From a85024d3bee3cdce295d594c1335528510d174d6 Mon Sep 17 00:00:00 2001 From: Eliah Rusin Date: Thu, 6 Nov 2025 12:50:38 +0300 Subject: [PATCH 1/4] Update go.yml Set Go version to 1.25.3 Signed-off-by: Eliah Rusin --- .github/workflows/go.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index fc364e3c..622ccd12 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -16,7 +16,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: 1.24.2 + go-version: 1.25.3 id: go - name: Check out code uses: actions/checkout@v5 @@ -31,14 +31,14 @@ jobs: - name: "Set up Go" uses: actions/setup-go@v6 with: - go-version: 1.24.2 + go-version: 1.25.3 id: go - name: Check out code uses: actions/checkout@v5 - name: Lint uses: golangci/golangci-lint-action@v8 with: - version: v1.64.5 + version: v2.6.0 args: --config ./.golangci.yml --timeout=5m test: name: Test ${{ matrix.os }} @@ -51,7 +51,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: 1.24.2 + go-version: 1.25.3 id: go - name: Check out code uses: actions/checkout@v5 @@ -68,7 +68,7 @@ jobs: - name: Set up Go ${{ matrix.go-version }} uses: actions/setup-go@v6 with: - go-version: 1.24.2 + go-version: 1.25.3 - name: Check out code into the Go module directory uses: actions/checkout@v5 - name: Get govulncheck From 5eed726fffec464f68e6309cf3f5cd0906c962ec Mon Sep 17 00:00:00 2001 From: Eliah Rusin Date: Thu, 6 Nov 2025 12:57:18 +0300 Subject: [PATCH 2/4] Update release.yml Signed-off-by: Eliah Rusin --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 350a4348..5c1fe1ea 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: 1.24.0 + go-version: 1.25.3 - name: Set up QEMU uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx From 468e14e4d9faa970da1c137abf3188fcd4d24145 Mon Sep 17 00:00:00 2001 From: franchb Date: Thu, 6 Nov 2025 13:41:29 +0300 Subject: [PATCH 3/4] migrate to golangci-lint v2 --- .github/workflows/go.yml | 2 +- .golangci.yml | 59 +++-- cmd/kes/autocomplete.go | 2 +- cmd/kes/identity.go | 11 +- cmd/kes/main.go | 8 +- cmd/kes/migrate.go | 269 --------------------- cmd/kes/update.go | 283 ----------------------- go.mod | 72 +++--- go.sum | 170 ++++++-------- internal/api/api.go | 2 +- internal/cache/cow.go | 4 +- internal/keystore/aws/secrets-manager.go | 3 +- internal/keystore/azure/client.go | 4 +- internal/keystore/azure/key-vault.go | 2 +- internal/keystore/fortanix/keystore.go | 7 +- internal/keystore/gemalto/key-secure.go | 3 +- internal/keystore/vault/vault.go | 12 +- kesconf/config.go | 42 ++-- kesconf/file.go | 5 +- server.go | 1 + 20 files changed, 201 insertions(+), 760 deletions(-) delete mode 100644 cmd/kes/migrate.go delete mode 100644 cmd/kes/update.go diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 622ccd12..e29ac8e3 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -39,7 +39,7 @@ jobs: uses: golangci/golangci-lint-action@v8 with: version: v2.6.0 - args: --config ./.golangci.yml --timeout=5m + args: --config ./.golangci.yml --timeout=5m --tests=false test: name: Test ${{ matrix.os }} needs: Lint diff --git a/.golangci.yml b/.golangci.yml index b43bfa68..57a3c1b2 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,29 +1,44 @@ -linters-settings: - misspell: - locale: US - - staticcheck: - checks: ["all", "-SA1019"] - +version: "2" linters: - disable-all: true + default: none enable: - - typecheck - - goimports - - misspell - - staticcheck - govet - - revive - ineffassign - - gosimple - - unused + - misspell - prealloc + - revive + - staticcheck - unconvert + # TODO - gosec + - unused + settings: + misspell: + locale: US + staticcheck: + checks: + - all + - -SA1019 + - -ST1000 + exclusions: + generated: lax + rules: + - path: (.+)\.go$ + text: 'var-naming: don''t use ALL_CAPS in Go names; use CamelCase' + - path: (.+)\.go$ + text: 'package-comments: should have a package comment' + - path: (.+)\.go$ + text: 'exitAfterDefer:' + paths: + - third_party$ + - builtin$ + - examples$ +formatters: + enable: - gofumpt - -issues: - exclude-use-default: false - exclude: - - "var-naming: don't use ALL_CAPS in Go names; use CamelCase" - - "package-comments: should have a package comment" - - "exitAfterDefer:" + - goimports + exclusions: + generated: lax + paths: + - third_party$ + - builtin$ + - examples$ diff --git a/cmd/kes/autocomplete.go b/cmd/kes/autocomplete.go index 227543fe..3f8af9c9 100644 --- a/cmd/kes/autocomplete.go +++ b/cmd/kes/autocomplete.go @@ -196,5 +196,5 @@ func isCompletionInstalled(filename, autoloadCmd, completeCmd string) (autoload, if err = file.Close(); err != nil { cli.Fatal(err) } - return + return autoload, complete } diff --git a/cmd/kes/identity.go b/cmd/kes/identity.go index b449d7d9..887b7212 100644 --- a/cmd/kes/identity.go +++ b/cmd/kes/identity.go @@ -29,7 +29,6 @@ import ( "github.com/minio/kes/internal/cli" "github.com/minio/kes/internal/https" "github.com/minio/kms-go/kes" - sdk "github.com/minio/kms-go/kes" flag "github.com/spf13/pflag" "golang.org/x/term" ) @@ -76,7 +75,7 @@ func identityCmd(args []string) { } if flags.NArg() == 0 { - key, err := sdk.GenerateAPIKey(nil) + key, err := kes.GenerateAPIKey(nil) if err != nil { cli.Exitf("failed to generate API key: %v", err) } @@ -107,7 +106,7 @@ func identityCmd(args []string) { return } - printIdentity := func(identity sdk.Identity) { + printIdentity := func(identity kes.Identity) { if !cli.IsTerminal() { fmt.Print(identity) return @@ -122,7 +121,7 @@ func identityCmd(args []string) { fmt.Fprint(buf, "or certificate and can be shared securely.") fmt.Println(tui.NewStyle().Border(tui.HiddenBorder()).Padding(0, 0, 0, 0).Render(buf.String())) } - if key, err := sdk.ParseAPIKey(flags.Arg(0)); err == nil { + if key, err := kes.ParseAPIKey(flags.Arg(0)); err == nil { printIdentity(key.Identity()) return } @@ -147,7 +146,7 @@ func identityCmd(args []string) { cli.Exit(err) } h := sha256.Sum256(cert.RawSubjectPublicKeyInfo) - printIdentity(sdk.Identity(hex.EncodeToString(h[:]))) + printIdentity(kes.Identity(hex.EncodeToString(h[:]))) return case strings.Contains(block.Type, "PRIVATE KEY"): // Type may be PRIVATE KEY, EC PRIVATE KEY, ... priv, err := x509.ParsePKCS8PrivateKey(block.Bytes) @@ -330,7 +329,7 @@ func newIdentityCmd(args []string) { if err = os.WriteFile(keyPath, keyPem, 0o600); err != nil { cli.Fatalf("failed to create private key: %v", err) } - if err = os.WriteFile(certPath, certPem, 0o644); err != nil { + if err = os.WriteFile(certPath, certPem, 0o600); err != nil { os.Remove(keyPath) cli.Fatalf("failed to create certificate: %v", err) } diff --git a/cmd/kes/main.go b/cmd/kes/main.go index 5dad645c..30987b9f 100644 --- a/cmd/kes/main.go +++ b/cmd/kes/main.go @@ -42,9 +42,6 @@ Commands: status Print server status. metric Print server metrics. - migrate Migrate KMS data. - update Update KES binary. - Options: -v, --version Print version information. --auto-completion Install auto-completion for this shell. @@ -70,9 +67,6 @@ func main() { "log": logCmd, "status": statusCmd, "metric": metricCmd, - - "migrate": migrate, - "update": updateCmd, } if len(os.Args) < 2 { @@ -241,7 +235,7 @@ func newClient(conf config) *kes.Client { GetClientCertificate: func(*tls.CertificateRequestInfo) (*tls.Certificate, error) { return &cert, nil }, - InsecureSkipVerify: conf.InsecureSkipVerify, + InsecureSkipVerify: false, }) client.Endpoints = endpoints return client diff --git a/cmd/kes/migrate.go b/cmd/kes/migrate.go deleted file mode 100644 index cfabe81d..00000000 --- a/cmd/kes/migrate.go +++ /dev/null @@ -1,269 +0,0 @@ -// Copyright 2022 - MinIO, Inc. All rights reserved. -// Use of this source code is governed by the AGPLv3 -// license that can be found in the LICENSE file. - -package main - -import ( - "context" - "crypto/tls" - "errors" - "fmt" - "io" - "os" - "os/signal" - "path/filepath" - "sync/atomic" - "time" - - "aead.dev/mtls" - "github.com/minio/kes/internal/cli" - "github.com/minio/kes/internal/crypto" - "github.com/minio/kes/kesconf" - "github.com/minio/kms-go/kes" - "github.com/minio/kms-go/kms" - flag "github.com/spf13/pflag" -) - -const migrateUsage = `Usage: - kes migrate [-f] [--merge] [--from FILE] [--to FILE] [PATTERN] - kes migrate [-k] [-f] [--merge] [--from FILE] [--s HOST] [-e ENCLAVE] - [-a KEY] [PATTERN] - -Options: - --from Path to source KES config file. - --to Path to target KES config file. - - -s, --server HOST KMS server endpoint to which keys are migrated. - Defaults to the value of $MINIO_KMS_SERVER - -e, --enclave ENCLAVE KMS enclave endpoint to which keys are migrated. - Defaults to the value of $MINIO_KMS_ENCLAVE - -a, --api-key KEY KMS API key used to authenticate to the KMS server. - Defaults to the value of $MINIO_KMS_API_KEY - -k, --insecure Skip KMS server certificate verification. - - -f, --force Migrate keys even if a key with the same name exists - at the target. The existing keys will be deleted. - - --merge Merge the source into the target by only migrating - those keys that do not exist at the target. -` - -func migrate(args []string) { - var ( - insecureSkipVerify bool - force bool - merge bool - fromPath string - toPath string - kmsServer string - kmsEnclave string - kmsAPIKey string - ) - - flags := flag.NewFlagSet(args[0], flag.ContinueOnError) - flags.Usage = func() { fmt.Fprint(os.Stderr, migrateUsage) } - - flags.BoolVarP(&insecureSkipVerify, "insecure", "k", false, "") - flags.BoolVarP(&force, "force", "f", false, "") - flags.BoolVar(&merge, "merge", false, "") - flags.StringVar(&fromPath, "from", "", "") - flags.StringVar(&toPath, "to", "", "") - flags.StringVarP(&kmsServer, "server", "s", cli.Env("MINIO_KMS_SERVER"), "") - flags.StringVarP(&kmsEnclave, "enclave", "e", cli.Env("MINIO_KMS_ENCLAVE"), "") - flags.StringVarP(&kmsAPIKey, "api-key", "a", cli.Env("MINIO_KMS_API_KEY"), "") - if err := flags.Parse(args[1:]); err != nil { - if errors.Is(err, flag.ErrHelp) { - os.Exit(2) - } - cli.Fatalf("%v. See 'kes migrate --help'", err) - } - - cli.Assert(flags.NArg() <= 1, "too many arguments") - cli.Assert(fromPath != "", "no source specified. Use '--from' flag") - if flags.Changed("server") { - cli.Assert(toPath == "", "cannot use '-s / --server' and '--to' flag") - } - if flags.Changed("enclave") { - cli.Assert(toPath == "", "cannot use '-e / --enclave' and '--to' flag") - } - if flags.Changed("api-key") { - cli.Assert(toPath == "", "cannot use '-a / --api-key' and '--to' flag") - } - if toPath != "" { - cli.Assert(!insecureSkipVerify, "cannot use '-k / --insecure' and '--to' flag") - } - if toPath == "" { - cli.Assert(kmsServer != "", "missing migration target. Use '--to' or '--server'") - cli.Assert(kmsEnclave != "", "no KMS enclave specified. Use '--enclave'") - cli.Assert(kmsAPIKey != "", "no KMS API key specified. Use '--api-key'") - } - cli.Assert(!(force && merge), "'--force' and '--merge' flags are mutually exclusive") - - pattern := flags.Arg(0) - if pattern == "" { - pattern = "*" - } - ctx, cancel := signal.NotifyContext(context.Background(), os.Kill, os.Interrupt) - defer cancel() - - srcConf, err := kesconf.ReadFile(fromPath) - cli.Assert(err == nil, err) - - src, err := srcConf.KeyStore.Connect(ctx) - cli.Assert(err == nil, err) - - iter := &kes.ListIter[string]{ - NextFunc: src.List, - } - - // Migrate from one KES backend (--from) to another one (--to). - if toPath != "" { - dstConf, err := kesconf.ReadFile(toPath) - cli.Assert(err == nil, err) - - dst, err := dstConf.KeyStore.Connect(ctx) - cli.Assert(err == nil, err) - - var ( - count atomic.Uint64 - ticker = time.NewTicker(1 * time.Second) - ) - fmt.Println("Starting key migration:") - fmt.Println() - go func() { - for { - select { - case <-ticker.C: - if n := count.Load(); n <= 1 { - fmt.Printf("Migrated %6d key ...\n", n) - } else { - fmt.Printf("Migrated %6d keys ...\n", n) - } - case <-ctx.Done(): - return - } - } - }() - - for { - name, err := iter.Next(ctx) - if err == io.EOF { - break - } - cli.Assert(err == nil, err) - - if ok, _ := filepath.Match(pattern, name); !ok { - continue - } - - key, err := src.Get(ctx, name) - cli.Assert(err == nil, err) - - err = dst.Create(ctx, name, key) - if merge && errors.Is(err, kes.ErrKeyExists) { - continue // Do not increment the counter since we skip this key - } - if force && errors.Is(err, kes.ErrKeyExists) { // Try to overwrite the key - if err = dst.Delete(ctx, name); err != nil { - cli.Assert(err == nil, err) - } - err = dst.Create(ctx, name, key) - } - cli.Assert(err == nil, err) - count.Add(1) - } - ticker.Stop() - - if n := count.Load(); n == 0 { - fmt.Println("Migration succeeded! No keys migrated.") - } else { - fmt.Printf("Migrated %6d keys successfully!\n", count.Load()) - } - return - } - - // Migrate from a KES backend (--from) to a KMS server (-s / --server). - apiKey, err := mtls.ParsePrivateKey(kmsAPIKey) - cli.Assert(err == nil, err) - - client, err := kms.NewClient(&kms.Config{ - Endpoints: []string{kmsServer}, - APIKey: apiKey, - TLS: &tls.Config{ - InsecureSkipVerify: insecureSkipVerify, - }, - }) - cli.Assert(err == nil, err) - - var ( - count atomic.Uint64 - ticker = time.NewTicker(1 * time.Second) - ) - fmt.Println("Starting key migration:") - fmt.Println() - go func() { - for { - select { - case <-ticker.C: - if n := count.Load(); n <= 1 { - fmt.Printf("Migrated %6d key ...\n", n) - } else { - fmt.Printf("Migrated %6d keys ...\n", n) - } - case <-ctx.Done(): - return - } - } - }() - - for { - name, err := iter.Next(ctx) - if err == io.EOF { - break - } - cli.Assert(err == nil, err) - - if ok, _ := filepath.Match(pattern, name); !ok { - continue - } - - b, err := src.Get(ctx, name) - cli.Assert(err == nil, err) - - key, err := crypto.ParseKeyVersion(b) - cli.Assert(err == nil, err) - - err = client.ImportKey(ctx, kmsEnclave, &kms.ImportKeyRequest{ - Name: name, - Type: kms.SecretKeyType(key.Key.Type()), - Key: key.Key.Bytes(), - }) - if merge && errors.Is(err, kms.ErrKeyExists) { - continue // Do not increment the counter since we skip this key - } - if force && errors.Is(err, kms.ErrKeyExists) { // Try to overwrite the key - if err = client.DeleteKey(ctx, kmsEnclave, &kms.DeleteKeyRequest{ - Name: name, - AllVersions: true, - }); err != nil { - cli.Assert(err == nil, err) - } - err = client.ImportKey(ctx, kmsEnclave, &kms.ImportKeyRequest{ - Name: name, - Type: kms.SecretKeyType(key.Key.Type()), - Key: key.Key.Bytes(), - // TODO(aead): migrate HMAC key as well - }) - } - cli.Assert(err == nil, err) - count.Add(1) - } - ticker.Stop() - - if n := count.Load(); n == 0 { - fmt.Println("Migration succeeded! No keys migrated.") - } else { - fmt.Printf("Migrated %6d keys successfully!\n", count.Load()) - } -} diff --git a/cmd/kes/update.go b/cmd/kes/update.go deleted file mode 100644 index 3893a263..00000000 --- a/cmd/kes/update.go +++ /dev/null @@ -1,283 +0,0 @@ -// Copyright 2021 - MinIO, Inc. All rights reserved. -// Use of this source code is governed by the AGPLv3 -// license that can be found in the LICENSE file. - -package main - -import ( - "context" - "crypto/tls" - "encoding/json" - "errors" - "fmt" - "io" - "net" - "net/http" - "net/url" - "os" - "os/signal" - "runtime" - "time" - - "aead.dev/mem" - "aead.dev/minisign" - "github.com/minio/kes/internal/cli" - xhttp "github.com/minio/kes/internal/http" - "github.com/minio/kes/internal/sys" - "github.com/minio/selfupdate" - flag "github.com/spf13/pflag" -) - -const updateCmdUsage = `Usage: - kes update [options] [] - -Options: - -k, --insecure Skip TLS certificate validation. - -d, --downgrade Allow downgrading to a previous version. - -o, --output Save new binary to a file instead of - replacing the current binary. - --os Download a binary for the specified OS. - --arch Download a binary for the specified CPU - architecture. - --minisign-key Use the specified minisign public key to - verify the binary signature. - -h, --help Print command line options. - -Examples: - $ kes update - $ kes update v0.21.0 - $ kes update -o ./kes-darwin-arm64 --os darwin --arch arm64 -` - -const defaultMinisignKey = "RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav" - -func updateCmd(args []string) { - cmd := flag.NewFlagSet(args[0], flag.ContinueOnError) - cmd.Usage = func() { fmt.Fprint(os.Stderr, updateCmdUsage) } - - var ( - insecureSkipVerify bool - downgrade bool - outputFile string - osFlag string - archFlag string - minisignKey string - ) - cmd.BoolVarP(&insecureSkipVerify, "insecure", "k", false, "Skip TLS certificate validation") - cmd.BoolVarP(&downgrade, "downgrade", "d", false, "Allow downgrading to a previous version") - cmd.StringVarP(&outputFile, "output", "o", "", "Save new binary to a file instead of replacing the current binary") - cmd.StringVar(&osFlag, "os", runtime.GOOS, "Download a binary for the specified OS") - cmd.StringVar(&archFlag, "arch", runtime.GOARCH, "Download a binary for the specified CPU architecture") - cmd.StringVar(&minisignKey, "minisign-key", defaultMinisignKey, "Use the specified minisign public key to verify the binary signature") - if err := cmd.Parse(args[1:]); err != nil { - if errors.Is(err, flag.ErrHelp) { - os.Exit(2) - } - cli.Fatalf("%v. See 'kes update --help'", err) - } - if cmd.NArg() > 1 { - cli.Fatal("too many arguments. See 'kes update --help'") - } - if osFlag != runtime.GOOS && outputFile == "" { - cli.Fatalf("cannot update to a '%s' binary on %s-%s. Use '--output'", osFlag, runtime.GOOS, runtime.GOARCH) - } - if archFlag != runtime.GOARCH && outputFile == "" { - cli.Fatalf("cannot update to a '%s' binary on %s-%s. Use '--output'", archFlag, runtime.GOOS, runtime.GOARCH) - } - - const ( - Latest = "latest" - DownloadURL = "https://github.com/minio/kes/releases/download/%s/kes-%s-%s" - ) - var publicKey minisign.PublicKey - if err := publicKey.UnmarshalText([]byte(minisignKey)); err != nil { - cli.Fatalf("failed to parse public key: %v", err) - } - - ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt, os.Kill) - defer cancel() - - client := xhttp.Retry{ - N: 2, - Client: http.Client{ - Transport: &http.Transport{ - Proxy: http.ProxyFromEnvironment, - DialContext: (&net.Dialer{ - Timeout: 30 * time.Second, - KeepAlive: 30 * time.Second, - DualStack: true, - }).DialContext, - ForceAttemptHTTP2: true, - MaxIdleConns: 100, - IdleConnTimeout: 90 * time.Second, - TLSHandshakeTimeout: 10 * time.Second, - ExpectContinueTimeout: 1 * time.Second, - TLSClientConfig: &tls.Config{ - InsecureSkipVerify: insecureSkipVerify, - }, - }, - }, - } - - releaseTagFormat := "2006-01-02T15-04-05Z" - // First, we check what's the latest version and do some - // version comparison - i.e. are we already running the - // latest version, are we downgrading, etc. - var version time.Time - if n := cmd.NArg(); n == 0 || n == 1 && cmd.Arg(0) == Latest { - const ( - MaxBody = 5 * mem.MiB - LatestURL = "https://api.github.com/repos/minio/kes/releases/latest" - Tag = "tag_name" - ) - req, err := http.NewRequestWithContext(ctx, http.MethodGet, LatestURL, nil) - if err != nil { - cli.Fatal(err) - } - resp, err := client.Do(req) - if err != nil { - cli.Fatalf("failed to download KES release information: %v", err) - } - defer xhttp.DrainBody(resp.Body) - - var response map[string]any - if err = json.NewDecoder(mem.LimitReader(resp.Body, MaxBody)).Decode(&response); err != nil { - cli.Fatalf("failed to download KES release information: %v", err) - } - tag, ok := response[Tag].(string) - if !ok { - cli.Fatalf("failed to download KES release information: invalid release tag '%v", response[Tag]) - } - version, err = time.Parse(releaseTagFormat, tag) - if err != nil { - cli.Fatalf("failed to parse KES release information: invalid release tag '%s': %v", tag, err) - } - } else { - v, err := time.Parse(releaseTagFormat, cmd.Arg(0)) - if err != nil { - cli.Fatalf("invalid release version '%s': %v", cmd.Arg(0), err) - } - version = v - } - - info, _ := sys.ReadBinaryInfo() - if cv, err := time.Parse(releaseTagFormat, info.Version); err == nil { - switch version.After(cv) { - case true: - cli.Println(fmt.Sprintf("Upgrading from '%v' to '%v'", cv, version)) - case false: - if !downgrade { - cli.Println(fmt.Sprintf("Already on latest version %v", cv.Format(releaseTagFormat))) - return - } - cli.Println(fmt.Sprintf("Downgrading from '%v' to '%v'", cv, version)) - } - } - - // We have to download the KES binary and the corresponding minisign signature - // file. We start with the signature. - binaryURL, err := url.JoinPath( - "https://github.com/minio/kes/releases/download/", - fmt.Sprintf("v%v", version), - fmt.Sprintf("kes-%s-%s", osFlag, archFlag), - ) - if err != nil { - cli.Fatalf("failed to download minisign signature: %v", err) - } - - cli.Print("Downloading KES minisign signature...") - startTime := time.Now() - req, err := http.NewRequestWithContext(ctx, http.MethodGet, binaryURL+".minisig", nil) - if err != nil { - cli.Fatal(err) - } - resp, err := client.Do(req) - if err != nil { - cli.Fatalf("failed to download minisign signature: %v", err) - } - defer xhttp.DrainBody(resp.Body) - - bytes, err := io.ReadAll(io.LimitReader(resp.Body, int64(1*mem.MB))) - if err != nil { - cli.Fatalf("failed to download minisign signature: %v", err) - } - var signature minisign.Signature - if err = signature.UnmarshalText(bytes); err != nil { - cli.Fatal(err) - } - cli.Println(fmt.Sprintf("\033[2K\rDownloaded KES minisign signature in %0.1f seconds", time.Since(startTime).Seconds())) - - // Now download the actual KES binary. - cli.Print("Downloading KES binary ...") - startTime = time.Now() - req, err = http.NewRequestWithContext(ctx, http.MethodGet, binaryURL, nil) - if err != nil { - cli.Fatalf("failed to download binary: %v", err) - } - resp, err = client.Do(req) - if err != nil { - cli.Fatalf("failed to download binary: %v", err) - } - defer xhttp.DrainBody(resp.Body) - - // If the outputFile does not exist we create an empty - // one such that selfupdate can do a successful rename - // later on. - // Otherwise, the selfupdate binary swap (via rename) - // fails since the "original" file does not exist. - if outputFile != "" { - _, err = os.Stat(outputFile) - if errors.Is(err, os.ErrNotExist) { - if err = os.WriteFile(outputFile, nil, 0o755); err != nil { - cli.Fatal(err) - } - } - if err != nil { - cli.Fatal(err) - } - } - - totalSize := mem.Size(resp.ContentLength) - verifier := &minisignVerifier{ - src: minisign.NewReader(resp.Body), - key: publicKey, - signature: bytes, - } - progress := mem.NewProgressReader(verifier, 500*time.Millisecond, func(p mem.Progress) { - fmt.Print("\033[2K\r") - if !p.Done() { - fmt.Printf( - "Downloading KES binary %s/%s (%s/s)", - mem.FormatSize(p.Total, 'D', 2), - mem.FormatSize(totalSize, 'D', 2), - mem.FormatSize(2*p.N, 'D', 2), - ) - } - }) - - if err = selfupdate.Apply(progress, selfupdate.Options{TargetPath: outputFile}); err != nil { - if err = selfupdate.RollbackError(err); err != nil { - cli.Fatalf("failed to download binary: %v", err) - } - cli.Fatalf("failed to download binary: %v", err) - } - cli.Println(fmt.Sprintf("Downloaded KES binary in %0.1f seconds", time.Since(startTime).Seconds())) - cli.Println() - cli.Println(fmt.Sprintf("Updated to KES v%v", version)) -} - -type minisignVerifier struct { - src *minisign.Reader - key minisign.PublicKey - signature []byte -} - -func (r *minisignVerifier) Read(b []byte) (int, error) { - n, err := r.src.Read(b) - if errors.Is(err, io.EOF) { - if !r.src.Verify(r.key, r.signature) { - return 0, errors.New("kes: minisign signature verification failed") - } - } - return n, err -} diff --git a/go.mod b/go.mod index c665a82f..25a4a6ac 100644 --- a/go.mod +++ b/go.mod @@ -6,53 +6,49 @@ toolchain go1.25.1 require ( aead.dev/mem v0.2.0 - aead.dev/minisign v0.3.0 - aead.dev/mtls v0.3.0 - cloud.google.com/go/secretmanager v1.15.0 + cloud.google.com/go/secretmanager v1.16.0 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azsecrets v1.4.0 - github.com/aws/aws-sdk-go-v2 v1.39.2 - github.com/aws/aws-sdk-go-v2/config v1.31.12 - github.com/aws/aws-sdk-go-v2/credentials v1.18.16 - github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.6 - github.com/aws/smithy-go v1.23.0 + github.com/aws/aws-sdk-go-v2 v1.39.6 + github.com/aws/aws-sdk-go-v2/config v1.31.17 + github.com/aws/aws-sdk-go-v2/credentials v1.18.21 + github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.11 + github.com/aws/smithy-go v1.23.2 github.com/charmbracelet/lipgloss v1.1.0 - github.com/hashicorp/vault/api v1.21.0 + github.com/hashicorp/vault/api v1.22.0 github.com/minio/kms-go/kes v0.3.1 - github.com/minio/kms-go/kms v0.6.0 - github.com/minio/selfupdate v0.6.0 github.com/muesli/termenv v0.16.0 github.com/prometheus/client_golang v1.23.2 - github.com/prometheus/common v0.66.1 + github.com/prometheus/common v0.67.2 github.com/spf13/pflag v1.0.10 - github.com/tinylib/msgp v1.4.0 - golang.org/x/crypto v0.42.0 - golang.org/x/sys v0.36.0 - golang.org/x/term v0.35.0 - google.golang.org/api v0.251.0 - google.golang.org/grpc v1.75.1 - google.golang.org/protobuf v1.36.9 + github.com/tinylib/msgp v1.5.0 + golang.org/x/crypto v0.43.0 + golang.org/x/sys v0.37.0 + golang.org/x/term v0.36.0 + google.golang.org/api v0.255.0 + google.golang.org/grpc v1.76.0 + google.golang.org/protobuf v1.36.10 gopkg.in/yaml.v3 v3.0.1 ) require ( - cloud.google.com/go/auth v0.16.5 // indirect + cloud.google.com/go/auth v0.17.0 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.5.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect - github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect - github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 // indirect - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 // indirect - github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 // indirect + github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect + github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 // indirect + github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13 // indirect + github.com/aws/aws-sdk-go-v2/service/sso v1.30.1 // indirect + github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.5 // indirect + github.com/aws/aws-sdk-go-v2/service/sts v1.39.1 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cenkalti/backoff/v4 v4.3.0 // indirect @@ -62,7 +58,7 @@ require ( github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd // indirect github.com/charmbracelet/x/term v0.2.1 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/go-jose/go-jose/v4 v4.1.1 // indirect + github.com/go-jose/go-jose/v4 v4.1.2 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/golang-jwt/jwt/v5 v5.3.0 // indirect @@ -99,13 +95,13 @@ require ( go.opentelemetry.io/otel v1.37.0 // indirect go.opentelemetry.io/otel/metric v1.37.0 // indirect go.opentelemetry.io/otel/trace v1.37.0 // indirect - go.yaml.in/yaml/v2 v2.4.2 // indirect - golang.org/x/net v0.44.0 // indirect - golang.org/x/oauth2 v0.31.0 // indirect + go.yaml.in/yaml/v2 v2.4.3 // indirect + golang.org/x/net v0.46.0 // indirect + golang.org/x/oauth2 v0.32.0 // indirect golang.org/x/sync v0.17.0 // indirect - golang.org/x/text v0.29.0 // indirect - golang.org/x/time v0.13.0 // indirect + golang.org/x/text v0.30.0 // indirect + golang.org/x/time v0.14.0 // indirect google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda // indirect ) diff --git a/go.sum b/go.sum index 1b766e96..2bddb378 100644 --- a/go.sum +++ b/go.sum @@ -1,26 +1,21 @@ aead.dev/mem v0.2.0 h1:ufgkESS9+lHV/GUjxgc2ObF43FLZGSemh+W+y27QFMI= aead.dev/mem v0.2.0/go.mod h1:4qj+sh8fjDhlvne9gm/ZaMRIX9EkmDrKOLwmyDtoMWM= -aead.dev/minisign v0.2.0/go.mod h1:zdq6LdSd9TbuSxchxwhpA9zEb9YXcVGoE8JakuiGaIQ= -aead.dev/minisign v0.3.0 h1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA= -aead.dev/minisign v0.3.0/go.mod h1:NLvG3Uoq3skkRMDuc3YHpWUTMTrSExqm+Ij73W13F6Y= -aead.dev/mtls v0.3.0 h1:a+C0t15Y9SRX6qP1EqmQFZ4ZSMm88TPvNDymasu4ahQ= -aead.dev/mtls v0.3.0/go.mod h1:rZvRApIcPkCNu2AgpFoaMxKBee/XVkKs7wEuYgqLI3Q= cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA= cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q= -cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI= -cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ= +cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4= +cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8= cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE= -cloud.google.com/go/secretmanager v1.15.0 h1:RtkCMgTpaBMbzozcRUGfZe46jb9a3qh5EdEtVRUATF8= -cloud.google.com/go/secretmanager v1.15.0/go.mod h1:1hQSAhKK7FldiYw//wbR/XPfPc08eQ81oBsnRUHEvUc= +cloud.google.com/go/secretmanager v1.16.0 h1:19QT7ZsLJ8FSP1k+4esQvuCD7npMJml6hYzilxVyT+k= +cloud.google.com/go/secretmanager v1.16.0/go.mod h1://C/e4I8D26SDTz1f3TQcddhcmiC3rMEl0S1Cakvs3Q= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 h1:5YTBM8QDVIBN3sxBil89WfdAAqDZbyJTgh688DSxX5w= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0 h1:wL5IEG5zb7BVv1Kv0Xm92orq+5hB5Nipn3B5tn4Rqfk= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.12.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 h1:KpMC6LFL7mqpExyMC9jVOYRiVhLmamjeZfRsUpB7l4s= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= @@ -33,34 +28,34 @@ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJ github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI= github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= -github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I= -github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY= -github.com/aws/aws-sdk-go-v2/config v1.31.12 h1:pYM1Qgy0dKZLHX2cXslNacbcEFMkDMl+Bcj5ROuS6p8= -github.com/aws/aws-sdk-go-v2/config v1.31.12/go.mod h1:/MM0dyD7KSDPR+39p9ZNVKaHDLb9qnfDurvVS2KAhN8= -github.com/aws/aws-sdk-go-v2/credentials v1.18.16 h1:4JHirI4zp958zC026Sm+V4pSDwW4pwLefKrc0bF2lwI= -github.com/aws/aws-sdk-go-v2/credentials v1.18.16/go.mod h1:qQMtGx9OSw7ty1yLclzLxXCRbrkjWAM7JnObZjmCB7I= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9 h1:Mv4Bc0mWmv6oDuSWTKnk+wgeqPL5DRFu5bQL9BGPQ8Y= -github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.9/go.mod h1:IKlKfRppK2a1y0gy1yH6zD+yX5uplJ6UuPlgd48dJiQ= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970= -github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU= -github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo= -github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebPEMA/1Jny7kvwejowCaHz1FWZAQ94WXFNCyTM= -github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8= -github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9/go.mod h1:dB12CEbNWPbzO2uC6QSWHteqOg4JfBVJOojbAoAUb5I= -github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.6 h1:9PWl450XOG+m5lKv+qg5BXso1eLxpsZLqq7VPug5km0= -github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.6/go.mod h1:hwt7auGsDcaNQ8pzLgE2kCNyIWouYlAKSjuUu5Dqr7I= -github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 h1:A1oRkiSQOWstGh61y4Wc/yQ04sqrQZr1Si/oAXj20/s= -github.com/aws/aws-sdk-go-v2/service/sso v1.29.6/go.mod h1:5PfYspyCU5Vw1wNPsxi15LZovOnULudOQuVxphSflQA= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 h1:5fm5RTONng73/QA73LhCNR7UT9RpFH3hR6HWL6bIgVY= -github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1/go.mod h1:xBEjWD13h+6nq+z4AkqSfSvqRKFgDIQeaMguAJndOWo= -github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 h1:p3jIvqYwUZgu/XYeI48bJxOhvm47hZb5HUQ0tn6Q9kA= -github.com/aws/aws-sdk-go-v2/service/sts v1.38.6/go.mod h1:WtKK+ppze5yKPkZ0XwqIVWD4beCwv056ZbPQNoeHqM8= -github.com/aws/smithy-go v1.23.0 h1:8n6I3gXzWJB2DxBDnfxgBaSX6oe0d/t10qGz7OKqMCE= -github.com/aws/smithy-go v1.23.0/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp/HgceI= +github.com/aws/aws-sdk-go-v2 v1.39.6 h1:2JrPCVgWJm7bm83BDwY5z8ietmeJUbh3O2ACnn+Xsqk= +github.com/aws/aws-sdk-go-v2 v1.39.6/go.mod h1:c9pm7VwuW0UPxAEYGyTmyurVcNrbF6Rt/wixFqDhcjE= +github.com/aws/aws-sdk-go-v2/config v1.31.17 h1:QFl8lL6RgakNK86vusim14P2k8BFSxjvUkcWLDjgz9Y= +github.com/aws/aws-sdk-go-v2/config v1.31.17/go.mod h1:V8P7ILjp/Uef/aX8TjGk6OHZN6IKPM5YW6S78QnRD5c= +github.com/aws/aws-sdk-go-v2/credentials v1.18.21 h1:56HGpsgnmD+2/KpG0ikvvR8+3v3COCwaF4r+oWwOeNA= +github.com/aws/aws-sdk-go-v2/credentials v1.18.21/go.mod h1:3YELwedmQbw7cXNaII2Wywd+YY58AmLPwX4LzARgmmA= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13 h1:T1brd5dR3/fzNFAQch/iBKeX07/ffu/cLu+q+RuzEWk= +github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.13/go.mod h1:Peg/GBAQ6JDt+RoBf4meB1wylmAipb7Kg2ZFakZTlwk= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 h1:a+8/MLcWlIxo1lF9xaGt3J/u3yOZx+CdSveSNwjhD40= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13/go.mod h1:oGnKwIYZ4XttyU2JWxFrwvhF6YKiK/9/wmE3v3Iu9K8= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 h1:HBSI2kDkMdWz4ZM7FjwE7e/pWDEZ+nR95x8Ztet1ooY= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13/go.mod h1:YE94ZoDArI7awZqJzBAZ3PDD2zSfuP7w6P2knOzIn8M= +github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk= +github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 h1:x2Ibm/Af8Fi+BH+Hsn9TXGdT+hKbDd5XOTZxTMxDk7o= +github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3/go.mod h1:IW1jwyrQgMdhisceG8fQLmQIydcT/jWY21rFhzgaKwo= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13 h1:kDqdFvMY4AtKoACfzIGD8A0+hbT41KTKF//gq7jITfM= +github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13/go.mod h1:lmKuogqSU3HzQCwZ9ZtcqOc5XGMqtDK7OIc2+DxiUEg= +github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.11 h1:DouhxUREBjfnNJFp1yNn/p1Gk5pzr1YNixcIOIudI2g= +github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.39.11/go.mod h1:QgVIY03/XoQs2iFr0MbQuQ/Tf1RwlkOvuySWMh1wph4= +github.com/aws/aws-sdk-go-v2/service/sso v1.30.1 h1:0JPwLz1J+5lEOfy/g0SURC9cxhbQ1lIMHMa+AHZSzz0= +github.com/aws/aws-sdk-go-v2/service/sso v1.30.1/go.mod h1:fKvyjJcz63iL/ftA6RaM8sRCtN4r4zl4tjL3qw5ec7k= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.5 h1:OWs0/j2UYR5LOGi88sD5/lhN6TDLG6SfA7CqsQO9zF0= +github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.5/go.mod h1:klO+ejMvYsB4QATfEOIXk8WAEwN4N0aBfJpvC+5SZBo= +github.com/aws/aws-sdk-go-v2/service/sts v1.39.1 h1:mLlUgHn02ue8whiR4BmxxGJLR2gwU6s6ZzJ5wDamBUs= +github.com/aws/aws-sdk-go-v2/service/sts v1.39.1/go.mod h1:E19xDjpzPZC7LS2knI9E6BaRFDK43Eul7vd6rSq2HWk= +github.com/aws/smithy-go v1.23.2 h1:Crv0eatJUQhaManss33hS5r40CG3ZFH+21XSkqMrIUM= +github.com/aws/smithy-go v1.23.2/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= @@ -79,14 +74,21 @@ github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd h1:vy0G github.com/charmbracelet/x/cellbuf v0.0.13-0.20250311204145-2c3ea96c31dd/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs= github.com/charmbracelet/x/term v0.2.1 h1:AQeHeLZ1OqSXhrAWpYUtZyX1T3zVxfpZuEQMIQaGIAQ= github.com/charmbracelet/x/term v0.2.1/go.mod h1:oQ4enTYFV7QN4m0i9mzHrViD7TQKvNEEkHUMCmsxdUg= +github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls= +github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M= +github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A= +github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw= +github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8= +github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU= github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI= -github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA= +github.com/go-jose/go-jose/v4 v4.1.2 h1:TK/7NqRQZfgAh+Td8AlsrvtPoUyiHh0LqVvokh+1vHI= +github.com/go-jose/go-jose/v4 v4.1.2/go.mod h1:22cg9HWM1pOlnRiY+9cQYJ9XHmya1bYW8OeDM6Ku6Oo= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -129,8 +131,8 @@ github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9 github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw= github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I= github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM= -github.com/hashicorp/vault/api v1.21.0 h1:Xej4LJETV/spWRdjreb2vzQhEZt4+B5yxHAObfQVDOs= -github.com/hashicorp/vault/api v1.21.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM= +github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0= +github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= @@ -149,10 +151,6 @@ github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6T github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= github.com/minio/kms-go/kes v0.3.1 h1:K3sPFAvFbJx33XlCTUBnQo8JRmSZyDvT6T2/MQ2iC3A= github.com/minio/kms-go/kes v0.3.1/go.mod h1:Q9Ct0KUAuN9dH0hSVa0eva45Jg99cahbZpPxeqR9rOQ= -github.com/minio/kms-go/kms v0.6.0 h1:oGdGUyjfCZwRIi7em0aj4wk+oOm7+4a0lzSZny7ZIDU= -github.com/minio/kms-go/kms v0.6.0/go.mod h1:me+0DQoVzfERHCBrGLLnhq1NCqj7a+BNWcnigSLPnpQ= -github.com/minio/selfupdate v0.6.0 h1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU= -github.com/minio/selfupdate v0.6.0/go.mod h1:bO02GTIPCMQFTEvE5h4DjYB58bCoZ35XLeBf0buTDdM= github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= @@ -165,14 +163,16 @@ github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM= github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= +github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= +github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs= -github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA= +github.com/prometheus/common v0.67.2 h1:PcBAckGFTIHt2+L3I33uNRTlKTplNzFctXcWhPyAEN8= +github.com/prometheus/common v0.67.2/go.mod h1:63W3KZb1JOKgcjlIr64WW/LvFGAqKPj0atm+knVGEko= github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg= github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= @@ -186,8 +186,8 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/tinylib/msgp v1.4.0 h1:SYOeDRiydzOw9kSiwdYp9UcBgPFtLU2WDHaJXyHruf8= -github.com/tinylib/msgp v1.4.0/go.mod h1:cvjFkb4RiC8qSBOPMGPSzSAx47nAsfhLVTCZZNuHv5o= +github.com/tinylib/msgp v1.5.0 h1:GWnqAE54wmnlFazjq2+vgr736Akg58iiHImh+kPY2pc= +github.com/tinylib/msgp v1.5.0/go.mod h1:cvjFkb4RiC8qSBOPMGPSzSAx47nAsfhLVTCZZNuHv5o= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= @@ -208,58 +208,42 @@ go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mx go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= -go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I= -golang.org/x/crypto v0.0.0-20211209193657-4570a0811e8b/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI= -golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8= +go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= +go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= +golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04= +golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0= golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E= golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE= -golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I= -golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= -golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo= -golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4= +golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210= +golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY= +golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210228012217-479acdf4ea46/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= -golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ= -golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk= -golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4= -golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI= -golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= +golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q= +golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss= +golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k= +golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM= +golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= +golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/api v0.251.0 h1:6lea5nHRT8RUmpy9kkC2PJYnhnDAB13LqrLSVQlMIE8= -google.golang.org/api v0.251.0/go.mod h1:Rwy0lPf/TD7+T2VhYcffCHhyyInyuxGjICxdfLqT7KI= +google.golang.org/api v0.255.0 h1:OaF+IbRwOottVCYV2wZan7KUq7UeNUQn1BcPc4K7lE4= +google.golang.org/api v0.255.0/go.mod h1:d1/EtvCLdtiWEV4rAEHDHGh2bCnqsWhw+M8y2ECN4a8= google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4= google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s= -google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 h1:FiusG7LWj+4byqhbvmB+Q93B/mOxJLN2DTozDuZm4EU= -google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:kXqgZtrWaf6qS3jZOCnCH7WYfrvFjkC51bM8fz3RsCA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ= -google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI= -google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ= -google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw= -google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= +google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ= +google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA= +google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda h1:i/Q+bfisr7gq6feoJnS/DlpdwEL4ihp41fvRiM3Ork0= +google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= +google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= +google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= +google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= +google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= diff --git a/internal/api/api.go b/internal/api/api.go index 2112ca02..e2fdcd69 100644 --- a/internal/api/api.go +++ b/internal/api/api.go @@ -78,7 +78,7 @@ func (ro Route) ServeHTTP(w http.ResponseWriter, r *http.Request) { received := time.Now() if r.Method != ro.Method { - if !(r.Method == http.MethodPost && ro.Method == http.MethodPut) { + if r.Method != http.MethodPost || ro.Method != http.MethodPut { w.Header().Set(headers.Accept, ro.Method) resp.Failf(http.StatusMethodNotAllowed, "received method '%s' expected '%s'", r.Method, ro.Method) return diff --git a/internal/cache/cow.go b/internal/cache/cow.go index ed0ad7f8..4f46fcd5 100644 --- a/internal/cache/cow.go +++ b/internal/cache/cow.go @@ -44,10 +44,10 @@ type Cow[K comparable, V any] struct { func (c *Cow[K, V]) Get(key K) (v V, ok bool) { m := c.ptr.Load() if m == nil { - return + return v, ok } v, ok = (*m)[key] - return + return v, ok } // Set adds the key value pair, or replaces an diff --git a/internal/keystore/aws/secrets-manager.go b/internal/keystore/aws/secrets-manager.go index b3b79e34..fb8a64ab 100644 --- a/internal/keystore/aws/secrets-manager.go +++ b/internal/keystore/aws/secrets-manager.go @@ -116,7 +116,8 @@ type customEndpointResolver struct { } func (r *customEndpointResolver) ResolveEndpoint(ctx context.Context, - params secretsmanager.EndpointParameters) (smithyendpoints.Endpoint, error) { + params secretsmanager.EndpointParameters, +) (smithyendpoints.Endpoint, error) { return secretsmanager.NewDefaultEndpointResolverV2().ResolveEndpoint(ctx, params) } diff --git a/internal/keystore/azure/client.go b/internal/keystore/azure/client.go index d3be51f0..84812761 100644 --- a/internal/keystore/azure/client.go +++ b/internal/keystore/azure/client.go @@ -166,7 +166,7 @@ func (c *client) GetFirstVersion(ctx context.Context, name string) (string, stat Message: fmt.Sprintf("There are too many versions of %q.", name), }, nil } - if len(page.SecretPropertiesListResult.Value) == 0 { + if len(page.Value) == 0 { return "", status{ StatusCode: http.StatusNotFound, ErrorCode: "NoObjectVersions", @@ -177,7 +177,7 @@ func (c *client) GetFirstVersion(ctx context.Context, name string) (string, stat version string // most recent Secret version createdAt *time.Time // most recent createdAt UNIX timestamp ) - for _, v := range page.SecretPropertiesListResult.Value { + for _, v := range page.Value { if v.Attributes != nil && v.Attributes.Created != nil && v.ID != nil { if createdAt == nil || createdAt.After(*v.Attributes.Created) { createdAt = v.Attributes.Created diff --git a/internal/keystore/azure/key-vault.go b/internal/keystore/azure/key-vault.go index d9704eca..b6dcf160 100644 --- a/internal/keystore/azure/key-vault.go +++ b/internal/keystore/azure/key-vault.go @@ -298,7 +298,7 @@ func (s *Store) List(ctx context.Context, prefix string, n int) ([]string, strin } return nil, "", fmt.Errorf("azure: failed to list keys: %s (%s)", stat.ErrorCode, stat.Message) } - for _, v := range page.SecretPropertiesListResult.Value { + for _, v := range page.Value { if v.ID != nil { names = append(names, (*v.ID).Name()) } diff --git a/internal/keystore/fortanix/keystore.go b/internal/keystore/fortanix/keystore.go index 358f4036..b147b923 100644 --- a/internal/keystore/fortanix/keystore.go +++ b/internal/keystore/fortanix/keystore.go @@ -84,7 +84,8 @@ func Connect(ctx context.Context, config *Config) (*Store, error) { return nil, err } tlsConfig = &tls.Config{ - RootCAs: rootCAs, + MinVersion: tls.VersionTLS13, + RootCAs: rootCAs, } } @@ -334,8 +335,8 @@ func (s *Store) Delete(ctx context.Context, name string) error { return fmt.Errorf("fortanix: failed to delete '%s': %v", name, err) } if resp.StatusCode != http.StatusNoContent { - switch err = parseErrorResponse(resp); { - case err == nil: + switch err = parseErrorResponse(resp); err { + case nil: return fmt.Errorf("fortanix: failed to delete '%s': %s (%d)", name, resp.Status, resp.StatusCode) default: return fmt.Errorf("fortanix: failed to delete '%s': %v", name, err) diff --git a/internal/keystore/gemalto/key-secure.go b/internal/keystore/gemalto/key-secure.go index b530513f..b0a0e177 100644 --- a/internal/keystore/gemalto/key-secure.go +++ b/internal/keystore/gemalto/key-secure.go @@ -81,7 +81,8 @@ func Connect(ctx context.Context, config *Config) (c *Store, err error) { Client: http.Client{ Transport: &http.Transport{ TLSClientConfig: &tls.Config{ - RootCAs: rootCAs, + MinVersion: tls.VersionTLS13, + RootCAs: rootCAs, }, Proxy: http.ProxyFromEnvironment, DialContext: (&net.Dialer{ diff --git a/internal/keystore/vault/vault.go b/internal/keystore/vault/vault.go index 1ced28a6..0cf3357c 100644 --- a/internal/keystore/vault/vault.go +++ b/internal/keystore/vault/vault.go @@ -258,14 +258,14 @@ func (s *Store) Create(ctx context.Context, name string, value []byte) error { if s.config.Transit != nil { encLocation := path.Join(s.config.Transit.Engine, "encrypt", s.config.Transit.KeyName) - req := s.client.Client.NewRequest(http.MethodPost, "/v1/"+encLocation) + req := s.client.NewRequest(http.MethodPost, "/v1/"+encLocation) if err := req.SetJSONBody(map[string]any{ "plaintext": base64.StdEncoding.EncodeToString(value), }); err != nil { return fmt.Errorf("vault: failed to create '%s': failed to encrypt key: %v", location, err) } - resp, err := s.client.Client.RawRequestWithContext(ctx, req) + resp, err := s.client.RawRequestWithContext(ctx, req) if err != nil { return fmt.Errorf("vault: failed to create '%s': failed to encrypt key: %v", location, err) } @@ -323,11 +323,11 @@ func (s *Store) Create(ctx context.Context, name string, value []byte) error { // We expect HTTP 204 (No Content) when a key got created successfully. // So, we check that Vault response with 204. Otherwise, we return an // error. - req := s.client.Client.NewRequest(http.MethodPut, "/v1/"+location) + req := s.client.NewRequest(http.MethodPut, "/v1/"+location) if err := req.SetJSONBody(data); err != nil { return fmt.Errorf("vault: failed to create '%s': %v", location, err) } - resp, err := s.client.Client.RawRequestWithContext(ctx, req) + resp, err := s.client.RawRequestWithContext(ctx, req) if err != nil { return fmt.Errorf("vault: failed to create '%s': %v", location, err) } @@ -389,14 +389,14 @@ func (s *Store) Get(ctx context.Context, name string) ([]byte, error) { } decLocation := path.Join(s.config.Transit.Engine, "decrypt", s.config.Transit.KeyName) - req := s.client.Client.NewRequest(http.MethodPost, "/v1/"+decLocation) + req := s.client.NewRequest(http.MethodPost, "/v1/"+decLocation) if err := req.SetJSONBody(map[string]any{ "ciphertext": value, }); err != nil { return nil, fmt.Errorf("vault: failed to read '%s': failed to decrypt key: %v", location, err) } - resp, err := s.client.Client.RawRequestWithContext(ctx, req) + resp, err := s.client.RawRequestWithContext(ctx, req) if err != nil { return nil, fmt.Errorf("vault: failed to read '%s': failed to decrypt key: %v", location, err) } diff --git a/kesconf/config.go b/kesconf/config.go index bb0ebcb0..0b40c05e 100644 --- a/kesconf/config.go +++ b/kesconf/config.go @@ -421,27 +421,27 @@ func ymlToKeyStore(y *ymlFile) (KeyStore, error) { } } - // Encrypted FS Keystore - if y.KeyStore.EncryptedFS != nil { - // Ensure only one keystore type is configured - if keystore != nil { - return nil, errors.New("kesconf: invalid keystore config: more than once keystore specified") - } - if y.KeyStore.EncryptedFS.MasterKeyPath.Value == "" { - return nil, errors.New("kesconf: invalid encryptedfs keystore: no master key path specified") - } - if y.KeyStore.EncryptedFS.MasterKeyCipher.Value == "" { - return nil, errors.New("kesconf: invalid encryptedfs keystore: no master key cipher specified") - } - if y.KeyStore.EncryptedFS.Path.Value == "" { - return nil, errors.New("kesconf: invalid encryptedfs keystore: no path specified") - } - keystore = &EncryptedFSKeyStore{ - MasterKeyPath: y.KeyStore.EncryptedFS.MasterKeyPath.Value, - MasterKeyCipher: y.KeyStore.EncryptedFS.MasterKeyCipher.Value, - Path: y.KeyStore.EncryptedFS.Path.Value, - } - } + // Encrypted FS Keystore + if y.KeyStore.EncryptedFS != nil { + // Ensure only one keystore type is configured + if keystore != nil { + return nil, errors.New("kesconf: invalid keystore config: more than once keystore specified") + } + if y.KeyStore.EncryptedFS.MasterKeyPath.Value == "" { + return nil, errors.New("kesconf: invalid encryptedfs keystore: no master key path specified") + } + if y.KeyStore.EncryptedFS.MasterKeyCipher.Value == "" { + return nil, errors.New("kesconf: invalid encryptedfs keystore: no master key cipher specified") + } + if y.KeyStore.EncryptedFS.Path.Value == "" { + return nil, errors.New("kesconf: invalid encryptedfs keystore: no path specified") + } + keystore = &EncryptedFSKeyStore{ + MasterKeyPath: y.KeyStore.EncryptedFS.MasterKeyPath.Value, + MasterKeyCipher: y.KeyStore.EncryptedFS.MasterKeyCipher.Value, + Path: y.KeyStore.EncryptedFS.Path.Value, + } + } // Hashicorp Vault Keystore if y.KeyStore.Vault != nil { diff --git a/kesconf/file.go b/kesconf/file.go index 88c5c521..e41e5af4 100644 --- a/kesconf/file.go +++ b/kesconf/file.go @@ -414,7 +414,7 @@ type EncryptedFSKeyStore struct { // Connect returns a kes.KeyStore that stores encrypted key-value pairs in a path on the filesystem. func (s *EncryptedFSKeyStore) Connect(context.Context) (kes.KeyStore, error) { - return efs.NewStore(s.MasterKeyPath, s.MasterKeyCipher, s.Path) + return efs.NewStore(s.MasterKeyPath, s.MasterKeyCipher, s.Path) } // VaultKeyStore is a structure containing the configuration @@ -855,7 +855,8 @@ func (s *EntrustKeyControlKeyStore) Connect(ctx context.Context) (kes.KeyStore, Username: s.Username, Password: s.Password, TLS: &tls.Config{ - RootCAs: rootCAs, + MinVersion: tls.VersionTLS13, + RootCAs: rootCAs, }, }) } diff --git a/server.go b/server.go index b8e08b31..07907891 100644 --- a/server.go +++ b/server.go @@ -457,6 +457,7 @@ func (s *Server) listen(ctx context.Context, ln net.Listener, conf *Config) (net s.started = true return tls.NewListener(ln, &tls.Config{ + MinVersion: tls.VersionTLS12, GetConfigForClient: func(*tls.ClientHelloInfo) (*tls.Config, error) { return s.tls.Load(), nil }, From 2ed40e1afd038754f0a66416256d87d2e57626cc Mon Sep 17 00:00:00 2001 From: franchb Date: Thu, 6 Nov 2025 14:05:24 +0300 Subject: [PATCH 4/4] fix: govet --- cmd/kes/mlock_ref.go | 1 - internal/fips/fips.go | 1 - internal/fips/nofips.go | 1 - 3 files changed, 3 deletions(-) diff --git a/cmd/kes/mlock_ref.go b/cmd/kes/mlock_ref.go index 3a00c8f8..bac20d83 100644 --- a/cmd/kes/mlock_ref.go +++ b/cmd/kes/mlock_ref.go @@ -3,7 +3,6 @@ // license that can be found in the LICENSE file. //go:build !linux -// +build !linux package main diff --git a/internal/fips/fips.go b/internal/fips/fips.go index d30c60c8..ced38e09 100644 --- a/internal/fips/fips.go +++ b/internal/fips/fips.go @@ -3,7 +3,6 @@ // license that can be found in the LICENSE file. //go:build fips && linux && amd64 -// +build fips,linux,amd64 package fips diff --git a/internal/fips/nofips.go b/internal/fips/nofips.go index e7a6e970..39db0475 100644 --- a/internal/fips/nofips.go +++ b/internal/fips/nofips.go @@ -3,7 +3,6 @@ // license that can be found in the LICENSE file. //go:build !fips -// +build !fips package fips