upgrade to go1.19

.github/workflows/build.yml

@@ -49,7 +49,7 @@ jobs:
 
       - uses: imjasonh/setup-ko@78eea08f10db87a7a23a666a4a6fe2734f2eeb8d # v0.4
         with:
-          version: v0.11.2
+          version: v0.12.0
 
       - name: Set up Cloud SDK
         uses: google-github-actions/auth@dac4e13deb3640f22e3ffe758fd3f95e6e89f712 # v0.8.1

.github/workflows/main.yml

@@ -35,6 +35,7 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - name: Build
         run: make -C $GITHUB_WORKSPACE all
       - name: Fuzz-Build
@@ -55,9 +56,10 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - uses: imjasonh/setup-ko@78eea08f10db87a7a23a666a4a6fe2734f2eeb8d # v0.4
         with:
-          version: v0.11.2
+          version: v0.12.0
       - name: container
         run: |
           make ko-local 2>&1 | tee output.txt
@@ -78,6 +80,7 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - name: CLI
         run: ./tests/e2e-test.sh
       - name: Upload logs if they exist
@@ -102,6 +105,7 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - name: Sharding Test
         run: ./tests/sharding-e2e-test.sh
       - name: Upload logs if they exist
@@ -124,6 +128,7 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - name: Test for Attestation begin returned that was previously persisted in tlog
         run: ./tests/issue-872-e2e-test.sh
       - name: Upload logs if they exist
@@ -137,19 +142,20 @@ jobs:
     runs-on: ubuntu-20.04
     needs: build
     steps:
-    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
-    - name: Create git branch
-      run: git switch -c harness-test-branch
-    - name: Extract version of Go to use
-      run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
-    - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
-      with:
-        go-version: ${{ env.GOVERSION }}
-    - name: Run test harness
-      run: ./tests/rekor-harness.sh
-    - name: Upload logs if they exist
-      uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3
-      if: failure()
-      with:
-        name: E2E Docker Compose logs
-        path: /tmp/docker-compose.log
+      - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
+      - name: Create git branch
+        run: git switch -c harness-test-branch
+      - name: Extract version of Go to use
+        run: echo "GOVERSION=$(cat Dockerfile|grep golang | awk ' { print $2 } ' | cut -d '@' -f 1 | cut -d ':' -f 2 | uniq)" >> $GITHUB_ENV
+      - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
+        with:
+          go-version: ${{ env.GOVERSION }}
+
+      - name: Run test harness
+        run: ./tests/rekor-harness.sh
+      - name: Upload logs if they exist
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3
+        if: failure()
+        with:
+          name: E2E Docker Compose logs
+          path: /tmp/docker-compose.log

.github/workflows/validate-release.yml

@@ -39,8 +39,8 @@ jobs:
       statuses: none
 
     env:
-      CROSS_BUILDER_IMAGE: ghcr.io/gythialy/golang-cross:v1.18.5-1@sha256:7dda2158ee68f0e4f53ca9bdf3971b2db01084dad4bdc775391e5f3bf40056a5
-      COSIGN_IMAGE: gcr.io/projectsigstore/cosign:v1.10.1@sha256:9377edd13ae515dcb97c15052e577a2cbce098f36b0361bdb2348e3bdd8fe536
+      CROSS_BUILDER_IMAGE: ghcr.io/gythialy/golang-cross:v1.19.0-0@sha256:904f22549b631c34c92fa696aa39144f8b5da3ee1dff095d4e3164fd50090767
+      COSIGN_IMAGE: gcr.io/projectsigstore/cosign:v1.11.1@sha256:f9fd5a287a67f4b955d08062a966df10f9a600b6b8583fd367bce3f1f000a429
 
     steps:
       - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2
@@ -49,6 +49,7 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - uses: anchore/sbom-action/download-syft@b5042e9d19d8b32849779bfe17673ff84aec702d # v0.12.0
       - name: Install GoReleaser
         uses: goreleaser/goreleaser-action@ff11ca24a9b39f2d36796d1fbd7a4e39c182630a # v3.1.0

.github/workflows/verify.yml

@@ -15,7 +15,11 @@
 
 name: Verify
 
-on: [push, pull_request]
+on:
+  push:
+    branches:
+      - main
+  pull_request:
 
 permissions:
   contents: read
@@ -31,6 +35,7 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - name: Install addlicense
         run: go install github.com/google/addlicense@v1.0.0
       - name: Check license headers
@@ -49,8 +54,9 @@ jobs:
       - uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # v3.1.0
         with:
           go-version: ${{ env.GOVERSION }}
+
       - name: golangci-lint
         uses: golangci/golangci-lint-action@537aa1903e5d359d0b27dbc19ddd22c5087f3fbc # v3.2.0
         timeout-minutes: 5
         with:
-          version: v1.46.0
+          version: v1.49

.golangci.yml

@@ -15,13 +15,13 @@
 
 linters:
   enable:
-  - deadcode
+  - unused
   - errcheck
   - gofmt
   - goimports
   - gosec
   - gocritic
-  - golint
+  - revive
   - misspell
 output:
   uniq-by-line: false

Dockerfile

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.18.5@sha256:fb249eca1b9172732de4950b0fb0fb5c231b83c2c90952c56d822d8a9de4d64b AS builder
+FROM golang:1.19@sha256:d3f734e1f46ec36da8c1bce67cd48536138085289e24cfc8765f483c401b7d96 AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -30,7 +30,7 @@ RUN go build -ldflags "${SERVER_LDFLAGS}" ./cmd/rekor-server
 RUN CGO_ENABLED=0 go build -gcflags "all=-N -l" -ldflags "${SERVER_LDFLAGS}" -o rekor-server_debug ./cmd/rekor-server
 
 # Multi-Stage production build
-FROM golang:1.18.5@sha256:fb249eca1b9172732de4950b0fb0fb5c231b83c2c90952c56d822d8a9de4d64b as deploy
+FROM golang:1.19@sha256:d3f734e1f46ec36da8c1bce67cd48536138085289e24cfc8765f483c401b7d96 as deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/rekor-server /usr/local/bin/rekor-server

cmd/rekor-cli/app/pflags_test.go

@@ -18,9 +18,9 @@ package app
 import (
 	"context"
 	"errors"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/spf13/cobra"
@@ -54,27 +54,27 @@ func TestArtifactPFlags(t *testing.T) {
 
 			switch r.URL.Path {
 			case "/artifact":
-				file, err = ioutil.ReadFile("../../../tests/test_file.txt")
+				file, err = os.ReadFile("../../../tests/test_file.txt")
 			case "/signature":
-				file, err = ioutil.ReadFile("../../../tests/test_file.sig")
+				file, err = os.ReadFile("../../../tests/test_file.sig")
 			case "/publicKey":
-				file, err = ioutil.ReadFile("../../../tests/test_public_key.key")
+				file, err = os.ReadFile("../../../tests/test_public_key.key")
 			case "/rekord":
-				file, err = ioutil.ReadFile("../../../tests/rekor.json")
+				file, err = os.ReadFile("../../../tests/rekor.json")
 			case "/rpmEntry":
-				file, err = ioutil.ReadFile("../../../tests/rpm.json")
+				file, err = os.ReadFile("../../../tests/rpm.json")
 			case "/rpm":
-				file, err = ioutil.ReadFile("../../../tests/test.rpm")
+				file, err = os.ReadFile("../../../tests/test.rpm")
 			case "/rpmPublicKey":
-				file, err = ioutil.ReadFile("../../../tests/test_rpm_public_key.key")
+				file, err = os.ReadFile("../../../tests/test_rpm_public_key.key")
 			case "/alpine":
-				file, err = ioutil.ReadFile("../../../tests/test_alpine.apk")
+				file, err = os.ReadFile("../../../tests/test_alpine.apk")
 			case "/alpinePublicKey":
-				file, err = ioutil.ReadFile("../../../tests/test_alpine.pub")
+				file, err = os.ReadFile("../../../tests/test_alpine.pub")
 			case "/alpineEntry":
-				file, err = ioutil.ReadFile("../../../tests/alpine.json")
+				file, err = os.ReadFile("../../../tests/alpine.json")
 			case "/helmEntry":
-				file, err = ioutil.ReadFile("../../../tests/helm.json")
+				file, err = os.ReadFile("../../../tests/helm.json")
 			case "/not_found":
 				err = errors.New("file not found")
 			}
@@ -524,9 +524,9 @@ func TestSearchPFlags(t *testing.T) {
 
 			switch r.URL.Path {
 			case "/artifact":
-				file, err = ioutil.ReadFile("../../../tests/test_file.txt")
+				file, err = os.ReadFile("../../../tests/test_file.txt")
 			case "/publicKey":
-				file, err = ioutil.ReadFile("../../../tests/test_public_key.key")
+				file, err = os.ReadFile("../../../tests/test_public_key.key")
 			case "/not_found":
 				err = errors.New("file not found")
 			}

cmd/rekor-cli/app/search.go

@@ -21,7 +21,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -136,7 +135,7 @@ var searchCmd = &cobra.Command{
 
 				tee = io.TeeReader(file, hasher)
 			}
-			if _, err := ioutil.ReadAll(tee); err != nil {
+			if _, err := io.ReadAll(tee); err != nil {
 				return nil, fmt.Errorf("error processing '%v': %w", artifactStr, err)
 			}
 
@@ -170,7 +169,7 @@ var searchCmd = &cobra.Command{
 				if isURL(splitPubKeyString[0]) {
 					params.Query.PublicKey.URL = strfmt.URI(splitPubKeyString[0])
 				} else {
-					keyBytes, err := ioutil.ReadFile(filepath.Clean(splitPubKeyString[0]))
+					keyBytes, err := os.ReadFile(filepath.Clean(splitPubKeyString[0]))
 					if err != nil {
 						return nil, fmt.Errorf("error reading public key file: %w", err)
 					}

cmd/rekor-cli/app/state/state.go

@@ -17,7 +17,6 @@ package state
 
 import (
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -44,7 +43,7 @@ func Dump(key string, sth *util.SignedCheckpoint) error {
 	if err != nil {
 		return err
 	}
-	if err := ioutil.WriteFile(statePath, b, 0600); err != nil {
+	if err := os.WriteFile(statePath, b, 0600); err != nil {
 		return err
 	}
 	return nil
@@ -56,7 +55,7 @@ func loadStateFile() persistedState {
 		return nil
 	}
 	fp := filepath.Join(rekorDir, "state.json")
-	b, err := ioutil.ReadFile(filepath.Clean(fp))
+	b, err := os.ReadFile(filepath.Clean(fp))
 	if err != nil {
 		return nil
 	}

cmd/rekor-server/app/root.go

@@ -20,6 +20,7 @@ import (
 	"net/http"
 	"net/http/pprof"
 	"os"
+	"time"
 
 	homedir "github.com/mitchellh/go-homedir"
 	"github.com/sigstore/rekor/pkg/log"
@@ -100,7 +101,14 @@ func init() {
 			mux.HandleFunc("/debug/pprof/{action}", pprof.Index)
 			mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
 
-			if err := http.ListenAndServe(":6060", mux); err != nil && err != http.ErrServerClosed {
+			srv := &http.Server{
+				Addr:         ":6060",
+				ReadTimeout:  10 * time.Second,
+				WriteTimeout: 10 * time.Second,
+				Handler:      mux,
+			}
+
+			if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
 				log.Logger.Fatalf("Error when starting or running http server: %v", err)
 			}
 		}()

cmd/rekor-server/app/serve.go

@@ -18,6 +18,7 @@ package app
 import (
 	"flag"
 	"net/http"
+	"time"
 
 	"github.com/go-openapi/loads"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -114,7 +115,12 @@ var serveCmd = &cobra.Command{
 
 		http.Handle("/metrics", promhttp.Handler())
 		go func() {
-			_ = http.ListenAndServe(":2112", nil)
+			srv := &http.Server{
+				Addr:         ":2112",
+				ReadTimeout:  10 * time.Second,
+				WriteTimeout: 10 * time.Second,
+			}
+			_ = srv.ListenAndServe()
 		}()
 
 		if err := server.Serve(); err != nil {