gosec: handle every error #623

New issue

Open

opened 2026-09-24 16:24:06 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-24 16:24:06 +00:00

Owner

What

scripts/gosec.sh excludes seven rule classes: G104, G204, G301, G302, G304, G306, and G704. The reasons live only in the script header, with no decision record. A run with no exclusions reports 172 hits, all in those seven classes: G104 85, G304 46, G204 15, G306 12, G301 9, G302 3, and G704 2. Every rule outside the seven is clean.

I do not ignore errors. So G104 comes out of the exclusion list, and every error gets handled.

Fix

Handle each of the 85 G104 sites: return the error, join it with the error already in flight, or report it. No blank assignment.
Check the 515 lines of non-test code that assign a value to _ (_ = x or v, _ :=), and handle every dropped error among them. Not all are errors (a type assertion v, _ = x.(string) drops a bool), but many are, for example keyID, _ := strconv.ParseInt(...) and newContent, _ := os.ReadFile(...) in internal/docs/generate.go.
internal/analytics/analytics.go creates its private directory 0700, not 0755.
Remove G104 from -exclude in scripts/gosec.sh.
The decision record for the six classes that stay excluded is #633.

Acceptance

gosec -confidence=high -exclude=G204,G301,G302,G304,G306,G704 ./... reports 0 issues.
No error is dropped through a blank assignment in non-test code.
The gate is green.

## What `scripts/gosec.sh` excludes seven rule classes: G104, G204, G301, G302, G304, G306, and G704. The reasons live only in the script header, with no decision record. A run with no exclusions reports 172 hits, all in those seven classes: G104 85, G304 46, G204 15, G306 12, G301 9, G302 3, and G704 2. Every rule outside the seven is clean. I do not ignore errors. So G104 comes out of the exclusion list, and every error gets handled. ## Fix - Handle each of the 85 G104 sites: return the error, join it with the error already in flight, or report it. No blank assignment. - Check the 515 lines of non-test code that assign a value to `_` (`_ = x` or `v, _ :=`), and handle every dropped error among them. Not all are errors (a type assertion `v, _ = x.(string)` drops a bool), but many are, for example `keyID, _ := strconv.ParseInt(...)` and `newContent, _ := os.ReadFile(...)` in `internal/docs/generate.go`. - `internal/analytics/analytics.go` creates its private directory `0700`, not `0755`. - Remove G104 from `-exclude` in `scripts/gosec.sh`. - The decision record for the six classes that stay excluded is #633. ## Acceptance - `gosec -confidence=high -exclude=G204,G301,G302,G304,G306,G704 ./...` reports 0 issues. - No error is dropped through a blank assignment in non-test code. - The gate is green.

hexajon added the

security

label

2026-09-24 16:24:06 +00:00

~~hexajon referenced this issue 2026-09-24 18:15:16 +00:00~~

gate: fail on every gopls diagnostic #624

hexajon referenced this issue

2026-09-24 18:36:32 +00:00

add a madtea-dev command that splits a working-tree change into ordered atomic commits #629

hexajon referenced this issue

2026-09-24 19:39:16 +00:00

gosec: record why six rule classes stay excluded #633

hexajon changed title from ~~gosec: handle every error, and record why the other excluded rules are out of scope~~ to gosec: handle every error

2026-09-24 19:40:03 +00:00

hexajon added a new dependency

2026-09-24 19:40:15 +00:00

#633 gosec: record why six rule classes stay excluded

hexajon referenced this issue

2026-10-13 22:23:04 +00:00

epic: code and supply-chain security hardening #759

hexajon added a new dependency

2026-10-13 22:23:15 +00:00

#759 epic: code and supply-chain security hardening