Updates consistently to go 1.16 (#133)

Before, depending on CI, one ran go 1.13 and the other 1.16. This
centralizes to 1.16 in efforts to remove differences between local and
CI runs (as well differences between CI). This is needed anyway for
future change.

Signed-off-by: Adrian Cole <adrian@tetrate.io>

.circleci/config.yml

@@ -17,7 +17,7 @@ version: 2.1
 executors:
   builder:
     docker:
-      - image: circleci/golang:1.15.6
+      - image: circleci/golang:1.16.2
       - image: registry:2
 
 jobs:

.github/workflows/commit.yaml

@@ -21,7 +21,7 @@ jobs:
     - name: "Install Go"
       uses: actions/setup-go@v2
       with:
-        go-version: '1.13.3'
+        go-version: '1.16.2'
 
     - name: "Init on first use"
       run: make init

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
       - name: "Set up Go"
         uses: actions/setup-go@v2
         with:
-          go-version: '1.13.3'
+          go-version: '1.16.2'
 
       - name: "Login into DockerHub"
         uses: azure/docker-login@v1
@@ -75,7 +75,7 @@ jobs:
     - name: "Install Go"
       uses: actions/setup-go@v2
       with:
-        go-version: '1.13.3'
+        go-version: '1.16.2'
 
     - name: "Build `e2e` binaries"
       run: make build/bin/linux/amd64/e2e build/bin/darwin/amd64/e2e

.gitignore

@@ -2,6 +2,7 @@ vendor
 dist
 /getenvoy
 /build/
+.idea
 
 # code generated by `github.com/rakyll/statik`
 statik.go

.golangci.yml

@@ -34,9 +34,9 @@ run:
   modules-download-mode: readonly
 
 linters:
-  enable: 
+  enable:
   - "bodyclose"
-  # - "depguard" broken in golangci-lint 1.17.1
+  - "depguard"
   - "dupl"
   - "goconst"
   - "gocritic"
@@ -46,17 +46,15 @@ linters:
   - "golint"
   - "gosec"
   - "gosimple"
-  - "interfacer"
   - "lll"
-  - "maligned"
   - "misspell"
   - "nakedret"
   - "prealloc"
   - "scopelint"
   - "unconvert"
   - "unparam"
-  
-  disable: 
+
+  disable:
   - "gochecknoinits"
   - "gochecknoglobals"
 
@@ -93,67 +91,30 @@ linters-settings:
   unparam:
     check-exported: false
   gocritic:
-    enabled-checks:
-      - appendCombine
-      - appendAssign
-      - assignOp
-      - argOrder
-      - badCond
+    enabled-checks:  # non-default checks we decided to also add
       - boolExprSimplify
       - builtinShadow
-      - captLocal
-      - caseOrder
-      - codegenComment
       - commentedOutCode
       - commentedOutImport
-      - defaultCaseOrder
-      - deprecatedComment
       - docStub
-      - dupArg
-      - dupBranchBody
-      - dupCase
-      - dupSubExpr
-      - elseif
       - emptyFallthrough
-      - equalFold
-      - flagDeref
-      - flagName
       - hexLiteral
-      - indexAlloc
       - initClause
       - methodExprCall
       - nilValReturn
       - octalLiteral
-      - offBy1
-      - rangeExprCopy
-      - regexpMust
-      - singleCaseSwitch
-      - sloppyLen
-      - stringXbytes
-      - switchTrue
       - typeAssertChain
-      - typeSwitchVar
       - typeUnparen
-      - underef
-      - unlambda
       - unnecessaryBlock
-      - unslice
-      - valSwap
       - weakCond
       - yodaStyleExpr
-      - commentFormatting
       - emptyStringTest
-      - exitAfterDefer
-      - ifElseChain
-      - hugeParam
       - importShadow
       - nestingReduce
       - paramTypeCombine
       - ptrToRefParam
-      - rangeValCopy
       - sloppyReassign
       - unlabelStmt
-      - wrapperFunc
 
     # Enable multiple checks by tags, run `GL_DEBUG=gocritic golangci-lint` run to see all tags and checks.
     # Empty list by default. See https://github.com/go-critic/go-critic#usage -> section "Tags".
@@ -180,7 +141,6 @@ issues:
         - errcheck
         - dupl
         - gosec
-        - maligned
 
     # Exclude lll issues for long lines with go:generate
     - linters:

ci/install-lint

@@ -4,7 +4,7 @@ set -e
 
 SHFMT_VERSION="3.1.1"
 LICENSER_VERSION="0.6.0"
-GOLANGCI_LINT_VERSION="1.18.0"
+GOLANGCI_LINT_VERSION="1.38.0"
 
 # Install shfmt
 wget -c https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64 -O - | sudo dd of=/usr/bin/shfmt && sudo chmod a+x /usr/bin/shfmt

go.mod

@@ -1,6 +1,6 @@
 module github.com/tetratelabs/getenvoy
 
-go 1.13
+go 1.16
 
 require (
 	bitbucket.org/creachadair/shell v0.0.6

go.sum

@@ -26,7 +26,6 @@ fortio.org/fortio v1.3.1/go.mod h1:Go0fRqoPJ1xy5JOWcS23jyF58byVZxFyEePYsGmCR0k=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-autorest v10.8.1+incompatible h1:u0jVQf+a6k6x8A+sT60l6EY9XZu+kHdnZVPAYqpVRo0=
 github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
@@ -51,7 +50,6 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v2.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/MakeNowJust/heredoc v0.0.0-20170808103936-bb23615498cd/go.mod h1:64YHyfSL2R96J44Nlwm39UHepQbyR5q10x7iYa1ks2E=
-github.com/Masterminds/semver v1.4.2 h1:WBLTQ37jOCzSLtXNdoo8bNM8876KhNqOKvrlGITgsTc=
 github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
@@ -106,11 +104,9 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bitly/go-simplejson v0.5.0 h1:6IH+V8/tVMab511d5bn4M7EwGXZf9Hj6i2xSwkNEM+Y=
 github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
 github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1 h1:pgAtgj+A31JBVtEHu2uHuEx0n+2ukqUJnS2vVe5pQNA=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
@@ -140,7 +136,6 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533 h1:8wZizuKuZVu5COB7EsBYxBQz8nRcXXn5d4Gt91eJLvU=
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
-github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd h1:qMd81Ts1T2OTKmB4acZcyKaMtRnY5Y44NuXGX2GFJ1w=
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f h1:tSNMc+rJDfmYntojat8lljbt1mgKNpTxUZJsSzJ9Y1s=
 github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
@@ -174,7 +169,6 @@ github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwc
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/cyphar/filepath-securejoin v0.2.2 h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
-github.com/d4l3k/messagediff v1.2.1 h1:ZcAIMYsUg0EAp9X+tt8/enBE/Q8Yd5kzPynLyKptt9U=
 github.com/d4l3k/messagediff v1.2.1/go.mod h1:Oozbb1TVXFac9FtSIxHBMnBCq2qeH/2KkEQxENCrlLo=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -413,7 +407,6 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgf
 github.com/grpc-ecosystem/grpc-gateway v1.3.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20171214222146-0e7658f8ee99 h1:bTRV2bQrg85E7ZeeyQfHX3GyfidLrNzVoyq7epx0bTw=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20171214222146-0e7658f8ee99/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
 github.com/hashicorp/consul v1.3.1 h1:bY7/Uo29Uq7+mHce4wgSHtAJSbeRl+4F7M+OHTuEeXI=
 github.com/hashicorp/consul v1.3.1/go.mod h1:mFrjN1mfidgJfYP1xrJCF+AfRhr6Eaqhb2+sfyn/OOI=
@@ -551,7 +544,6 @@ github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUb
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f h1:2+myh5ml7lgEU/51gbeLHfKGNfgEQQIWrlbdaOsidbQ=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
@@ -612,14 +604,12 @@ github.com/opencontainers/selinux v1.8.0 h1:+77ba4ar4jsCbL1GLbFL8fFM57w6suPfSS9P
 github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
 github.com/openshift/api v3.9.1-0.20191008181517-e4fd21196097+incompatible h1:CIa+Zv6vIPhJl5OHmKxVpnekHC54YYe49L9GLr7IxGI=
 github.com/openshift/api v3.9.1-0.20191008181517-e4fd21196097+incompatible/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
-github.com/opentracing/opentracing-go v1.0.2 h1:3jA2P6O1F9UOrWVpwrIo17pu01KWvNWg4X946/Y5Zwg=
 github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
 github.com/openzipkin/zipkin-go v0.1.7/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
 github.com/otiai10/copy v1.2.0 h1:HvG945u96iNadPoG2/Ja2+AUJeW5YuFQMixq9yirC+k=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
-github.com/otiai10/curr v1.0.0 h1:TJIWdbX0B+kpNagQrjgq8bCMrbhiuX73M2XwgtDMoOI=
 github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
 github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
 github.com/otiai10/mint v1.3.1 h1:BCmzIS3n71sGfHB5NMNDB3lHYPz8fWSkCAErHed//qc=
@@ -747,7 +737,6 @@ github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoH
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -763,9 +752,7 @@ github.com/tinylib/msgp v1.0.2/go.mod h1:+d+yLhGm8mzTaHzB+wgMYrodPfmZrzkirds8fDW
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c/go.mod h1:hzIxponao9Kjc7aWznkXaL4U4TWaDSs8zcsY4Ka08nM=
-github.com/uber/jaeger-client-go v0.0.0-20190228190846-ecf2d03a9e80 h1:nWzkj/LnVGFeaeXAAXq7AyH4BQP3678Lqj3y2fIaieg=
 github.com/uber/jaeger-client-go v0.0.0-20190228190846-ecf2d03a9e80/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
-github.com/uber/jaeger-lib v2.0.0+incompatible h1:iMSCV0rmXEogjNWPh2D0xk9YVKvrtGoHJNe9ebLu/pw=
 github.com/uber/jaeger-lib v2.0.0+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=

pkg/binary/envoy/config.go

@@ -97,7 +97,7 @@ func (r *Runtime) SaveConfig(name, config string) (string, error) {
 		return "", fmt.Errorf("Unable to create directory %q: %v", configDir, err)
 	}
 	filename := name + ".yaml"
-	err := ioutil.WriteFile(filepath.Join(configDir, filename), []byte(config), 0644)
+	err := ioutil.WriteFile(filepath.Join(configDir, filename), []byte(config), 0600)
 	if err != nil {
 		return "", fmt.Errorf("Cannot save config file %s: %s", filepath.Join(configDir, filename), err)
 	}

pkg/binary/envoy/controlplane/istio.tmpl.go

@@ -28,7 +28,7 @@ func writeIstioTemplate(path string) error {
 	if err := os.MkdirAll(filepath.Dir(path), os.ModePerm); err != nil {
 		return err
 	}
-	return ioutil.WriteFile(path, []byte(istioBootStrapTemplate), 0644)
+	return ioutil.WriteFile(path, []byte(istioBootStrapTemplate), 0600)
 }
 
 var istioBootStrapTemplate = `{

pkg/binary/envoy/debug/admin.go

@@ -68,6 +68,7 @@ func retrieveAdminAPIData(r binary.Runner) error {
 			multiErr = multierror.Append(multiErr, fmt.Errorf("received %v from /%v ", resp.StatusCode, path))
 			continue
 		}
+		// #nosec -> r.DebugStore() is allowed to be anywhere
 		f, err := os.OpenFile(filepath.Join(r.DebugStore(), file), os.O_CREATE|os.O_WRONLY, 0600)
 		if err != nil {
 			multiErr = multierror.Append(multiErr, err)

pkg/binary/envoy/debug/log_linux.go

@@ -66,6 +66,7 @@ func captureStderr(r binary.Runner) error {
 }
 
 func createLogFile(path string) (*os.File, error) {
+	// #nosec -> logs can be written anywhere
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0600)
 	if err != nil {
 		return nil, fmt.Errorf("unable to open file to write logs to %v: %v", path, err)

pkg/binary/envoy/debug/log_linux_test.go

@@ -37,7 +37,7 @@ func Test_capture(t *testing.T) {
 			if err != nil {
 				t.Errorf("error stating %v: %v", path, err)
 			}
-			if f.Size() < 1 {
+			if f != nil && f.Size() < 1 {
 				t.Errorf("file %v was empty", path)
 			}
 		}

pkg/binary/envoy/fetch.go

@@ -112,7 +112,7 @@ func fetchEnvoy(dst, src string) error {
 }
 
 func doDownload(dst, src string) (string, error) {
-	// #nosec -> src destination can be anywhere by design
+	// #nosec -> src can be anywhere by design
 	resp, err := transport.Get(src)
 	if err != nil {
 		return "", err
@@ -124,6 +124,7 @@ func doDownload(dst, src string) (string, error) {
 	}
 
 	tarball := filepath.Join(dst, "envoy.tar"+filepath.Ext(src))
+	// #nosec -> dst can be anywhere by design
 	f, err := os.OpenFile(tarball, os.O_CREATE|os.O_WRONLY, 0600)
 	if err != nil {
 		return "", err

pkg/cmd/extension/run/cmd_test.go

@@ -356,7 +356,7 @@ Run 'getenvoy extension run --help' for usage.
 
 		By("creating a non-executable file")
 		filePath := filepath.Join(tempDir, "envoy")
-		err = ioutil.WriteFile(filePath, []byte(`#!/bin/sh`), 0644)
+		err = ioutil.WriteFile(filePath, []byte(`#!/bin/sh`), 0600)
 		Expect(err).NotTo(HaveOccurred())
 
 		By("running command")
@@ -616,7 +616,7 @@ Run 'getenvoy extension run --help' for usage.
 				Expect(os.RemoveAll(tempDir)).To(Succeed())
 			}()
 			wasmFile := filepath.Join(tempDir, "extension.wasm")
-			err = ioutil.WriteFile(wasmFile, []byte{}, 0644)
+			err = ioutil.WriteFile(wasmFile, []byte{}, 0600)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("running command")
@@ -648,7 +648,7 @@ Run 'getenvoy extension run --help' for usage.
 				Expect(os.RemoveAll(tempDir)).To(Succeed())
 			}()
 			configFile := filepath.Join(tempDir, "config.json")
-			err = ioutil.WriteFile(configFile, []byte(`{"key2":"value2"}`), 0644)
+			err = ioutil.WriteFile(configFile, []byte(`{"key2":"value2"}`), 0600)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("running command")

pkg/extension/wasmimage/puller.go

@@ -40,8 +40,8 @@ func NewPuller(insecure, useHTTP bool) (*Puller, error) {
 
 	client.Transport = &http.Transport{
 		TLSClientConfig: &tls.Config{
-			// nolint:gosec this option is only enabled when the user specify the insecure flag.
-			InsecureSkipVerify: insecure,
+			// this option is only enabled when the user specify the insecure flag.
+			InsecureSkipVerify: insecure, // nolint:gosec
 		},
 	}
 
@@ -77,7 +77,7 @@ func (p *Puller) Pull(imageRef, imagePath string) (ocispec.Descriptor, error) {
 	}
 	manifest, image, _ := store.Get(layers[0])
 
-	if err := ioutil.WriteFile(imagePath, image, 0755); err != nil {
+	if err := ioutil.WriteFile(imagePath, image, 0600); err != nil {
 		return manifest, fmt.Errorf("failed to write image: %w", err)
 	}
 

pkg/extension/wasmimage/pusher.go

@@ -39,8 +39,8 @@ func NewPusher(insecure, useHTTP bool) (*Pusher, error) {
 	if insecure {
 		client.Transport = &http.Transport{
 			TLSClientConfig: &tls.Config{
-				// nolint:gosec this option is only enabled when the user specify the insecure flag.
-				InsecureSkipVerify: true,
+				// this option is only enabled when the user specify the insecure flag.
+				InsecureSkipVerify: true, // nolint:gosec
 			},
 		}
 	}

pkg/extension/workspace/example/runtime/configdir/configdir.go

@@ -194,7 +194,7 @@ func (d *configDir) writeFile(fileName string, data []byte) error {
 	if err := osutil.EnsureDirExists(filepath.Dir(outputFile)); err != nil {
 		return err
 	}
-	if err := ioutil.WriteFile(outputFile, data, 0644); err != nil {
+	if err := ioutil.WriteFile(outputFile, data, 0600); err != nil {
 		return errors.Wrapf(err, "failed to write config file to %q", outputFile)
 	}
 	return nil

pkg/extension/workspace/fs/types.go

@@ -57,7 +57,7 @@ func (d workspaceDir) WriteFile(path string, data []byte) error {
 	if err := osutil.EnsureDirExists(filepath.Dir(path)); err != nil {
 		return err
 	}
-	return ioutil.WriteFile(path, data, 0644)
+	return ioutil.WriteFile(path, data, 0600)
 }
 
 func (d workspaceDir) HasDir(path string) (bool, error) {