Commit Graph

4162 Commits

Author SHA1 Message Date
Kir Kolyshkin 670d57ae83 ci: switch to golangci-lint v2.0
The new configuration files were initially generated by
`golangci-lint migrate`, when tweaked to minimize and simplify.

golangci-lint v2 switches to a new version of staticcheck which shows
much more warnings. Some of them were fixed by a few previous commits,
and the rest of them are disabled.

Also, golangci-extra was modified to include ALL staticcheck linters.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:37:44 -07:00
Kir Kolyshkin 702b726c21 pkg/retry: rm unused break
This fixes the following linter warning:

> pkg/retry/retry.go:50:4: SA4011: ineffective break statement. Did you mean to break out of the outer loop? (staticcheck)
> 			break
>			^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 8b1718ffee pkg: do not capitalize error strings
This fixes the following linter warnings:

> pkg/auth/auth.go:176:11: ST1005: error strings should not be capitalized (staticcheck)
> 			return errors.New("Can't specify both --password-stdin and --password")
> 			       ^
> pkg/auth/auth.go:179:11: ST1005: error strings should not be capitalized (staticcheck)
> 			return errors.New("Must provide --username with --password-stdin")
> 			       ^
> pkg/subscriptions/subscriptions.go:325:17: ST1005: error strings should not be capitalized (staticcheck)
> 		return false, fmt.Errorf("Container /etc resolution error: %w", err)
> 		              ^
> pkg/subscriptions/subscriptions.go:325:17: ST1005: error strings should not be capitalized (staticcheck)
> 		return false, fmt.Errorf("Container /etc resolution error: %w", err)
> 		              ^
> pkg/subscriptions/subscriptions.go:334:17: ST1005: error strings should not be capitalized (staticcheck)
> 		return false, fmt.Errorf("Container /etc/system-fips resolution error: %w", err)
> 		              ^
> pkg/subscriptions/subscriptions.go:451:10: ST1005: error strings should not be capitalized (staticcheck)
> 		return fmt.Errorf("Could not expand %q in container: %w", srcPolicyConfig, err)
> 		       ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin a25e5a56a8 libimage: silence a staticcheck warning
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 163ec20d8a pkg/cgroups: apply De Morgan's law
This fixes the following staticcheck warning:

> pkg/cgroups/utils_linux.go:224:25: QF1001: could apply De Morgan's law (staticcheck)
> 		if parts[2] == "/" && !(unifiedMode && parts[1] == "") {
> 		                      ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 9da372fd2c libimage: apply De Morgan's law
This fixes the following staticcheck warnings:

> libimage/image.go:463:5: QF1001: could apply De Morgan's law (staticcheck)
> 	if !(referencedBy == "" || numNames == 1) {
> 	   ^
> libimage/normalize.go:33:5: QF1001: could apply De Morgan's law (staticcheck)
> 	if !(strings.ContainsAny(registry, ".:") || registry == "localhost") {
> 	   ^
> libimage/search.go:220:6: QF1001: could apply De Morgan's law (staticcheck)
> 		if !(filterMatchesAutomatedFilter(&options.Filter, results[i]) && filterMatchesOfficialFilter(&options.Filter, results[i]) && filterMatchesStarFilter(&options.Filter, results[i])) {
> 		   ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 566c24e784 pkg: apply De Morgan's law
This fixes the following staticcheck warnings:

> pkg/configmaps/configmaps.go:135:5: QF1001: could apply De Morgan's law (staticcheck)
> 	if !(len(data) > 0 && len(data) < maxConfigMapSize) {
> 	   ^
> pkg/secrets/secrets.go:169:5: QF1001: could apply De Morgan's law (staticcheck)
> 	if !(len(data) > 0 && len(data) < maxSecretSize) {
> 	   ^

as well as the subsequent gocritic warnings:

> pkg/configmaps/configmaps.go:135:5: sloppyLen: len(data) <= 0 can be len(data) == 0 (gocritic)
> 	if len(data) <= 0 || len(data) >= maxConfigMapSize {
> 	   ^
> pkg/secrets/secrets.go:169:5: sloppyLen: len(data) <= 0 can be len(data) == 0 (gocritic)
> 	if len(data) <= 0 || len(data) >= maxSecretSize {
> 	   ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 2a6974f334 pkg/timetype: fix linter warning, improve comment
Fix the following staticcheck warning:

> pkg/timetype/timestamp.go:35:21: QF1001: could apply De Morgan's law (staticcheck)
> 	parseInLocation := !(strings.ContainsAny(value, "zZ+") || strings.Count(value, "-") == 3)
> 	                   ^

While at it, improve the comment.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 14c831e003 libnetwork/netavark: simplify isMacVlan init
This fixes the following staticcheck warning:

> libnetwork/netavark/config.go:297:2: QF1007: could merge conditional assignment into variable declaration (staticcheck)
> 	isMacVlan := true
> 	^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 555b817630 libnetwork/types: rename RegexError to ErrInvalidName
... and add a deprecated alias so backward compatibility is still
preserved (and users can gradually switch to the new name).

Done because this is now also reported by staticcheck
(in addition to revive) linter.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin f3877451b3 pkg/timezone: simplify switch
This fixes the following staticcheck warning:

> pkg/timezone/timezone.go:23:2: QF1002: could use tagged switch on timezone (staticcheck)
> 	switch {
> 	^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 41e8b24890 libnetwork: simplify write
Fix the following staticcheck warning:

> libnetwork/slirp4netns/slirp4netns.go:685:15: QF1012: Use fmt.Fprintf(...) instead of Write([]byte(fmt.Sprintf(...))) (staticcheck)
> 	if _, err := conn.Write([]byte(fmt.Sprintf("%s\n", data))); err != nil {
> 	             ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin d524bfaf6a pkg/cgroups: simplify write
Fix the following staticcheck warning:

> pkg/cgroups/utils_linux.go:264:18: QF1012: Use fmt.Fprintf(...) instead of WriteString(fmt.Sprintf(...)) (staticcheck)
> 				if _, err := f.WriteString(fmt.Sprintf("%d\n", pid)); err != nil {
> 				             ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 48882d0bb9 pkg/secrets: use time.Equal
Fix the following warning, as reported by staticcheck from golangci-lint
v2.0.1:

> pkg/secrets/secrets_test.go:67:5: QF1009: probably want to use time.Time.Equal instead (staticcheck)
> 	if s.CreatedAt == s.UpdatedAt {
> 	   ^

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 9a5008a1ca .golangci.yml: remove some linters
Let's take a look at each enabled linter, and find out if it's needed;
remove those that make no sense.

 * gci: formats imports, probably superseded by gofumpt;
 * gofmt: is a subset of gofumpt;
 * goheader: does nothing with empty configuration;
 * goimports: functionality should be covered by gofumpt;
 * gomodguard: does nothing with empty configuration;
 * grouper: formats imports, probably superseded by gofumpt;
 * importas: does nothing with empty configuration;
 * loggercheck: this repo does not use any loggers it checks (kitlog,klog,logr,zap);
 * promlinter: this repo does not use Prometheus;
 * protogetter: this repo does not use protobuf;
 * rowserrcheck: this repo does not use sql;
 * sloginit: this repo does not use slog;
 * spancheck: this repo does not use opentelemetry/opencensus;
 * sqlclosecheck: this repo does not use sql;
 * tagalign: this repo does not use multiple struct tags;
 * testableexamples: this repo does not have any examples;
 * zerologlint: this repo does not use zerolog.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
Kir Kolyshkin 5e8b0017c5 .golangci.yml: switch to list of enabled linters
Instead of enabling all linters, and when disabling some of them because
we don't like them, switch to list of explicitly enabled linters. The
upside of this is we can easily upgrade golangci-lint (i.e. any new
linters won't break our CI). The downside is, we need to explicitly
enable extra linters.

To me, this is better from the maintainability perspective.

NOTE this commit does not change the configuration in any way, in other
words, the list of linters being run is the same as before. The next
commit will address this.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-26 09:36:14 -07:00
openshift-merge-bot[bot] 3adfb9b201 Merge pull request #2388 from kolyshkin/ci-extra
ci: fix running extra linters
2025-03-26 13:41:38 +00:00
openshift-merge-bot[bot] c3a3c62b3f Merge pull request #2374 from giuseppe/look-mountpoint-in-mapped-layers
image: look for mountpoint in mapped layers too
2025-03-26 10:12:58 +00:00
openshift-merge-bot[bot] 828bcae6dd Merge pull request #2360 from rhatdan/dangling
When checking IsDangling make sure image is not in manifest list
2025-03-26 08:44:56 +00:00
Kir Kolyshkin df4a7a5f8f ci: fix running extra linters
Commit f8614a5b ("CI: enable extra linters for new code") introduced the
feature of running some extra linters for any newly added code (see the
commit description for motivation).

Commit 7f76a6b5 ("use runc cgroup creation logic") broke the feature,
because it contains:

	mv .golangci-extra.yml golangci.yml

(Note the missing dot in the destination file name.)

As a result, golangci-lint was running twice with the same config,
with golangci-extra.yml being unused.

Let's fix it by using args: action parameter.

Also, some time later, a new golangci-lint removed support for deadline
option, and commit 5d5e6a44 ("update golangci.yml") fixed it for the
main config. Let's do the same for the extra config.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2025-03-25 17:21:55 -07:00
openshift-merge-bot[bot] 9dd907ed92 Merge pull request #2387 from containers/renovate/github.com-pkg-sftp-1.x
fix(deps): update module github.com/pkg/sftp to v1.13.9
2025-03-25 18:15:54 +00:00
renovate[bot] 75219a7360 fix(deps): update module github.com/pkg/sftp to v1.13.9
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-25 17:28:43 +00:00
openshift-merge-bot[bot] f315e41573 Merge pull request #2383 from containers/renovate/major-ci-vm-image
chore(deps): update dependency containers/automation_images to v20250324
2025-03-24 16:52:22 +00:00
renovate[bot] ea347b155f chore(deps): update dependency containers/automation_images to v20250324
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-24 15:56:29 +00:00
openshift-merge-bot[bot] d50cc63720 Merge pull request #2380 from containers/renovate/github.com-onsi-gomega-1.x
fix(deps): update module github.com/onsi/gomega to v1.36.3
2025-03-24 12:17:25 +00:00
renovate[bot] 7d5eebb9e3 fix(deps): update module github.com/onsi/gomega to v1.36.3
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-24 11:37:18 +00:00
openshift-merge-bot[bot] c9a49cb1a1 Merge pull request #2381 from containers/renovate/github.com-opencontainers-selinux-1.x
fix(deps): update module github.com/opencontainers/selinux to v1.12.0
2025-03-24 11:36:02 +00:00
renovate[bot] 216ce3d872 fix(deps): update module github.com/opencontainers/selinux to v1.12.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-24 11:18:26 +00:00
openshift-merge-bot[bot] e45722295c Merge pull request #2379 from containers/renovate/github.com-onsi-ginkgo-v2-2.x
fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.3
2025-03-24 11:16:50 +00:00
renovate[bot] 0f09ae4838 fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.3
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-24 10:58:43 +00:00
openshift-merge-bot[bot] 33891b6bcb Merge pull request #2382 from containers/renovate/tags.cncf.io-container-device-interface-1.x
fix(deps): update module tags.cncf.io/container-device-interface to v1.0.1
2025-03-24 10:57:33 +00:00
renovate[bot] b0fadb1498 fix(deps): update module tags.cncf.io/container-device-interface to v1.0.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-22 14:37:28 +00:00
Daniel J Walsh 9e1bb4b047 When checking IsDangling make sure image is not in manifest list
Currently when we run podman image prune or podman images --filter
dangling

It is pruning images that are in a local manifest. These images are
not dangling because they are currently in use by a named manifest list.

You can create this situation simply by doing

echo "from scratch" > /tmp/Containerfile
id=$(podman build /tmp)
podman manifest create test $id
podman image prune --force
podman image exists $id

Will return an error since the image was pruned.  Now the local manifest
test is broken.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2025-03-21 14:53:41 -04:00
openshift-merge-bot[bot] 2bff9f6c50 Merge pull request #2339 from flouthoc/refactor-pull
pull,load: use `*Image` instead of re-resolving via `name`
2025-03-21 17:18:39 +00:00
openshift-merge-bot[bot] 5589c60d1f Merge pull request #2375 from giuseppe/mask-thermal-paths
config: mask thermal interrupt info paths
2025-03-20 21:50:58 +00:00
flouthoc 8e2888e726 copier: modify newCopier for golangci-lint
Fix linter error
```
Error: libimage/copier.go:180:51: `(*Runtime).newCopier` - `reportResolvedReference` always receives `nil` (unparam)
```

Signed-off-by: flouthoc <flouthoc.git@gmail.com>
2025-03-20 13:38:06 -07:00
flouthoc 2146c492dc pull,load: use *Image instead of re-resolving via name
Following commit fixes a `race` condition in `libimage` because in `Pull(`
after performing `copy` from remote sources it agains attempts to resolve
image via `LookupImage`, any operation between `copy` and `LookupImage` can remove
`name` from the recently pulled image. Causing race in builds.

This issue was discoverd while working on PR https://github.com/containers/buildah/pull/5971
```
buildah build -t test --jobs=2 --skip-unused-stages=false .
```

Containerfile
```
FROM quay.io/jitesoft/alpine
RUN arch
FROM --platform=linux/arm64 quay.io/jitesoft/alpine AS foreign
```

Following commit also addresses the commit 88f60eeeb3
by performing the neccessary refactor.

No functional change in public exposed API, exisiting tests should pass as-is.
[NO NEW TESTS NEEDED]

Signed-off-by: flouthoc <flouthoc.git@gmail.com>
2025-03-20 13:37:59 -07:00
openshift-merge-bot[bot] d26ce8d5b4 Merge pull request #2376 from containers/renovate/github.com-onsi-ginkgo-v2-2.x
fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.2
2025-03-20 19:47:14 +00:00
renovate[bot] 02d4261f72 fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.2
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-20 18:29:56 +00:00
Giuseppe Scrivano 498dd1905e config: mask thermal interrupt info paths
On Linux, mask "/proc/interrupts" and
"/sys/devices/system/cpu/*/thermal_throttle" inside containers by
default.

It is the equivalent of https://github.com/moby/moby/pull/49560 for Moby.

Mitigates potential Thermal Side-Channel Vulnerability
Exploit (https://github.com/moby/moby/security/advisories/GHSA-6fw5-f8r9-fgfm).

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2025-03-20 19:22:29 +01:00
Giuseppe Scrivano d537c8a226 image: look for mountpoint in mapped layers too
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
2025-03-20 19:21:51 +01:00
openshift-merge-bot[bot] 83f34cfe99 Merge pull request #2372 from lpcalisi/network-interface-validate
fix(libnetwork): interface name length validation
2025-03-20 14:32:56 +00:00
Lucas Pablo Calisi 4a929deddf fix(libnetwork): interface name length validation
Implements interface name length validation during network creation to prevent
netlink errors when names exceed the kernel's 15-character limit.

This prevents creation of networks with interface names that would cause failures
when running containers.

Signed-off-by: Lucas Pablo Calisi <lucas.calisi@mercadolibre.com>
2025-03-20 11:02:13 -03:00
openshift-merge-bot[bot] c838f5ec53 Merge pull request #2373 from containers/renovate/github.com-onsi-ginkgo-v2-2.x
fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.1
2025-03-20 11:33:34 +00:00
renovate[bot] 6ebef19539 fix(deps): update module github.com/onsi/ginkgo/v2 to v2.23.1
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-19 20:08:31 +00:00
openshift-merge-bot[bot] af024e60df Merge pull request #2370 from containers/renovate/github.com-opencontainers-runc-1.x
fix(deps): update module github.com/opencontainers/runc to v1.2.6
2025-03-18 13:58:59 +00:00
renovate[bot] 2a78fab0a7 fix(deps): update module github.com/opencontainers/runc to v1.2.6
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-18 13:22:22 +00:00
openshift-merge-bot[bot] f95236a4d1 Merge pull request #2371 from containers/renovate/github.com-burntsushi-toml-1.x
fix(deps): update module github.com/burntsushi/toml to v1.5.0
2025-03-18 13:20:21 +00:00
renovate[bot] c66e7e8812 fix(deps): update module github.com/burntsushi/toml to v1.5.0
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2025-03-18 13:05:16 +00:00
openshift-merge-bot[bot] db54028574 Merge pull request #2368 from Luap99/bolt
update bolt to 1.4.0 and cdi to v1.0.0
2025-03-18 13:03:52 +00:00