enter_modify

.github/workflows/CodeQL.yml

@@ -0,0 +1,54 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master","develop" ]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ "master","develop" ]
+  schedule:
+    - cron: '0 17 * * 5'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    # timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'go' ]
+        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
+        # Use only 'java' to analyze code written in Java, Kotlin or both
+        # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v3
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v2
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+
+    # Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v2
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v2

.github/workflows/go.yml

@@ -7,29 +7,43 @@ on:
     branches: [ $default-branch, "develop" ]
 
 jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Setup go
+        uses: actions/setup-go@v3
+        with:
+          go-version: '1.19'
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Setup golangci-lint
+        uses: golangci/[email protected]
+        with:
+          version: v1.52.2
+          args: --verbose
+
   test:
+    needs: lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.18
+          go-version: 1.19
       - name: Generate SSH key
         run: ssh-keygen -f ~/.ssh/id_rsa -P ""
       - name: Test
         run: make test
 
   build:
-    needs: test
+    needs: lint
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.18
-      - name: Set dependencies
-        run: sudo apt update && sudo apt install musl-tools
+          go-version: 1.19
       - name: Build
-        run: make build
+        run: go build -v ./...

.golangci.yml

@@ -0,0 +1,38 @@
+run:
+  timeout: 5m
+linters:
+  enable:
+    # Simple linter to check that your code does not contain non-ASCII identifiers.
+    - asciicheck
+    # Go linter that checks if package imports are in a list of acceptable packages.
+    - depguard
+    # Checks for pointers to enclosing loop variables.
+    - exportloopref
+    # Gofmt checks whether code was gofmt-ed
+    - gofmt
+    # Inspects source code for security problems.	
+    - gosec
+    # Finds naked returns in functions greater than a specified function length.
+    - nakedret
+    # Reports ill-formed or insufficient nolint directives.
+    - nolintlint
+    # Checks for dangerous unicode character sequences.
+    - bidichk
+  disable:
+    # ignore errcheck
+    - errcheck
+linters-settings:
+  gosec:
+    # Available rules: https://github.com/securego/gosec#available-rules
+    excludes:
+      - G101	# Look for hard coded credentials
+      - G204	# Audit use of command execution
+      - G401	# Detect the usage of DES, RC4, MD5 or SHA1
+      - G403	# Ensure minimum RSA key length of 2048 bits
+      - G404	# Insecure random number source (rand)
+      - G501	# Import blocklist: crypto/md5
+      - G502	# Import blocklist: crypto/des
+      - G503	# Import blocklist: crypto/rc4
+      - G504	# Import blocklist: net/http/cgi
+      - G505	# Import blocklist: crypto/sha1
+      - G601	# Implicit memory aliasing of items from a range statement

Makefile

@@ -12,12 +12,15 @@ GOENV += GOPROXY=$(GOPROXY)
 GOENV += CC=$(CC)
 GOENV += CGO_ENABLED=1 CGO_LDFLAGS=$(CGO_LDFLAGS)
 GOENV += GOOS=$(GOOS) GOARCH=$(GOARCH)
-
+GOLANGCILINT_VERSION ?= v1.50.0
+GOBIN := $(shell go env GOPATH)/bin
+GOBIN_GOLANGCILINT := $(shell which $(GOBIN)/golangci-lint)
 # go
 GO := go
 
 # output
 OUTPUT := bin/curveadm
+SERVER_OUTPUT := bin/pigeon
 
 # build flags
 LDFLAGS := -s -w
@@ -48,18 +51,33 @@ TEST_FLAGS += -run $(CASE)
 
 # packages
 PACKAGES := $(PWD)/cmd/curveadm/main.go
+SERVER_PACKAGES := $(PWD)/cmd/service/main.go
 
 # tar
 VERSION := "unknown"
 
-build:
+build: fmt vet
 	$(GOENV) $(GO) build -o $(OUTPUT) $(BUILD_FLAGS) $(PACKAGES)
+	$(GOENV) $(GO) build -o $(SERVER_OUTPUT) $(BUILD_FLAGS) $(SERVER_PACKAGES)
+
 
-debug:
+debug: fmt vet
 	$(GOENV) $(GO) build -o $(OUTPUT) $(DEBUG_FLAGS) $(PACKAGES)
+	$(GOENV) $(GO) build -o $(SERVER_OUTPUT) $(DEBUG_FLAGS) $(SERVER_PACKAGES)
+
 
 test:
 	$(GO_TEST) $(TEST_FLAGS) ./...
 
 upload:
 	@NOSCMD=$(NOSCMD) bash build/package/upload.sh $(VERSION)
+
+lint:
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCILINT_VERSION)
+	$(GOBIN_GOLANGCILINT) run -v
+
+fmt:
+	go fmt ./...
+
+vet:
+	go vet ./...

build/package/upload.sh

@@ -5,10 +5,12 @@ g_nos_cmd=${NOSCMD}
 g_root=$(pwd)/.build
 g_curveadm=${g_root}/curveadm
 g_curveadm_bin=${g_curveadm}/bin
+g_curveadm_http_bin=${g_curveadm}/http
 rm -rf ${g_root}
 
-mkdir -p ${g_curveadm_bin}
+mkdir -p ${g_curveadm_bin} ${g_curveadm_http_bin}
 cp bin/curveadm ${g_curveadm_bin}
+cp bin/pigeon ${g_curveadm_http_bin}
 [[ -f .CHANGELOG ]] && cp .CHANGELOG ${g_curveadm}/CHANGELOG
 (cd ${g_curveadm} && ./bin/curveadm -v && ls -ls bin/curveadm && [[ -f CHANGELOG ]] && cat CHANGELOG)
 (cd ${g_root} && tar -zcf curveadm-${g_version}.tar.gz curveadm)