go: Fix linter errors exposed by golangci-lint 1.28.2

go/common/crypto/tls/cert.go

@@ -146,7 +146,7 @@ func Save(certPath, keyPath string, cert *tls.Certificate) error {
 		return fmt.Errorf("tls: failed to write private key: %w", err)
 	}
 
-	if err = ioutil.WriteFile(certPath, certPEM, 0o644); err != nil {
+	if err = ioutil.WriteFile(certPath, certPEM, 0o644); err != nil { // nolint: gosec
 		return fmt.Errorf("tls: failed to write certificate: %w", err)
 	}
 

go/consensus/tendermint/apps/roothash/transactions.go

@@ -125,7 +125,7 @@ func (app *rootHashApplication) executorCommit(
 	pools := make(map[*commitment.Pool]bool)
 	for _, commit := range cc.Commits {
 		var pool *commitment.Pool
-		if pool, err = rtState.Round.AddExecutorCommitment(ctx, &commit, sv, nl); err != nil {
+		if pool, err = rtState.Round.AddExecutorCommitment(ctx, &commit, sv, nl); err != nil { // nolint: gosec
 			ctx.Logger().Error("failed to add compute commitment to round",
 				"err", err,
 				"round", rtState.CurrentBlock.Header.Round,
@@ -192,7 +192,7 @@ func (app *rootHashApplication) mergeCommit(
 
 	// Add commitments.
 	for _, commit := range mc.Commits {
-		if err = rtState.Round.AddMergeCommitment(ctx, &commit, sv, nl); err != nil {
+		if err = rtState.Round.AddMergeCommitment(ctx, &commit, sv, nl); err != nil { // nolint: gosec
 			ctx.Logger().Error("failed to add merge commitment to round",
 				"err", err,
 				"round", rtState.CurrentBlock.Header.Round,

go/consensus/tendermint/apps/staking/state/state.go

@@ -757,9 +757,9 @@ func (s *MutableState) AddRewards(
 		return err
 	}
 	var activeStep *staking.RewardStep
-	for _, step := range steps {
+	for i, step := range steps {
 		if time < step.Until {
-			activeStep = &step
+			activeStep = &steps[i]
 			break
 		}
 	}
@@ -873,9 +873,9 @@ func (s *MutableState) AddRewardSingleAttenuated(
 		return fmt.Errorf("failed to query reward schedule: %w", err)
 	}
 	var activeStep *staking.RewardStep
-	for _, step := range steps {
+	for i, step := range steps {
 		if time < step.Until {
-			activeStep = &step
+			activeStep = &steps[i]
 			break
 		}
 	}

go/oasis-node/cmd/keymanager/keymanager.go

@@ -102,7 +102,7 @@ func doInitPolicy(cmd *cobra.Command, args []string) {
 	}
 
 	c := cbor.Marshal(p)
-	if err = ioutil.WriteFile(viper.GetString(CfgPolicyFile), c, 0o666); err != nil {
+	if err = ioutil.WriteFile(viper.GetString(CfgPolicyFile), c, 0o644); err != nil { // nolint: gosec
 		logger.Error("failed to write key manager policy cbor file",
 			"err", err,
 			"CfgPolicyFile", viper.GetString(CfgPolicyFile),
@@ -372,7 +372,7 @@ func doInitStatus(cmd *cobra.Command, args []string) {
 	}
 
 	c, _ := json.Marshal(s)
-	if err = ioutil.WriteFile(viper.GetString(CfgStatusFile), c, 0o666); err != nil {
+	if err = ioutil.WriteFile(viper.GetString(CfgStatusFile), c, 0o644); err != nil { // nolint: gosec
 		logger.Error("failed to write key manager status json file",
 			"err", err,
 			"CfgStatusFile", viper.GetString(CfgStatusFile),

go/oasis-node/cmd/registry/runtime/runtime.go

@@ -220,7 +220,7 @@ func doList(cmd *cobra.Command, args []string) {
 		var s string
 		switch cmdFlags.Verbose() {
 		case true:
-			b, _ := json.Marshal(&rt)
+			b, _ := json.Marshal(rt)
 			s = string(b)
 		default:
 			s = rt.ID.String()

go/oasis-test-runner/env/env.go

@@ -239,7 +239,7 @@ func (env *Env) WriteTestInfo() error {
 	if err != nil {
 		return err
 	}
-	if err = ioutil.WriteFile(filepath.Join(env.Dir(), "test_info.json"), b, 0o644); err != nil {
+	if err = ioutil.WriteFile(filepath.Join(env.Dir(), "test_info.json"), b, 0o644); err != nil { // nolint: gosec
 		return err
 	}
 

go/oasis-test-runner/oasis/fixture.go

@@ -46,7 +46,7 @@ func (f *NetworkFixture) Create(env *env.Env) (*Network, error) {
 
 	// Provision entities.
 	for _, entCfg := range f.Entities {
-		if _, err = net.NewEntity(&entCfg); err != nil {
+		if _, err = net.NewEntity(&entCfg); err != nil { // nolint: gosec
 			return nil, fmt.Errorf("failed to provision entity: %w", err)
 		}
 	}

go/registry/api/sanity_check.go

@@ -323,7 +323,7 @@ func SanityCheckStake(
 				}
 				for i, expectedThreshold := range expectedThresholds {
 					threshold := thresholds[i]
-					if !threshold.Equal(&expectedThreshold) {
+					if !threshold.Equal(&expectedThreshold) { // nolint: gosec
 						return fmt.Errorf("incorrect threshold in position %d for claim %s for account %s (expected: %s got: %s)",
 							i,
 							claim,

go/runtime/host/protocol/connection.go

@@ -380,15 +380,14 @@ func (c *connection) handleMessage(ctx context.Context, message *Message) {
 		}
 
 		// Import runtime-provided span.
-		span := opentracing.SpanFromContext(ctx)
 		if len(message.SpanContext) != 0 {
 			sc, err := tracing.SpanContextFromBinary(message.SpanContext)
 			if err != nil {
 				c.logger.Error("error while unmarshalling span context",
 					"err", err,
 				)
 			} else {
-				span = opentracing.StartSpan("RHP", opentracingExt.RPCServerOption(sc))
+				span := opentracing.StartSpan("RHP", opentracingExt.RPCServerOption(sc))
 				defer span.Finish()
 
 				ctx = opentracing.ContextWithSpan(ctx, span)

go/runtime/transaction/transaction.go

@@ -358,7 +358,7 @@ func (t *Tree) GetTransactionMultiple(ctx context.Context, txHashes []hash.Hash)
 	// don't need to do multiple round trips.
 	var keys [][]byte
 	for _, txHash := range txHashes {
-		keys = append(keys, txnKeyFmt.Encode(&txHash))
+		keys = append(keys, txnKeyFmt.Encode(&txHash)) // nolint: gosec
 	}
 	if err := t.tree.PrefetchPrefixes(ctx, keys, prefetchArtifactCount); err != nil {
 		return nil, fmt.Errorf("transaction: prefetch failed: %w", err)

go/runtime/transaction/transaction_test.go

@@ -78,7 +78,7 @@ func TestTransaction(t *testing.T) {
 
 	for _, checkTx := range testTxns {
 		require.Contains(t, txnsByHash, checkTx.Hash(), "transaction should exist")
-		require.True(t, txnsByHash[checkTx.Hash()].Equal(&checkTx), "transaction should have the correct artifacts")
+		require.True(t, txnsByHash[checkTx.Hash()].Equal(&checkTx), "transaction should have the correct artifacts") // nolint: gosec
 	}
 
 	// Fetching a single transaction should work.
@@ -150,6 +150,6 @@ func TestTransaction(t *testing.T) {
 
 	for _, checkTx := range testTxns {
 		require.Contains(t, txnsByHash, checkTx.Hash(), "transaction should exist")
-		require.True(t, txnsByHash[checkTx.Hash()].Equal(&checkTx), "transaction should have the correct artifacts")
+		require.True(t, txnsByHash[checkTx.Hash()].Equal(&checkTx), "transaction should have the correct artifacts") // nolint: gosec
 	}
 }

go/worker/common/config.go

@@ -238,7 +238,7 @@ func NewConfig(ias ias.Endpoint) (*Config, error) {
 func init() {
 	Flags.Uint16(CfgClientPort, 9100, "Port to use for incoming gRPC client connections")
 	Flags.StringSlice(cfgClientAddresses, []string{}, "Address/port(s) to use for client connections when registering this node (if not set, all non-loopback local interfaces will be used)")
-	Flags.StringSlice(CfgSentryAddresses, []string{}, fmt.Sprintf("Address(es) of sentry node(s) to connect to of the form [PubKey@]ip:port (where PubKey@ part represents base64 encoded node TLS public key)"))
+	Flags.StringSlice(CfgSentryAddresses, []string{}, "Address(es) of sentry node(s) to connect to of the form [PubKey@]ip:port (where PubKey@ part represents base64 encoded node TLS public key)")
 
 	Flags.String(CfgRuntimeProvisioner, RuntimeProvisionerSandboxed, "Runtime provisioner to use")
 	Flags.String(CfgRuntimeSGXLoader, "", "(for SGX runtimes) Path to SGXS runtime loader binary")

go/worker/common/p2p/p2p.go

@@ -96,6 +96,7 @@ func (p *P2P) Publish(ctx context.Context, runtimeID common.Namespace, msg *Mess
 		p.logger.Error("attempted to publish message for unknown runtime ID",
 			"runtime_id", runtimeID,
 		)
+		return
 	}
 
 	if err := h.topic.Publish(h.ctx, rawMsg); err != nil {