Update to go1.18.1 (spiffe#2945)

Also includes some changes to golangci-lint and some fixes for the new
linter version. The version bump here is required for go1.18.
Unfortunately not all of our currently linters support generics, so we
need to force the linter into go1.17 mode until they are addressed.

Also changes the way golangci-lint is installed to use the go toolchain
for the project to install it instead of prebuilt binaries that may be
built with an older version of Go (which can cause problems when certain
features are released, like generics).

Signed-off-by: Andrew Harding <[email protected]>

.github/workflows/pr_build.yaml

@@ -3,7 +3,7 @@ on:
  pull_request: {}
  workflow_dispatch: {}
 env:
- GO_VERSION: 1.17.7
+ GO_VERSION: 1.18.1
 jobs:
  cache-deps:
  name: cache-deps (linux)

.github/workflows/release_build.yaml

@@ -4,7 +4,7 @@ on:
  tags:
  - 'v[0-9].[0-9]+.[0-9]+'
 env:
- GO_VERSION: 1.17.7
+ GO_VERSION: 1.18.1
 jobs:
  cache-deps:
  runs-on: ubuntu-18.04

.go-version

@@ -1 +1 @@
-1.17.7
+1.18.1

.golangci.yml

@@ -1,4 +1,8 @@
 run:
+ # Force ourselves to lint using go1.17 compat mode. This is needed until
+ # https://github.com/golangci/golangci-lint/issues/2649 has been resolved.
+ go: '1.17'
+
  # timeout for analysis, e.g. 30s, 5m, default is 1m
  deadline: 10m
 

Makefile

@@ -115,7 +115,7 @@ endif
 
 go_path := PATH="$(go_bin_dir):$(PATH)"
 
-golangci_lint_version = v1.44.0
+golangci_lint_version = v1.45.2
 golangci_lint_dir = $(build_dir)/golangci_lint/$(golangci_lint_version)
 golangci_lint_bin = $(golangci_lint_dir)/golangci-lint
 golangci_lint_cache = $(golangci_lint_dir)/cache
@@ -504,7 +504,7 @@ $(golangci_lint_bin):
  $(E)rm -rf $(dir $(golangci_lint_dir))
  $(E)mkdir -p $(golangci_lint_dir)
  $(E)mkdir -p $(golangci_lint_cache)
- $(E)curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(golangci_lint_dir) $(golangci_lint_version)
+ $(E)GOBIN=$(golangci_lint_dir) $(go_path) go install github.com/golangci/golangci-lint/cmd/golangci-lint@$(golangci_lint_version)
 
 install-protoc-gen-go: $(protoc_gen_go_bin)
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/spiffe/spire
 
-go 1.17
+go 1.18
 
 require (
  cloud.google.com/go/secretmanager v1.4.0

pkg/agent/plugin/nodeattestor/tpmdevid/tpmutil/session.go

@@ -54,7 +54,7 @@ type SessionConfig struct {
  Log hclog.Logger
 }
 
-var OpenTPM func(...string) (io.ReadWriteCloser, error) = openTPM
+var OpenTPM = openTPM
 
 // NewSession opens a connection to a TPM and configures it to be used for
 // node attestation.

pkg/agent/plugin/workloadattestor/k8s/k8s_test.go

@@ -598,7 +598,7 @@ func (s *Suite) TestConfigure() {
  t.Logf("CONFIG: %#v", c.Client.Transport.TLSClientConfig)
  if testCase.config.HasNodeName {
  if assert.NotNil(t, c.Client.Transport.TLSClientConfig.RootCAs) {
- assert.Len(t, c.Client.Transport.TLSClientConfig.RootCAs.Subjects(), 1)
+ assert.Len(t, c.Client.Transport.TLSClientConfig.RootCAs.Subjects(), 1) // nolint // these pools are not system pools so the use of Subjects() is ok for now
  }
  } else {
  assert.True(t, c.Client.Transport.TLSClientConfig.InsecureSkipVerify)

pkg/common/peertracker/peertracker_test_child_windows.go

@@ -103,7 +103,7 @@ func main() {
 // a WSAPROTOCOL_INFO structure that can be used to create a new socket
 // descriptor for a shared socket
 func wsaDuplicateSocket(socket windows.Handle, processID uint32, protocolInfo *windows.WSAProtocolInfo) (err error) {
- r1, _, e1 := syscall.Syscall(procWSADuplicateSocketA.Addr(), 3, uintptr(socket), uintptr(processID), uintptr(unsafe.Pointer(protocolInfo)))
+ r1, _, e1 := syscall.SyscallN(procWSADuplicateSocketA.Addr(), uintptr(socket), uintptr(processID), uintptr(unsafe.Pointer(protocolInfo)))
  if r1 == 0xffffffff {
  return e1
  }

pkg/common/peertracker/tcp_windows.go

@@ -50,7 +50,7 @@ func getCallerInfoFromTCPConn(conn net.Conn) (CallerInfo, error) {
 // compareObjectHandles compares two object handles to determine if they
 // refer to the same underlying kernel object
 func compareObjectHandles(firstHandle, secondHandle windows.Handle) error {
- r1, _, e1 := syscall.Syscall(procCompareObjectHandles.Addr(), 2, uintptr(firstHandle), uintptr(secondHandle), 0)
+ r1, _, e1 := syscall.SyscallN(procCompareObjectHandles.Addr(), uintptr(firstHandle), uintptr(secondHandle))
  if r1 == 0 {
  return e1
  }

pkg/common/util/certs_test.go

@@ -17,5 +17,5 @@ func TestLoadCertPool(t *testing.T) {
  // be ignored.
  pool, err := LoadCertPool("testdata/mixed-bundle.pem")
  require.NoError(err)
- require.Len(pool.Subjects(), 2)
+ require.Len(pool.Subjects(), 2) // nolint // these pools are not system pools so the use of Subjects() is ok for now
 }

pkg/server/plugin/upstreamauthority/vault/vault_client_test.go

@@ -500,7 +500,7 @@ func TestConfigureTLSWithCertAuth(t *testing.T) {
 
  testPool, err := testRootCAs()
  require.NoError(t, err)
- require.Equal(t, testPool.Subjects(), tcc.RootCAs.Subjects())
+ require.Equal(t, testPool.Subjects(), tcc.RootCAs.Subjects()) // nolint // these pools are not system pools so the use of Subjects() is ok for now
 }
 
 func TestConfigureTLSWithTokenAuth(t *testing.T) {
@@ -521,7 +521,7 @@ func TestConfigureTLSWithTokenAuth(t *testing.T) {
 
  testPool, err := testRootCAs()
  require.NoError(t, err)
- require.Equal(t, testPool.Subjects(), tcc.RootCAs.Subjects())
+ require.Equal(t, testPool.Subjects(), tcc.RootCAs.Subjects()) // nolint // these pools are not system pools so the use of Subjects() is ok for now
 }
 
 func TestConfigureTLSWithAppRoleAuth(t *testing.T) {
@@ -543,7 +543,7 @@ func TestConfigureTLSWithAppRoleAuth(t *testing.T) {
 
  testPool, err := testRootCAs()
  require.NoError(t, err)
- require.Equal(t, testPool.Subjects(), tcc.RootCAs.Subjects())
+ require.Equal(t, testPool.Subjects(), tcc.RootCAs.Subjects()) // nolint // these pools are not system pools so the use of Subjects() is ok for now
 }
 
 func TestConfigureTLSInvalidCACert(t *testing.T) {