Skip to content

Commit eb6dc4d

Browse files
aeadaead
committed
add govulncheck to CI and improve CI actions
Signed-off-by: Andreas Auernhammer <[email protected]>
1 parent 3e4aa6f commit eb6dc4d

File tree

9 files changed

+80
-66
lines changed

9 files changed

+80
-66
lines changed

‎.github/workflows/codeql.yml

Lines changed: 13 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,18 @@
1-
name: "CodeQL Scan"
1+
name: CodeQL
22
on:
3-
push:
43
pull_request:
5-
schedule:
6-
- cron: '0 19 * * 0'
4+
branches:
5+
- main
6+
push:
7+
branches:
8+
- main
79
jobs:
8-
CodeQL-Build:
9-
# CodeQL runs on ubuntu-latest and windows-latest
10+
codeql:
11+
name: Analysis
1012
runs-on: ubuntu-latest
1113
steps:
1214
- name: Checkout repository
13-
uses: actions/checkout@v2
15+
uses: actions/checkout@v3
1416
with:
1517
# We must fetch at least the immediate parents so that if this is
1618
# a pull request then we can checkout the head.
@@ -22,26 +24,15 @@ jobs:
2224

2325
# Initializes the CodeQL tools for scanning.
2426
- name: Initialize CodeQL
25-
uses: github/codeql-action/init@v1
27+
uses: github/codeql-action/init@v2
2628
# Override language selection by uncommenting this and choosing your languages
2729
# with:
2830
# languages: go, javascript, csharp, python, cpp, java
2931

3032
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
3133
# If this step fails, then you should remove it and run the build manually (see below)
3234
- name: Autobuild
33-
uses: github/codeql-action/autobuild@v1
34-
35-
# ℹ️ Command-line programs to run using the OS shell.
36-
# 📚 https://git.io/JvXDl
37-
38-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
39-
# and modify them (or add more) to build your code if your project
40-
# uses a compiled language
41-
42-
#- run: |
43-
# make bootstrap
44-
# make release
45-
35+
uses: github/codeql-action/autobuild@v2
4636
- name: Perform CodeQL Analysis
47-
uses: github/codeql-action/analyze@v1
37+
uses: github/codeql-action/analyze@v2
38+

‎.github/workflows/go.yml

Lines changed: 13 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -10,47 +10,40 @@ on:
1010

1111
jobs:
1212
build:
13-
name: Build Go ${{ matrix.go-version }}
13+
name: Build ${{ matrix.go-version }}
1414
runs-on: ubuntu-latest
1515
strategy:
1616
matrix:
17-
go-version: [1.16.x, 1.17.x]
17+
go-version: [1.19.1]
1818
steps:
1919
- name: Set up Go ${{ matrix.go-version }}
20-
uses: actions/setup-go@v1
20+
uses: actions/setup-go@v3
2121
with:
2222
go-version: ${{ matrix.go-version }}
23-
id: go
24-
2523
- name: Check out code into the Go module directory
26-
uses: actions/checkout@v1
27-
28-
- name: Build
24+
uses: actions/checkout@v3
25+
- name: Build and Lint
2926
env:
3027
GO111MODULE: on
3128
run: |
32-
curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.42.0
33-
$(go env GOPATH)/bin/golangci-lint run --config ./.golangci.yml
29+
go build ./...
3430
go vet ./...
31+
curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.48.0
32+
$(go env GOPATH)/bin/golangci-lint run --config ./.golangci.yml
3533
test:
36-
name: Test Go ${{ matrix.go-version }} on ${{ matrix.os }}
34+
name: Text ${{ matrix.os }}
3735
runs-on: ${{ matrix.os }}
3836
strategy:
3937
matrix:
40-
go-version: [1.17.x]
38+
go-version: [1.19.1]
4139
os: [ubuntu-latest, windows-latest, macos-latest]
4240
steps:
4341
- name: Set up Go ${{ matrix.go-version }} on ${{ matrix.os }}
44-
uses: actions/setup-go@v1
42+
uses: actions/setup-go@v3
4543
with:
4644
go-version: ${{ matrix.go-version }}
47-
id: go
48-
4945
- name: Check out code into the Go module directory
50-
uses: actions/checkout@v1
51-
46+
uses: actions/checkout@v3
5247
- name: Test on ${{ matrix.os }}
53-
env:
54-
GO111MODULE: on
5548
run: |
56-
go test -v ./...
49+
go test ./...

‎.github/workflows/vulncheck.yml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
ame: VulnCheck
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
push:
7+
branches:
8+
- main
9+
jobs:
10+
vulncheck:
11+
name: Analysis
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Check out code into the Go module directory
15+
uses: actions/checkout@v3
16+
- name: Set up Go
17+
uses: actions/setup-go@v3
18+
with:
19+
go-version: 1.19.1
20+
check-latest: true
21+
- name: Install govulncheck
22+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
23+
shell: bash
24+
- name: Run govulncheck
25+
run: govulncheck ./...
26+
shell: bash

‎minisign.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ func Verify(publicKey PublicKey, message, signature []byte) bool {
162162
}
163163

164164
func sign(privateKey PrivateKey, message []byte, trustedComment, untrustedComment string, isHashed bool) []byte {
165-
var algorithm = EdDSA
165+
algorithm := EdDSA
166166
if isHashed {
167167
algorithm = HashEdDSA
168168
}

‎minisign_test.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,5 +60,4 @@ func TestReaderRoundtrip(t *testing.T) {
6060
if !reader.Verify(publicKey, signature) {
6161
t.Fatalf("Verification failed: signature %q - public key %q", signature, publicKey)
6262
}
63-
6463
}

‎private.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -195,9 +195,9 @@ func DecryptKey(password string, privateKey []byte) (PrivateKey, error) {
195195
}
196196

197197
// encryptKey encrypts the plaintext and returns a ciphertext by:
198-
// 1. tag = BLAKE2b-256(EdDSA-const || plaintext)
199-
// 2. keystream = Scrypt(password, salt, convert(ops, mem))
200-
// 3. ciphertext = (plaintext || tag) ⊕ keystream
198+
// 1. tag = BLAKE2b-256(EdDSA-const || plaintext)
199+
// 2. keystream = Scrypt(password, salt, convert(ops, mem))
200+
// 3. ciphertext = (plaintext || tag) ⊕ keystream
201201
//
202202
// Therefore, decryptKey converts the ops and mem cost parameters
203203
// to the (N, r, p)-tuple expected by Scrypt.
@@ -233,9 +233,9 @@ func encryptKey(password string, salt []byte, ops, mem uint64, plaintext []byte)
233233
}
234234

235235
// decryptKey decrypts the ciphertext and returns a plaintext by:
236-
// 1. keystream = Scrypt(password, salt, convert(ops, mem))
237-
// 2. plaintext || tag = ciphertext ⊕ keystream
238-
// 3. Check that: tag == BLAKE2b-256(EdDSA-const || plaintext)
236+
// 1. keystream = Scrypt(password, salt, convert(ops, mem))
237+
// 2. plaintext || tag = ciphertext ⊕ keystream
238+
// 3. Check that: tag == BLAKE2b-256(EdDSA-const || plaintext)
239239
//
240240
// Therefore, decryptKey converts the ops and mem cost parameters to
241241
// the (N, r, p)-tuple expected by Scrypt.

‎public.go

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
// Copyright (c) 2021 Andreas Auernhammer. All rights reserved.
2+
// Use of this source code is governed by a license that can be
3+
// found in the LICENSE file.
4+
15
package minisign
26

37
import (
@@ -65,7 +69,7 @@ func (p PublicKey) String() string {
6569
//
6670
// It never returns an error.
6771
func (p PublicKey) MarshalText() ([]byte, error) {
68-
var comment = "untrusted comment: minisign public key: " + strings.ToUpper(strconv.FormatUint(p.ID(), 16)) + "\n"
72+
comment := "untrusted comment: minisign public key: " + strings.ToUpper(strconv.FormatUint(p.ID(), 16)) + "\n"
6973
return []byte(comment + p.String()), nil
7074
}
7175

‎signature.go

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,15 +35,16 @@ func SignatureFromFile(file string) (Signature, error) {
3535
//
3636
// A signature is generated when signing a message with
3737
// a private key:
38-
// signature = Sign(privateKey, message)
38+
//
39+
// signature = Sign(privateKey, message)
3940
//
4041
// The signature of a message can then be verified with the
4142
// corresponding public key:
42-
// if Verify(publicKey, message, signature) {
43-
// // => signature is valid
44-
// // => message has been signed with correspoding private key
45-
// }
4643
//
44+
// if Verify(publicKey, message, signature) {
45+
// // => signature is valid
46+
// // => message has been signed with correspoding private key
47+
// }
4748
type Signature struct {
4849
_ [0]func() // enforce named assignment and prevent direct comparison
4950

‎signature_test.go

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -92,15 +92,15 @@ var equalSignatureTests = []struct {
9292
Algorithm: EdDSA,
9393
KeyID: 0xe7620f1842b4e81f,
9494
UntrustedComment: `signature from minisign secret key`,
95-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
95+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
9696
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
9797
CommentSignature: [64]byte{148, 178, 205, 92, 217, 151, 10, 78, 112, 147, 154, 17, 47, 24, 233, 136, 141, 16, 37, 217, 29, 77, 64, 75, 217, 55, 69, 178, 114, 188, 40, 93, 6, 130, 93, 121, 211, 7, 19, 198, 190, 160, 33, 49, 136, 129, 80, 249, 121, 170, 165, 216, 105, 97, 230, 151, 208, 109, 244, 227, 46, 121, 241, 15},
9898
},
9999
B: Signature{
100100
Algorithm: EdDSA,
101101
KeyID: 0xe7620f1842b4e81f,
102102
UntrustedComment: `signature from minisign secret key`,
103-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
103+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
104104
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
105105
CommentSignature: [64]byte{148, 178, 205, 92, 217, 151, 10, 78, 112, 147, 154, 17, 47, 24, 233, 136, 141, 16, 37, 217, 29, 77, 64, 75, 217, 55, 69, 178, 114, 188, 40, 93, 6, 130, 93, 121, 211, 7, 19, 198, 190, 160, 33, 49, 136, 129, 80, 249, 121, 170, 165, 216, 105, 97, 230, 151, 208, 109, 244, 227, 46, 121, 241, 15},
106106
},
@@ -123,8 +123,8 @@ var equalSignatureTests = []struct {
123123
Equal: false, // KeyID differs
124124
},
125125
{
126-
A: Signature{TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`},
127-
B: Signature{TrustedComment: `timestamp:1591521249 file:minisign-0.9.tar.gz`},
126+
A: Signature{TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`},
127+
B: Signature{TrustedComment: `timestamp:1591521249 file:minisign-0.9.tar.gz`},
128128
Equal: false, // TrustedComment differs
129129
},
130130
{
@@ -165,24 +165,24 @@ var marshalSignatureTests = []struct {
165165
Algorithm: EdDSA,
166166
KeyID: 0xe7620f1842b4e81f,
167167
UntrustedComment: `signature from minisign secret key`,
168-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
168+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
169169
},
170170
},
171171
{
172172
Signature: Signature{
173173
Algorithm: EdDSA,
174174
KeyID: 0xe7620f1842b4e81f,
175175
UntrustedComment: `signature from minisign secret key`,
176-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
177-
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
176+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
177+
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
178178
},
179179
},
180180
{
181181
Signature: Signature{
182182
Algorithm: EdDSA,
183183
KeyID: 0xe7620f1842b4e81f,
184184
UntrustedComment: `signature from minisign secret key`,
185-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
185+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
186186
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
187187
CommentSignature: [64]byte{148, 178, 205, 92, 217, 151, 10, 78, 112, 147, 154, 17, 47, 24, 233, 136, 141, 16, 37, 217, 29, 77, 64, 75, 217, 55, 69, 178, 114, 188, 40, 93, 6, 130, 93, 121, 211, 7, 19, 198, 190, 160, 33, 49, 136, 129, 80, 249, 121, 170, 165, 216, 105, 97, 230, 151, 208, 109, 244, 227, 46, 121, 241, 15},
188188
},
@@ -203,7 +203,7 @@ lLLNXNmXCk5wk5oRLxjpiI0QJdkdTUBL2TdFsnK8KF0Ggl150wcTxr6gITGIgVD5eaql2Glh5pfQbfTj
203203
Algorithm: EdDSA,
204204
KeyID: 0xe7620f1842b4e81f,
205205
UntrustedComment: `signature from minisign secret key`,
206-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
206+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
207207
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
208208
CommentSignature: [64]byte{148, 178, 205, 92, 217, 151, 10, 78, 112, 147, 154, 17, 47, 24, 233, 136, 141, 16, 37, 217, 29, 77, 64, 75, 217, 55, 69, 178, 114, 188, 40, 93, 6, 130, 93, 121, 211, 7, 19, 198, 190, 160, 33, 49, 136, 129, 80, 249, 121, 170, 165, 216, 105, 97, 230, 151, 208, 109, 244, 227, 46, 121, 241, 15},
209209
},
@@ -217,7 +217,7 @@ lLLNXNmXCk5wk5oRLxjpiI0QJdkdTUBL2TdFsnK8KF0Ggl150wcTxr6gITGIgVD5eaql2Glh5pfQbfTj
217217
Algorithm: EdDSA,
218218
KeyID: 0xe7620f1842b4e81f,
219219
UntrustedComment: `signature from minisign secret key`,
220-
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
220+
TrustedComment: `timestamp:1591521248 file:minisign-0.9.tar.gz`,
221221
Signature: [64]byte{20, 99, 118, 100, 132, 21, 202, 44, 47, 123, 240, 66, 228, 28, 175, 132, 143, 49, 11, 188, 252, 49, 53, 73, 106, 154, 66, 249, 67, 203, 35, 77, 156, 24, 226, 182, 244, 241, 252, 5, 244, 97, 127, 41, 191, 156, 128, 14, 117, 64, 157, 164, 36, 146, 238, 203, 151, 33, 174, 82, 239, 66, 73, 10},
222222
CommentSignature: [64]byte{148, 178, 205, 92, 217, 151, 10, 78, 112, 147, 154, 17, 47, 24, 233, 136, 141, 16, 37, 217, 29, 77, 64, 75, 217, 55, 69, 178, 114, 188, 40, 93, 6, 130, 93, 121, 211, 7, 19, 198, 190, 160, 33, 49, 136, 129, 80, 249, 121, 170, 165, 216, 105, 97, 230, 151, 208, 109, 244, 227, 46, 121, 241, 15},
223223
},

0 commit comments

Comments
 (0)