More linting coverage (#4213)

* Remove explicit staticcheck and unused linter enables

They are enabled by default. For consistency, do not list them like
others that are enabled by default (for example govet) are not
explicitly listed either.

Signed-off-by: Ville Skyttä <[email protected]>

* Enable makezero and nilnesserr linters

There are no findings from either at the moment, but they serve useful
purposes.

Signed-off-by: Ville Skyttä <[email protected]>

* Ensure closing of TSA response body, enable bodyclose linter

This was flagged by bodyclose.

Signed-off-by: Ville Skyttä <[email protected]>

* Vet internal ui.Infof/Warnf uses

Signed-off-by: Ville Skyttä <[email protected]>

* Enable usestdlibvars linter, address findings

Signed-off-by: Ville Skyttä <[email protected]>

* test: update e2e rekor service count

#4213 (review)

Signed-off-by: Ville Skyttä <[email protected]>

* Update e2e_test.sh to handle different healthy service totals

Rekor has healthchecks for 5 services, Fulcio currently has healthchecks for 3.

Signed-off-by: Hayden B <[email protected]>

---------

Signed-off-by: Ville Skyttä <[email protected]>
Signed-off-by: Hayden B <[email protected]>
Co-authored-by: Hayden B <[email protected]>

Author: scop

.golangci.yml

@@ -19,19 +19,21 @@ run:
 linters:
   enable:
     - asciicheck
+    - bodyclose
     - errorlint
     - forbidigo
     - gocritic
     - gosec
     - importas
+    - makezero
     - misspell
+    - nilnesserr
     - prealloc
     - revive
-    - staticcheck
     - tparallel
     - unconvert
     - unparam
-    - unused
+    - usestdlibvars
     - whitespace
   settings:
     forbidigo:
@@ -45,6 +47,12 @@ linters:
     gosec:
       excludes:
         - G115 # integer overflow conversion int64 -> uint64
+    govet:
+      settings:
+        printf:
+          funcs:
+            - github.com/sigstore/cosign/v2/internal/ui.Infof
+            - github.com/sigstore/cosign/v2/internal/ui.Warnf
   exclusions:
     generated: lax
     presets:

cmd/cosign/cli/attach/attach.go

@@ -78,8 +78,7 @@ func attachAttestation(ctx context.Context, remoteOpts []ociremote.Option, signe
 			return err
 		}
 		if _, ok := ref.(name.Digest); !ok {
-			msg := fmt.Sprintf(ui.TagReferenceMessage, imageRef)
-			ui.Warnf(ctx, msg)
+			ui.Warnf(ctx, ui.TagReferenceMessage, imageRef)
 		}
 		digest, err := ociremote.ResolveDigest(ref, remoteOpts...)
 		if err != nil {

cmd/cosign/cli/clean.go

@@ -51,7 +51,7 @@ func Clean() *cobra.Command {
 
 func CleanCmd(ctx context.Context, regOpts options.RegistryOptions, cleanType options.CleanType, imageRef string, force bool) error {
 	if !force {
-		ui.Warnf(ctx, prompt(cleanType))
+		ui.Warnf(ctx, prompt(cleanType)) //nolint:govet // practically const
 		if err := ui.ConfirmContinue(ctx); err != nil {
 			return err
 		}

cmd/cosign/cli/sign/sign.go

@@ -122,8 +122,7 @@ func ParseOCIReference(ctx context.Context, refStr string, opts ...name.Option)
 		return nil, fmt.Errorf("parsing reference: %w", err)
 	}
 	if _, ok := ref.(name.Digest); !ok {
-		msg := fmt.Sprintf(ui.TagReferenceMessage, refStr)
-		ui.Warnf(ctx, msg)
+		ui.Warnf(ctx, ui.TagReferenceMessage, refStr)
 	}
 	return ref, nil
 }

cmd/cosign/cli/verify.go

@@ -152,7 +152,7 @@ against the transparency log.`,
 			defer cancel()
 
 			if o.CommonVerifyOptions.IgnoreTlog && !o.CommonVerifyOptions.PrivateInfrastructure {
-				ui.Warnf(ctx, fmt.Sprintf(ignoreTLogMessage, "signature"))
+				ui.Warnf(ctx, ignoreTLogMessage, "signature")
 			}
 
 			return v.Exec(ctx, args)
@@ -256,7 +256,7 @@ against the transparency log.`,
 			defer cancel()
 
 			if o.CommonVerifyOptions.IgnoreTlog && !o.CommonVerifyOptions.PrivateInfrastructure {
-				ui.Warnf(ctx, fmt.Sprintf(ignoreTLogMessage, "attestation"))
+				ui.Warnf(ctx, ignoreTLogMessage, "attestation")
 			}
 
 			return v.Exec(ctx, args)
@@ -363,7 +363,7 @@ The blob may be specified as a path to a file or - for stdin.`,
 			defer cancel()
 
 			if o.CommonVerifyOptions.IgnoreTlog && !o.CommonVerifyOptions.PrivateInfrastructure {
-				ui.Warnf(ctx, fmt.Sprintf(ignoreTLogMessage, "blob"))
+				ui.Warnf(ctx, ignoreTLogMessage, "blob")
 			}
 
 			return verifyBlobCmd.Exec(ctx, args[0])
@@ -444,7 +444,7 @@ The blob may be specified as a path to a file.`,
 			defer cancel()
 
 			if o.CommonVerifyOptions.IgnoreTlog && !o.CommonVerifyOptions.PrivateInfrastructure {
-				ui.Warnf(ctx, fmt.Sprintf(ignoreTLogMessage, "blob attestation"))
+				ui.Warnf(ctx, ignoreTLogMessage, "blob attestation")
 			}
 
 			return v.Exec(ctx, path)

internal/pkg/cosign/tsa/client/client.go

@@ -130,7 +130,7 @@ func (t *TimestampAuthorityClientImpl) GetTimestampResponse(tsq []byte) ([]byte,
 		client.Transport = tr
 	}
 
-	req, err := http.NewRequest("POST", t.URL, bytes.NewReader(tsq))
+	req, err := http.NewRequest(http.MethodPost, t.URL, bytes.NewReader(tsq))
 	if err != nil {
 		return nil, fmt.Errorf("error creating HTTP request: %w", err)
 	}
@@ -140,7 +140,8 @@ func (t *TimestampAuthorityClientImpl) GetTimestampResponse(tsq []byte) ([]byte,
 	if err != nil {
 		return nil, fmt.Errorf("error making request to timestamp authority: %w", err)
 	}
-	if tsr.StatusCode != 200 && tsr.StatusCode != 201 {
+	defer tsr.Body.Close()
+	if tsr.StatusCode != http.StatusOK && tsr.StatusCode != http.StatusCreated {
 		return nil, fmt.Errorf("request to timestamp authority failed with status code %d", tsr.StatusCode)
 	}
 

pkg/providers/github/github.go

@@ -58,7 +58,7 @@ func (ga *githubActions) Enabled(_ context.Context) bool {
 func (ga *githubActions) Provide(ctx context.Context, audience string) (string, error) {
 	url := env.Getenv(env.VariableGitHubRequestURL) + "&audience=" + audience
 
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
 		return "", err
 	}

test/e2e_test.sh

@@ -70,8 +70,16 @@ for repo in rekor fulcio; do
     fi
     ${docker_compose} up -d
     echo -n "waiting up to 60 sec for system to start"
+    if [ "$repo" == "fulcio" ]; then
+      healthytotal=3
+    elif [ "$repo" == "rekor" ]; then
+      healthytotal=5
+    else
+      # handle no match in case another service is added
+      healthytotal=0
+    fi
     count=0
-    until [ $(${docker_compose} ps | grep -c "(healthy)") == 3 ];
+    until [ $(${docker_compose} ps | grep -c "(healthy)") == $healthytotal ];
     do
         if [ $count -eq 18 ]; then
            echo "! timeout reached"