAME": "push" // "GITHUB_EVENT_PATH": "/home/runner/work/_temp/_github_workflow/event.json" m["github_event_name"] = githubEventName - dt, err := os.ReadFile(githubEventPath) + dt, err := os.ReadFile(githubEventPath) // #nosec G703 -- GITHUB_EVENT_PATH intentionally selects the workflow event file if err != nil { return nil, errors.Wrapf(err, "failed to read GITHUB_EVENT_PATH %q", githubEventPath) } diff --git a/util/imagetools/auth.go b/util/imagetools/auth.go index f33c9b2c99c2..97d7de048125 100644 --- a/util/imagetools/auth.go +++ b/util/imagetools/auth.go @@ -34,7 +34,7 @@ func RegistryAuthForRef(ref string, auth authprovider.AuthConfigProvider) (strin if err != nil { return "", err } - buf, err := json.Marshal(ac) + buf, err := json.Marshal(ac) // #nosec G117 -- the registry authentication API requires serialized credentials if err != nil { return "", err }