Linting tidy-ups

.golangci.yml

@@ -22,6 +22,8 @@ linters:
     - staticcheck
     - typecheck
     - nolintlint
+    - gosec
+    - forbidigo
   disable-all: true
 
 linters-settings:
@@ -32,6 +34,15 @@ linters-settings:
       # The io/ioutil package has been deprecated.
       # https://go.dev/doc/go1.16#ioutil
       - io/ioutil
+  forbidigo:
+    forbid:
+      - '^fmt\.Errorf(# use errors\.Errorf instead)?$'
+  gosec:
+    excludes:
+      - G204  # Audit use of command execution
+      - G402  # TLS MinVersion too low
+    config:
+      G306: "0644"
 
 issues:
   exclude-rules:

bake/bake.go

@@ -3,7 +3,6 @@ package bake
 import (
 	"context"
 	"encoding/csv"
-	"fmt"
 	"io"
 	"os"
 	"path"
@@ -228,7 +227,7 @@ func ParseFiles(files []File, defaults map[string]string) (_ *Config, err error)
 				}
 				hclFiles = append(hclFiles, hf)
 			} else if composeErr != nil {
-				return nil, fmt.Errorf("failed to parse %s: parsing yaml: %v, parsing hcl: %w", f.Name, composeErr, err)
+				return nil, errors.Wrapf(err, "failed to parse %s: parsing yaml: %v, parsing hcl", f.Name, composeErr)
 			} else {
 				return nil, err
 			}

bake/compose.go

@@ -78,6 +78,7 @@ func ParseCompose(cfgs []compose.ConfigFile, envs map[string]string) (*Config, e
 			// compose does not support nil values for labels
 			labels := map[string]*string{}
 			for k, v := range s.Build.Labels {
+				v := v
 				labels[k] = &v
 			}
 

bake/remote.go

@@ -34,9 +34,9 @@ func ReadRemoteFiles(ctx context.Context, nodes []builder.Node, url string, name
 	var files []File
 
 	var node *builder.Node
-	for _, n := range nodes {
+	for i, n := range nodes {
 		if n.Err == nil {
-			node = &n
+			node = &nodes[i]
 			continue
 		}
 	}

commands/build.go

@@ -5,7 +5,6 @@ import (
 	"encoding/base64"
 	"encoding/csv"
 	"encoding/json"
-	"fmt"
 	"io"
 	"os"
 	"runtime"
@@ -358,7 +357,7 @@ func launchControllerAndRunBuild(dockerCli command.Cli, options buildOptions) er
 	// Start build
 	ref, err := c.Build(ctx, options.BuildOptions, pr, os.Stdout, os.Stderr, options.progress)
 	if err != nil {
-		return fmt.Errorf("failed to build: %w", err) // TODO: allow invoke even on error
+		return errors.Wrapf(err, "failed to build") // TODO: allow invoke even on error
 	}
 	if err := pw.Close(); err != nil {
 		logrus.Debug("failed to close stdin pipe writer")

controller/controller.go

@@ -2,12 +2,12 @@ package controller
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/docker/buildx/controller/control"
 	"github.com/docker/buildx/controller/local"
 	"github.com/docker/buildx/controller/remote"
 	"github.com/docker/cli/cli/command"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
@@ -21,7 +21,7 @@ func NewController(ctx context.Context, opts control.ControlOptions, dockerCli c
 	logrus.Infof("connecting to buildx server")
 	c, err = remote.NewRemoteBuildxController(ctx, dockerCli, opts)
 	if err != nil {
-		return nil, fmt.Errorf("failed to use buildx server; use --detach=false: %w", err)
+		return nil, errors.Wrap(err, "failed to use buildx server; use --detach=false")
 	}
 	return c, nil
 }

controller/local/controller.go

@@ -2,7 +2,6 @@ package local
 
 import (
 	"context"
-	"fmt"
 	"io"
 
 	"github.com/containerd/console"
@@ -11,6 +10,7 @@ import (
 	"github.com/docker/buildx/controller/control"
 	controllerapi "github.com/docker/buildx/controller/pb"
 	"github.com/docker/cli/cli/command"
+	"github.com/pkg/errors"
 )
 
 func NewLocalBuildxController(ctx context.Context, dockerCli command.Cli) control.BuildxController {
@@ -28,10 +28,10 @@ type localController struct {
 
 func (b *localController) Invoke(ctx context.Context, ref string, cfg controllerapi.ContainerConfig, ioIn io.ReadCloser, ioOut io.WriteCloser, ioErr io.WriteCloser) error {
 	if ref != b.ref {
-		return fmt.Errorf("unknown ref %q", ref)
+		return errors.Errorf("unknown ref %q", ref)
 	}
 	if b.resultCtx == nil {
-		return fmt.Errorf("no build result is registered")
+		return errors.New("no build result is registered")
 	}
 	ccfg := build.ContainerConfig{
 		ResultCtx:  b.resultCtx,

controller/remote/client.go

@@ -2,7 +2,6 @@ package remote
 
 import (
 	"context"
-	"fmt"
 	"io"
 	"sync"
 	"time"
@@ -77,7 +76,7 @@ func (c *Client) Disconnect(ctx context.Context, key string) error {
 
 func (c *Client) Invoke(ctx context.Context, ref string, containerConfig pb.ContainerConfig, in io.ReadCloser, stdout io.WriteCloser, stderr io.WriteCloser) error {
 	if ref == "" {
-		return fmt.Errorf("build reference must be specified")
+		return errors.New("build reference must be specified")
 	}
 	stream, err := c.client().Invoke(ctx)
 	if err != nil {
@@ -207,7 +206,7 @@ func (c *Client) build(ctx context.Context, ref string, options pb.BuildOptions,
 					},
 				},
 			}); err != nil {
-				return fmt.Errorf("failed to init input: %w", err)
+				return errors.Wrap(err, "failed to init input")
 			}
 
 			inReader, inWriter := io.Pipe()

controller/remote/controller.go

@@ -25,6 +25,7 @@ import (
 	"github.com/docker/cli/cli/command"
 	"github.com/moby/buildkit/client"
 	"github.com/pelletier/go-toml"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
@@ -70,7 +71,7 @@ func NewRemoteBuildxController(ctx context.Context, dockerCli command.Cli, opts
 		go wait()
 		c, err = newBuildxClientAndCheck(filepath.Join(serverRoot, "buildx.sock"), 10, time.Second)
 		if err != nil {
-			return nil, fmt.Errorf("cannot connect to the buildx server: %w", err)
+			return nil, errors.Wrap(err, "cannot connect to the buildx server")
 		}
 	}
 	return &buildxController{c, serverRoot}, nil
@@ -91,14 +92,14 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 			// Parse config
 			config, err := getConfig(dockerCli, serverConfigPath)
 			if err != nil {
-				return fmt.Errorf("failed to get config")
+				return err
 			}
 			if config.LogLevel == "" {
 				logrus.SetLevel(logrus.InfoLevel)
 			} else {
 				lvl, err := logrus.ParseLevel(config.LogLevel)
 				if err != nil {
-					return fmt.Errorf("failed to prepare logger: %w", err)
+					return errors.Wrap(err, "failed to prepare logger")
 				}
 				logrus.SetLevel(lvl)
 			}
@@ -147,7 +148,7 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 			go func() {
 				defer close(doneCh)
 				if err := rpc.Serve(l); err != nil {
-					errCh <- fmt.Errorf("error on serving via socket %q: %w", addr, err)
+					errCh <- errors.Wrapf(err, "error on serving via socket %q", addr)
 				}
 			}()
 			var s os.Signal
@@ -173,7 +174,7 @@ func serveCmd(dockerCli command.Cli) *cobra.Command {
 func getLogFilePath(dockerCli command.Cli, configPath string) (string, error) {
 	config, err := getConfig(dockerCli, configPath)
 	if err != nil {
-		return "", fmt.Errorf("failed to get config")
+		return "", err
 	}
 	logFile := config.LogFile
 	if logFile == "" {
@@ -196,10 +197,10 @@ func getConfig(dockerCli command.Cli, configPath string) (*serverConfig, error)
 	var config serverConfig
 	tree, err := toml.LoadFile(configPath)
 	if err != nil && !(os.IsNotExist(err) && defaultConfigPath) {
-		return nil, fmt.Errorf("failed to load config file %q", configPath)
+		return nil, errors.Wrapf(err, "failed to read config %q", configPath)
 	} else if err == nil {
 		if err := tree.Unmarshal(&config); err != nil {
-			return nil, fmt.Errorf("failed to unmarshal config file %q", configPath)
+			return nil, errors.Wrapf(err, "failed to unmarshal config %q", configPath)
 		}
 	}
 	return &config, nil
@@ -211,7 +212,7 @@ func prepareRootDir(dockerCli command.Cli, config *serverConfig) (string, error)
 		rootDir = rootDataDir(dockerCli)
 	}
 	if rootDir == "" {
-		return "", fmt.Errorf("buildx root dir must be determined")
+		return "", errors.New("buildx root dir must be determined")
 	}
 	if err := os.MkdirAll(rootDir, 0700); err != nil {
 		return "", err
@@ -239,7 +240,7 @@ func newBuildxClientAndCheck(addr string, checkNum int, duration time.Duration)
 			lastErr = nil
 			break
 		}
-		err = fmt.Errorf("failed to access server (tried %d times): %w", i, err)
+		err = errors.Wrapf(err, "failed to access server (tried %d times)", i)
 		logrus.Debugf("connection failure: %v", err)
 		lastErr = err
 		time.Sleep(duration)
@@ -274,7 +275,7 @@ func (c *buildxController) Kill(ctx context.Context) error {
 		return err
 	}
 	if pid <= 0 {
-		return fmt.Errorf("no PID is recorded for buildx server")
+		return errors.New("no PID is recorded for buildx server")
 	}
 	p, err := os.FindProcess(int(pid))
 	if err != nil {

controller/remote/controller_nolinux.go

@@ -4,15 +4,15 @@ package remote
 
 import (
 	"context"
-	"fmt"
 
 	"github.com/docker/buildx/controller/control"
 	"github.com/docker/cli/cli/command"
+	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 )
 
 func NewRemoteBuildxController(ctx context.Context, dockerCli command.Cli, opts control.ControlOptions) (control.BuildxController, error) {
-	return nil, fmt.Errorf("remote buildx unsupported")
+	return nil, errors.New("remote buildx unsupported")
 }
 
 func AddControllerCommands(cmd *cobra.Command, dockerCli command.Cli) {}

controller/remote/io.go

@@ -2,14 +2,13 @@ package remote
 
 import (
 	"context"
-	"errors"
-	"fmt"
 	"io"
 	"syscall"
 	"time"
 
 	"github.com/docker/buildx/controller/pb"
 	"github.com/moby/sys/signal"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sync/errgroup"
 )
@@ -42,14 +41,14 @@ func serveIO(attachCtx context.Context, srv msgStream, initFn func(*pb.InitMessa
 	}
 	init := msg.GetInit()
 	if init == nil {
-		return fmt.Errorf("unexpected message: %T; wanted init", msg.GetInput())
+		return errors.Errorf("unexpected message: %T; wanted init", msg.GetInput())
 	}
 	ref := init.Ref
 	if ref == "" {
-		return fmt.Errorf("no ref is provided")
+		return errors.New("no ref is provided")
 	}
 	if err := initFn(init); err != nil {
-		return fmt.Errorf("failed to initialize IO server: %w", err)
+		return errors.Wrap(err, "failed to initialize IO server")
 	}
 
 	if stdout != nil {
@@ -124,7 +123,7 @@ func serveIO(attachCtx context.Context, srv msgStream, initFn func(*pb.InitMessa
 			}
 			if file := msg.GetFile(); file != nil {
 				if file.Fd != 0 {
-					return fmt.Errorf("unexpected fd: %v", file.Fd)
+					return errors.Errorf("unexpected fd: %v", file.Fd)
 				}
 				if stdin == nil {
 					continue // no stdin destination is specified so ignore the data
@@ -154,7 +153,7 @@ func serveIO(attachCtx context.Context, srv msgStream, initFn func(*pb.InitMessa
 					ioConfig.signalFn(ctx, syscallSignal)
 				}
 			} else {
-				return fmt.Errorf("unexpected message: %T", msg.GetInput())
+				return errors.Errorf("unexpected message: %T", msg.GetInput())
 			}
 		}
 	})
@@ -183,7 +182,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 			Init: initMessage,
 		},
 	}); err != nil {
-		return fmt.Errorf("failed to init: %w", err)
+		return errors.Wrap(err, "failed to init")
 	}
 
 	if cfg.stdin != nil {
@@ -228,7 +227,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 						},
 					},
 				}); err != nil {
-					return fmt.Errorf("failed to send signal: %w", err)
+					return errors.Wrap(err, "failed to send signal")
 				}
 			}
 		})
@@ -253,7 +252,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 						},
 					},
 				}); err != nil {
-					return fmt.Errorf("failed to send resize: %w", err)
+					return errors.Wrap(err, "failed to send resize")
 				}
 			}
 		})
@@ -301,7 +300,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 				case 2:
 					out = cfg.stderr
 				default:
-					return fmt.Errorf("unsupported fd %d", file.Fd)
+					return errors.Errorf("unsupported fd %d", file.Fd)
 
 				}
 				if out == nil {
@@ -317,7 +316,7 @@ func attachIO(ctx context.Context, stream msgStream, initMessage *pb.InitMessage
 					eofs[file.Fd] = struct{}{}
 				}
 			} else {
-				return fmt.Errorf("unexpected message: %T", msg.GetInput())
+				return errors.Errorf("unexpected message: %T", msg.GetInput())
 			}
 		}
 	})