Updates consistently to go 1.16

.circleci/config.yml

@@ -17,7 +17,7 @@ version: 2.1
 executors:
   builder:
     docker:
-      - image: circleci/golang:1.15.6
+      - image: circleci/golang:1.16.2
       - image: registry:2
 
 jobs:

.github/workflows/commit.yaml

@@ -21,7 +21,7 @@ jobs:
     - name: "Install Go"
       uses: actions/setup-go@v2
       with:
-        go-version: '1.13.3'
+        go-version: '1.16.2'
 
     - name: "Init on first use"
       run: make init

.github/workflows/release.yaml

@@ -21,7 +21,7 @@ jobs:
       - name: "Set up Go"
         uses: actions/setup-go@v2
         with:
-          go-version: '1.13.3'
+          go-version: '1.16.2'
 
       - name: "Login into DockerHub"
         uses: azure/docker-login@v1
@@ -75,7 +75,7 @@ jobs:
     - name: "Install Go"
       uses: actions/setup-go@v2
       with:
-        go-version: '1.13.3'
+        go-version: '1.16.2'
 
     - name: "Build `e2e` binaries"
       run: make build/bin/linux/amd64/e2e build/bin/darwin/amd64/e2e

.gitignore

@@ -2,6 +2,7 @@ vendor
 dist
 /getenvoy
 /build/
+.idea
 
 # code generated by `github.com/rakyll/statik`
 statik.go

.golangci.yml

@@ -34,9 +34,9 @@ run:
   modules-download-mode: readonly
 
 linters:
-  enable: 
+  enable:
   - "bodyclose"
-  # - "depguard" broken in golangci-lint 1.17.1
+  - "depguard"
   - "dupl"
   - "goconst"
   - "gocritic"
@@ -46,17 +46,15 @@ linters:
   - "golint"
   - "gosec"
   - "gosimple"
-  - "interfacer"
   - "lll"
-  - "maligned"
   - "misspell"
   - "nakedret"
   - "prealloc"
   - "scopelint"
   - "unconvert"
   - "unparam"
-  
-  disable: 
+
+  disable:
   - "gochecknoinits"
   - "gochecknoglobals"
 
@@ -93,67 +91,30 @@ linters-settings:
   unparam:
     check-exported: false
   gocritic:
-    enabled-checks:
-      - appendCombine
-      - appendAssign
-      - assignOp
-      - argOrder
-      - badCond
+    enabled-checks:  # non-default checks we decided to also add
       - boolExprSimplify
       - builtinShadow
-      - captLocal
-      - caseOrder
-      - codegenComment
       - commentedOutCode
       - commentedOutImport
-      - defaultCaseOrder
-      - deprecatedComment
       - docStub
-      - dupArg
-      - dupBranchBody
-      - dupCase
-      - dupSubExpr
-      - elseif
       - emptyFallthrough
-      - equalFold
-      - flagDeref
-      - flagName
       - hexLiteral
-      - indexAlloc
       - initClause
       - methodExprCall
       - nilValReturn
       - octalLiteral
-      - offBy1
-      - rangeExprCopy
-      - regexpMust
-      - singleCaseSwitch
-      - sloppyLen
-      - stringXbytes
-      - switchTrue
       - typeAssertChain
-      - typeSwitchVar
       - typeUnparen
-      - underef
-      - unlambda
       - unnecessaryBlock
-      - unslice
-      - valSwap
       - weakCond
       - yodaStyleExpr
-      - commentFormatting
       - emptyStringTest
-      - exitAfterDefer
-      - ifElseChain
-      - hugeParam
       - importShadow
       - nestingReduce
       - paramTypeCombine
       - ptrToRefParam
-      - rangeValCopy
       - sloppyReassign
       - unlabelStmt
-      - wrapperFunc
 
     # Enable multiple checks by tags, run `GL_DEBUG=gocritic golangci-lint` run to see all tags and checks.
     # Empty list by default. See https://github.com/go-critic/go-critic#usage -> section "Tags".
@@ -180,7 +141,6 @@ issues:
         - errcheck
         - dupl
         - gosec
-        - maligned
 
     # Exclude lll issues for long lines with go:generate
     - linters:

ci/install-lint

@@ -4,7 +4,7 @@ set -e
 
 SHFMT_VERSION="3.1.1"
 LICENSER_VERSION="0.6.0"
-GOLANGCI_LINT_VERSION="1.18.0"
+GOLANGCI_LINT_VERSION="1.38.0"
 
 # Install shfmt
 wget -c https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64 -O - | sudo dd of=/usr/bin/shfmt && sudo chmod a+x /usr/bin/shfmt

go.mod

@@ -1,6 +1,6 @@
 module github.com/tetratelabs/getenvoy
 
-go 1.13
+go 1.16
 
 require (
 	bitbucket.org/creachadair/shell v0.0.6

go.sum

@@ -26,7 +26,6 @@ fortio.org/fortio v1.3.1/go.mod h1:Go0fRqoPJ1xy5JOWcS23jyF58byVZxFyEePYsGmCR0k=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
-github.com/Azure/go-autorest v10.8.1+incompatible h1:u0jVQf+a6k6x8A+sT60l6EY9XZu+kHdnZVPAYqpVRo0=
 github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
 github.com/Azure/go-autorest v14.2.0+incompatible h1:V5VMDjClD3GiElqLWO7mz2MxNAK/vTfRHdAubSIPRgs=
 github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
@@ -51,7 +50,6 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/DataDog/datadog-go v2.2.0+incompatible/go.mod h1:LButxg5PwREeZtORoXG3tL4fMGNddJ+vMq1mwgfaqoQ=
 github.com/MakeNowJust/heredoc v0.0.0-20170808103936-bb23615498cd/go.mod h1:64YHyfSL2R96J44Nlwm39UHepQbyR5q10x7iYa1ks2E=
-github.com/Masterminds/semver v1.4.2 h1:WBLTQ37jOCzSLtXNdoo8bNM8876KhNqOKvrlGITgsTc=
 github.com/Masterminds/semver v1.4.2/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
@@ -106,11 +104,9 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bitly/go-simplejson v0.5.0 h1:6IH+V8/tVMab511d5bn4M7EwGXZf9Hj6i2xSwkNEM+Y=
 github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
 github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/blang/semver v3.5.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 h1:DDGfHa7BWjL4YnC6+E63dPcxHo2sUxDIu8g3QgEJdRY=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1 h1:pgAtgj+A31JBVtEHu2uHuEx0n+2ukqUJnS2vVe5pQNA=
 github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
@@ -140,7 +136,6 @@ github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGX
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533 h1:8wZizuKuZVu5COB7EsBYxBQz8nRcXXn5d4Gt91eJLvU=
 github.com/cncf/udpa/go v0.0.0-20200313221541-5f7e5dd04533/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
-github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd h1:qMd81Ts1T2OTKmB4acZcyKaMtRnY5Y44NuXGX2GFJ1w=
 github.com/codahale/hdrhistogram v0.0.0-20161010025455-3a0bb77429bd/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f h1:tSNMc+rJDfmYntojat8lljbt1mgKNpTxUZJsSzJ9Y1s=
 github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
@@ -174,7 +169,6 @@ github.com/cpuguy83/go-md2man v1.0.10/go.mod h1:SmD6nW6nTyfqj6ABTjUi3V3JVMnlJmwc
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/cyphar/filepath-securejoin v0.2.2 h1:jCwT2GTP+PY5nBz3c/YL5PAIbusElVrPujOBSCj8xRg=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
-github.com/d4l3k/messagediff v1.2.1 h1:ZcAIMYsUg0EAp9X+tt8/enBE/Q8Yd5kzPynLyKptt9U=
 github.com/d4l3k/messagediff v1.2.1/go.mod h1:Oozbb1TVXFac9FtSIxHBMnBCq2qeH/2KkEQxENCrlLo=
 github.com/davecgh/go-spew v0.0.0-20151105211317-5215b55f46b2/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -413,7 +407,6 @@ github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgf
 github.com/grpc-ecosystem/grpc-gateway v1.3.0/go.mod h1:RSKVYQBd5MCa4OVpNdGskqpgL2+G+NZTnrVHpWWfpdw=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
-github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20171214222146-0e7658f8ee99 h1:bTRV2bQrg85E7ZeeyQfHX3GyfidLrNzVoyq7epx0bTw=
 github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20171214222146-0e7658f8ee99/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw=
 github.com/hashicorp/consul v1.3.1 h1:bY7/Uo29Uq7+mHce4wgSHtAJSbeRl+4F7M+OHTuEeXI=
 github.com/hashicorp/consul v1.3.1/go.mod h1:mFrjN1mfidgJfYP1xrJCF+AfRhr6Eaqhb2+sfyn/OOI=
@@ -551,7 +544,6 @@ github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUb
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
-github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f h1:2+myh5ml7lgEU/51gbeLHfKGNfgEQQIWrlbdaOsidbQ=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/mitchellh/reflectwalk v1.0.1 h1:FVzMWA5RllMAKIdUSC8mdWo3XtwoecrH79BY70sEEpE=
@@ -612,14 +604,12 @@ github.com/opencontainers/selinux v1.8.0 h1:+77ba4ar4jsCbL1GLbFL8fFM57w6suPfSS9P
 github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
 github.com/openshift/api v3.9.1-0.20191008181517-e4fd21196097+incompatible h1:CIa+Zv6vIPhJl5OHmKxVpnekHC54YYe49L9GLr7IxGI=
 github.com/openshift/api v3.9.1-0.20191008181517-e4fd21196097+incompatible/go.mod h1:dh9o4Fs58gpFXGSYfnVxGR9PnV53I8TW84pQaJDdGiY=
-github.com/opentracing/opentracing-go v1.0.2 h1:3jA2P6O1F9UOrWVpwrIo17pu01KWvNWg4X946/Y5Zwg=
 github.com/opentracing/opentracing-go v1.0.2/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
 github.com/openzipkin/zipkin-go v0.1.7/go.mod h1:NaW6tEwdmWMaCDZzg8sh+IBNOxHMPnhQw8ySjnjRyN4=
 github.com/otiai10/copy v1.2.0 h1:HvG945u96iNadPoG2/Ja2+AUJeW5YuFQMixq9yirC+k=
 github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw=
 github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE=
-github.com/otiai10/curr v1.0.0 h1:TJIWdbX0B+kpNagQrjgq8bCMrbhiuX73M2XwgtDMoOI=
 github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs=
 github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo=
 github.com/otiai10/mint v1.3.1 h1:BCmzIS3n71sGfHB5NMNDB3lHYPz8fWSkCAErHed//qc=
@@ -747,7 +737,6 @@ github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoH
 github.com/stretchr/testify v0.0.0-20151208002404-e3a8ff8ce365/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
 github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
@@ -763,9 +752,7 @@ github.com/tinylib/msgp v1.0.2/go.mod h1:+d+yLhGm8mzTaHzB+wgMYrodPfmZrzkirds8fDW
 github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c/go.mod h1:hzIxponao9Kjc7aWznkXaL4U4TWaDSs8zcsY4Ka08nM=
-github.com/uber/jaeger-client-go v0.0.0-20190228190846-ecf2d03a9e80 h1:nWzkj/LnVGFeaeXAAXq7AyH4BQP3678Lqj3y2fIaieg=
 github.com/uber/jaeger-client-go v0.0.0-20190228190846-ecf2d03a9e80/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk=
-github.com/uber/jaeger-lib v2.0.0+incompatible h1:iMSCV0rmXEogjNWPh2D0xk9YVKvrtGoHJNe9ebLu/pw=
 github.com/uber/jaeger-lib v2.0.0+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U=
 github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
 github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8/go.mod h1:VFNgLljTbGfSG7qAOspJ7OScBnGdDN/yBr0sguwnwf0=

pkg/binary/envoy/config.go

@@ -97,7 +97,7 @@ func (r *Runtime) SaveConfig(name, config string) (string, error) {
 		return "", fmt.Errorf("Unable to create directory %q: %v", configDir, err)
 	}
 	filename := name + ".yaml"
-	err := ioutil.WriteFile(filepath.Join(configDir, filename), []byte(config), 0644)
+	err := ioutil.WriteFile(filepath.Join(configDir, filename), []byte(config), 0600)
 	if err != nil {
 		return "", fmt.Errorf("Cannot save config file %s: %s", filepath.Join(configDir, filename), err)
 	}

pkg/binary/envoy/controlplane/istio.tmpl.go

@@ -28,7 +28,7 @@ func writeIstioTemplate(path string) error {
 	if err := os.MkdirAll(filepath.Dir(path), os.ModePerm); err != nil {
 		return err
 	}
-	return ioutil.WriteFile(path, []byte(istioBootStrapTemplate), 0644)
+	return ioutil.WriteFile(path, []byte(istioBootStrapTemplate), 0600)
 }
 
 var istioBootStrapTemplate = `{

pkg/binary/envoy/debug/admin.go

@@ -68,6 +68,7 @@ func retrieveAdminAPIData(r binary.Runner) error {
 			multiErr = multierror.Append(multiErr, fmt.Errorf("received %v from /%v ", resp.StatusCode, path))
 			continue
 		}
+		// #nosec -> r.DebugStore() is allowed to be anywhere
 		f, err := os.OpenFile(filepath.Join(r.DebugStore(), file), os.O_CREATE|os.O_WRONLY, 0600)
 		if err != nil {
 			multiErr = multierror.Append(multiErr, err)

pkg/binary/envoy/debug/log_linux.go

@@ -66,6 +66,7 @@ func captureStderr(r binary.Runner) error {
 }
 
 func createLogFile(path string) (*os.File, error) {
+	// #nosec -> logs can be written anywhere
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0600)
 	if err != nil {
 		return nil, fmt.Errorf("unable to open file to write logs to %v: %v", path, err)

pkg/binary/envoy/debug/log_linux_test.go

@@ -37,7 +37,7 @@ func Test_capture(t *testing.T) {
 			if err != nil {
 				t.Errorf("error stating %v: %v", path, err)
 			}
-			if f.Size() < 1 {
+			if f != nil && f.Size() < 1 {
 				t.Errorf("file %v was empty", path)
 			}
 		}

pkg/binary/envoy/fetch.go

@@ -112,7 +112,7 @@ func fetchEnvoy(dst, src string) error {
 }
 
 func doDownload(dst, src string) (string, error) {
-	// #nosec -> src destination can be anywhere by design
+	// #nosec -> src can be anywhere by design
 	resp, err := transport.Get(src)
 	if err != nil {
 		return "", err
@@ -124,6 +124,7 @@ func doDownload(dst, src string) (string, error) {
 	}
 
 	tarball := filepath.Join(dst, "envoy.tar"+filepath.Ext(src))
+	// #nosec -> dst can be anywhere by design
 	f, err := os.OpenFile(tarball, os.O_CREATE|os.O_WRONLY, 0600)
 	if err != nil {
 		return "", err

pkg/cmd/extension/run/cmd_test.go

@@ -356,7 +356,7 @@ Run 'getenvoy extension run --help' for usage.
 
 		By("creating a non-executable file")
 		filePath := filepath.Join(tempDir, "envoy")
-		err = ioutil.WriteFile(filePath, []byte(`#!/bin/sh`), 0644)
+		err = ioutil.WriteFile(filePath, []byte(`#!/bin/sh`), 0600)
 		Expect(err).NotTo(HaveOccurred())
 
 		By("running command")
@@ -616,7 +616,7 @@ Run 'getenvoy extension run --help' for usage.
 				Expect(os.RemoveAll(tempDir)).To(Succeed())
 			}()
 			wasmFile := filepath.Join(tempDir, "extension.wasm")
-			err = ioutil.WriteFile(wasmFile, []byte{}, 0644)
+			err = ioutil.WriteFile(wasmFile, []byte{}, 0600)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("running command")
@@ -648,7 +648,7 @@ Run 'getenvoy extension run --help' for usage.
 				Expect(os.RemoveAll(tempDir)).To(Succeed())
 			}()
 			configFile := filepath.Join(tempDir, "config.json")
-			err = ioutil.WriteFile(configFile, []byte(`{"key2":"value2"}`), 0644)
+			err = ioutil.WriteFile(configFile, []byte(`{"key2":"value2"}`), 0600)
 			Expect(err).NotTo(HaveOccurred())
 
 			By("running command")

pkg/extension/wasmimage/puller.go

@@ -40,8 +40,8 @@ func NewPuller(insecure, useHTTP bool) (*Puller, error) {
 
 	client.Transport = &http.Transport{
 		TLSClientConfig: &tls.Config{
-			// nolint:gosec this option is only enabled when the user specify the insecure flag.
-			InsecureSkipVerify: insecure,
+			// this option is only enabled when the user specify the insecure flag.
+			InsecureSkipVerify: insecure, // nolint:gosec
 		},
 	}
 
@@ -77,7 +77,7 @@ func (p *Puller) Pull(imageRef, imagePath string) (ocispec.Descriptor, error) {
 	}
 	manifest, image, _ := store.Get(layers[0])
 
-	if err := ioutil.WriteFile(imagePath, image, 0755); err != nil {
+	if err := ioutil.WriteFile(imagePath, image, 0600); err != nil {
 		return manifest, fmt.Errorf("failed to write image: %w", err)
 	}
 

pkg/extension/wasmimage/pusher.go

@@ -39,8 +39,8 @@ func NewPusher(insecure, useHTTP bool) (*Pusher, error) {
 	if insecure {
 		client.Transport = &http.Transport{
 			TLSClientConfig: &tls.Config{
-				// nolint:gosec this option is only enabled when the user specify the insecure flag.
-				InsecureSkipVerify: true,
+				// this option is only enabled when the user specify the insecure flag.
+				InsecureSkipVerify: true, // nolint:gosec
 			},
 		}
 	}

pkg/extension/workspace/example/runtime/configdir/configdir.go

@@ -194,7 +194,7 @@ func (d *configDir) writeFile(fileName string, data []byte) error {
 	if err := osutil.EnsureDirExists(filepath.Dir(outputFile)); err != nil {
 		return err
 	}
-	if err := ioutil.WriteFile(outputFile, data, 0644); err != nil {
+	if err := ioutil.WriteFile(outputFile, data, 0600); err != nil {
 		return errors.Wrapf(err, "failed to write config file to %q", outputFile)
 	}
 	return nil

pkg/extension/workspace/fs/types.go

@@ -57,7 +57,7 @@ func (d workspaceDir) WriteFile(path string, data []byte) error {
 	if err := osutil.EnsureDirExists(filepath.Dir(path)); err != nil {
 		return err
 	}
-	return ioutil.WriteFile(path, data, 0644)
+	return ioutil.WriteFile(path, data, 0600)
 }
 
 func (d workspaceDir) HasDir(path string) (bool, error) {