From 204d5bb1017d8343e8c195d5db93b1d0e8117a0b Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 00:29:27 +0200 Subject: [PATCH 1/9] docs: target v1.0.0 as the first release The documentation called the rewrite the "v2 stack" and announced a "first v2 release", but every module path lacks a `/v2` suffix: under Go's semantic import versioning the go command ignores a `v2.x.y` tag on such a path, so a "v2" release could not be consumed. No tag exists yet (neither on GitHub nor on proxy.golang.org), so the first release of every module is `v1.0.0` and the paths stay as they are. Reword the occurrences accordingly: CLAUDE.md, MIGRATION.md (the breaking-change heading becomes "before the first release"), LIMITATIONS.md, CHANGELOG.md (header; the "Authorization v2" bullet named the stack, not an API version), docs/migration-from-v0.md (v0 to v1) and the oauth2 example. The release-tag guard that enforces v1 comes with the release checklist. Audit: CI-02. --- CHANGELOG.md | 6 +++--- CLAUDE.md | 11 ++++++----- LIMITATIONS.md | 2 +- MIGRATION.md | 7 ++++--- docs/migration-from-v0.md | 19 ++++++++++--------- examples/oauth2/README.md | 2 +- examples/oauth2/main.go | 2 +- 7 files changed, 26 insertions(+), 23 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2cadf552..45d7031a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,8 +5,8 @@ is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html). The library is a multi-module workspace; modules are tagged independently -(`module/vX.Y.Z`). The entries below describe the ground-up rewrite that -replaced the v0 stack. +(`module/vX.Y.Z`), and the first release of every module is `v1.0.0`. The +entries below describe the ground-up rewrite that replaced the v0 stack. ## [Unreleased] @@ -20,7 +20,7 @@ legacy packages (`authentication/`, `authorization/`, the in-tree immutable `Authentication`/`Principal`, `Carrier`, `Extractor`, `Authenticator`, first-success-wins `Manager`, `Engine`, typed `SecurityError` sentinels, and a `Clock` abstraction. -- **Authorization v2**: `Voter`/`Decision`/`Attribute`, an +- **Authorization**: `Voter`/`Decision`/`Attribute`, an `AccessDecisionManager` with Affirmative/Consensus/Unanimous strategies, and a `voter/` catalog (`HasRole`, `HasAnyRole`, `HasScope`, `HasAuthority`, `HasPermission`, `Authenticated`, `Anonymous`, diff --git a/CLAUDE.md b/CLAUDE.md index 549f0943..1ce9da51 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -11,12 +11,13 @@ several independently-releasable modules**, so consumers import only the pieces they need and the core stays free of heavy transitive dependencies. The whole `v0.x` series was replaced by a ground-up transport-agnostic -rewrite (the "v2 stack"); the legacy `authentication/` / `authorization/` -packages were removed. The rewrite is functionally complete and currently -`[Unreleased]` — remaining gaps are tracked as GitHub issues, not refactor +rewrite; the legacy `authentication/` / `authorization/` packages were +removed. The rewrite is functionally complete and currently `[Unreleased]`: +its first release is **v1.0.0** for every module (the module paths carry +no `/vN` suffix). Remaining gaps are tracked as GitHub issues, not refactor phases. Source-of-truth docs: -- `CHANGELOG.md` — what the v2 stack ships. +- `CHANGELOG.md` — what the first release ships. - `MIGRATION.md` — workspace layout and dependency policy. - `LIMITATIONS.md` — known gaps and explicitly out-of-scope items. - `docs/` — `architecture.md`, `oidc-provider.md`, `oidc-client.md`, @@ -263,7 +264,7 @@ mount path of every handler (`AuthorizeHandler`, `UserInfoHandler`, - `docs/oidc-provider.md` is the exact feature matrix (no certification claimed); `internal/interop/oidcop` checks interop with go-oidc. -`examples/oauth2/main.go` is the canonical wiring example for the v2 stack; +`examples/oauth2/main.go` is the canonical wiring example of the library; `examples/oidc-provider` the one for the OpenID Provider (login and consent pages, CSRF, sessions); `examples/` also has `basic-http`, `bearer-jwt`, `grpc-bearer`, `connectrpc-bearer`, `session-web`, `oidc-client` and `saml-sp` demos. diff --git a/LIMITATIONS.md b/LIMITATIONS.md index 11f6fab1..ac61ffb0 100644 --- a/LIMITATIONS.md +++ b/LIMITATIONS.md @@ -1,6 +1,6 @@ # Known limitations -The v2 stack covers HTTP and gRPC transports, HTTP Basic / Bearer schemes, +The library covers HTTP and gRPC transports, HTTP Basic / Bearer schemes, password hashing, JWT, OAuth2 (issuer + resource server), OpenID Connect (provider and relying party), a SAML 2.0 Service Provider, production storage backends, and stateless cookie sessions. This document tracks what is diff --git a/MIGRATION.md b/MIGRATION.md index f30bfe66..f9742fb7 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -161,10 +161,11 @@ for the OIDC client and SAML SP stores), plus one for each in-repo module of its graph, so local development and CI work without published versions. Releases are cut per module with `module/vX.Y.Z` tags. -## Breaking changes before the first v2 release +## Breaking changes before the first release -The v2 stack is not tagged yet, but code tracking `master` may already rely -on its behavior. Each entry below states what changed and how to adapt. +No module is tagged yet (the first release of every module is `v1.0.0`), +but code tracking `master` may already rely on its behavior. Each entry +below states what changed and how to adapt. ### `oauth2`: `/introspect` only answers confidential clients (#81) diff --git a/docs/migration-from-v0.md b/docs/migration-from-v0.md index 95c85ee9..e2be127b 100644 --- a/docs/migration-from-v0.md +++ b/docs/migration-from-v0.md @@ -2,12 +2,13 @@ The v0 stack (`authentication/`, `authorization/`, the in-tree `password` package, and `authentication/provider/oauth2`) was removed during the -refactor. This guide maps the old API to the v2 stack. For the workspace -layout and the new module list see [../MIGRATION.md](../MIGRATION.md). +refactor. This guide maps the old API to the v1 stack (first release: +`v1.0.0`). For the workspace layout and the new module list see +[../MIGRATION.md](../MIGRATION.md). ## Concept mapping -| v0 | v2 | +| v0 | v1 | | ----------------------------------------------- | --------------------------------------------------------- | | `authentication.Credential` (mutable, `any`) | `security.Authentication` (immutable interface) | | `authentication.Filter` / `OnFilter` | `security.Extractor` — `Extract(ctx, Carrier)` | @@ -19,12 +20,12 @@ layout and the new module list see [../MIGRATION.md](../MIGRATION.md). ## Authentication is now immutable -v0 credentials were a mutable bag mutated in place by each filter. v2 +v0 credentials were a mutable bag mutated in place by each filter. v1 `Authentication` is a read-only interface; an authenticator returns a *new* value rather than mutating its input: ```go -// v2 +// v1 func (a *Authenticator) Authenticate(ctx context.Context, auth security.Authentication) (security.Authentication, error) { // …validate… return in.WithAuthenticated(user, authorities), nil // new value @@ -41,7 +42,7 @@ Every runtime operation now takes `context.Context` as its first argument — ## The Handler loop bug is gone v0's `Handler` kept iterating filters after a successful authentication and -silently swallowed provider errors. v2 replaces it with: +silently swallowed provider errors. v1 replaces it with: - `security.Manager` — first-success-wins, then stops; all-fail produces an aggregated error reachable via `errors.Is`. @@ -53,7 +54,7 @@ silently swallowed provider errors. v2 replaces it with: ## Password verification reports errors v0's `Verify` returned a bare `bool`, conflating "wrong password" with -"malformed hash". v2: +"malformed hash". v1: ```go ok, err := hasher.Verify(ctx, encodedHash, password) @@ -77,7 +78,7 @@ mux.Handle("/admin", httpsec.Authorize(adm, security.Role("ADMIN"))(adminHandler ## OAuth2: provider split into issuer and resource server v0's `NewOAuth2AuthenticationProvider` mixed token issuance and token -validation. v2 separates them: +validation. v1 separates them: - **Authorization server** — `oauth2.NewServer(cfg)` exposes `TokenHandler`, `RevokeHandler`, `IntrospectHandler`, `MetadataHandler`. @@ -89,6 +90,6 @@ and the [examples/](../examples) directory for the other per-scenario demos. ## Transport imports -The v0 example imported `gorilla/mux`. v2 examples use the standard +The v0 example imported `gorilla/mux`. v1 examples use the standard `net/http.ServeMux` — no third-party router is required, and none is a dependency of any module. diff --git a/examples/oauth2/README.md b/examples/oauth2/README.md index a9801efb..c1a584bf 100644 --- a/examples/oauth2/README.md +++ b/examples/oauth2/README.md @@ -1,6 +1,6 @@ # OAuth2 server + Bearer resource server -End-to-end wiring of the v2 security library running in a single binary: +End-to-end wiring of the security library running in a single binary: - an OAuth2 authorization server exposing `/oauth2/authorize`, `/oauth2/token`, `/oauth2/revoke`, `/oauth2/introspect`, and diff --git a/examples/oauth2/main.go b/examples/oauth2/main.go index 791db672..359af41c 100644 --- a/examples/oauth2/main.go +++ b/examples/oauth2/main.go @@ -2,7 +2,7 @@ // Use of this source code is governed by a MIT // license that can be found in the LICENSE file. -// Package main demonstrates wiring of the v2 security library: an OAuth2 +// Package main demonstrates wiring of the security library: an OAuth2 // authorization server (authorization_code with PKCE, client_credentials, // refresh_token) plus a resource server protected by a bearer middleware // sharing the same storage as the auth server. From 5cdb2b00a56d9a498598d483d0c760b94cc7f172 Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 00:35:22 +0200 Subject: [PATCH 2/9] test(outbound): tie the gzip-bomb precondition to the response cap TestResponseSizeLimit/gzip_bomb_counted_after_decompression checked that 8 MiB of zeros compress to fewer than 16 KiB before serving them. Go 1.27 changed the compress/flate encoder output and the payload now compresses to 16,438 bytes, so the test fails on every Go 1.27 toolchain (CI hid it by running go1.26.5). The bound was arbitrary. What the case relies on is that the bytes on the wire stay under Policy.MaxResponseBytes (64 KiB here), so only the decompressed size can trip the cap. Assert exactly that, once the policy is built; the ErrResponseTooLarge assertion is unchanged. Mutation check: making outbound count the compressed wire bytes (no transparent decompression, limiter before gzip.NewReader) makes the test fail with "Expected error ... response body too large ... but got nil". Audit: DEP-01. --- outbound/client_test.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/outbound/client_test.go b/outbound/client_test.go index b5c9025e..b56df248 100644 --- a/outbound/client_test.go +++ b/outbound/client_test.go @@ -630,7 +630,6 @@ func TestResponseSizeLimit(t *testing.T) { zw := gzip.NewWriter(&compressed) _, _ = zw.Write(make([]byte, 8<<20)) require.NoError(t, zw.Close()) - require.Less(t, compressed.Len(), capBytes*16) s := newServer(t, true, func(w http.ResponseWriter, r *http.Request) { require.Contains(t, r.Header.Get("Accept-Encoding"), "gzip") @@ -640,6 +639,11 @@ func TestResponseSizeLimit(t *testing.T) { p := loopbackPolicy(s) p.MaxResponseBytes = 64 * capBytes + // The bytes on the wire stay under the cap: only the decompressed + // size can exceed it. (The exact gzip output size depends on the Go + // release: 8 MiB of zeros compress to 16,438 bytes with Go 1.27.) + require.Less(t, int64(compressed.Len()), p.MaxResponseBytes) + resp, err := get(t, mustClient(t, p), s.URL) require.NoError(t, err) From ed20697c56feb2d8d63d72e9debb5c248d8cd9ac Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 00:43:34 +0200 Subject: [PATCH 3/9] build: pin the development tools in one module each, generate mocks The core module declared `tool github.com/vektra/mockery/v2`, which put mockery and ~45 tool modules (cobra, viper, zerolog, x/tools, ...) into the module graph of every consumer: one importing only the core resolved 50 modules. The tool was also unusable: `.mockery.yaml` uses mockery v3 syntax. And `make lint` piped an unpinned install script (`curl .../golangci-lint/HEAD/install.sh | sh`). Pin each tool in its own module, outside go.work, so that no tool dependency reaches a library go.mod and each tool builds with exactly the dependency set its upstream tests: - tools/golangci-lint: v2.14.0 (Go 1.27 support; built with x/tools v0.50.0, upstream's); - tools/govulncheck: golang.org/x/vuln v1.9.0; - tools/mockery: v3.8.1 (reads Go 1.27.2 export data). `make tools` installs them into build/bin, checksum-verified by each module's go.sum. The core now resolves 22 modules for a consumer. mockery is kept and used, and its output is never committed: `make generate` writes in-package mock__test.go files (testify template), which exist only in test binaries, so no library build sees them and every module builds with GOWORK=off without them. test, lint, vuln, bench and tidy generate first; stale generated files are removed. Dependabot and `go mod tidy` never generate mocks, so every module that gets mocks keeps a mockery_test.go importing testify/mock: go.mod and go.sum stay identical with or without them (objx becomes an indirect requirement; checked with GOWORK=off build, vet and tidy -diff on all 25 modules, with 58 mocks generated and with none). The oidc/provider import policy allows testify/mock in tests. Add `make vuln` (govulncheck -test on every module, GOWORK=off) and make `make tidy` sync, tidy every module and tool, then sync again. Audit: DEP-03, CI-01. --- .mockery.yaml | 14 +- CHANGELOG.md | 17 + CLAUDE.md | 34 +- LIMITATIONS.md | 8 - MIGRATION.md | 35 +- Makefile | 64 +- README.md | 4 +- basic/go.mod | 1 + basic/go.sum | 2 + basic/mockery_test.go | 11 + bearer/go.mod | 1 + bearer/go.sum | 2 + bearer/mockery_test.go | 11 + connectrpc/go.mod | 1 + connectrpc/go.sum | 2 + connectrpc/mockery_test.go | 11 + examples/go.sum | 2 + generate.go | 3 - go.mod | 33 +- go.sum | 74 -- grpc/go.mod | 1 + grpc/go.sum | 2 + grpc/mockery_test.go | 11 + http/go.mod | 1 + http/go.sum | 2 + http/mockery_test.go | 11 + internal/integrations/go.sum | 2 + internal/interop/oidcop/go.sum | 2 + internal/interop/oidcrp/go.mod | 1 + internal/interop/oidcrp/go.sum | 2 + internal/interop/oidcstack/go.sum | 2 + internal/interop/saml/go.sum | 2 + jwt/go.mod | 1 + jwt/go.sum | 2 + jwt/mockery_test.go | 11 + mockery_test.go | 11 + oauth2/go.mod | 1 + oauth2/go.sum | 2 + oauth2/mockery_test.go | 11 + oauth2/store/redis/go.sum | 2 + oauth2/store/sql/go.mod | 3 + oauth2/store/sql/go.sum | 2 + oauth2/store/sql/mockery_test.go | 11 + oidc/client/go.mod | 1 + oidc/client/go.sum | 2 + oidc/client/mockery_test.go | 11 + oidc/client/store/redis/go.sum | 2 + oidc/client/store/sql/go.mod | 3 + oidc/client/store/sql/go.sum | 2 + oidc/client/store/sql/mockery_test.go | 11 + oidc/provider/deps_test.go | 8 +- oidc/provider/go.mod | 1 + oidc/provider/go.sum | 2 + oidc/provider/mockery_test.go | 11 + password/go.mod | 5 +- password/go.sum | 2 + password/mockery_test.go | 11 + saml/sp/go.mod | 1 + saml/sp/go.sum | 2 + saml/sp/mockery_test.go | 11 + saml/sp/store/redis/go.sum | 2 + saml/sp/store/sql/go.mod | 3 + saml/sp/store/sql/go.sum | 2 + saml/sp/store/sql/mockery_test.go | 11 + session/go.mod | 1 + session/go.sum | 2 + session/mockery_test.go | 11 + tools/golangci-lint/go.mod | 219 ++++++ tools/golangci-lint/go.sum | 977 ++++++++++++++++++++++++++ tools/govulncheck/go.mod | 14 + tools/govulncheck/go.sum | 22 + tools/mockery/go.mod | 44 ++ tools/mockery/go.sum | 109 +++ 73 files changed, 1769 insertions(+), 160 deletions(-) create mode 100644 basic/mockery_test.go create mode 100644 bearer/mockery_test.go create mode 100644 connectrpc/mockery_test.go delete mode 100644 generate.go create mode 100644 grpc/mockery_test.go create mode 100644 http/mockery_test.go create mode 100644 jwt/mockery_test.go create mode 100644 mockery_test.go create mode 100644 oauth2/mockery_test.go create mode 100644 oauth2/store/sql/mockery_test.go create mode 100644 oidc/client/mockery_test.go create mode 100644 oidc/client/store/sql/mockery_test.go create mode 100644 oidc/provider/mockery_test.go create mode 100644 password/mockery_test.go create mode 100644 saml/sp/mockery_test.go create mode 100644 saml/sp/store/sql/mockery_test.go create mode 100644 session/mockery_test.go create mode 100644 tools/golangci-lint/go.mod create mode 100644 tools/golangci-lint/go.sum create mode 100644 tools/govulncheck/go.mod create mode 100644 tools/govulncheck/go.sum create mode 100644 tools/mockery/go.mod create mode 100644 tools/mockery/go.sum diff --git a/.mockery.yaml b/.mockery.yaml index 97a955a6..0611757b 100644 --- a/.mockery.yaml +++ b/.mockery.yaml @@ -1,7 +1,13 @@ +# mockery v3, pinned in tools/mockery and run by `make generate` (CI runs it +# before build, test and lint). Mocks are in-package mock__test.go +# files: they exist only in test binaries, never in a library build, and are +# never committed (.gitignore: mock_*). Every module whose packages get mocks +# keeps a mockery_test.go importing testify/mock, so its go.mod and go.sum are +# the same with or without them. all: true dir: '{{.InterfaceDir}}' -filename: 'mock_{{.InterfaceName | snakecase}}.go' -structname: Mock{{.InterfaceName}} +filename: 'mock_{{.InterfaceName | snakecase}}_test.go' +structname: 'Mock{{.InterfaceName}}' pkgname: '{{.SrcPackageName}}' inpackage: true template: testify @@ -11,3 +17,7 @@ packages: github.com/hyperscale-stack/security: config: recursive: true + # Library packages only: the examples and the private test modules need + # no mocks, and the tool modules are not part of the workspace. + exclude-subpkg-regex: + - '^github\.com/hyperscale-stack/security/(examples|internal|tools)(/|$)' diff --git a/CHANGELOG.md b/CHANGELOG.md index 45d7031a..03bc3f1e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -514,6 +514,20 @@ legacy packages (`authentication/`, `authorization/`, the in-tree `ErrTransactionIntegrity`. `Config` and `*Client` now print and log without the client secret and the keys, whatever the `fmt` verb. The example reads `OIDC_TRANSACTION_KEYS`. See [MIGRATION.md](MIGRATION.md). +- **Development tools in their own modules**: golangci-lint (v2.14.0, Go + 1.27 support), govulncheck (v1.9.0) and mockery (v3.8.1) are pinned in one + module each under `tools/`, outside `go.work`. The core module no longer + declares the mockery `tool` directive: a consumer importing only the core + now resolves 22 modules instead of 50 (no mockery, cobra, viper, zerolog or + `x/tools`). `make lint` builds golangci-lint from its pinned module instead + of piping an unpinned install script (`curl …/HEAD/install.sh | sh`). +- **Mocks are generated, never committed**: `make generate` (mockery v3, + testify template) writes in-package `mock__test.go` files, which + exist only in test binaries; `make test`/`lint`/`vuln`/`tidy` and CI run it + first. New tests use them for interface doubles. A module that gets mocks + keeps a `mockery_test.go` importing `testify/mock`, so its `go.mod` is the + same with or without them (`github.com/stretchr/objx` becomes an indirect + requirement). ### Fixed @@ -585,6 +599,9 @@ legacy packages (`authentication/`, `authorization/`, the in-tree escape is a malformed header); credentials made of unreserved characters are unaffected. The empty-credential guard applies to the decoded values. See [MIGRATION.md](MIGRATION.md). +- `make generate` works again: `.mockery.yaml` used mockery v3 syntax while + the pinned tool was v2, and mockery needs a Go 1.27-aware `x/tools` to load + the packages (v3.8.1). ### Removed diff --git a/CLAUDE.md b/CLAUDE.md index 1ce9da51..1bdbf491 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -54,13 +54,15 @@ All targets operate on **every module in the workspace** (discovered via ```sh make build # go build ./... in every module -make test # go test -race -cover in every module, aggregated -> build/coverage.out -make lint # golangci-lint (shared .golangci.yml) on every module -make tidy # go mod tidy per module + go work sync +make generate # mockery mocks (in-package mock_*_test.go, never committed), see "Tooling caveats" +make test # generate, then go test -race -cover in every module, aggregated -> build/coverage.out +make lint # golangci-lint (pinned in tools/golangci-lint, shared .golangci.yml) on every module +make vuln # govulncheck -test on every module, outside the workspace +make tools # build the pinned tools (tools/) into build/bin +make tidy # go work sync + go mod tidy per module (and tools/*) + go work sync make sync # go work sync make bench # benchmarks across all modules make coverage # go tool cover -func on the aggregated profile -make generate # mockery — currently BROKEN, see "Tooling caveats" below make e2e # opt-in browser suites (Tales + Chrome: e2e/saml, e2e/oidc), never in CI make e2e-oidc # only the OIDC one (make e2e-saml: only the SAML one) make conformance # opt-in: the OpenID Foundation suite against oidc/provider and oidc/client (Docker, OIDF_SUITE_DIR) @@ -367,11 +369,25 @@ by response content). ## Tooling caveats -- **`make generate` is broken**: `.mockery.yaml` uses mockery v3 syntax but - `go.mod` pins the v2 tool (`vektra/mockery v2.53.5`). No module depends on - generated mocks — **all tests use hand-written fakes**. Don't rely on - `make generate`; write a fake. -- **Lint**: `golangci-lint v2`, `default: none` + ~30 explicitly-enabled +- **Mocks**: `make generate` runs mockery v3 (pinned in `tools/mockery`, + configured by `.mockery.yaml`). Every interface of the library packages + gets an in-package `mock__test.go` (`Mock`, testify + template, `EXPECT()` API). These files exist only in test binaries, are + **never committed** (`.gitignore`: `mock_*`) and are regenerated by + `make generate`, which `make test`/`lint`/`vuln`/`tidy` and CI run first. + Use them for interface doubles in new tests; migrate a hand-written fake + when you touch its test (no big-bang rewrite). A module whose packages get + mocks keeps a `mockery_test.go` that imports `testify/mock`, so its + `go.mod`/`go.sum` are the same with or without generated mocks (Dependabot + and `go mod tidy` never generate them). Every module builds with + `GOWORK=off` without them; only its tests need them. +- **Tools**: one module per tool under `tools/` (golangci-lint, govulncheck, + mockery), outside `go.work`, so their dependencies never reach a library + `go.mod` and each tool builds with exactly its own tested dependency set. + `make tools` installs them into `build/bin` (checksum-verified by each + tool's `go.sum`). Bump one with + `cd tools/ && GOWORK=off go get -tool @`. +- **Lint**: `golangci-lint` v2.14.0, `default: none` + ~30 explicitly-enabled linters including `gosec`, `wrapcheck`, `errorlint`, `wsl_v5`, `forcetypeassert`. `gocyclo` max complexity 18. Tests are excluded from lint (`run.tests: false`). All wrapped errors must keep `%w`. diff --git a/LIMITATIONS.md b/LIMITATIONS.md index ac61ffb0..b75223df 100644 --- a/LIMITATIONS.md +++ b/LIMITATIONS.md @@ -327,14 +327,6 @@ PKCE. Not supported, and refused where a provider could select them: holding them) the raw code and tokens they carry during issuance: never log them. -## Tooling - -- `.mockery.yaml` targets mockery v3 syntax while the tool pinned in the - module is still v2. `make generate` therefore fails until the config and - the tool pin are reconciled; CI skips `make generate`. No module relies on - generated mocks — every test uses hand-written fakes — so this is not on - the critical path. - ## Not planned - **`HTTPDigestFilter` (RFC 7616)** — Digest auth is effectively dead; it diff --git a/MIGRATION.md b/MIGRATION.md index f9742fb7..0fbf0b22 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -49,9 +49,14 @@ the `saml/sp` module. The legacy v0 packages (`authentication/`, `authentication/credential/`, `authentication/provider/{dao,oauth2}/`, `authorization/`, and the old -in-tree `password`) were removed during the rewrite. The core module now -depends only on stdlib + `go.opentelemetry.io/otel` (+ `testify` for its -own tests). +in-tree `password`) were removed during the rewrite. The core module's +non-test imports are now stdlib + `go.opentelemetry.io/otel`; its tests also +use `testify` and `otel/sdk`. + +`tools/golangci-lint`, `tools/govulncheck` and `tools/mockery` are not +library modules: each pins one development tool, outside `go.work`, so the +tools' dependencies never reach a library `go.mod` or a consumer's module +graph. They are never released. ## Dependency policy @@ -110,9 +115,12 @@ and `golang.org/x/oauth2` are not dependencies of any production module (see the package documentation of `oidc/client` for the evaluation). The core MUST NOT depend on: gRPC, ConnectRPC, JWT/JOSE libs, OAuth2, Redis, -SQL drivers, HTTP routers, or concrete loggers. Its direct dependency set is exactly -stdlib + `go.opentelemetry.io/otel` (+ `stretchr/testify` scoped to its own -tests). The policy is enforced by review. `oauth2` never imports OIDC or JOSE: +SQL drivers, HTTP routers, or concrete loggers. Its non-test imports are +exactly stdlib + `go.opentelemetry.io/otel`; its tests also use +`stretchr/testify` (with `stretchr/objx` behind the generated testify mocks) +and `otel/sdk`. No development tool is a dependency of any library module: +the tools live in their own modules under `tools/`. The policy is enforced by +review. `oauth2` never imports OIDC or JOSE: `oidc/provider` plugs into its extension points, and imports no relying-party library, store driver or template engine (`TestDependencyPolicy`). go-oidc and x/oauth2 are confined to the test-only `internal/interop/oidcop` module, @@ -132,14 +140,19 @@ and Chrome; it adds no Go dependency. ```sh make sync # go work sync make build # build all modules -make test # race + coverage, aggregated into build/coverage.out -make lint # golangci-lint on every module with the shared config -make tidy # go mod tidy on every module + go work sync +make generate # mockery mocks: in-package mock_*_test.go files, never committed +make test # generate, then race + coverage, aggregated into build/coverage.out +make lint # golangci-lint (tools/golangci-lint) on every module with the shared config +make vuln # govulncheck -test on every module, outside the workspace +make tidy # go work sync + go mod tidy on every module and tool + go work sync make e2e # opt-in browser suites (Tales + Chrome), never run by CI ``` -The `Makefile` discovers modules dynamically via `find . -name go.mod`, so a -new sub-module is picked up automatically as soon as its `go.mod` lands. +The `Makefile` discovers modules dynamically via `find . -name go.mod` +(except the tool modules under `tools/`), so a new sub-module is picked up +automatically as soon as its `go.mod` lands. The tools (golangci-lint, +govulncheck, mockery) are built from their pinned modules into `build/bin` +on first use; mocks are generated before anything that compiles tests. Example program lines are excluded from the aggregated coverage profile (their `main()` is not unit-testable); the examples are still built, tested, and linted. diff --git a/Makefile b/Makefile index 79518668..fa639e77 100644 --- a/Makefile +++ b/Makefile @@ -1,21 +1,36 @@ BUILD_DIR := build +BIN_DIR := $(CURDIR)/$(BUILD_DIR)/bin LINT_CONFIG := $(CURDIR)/.golangci.yml -# All Go modules in the workspace, derived from go.work to stay in sync. +# All Go modules of the workspace: every go.mod but the tool modules under +# tools/, which are not part of go.work. # Note: the leading "./" is required for find -execdir / cd targets. -MODULES := $(shell find . -name go.mod -not -path '*/vendor/*' -not -path '*/node_modules/*' -not -path '*/build/*' | sort | sed 's|/go.mod||') +MODULES := $(shell find . -name go.mod -not -path '*/vendor/*' -not -path '*/node_modules/*' -not -path '*/build/*' -not -path './tools/*' | sort | sed 's|/go.mod||') + +# Development tools: one module per tool under tools/, outside the +# workspace so that their dependencies never reach a library go.mod, each +# pinned and checksum-verified by its own go.mod and go.sum. +TOOLS := golangci-lint govulncheck mockery .PHONY: all all: test .PHONY: clean -clean: +clean: clean-mocks @rm -rf $(BUILD_DIR) @for mod in $(MODULES); do (cd "$$mod" && go clean -i ./...); done _build: @mkdir -p $(BUILD_DIR) +.PHONY: tools +tools: $(addprefix $(BIN_DIR)/,$(TOOLS)) + +$(BIN_DIR)/%: tools/%/go.mod tools/%/go.sum + @echo "==> install $*" + @GOWORK=off GOBIN=$(BIN_DIR) go install -C tools/$* tool + @touch $@ + .PHONY: sync sync: @echo "Syncing workspace..." @@ -28,13 +43,21 @@ build: (cd "$$mod" && go build -v ./...) || exit 1; \ done +# Mocks (.mockery.yaml): in-package mock__test.go files, so they +# only exist in test binaries; never committed. The targets that compile +# tests generate them first; stale generated files are removed beforehand. .PHONY: generate -generate: +generate: $(BIN_DIR)/mockery clean-mocks @echo "Generating mocks..." - @go generate ./... + @$(BIN_DIR)/mockery --log-level=warn + +.PHONY: clean-mocks +clean-mocks: + @find . -name 'mock_*_test.go' -not -path './build/*' -type f \ + -exec grep -q '^// Code generated by mockery' {} \; -delete .PHONY: test -test: _build +test: _build generate @: > $(BUILD_DIR)/coverage.out @for mod in $(MODULES); do \ echo "==> test $$mod"; \ @@ -63,20 +86,24 @@ coverage-html: $(BUILD_DIR)/coverage.out @go tool cover -html ./$(BUILD_DIR)/coverage.out .PHONY: bench -bench: +bench: generate @for mod in $(MODULES); do \ echo "==> bench $$mod"; \ (cd "$$mod" && go test -bench=. -benchmem -benchtime=5s -timeout 300s ./...) || exit 1; \ done .PHONY: lint -lint: -ifeq (, $(shell which golangci-lint)) - @echo "Install golangci-lint..." - @curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/HEAD/install.sh \ - | sh -s -- -b $$(go env GOPATH)/bin v2.12.2 -endif - @go list -f '{{.Dir}}/...' -m | xargs golangci-lint run --timeout=300s --config="$(LINT_CONFIG)" +lint: generate $(BIN_DIR)/golangci-lint + @go list -f '{{.Dir}}/...' -m | xargs $(BIN_DIR)/golangci-lint run --timeout=300s --config="$(LINT_CONFIG)" + +# govulncheck on every module, outside the workspace (each module's own +# requirements: what a consumer resolves), tests included. +.PHONY: vuln +vuln: generate $(BIN_DIR)/govulncheck + @for mod in $(MODULES); do \ + echo "==> govulncheck $$mod"; \ + (cd "$$mod" && GOWORK=off $(BIN_DIR)/govulncheck -test ./...) || exit 1; \ + done # Opt-in browser suites (Tales and Chrome, prerequisites in docs/saml-sp.md # and e2e/oidc/run.sh): never part of `make test` nor of CI. @@ -105,10 +132,15 @@ e2e-oidc-live: @./e2e/oidc-live/run.sh .PHONY: tidy -tidy: +tidy: generate + @go work sync @for mod in $(MODULES); do \ echo "==> tidy $$mod"; \ - (cd "$$mod" && go mod tidy) || exit 1; \ + (cd "$$mod" && GOWORK=off go mod tidy) || exit 1; \ + done + @for tool in $(TOOLS); do \ + echo "==> tidy tools/$$tool"; \ + (cd "tools/$$tool" && GOWORK=off go mod tidy) || exit 1; \ done @go work sync diff --git a/README.md b/README.md index f67a2f07..af69d5ae 100644 --- a/README.md +++ b/README.md @@ -106,8 +106,10 @@ mux.Handle("/admin", httpsec.Authorize(adm, security.Role("ADMIN"))(adminHandler ```sh make sync # go work sync make build # build every module +make generate # mockery mocks for the tests (never committed; test/lint/vuln run it first) make test # race + coverage -make lint # golangci-lint with the shared config +make lint # golangci-lint with the shared config (pinned in tools/golangci-lint) +make vuln # govulncheck on every module make e2e # opt-in browser suites (Tales and Chrome: docs/saml-sp.md, e2e/oidc/run.sh) make conformance # opt-in: the OpenID Foundation conformance suite, locally (docs/oidc-conformance.md) ``` diff --git a/basic/go.mod b/basic/go.mod index a6707d72..6288fece 100644 --- a/basic/go.mod +++ b/basic/go.mod @@ -12,6 +12,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect diff --git a/basic/go.sum b/basic/go.sum index 58623e7c..3e023e98 100644 --- a/basic/go.sum +++ b/basic/go.sum @@ -9,6 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/basic/mockery_test.go b/basic/mockery_test.go new file mode 100644 index 00000000..529f4d1d --- /dev/null +++ b/basic/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package basic_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/bearer/go.mod b/bearer/go.mod index f7377944..449e81cc 100644 --- a/bearer/go.mod +++ b/bearer/go.mod @@ -11,6 +11,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect diff --git a/bearer/go.sum b/bearer/go.sum index 4e2960b0..ab6a3c68 100644 --- a/bearer/go.sum +++ b/bearer/go.sum @@ -9,6 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/bearer/mockery_test.go b/bearer/mockery_test.go new file mode 100644 index 00000000..1489c507 --- /dev/null +++ b/bearer/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package bearer_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/connectrpc/go.mod b/connectrpc/go.mod index f6e5fdfe..e704af8b 100644 --- a/connectrpc/go.mod +++ b/connectrpc/go.mod @@ -13,6 +13,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect diff --git a/connectrpc/go.sum b/connectrpc/go.sum index 5d39ac64..5331e606 100644 --- a/connectrpc/go.sum +++ b/connectrpc/go.sum @@ -11,6 +11,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/connectrpc/mockery_test.go b/connectrpc/mockery_test.go new file mode 100644 index 00000000..e2b9f0b8 --- /dev/null +++ b/connectrpc/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package connectrpcsec_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/examples/go.sum b/examples/go.sum index 37e83c05..24ed515a 100644 --- a/examples/go.sum +++ b/examples/go.sum @@ -30,6 +30,8 @@ github.com/russellhaering/gosaml2 v0.12.0/go.mod h1:txFBNgTGPBhdtNqMo+XR5YPqavMy github.com/russellhaering/goxmldsig v1.6.1 h1:SB7R5ttvrGIDB2juJAK/i7DQ2Ivr7agG+ohfNJjwyYU= github.com/russellhaering/goxmldsig v1.6.1/go.mod h1:haZkRcLs9W/Xp989fIjP3BrTdbFQveRF0QNZSYoH09w= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= diff --git a/generate.go b/generate.go deleted file mode 100644 index 2049949b..00000000 --- a/generate.go +++ /dev/null @@ -1,3 +0,0 @@ -package security - -//go:generate go tool mockery diff --git a/go.mod b/go.mod index 87b930a8..221a00d6 100644 --- a/go.mod +++ b/go.mod @@ -11,44 +11,13 @@ require ( require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/chigopher/pathlib v0.19.1 // indirect - github.com/fsnotify/fsnotify v1.8.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-viper/mapstructure/v2 v2.2.1 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/huandu/xstrings v1.4.0 // indirect - github.com/iancoleman/strcase v0.3.0 // indirect - github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/jinzhu/copier v0.4.0 // indirect - github.com/mattn/go-colorable v0.1.14 // indirect - github.com/mattn/go-isatty v0.0.24 // indirect - github.com/mitchellh/go-homedir v1.1.0 // indirect - github.com/mitchellh/mapstructure v1.5.0 // indirect - github.com/pelletier/go-toml/v2 v2.2.3 // indirect - github.com/rogpeppe/go-internal v1.15.0 // indirect - github.com/rs/zerolog v1.35.1 // indirect - github.com/sagikazarmark/locafero v0.7.0 // indirect - github.com/sourcegraph/conc v0.3.0 // indirect - github.com/spf13/afero v1.12.0 // indirect - github.com/spf13/cast v1.7.1 // indirect - github.com/spf13/cobra v1.8.1 // indirect - github.com/spf13/pflag v1.0.6 // indirect - github.com/spf13/viper v1.20.0 // indirect - github.com/subosito/gotenv v1.6.0 // indirect - github.com/vektra/mockery/v2 v2.53.5 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect - go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/mod v0.41.0 // indirect - golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect - golang.org/x/term v0.47.0 // indirect - golang.org/x/text v0.43.0 // indirect - golang.org/x/tools v0.51.0 // indirect - gopkg.in/yaml.v3 v3.0.1 // indirect ) - -tool github.com/vektra/mockery/v2 diff --git a/go.sum b/go.sum index acb77055..5cffc89c 100644 --- a/go.sum +++ b/go.sum @@ -1,75 +1,18 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/chigopher/pathlib v0.19.1 h1:RoLlUJc0CqBGwq239cilyhxPNLXTK+HXoASGyGznx5A= -github.com/chigopher/pathlib v0.19.1/go.mod h1:tzC1dZLW8o33UQpWkNkhvPwL5n4yyFRFm/jL1YGWFvY= -github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= -github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= -github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M= -github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss= -github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU= -github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= -github.com/iancoleman/strcase v0.3.0 h1:nTXanmYxhfFAMjZL34Ov6gkzEsSJZ5DbhxWjvSASxEI= -github.com/iancoleman/strcase v0.3.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho= -github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= -github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8= -github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg= -github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= -github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= -github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= -github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= -github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= -github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= -github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= -github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= -github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= -github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= -github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M= -github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc= -github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY7EJ6hc= -github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs= -github.com/rs/zerolog v1.35.1 h1:m7xQeoiLIiV0BCEY4Hs+j2NG4Gp2o2KPKmhnnLiazKI= -github.com/rs/zerolog v1.35.1/go.mod h1:EjML9kdfa/RMA7h/6z6pYmq1ykOuA8/mjWaEvGI+jcw= -github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/sagikazarmark/locafero v0.7.0 h1:5MqpDsTGNDhY8sGp0Aowyf0qKsPrhewaLSsFaodPcyo= -github.com/sagikazarmark/locafero v0.7.0/go.mod h1:2za3Cg5rMaTMoG/2Ulr9AwtFaIppKXTRYnozin4aB5k= -github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo= -github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0= -github.com/spf13/afero v1.12.0 h1:UcOPyRBYczmFn6yvphxkn9ZEOY65cpwGKb5mL36mrqs= -github.com/spf13/afero v1.12.0/go.mod h1:ZTlWwG4/ahT8W7T0WQ5uYmjI9duaLQGy3Q2OAl4sk/4= -github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y= -github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo= -github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM= -github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y= -github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o= -github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/viper v1.20.0 h1:zrxIyR3RQIOsarIrgL8+sAvALXul9jeEPa06Y0Ph6vY= -github.com/spf13/viper v1.20.0/go.mod h1:P9Mdzt1zoHIG8m2eZQinpiBjo6kCmZSKBClNNqjJvu4= github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= -github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= -github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= -github.com/vektra/mockery/v2 v2.53.5 h1:iktAY68pNiMvLoHxKqlSNSv/1py0QF/17UGrrAMYDI8= -github.com/vektra/mockery/v2 v2.53.5/go.mod h1:hIFFb3CvzPdDJJiU7J4zLRblUMv7OuezWsHPmswriwo= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= @@ -86,24 +29,7 @@ go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrF go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= -go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= -golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= -golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= -golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= -golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= -golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= -golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= -golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= -gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/grpc/go.mod b/grpc/go.mod index f6c81523..6ea5129d 100644 --- a/grpc/go.mod +++ b/grpc/go.mod @@ -13,6 +13,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect diff --git a/grpc/go.sum b/grpc/go.sum index 63d5d7c4..e01b76a1 100644 --- a/grpc/go.sum +++ b/grpc/go.sum @@ -11,6 +11,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/grpc/mockery_test.go b/grpc/mockery_test.go new file mode 100644 index 00000000..f9652e9c --- /dev/null +++ b/grpc/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package grpcsec_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/http/go.mod b/http/go.mod index 861c5ac3..345560ae 100644 --- a/http/go.mod +++ b/http/go.mod @@ -14,6 +14,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect diff --git a/http/go.sum b/http/go.sum index 4e2960b0..ab6a3c68 100644 --- a/http/go.sum +++ b/http/go.sum @@ -9,6 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/http/mockery_test.go b/http/mockery_test.go new file mode 100644 index 00000000..dac8e67c --- /dev/null +++ b/http/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package httpsec_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/internal/integrations/go.sum b/internal/integrations/go.sum index 4e2960b0..ab6a3c68 100644 --- a/internal/integrations/go.sum +++ b/internal/integrations/go.sum @@ -9,6 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/internal/interop/oidcop/go.sum b/internal/interop/oidcop/go.sum index 2908dc57..386ae1c5 100644 --- a/internal/interop/oidcop/go.sum +++ b/internal/interop/oidcop/go.sum @@ -13,6 +13,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/internal/interop/oidcrp/go.mod b/internal/interop/oidcrp/go.mod index 84a4639e..b1ec99c3 100644 --- a/internal/interop/oidcrp/go.mod +++ b/internal/interop/oidcrp/go.mod @@ -24,6 +24,7 @@ require ( github.com/kr/text v0.2.0 // indirect github.com/muhlemmer/gu v0.3.1 // indirect github.com/muhlemmer/httpforwarded v0.1.0 // indirect + github.com/rogpeppe/go-internal v1.15.0 // indirect github.com/rs/cors v1.11.1 // indirect github.com/zitadel/schema v1.3.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect diff --git a/internal/interop/oidcrp/go.sum b/internal/interop/oidcrp/go.sum index d467a7e3..a4d79dd9 100644 --- a/internal/interop/oidcrp/go.sum +++ b/internal/interop/oidcrp/go.sum @@ -40,6 +40,8 @@ github.com/rogpeppe/go-internal v1.15.0 h1:D0RCU5rMAp+SpgkiNdrjfJ+LX4J1M32V2NeCY github.com/rogpeppe/go-internal v1.15.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/zitadel/oidc/v3 v3.51.14 h1:gVuKmazBpMLv92Rzjfc+/gYOf3ZwUe70whbowfHsnbM= diff --git a/internal/interop/oidcstack/go.sum b/internal/interop/oidcstack/go.sum index f12db0ca..b249dd37 100644 --- a/internal/interop/oidcstack/go.sum +++ b/internal/interop/oidcstack/go.sum @@ -44,6 +44,8 @@ github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmB github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= diff --git a/internal/interop/saml/go.sum b/internal/interop/saml/go.sum index 5a783b25..720b85d1 100644 --- a/internal/interop/saml/go.sum +++ b/internal/interop/saml/go.sum @@ -62,6 +62,8 @@ github.com/russellhaering/gosaml2 v0.12.0/go.mod h1:txFBNgTGPBhdtNqMo+XR5YPqavMy github.com/russellhaering/goxmldsig v1.6.1 h1:SB7R5ttvrGIDB2juJAK/i7DQ2Ivr7agG+ohfNJjwyYU= github.com/russellhaering/goxmldsig v1.6.1/go.mod h1:haZkRcLs9W/Xp989fIjP3BrTdbFQveRF0QNZSYoH09w= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= diff --git a/jwt/go.mod b/jwt/go.mod index 23281686..e49168d8 100644 --- a/jwt/go.mod +++ b/jwt/go.mod @@ -21,6 +21,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect diff --git a/jwt/go.sum b/jwt/go.sum index b7a44e89..b01556e6 100644 --- a/jwt/go.sum +++ b/jwt/go.sum @@ -11,6 +11,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/jwt/mockery_test.go b/jwt/mockery_test.go new file mode 100644 index 00000000..9e78d1c0 --- /dev/null +++ b/jwt/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package jwtsec_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/mockery_test.go b/mockery_test.go new file mode 100644 index 00000000..1dabee51 --- /dev/null +++ b/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package security_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/oauth2/go.mod b/oauth2/go.mod index 560916af..5aa73f79 100644 --- a/oauth2/go.mod +++ b/oauth2/go.mod @@ -11,6 +11,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect diff --git a/oauth2/go.sum b/oauth2/go.sum index 4e2960b0..ab6a3c68 100644 --- a/oauth2/go.sum +++ b/oauth2/go.sum @@ -9,6 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/oauth2/mockery_test.go b/oauth2/mockery_test.go new file mode 100644 index 00000000..d54c4183 --- /dev/null +++ b/oauth2/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package oauth2_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/oauth2/store/redis/go.sum b/oauth2/store/redis/go.sum index d2a24501..124f1a5d 100644 --- a/oauth2/store/redis/go.sum +++ b/oauth2/store/redis/go.sum @@ -19,6 +19,8 @@ github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV91 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU= github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s= github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= diff --git a/oauth2/store/sql/go.mod b/oauth2/store/sql/go.mod index 68cd7972..0b5a9f86 100644 --- a/oauth2/store/sql/go.mod +++ b/oauth2/store/sql/go.mod @@ -18,13 +18,16 @@ require ( github.com/mattn/go-isatty v0.0.24 // indirect github.com/ncruces/go-strftime v1.0.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect go.opentelemetry.io/otel/trace v1.47.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect + golang.org/x/tools v0.51.0 // indirect modernc.org/libc v1.77.1 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.12.1 // indirect diff --git a/oauth2/store/sql/go.sum b/oauth2/store/sql/go.sum index 27bbe768..3c9f3841 100644 --- a/oauth2/store/sql/go.sum +++ b/oauth2/store/sql/go.sum @@ -21,6 +21,8 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/oauth2/store/sql/mockery_test.go b/oauth2/store/sql/mockery_test.go new file mode 100644 index 00000000..e4d7fc61 --- /dev/null +++ b/oauth2/store/sql/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package sqlstore_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/oidc/client/go.mod b/oidc/client/go.mod index 0ba29be2..6c8f6879 100644 --- a/oidc/client/go.mod +++ b/oidc/client/go.mod @@ -14,6 +14,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect diff --git a/oidc/client/go.sum b/oidc/client/go.sum index b7a44e89..b01556e6 100644 --- a/oidc/client/go.sum +++ b/oidc/client/go.sum @@ -11,6 +11,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/oidc/client/mockery_test.go b/oidc/client/mockery_test.go new file mode 100644 index 00000000..0a69eebf --- /dev/null +++ b/oidc/client/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package oidcclient_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/oidc/client/store/redis/go.sum b/oidc/client/store/redis/go.sum index e5b0ac4b..23aea53e 100644 --- a/oidc/client/store/redis/go.sum +++ b/oidc/client/store/redis/go.sum @@ -21,6 +21,8 @@ github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV91 github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU= github.com/redis/go-redis/v9 v9.23.0 h1:/TTVdJa8BRNsybwwGGnmiYktHNlUXtbOQxlWpHBPL3s= github.com/redis/go-redis/v9 v9.23.0/go.mod h1:EWP2UUk+XDaI1s5nQB5mablZN6vccXlmBQTyfnF87D0= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M= diff --git a/oidc/client/store/sql/go.mod b/oidc/client/store/sql/go.mod index 219530eb..ae31ae8c 100644 --- a/oidc/client/store/sql/go.mod +++ b/oidc/client/store/sql/go.mod @@ -19,13 +19,16 @@ require ( github.com/mattn/go-isatty v0.0.24 // indirect github.com/ncruces/go-strftime v1.0.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect go.opentelemetry.io/otel/trace v1.47.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect + golang.org/x/tools v0.51.0 // indirect modernc.org/libc v1.77.1 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.12.1 // indirect diff --git a/oidc/client/store/sql/go.sum b/oidc/client/store/sql/go.sum index 42f18635..f1805d90 100644 --- a/oidc/client/store/sql/go.sum +++ b/oidc/client/store/sql/go.sum @@ -23,6 +23,8 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/oidc/client/store/sql/mockery_test.go b/oidc/client/store/sql/mockery_test.go new file mode 100644 index 00000000..e4d7fc61 --- /dev/null +++ b/oidc/client/store/sql/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package sqlstore_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/oidc/provider/deps_test.go b/oidc/provider/deps_test.go index 2aa864e6..d57514f6 100644 --- a/oidc/provider/deps_test.go +++ b/oidc/provider/deps_test.go @@ -21,8 +21,9 @@ const repo = "github.com/hyperscale-stack/security" // TestDependencyPolicy pins the allowed dependencies of the package // (doc.go): the standard library without its template engines, the core, // oauth2 without its stores, and jwt — go-jose stays behind jwt, and no -// relying-party module or store driver comes in. Tests may add testify and -// the oauth2 building blocks of a server. +// relying-party module or store driver comes in. Tests may add testify +// (testify/mock for the mocks `make generate` writes) and the oauth2 +// building blocks of a server. func TestDependencyPolicy(t *testing.T) { t.Parallel() @@ -65,7 +66,8 @@ func productionImport(path string) bool { func testImport(path string) bool { switch path { case repo + "/oidc/provider", repo + "/oauth2/storage/memory", repo + "/oauth2/grant", repo + "/oauth2/token", - repo + "/oauth2/clientauth", "github.com/stretchr/testify/assert", "github.com/stretchr/testify/require": + repo + "/oauth2/clientauth", "github.com/stretchr/testify/assert", "github.com/stretchr/testify/require", + "github.com/stretchr/testify/mock": return true default: return productionImport(path) diff --git a/oidc/provider/go.mod b/oidc/provider/go.mod index 5a16d7a8..76c26e88 100644 --- a/oidc/provider/go.mod +++ b/oidc/provider/go.mod @@ -23,6 +23,7 @@ require ( github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/hyperscale-stack/security/bearer v0.0.0-00010101000000-000000000000 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect diff --git a/oidc/provider/go.sum b/oidc/provider/go.sum index b7a44e89..b01556e6 100644 --- a/oidc/provider/go.sum +++ b/oidc/provider/go.sum @@ -11,6 +11,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/oidc/provider/mockery_test.go b/oidc/provider/mockery_test.go new file mode 100644 index 00000000..d2bb01b5 --- /dev/null +++ b/oidc/provider/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package oidcprovider_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/password/go.mod b/password/go.mod index af4ff6d2..f6c72f40 100644 --- a/password/go.mod +++ b/password/go.mod @@ -4,7 +4,10 @@ go 1.26.0 require golang.org/x/crypto v0.58.0 -require go.yaml.in/yaml/v3 v3.0.5 // indirect +require ( + github.com/stretchr/objx v0.5.3 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect +) require ( github.com/stretchr/testify v1.12.1 diff --git a/password/go.sum b/password/go.sum index b6b1bfca..7f56f720 100644 --- a/password/go.sum +++ b/password/go.sum @@ -1,3 +1,5 @@ +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= diff --git a/password/mockery_test.go b/password/mockery_test.go new file mode 100644 index 00000000..57af815e --- /dev/null +++ b/password/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package password_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/saml/sp/go.mod b/saml/sp/go.mod index 2d830cd1..fd254d7c 100644 --- a/saml/sp/go.mod +++ b/saml/sp/go.mod @@ -22,6 +22,7 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/google/uuid v1.6.0 // indirect github.com/jonboulle/clockwork v0.5.0 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect diff --git a/saml/sp/go.sum b/saml/sp/go.sum index aec7ebbb..4be9f9dd 100644 --- a/saml/sp/go.sum +++ b/saml/sp/go.sum @@ -22,6 +22,8 @@ github.com/russellhaering/gosaml2 v0.12.0/go.mod h1:txFBNgTGPBhdtNqMo+XR5YPqavMy github.com/russellhaering/goxmldsig v1.6.1 h1:SB7R5ttvrGIDB2juJAK/i7DQ2Ivr7agG+ohfNJjwyYU= github.com/russellhaering/goxmldsig v1.6.1/go.mod h1:haZkRcLs9W/Xp989fIjP3BrTdbFQveRF0QNZSYoH09w= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= diff --git a/saml/sp/mockery_test.go b/saml/sp/mockery_test.go new file mode 100644 index 00000000..f55faaf5 --- /dev/null +++ b/saml/sp/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package samlsp_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/saml/sp/store/redis/go.sum b/saml/sp/store/redis/go.sum index 176d7965..072b42f9 100644 --- a/saml/sp/store/redis/go.sum +++ b/saml/sp/store/redis/go.sum @@ -32,6 +32,8 @@ github.com/russellhaering/gosaml2 v0.12.0/go.mod h1:txFBNgTGPBhdtNqMo+XR5YPqavMy github.com/russellhaering/goxmldsig v1.6.1 h1:SB7R5ttvrGIDB2juJAK/i7DQ2Ivr7agG+ohfNJjwyYU= github.com/russellhaering/goxmldsig v1.6.1/go.mod h1:haZkRcLs9W/Xp989fIjP3BrTdbFQveRF0QNZSYoH09w= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= diff --git a/saml/sp/store/sql/go.mod b/saml/sp/store/sql/go.mod index 3e5a1d4b..5e4329f1 100644 --- a/saml/sp/store/sql/go.mod +++ b/saml/sp/store/sql/go.mod @@ -27,13 +27,16 @@ require ( github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect github.com/russellhaering/gosaml2 v0.12.0 // indirect github.com/russellhaering/goxmldsig v1.6.1 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect go.opentelemetry.io/otel/trace v1.47.0 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect + golang.org/x/tools v0.51.0 // indirect modernc.org/libc v1.77.1 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.12.1 // indirect diff --git a/saml/sp/store/sql/go.sum b/saml/sp/store/sql/go.sum index b7fd2eb4..c7bf04d9 100644 --- a/saml/sp/store/sql/go.sum +++ b/saml/sp/store/sql/go.sum @@ -34,6 +34,8 @@ github.com/russellhaering/gosaml2 v0.12.0/go.mod h1:txFBNgTGPBhdtNqMo+XR5YPqavMy github.com/russellhaering/goxmldsig v1.6.1 h1:SB7R5ttvrGIDB2juJAK/i7DQ2Ivr7agG+ohfNJjwyYU= github.com/russellhaering/goxmldsig v1.6.1/go.mod h1:haZkRcLs9W/Xp989fIjP3BrTdbFQveRF0QNZSYoH09w= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= diff --git a/saml/sp/store/sql/mockery_test.go b/saml/sp/store/sql/mockery_test.go new file mode 100644 index 00000000..e4d7fc61 --- /dev/null +++ b/saml/sp/store/sql/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package sqlstore_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/session/go.mod b/session/go.mod index b621f46a..f4030a93 100644 --- a/session/go.mod +++ b/session/go.mod @@ -12,6 +12,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/stretchr/objx v0.5.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect diff --git a/session/go.sum b/session/go.sum index 4e2960b0..ab6a3c68 100644 --- a/session/go.sum +++ b/session/go.sum @@ -9,6 +9,8 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= diff --git a/session/mockery_test.go b/session/mockery_test.go new file mode 100644 index 00000000..91e59f65 --- /dev/null +++ b/session/mockery_test.go @@ -0,0 +1,11 @@ +// Copyright 2026 Hyperscale. All rights reserved. +// Use of this source code is governed by a MIT +// license that can be found in the LICENSE file. + +package session_test + +// `make generate` writes this module's mockery mocks as in-package +// mock_*_test.go files, which are never committed. They import testify/mock: +// importing it here too keeps go.mod and go.sum identical whether or not the +// mocks have been generated (go mod tidy, Dependabot). +import _ "github.com/stretchr/testify/mock" diff --git a/tools/golangci-lint/go.mod b/tools/golangci-lint/go.mod new file mode 100644 index 00000000..139d79e7 --- /dev/null +++ b/tools/golangci-lint/go.mod @@ -0,0 +1,219 @@ +module github.com/hyperscale-stack/security/tools/golangci-lint + +go 1.27.2 + +tool github.com/golangci/golangci-lint/v2/cmd/golangci-lint + +require ( + 4d63.com/gocheckcompilerdirectives v1.4.0 // indirect + 4d63.com/gochecknoglobals v0.2.2 // indirect + charm.land/lipgloss/v2 v2.0.6 // indirect + codeberg.org/chavacava/garif v0.2.1 // indirect + codeberg.org/polyfloyd/go-errorlint v1.9.0 // indirect + dev.gaijin.team/go/exhaustruct/v4 v4.0.0 // indirect + dev.gaijin.team/go/exhaustruct/v5 v5.2.0 // indirect + dev.gaijin.team/go/golib v0.8.1 // indirect + github.com/4meepo/tagalign v1.4.4 // indirect + github.com/Abirdcfly/dupword v0.1.8 // indirect + github.com/AdminBenni/iota-mixing v1.0.0 // indirect + github.com/AlwxSin/noinlineerr v1.0.6 // indirect + github.com/Antonboom/errname v1.1.2 // indirect + github.com/Antonboom/nilnil v1.1.2 // indirect + github.com/Antonboom/testifylint v1.6.4 // indirect + github.com/BurntSushi/toml v1.6.0 // indirect + github.com/ClickHouse/clickhouse-go-linter v1.2.1 // indirect + github.com/Djarvur/go-err113 v0.1.1 // indirect + github.com/Masterminds/semver/v3 v3.5.0 // indirect + github.com/MirrexOne/unqueryvet v1.5.4 // indirect + github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect + github.com/alecthomas/chroma/v2 v2.27.0 // indirect + github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 // indirect + github.com/alexkohler/nakedret/v2 v2.0.6 // indirect + github.com/alexkohler/prealloc v1.1.0 // indirect + github.com/alfatraining/structtag v1.0.0 // indirect + github.com/alingse/asasalint v0.0.11 // indirect + github.com/alingse/nilnesserr v0.2.0 // indirect + github.com/ashanbrown/forbidigo/v2 v2.3.1 // indirect + github.com/ashanbrown/makezero/v2 v2.2.1 // indirect + github.com/beorn7/perks v1.0.1 // indirect + github.com/bkielbasa/cyclop v1.2.3 // indirect + github.com/blizzy78/varnamelen v0.8.0 // indirect + github.com/bombsimon/wsl/v4 v4.7.0 // indirect + github.com/bombsimon/wsl/v5 v5.9.0 // indirect + github.com/breml/bidichk v0.3.3 // indirect + github.com/breml/errchkjson v0.4.1 // indirect + github.com/butuzov/ireturn v0.4.1 // indirect + github.com/butuzov/mirror v1.3.3 // indirect + github.com/catenacyber/perfsprint v0.10.1 // indirect + github.com/ccojocar/zxcvbn-go v1.0.4 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect + github.com/charithe/durationcheck v0.0.11 // indirect + github.com/charmbracelet/colorprofile v0.4.3 // indirect + github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 // indirect + github.com/charmbracelet/x/ansi v0.11.8 // indirect + github.com/charmbracelet/x/term v0.2.2 // indirect + github.com/charmbracelet/x/termios v0.1.1 // indirect + github.com/charmbracelet/x/windows v0.2.2 // indirect + github.com/ckaznocha/intrange v0.3.1 // indirect + github.com/clipperhouse/displaywidth v0.11.0 // indirect + github.com/clipperhouse/uax29/v2 v2.7.0 // indirect + github.com/curioswitch/go-reassign v0.3.0 // indirect + github.com/daixiang0/gci v0.13.7 // indirect + github.com/dave/dst v0.27.3 // indirect + github.com/denis-tingaikin/go-header v0.5.0 // indirect + github.com/dlclark/regexp2/v2 v2.2.1 // indirect + github.com/ettle/strcase v0.2.0 // indirect + github.com/fatih/color v1.19.0 // indirect + github.com/fatih/structtag v1.2.0 // indirect + github.com/firefart/nonamedreturns v1.0.8 // indirect + github.com/fsnotify/fsnotify v1.9.0 // indirect + github.com/fzipp/gocyclo v0.6.0 // indirect + github.com/ghostiam/protogetter v1.0.1 // indirect + github.com/go-critic/go-critic v0.15.0 // indirect + github.com/go-toolsmith/astcast v1.1.0 // indirect + github.com/go-toolsmith/astcopy v1.1.0 // indirect + github.com/go-toolsmith/astequal v1.2.0 // indirect + github.com/go-toolsmith/astfmt v1.1.0 // indirect + github.com/go-toolsmith/astp v1.1.0 // indirect + github.com/go-toolsmith/strparse v1.1.0 // indirect + github.com/go-toolsmith/typep v1.1.0 // indirect + github.com/go-viper/mapstructure/v2 v2.5.0 // indirect + github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect + github.com/gobwas/glob v0.2.3 // indirect + github.com/godoc-lint/godoc-lint v0.11.4 // indirect + github.com/gofrs/flock v0.13.1 // indirect + github.com/golang/protobuf v1.5.3 // indirect + github.com/golangci/asciicheck v0.5.0 // indirect + github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 // indirect + github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 // indirect + github.com/golangci/go-printf-func-name v0.1.1 // indirect + github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 // indirect + github.com/golangci/golangci-lint/v2 v2.14.0 // indirect + github.com/golangci/golines v0.15.0 // indirect + github.com/golangci/misspell v0.8.0 // indirect + github.com/golangci/plugin-module-register v0.1.2 // indirect + github.com/golangci/revgrep v0.8.0 // indirect + github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba // indirect + github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e // indirect + github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e // indirect + github.com/google/go-cmp v0.7.0 // indirect + github.com/gordonklaus/ineffassign v0.2.0 // indirect + github.com/gostaticanalysis/analysisutil v0.7.1 // indirect + github.com/gostaticanalysis/comment v1.5.0 // indirect + github.com/gostaticanalysis/forcetypeassert v0.2.0 // indirect + github.com/gostaticanalysis/nilerr v0.1.2 // indirect + github.com/hashicorp/go-immutable-radix/v2 v2.1.0 // indirect + github.com/hashicorp/go-version v1.9.0 // indirect + github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect + github.com/hashicorp/hcl v1.0.0 // indirect + github.com/hexops/gotextdiff v1.0.3 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect + github.com/jgautheron/goconst v1.11.0 // indirect + github.com/jjti/go-spancheck v0.6.5 // indirect + github.com/julz/importas v0.2.0 // indirect + github.com/karamaru-alpha/copyloopvar v1.2.2 // indirect + github.com/kisielk/errcheck v1.20.0 // indirect + github.com/kkHAIKE/contextcheck v1.1.6 // indirect + github.com/kulti/thelper v0.7.1 // indirect + github.com/kunwardeep/paralleltest v1.0.15 // indirect + github.com/ldez/exptostd v0.4.5 // indirect + github.com/ldez/gomoddirectives v0.10.0 // indirect + github.com/ldez/grignotin v0.10.1 // indirect + github.com/ldez/structtags v0.6.1 // indirect + github.com/ldez/tagliatelle v0.8.0 // indirect + github.com/ldez/usetesting v0.5.0 // indirect + github.com/leonklingele/grouper v1.1.2 // indirect + github.com/lucasb-eyer/go-colorful v1.4.1 // indirect + github.com/macabu/inamedparam v0.2.0 // indirect + github.com/magiconair/properties v1.8.6 // indirect + github.com/manuelarte/embeddedstructfieldcheck v0.4.0 // indirect + github.com/manuelarte/funcorder v0.6.0 // indirect + github.com/maratori/testableexamples v1.0.1 // indirect + github.com/maratori/testpackage v1.1.2 // indirect + github.com/matoous/godox v1.1.0 // indirect + github.com/mattn/go-colorable v0.1.15 // indirect + github.com/mattn/go-isatty v0.0.22 // indirect + github.com/mattn/go-runewidth v0.0.24 // indirect + github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect + github.com/mgechev/revive v1.17.0 // indirect + github.com/mitchellh/go-homedir v1.1.0 // indirect + github.com/mitchellh/mapstructure v1.5.0 // indirect + github.com/moricho/tparallel v0.3.2 // indirect + github.com/muesli/cancelreader v0.2.2 // indirect + github.com/nakabonne/nestif v0.3.1 // indirect + github.com/nishanths/exhaustive v0.13.0 // indirect + github.com/nishanths/predeclared v0.2.2 // indirect + github.com/nunnatsa/ginkgolinter v0.24.0 // indirect + github.com/pelletier/go-toml v1.9.5 // indirect + github.com/pelletier/go-toml/v2 v2.4.3 // indirect + github.com/prometheus/client_golang v1.12.1 // indirect + github.com/prometheus/client_model v0.2.0 // indirect + github.com/prometheus/common v0.32.1 // indirect + github.com/prometheus/procfs v0.7.3 // indirect + github.com/quasilyte/go-ruleguard v0.4.5 // indirect + github.com/quasilyte/go-ruleguard/dsl v0.3.23 // indirect + github.com/quasilyte/gogrep v0.5.0 // indirect + github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 // indirect + github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect + github.com/raeperd/recvcheck v0.3.1 // indirect + github.com/rivo/uniseg v0.4.7 // indirect + github.com/rogpeppe/go-internal v1.16.0 // indirect + github.com/ryancurrah/gomodguard v1.4.1 // indirect + github.com/ryancurrah/gomodguard/v2 v2.1.3 // indirect + github.com/ryanrolds/sqlclosecheck v0.6.0 // indirect + github.com/sanposhiho/wastedassign/v2 v2.1.0 // indirect + github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 // indirect + github.com/sashamelentyev/interfacebloat v1.1.0 // indirect + github.com/sashamelentyev/usestdlibvars v1.29.0 // indirect + github.com/securego/gosec/v2 v2.29.0 // indirect + github.com/sirupsen/logrus v1.10.2 // indirect + github.com/sivchari/containedctx v1.0.3 // indirect + github.com/sonatard/noctx v0.5.1 // indirect + github.com/sourcegraph/go-diff v0.9.0 // indirect + github.com/spf13/afero v1.15.0 // indirect + github.com/spf13/cast v1.5.0 // indirect + github.com/spf13/cobra v1.10.2 // indirect + github.com/spf13/jwalterweatherman v1.1.0 // indirect + github.com/spf13/pflag v1.0.10 // indirect + github.com/spf13/viper v1.12.0 // indirect + github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect + github.com/stbenjam/no-sprintf-host-port v0.3.1 // indirect + github.com/stretchr/objx v0.5.3 // indirect + github.com/stretchr/testify v1.12.1 // indirect + github.com/subosito/gotenv v1.4.1 // indirect + github.com/tetafro/godot v1.5.6 // indirect + github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c // indirect + github.com/timonwong/loggercheck v0.12.0 // indirect + github.com/tomarrell/wrapcheck/v2 v2.12.0 // indirect + github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect + github.com/ultraware/funlen v0.2.0 // indirect + github.com/ultraware/whitespace v0.2.0 // indirect + github.com/uudashr/gocognit v1.2.1 // indirect + github.com/uudashr/iface v1.5.1 // indirect + github.com/xen0n/gosmopolitan v1.3.0 // indirect + github.com/xo/terminfo v1.0.0 // indirect + github.com/yagipy/maintidx v1.0.0 // indirect + github.com/yeya24/promlinter v0.3.0 // indirect + github.com/ykadowak/zerologlint v0.1.5 // indirect + gitlab.com/bosi/decorder v0.4.2 // indirect + go-simpler.org/musttag v0.14.0 // indirect + go-simpler.org/sloglint v0.12.0 // indirect + go.augendre.info/arangolint v0.4.0 // indirect + go.augendre.info/fatcontext v0.10.1 // indirect + go.uber.org/multierr v1.10.0 // indirect + go.uber.org/zap v1.27.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/sync v0.23.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/text v0.41.0 // indirect + golang.org/x/tools v0.50.0 // indirect + google.golang.org/protobuf v1.36.12 // indirect + gopkg.in/ini.v1 v1.67.0 // indirect + gopkg.in/yaml.v2 v2.4.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect + honnef.co/go/tools v0.8.1 // indirect + mvdan.cc/gofumpt v0.12.0 // indirect + mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 // indirect +) diff --git a/tools/golangci-lint/go.sum b/tools/golangci-lint/go.sum new file mode 100644 index 00000000..e3fb4951 --- /dev/null +++ b/tools/golangci-lint/go.sum @@ -0,0 +1,977 @@ +4d63.com/gocheckcompilerdirectives v1.4.0 h1:ZLq62rbGWVmQhiZ8kuNVIT/M09xCSTdJz9K3xOdT/CY= +4d63.com/gocheckcompilerdirectives v1.4.0/go.mod h1:9ZOAiMOjqC/nRwci2fcUXVHUNLG/cH6r6rhUh+jTFtQ= +4d63.com/gochecknoglobals v0.2.2 h1:H1vdnwnMaZdQW/N+NrkT1SZMTBmcwHe9Vq8lJcYYTtU= +4d63.com/gochecknoglobals v0.2.2/go.mod h1:lLxwTQjL5eIesRbvnzIP3jZtG140FnTdz+AlMa+ogt0= +charm.land/lipgloss/v2 v2.0.6 h1:EaGKeuA8FvF+v2BT5VmZd2LoYLaMZJXA5n34th8nCIQ= +charm.land/lipgloss/v2 v2.0.6/go.mod h1:ipDDJNSGa1hlwDtSfW1s2/xR8Vdhbut4PXh2zEKZd0Q= +cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= +cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= +cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU= +cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU= +cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY= +cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc= +cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0= +cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To= +cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4= +cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M= +cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc= +cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk= +cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs= +cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc= +cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY= +cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o= +cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE= +cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc= +cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg= +cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc= +cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ= +cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE= +cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk= +cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I= +cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw= +cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA= +cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU= +cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw= +cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos= +cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk= +cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs= +cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0= +codeberg.org/chavacava/garif v0.2.1 h1:K9oYxSlvlXrHXyW26Z4q61bTpJDo1wbvXcYKar/F/LM= +codeberg.org/chavacava/garif v0.2.1/go.mod h1:oHnDSmc0f9K1MeE+MQD/yjkiIB5Xsn5y3S9Dg96Xk84= +codeberg.org/polyfloyd/go-errorlint v1.9.0 h1:VkdEEmA1VBpH6ecQoMR4LdphVI3fA4RrCh2an7YmodI= +codeberg.org/polyfloyd/go-errorlint v1.9.0/go.mod h1:GPRRu2LzVijNn4YkrZYJfatQIdS+TrcK8rL5Xs24qw8= +dev.gaijin.team/go/exhaustruct/v4 v4.0.0 h1:873r7aNneqoBB3IaFIzhvt2RFYTuHgmMjoKfwODoI1Y= +dev.gaijin.team/go/exhaustruct/v4 v4.0.0/go.mod h1:aZ/k2o4Y05aMJtiux15x8iXaumE88YdiB0Ai4fXOzPI= +dev.gaijin.team/go/exhaustruct/v5 v5.2.0 h1:HZB49Fshn8qHJCi9VzYtrcnR1jbLteRHXfnQz8Adams= +dev.gaijin.team/go/exhaustruct/v5 v5.2.0/go.mod h1:5IshpqhgGdKIrF8lBmi3M6YKmI7T3hMzAL9nrflko88= +dev.gaijin.team/go/golib v0.8.1 h1:JYju4x9BSo+QD/AYeHULVDcvEhiFg8wOi6pT0IaZF5E= +dev.gaijin.team/go/golib v0.8.1/go.mod h1:c5fu7t1RSGMxSQgcUYO1sODbzsYnOCXJLmHeNG1Eb+0= +dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= +github.com/4meepo/tagalign v1.4.4 h1:052JDGj2pBORc6NkD30dDXpsUpoYszDeUwr9/5YZuVA= +github.com/4meepo/tagalign v1.4.4/go.mod h1:00WwRjiuSbrRJnSVeGWPLp2epS5Q/l4UEy0apLLS37c= +github.com/Abirdcfly/dupword v0.1.8 h1:SrhcUuGsROBuChFxHALRYzyyPODWn9zwghmzPvD9Cd8= +github.com/Abirdcfly/dupword v0.1.8/go.mod h1:XZrhVnI7YGpsTiWZANSQaBJ4QpL/Tq5vIEdKJJAs9WI= +github.com/AdminBenni/iota-mixing v1.0.0 h1:Os6lpjG2dp/AE5fYBPAA1zfa2qMdCAWwPMCgpwKq7wo= +github.com/AdminBenni/iota-mixing v1.0.0/go.mod h1:i4+tpAaB+qMVIV9OK3m4/DAynOd5bQFaOu+2AhtBCNY= +github.com/AlwxSin/noinlineerr v1.0.6 h1:KAvuxunTe9QxvqrFB7nZTdb/7Wzas4AvifslTnG0Ld8= +github.com/AlwxSin/noinlineerr v1.0.6/go.mod h1:+QgkkoYrMH7RHvcdxdlI7vYYEdgeoFOVjU9sUhw/rQc= +github.com/Antonboom/errname v1.1.2 h1:dxwONZJua3VB8Xh/VaCjqAcqF645sWWv7xj26zy7tdQ= +github.com/Antonboom/errname v1.1.2/go.mod h1:YeZIpgLMxT+SNkruGgYkLhzq/9vs3fsolTZegKaKDZI= +github.com/Antonboom/nilnil v1.1.2 h1:aNlFuJhaEseXe4fHO3xbjXlSeEiQVYa2lEkWD2s2hAY= +github.com/Antonboom/nilnil v1.1.2/go.mod h1:0ynwvphOLmAuMwTNDyBnDZmSwZoDpcFXmUHmzoHH2WA= +github.com/Antonboom/testifylint v1.6.4 h1:gs9fUEy+egzxkEbq9P4cpcMB6/G0DYdMeiFS87UiqmQ= +github.com/Antonboom/testifylint v1.6.4/go.mod h1:YO33FROXX2OoUfwjz8g+gUxQXio5i9qpVy7nXGbxDD4= +github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= +github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= +github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= +github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo= +github.com/ClickHouse/clickhouse-go-linter v1.2.1 h1:zGEKIyd5YL08ieWG/LOUmlau2DxbxPVOfAeo+4Jz3ck= +github.com/ClickHouse/clickhouse-go-linter v1.2.1/go.mod h1:pLorS7ffPTfuUV9M0SJgfHA/h/WQPQUk2FWG9x74cQ4= +github.com/Djarvur/go-err113 v0.1.1 h1:eHfopDqXRwAi+YmCUas75ZE0+hoBHJ2GQNLYRSxao4g= +github.com/Djarvur/go-err113 v0.1.1/go.mod h1:IaWJdYFLg76t2ihfflPZnM1LIQszWOsFDh2hhhAVF6k= +github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= +github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/MirrexOne/unqueryvet v1.5.4 h1:38QOxShO7JmMWT+eCdDMbcUgGCOeJphVkzzRgyLJgsQ= +github.com/MirrexOne/unqueryvet v1.5.4/go.mod h1:fs9Zq6eh1LRIhsDIsxf9PONVUjYdFHdtkHIgZdJnyPU= +github.com/OpenPeeDeeP/depguard/v2 v2.2.1 h1:vckeWVESWp6Qog7UZSARNqfu/cZqvki8zsuj3piCMx4= +github.com/OpenPeeDeeP/depguard/v2 v2.2.1/go.mod h1:q4DKzC4UcVaAvcfd41CZh0PWpGgzrVxUYBlgKNGquUo= +github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0= +github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k= +github.com/alecthomas/chroma/v2 v2.27.0 h1:FodwmyOBgJULFYmDqibcp9pvfDLWdtPRh9v/r5BXYZs= +github.com/alecthomas/chroma/v2 v2.27.0/go.mod h1:NjJ3ciIgrqBNeIkWZ4e46nseoLDslxU1LmfCoL+wcY8= +github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606 h1:dXPJ+uOJLWb8rjlAuLX7JPiRJtZKw/53Ol+WxdDJ1Eo= +github.com/alecthomas/go-check-sumtype v0.5.1-0.20260828200218-ae6904d28606/go.mod h1:ZH31IJyNpxpStxP2ayCcPQz+3T2G/OnxIQqe4LWvSDw= +github.com/alecthomas/repr v0.5.2 h1:SU73FTI9D1P5UNtvseffFSGmdNci/O6RsqzeXJtP0Qs= +github.com/alecthomas/repr v0.5.2/go.mod h1:Fr0507jx4eOXV7AlPV6AVZLYrLIuIeSOWtW57eE/O/4= +github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= +github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc= +github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= +github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0= +github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho= +github.com/alexkohler/nakedret/v2 v2.0.6 h1:ME3Qef1/KIKr3kWX3nti3hhgNxw6aqN5pZmQiFSsuzQ= +github.com/alexkohler/nakedret/v2 v2.0.6/go.mod h1:l3RKju/IzOMQHmsEvXwkqMDzHHvurNQfAgE1eVmT40Q= +github.com/alexkohler/prealloc v1.1.0 h1:cKGRBqlXw5iyQGLYhrXrDlcHxugXpTq4tQ5c91wkf8M= +github.com/alexkohler/prealloc v1.1.0/go.mod h1:fT39Jge3bQrfA7nPMDngUfvUbQGQeJyGQnR+913SCig= +github.com/alfatraining/structtag v1.0.0 h1:2qmcUqNcCoyVJ0up879K614L9PazjBSFruTB0GOFjCc= +github.com/alfatraining/structtag v1.0.0/go.mod h1:p3Xi5SwzTi+Ryj64DqjLWz7XurHxbGsq6y3ubePJPus= +github.com/alingse/asasalint v0.0.11 h1:SFwnQXJ49Kx/1GghOFz1XGqHYKp21Kq1nHad/0WQRnw= +github.com/alingse/asasalint v0.0.11/go.mod h1:nCaoMhw7a9kSJObvQyVzNTPBDbNpdocqrSP7t/cW5+I= +github.com/alingse/nilnesserr v0.2.0 h1:raLem5KG7EFVb4UIDAXgrv3N2JIaffeKNtcEXkEWd/w= +github.com/alingse/nilnesserr v0.2.0/go.mod h1:1xJPrXonEtX7wyTq8Dytns5P2hNzoWymVUIaKm4HNFg= +github.com/ashanbrown/forbidigo/v2 v2.3.1 h1:KAZijvQ7zeIBKbhikT4jCm0TLYXC4u78bTiLh/8JROI= +github.com/ashanbrown/forbidigo/v2 v2.3.1/go.mod h1:2QDkLTzU6TV937eFROamXrW92M3paehdae4HCDCOZCM= +github.com/ashanbrown/makezero/v2 v2.2.1 h1:A7uU8dgB1PA9aelTxHMfHIQ8Qev8AB3JLxJUBUsejqM= +github.com/ashanbrown/makezero/v2 v2.2.1/go.mod h1:aEGT/9q3S8DHeE57C88z2a6xydvgx8J5hgXIGWgo0MY= +github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= +github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= +github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= +github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/bkielbasa/cyclop v1.2.3 h1:faIVMIGDIANuGPWH031CZJTi2ymOQBULs9H21HSMa5w= +github.com/bkielbasa/cyclop v1.2.3/go.mod h1:kHTwA9Q0uZqOADdupvcFJQtp/ksSnytRMe8ztxG8Fuo= +github.com/blizzy78/varnamelen v0.8.0 h1:oqSblyuQvFsW1hbBHh1zfwrKe3kcSj0rnXkKzsQ089M= +github.com/blizzy78/varnamelen v0.8.0/go.mod h1:V9TzQZ4fLJ1DSrjVDfl89H7aMnTvKkApdHeyESmyR7k= +github.com/bombsimon/wsl/v4 v4.7.0 h1:1Ilm9JBPRczjyUs6hvOPKvd7VL1Q++PL8M0SXBDf+jQ= +github.com/bombsimon/wsl/v4 v4.7.0/go.mod h1:uV/+6BkffuzSAVYD+yGyld1AChO7/EuLrCF/8xTiapg= +github.com/bombsimon/wsl/v5 v5.9.0 h1:WCrgZ7RQnZO5oEwbVTlYgBdU3wL294kR1BSWV8vTfsU= +github.com/bombsimon/wsl/v5 v5.9.0/go.mod h1:kjo4HiAV5FDkHC8/uzJq9mBffEEd6WT/nvN7DoMovDM= +github.com/breml/bidichk v0.3.3 h1:WSM67ztRusf1sMoqH6/c4OBCUlRVTKq+CbSeo0R17sE= +github.com/breml/bidichk v0.3.3/go.mod h1:ISbsut8OnjB367j5NseXEGGgO/th206dVa427kR8YTE= +github.com/breml/errchkjson v0.4.1 h1:keFSS8D7A2T0haP9kzZTi7o26r7kE3vymjZNeNDRDwg= +github.com/breml/errchkjson v0.4.1/go.mod h1:a23OvR6Qvcl7DG/Z4o0el6BRAjKnaReoPQFciAl9U3s= +github.com/butuzov/ireturn v0.4.1 h1:vWb3NO4t77iku/sjCQ/2pHTQeOmxEhjIriJqRLg1Y+I= +github.com/butuzov/ireturn v0.4.1/go.mod h1:q+DXKzTDV5guNuXLnIab9fKXizTn2miZHLhxH7V/GB4= +github.com/butuzov/mirror v1.3.3 h1:v0RsWBhfFc1RQqE/f3sHpSttKDtodFn0gFmtYyD4/hA= +github.com/butuzov/mirror v1.3.3/go.mod h1:h9BzzwYnTiHO0GzgvaTqIg7VSsOUhdIv51cHFFBmX1w= +github.com/catenacyber/perfsprint v0.10.1 h1:u7Riei30bk46XsG8nknMhKLXG9BcXz3+3tl/WpKm0PQ= +github.com/catenacyber/perfsprint v0.10.1/go.mod h1:DJTGsi/Zufpuus6XPGJyKOTMELe347o6akPvWG9Zcsc= +github.com/ccojocar/zxcvbn-go v1.0.4 h1:FWnCIRMXPj43ukfX000kvBZvV6raSxakYr1nzyNrUcc= +github.com/ccojocar/zxcvbn-go v1.0.4/go.mod h1:3GxGX+rHmueTUMvm5ium7irpyjmm7ikxYFOSJB21Das= +github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= +github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/charithe/durationcheck v0.0.11 h1:g1/EX1eIiKS57NTWsYtHDZ/APfeXKhye1DidBcABctk= +github.com/charithe/durationcheck v0.0.11/go.mod h1:x5iZaixRNl8ctbM+3B2RrPG5t856TxRyVQEnbIEM2X4= +github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q= +github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q= +github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886 h1:rdnVWKgJpTVXKuKuJyxDJ+NFJdUaUqGvyGy61OcvlbA= +github.com/charmbracelet/ultraviolet v0.0.0-20260811164956-006e29f97886/go.mod h1:nAw0d9PhFp1qdzi2xhQU5YOu5sVpDIHWlaW2Uz/bCro= +github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ= +github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0= +github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk= +github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI= +github.com/charmbracelet/x/termios v0.1.1 h1:o3Q2bT8eqzGnGPOYheoYS8eEleT5ZVNYNy8JawjaNZY= +github.com/charmbracelet/x/termios v0.1.1/go.mod h1:rB7fnv1TgOPOyyKRJ9o+AsTU/vK5WHJ2ivHeut/Pcwo= +github.com/charmbracelet/x/windows v0.2.2 h1:IofanmuvaxnKHuV04sC0eBy/smG6kIKrWG2/jYn2GuM= +github.com/charmbracelet/x/windows v0.2.2/go.mod h1:/8XtdKZzedat74NQFn0NGlGL4soHB0YQZrETF96h75k= +github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= +github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= +github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= +github.com/ckaznocha/intrange v0.3.1 h1:j1onQyXvHUsPWujDH6WIjhyH26gkRt/txNlV7LspvJs= +github.com/ckaznocha/intrange v0.3.1/go.mod h1:QVepyz1AkUoFQkpEqksSYpNpUo3c5W7nWh/s6SHIJJk= +github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw= +github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8= +github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0= +github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= +github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= +github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= +github.com/curioswitch/go-reassign v0.3.0 h1:dh3kpQHuADL3cobV/sSGETA8DOv457dwl+fbBAhrQPs= +github.com/curioswitch/go-reassign v0.3.0/go.mod h1:nApPCCTtqLJN/s8HfItCcKV0jIPwluBOvZP+dsJGA88= +github.com/daixiang0/gci v0.13.7 h1:+0bG5eK9vlI08J+J/NWGbWPTNiXPG4WhNLJOkSxWITQ= +github.com/daixiang0/gci v0.13.7/go.mod h1:812WVN6JLFY9S6Tv76twqmNqevN0pa3SX3nih0brVzQ= +github.com/dave/dst v0.27.3 h1:P1HPoMza3cMEquVf9kKy8yXsFirry4zEnWOdYPOoIzY= +github.com/dave/dst v0.27.3/go.mod h1:jHh6EOibnHgcUW3WjKHisiooEkYwqpHLBSX1iOBhEyc= +github.com/dave/jennifer v1.7.1 h1:B4jJJDHelWcDhlRQxWeo0Npa/pYKBLrirAQoTN45txo= +github.com/dave/jennifer v1.7.1/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= +github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/denis-tingaikin/go-header v0.5.0 h1:SRdnP5ZKvcO9KKRP1KJrhFR3RrlGuD+42t4429eC9k8= +github.com/denis-tingaikin/go-header v0.5.0/go.mod h1:mMenU5bWrok6Wl2UsZjy+1okegmwQ3UgWl4V1D8gjlY= +github.com/dlclark/regexp2 v1.12.0 h1:0j4c5qQmnC6XOWNjP3PIXURXN2gWx76rd3KvgdPkCz8= +github.com/dlclark/regexp2 v1.12.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= +github.com/dlclark/regexp2/v2 v2.2.1 h1:mf4KkFUj0gJuarK8P+LgiS+Lit7m9N1yAwEfPbee7R0= +github.com/dlclark/regexp2/v2 v2.2.1/go.mod h1:avUrQvPaLz2DrFNHJF0taWAFFX2C1GMSSoeiqFjcBmU= +github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= +github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4= +github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98= +github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c= +github.com/ettle/strcase v0.2.0 h1:fGNiVF21fHXpX1niBgk0aROov1LagYsOwV/xqKDKR/Q= +github.com/ettle/strcase v0.2.0/go.mod h1:DajmHElDSaX76ITe3/VHVyMin4LWSJN5Z909Wp+ED1A= +github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= +github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= +github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4= +github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94= +github.com/firefart/nonamedreturns v1.0.8 h1:iB32Dl17zJl1zlVEj/WlUWgx0HiRyQ85OUw1WHa4/II= +github.com/firefart/nonamedreturns v1.0.8/go.mod h1:vxFNvm5AfP/8rgAKFzYmnqx0yp1HjrYsErZ9pHPTznA= +github.com/frankban/quicktest v1.14.3 h1:FJKSZTDHjyhriyC81FLQ0LY93eSai0ZyR/ZIkd3ZUKE= +github.com/frankban/quicktest v1.14.3/go.mod h1:mgiwOwqx65TmIk1wJ6Q7wvnVMocbUorkibMOrVTHZps= +github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= +github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= +github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo= +github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA= +github.com/ghostiam/protogetter v1.0.1 h1:q4LLTx2KJHJpxrfO3BniUDWoFkoqWD/UlHhClBlUlLM= +github.com/ghostiam/protogetter v1.0.1/go.mod h1:50Fh5yZfs6SFGrd1FlmT04NcguyEOxyjNK5zGD6/EvM= +github.com/go-critic/go-critic v0.15.0 h1:MDUZIQKytIl+vPEc0Igw51m4uLTdi1ZGz2jatEqNs1g= +github.com/go-critic/go-critic v0.15.0/go.mod h1:3BPrw8nHATGm3o2n37cssOmJzpySGKCdY8JWkCzxgKQ= +github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= +github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= +github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= +github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= +github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as= +github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY= +github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE= +github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk= +github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474= +github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI= +github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY= +github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= +github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= +github.com/go-toolsmith/astcast v1.1.0 h1:+JN9xZV1A+Re+95pgnMgDboWNVnIMMQXwfBwLRPgSC8= +github.com/go-toolsmith/astcast v1.1.0/go.mod h1:qdcuFWeGGS2xX5bLM/c3U9lewg7+Zu4mr+xPwZIB4ZU= +github.com/go-toolsmith/astcopy v1.1.0 h1:YGwBN0WM+ekI/6SS6+52zLDEf8Yvp3n2seZITCUBt5s= +github.com/go-toolsmith/astcopy v1.1.0/go.mod h1:hXM6gan18VA1T/daUEHCFcYiW8Ai1tIwIzHY6srfEAw= +github.com/go-toolsmith/astequal v1.0.3/go.mod h1:9Ai4UglvtR+4up+bAD4+hCj7iTo4m/OXVTSLnCyTAx4= +github.com/go-toolsmith/astequal v1.1.0/go.mod h1:sedf7VIdCL22LD8qIvv7Nn9MuWJruQA/ysswh64lffQ= +github.com/go-toolsmith/astequal v1.2.0 h1:3Fs3CYZ1k9Vo4FzFhwwewC3CHISHDnVUPC4x0bI2+Cw= +github.com/go-toolsmith/astequal v1.2.0/go.mod h1:c8NZ3+kSFtFY/8lPso4v8LuJjdJiUFVnSuU3s0qrrDY= +github.com/go-toolsmith/astfmt v1.1.0 h1:iJVPDPp6/7AaeLJEruMsBUlOYCmvg0MoCfJprsOmcco= +github.com/go-toolsmith/astfmt v1.1.0/go.mod h1:OrcLlRwu0CuiIBp/8b5PYF9ktGVZUjlNMV634mhwuQ4= +github.com/go-toolsmith/astp v1.1.0 h1:dXPuCl6u2llURjdPLLDxJeZInAeZ0/eZwFJmqZMnpQA= +github.com/go-toolsmith/astp v1.1.0/go.mod h1:0T1xFGz9hicKs8Z5MfAqSUitoUYS30pDMsRVIDHs8CA= +github.com/go-toolsmith/pkgload v1.2.2 h1:0CtmHq/02QhxcF7E9N5LIFcYFsMR5rdovfqTtRKkgIk= +github.com/go-toolsmith/pkgload v1.2.2/go.mod h1:R2hxLNRKuAsiXCo2i5J6ZQPhnPMOVtU+f0arbFPWCus= +github.com/go-toolsmith/strparse v1.0.0/go.mod h1:YI2nUKP9YGZnL/L1/DLFBfixrcjslWct4wyljWhSRy8= +github.com/go-toolsmith/strparse v1.1.0 h1:GAioeZUK9TGxnLS+qfdqNbA4z0SSm5zVNtCQiyP2Bvw= +github.com/go-toolsmith/strparse v1.1.0/go.mod h1:7ksGy58fsaQkGQlY8WVoBFNyEPMGuJin1rfoPS4lBSQ= +github.com/go-toolsmith/typep v1.1.0 h1:fIRYDyF+JywLfqzyhdiHzRop/GQDxxNhLGQ6gFUNHus= +github.com/go-toolsmith/typep v1.1.0/go.mod h1:fVIw+7zjdsMxDA3ITWnH1yOiw1rnTQKCsF/sk2H/qig= +github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= +github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= +github.com/go-xmlfmt/xmlfmt v1.1.3 h1:t8Ey3Uy7jDSEisW2K3somuMKIpzktkWptA0iFCnRUWY= +github.com/go-xmlfmt/xmlfmt v1.1.3/go.mod h1:aUCEOzzezBEjDBbFBoSiya/gduyIiWYRP6CnSFIV8AM= +github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= +github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= +github.com/godoc-lint/godoc-lint v0.11.4 h1:N9zUYVJ/OkznBbrBsU/zODvua64EUplMBLQWStO3+1M= +github.com/godoc-lint/godoc-lint v0.11.4/go.mod h1:7usTXoxS0QYIi5usTSCPwR0w/6xLjcz450shXjLn3t4= +github.com/gofrs/flock v0.13.1 h1:jjREztyBeSKBZYAC+mgc1laB+xsgy4kYMf3FbKF2UBo= +github.com/gofrs/flock v0.13.1/go.mod h1:sf4BFiHwnvgxa25DlQoDqXQnwRMEOwqxRq37P6MzzmE= +github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ= +github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= +github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc= +github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= +github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A= +github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y= +github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw= +github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4= +github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= +github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= +github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw= +github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk= +github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= +github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= +github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs= +github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w= +github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0= +github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8= +github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= +github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= +github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= +github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg= +github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/golangci/asciicheck v0.5.0 h1:jczN/BorERZwK8oiFBOGvlGPknhvq0bjnysTj4nUfo0= +github.com/golangci/asciicheck v0.5.0/go.mod h1:5RMNAInbNFw2krqN6ibBxN/zfRFa9S6tA1nPdM0l8qQ= +github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6 h1:fVLolA3dG6s0brGetsiDAtcnpMSwVa2LqXJEw/9RJG4= +github.com/golangci/canonicalheader v0.0.0-20260827115959-a25c71c521f6/go.mod h1:1xo+NFW5S+bEf2DKXhaxuzvcDN5AR6o/KMwvqC5Mkpo= +github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202 h1:CbTB8KpqnViI6lIXxp03Oclc4VFHi3K4BWC1TacsZ+A= +github.com/golangci/dupl v0.0.0-20260401084720-c99c5cf5c202/go.mod h1:NUw9Zr2Sy7+HxzdjIULge71wI6yEg1lWQr7Evcu8K0E= +github.com/golangci/go-printf-func-name v0.1.1 h1:hIYTFJqAGp1iwoIfsNTpoq1xZAarogrvjO9AfiW3B4U= +github.com/golangci/go-printf-func-name v0.1.1/go.mod h1:Es64MpWEZbh0UBtTAICOZiB+miW53w/K9Or/4QogJss= +github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792 h1:WL8YKrt3UbOBqSRU7GpP5BTtQTMWtVtj+mfPijgZeIg= +github.com/golangci/gofmt v0.0.0-20260820135601-e84e05053792/go.mod h1:te5hX0dW4C5r6YbXs+6ysNr8Q5UTmdIqGbb+mlFiYmA= +github.com/golangci/golangci-lint/v2 v2.14.0 h1:ot8QffRa4LzAAEgtvNYrVs9esxQ7xoTwoAv6uhp4ngA= +github.com/golangci/golangci-lint/v2 v2.14.0/go.mod h1:amHimCzNDP1GfVno3hIiNssjvqXmuW+CPZAHOdR4cIc= +github.com/golangci/golines v0.15.0 h1:Qnph25g8Y1c5fdo1X7GaRDGgnMHgnxh4Gk4VfPTtRx0= +github.com/golangci/golines v0.15.0/go.mod h1:AZjXd23tbHMpowhtnGlj9KCNsysj72aeZVVHnVcZx10= +github.com/golangci/misspell v0.8.0 h1:qvxQhiE2/5z+BVRo1kwYA8yGz+lOlu5Jfvtx2b04Jbg= +github.com/golangci/misspell v0.8.0/go.mod h1:WZyyI2P3hxPY2UVHs3cS8YcllAeyfquQcKfdeE9AFVg= +github.com/golangci/plugin-module-register v0.1.2 h1:e5WM6PO6NIAEcij3B053CohVp3HIYbzSuP53UAYgOpg= +github.com/golangci/plugin-module-register v0.1.2/go.mod h1:1+QGTsKBvAIvPvoY/os+G5eoqxWn70HYDm2uvUyGuVw= +github.com/golangci/revgrep v0.8.0 h1:EZBctwbVd0aMeRnNUsFogoyayvKHyxlV3CdUA46FX2s= +github.com/golangci/revgrep v0.8.0/go.mod h1:U4R/s9dlXZsg8uJmaR1GrloUr14D7qDl8gi2iPXJH8k= +github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba h1:lqtcnSMDuuJdu/LrKWi5RJzpSNLOJXYe/nzQutTI5kg= +github.com/golangci/rowserrcheck v0.0.0-20260419091836-c5f79b8a11ba/go.mod h1:sCBNcpRmhJCtbFGz49+IM3ETTFf7QdJ30AeYCd43NKk= +github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e h1:ai0EfmVYE2bRA5htgAG9r7s3tHsfjIhN98WshBTJ9jM= +github.com/golangci/swaggoswag v0.0.0-20250504205917-77f2aca3143e/go.mod h1:Vrn4B5oR9qRwM+f54koyeH3yzphlecwERs0el27Fr/s= +github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqtt0ssnqSJNNndxe69DOQ24A5h7+i3KpM= +github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc= +github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= +github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ= +github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M= +github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= +github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= +github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs= +github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0= +github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= +github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc= +github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM= +github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 h1:LMLX+LgTNWpfvCBdFebv6EsYotImrt/Ppc5cXIriCSo= +github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3/go.mod h1:jl5iWTm0/hd5PjEYEOuwAJ57L/CibdZfrqZ5XA5GrCk= +github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= +github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg= +github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk= +github.com/gordonklaus/ineffassign v0.2.0 h1:Uths4KnmwxNJNzq87fwQQDDnbNb7De00VOk9Nu0TySs= +github.com/gordonklaus/ineffassign v0.2.0/go.mod h1:TIpymnagPSexySzs7F9FnO1XFTy8IT3a59vmZp5Y9Lw= +github.com/gostaticanalysis/analysisutil v0.7.1 h1:ZMCjoue3DtDWQ5WyU16YbjbQEQ3VuzwxALrpYd+HeKk= +github.com/gostaticanalysis/analysisutil v0.7.1/go.mod h1:v21E3hY37WKMGSnbsw2S/ojApNWb6C1//mXO48CXbVc= +github.com/gostaticanalysis/comment v1.4.2/go.mod h1:KLUTGDv6HOCotCH8h2erHKmpci2ZoR8VPu34YA2uzdM= +github.com/gostaticanalysis/comment v1.5.0 h1:X82FLl+TswsUMpMh17srGRuKaaXprTaytmEpgnKIDu8= +github.com/gostaticanalysis/comment v1.5.0/go.mod h1:V6eb3gpCv9GNVqb6amXzEUX3jXLVK/AdA+IrAMSqvEc= +github.com/gostaticanalysis/forcetypeassert v0.2.0 h1:uSnWrrUEYDr86OCxWa4/Tp2jeYDlogZiZHzGkWFefTk= +github.com/gostaticanalysis/forcetypeassert v0.2.0/go.mod h1:M5iPavzE9pPqWyeiVXSFghQjljW1+l/Uke3PXHS6ILY= +github.com/gostaticanalysis/nilerr v0.1.2 h1:S6nk8a9N8g062nsx63kUkF6AzbHGw7zzyHMcpu52xQU= +github.com/gostaticanalysis/nilerr v0.1.2/go.mod h1:A19UHhoY3y8ahoL7YKz6sdjDtduwTSI4CsymaC2htPA= +github.com/gostaticanalysis/testutil v0.3.1-0.20210208050101-bfb5c8eec0e4/go.mod h1:D+FIZ+7OahH3ePw/izIEeH5I06eKs1IKI4Xr64/Am3M= +github.com/gostaticanalysis/testutil v0.5.0 h1:Dq4wT1DdTwTGCQQv3rl3IvD5Ld0E6HiY+3Zh0sUGqw8= +github.com/gostaticanalysis/testutil v0.5.0/go.mod h1:OLQSbuM6zw2EvCcXTz1lVq5unyoNft372msDY0nY5Hs= +github.com/hashicorp/go-immutable-radix/v2 v2.1.0 h1:CUW5RYIcysz+D3B+l1mDeXrQ7fUvGGCwJfdASSzbrfo= +github.com/hashicorp/go-immutable-radix/v2 v2.1.0/go.mod h1:hgdqLXA4f6NIjRVisM1TJ9aOJVNRqKZj+xDGF6m7PBw= +github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8= +github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro= +github.com/hashicorp/go-version v1.2.1/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= +github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA= +github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= +github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8= +github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= +github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= +github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4= +github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ= +github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= +github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg= +github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= +github.com/jgautheron/goconst v1.11.0 h1:KgN90z5qXt5f0Uzf3cWXev3hfMMFUyNeKdpkSBRvLDk= +github.com/jgautheron/goconst v1.11.0/go.mod h1:0p+wv1lFOiUr0IlNNT1nrm6+8DB8u2sU6KHGzFRXHDc= +github.com/jjti/go-spancheck v0.6.5 h1:lmi7pKxa37oKYIMScialXUK6hP3iY5F1gu+mLBPgYB8= +github.com/jjti/go-spancheck v0.6.5/go.mod h1:aEogkeatBrbYsyW6y5TgDfihCulDYciL1B7rG2vSsrU= +github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4= +github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU= +github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= +github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4= +github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= +github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU= +github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk= +github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w= +github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM= +github.com/julz/importas v0.2.0 h1:y+MJN/UdL63QbFJHws9BVC5RpA2iq0kpjrFajTGivjQ= +github.com/julz/importas v0.2.0/go.mod h1:pThlt589EnCYtMnmhmRYY/qn9lCf/frPOK+WMx3xiJY= +github.com/karamaru-alpha/copyloopvar v1.2.2 h1:yfNQvP9YaGQR7VaWLYcfZUlRP2eo2vhExWKxD/fP6q0= +github.com/karamaru-alpha/copyloopvar v1.2.2/go.mod h1:oY4rGZqZ879JkJMtX3RRkcXRkmUvH0x35ykgaKgsgJY= +github.com/kisielk/errcheck v1.20.0 h1:9rwHBNKzd4wkDWcROy3DvFGNqEPlkxBg305rvk7HabI= +github.com/kisielk/errcheck v1.20.0/go.mod h1:O+f80MKNwX8Oor2jwgpeQ9An7uJm+hRSgT+h22knRJU= +github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/kkHAIKE/contextcheck v1.1.6 h1:7HIyRcnyzxL9Lz06NGhiKvenXq7Zw6Q0UQu/ttjfJCE= +github.com/kkHAIKE/contextcheck v1.1.6/go.mod h1:3dDbMRNBFaq8HFXWC1JyvDSPm43CmE6IuHam8Wr0rkg= +github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= +github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ= +github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc= +github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= +github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/kulti/thelper v0.7.1 h1:fI8QITAoFVLx+y+vSyuLBP+rcVIB8jKooNSCT2EiI98= +github.com/kulti/thelper v0.7.1/go.mod h1:NsMjfQEy6sd+9Kfw8kCP61W1I0nerGSYSFnGaxQkcbs= +github.com/kunwardeep/paralleltest v1.0.15 h1:ZMk4Qt306tHIgKISHWFJAO1IDQJLc6uDyJMLyncOb6w= +github.com/kunwardeep/paralleltest v1.0.15/go.mod h1:di4moFqtfz3ToSKxhNjhOZL+696QtJGCFe132CbBLGk= +github.com/ldez/exptostd v0.4.5 h1:kv2ZGUVI6VwRfp/+bcQ6Nbx0ghFWcGIKInkG/oFn1aQ= +github.com/ldez/exptostd v0.4.5/go.mod h1:QRjHRMXJrCTIm9WxVNH6VW7oN7KrGSht69bIRwvdFsM= +github.com/ldez/gomoddirectives v0.10.0 h1:Zb23rfMMkG21B6pZ9OfESzemByP5Qr7YvWcXQZE/S3Q= +github.com/ldez/gomoddirectives v0.10.0/go.mod h1:W9uh0721Vc7aaVoiMXTpKIveLmtHC9uaOSiHM4OK5a8= +github.com/ldez/grignotin v0.10.1 h1:keYi9rYsgbvqAZGI1liek5c+jv9UUjbvdj3Tbn5fn4o= +github.com/ldez/grignotin v0.10.1/go.mod h1:UlDbXFCARrXbWGNGP3S5vsysNXAPhnSuBufpTEbwOas= +github.com/ldez/structtags v0.6.1 h1:bUooFLbXx41tW8SvkfwfFkkjPYvFFs59AAMgVg6DUBk= +github.com/ldez/structtags v0.6.1/go.mod h1:YDxVSgDy/MON6ariaxLF2X09bh19qL7MtGBN5MrvbdY= +github.com/ldez/tagliatelle v0.8.0 h1:QczqVPa22JdT40p3m5JTTVmPMv5wDORqdomJn6/Pnn0= +github.com/ldez/tagliatelle v0.8.0/go.mod h1:K9n83Wv0wyVq3JYF9WI28BX8xXhDBVP3thHJ0ENuiEs= +github.com/ldez/usetesting v0.5.0 h1:3/QtzZObBKLy1F4F8jLuKJiKBjjVFi1IavpoWbmqLwc= +github.com/ldez/usetesting v0.5.0/go.mod h1:Spnb4Qppf8JTuRgblLrEWb7IE6rDmUpGvxY3iRrzvDQ= +github.com/leonklingele/grouper v1.1.2 h1:o1ARBDLOmmasUaNDesWqWCIFH3u7hoFlM84YrjT3mIY= +github.com/leonklingele/grouper v1.1.2/go.mod h1:6D0M/HVkhs2yRKRFZUoGjeDy7EZTfFBE9gl4kjmIGkA= +github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss= +github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/macabu/inamedparam v0.2.0 h1:VyPYpOc10nkhI2qeNUdh3Zket4fcZjEWe35poddBCpE= +github.com/macabu/inamedparam v0.2.0/go.mod h1:+Pee9/YfGe5LJ62pYXqB89lJ+0k5bsR8Wgz/C0Zlq3U= +github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo= +github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60= +github.com/manuelarte/embeddedstructfieldcheck v0.4.0 h1:3mAIyaGRtjK6EO9E73JlXLtiy7ha80b2ZVGyacxgfww= +github.com/manuelarte/embeddedstructfieldcheck v0.4.0/go.mod h1:z8dFSyXqp+fC6NLDSljRJeNQJJDWnY7RoWFzV3PC6UM= +github.com/manuelarte/funcorder v0.6.0 h1:0hBngc4fa1IgNiI65A7sFGkMvoMCc878RjqB5V7rWP0= +github.com/manuelarte/funcorder v0.6.0/go.mod h1:id3NDhXdQBmeqXH7eVC6Z89xS6JxvZ8kF9xUxpArU/g= +github.com/maratori/testableexamples v1.0.1 h1:HfOQXs+XgfeRBJ+Wz0XfH+FHnoY9TVqL6Fcevpzy4q8= +github.com/maratori/testableexamples v1.0.1/go.mod h1:XE2F/nQs7B9N08JgyRmdGjYVGqxWwClLPCGSQhXQSrQ= +github.com/maratori/testpackage v1.1.2 h1:ffDSh+AgqluCLMXhM19f/cpvQAKygKAJXFl9aUjmbqs= +github.com/maratori/testpackage v1.1.2/go.mod h1:8F24GdVDFW5Ew43Et02jamrVMNXLUNaOynhDssITGfc= +github.com/matoous/godox v1.1.0 h1:W5mqwbyWrwZv6OQ5Z1a/DHGMOvXYCBP3+Ht7KMoJhq4= +github.com/matoous/godox v1.1.0/go.mod h1:jgE/3fUXiTurkdHOLT5WEkThTSuE7yxHv5iWPa80afs= +github.com/matryer/is v1.4.0 h1:sosSmIWwkYITGrxZ25ULNDeKiMNzFSr4V/eqBQP0PeE= +github.com/matryer/is v1.4.0/go.mod h1:8I/i5uYgLzgsgEloJE1U6xx5HkBQpAZvepWuujKwMRU= +github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= +github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= +github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= +github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU= +github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU= +github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0= +github.com/mgechev/revive v1.17.0 h1:hwTTVC3svSv9X2FA2hiYT17Uws+lfxDWhPxzBZZCREg= +github.com/mgechev/revive v1.17.0/go.mod h1:uiVNUF8ruVh4WHm/aPs7kKEeuo+m6oO3tuOfniyzP/g= +github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= +github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= +github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= +github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= +github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= +github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0= +github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/moricho/tparallel v0.3.2 h1:odr8aZVFA3NZrNybggMkYO3rgPRcqjeQUlBBFVxKHTI= +github.com/moricho/tparallel v0.3.2/go.mod h1:OQ+K3b4Ln3l2TZveGCywybl68glfLEwFGqvnjok8b+U= +github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA= +github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo= +github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= +github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U= +github.com/nakabonne/nestif v0.3.1 h1:wm28nZjhQY5HyYPx+weN3Q65k6ilSBxDb8v5S81B81U= +github.com/nakabonne/nestif v0.3.1/go.mod h1:9EtoZochLn5iUprVDmDjqGKPofoUEBL8U4Ngq6aY7OE= +github.com/nishanths/exhaustive v0.13.0 h1:Rof0axOSNQaaPaPmLK5RxcRrJV2Vcv+vfUmuRy+2EAM= +github.com/nishanths/exhaustive v0.13.0/go.mod h1:3/adQjJgvD/UFHHSYBjpK9Wbz8DOvf0FBtzx+zI0Rlo= +github.com/nishanths/predeclared v0.2.2 h1:V2EPdZPliZymNAn79T8RkNApBjMmVKh5XRpLm/w98Vk= +github.com/nishanths/predeclared v0.2.2/go.mod h1:RROzoN6TnGQupbC+lqggsOlcgysk3LMK/HI84Mp280c= +github.com/nunnatsa/ginkgolinter v0.24.0 h1:Mp0EagluLFP98JatP6nqp/gGEoljNG97uf9AcxcBVy8= +github.com/nunnatsa/ginkgolinter v0.24.0/go.mod h1:2ZMRuzX6+3XXyY6UZOwb6n+MCocVGbkIsDBC4vuWz5c= +github.com/onsi/ginkgo/v2 v2.32.1 h1:6tlvcDm/3sE8lGJbZ4+d4mO3RLy24/tQWOFzVSQNIfw= +github.com/onsi/ginkgo/v2 v2.32.1/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44= +github.com/onsi/gomega v1.42.1 h1:iN1rCUX+44NZ1Dc97MPoeFYbFR0vh8zxoxMFwKdyZ6I= +github.com/onsi/gomega v1.42.1/go.mod h1:REff/hsDsodHoKlWsP2mAPhu1+5/6hVYNf9rIEBpeSg= +github.com/otiai10/copy v1.2.0/go.mod h1:rrF5dJ5F0t/EWSYODDu4j9/vEeYHMkc8jt0zJChqQWw= +github.com/otiai10/copy v1.14.0 h1:dCI/t1iTdYGtkvCuBG2BgR6KZa83PTclw4U5n2wAllU= +github.com/otiai10/copy v1.14.0/go.mod h1:ECfuL02W+/FkTWZWgQqXPWZgW9oeKCSQ5qVfSc4qc4w= +github.com/otiai10/curr v0.0.0-20150429015615-9b4961190c95/go.mod h1:9qAhocn7zKJG+0mI8eUu6xqkFDYS2kb2saOteoSB3cE= +github.com/otiai10/curr v1.0.0/go.mod h1:LskTG5wDwr8Rs+nNQ+1LlxRjAtTZZjtJW4rMXl6j4vs= +github.com/otiai10/mint v1.3.0/go.mod h1:F5AjcsTsWUqX+Na9fpHb52P8pcRX2CI6A3ctIT91xUo= +github.com/otiai10/mint v1.3.1/go.mod h1:/yxELlJQ0ufhjUwhshSj+wFjZ78CnZ48/1wtmBH1OTc= +github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8= +github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c= +github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY= +github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= +github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw= +github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo= +github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M= +github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0= +github.com/prometheus/client_golang v1.12.1 h1:ZiaPsmm9uiBeaSMRznKsCDNtPCS0T3JVDGF+06gjBzk= +github.com/prometheus/client_golang v1.12.1/go.mod h1:3Z9XVyYiZYEO+YQWt3RD2R3jrbd179Rt297l4aS6nDY= +github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo= +github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= +github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= +github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M= +github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA= +github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4= +github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo= +github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc= +github.com/prometheus/common v0.32.1 h1:hWIdL3N2HoUx3B8j3YN9mWor0qhY/NlEKZEaXxuIRh4= +github.com/prometheus/common v0.32.1/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls= +github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk= +github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA= +github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= +github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= +github.com/prometheus/procfs v0.7.3 h1:4jVXhlkAyzOScmCkXBTOLRLTz8EeU+eyjrwB/EPq0VU= +github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA= +github.com/quasilyte/go-ruleguard v0.4.5 h1:AGY0tiOT5hJX9BTdx/xBdoCubQUAE2grkqY2lSwvZcA= +github.com/quasilyte/go-ruleguard v0.4.5/go.mod h1:Vl05zJ538vcEEwu16V/Hdu7IYZWyKSwIy4c88Ro1kRE= +github.com/quasilyte/go-ruleguard/dsl v0.3.23 h1:lxjt5B6ZCiBeeNO8/oQsegE6fLeCzuMRoVWSkXC4uvY= +github.com/quasilyte/go-ruleguard/dsl v0.3.23/go.mod h1:KeCP03KrjuSO0H1kTuZQCWlQPulDV6YMIXmpQss17rU= +github.com/quasilyte/gogrep v0.5.0 h1:eTKODPXbI8ffJMN+W2aE0+oL0z/nh8/5eNdiO34SOAo= +github.com/quasilyte/gogrep v0.5.0/go.mod h1:Cm9lpz9NZjEoL1tgZ2OgeUKPIxL1meE7eo60Z6Sk+Ng= +github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727 h1:TCg2WBOl980XxGFEZSS6KlBGIV0diGdySzxATTWoqaU= +github.com/quasilyte/regex/syntax v0.0.0-20210819130434-b3f0c404a727/go.mod h1:rlzQ04UMyJXu/aOvhd8qT+hvDrFpiwqp8MRXDY9szc0= +github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 h1:M8mH9eK4OUR4lu7Gd+PU1fV2/qnDNfzT635KRSObncs= +github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567/go.mod h1:DWNGW8A4Y+GyBgPuaQJuWiy0XYftx4Xm/y5Jqk9I6VQ= +github.com/raeperd/recvcheck v0.3.1 h1:p7nZMxiCWkdUtY2i3o+pv1h4fJCR5gpvqAXr9326hEY= +github.com/raeperd/recvcheck v0.3.1/go.mod h1:CbE7iRocQ4uc71JwpW/CPSh4BShnkre4A9Gb508RypU= +github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= +github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= +github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= +github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g= +github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/ryancurrah/gomodguard v1.4.1 h1:eWC8eUMNZ/wM/PWuZBv7JxxqT5fiIKSIyTvjb7Elr+g= +github.com/ryancurrah/gomodguard v1.4.1/go.mod h1:qnMJwV1hX9m+YJseXEBhd2s90+1Xn6x9dLz11ualI1I= +github.com/ryancurrah/gomodguard/v2 v2.1.3 h1:E7sz3PJwE9Ba1reVxSpF6XLCPJZ74Kfw/LabTNM4GIA= +github.com/ryancurrah/gomodguard/v2 v2.1.3/go.mod h1:CQicdLGatWMxLX53JzoBjYlsNZhHbmLv2AVa0s2aivU= +github.com/ryanrolds/sqlclosecheck v0.6.0 h1:pEyL9okISdg1F1SEpJNlrEotkTGerv5BMk7U4AG0eVg= +github.com/ryanrolds/sqlclosecheck v0.6.0/go.mod h1:xyX16hsDaCMXHrMJ3JMzGf5OpDfHTOTTQrT7HOFUmeU= +github.com/sanposhiho/wastedassign/v2 v2.1.0 h1:crurBF7fJKIORrV85u9UUpePDYGWnwvv3+A96WvwXT0= +github.com/sanposhiho/wastedassign/v2 v2.1.0/go.mod h1:+oSmSC+9bQ+VUAxA66nBb0Z7N8CK7mscKTDYC6aIek4= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= +github.com/sashamelentyev/interfacebloat v1.1.0 h1:xdRdJp0irL086OyW1H/RTZTr1h/tMEOsumirXcOJqAw= +github.com/sashamelentyev/interfacebloat v1.1.0/go.mod h1:+Y9yU5YdTkrNvoX0xHc84dxiN1iBi9+G8zZIhPVoNjQ= +github.com/sashamelentyev/usestdlibvars v1.29.0 h1:8J0MoRrw4/NAXtjQqTHrbW9NN+3iMf7Knkq057v4XOQ= +github.com/sashamelentyev/usestdlibvars v1.29.0/go.mod h1:8PpnjHMk5VdeWlVb4wCdrB8PNbLqZ3wBZTZWkrpZZL8= +github.com/securego/gosec/v2 v2.29.0 h1:pF2HSLcnY5voqpxQumEe0O5YAAbvF4Syu4qeIewpLyc= +github.com/securego/gosec/v2 v2.29.0/go.mod h1:47C7ej+L2bC1NOxteU2aCGnCi4cZaoKzRt5y9plIvuY= +github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ= +github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM= +github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo= +github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE= +github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88= +github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo= +github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q= +github.com/sivchari/containedctx v1.0.3 h1:x+etemjbsh2fB5ewm5FeLNi5bUjK0V8n0RB+Wwfd0XE= +github.com/sivchari/containedctx v1.0.3/go.mod h1:c1RDvCbnJLtH4lLcYD/GqwiBSSf4F5Qk0xld2rBqzJ4= +github.com/sonatard/noctx v0.5.1 h1:wklWg9c9ZYugOAk7qG4yP4PBrlQsmSLPTvW1K4PRQMs= +github.com/sonatard/noctx v0.5.1/go.mod h1:64XdbzFb18XL4LporKXp8poqZtPKbCrqQ402CV+kJas= +github.com/sourcegraph/go-diff v0.9.0 h1:7xcVsayWHhvxZGrqt1o89vvBApCa4nyCgO7tNxDHJ+Q= +github.com/sourcegraph/go-diff v0.9.0/go.mod h1:hWlcO7Al+UZStZAP8rBumHpCK5ZHQ5BXsMls8p4+F5E= +github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I= +github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg= +github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w= +github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU= +github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= +github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= +github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk= +github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo= +github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= +github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/viper v1.12.0 h1:CZ7eSOd3kZoaYDLbXnmzgQI5RlciuXBMA+18HwHRfZQ= +github.com/spf13/viper v1.12.0/go.mod h1:b6COn30jlNxbm/V2IqWiNWkJ+vZNiMNksliPCiuKtSI= +github.com/ssgreg/nlreturn/v2 v2.2.1 h1:X4XDI7jstt3ySqGU86YGAURbxw3oTDPK9sPEi6YEwQ0= +github.com/ssgreg/nlreturn/v2 v2.2.1/go.mod h1:E/iiPB78hV7Szg2YfRgyIrk1AD6JVMTRkkxBiELzh2I= +github.com/stbenjam/no-sprintf-host-port v0.3.1 h1:AyX7+dxI4IdLBPtDbsGAyqiTSLpCP9hWRrXQDU4Cm/g= +github.com/stbenjam/no-sprintf-host-port v0.3.1/go.mod h1:ODbZesTCHMVKthBHskvUUexdcNHAQRXk9NpSsL8p/HQ= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= +github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= +github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs= +github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0= +github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA= +github.com/tenntenn/modver v1.0.1/go.mod h1:bePIyQPb7UeioSRkw3Q0XeMhYZSMx9B8ePqg6SAMGH0= +github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3 h1:f+jULpRQGxTSkNYKJ51yaw6ChIqO+Je8UqsTKN/cDag= +github.com/tenntenn/text/transform v0.0.0-20200319021203-7eef512accb3/go.mod h1:ON8b8w4BN/kE1EOhwT0o+d62W65a6aPw1nouo9LMgyY= +github.com/tetafro/godot v1.5.6 h1:IEkrFCwXaYHlOn4mGzGS3F3dkP6m9t0jpwqBFPIkKiA= +github.com/tetafro/godot v1.5.6/go.mod h1:eOkMrVQurDui411nBY2FA05EYH01r14LuWY/NrVDVcU= +github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c h1:d/FUP8GD4QiY/rdFzZmBu3KqL9eBNVzMu7W/5pGkaMM= +github.com/timakin/bodyclose v0.0.0-20260723120731-857993a2939c/go.mod h1:sDHLK7rb/59v/ZxZ7KtymgcoxuUMxjXq8gtu9VMOK8M= +github.com/timonwong/loggercheck v0.12.0 h1:7Cb9XGLJZSWYNjgL459DIhpSiEHupD+MLQ6vaN2Pl3g= +github.com/timonwong/loggercheck v0.12.0/go.mod h1:Wa6Y+SJHQR01mViZlLLY5GAZVOWOLNMbkXddMjFWQCs= +github.com/tomarrell/wrapcheck/v2 v2.12.0 h1:H/qQ1aNWz/eeIhxKAFvkfIA+N7YDvq6TWVFL27Of9is= +github.com/tomarrell/wrapcheck/v2 v2.12.0/go.mod h1:AQhQuZd0p7b6rfW+vUwHm5OMCGgp63moQ9Qr/0BpIWo= +github.com/tommy-muehle/go-mnd/v2 v2.5.1 h1:NowYhSdyE/1zwK9QCLeRb6USWdoif80Ie+v+yU8u1Zw= +github.com/tommy-muehle/go-mnd/v2 v2.5.1/go.mod h1:WsUAkMJMYww6l/ufffCD3m+P7LEvr8TnZn9lwVDlgzw= +github.com/ultraware/funlen v0.2.0 h1:gCHmCn+d2/1SemTdYMiKLAHFYxTYz7z9VIDRaTGyLkI= +github.com/ultraware/funlen v0.2.0/go.mod h1:ZE0q4TsJ8T1SQcjmkhN/w+MceuatI6pBFSxxyteHIJA= +github.com/ultraware/whitespace v0.2.0 h1:TYowo2m9Nfj1baEQBjuHzvMRbp19i+RCcRYrSWoFa+g= +github.com/ultraware/whitespace v0.2.0/go.mod h1:XcP1RLD81eV4BW8UhQlpaR+SDc2givTvyI8a586WjW8= +github.com/uudashr/gocognit v1.2.1 h1:CSJynt5txTnORn/DkhiB4mZjwPuifyASC8/6Q0I/QS4= +github.com/uudashr/gocognit v1.2.1/go.mod h1:acaubQc6xYlXFEMb9nWX2dYBzJ/bIjEkc1zzvyIZg5Q= +github.com/uudashr/iface v1.5.1 h1:BS3yrgaT55s3dAtJoxuTnsZNbsejq/mVuzp49YDyfBA= +github.com/uudashr/iface v1.5.1/go.mod h1:5UWoT6SvTdTww/KToRj6clO+n4Kg3/NrAQvgOB+5Ggw= +github.com/xen0n/gosmopolitan v1.3.0 h1:zAZI1zefvo7gcpbCOrPSHJZJYA9ZgLfJqtKzZ5pHqQM= +github.com/xen0n/gosmopolitan v1.3.0/go.mod h1:rckfr5T6o4lBtM1ga7mLGKZmLxswUoH1zxHgNXOsEt4= +github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY= +github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= +github.com/yagipy/maintidx v1.0.0 h1:h5NvIsCz+nRDapQ0exNv4aJ0yXSI0420omVANTv3GJM= +github.com/yagipy/maintidx v1.0.0/go.mod h1:0qNf/I/CCZXSMhsRsrEPDZ+DkekpKLXAJfsTACwgXLk= +github.com/yeya24/promlinter v0.3.0 h1:JVDbMp08lVCP7Y6NP3qHroGAO6z2yGKQtS5JsjqtoFs= +github.com/yeya24/promlinter v0.3.0/go.mod h1:cDfJQQYv9uYciW60QT0eeHlFodotkYZlL+YcPQN+mW4= +github.com/ykadowak/zerologlint v0.1.5 h1:Gy/fMz1dFQN9JZTPjv1hxEk+sRWm05row04Yoolgdiw= +github.com/ykadowak/zerologlint v0.1.5/go.mod h1:KaUskqF3e/v59oPmdq1U1DnKcuHokl2/K1U4pmIELKg= +github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= +github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +gitlab.com/bosi/decorder v0.4.2 h1:qbQaV3zgwnBZ4zPMhGLW4KZe7A7NwxEhJx39R3shffo= +gitlab.com/bosi/decorder v0.4.2/go.mod h1:muuhHoaJkA9QLcYHq4Mj8FJUwDZ+EirSHRiaTcTf6T8= +go-simpler.org/assert v0.9.0 h1:PfpmcSvL7yAnWyChSjOz6Sp6m9j5lyK8Ok9pEL31YkQ= +go-simpler.org/assert v0.9.0/go.mod h1:74Eqh5eI6vCK6Y5l3PI8ZYFXG4Sa+tkr70OIPJAUr28= +go-simpler.org/musttag v0.14.0 h1:XGySZATqQYSEV3/YTy+iX+aofbZZllJaqwFWs+RTtSo= +go-simpler.org/musttag v0.14.0/go.mod h1:uP8EymctQjJ4Z1kUnjX0u2l60WfUdQxCwSNKzE1JEOE= +go-simpler.org/sloglint v0.12.0 h1:UzWDlLWNE5FLqsvyq3tWYHuQMbqrervOhT8qPl4Mmw4= +go-simpler.org/sloglint v0.12.0/go.mod h1:jBjjC2bm8rYrs88oTRlFX497kWjJsyZWYoNaXkGRI6I= +go.augendre.info/arangolint v0.4.0 h1:xSCZjRoS93nXazBSg5d0OGCi9APPLNMmmLrC995tR50= +go.augendre.info/arangolint v0.4.0/go.mod h1:l+f/b4plABuFISuKnTGD4RioXiCCgghv2xqst/xOvAA= +go.augendre.info/fatcontext v0.10.1 h1:HCS/+eob32cM0mEtmZM6NiXdqvS5KiZmsR+fCubTpbc= +go.augendre.info/fatcontext v0.10.1/go.mod h1:pqpGvA9GlrXy+aXkp8L2dKz12Zp4g2FhzcAtwToU+2w= +go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU= +go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8= +go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= +go.uber.org/multierr v1.10.0 h1:S0h4aNzvfcFsC3dRF1jLoaov7oRaKqRGC/pUEJ2yvPQ= +go.uber.org/multierr v1.10.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8= +go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= +golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= +golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= +golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= +golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek= +golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY= +golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= +golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= +golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4= +golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM= +golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU= +golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o= +golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8= +golang.org/x/exp/typeparams v0.0.0-20220428152302-39d4317da171/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk= +golang.org/x/exp/typeparams v0.0.0-20230203172020-98cc5a0785f9/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk= +golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f h1:+lI8cDJ4uceLipg2f1ODay7fEuLkk0BIHXd6PB8icxo= +golang.org/x/exp/typeparams v0.0.0-20260811152304-ee035b5b010f/go.mod h1:PqrXSW65cXDZH0k4IeUbhmg/bcAZDbzNz3byBpKCsXo= +golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= +golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= +golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= +golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= +golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= +golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= +golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs= +golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= +golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= +golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE= +golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o= +golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc= +golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY= +golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= +golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= +golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= +golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= +golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= +golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks= +golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= +golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= +golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= +golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= +golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= +golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= +golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= +golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= +golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= +golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A= +golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20211105183446-c75c47738b0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= +golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= +golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs= +golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= +golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= +golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q= +golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= +golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= +golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc= +golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= +golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw= +golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw= +golang.org/x/tools v0.0.0-20200329025819-fd4102a86c65/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8= +golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8= +golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= +golang.org/x/tools v0.0.0-20200724022722-7017fd6b1305/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA= +golang.org/x/tools v0.1.1-0.20210205202024-ef80cdb6ec6d/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU= +golang.org/x/tools v0.1.1-0.20210302220138-2ac05c832e1a/go.mod h1:9bzcO0MWcOuT0tm1iBGzDVPshzfwoVvREIui8C+MHqU= +golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E= +golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= +golang.org/x/tools v0.50.0 h1:c2ifzfcuY7L90lZ2aKd8S4K2NpASF08SZx9ZuJkHmSU= +golang.org/x/tools v0.50.0/go.mod h1:7ulVMw3831Mwi5EZD6RomGyffr4VFjuNYXf2BbCEAV0= +golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= +golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE= +google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M= +google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= +google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg= +google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= +google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= +google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI= +google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE= +google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= +google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE= +google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM= +google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc= +google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= +google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= +google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4= +google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0= +google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc= +google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= +google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE= +google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= +google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= +google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8= +google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc= +google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA= +google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= +google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U= +google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo= +google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA= +google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no= +google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= +google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38= +google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM= +google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= +google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= +google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= +google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= +google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= +google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60= +google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= +google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= +google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak= +google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= +google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= +google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= +google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE= +google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo= +google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU= +google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4= +google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c= +google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= +google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= +gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI= +gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA= +gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k= +gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4= +honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= +honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= +honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k= +honnef.co/go/tools v0.8.1 h1:+JKf3xJ1ni4CwrhVg4/pqsfPGP6vNAXcKbMXJodYx3w= +honnef.co/go/tools v0.8.1/go.mod h1:XA+OnlRA9EDh/ukGvXMNSZNKGwFQJ+5dER0ioUkOxks= +mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho= +mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA= +mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8 h1:Re1NRyLpiAt9kB+ImaaoapwWiQXrKwER4tY8fLOkDew= +mvdan.cc/unparam v0.0.0-20260823230713-2fa3d841b0c8/go.mod h1:MrS/+zJ1M2xvGXhKktiHbNQeQPyg3Qel+KkzT+f7/i4= +rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= +rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0= +rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= diff --git a/tools/govulncheck/go.mod b/tools/govulncheck/go.mod new file mode 100644 index 00000000..07c5e92d --- /dev/null +++ b/tools/govulncheck/go.mod @@ -0,0 +1,14 @@ +module github.com/hyperscale-stack/security/tools/govulncheck + +go 1.27.2 + +tool golang.org/x/vuln/cmd/govulncheck + +require ( + golang.org/x/mod v0.42.0 // indirect + golang.org/x/sync v0.24.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e // indirect + golang.org/x/tools v0.52.0 // indirect + golang.org/x/vuln v1.9.0 // indirect +) diff --git a/tools/govulncheck/go.sum b/tools/govulncheck/go.sum new file mode 100644 index 00000000..cdaf239c --- /dev/null +++ b/tools/govulncheck/go.sum @@ -0,0 +1,22 @@ +github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU= +github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA= +github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= +golang.org/x/mod v0.42.0 h1:ICeL3t2L30ljSPHHxDnR4fqVcBt/zR2zJAb9juavmQg= +golang.org/x/mod v0.42.0/go.mod h1:u5fzIrRInkL8MaO1cbRkUHT64v303YIT5KEqpNr7jRs= +golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= +golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e h1:P6NGsugec4oASJ+yKMNgTndeo0h2CbixZLvQIe9h5R4= +golang.org/x/telemetry v0.0.0-20261010193011-f71dc92da45e/go.mod h1:GNu+nb+E5axfGmP+Uu3ZVQu5lE/Xk42MjZOHWUD94/o= +golang.org/x/tools v0.52.0 h1:ryxg4U63oaUYk7uOLTF37n43f4qgtGvqV4Ioit1BaEs= +golang.org/x/tools v0.52.0/go.mod h1:ItcP5UNaVGG+Yc4eIYmaFLNJ4soEopkx5Y2d4lcEurs= +golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= +golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8= +golang.org/x/vuln v1.9.0 h1:12VaqnI9kJfqwRoPptxoqsUhQtdfrSbdksT7X/KY/sc= +golang.org/x/vuln v1.9.0/go.mod h1:E/Frwm0xp49fTyBW+6CQHdkvobknbwUM49yEpMGUauw= diff --git a/tools/mockery/go.mod b/tools/mockery/go.mod new file mode 100644 index 00000000..be0756b2 --- /dev/null +++ b/tools/mockery/go.mod @@ -0,0 +1,44 @@ +module github.com/hyperscale-stack/security/tools/mockery + +go 1.27.2 + +tool github.com/vektra/mockery/v3 + +require ( + github.com/brunoga/deep v1.3.1 // indirect + github.com/clipperhouse/uax29/v2 v2.2.0 // indirect + github.com/fatih/structs v1.1.0 // indirect + github.com/fsnotify/fsnotify v1.9.0 // indirect + github.com/go-viper/mapstructure/v2 v2.5.0 // indirect + github.com/huandu/xstrings v1.5.0 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect + github.com/jedib0t/go-pretty/v6 v6.7.8 // indirect + github.com/knadh/koanf/maps v0.1.2 // indirect + github.com/knadh/koanf/parsers/yaml v1.1.0 // indirect + github.com/knadh/koanf/providers/env v1.1.0 // indirect + github.com/knadh/koanf/providers/file v1.2.1 // indirect + github.com/knadh/koanf/providers/posflag v1.0.1 // indirect + github.com/knadh/koanf/providers/structs v1.0.0 // indirect + github.com/knadh/koanf/v2 v2.3.2 // indirect + github.com/mattn/go-colorable v0.1.14 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect + github.com/mattn/go-runewidth v0.0.19 // indirect + github.com/mitchellh/copystructure v1.2.0 // indirect + github.com/mitchellh/reflectwalk v1.0.2 // indirect + github.com/rs/zerolog v1.34.0 // indirect + github.com/spf13/cobra v1.10.2 // indirect + github.com/spf13/pflag v1.0.10 // indirect + github.com/vektra/mockery/v3 v3.8.1 // indirect + github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect + github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect + github.com/xeipuuv/gojsonschema v1.2.0 // indirect + go.yaml.in/yaml/v3 v3.0.4 // indirect + golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect + golang.org/x/mod v0.41.0 // indirect + golang.org/x/sync v0.23.0 // indirect + golang.org/x/sys v0.48.0 // indirect + golang.org/x/term v0.40.0 // indirect + golang.org/x/text v0.34.0 // indirect + golang.org/x/tools v0.51.0 // indirect + gopkg.in/yaml.v3 v3.0.1 // indirect +) diff --git a/tools/mockery/go.sum b/tools/mockery/go.sum new file mode 100644 index 00000000..fee0ed65 --- /dev/null +++ b/tools/mockery/go.sum @@ -0,0 +1,109 @@ +github.com/brunoga/deep v1.3.1 h1:bSrL6FhAZa6JlVv4vsi7Hg8SLwroDb1kgDERRVipBCo= +github.com/brunoga/deep v1.3.1/go.mod h1:GDV6dnXqn80ezsLSZ5Wlv1PdKAWAO4L5PnKYtv2dgaI= +github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY= +github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= +github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= +github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo= +github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M= +github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= +github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= +github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro= +github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= +github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= +github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= +github.com/jedib0t/go-pretty/v6 v6.7.8 h1:BVYrDy5DPBA3Qn9ICT+PokP9cvCv1KaHv2i+Hc8sr5o= +github.com/jedib0t/go-pretty/v6 v6.7.8/go.mod h1:YwC5CE4fJ1HFUDeivSV1r//AmANFHyqczZk+U6BDALU= +github.com/knadh/koanf/maps v0.1.2 h1:RBfmAW5CnZT+PJ1CVc1QSJKf4Xu9kxfQgYVQSu8hpbo= +github.com/knadh/koanf/maps v0.1.2/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI= +github.com/knadh/koanf/parsers/yaml v1.1.0 h1:3ltfm9ljprAHt4jxgeYLlFPmUaunuCgu1yILuTXRdM4= +github.com/knadh/koanf/parsers/yaml v1.1.0/go.mod h1:HHmcHXUrp9cOPcuC+2wrr44GTUB0EC+PyfN3HZD9tFg= +github.com/knadh/koanf/providers/env v1.1.0 h1:U2VXPY0f+CsNDkvdsG8GcsnK4ah85WwWyJgef9oQMSc= +github.com/knadh/koanf/providers/env v1.1.0/go.mod h1:QhHHHZ87h9JxJAn2czdEl6pdkNnDh/JS1Vtsyt65hTY= +github.com/knadh/koanf/providers/file v1.2.1 h1:bEWbtQwYrA+W2DtdBrQWyXqJaJSG3KrP3AESOJYp9wM= +github.com/knadh/koanf/providers/file v1.2.1/go.mod h1:bp1PM5f83Q+TOUu10J/0ApLBd9uIzg+n9UgthfY+nRA= +github.com/knadh/koanf/providers/posflag v1.0.1 h1:EnMxHSrPkYCFnKgBUl5KBgrjed8gVFrcXDzaW4l/C6Y= +github.com/knadh/koanf/providers/posflag v1.0.1/go.mod h1:3Wn3+YG3f4ljzRyCUgIwH7G0sZ1pMjCOsNBovrbKmAk= +github.com/knadh/koanf/providers/structs v1.0.0 h1:DznjB7NQykhqCar2LvNug3MuxEQsZ5KvfgMbio+23u4= +github.com/knadh/koanf/providers/structs v1.0.0/go.mod h1:kjo5TFtgpaZORlpoJqcbeLowM2cINodv8kX+oFAeQ1w= +github.com/knadh/koanf/v2 v2.3.2 h1:Ee6tuzQYFwcZXQpc2MiVeC6qHMandf5SMUJJNoFp/c4= +github.com/knadh/koanf/v2 v2.3.2/go.mod h1:gRb40VRAbd4iJMYYD5IxZ6hfuopFcXBpc9bbQpZwo28= +github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= +github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= +github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= +github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= +github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= +github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= +github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-runewidth v0.0.19 h1:v++JhqYnZuu5jSKrk9RbgF5v4CGUjqRfBm05byFGLdw= +github.com/mattn/go-runewidth v0.0.19/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= +github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= +github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= +github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= +github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0= +github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY= +github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= +github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= +github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= +github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4= +github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/vektra/mockery/v3 v3.8.1 h1:TDDa46ooae8DWWR0uCPNyqqDL3uGK0uRvNae0/uotJ8= +github.com/vektra/mockery/v3 v3.8.1/go.mod h1:1+hDVtNiQfxGv9YhpYmQ1q1Drf7z4w1rUvsAvwe2aIY= +github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= +github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo= +github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU= +github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0= +github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ= +github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74= +github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y= +go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a h1:ovFr6Z0MNmU7nH8VaX5xqw+05ST2uO1exVfZPVqRC5o= +golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= +golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= +golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= From 810d31af76962bae536db3a46fb1b83768c41a05 Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 00:54:54 +0200 Subject: [PATCH 4/9] build: require Go 1.27.2 in every module Every module declared go 1.26.0 or 1.26.5 and CI tested with go1.26.5, which carries standard-library advisories reachable from the library's call paths (HTTP/2 server crashes and request smuggling in net/http, crypto/tls post-handshake and ECH issues, encoding/asn1 recursion, net/url, encoding/xml...). Nothing in the build enforced a patched toolchain, and the mixed go lines made `GOWORK=off go build` fail in the modules at 1.26.0 ("updates to go.mod needed"). Set `go 1.27.2` in every go.mod (the tool modules included) and in go.work. Since Go 1.21 the go line is a minimum, so no consumer can build the library with an unpatched toolchain (GOTOOLCHAIN=auto switches to go1.27.2, verified by the checksum database; a GOTOOLCHAIN=local toolchain stops with a clear message), and CI follows go.work. govulncheck reports no reachable advisory on go1.27.2 in any of the 25 modules; the only remaining item is GO-2026-5932 (x/crypto/openpgp is unmaintained, no fix), at module level, never imported. go mod tidy merges the duplicate require blocks of password and internal/interop/saml (Go 1.27 behaviour). make sync is a no-op; every module builds, vets and is tidy with GOWORK=off, with and without the generated mocks. MIGRATION.md documents the floor and the Go 1.27 behaviour it brings. Audit: DEP-01, CI-02. --- CHANGELOG.md | 6 +++++ CLAUDE.md | 6 +++-- MIGRATION.md | 42 +++++++++++++++++++++++++++++++ README.md | 3 +++ basic/go.mod | 2 +- bearer/go.mod | 2 +- connectrpc/go.mod | 2 +- examples/go.mod | 2 +- go.mod | 2 +- go.work | 2 +- grpc/go.mod | 2 +- http/go.mod | 2 +- internal/integrations/go.mod | 2 +- internal/interop/oidcop/go.mod | 2 +- internal/interop/oidcrp/go.mod | 2 +- internal/interop/oidcstack/go.mod | 2 +- internal/interop/saml/go.mod | 37 +++++++++++++-------------- jwt/go.mod | 2 +- oauth2/go.mod | 2 +- oauth2/store/redis/go.mod | 2 +- oauth2/store/sql/go.mod | 2 +- oidc/client/go.mod | 2 +- oidc/client/store/redis/go.mod | 2 +- oidc/client/store/sql/go.mod | 2 +- oidc/provider/go.mod | 2 +- password/go.mod | 11 ++++---- saml/sp/go.mod | 2 +- saml/sp/store/redis/go.mod | 2 +- saml/sp/store/sql/go.mod | 2 +- session/go.mod | 2 +- 30 files changed, 101 insertions(+), 52 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 03bc3f1e..54e2f08d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -514,6 +514,12 @@ legacy packages (`authentication/`, `authorization/`, the in-tree `ErrTransactionIntegrity`. `Config` and `*Client` now print and log without the client secret and the keys, whatever the `fmt` verb. The example reads `OIDC_TRANSACTION_KEYS`. See [MIGRATION.md](MIGRATION.md). +- **Go 1.27.2 minimum** (breaking): every module and `go.work` declare + `go 1.27.2`, so no consumer can build the library with a toolchain that + carries the standard-library advisories of go1.26.5, the version CI tested + with until now (HTTP/2 crashes, request smuggling, `crypto/tls`, + `encoding/asn1`; govulncheck finds none on go1.27.2). CI runs the version + `go.work` names. See [MIGRATION.md](MIGRATION.md). - **Development tools in their own modules**: golangci-lint (v2.14.0, Go 1.27 support), govulncheck (v1.9.0) and mockery (v3.8.1) are pinned in one module each under `tools/`, outside `go.work`. The core module no longer diff --git a/CLAUDE.md b/CLAUDE.md index 1bdbf491..76a79065 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -153,7 +153,8 @@ for the OAuth2 SQL/Redis stores and the interop modules, `=> ../../../../` for the OIDC client and SAML SP stores, which also replace `oidc/client => ../../` or `saml/sp => ../../`) plus one per in-repo module of its graph, so local dev works without published -versions. New modules declare `go 1.26.5`, like the core. +versions. New modules declare `go 1.27.2`: every `go.mod` and `go.work` +carry the same `go` line. ## Core architecture @@ -391,6 +392,7 @@ by response content). linters including `gosec`, `wrapcheck`, `errorlint`, `wsl_v5`, `forcetypeassert`. `gocyclo` max complexity 18. Tests are excluded from lint (`run.tests: false`). All wrapped errors must keep `%w`. -- Go 1.26. Indentation: tabs in `.go` and `Makefile`, 4 spaces elsewhere, +- Go 1.27.2 in every `go.mod` and in `go.work` (CI installs the version + `go.work` names). Indentation: tabs in `.go` and `Makefile`, 4 spaces elsewhere, 2 spaces in YAML (see `.editorconfig`). All source files carry the MIT copyright header. diff --git a/MIGRATION.md b/MIGRATION.md index 0fbf0b22..1b5bb35f 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -794,3 +794,45 @@ To migrate: 2. A `Profile20` client that sends a `code_verifier` without having sent a `code_challenge` now fails: send the matching `code_challenge` (S256) in its authorization requests, or stop sending the verifier. + +### Toolchain: every module requires Go 1.27.2 + +Every `go.mod`, and `go.work`, now declares `go 1.27.2`. Since Go 1.21 the +`go` line is a minimum: a module that requires one of ours must declare +`go 1.27.2` or later, and building it needs a go1.27.2 or later toolchain. +The modules used to declare `go 1.26.0` or `go 1.26.5`, and the toolchain CI +tested with (go1.26.5) carries standard-library advisories reachable from +the library's own call paths: HTTP/2 server crashes and request smuggling in +`net/http`, `crypto/tls`, `encoding/asn1`, `net/url`, `encoding/xml`. All of +them are fixed in go1.27.2, on which `govulncheck` reports none. + +| | Before | After | +| ------------------------------------------ | ------------------------- | ---------------------------------------------------------- | +| `go` line of every module and of `go.work` | `go 1.26.0` / `go 1.26.5` | `go 1.27.2` | +| Toolchain that builds a consumer | go1.26.0 or later | go1.27.2 or later (switched to under `GOTOOLCHAIN=auto`) | +| Toolchain CI tests and releases with | go1.26.5 | go1.27.2, read from `go.work` | + +Behaviour the Go 1.27 floor brings to every consumer (Go 1.27 release +notes): + +- `encoding/json` runs on the `encoding/json/v2` implementation: what is + marshaled and unmarshaled is unchanged, but error texts may differ, so + never match on them; +- `net/http`: closing an HTTP/1 `Response.Body` drains the unread content; +- `crypto/x509`: on darwin and windows `SystemCertPool` honours + `SSL_CERT_FILE` and `SSL_CERT_DIR` (`GODEBUG=x509sslcertoverrideplatform=0` + restores the platform verifier); +- `compress/flate` (and so `gzip`) output differs from Go 1.26 for the same + input. + +To migrate: + +1. Set your module's `go` line to `1.27.2` or later: `go get` of one of our + modules does it, or run `go mod edit -go=1.27.2`. +2. With `GOTOOLCHAIN=auto` (the default) the go command downloads go1.27.2 + from the module proxy, verified by the checksum database. Where + `GOTOOLCHAIN=local` (some Linux distributions, hermetic CI), install + go1.27.2 or later first: an older toolchain stops with + `go.mod requires go >= 1.27.2`. +3. Build and ship with the latest Go patch release: the `go` line is a + floor, not the toolchain to release with. diff --git a/README.md b/README.md index af69d5ae..3d561d4c 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,9 @@ The core module also ships `…/security/outbound`, an SSRF-safe ## Install +Every module requires **Go 1.27.2** or later (`go` line of each `go.mod`); +with the default `GOTOOLCHAIN=auto` an older go command downloads it. + ```sh go get github.com/hyperscale-stack/security go get github.com/hyperscale-stack/security/http # and any other module you need diff --git a/basic/go.mod b/basic/go.mod index 6288fece..70516f7a 100644 --- a/basic/go.mod +++ b/basic/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/basic -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 diff --git a/bearer/go.mod b/bearer/go.mod index 449e81cc..10df4f97 100644 --- a/bearer/go.mod +++ b/bearer/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/bearer -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 diff --git a/connectrpc/go.mod b/connectrpc/go.mod index e704af8b..d1058ce7 100644 --- a/connectrpc/go.mod +++ b/connectrpc/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/connectrpc -go 1.26.5 +go 1.27.2 require ( connectrpc.com/connect v1.21.0 diff --git a/examples/go.mod b/examples/go.mod index 2f88913c..ba410bcc 100644 --- a/examples/go.mod +++ b/examples/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/examples -go 1.26.5 +go 1.27.2 // Examples may depend on every other module of the workspace. replace github.com/hyperscale-stack/security => ../ diff --git a/go.mod b/go.mod index 221a00d6..4162f5c3 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security -go 1.26.5 +go 1.27.2 require ( github.com/stretchr/testify v1.12.1 diff --git a/go.work b/go.work index 7ee3b4e7..d4db1718 100644 --- a/go.work +++ b/go.work @@ -1,4 +1,4 @@ -go 1.26.5 +go 1.27.2 use ( . diff --git a/grpc/go.mod b/grpc/go.mod index 6ea5129d..796bbd2b 100644 --- a/grpc/go.mod +++ b/grpc/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/grpc -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 diff --git a/http/go.mod b/http/go.mod index 345560ae..756f9f49 100644 --- a/http/go.mod +++ b/http/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/http -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security => ../ diff --git a/internal/integrations/go.mod b/internal/integrations/go.mod index 5245baa0..64a7cfb4 100644 --- a/internal/integrations/go.mod +++ b/internal/integrations/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/internal/integrations -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 diff --git a/internal/interop/oidcop/go.mod b/internal/interop/oidcop/go.mod index 18a00e36..0521a4a5 100644 --- a/internal/interop/oidcop/go.mod +++ b/internal/interop/oidcop/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/internal/interop/oidcop -go 1.26.5 +go 1.27.2 require ( github.com/coreos/go-oidc/v3 v3.21.0 diff --git a/internal/interop/oidcrp/go.mod b/internal/interop/oidcrp/go.mod index b1ec99c3..16c7ac94 100644 --- a/internal/interop/oidcrp/go.mod +++ b/internal/interop/oidcrp/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/internal/interop/oidcrp -go 1.26.5 +go 1.27.2 require ( github.com/chromedp/cdproto v0.157.9 diff --git a/internal/interop/oidcstack/go.mod b/internal/interop/oidcstack/go.mod index 9d0a731b..9108f105 100644 --- a/internal/interop/oidcstack/go.mod +++ b/internal/interop/oidcstack/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/internal/interop/oidcstack -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security => ../../../ diff --git a/internal/interop/saml/go.mod b/internal/interop/saml/go.mod index d2c52502..eeefbdd7 100644 --- a/internal/interop/saml/go.mod +++ b/internal/interop/saml/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/internal/interop/saml -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security/saml/sp => ../../../saml/sp @@ -8,10 +8,13 @@ replace github.com/hyperscale-stack/security => ../../../ require ( github.com/alicebob/miniredis/v2 v2.39.0 + github.com/beevik/etree v1.8.1 github.com/crewjam/saml v0.5.1 github.com/go-sql-driver/mysql v1.10.1 github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 github.com/hyperscale-stack/security/saml/sp v0.0.0-00010101000000-000000000000 + github.com/hyperscale-stack/security/saml/sp/store/redis v0.0.0-00010101000000-000000000000 + github.com/hyperscale-stack/security/saml/sp/store/sql v0.0.0-00010101000000-000000000000 github.com/jackc/pgx/v5 v5.11.0 github.com/redis/go-redis/v9 v9.23.0 github.com/stretchr/testify v1.12.1 @@ -20,17 +23,30 @@ require ( require ( filippo.io/edwards25519 v1.2.0 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/dustin/go-humanize v1.0.1 // indirect + github.com/go-logr/logr v1.4.4 // indirect + github.com/go-logr/stdr v1.2.2 // indirect github.com/google/uuid v1.6.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect + github.com/jonboulle/clockwork v0.5.0 // indirect + github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect github.com/mattn/go-isatty v0.0.24 // indirect github.com/ncruces/go-strftime v1.0.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect + github.com/russellhaering/gosaml2 v0.12.0 // indirect + github.com/russellhaering/goxmldsig v1.6.1 // indirect github.com/yuin/gopher-lua v1.1.1 // indirect + go.opentelemetry.io/auto/sdk v1.2.1 // indirect + go.opentelemetry.io/otel v1.47.0 // indirect go.opentelemetry.io/otel/log v1.47.0 // indirect + go.opentelemetry.io/otel/metric v1.47.0 // indirect + go.opentelemetry.io/otel/trace v1.47.0 // indirect go.uber.org/atomic v1.12.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/crypto v0.58.0 // indirect golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/text v0.43.0 // indirect @@ -39,25 +55,6 @@ require ( modernc.org/memory v1.12.1 // indirect ) -require ( - github.com/beevik/etree v1.8.1 - github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/go-logr/logr v1.4.4 // indirect - github.com/go-logr/stdr v1.2.2 // indirect - github.com/hyperscale-stack/security/saml/sp/store/redis v0.0.0-00010101000000-000000000000 - github.com/hyperscale-stack/security/saml/sp/store/sql v0.0.0-00010101000000-000000000000 - github.com/jonboulle/clockwork v0.5.0 // indirect - github.com/mattermost/xml-roundtrip-validator v0.1.0 // indirect - github.com/russellhaering/gosaml2 v0.12.0 // indirect - github.com/russellhaering/goxmldsig v1.6.1 // indirect - go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/otel v1.47.0 // indirect - go.opentelemetry.io/otel/metric v1.47.0 // indirect - go.opentelemetry.io/otel/trace v1.47.0 // indirect - go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/crypto v0.58.0 // indirect -) - replace github.com/hyperscale-stack/security/saml/sp/store/sql => ../../../saml/sp/store/sql replace github.com/hyperscale-stack/security/saml/sp/store/redis => ../../../saml/sp/store/redis diff --git a/jwt/go.mod b/jwt/go.mod index e49168d8..8ddb27aa 100644 --- a/jwt/go.mod +++ b/jwt/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/jwt -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security => ../ diff --git a/oauth2/go.mod b/oauth2/go.mod index 5aa73f79..bef33061 100644 --- a/oauth2/go.mod +++ b/oauth2/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oauth2 -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 diff --git a/oauth2/store/redis/go.mod b/oauth2/store/redis/go.mod index b8320733..2a1e019b 100644 --- a/oauth2/store/redis/go.mod +++ b/oauth2/store/redis/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oauth2/store/redis -go 1.26.5 +go 1.27.2 require ( github.com/alicebob/miniredis/v2 v2.39.0 diff --git a/oauth2/store/sql/go.mod b/oauth2/store/sql/go.mod index 0b5a9f86..f4ba688d 100644 --- a/oauth2/store/sql/go.mod +++ b/oauth2/store/sql/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oauth2/store/sql -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security/oauth2 v0.0.0-00010101000000-000000000000 diff --git a/oidc/client/go.mod b/oidc/client/go.mod index 6c8f6879..dcca87f6 100644 --- a/oidc/client/go.mod +++ b/oidc/client/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oidc/client -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security => ../../ diff --git a/oidc/client/store/redis/go.mod b/oidc/client/store/redis/go.mod index 3e0b1c97..fd59f875 100644 --- a/oidc/client/store/redis/go.mod +++ b/oidc/client/store/redis/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oidc/client/store/redis -go 1.26.5 +go 1.27.2 require ( github.com/alicebob/miniredis/v2 v2.39.0 diff --git a/oidc/client/store/sql/go.mod b/oidc/client/store/sql/go.mod index ae31ae8c..70cf44ea 100644 --- a/oidc/client/store/sql/go.mod +++ b/oidc/client/store/sql/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oidc/client/store/sql -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security/oidc/client v0.0.0-00010101000000-000000000000 diff --git a/oidc/provider/go.mod b/oidc/provider/go.mod index 76c26e88..6d4f7ce1 100644 --- a/oidc/provider/go.mod +++ b/oidc/provider/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/oidc/provider -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security => ../../ diff --git a/password/go.mod b/password/go.mod index f6c72f40..56a49b0c 100644 --- a/password/go.mod +++ b/password/go.mod @@ -1,15 +1,14 @@ module github.com/hyperscale-stack/security/password -go 1.26.0 - -require golang.org/x/crypto v0.58.0 +go 1.27.2 require ( - github.com/stretchr/objx v0.5.3 // indirect - go.yaml.in/yaml/v3 v3.0.5 // indirect + github.com/stretchr/testify v1.12.1 + golang.org/x/crypto v0.58.0 ) require ( - github.com/stretchr/testify v1.12.1 + github.com/stretchr/objx v0.5.3 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/sys v0.49.0 // indirect ) diff --git a/saml/sp/go.mod b/saml/sp/go.mod index fd254d7c..1918fb37 100644 --- a/saml/sp/go.mod +++ b/saml/sp/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/saml/sp -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security => ../../ diff --git a/saml/sp/store/redis/go.mod b/saml/sp/store/redis/go.mod index 16ce9c86..6b38a3d0 100644 --- a/saml/sp/store/redis/go.mod +++ b/saml/sp/store/redis/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/saml/sp/store/redis -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security/saml/sp => ../../ diff --git a/saml/sp/store/sql/go.mod b/saml/sp/store/sql/go.mod index 5e4329f1..fa1e9624 100644 --- a/saml/sp/store/sql/go.mod +++ b/saml/sp/store/sql/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/saml/sp/store/sql -go 1.26.5 +go 1.27.2 replace github.com/hyperscale-stack/security/saml/sp => ../../ diff --git a/session/go.mod b/session/go.mod index f4030a93..ff4f0d42 100644 --- a/session/go.mod +++ b/session/go.mod @@ -1,6 +1,6 @@ module github.com/hyperscale-stack/security/session -go 1.26.5 +go 1.27.2 require ( github.com/hyperscale-stack/security v0.0.0-00010101000000-000000000000 From 03589ddb9a4edec2d987e5a86eac3894f3e202f0 Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 01:02:16 +0200 Subject: [PATCH 5/9] build: check every module on its own and guard release tags Nothing checked that a module builds outside the workspace, and the workspace hid two release problems: - the mixed go lines made some modules unbuildable with GOWORK=off; - every sub-module requires the in-repo modules at the placeholder v0.0.0-00010101000000-000000000000, made to work by `replace` directives. Consumers ignore those, so a tag cut from this tree could not be resolved. A GOWORK=off build alone would not catch the second problem, since the module's own replace directives still apply. `make check-modules` (scripts/check-modules.sh), for CI and every release, fails unless: - go.work and every go.mod carry one go line and no toolchain line; - go.work lists every module (Dependabot's go.work mode covers exactly those); - `go work sync` changes nothing; - every module and tool module is tidy with GOWORK=off without the generated mocks (what go mod tidy and Dependabot see); - every module builds, vets and is still tidy with them. Seven mutants (go line drift, toolchain line, module missing from go.work, version drift, missing mock anchor, untidy module and tool module) each make it fail. `make release-check TAG=...` (scripts/release-check.sh, also run by the release workflow) refuses: - a tag that is not a canonical v1.MINOR.PATCH[-PRERELEASE] (the module paths carry no /vN, and the go command skips build metadata); - the examples, internal and tool modules; - a module path mismatch, a placeholder requirement, and a commit off origin/master. It then builds and vets a copy of the module without its in-repo replace directives, outside the workspace: what a consumer resolves. A dry run against a local module proxy refuses a module using a core symbol its required core version lacks ("undefined: security.ReleaseCheckProbe"), although its GOWORK=off build through replace passes. docs/releasing.md is the checklist: v1.0.0 first, dependency order, one release commit setting real requirements, the toolchain patch policy, and the repository settings the maintainer sets once. The git-flow `release` target (no develop branch exists) is removed. Audit: CI-02. --- CHANGELOG.md | 9 +++ CLAUDE.md | 14 ++-- MIGRATION.md | 9 ++- Makefile | 26 ++++---- README.md | 2 + docs/oidc-conformance.md | 4 +- docs/releasing.md | 135 +++++++++++++++++++++++++++++++++++++++ scripts/check-modules.sh | 91 ++++++++++++++++++++++++++ scripts/release-check.sh | 111 ++++++++++++++++++++++++++++++++ 9 files changed, 382 insertions(+), 19 deletions(-) create mode 100644 docs/releasing.md create mode 100755 scripts/check-modules.sh create mode 100755 scripts/release-check.sh diff --git a/CHANGELOG.md b/CHANGELOG.md index 54e2f08d..cec3da49 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -520,6 +520,15 @@ legacy packages (`authentication/`, `authorization/`, the in-tree with until now (HTTP/2 crashes, request smuggling, `crypto/tls`, `encoding/asn1`; govulncheck finds none on go1.27.2). CI runs the version `go.work` names. See [MIGRATION.md](MIGRATION.md). +- **Module and release checks**: `make check-modules` (run by CI) fails + unless `go.work` and every `go.mod` share one `go` line, `go.work` lists + every module, `go work sync` changes nothing and every module builds, vets + and is tidy on its own (`GOWORK=off`). `make release-check TAG=…` (also run + by the release workflow) accepts only canonical `v1.x.y` tags of released + modules, refuses placeholder requirements and commits off `master`, and + builds the module as a consumer resolves it, without its in-repo + `replace` directives. The first release of every module is `v1.0.0`; the + checklist is [docs/releasing.md](docs/releasing.md). - **Development tools in their own modules**: golangci-lint (v2.14.0, Go 1.27 support), govulncheck (v1.9.0) and mockery (v3.8.1) are pinned in one module each under `tools/`, outside `go.work`. The core module no longer diff --git a/CLAUDE.md b/CLAUDE.md index 76a79065..0ccae015 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -14,15 +14,15 @@ The whole `v0.x` series was replaced by a ground-up transport-agnostic rewrite; the legacy `authentication/` / `authorization/` packages were removed. The rewrite is functionally complete and currently `[Unreleased]`: its first release is **v1.0.0** for every module (the module paths carry -no `/vN` suffix). Remaining gaps are tracked as GitHub issues, not refactor -phases. Source-of-truth docs: +no `/vN` suffix; see `docs/releasing.md`). Remaining gaps are tracked as +GitHub issues, not refactor phases. Source-of-truth docs: - `CHANGELOG.md` — what the first release ships. - `MIGRATION.md` — workspace layout and dependency policy. - `LIMITATIONS.md` — known gaps and explicitly out-of-scope items. - `docs/` — `architecture.md`, `oidc-provider.md`, `oidc-client.md`, `oidc-conformance.md`, `saml-sp.md`, `observability.md`, - `security-considerations.md`, `migration-from-v0.md`. + `security-considerations.md`, `migration-from-v0.md`, `releasing.md`. ## Working rules @@ -60,6 +60,8 @@ make lint # golangci-lint (pinned in tools/golangci-lint, shared .golangci make vuln # govulncheck -test on every module, outside the workspace make tools # build the pinned tools (tools/) into build/bin make tidy # go work sync + go mod tidy per module (and tools/*) + go work sync +make check-modules # one go line, go.work complete, sync no-op, every module tidy/buildable with GOWORK=off +make release-check TAG=oauth2/v1.0.0 # pre-push check of a release tag (docs/releasing.md) make sync # go work sync make bench # benchmarks across all modules make coverage # go tool cover -func on the aggregated profile @@ -153,8 +155,10 @@ for the OAuth2 SQL/Redis stores and the interop modules, `=> ../../../../` for the OIDC client and SAML SP stores, which also replace `oidc/client => ../../` or `saml/sp => ../../`) plus one per in-repo module of its graph, so local dev works without published -versions. New modules declare `go 1.27.2`: every `go.mod` and `go.work` -carry the same `go` line. +versions; consumers ignore them, so a release commit sets the in-repo +requirements to real versions (`docs/releasing.md`). New modules declare +`go 1.27.2`: every `go.mod` and `go.work` carry the same `go` line, and a +new module must be added to `go.work` (`make check-modules` enforces both). ## Core architecture diff --git a/MIGRATION.md b/MIGRATION.md index 1b5bb35f..1ea3a0ab 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -145,6 +145,7 @@ make test # generate, then race + coverage, aggregated into build/covera make lint # golangci-lint (tools/golangci-lint) on every module with the shared config make vuln # govulncheck -test on every module, outside the workspace make tidy # go work sync + go mod tidy on every module and tool + go work sync +make check-modules # one go line, go.work complete, sync no-op, every module on its own (GOWORK=off) make e2e # opt-in browser suites (Tales + Chrome), never run by CI ``` @@ -172,7 +173,13 @@ Every sub-module declares `replace github.com/hyperscale-stack/security => ../` for the OAuth2 SQL/Redis stores and the interop modules, `=> ../../../../` for the OIDC client and SAML SP stores), plus one for each in-repo module of its graph, -so local development and CI work without published versions. Releases are cut per module with `module/vX.Y.Z` tags. +so local development and CI work without published versions. Releases are +cut per module with `module/vX.Y.Z` tags (`vX.Y.Z` for the core). Consumers +ignore these `replace` directives, so the in-repo requirements keep the +`v0.0.0-00010101000000-000000000000` placeholder only until a module's first +release: the release commit sets them to the released versions, and +`make release-check` builds each tagged module the way a consumer resolves +it (see [docs/releasing.md](docs/releasing.md)). ## Breaking changes before the first release diff --git a/Makefile b/Makefile index fa639e77..b8138933 100644 --- a/Makefile +++ b/Makefile @@ -105,6 +105,20 @@ vuln: generate $(BIN_DIR)/govulncheck (cd "$$mod" && GOWORK=off $(BIN_DIR)/govulncheck -test ./...) || exit 1; \ done +# Every module on its own (scripts/check-modules.sh): one go line, go.work +# lists every module, `go work sync` is a no-op, and every module builds, +# vets and is tidy with GOWORK=off, with and without the generated mocks. +# CI runs it on every change. +.PHONY: check-modules +check-modules: $(BIN_DIR)/mockery + @./scripts/check-modules.sh + +# Checks a release tag before it is pushed (docs/releasing.md): +# make release-check TAG=oauth2/v1.0.0 +.PHONY: release-check +release-check: generate + @./scripts/release-check.sh "$(TAG)" + # Opt-in browser suites (Tales and Chrome, prerequisites in docs/saml-sp.md # and e2e/oidc/run.sh): never part of `make test` nor of CI. .PHONY: e2e @@ -143,15 +157,3 @@ tidy: generate (cd "tools/$$tool" && GOWORK=off go mod tidy) || exit 1; \ done @go work sync - -.PHONY: release -release: - @echo "Release v$(version)" - @git pull - @git checkout master - @git pull - @git checkout develop - @git flow release start $(version) - @git flow release finish $(version) -p -m "Release v$(version)" - @git checkout develop - @echo "Release v$(version) finished." diff --git a/README.md b/README.md index 3d561d4c..48905640 100644 --- a/README.md +++ b/README.md @@ -100,6 +100,7 @@ mux.Handle("/admin", httpsec.Authorize(adm, security.Role("ADMIN"))(adminHandler - [docs/oidc-conformance.md](docs/oidc-conformance.md) — OpenID Connect coverage, interoperability and conformance-suite runs. - [docs/saml-sp.md](docs/saml-sp.md) — SAML Service Provider integration guide. - [docs/migration-from-v0.md](docs/migration-from-v0.md) — upgrading from the v0 stack. +- [docs/releasing.md](docs/releasing.md) — versions, tags and the release checklist. - [MIGRATION.md](MIGRATION.md) — workspace layout and dependency policy. - [LIMITATIONS.md](LIMITATIONS.md) — known gaps. - [examples/](examples) — runnable per-scenario demos. @@ -113,6 +114,7 @@ make generate # mockery mocks for the tests (never committed; test/lint/vuln run make test # race + coverage make lint # golangci-lint with the shared config (pinned in tools/golangci-lint) make vuln # govulncheck on every module +make check-modules # every module on its own (GOWORK=off), workspace in sync make e2e # opt-in browser suites (Tales and Chrome: docs/saml-sp.md, e2e/oidc/run.sh) make conformance # opt-in: the OpenID Foundation conformance suite, locally (docs/oidc-conformance.md) ``` diff --git a/docs/oidc-conformance.md b/docs/oidc-conformance.md index 90b80228..0edd1d06 100644 --- a/docs/oidc-conformance.md +++ b/docs/oidc-conformance.md @@ -305,7 +305,9 @@ driver's `results.json`); `OIDC_CONFORMANCE_PLANS=op` or `rp` runs one side. ## Release checklist -Before tagging `oidc/provider` or `oidc/client`: +The release process itself (versions, order, `make release-check`) is in +[releasing.md](releasing.md). Before tagging `oidc/provider` or +`oidc/client`, also check: 1. CI is green (`make sync build test lint`): every test cited above. 2. `make e2e-oidc` passes: 21 scenarios. diff --git a/docs/releasing.md b/docs/releasing.md new file mode 100644 index 00000000..c4f516cd --- /dev/null +++ b/docs/releasing.md @@ -0,0 +1,135 @@ +# Releasing + +The repository is a Go workspace of independently released modules. This +checklist cuts releases that consumers can resolve. Outside this repository +the go command ignores the `replace` directives of a dependency, so a tagged +`go.mod` must require real, published versions of the in-repo modules it +uses. + +## Versions and tags + +- The first release of every module is **`v1.0.0`**. The module paths carry + no `/vN` suffix, so the go command would ignore a `v2.x.y` tag (semantic + import versioning). `scripts/release-check.sh` only accepts + `v1.MINOR.PATCH[-PRERELEASE]`; a `v0.x` release would need an explicit + decision. +- The core module is tagged `vX.Y.Z`. The module in `` is tagged + `/vX.Y.Z`: `http/v1.0.0`, `oidc/client/v1.0.0`, + `oauth2/store/sql/v1.0.0`… +- A version is a canonical semantic version: no leading zeros, no build + metadata (`+…`). The go command ignores any other tag. +- `examples`, `internal/*` (test-only modules) and `tools/*` (development + tools) are never released. + +## Release order + +A module can only be released once the in-repo modules it requires are +tagged and published. Tag in dependency order (a module's in-repo +requirements are the `github.com/hyperscale-stack/security…` lines of its +`go.mod`): + +1. `v1.0.0` (core), `password/v1.0.0`. +2. `basic` (core, password); `bearer`, `connectrpc`, `grpc`, `http`, + `oauth2`, `oidc/client`, `saml/sp`, `session` (core). +3. `jwt` (core, bearer, oauth2); `oauth2/store/redis`, `oauth2/store/sql` + (oauth2); `oidc/client/store/redis`, `oidc/client/store/sql` + (oidc/client); `saml/sp/store/redis`, `saml/sp/store/sql` (saml/sp). +4. `oidc/provider` (core, bearer, jwt, oauth2). + +## Checklist + +1. **master is green.** The `Go` and `govulncheck` workflows passed on the + commit to release, and no reachable advisory is open (see below). +2. **Release commit** (a pull request to master): + - `CHANGELOG.md`: turn `[Unreleased]` into `[1.0.0] - YYYY-MM-DD`. + - Set every in-repo requirement of every module of this release to its new + version. For example, in `oauth2/store/sql`: + + ```sh + cd oauth2/store/sql + go mod edit -require=github.com/hyperscale-stack/security@v1.0.0 \ + -require=github.com/hyperscale-stack/security/oauth2@v1.0.0 + ``` + + Keep the `replace` lines. They only apply inside this repository, so + local development and CI keep building the code on disk, while + consumers resolve the versions above. + - `make tidy && make check-modules`, then merge. +3. **Tag, check and push one module at a time**, in the order above, on the + release commit: + + ```sh + git fetch origin && git checkout + make release-check TAG=oauth2/store/sql/v1.0.0 + git tag -a oauth2/store/sql/v1.0.0 -m "oauth2/store/sql v1.0.0" + git push origin oauth2/store/sql/v1.0.0 + ``` + + `make release-check` refuses: + - a malformed or non-v1 tag; + - a module that is never released; + - a placeholder requirement (`v0.0.0-00010101000000-000000000000`); + - a commit that is not on `origin/master`. + + It then builds and vets a copy of the module **without its in-repo + `replace` directives**, outside the workspace. That is exactly what a + consumer resolves: the in-repo requirements are fetched from the module + proxy at their required versions. So it fails until those requirements + are tagged and pushed (keep the order), and whenever the module uses code + that its required versions lack. +4. **The Release workflow** (`.github/workflows/release.yml`) runs on every + `v*` and `**/v*` tag, with a read-only token: + - the same check, then `make check-modules build test lint vuln`; + - only then a separate job creates the GitHub release, with + `contents: write`, no checkout and no third-party action; + - `-rc` versions are published as pre-releases, and a sub-module release + is never marked "latest" (the README badge shows the core's). + + Wait for it before pushing a tag that depends on this one. +5. **Consumer check**, once every tag is published: + + ```sh + cd "$(mktemp -d)" && go mod init example.com/check + go get github.com/hyperscale-stack/security/oidc/provider@v1.0.0 + go build github.com/hyperscale-stack/security/oidc/provider/... + ``` + +## Toolchain and vulnerabilities + +- `go.work` and every `go.mod` carry the same `go` line, which consumers + inherit as their minimum (`make check-modules` enforces it). When a Go + release fixes a standard-library advisory that the `govulncheck` workflow + reports: + 1. bump `go.work` and every `go` line together (`go work edit -go=…`, + `go mod edit -go=…` in each module and tool module); + 2. release patch versions of the affected modules. +- The `govulncheck` workflow runs on every change, weekly, and inside the + release workflow. An advisory with no fixed version keeps it red. Triage + it: + - remove the call path if you can; + - otherwise record the decision in `docs/security-considerations.md`: + advisory ID, why it is not exploitable or is accepted, owner, review + date. + + The release workflow never publishes over a reachable advisory. A release + with a documented, accepted advisory is published by hand + (`gh release create --verify-tag`). + +## Repository settings (maintainer) + +These are not versioned in the repository; set them once: + +- Actions → General: + - default workflow permissions **read**; + - untick "Allow GitHub Actions to create and approve pull requests"; + - require actions to be pinned to a full-length commit SHA. +- Rulesets: + - `master`: pull request plus the required status check + `Build & test (workspace)`; + - tags `v*` and `**/v*`: creation, update and deletion restricted to + maintainers. +- Releases: enable release immutability, so the tag of a published release + can no longer be moved or deleted. +- Environments: give `release` (used by the publish job) required reviewers. +- Code security: Dependabot alerts and security updates, secret scanning and + push protection. diff --git a/scripts/check-modules.sh b/scripts/check-modules.sh new file mode 100755 index 00000000..75e4b894 --- /dev/null +++ b/scripts/check-modules.sh @@ -0,0 +1,91 @@ +#!/bin/sh +# Copyright 2026 Hyperscale. All rights reserved. +# Use of this source code is governed by a MIT +# license that can be found in the LICENSE file. +# +# Checks that every module stands on its own, as consumers and Dependabot +# see it (`make check-modules`, run by CI on every change and before every +# release): +# +# 1. go.work and every go.mod (the tool modules included) carry the same +# go line, and none has a toolchain line; +# 2. go.work lists every module but the tool modules (tools/*), so that +# Dependabot's go.work mode covers them all; +# 3. `go work sync` changes nothing: each module declares the versions the +# workspace builds and tests with; +# 4. without the generated mocks (what `go mod tidy` and Dependabot see), +# every module and tool module is tidy outside the workspace; +# 5. with them (what the tests compile), every module builds, vets and is +# still tidy outside the workspace (GOWORK=off). +# +# When step 3 fails, the files `go work sync` rewrote stay on disk: review +# them and commit them, or run `make tidy`. +set -eu + +cd "$(dirname "$0")/.." + +fail() { + echo "check-modules: $*" >&2 + exit 1 +} + +all=$(find . -name go.mod -not -path '*/vendor/*' -not -path '*/node_modules/*' -not -path './build/*' | + sort | sed 's|/go\.mod$||') +workspace=$(printf '%s\n' "$all" | grep -v '^\./tools/') +tools=$(printf '%s\n' "$all" | grep '^\./tools/' || true) + +echo "==> one go line, no toolchain line" +want=$(sed -n 's/^go[[:space:]]\{1,\}\([0-9][0-9.]*\)$/\1/p' go.work) +[ -n "$want" ] || fail "go.work declares no go line" +for mod in $all; do + got=$(sed -n 's/^go[[:space:]]\{1,\}\([0-9][0-9.]*\)$/\1/p' "$mod/go.mod") + [ "$got" = "$want" ] || + fail "$mod/go.mod declares go $got, go.work go $want: bump every go line together" + ! grep -q '^toolchain' "$mod/go.mod" || + fail "$mod/go.mod has a toolchain line: the go line is the toolchain floor" +done +! grep -q '^toolchain' go.work || fail "go.work has a toolchain line" + +echo "==> go.work lists every module" +listed=$(awk ' + /^use[[:space:]]*\(/ { block = 1; next } + block && /^\)/ { block = 0; next } + block { print $1; next } + /^use[[:space:]]/ { print $2 } +' go.work) +for mod in $workspace; do + printf '%s\n' "$listed" | grep -qx "$mod" || + fail "$mod is not listed in go.work (go work use $mod): Dependabot would not update it" +done + +echo "==> go work sync is a no-op" +manifests() { + for mod in $workspace; do + cat "$mod/go.mod" + [ ! -f "$mod/go.sum" ] || cat "$mod/go.sum" + done | cksum +} +before=$(manifests) +go work sync +[ "$before" = "$(manifests)" ] || + fail "go work sync rewrote go.mod/go.sum files (left on disk): review and commit them, or run make tidy" + +echo "==> tidy without the generated mocks" +"${MAKE:-make}" --no-print-directory clean-mocks +for mod in $all; do + (cd "$mod" && GOWORK=off go mod tidy -diff) || + fail "$mod is not tidy without the generated mocks (diff above): run make tidy; if only generated mocks import testify/mock, the module needs a mockery_test.go importing it" +done + +echo "==> build, vet and tidy with the generated mocks" +"${MAKE:-make}" --no-print-directory generate +for mod in $workspace; do + echo " $mod" + (cd "$mod" && GOWORK=off go build ./... && GOWORK=off go vet ./... && GOWORK=off go mod tidy -diff) || + fail "$mod does not build, vet or stay tidy on its own (GOWORK=off)" +done +for mod in $tools; do + (cd "$mod" && GOWORK=off go mod tidy -diff) || fail "$mod is not tidy" +done + +echo "check-modules: ok" diff --git a/scripts/release-check.sh b/scripts/release-check.sh new file mode 100755 index 00000000..5fdb29db --- /dev/null +++ b/scripts/release-check.sh @@ -0,0 +1,111 @@ +#!/bin/sh +# Copyright 2026 Hyperscale. All rights reserved. +# Use of this source code is governed by a MIT +# license that can be found in the LICENSE file. +# +# Checks a release tag before it is pushed (`make release-check TAG=...`) +# and again in the release workflow (docs/releasing.md): +# +# - TAG is vMAJOR.MINOR.PATCH[-PRERELEASE] for the core module, or +# /vMAJOR.MINOR.PATCH[-PRERELEASE] for the module in , as a +# canonical semantic version without build metadata (the go command +# ignores any other tag), and the major version is 1: the module paths +# carry no /vN suffix, so the go command would ignore a v2+ tag, and a +# v0.x release is not planned; +# - holds a released module (not examples/, internal/ or tools/) +# whose go.mod declares the matching module path; +# - that go.mod requires real versions of the in-repo modules, never the +# v0.0.0-00010101000000-000000000000 placeholder; +# - the commit (HEAD) is on origin/master; +# - the module builds and vets as a consumer resolves it: a copy without +# its in-repo replace directives, outside the workspace, so that the +# in-repo modules it requires are fetched at their required versions +# (they must be tagged and pushed first). +# +# In GitHub Actions it also writes the module directory, the previous tag of +# the same module and whether the version is a pre-release to $GITHUB_OUTPUT. +set -eu + +ROOT=github.com/hyperscale-stack/security +ROOT_RE='github\.com/hyperscale-stack/security' +PLACEHOLDER=v0.0.0-00010101000000-000000000000 + +fail() { + echo "release-check: $*" >&2 + exit 1 +} + +tag=${1:-} +[ -n "$tag" ] || fail "usage: release-check.sh TAG (v1.2.3 for the core module, /v1.2.3 otherwise)" + +cd "$(dirname "$0")/.." + +case $tag in +*/*) + dir=${tag%/*} + version=${tag##*/} + ;; +*) + dir=. + version=$tag + ;; +esac + +num='(0|[1-9][0-9]*)' +ident='(0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)' +printf '%s\n' "$version" | grep -Eq "^v$num\\.$num\\.$num(-$ident(\\.$ident)*)?\$" || + fail "$tag: the version must be a canonical vMAJOR.MINOR.PATCH[-PRERELEASE] (no leading zeros, no build metadata)" +printf '%s\n' "$version" | grep -q '^v1\.' || + fail "$tag: only v1 releases are made (the module paths have no /vN suffix; v0.x needs an explicit decision)" + +case $dir in +examples | examples/* | internal | internal/* | tools | tools/*) + fail "$tag: $dir is never released" + ;; +esac +printf '%s\n' "$dir" | grep -Eq '^(\.|[a-z0-9]+(/[a-z0-9]+)*)$' || fail "$tag: malformed module directory $dir" +[ -f "$dir/go.mod" ] || fail "$tag: no module in $dir" + +expected=$ROOT +[ "$dir" = . ] || expected=$ROOT/$dir +path=$(sed -n 's/^module[[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p' "$dir/go.mod") +[ "$path" = "$expected" ] || fail "$tag: $dir/go.mod declares module $path, want $expected" + +if grep -n -- "$PLACEHOLDER" "$dir/go.mod" >&2; then + fail "$tag: $dir/go.mod requires in-repo modules at the placeholder version above; set each to its release tag first (docs/releasing.md)" +fi + +git rev-parse -q --verify refs/remotes/origin/master >/dev/null || fail "origin/master is unknown: git fetch origin" +git merge-base --is-ancestor HEAD origin/master || fail "HEAD is not on origin/master: release from master" + +if [ -n "${GITHUB_OUTPUT:-}" ]; then + prefix= + [ "$dir" = . ] || prefix=$dir/ + previous=$(git tag --list "${prefix}v[0-9]*" --sort=v:refname | + awk -v cur="$tag" '$0 == cur { print prev; exit } { prev = $0 }') + prerelease=false + case $version in + *-*) prerelease=true ;; + esac + { + echo "dir=$dir" + echo "previous=$previous" + echo "prerelease=$prerelease" + } >>"$GITHUB_OUTPUT" +fi + +echo "==> $tag: build and vet $expected as a consumer resolves it" +tmp=$(mktemp -d) +trap 'rm -rf "$tmp"' EXIT +cp -R "$dir"/. "$tmp"/ +cd "$tmp" +! grep -q '^replace[[:space:]]*(' go.mod || fail "$tag: replace blocks are not supported, use one replace line per module" +for old in $(sed -n 's/^replace[[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p' go.mod | grep -E "^$ROOT_RE(/|\$)" || true); do + go mod edit -dropreplace="$old" +done +GOWORK=off GOFLAGS=-mod=mod go build ./... || + fail "$tag: $expected does not build at the versions it requires (are its in-repo requirements tagged and up to date?)" +GOWORK=off GOFLAGS=-mod=mod go vet ./... || + fail "$tag: $expected does not vet at the versions it requires" + +echo "release-check: $tag ok" From e9d59a1df2ef9e664242131f8aaf9a59ecd46bd6 Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 01:05:20 +0200 Subject: [PATCH 6/9] ci: least-privilege, SHA-pinned workflows, govulncheck and a split release The workflows had several supply-chain weaknesses: - they ran with the repository's default write-scoped token; - third-party actions were referenced by mutable tags or a branch (coverallsapp/github-action@master, handed GITHUB_TOKEN explicitly); - release.yml gave `contents: write` to the whole job, tests and a third-party release action included, kept the checkout credentials and interpolated `github.ref_name` into a script. Its `*/v*` filter missed every module nested two levels deep (oidc/client, saml/sp, oauth2/store/sql...); - nothing scanned for vulnerabilities. Changes: - workflow-level `permissions: contents: read`, every action pinned to a full commit SHA with its version in a comment (looked up from the releases: checkout v7.0.1, setup-go v7.0.0, upload-artifact v7.0.2, download-artifact v8.0.2, coverallsapp/github-action v2.3.8), `persist-credentials: false` everywhere; - go.yml builds the pinned tools, generates the mocks, then runs check-modules, build, test and lint. Coveralls uploads from a separate, non-blocking job without Go caches, with a pinned reporter; - govulncheck.yml runs `make vuln` on every change and weekly; - release.yml triggers on `v[0-9]*` and `**/v[0-9]*` and is split: - `verify`, read-only: release-check, then the whole gate, with no cache read; - `publish`: `contents: write`, environment `release`, no checkout, no third-party action, `gh release create --verify-tag`, notes since the module's previous tag, never "latest" for a sub-module. The tag only reaches scripts through `env`; - Dependabot: the `/` gomod entry already covers the 25 workspace modules (go.work mode: #103, #104, #105, #108 and #110 bumped dependencies only sub-modules require); added the tool modules (allowed by name, since tool requirements are indirect), groups for OpenTelemetry and actions, and a 7-day cooldown. actionlint: 0 findings. zizmor 1.30.1, online, default and pedantic personas: 0 findings (master: 18 findings + 5 suppressed). Repository settings stay manual (docs/releasing.md). Audit: CI-01, DEP-01, DEP-02. --- .github/dependabot.yml | 67 +++++++++++++---- .github/workflows/go.yml | 76 +++++++++++++------ .github/workflows/govulncheck.yml | 40 ++++++++++ .github/workflows/release.yml | 121 +++++++++++++++++++++--------- CHANGELOG.md | 20 +++++ CLAUDE.md | 14 +++- MIGRATION.md | 19 +++-- docs/security-considerations.md | 35 +++++++++ 8 files changed, 308 insertions(+), 84 deletions(-) create mode 100644 .github/workflows/govulncheck.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 09d032b7..cb0bf8ca 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,16 +1,55 @@ version: 2 updates: -- package-ecosystem: gomod - directory: "/" - schedule: - interval: weekly - time: "04:00" - open-pull-requests-limit: 10 - assignees: - - euskadi31 -- package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: weekly - assignees: - - euskadi31 + # go.work at the root: Dependabot's go.work mode updates every module the + # workspace lists (all modules but tools/*; `make check-modules` fails when + # a module is missing from go.work). One entry per directory would make it + # open the same update once per module. + - package-ecosystem: gomod + directory: "/" + schedule: + interval: weekly + time: "04:00" + cooldown: + default-days: 7 + open-pull-requests-limit: 10 + groups: + opentelemetry: + patterns: + - "go.opentelemetry.io/*" + assignees: + - euskadi31 + + # The development tools, one module per tool outside go.work. Each tool is + # an indirect requirement of its module (a `tool` directive), so it is + # allowed by name; the tools' own dependencies follow the tool releases. + - package-ecosystem: gomod + directories: + - "/tools/*" + schedule: + interval: weekly + cooldown: + default-days: 7 + allow: + - dependency-name: "github.com/golangci/golangci-lint/v2" + dependency-type: "all" + - dependency-name: "golang.org/x/vuln" + dependency-type: "all" + - dependency-name: "github.com/vektra/mockery/v3" + dependency-type: "all" + assignees: + - euskadi31 + + # The workflows: every action is pinned to a commit SHA with its version in + # a comment, which Dependabot reads to propose the next one. + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + cooldown: + default-days: 7 + groups: + github-actions: + patterns: + - "*" + assignees: + - euskadi31 diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 29d6e61a..9e608f20 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -6,55 +6,83 @@ on: pull_request: branches: [master] +# Read-only token for every job: nothing in this workflow writes to the +# repository, its packages or its pull requests. +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: build: name: Build & test (workspace) runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.work - id: go + cache-dependency-path: "**/go.sum" - - name: golangci-lint - uses: golangci/golangci-lint-action@v9 - with: - version: v2.12.2 - install-only: true + # golangci-lint, govulncheck and mockery, each built from its pinned + # module under tools/ and verified by that module's go.sum. + - name: Install the pinned tools + run: make tools + + # Mocks are generated, never committed: every test build needs them. + - name: Generate mocks + run: make generate - - name: Workspace sync - run: make sync + - name: Check every module on its own + run: make check-modules - # NOTE: `make generate` is intentionally NOT run in CI yet — the - # .mockery.yaml is being migrated to v3 syntax while the tool pin - # (vektra/mockery v2.53.5) is still v2. Re-enable once the config / - # tool are aligned (tracked in LIMITATIONS.md, slated for Phase 4). - name: Build all modules run: make build - name: Test all modules (race + coverage) run: make test - # Lint runs in a dedicated step so that gosec/golangci output is easy to - # read. The Makefile iterates over every module with the shared config. - name: Lint all modules run: make lint - - name: Upload aggregated coverage to Coveralls - uses: shogo82148/actions-goveralls@v1 + - name: Keep the coverage profile + uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 with: - path-to-profile: build/coverage.out + name: coverage + path: build/coverage.out + if-no-files-found: error + retention-days: 7 - finish: + # The Coveralls uploader is third-party code that downloads its reporter + # binary at run time: it runs in a job of its own, away from the Go caches + # the build job saves, and a Coveralls outage never fails the build. + coverage: + name: Coverage (Coveralls) needs: build runs-on: ubuntu-latest steps: - - name: Coveralls finished - uses: coverallsapp/github-action@master + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Fetch the coverage profile + uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 + with: + name: coverage + path: build + + - name: Upload to Coveralls + uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8 with: - github-token: ${{ secrets.GITHUB_TOKEN }} - parallel-finished: true + file: build/coverage.out + format: golang + coverage-reporter-version: v0.6.22 + fail-on-error: false diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml new file mode 100644 index 00000000..7ccc0766 --- /dev/null +++ b/.github/workflows/govulncheck.yml @@ -0,0 +1,40 @@ +name: govulncheck + +on: + push: + branches: [master] + pull_request: + branches: [master] + # Weekly, so that an advisory published against the pinned toolchain or a + # dependency surfaces even when nothing changes here. + schedule: + - cron: "17 5 * * 1" + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + +jobs: + govulncheck: + name: govulncheck (every module) + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.work + cache-dependency-path: "**/go.sum" + + # Every module outside the workspace (its own requirements: what a + # consumer resolves), tests included, with the toolchain go.work pins. + - name: Scan every module + run: make vuln diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 57284ca5..e746307a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,64 +1,111 @@ name: Release -# Each module of the workspace is released independently. Go's multi-module -# convention puts the module path in the tag: +# Each module of the workspace is released on its own (docs/releasing.md). +# The module path is part of the tag: # -# v1.2.3 -> the root module (github.com/hyperscale-stack/security) -# http/v1.2.3 -> the github.com/hyperscale-stack/security/http module -# oauth2/v1.2.3 -> the github.com/hyperscale-stack/security/oauth2 module +# v1.2.3 -> the core module (github.com/hyperscale-stack/security) +# http/v1.2.3 -> github.com/hyperscale-stack/security/http +# oauth2/store/sql/v1.2.3 -> github.com/hyperscale-stack/security/oauth2/store/sql # -# Pushing such a tag validates the tagged state and publishes a GitHub -# release. Nothing is force-pushed and no tag is created by this workflow. +# Pushing such a tag verifies the tagged commit with a read-only token, then a +# separate job publishes the GitHub release. Nothing is pushed and no tag is +# created by this workflow. scripts/release-check.sh refuses any tag the +# filters below let through that is not a release of a module. on: push: tags: - - "v*" - - "*/v*" + - "v[0-9]*" + - "**/v[0-9]*" permissions: - contents: write + contents: read + +# One run per tag, never cancelled halfway through a release. +concurrency: + group: release-${{ github.ref }} + cancel-in-progress: false jobs: - release: - name: Release ${{ github.ref_name }} + verify: + name: Verify ${{ github.ref_name }} runs-on: ubuntu-latest + permissions: + contents: read + outputs: + dir: ${{ steps.tag.outputs.dir }} + previous: ${{ steps.tag.outputs.previous }} + prerelease: ${{ steps.tag.outputs.prerelease }} steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + # The tags and origin/master: release-check verifies that the + # tagged commit is on master and finds the module's previous tag. + fetch-depth: 0 + persist-credentials: false - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: "1.x" - check-latest: true + go-version-file: go.work + # A release never reads a cache that another run wrote. + cache: false - - name: Resolve the released module - id: mod - run: | - tag='${{ github.ref_name }}' - case "$tag" in - */v*) echo "dir=${tag%/v*}" >> "$GITHUB_OUTPUT" ;; - *) echo "dir=." >> "$GITHUB_OUTPUT" ;; - esac + - name: Install the pinned tools + run: make tools + + - name: Generate mocks + run: make generate + + # Tag, module and version; placeholder requirements; commit on master; + # the module built and vetted the way a consumer resolves it. + - name: Check the tag + id: tag + env: + TAG: ${{ github.ref_name }} + run: ./scripts/release-check.sh "$TAG" - - name: Workspace sync - run: make sync + - name: Check every module on its own + run: make check-modules - # The whole workspace is built and tested so a tag can never publish a - # module whose dependencies (sibling modules) are in a broken state. - name: Build all modules run: make build - name: Test all modules (race + coverage) run: make test - - name: Publish GitHub release - uses: softprops/action-gh-release@v3 - with: - name: ${{ github.ref_name }} - generate_release_notes: true - body: | - Release of the `${{ steps.mod.outputs.dir }}` module. + - name: Lint all modules + run: make lint + + - name: Scan every module (govulncheck) + run: make vuln - See [CHANGELOG.md](https://github.com/hyperscale-stack/security/blob/master/CHANGELOG.md) - for the consolidated history. + publish: + name: Publish ${{ github.ref_name }} + needs: verify + runs-on: ubuntu-latest + # Required reviewers can be set on this environment to approve each + # publication before the write token below is minted. + environment: release + permissions: + contents: write # create the GitHub release; no checkout, no third-party code + steps: + - name: Create the GitHub release + env: + GH_TOKEN: ${{ github.token }} + TAG: ${{ github.ref_name }} + DIR: ${{ needs.verify.outputs.dir }} + PREVIOUS: ${{ needs.verify.outputs.previous }} + PRERELEASE: ${{ needs.verify.outputs.prerelease }} + run: | + module="github.com/$GITHUB_REPOSITORY" + if [ "$DIR" != "." ]; then module="$module/$DIR"; fi + set -- --repo "$GITHUB_REPOSITORY" --verify-tag --title "$TAG" --generate-notes \ + --notes "Release of the \`$module\` module. See [CHANGELOG.md](https://github.com/$GITHUB_REPOSITORY/blob/master/CHANGELOG.md) for the consolidated history." + # Notes since the previous release of the same module, not of any + # module of the repository. + if [ -n "$PREVIOUS" ]; then set -- "$@" --notes-start-tag "$PREVIOUS"; fi + if [ "$PRERELEASE" = "true" ]; then set -- "$@" --prerelease; fi + # The repository's "latest" release (README badge) is the core's. + if [ "$DIR" != "." ]; then set -- "$@" --latest=false; fi + gh release create "$TAG" "$@" diff --git a/CHANGELOG.md b/CHANGELOG.md index cec3da49..a626b1be 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -626,6 +626,26 @@ legacy packages (`authentication/`, `authorization/`, the in-tree ### Security +- **CI and release supply chain**: + - every workflow runs with a read-only `GITHUB_TOKEN` + (`permissions: contents: read`); + - every action is pinned to a full commit SHA, which Dependabot keeps + current; + - checkouts no longer persist credentials; + - Coveralls uploads from a separate, non-blocking job, instead of an + action referenced as `@master` and handed the token; + - the release workflow is split: a read-only job verifies the tag + (`scripts/release-check.sh`, build, test, lint, govulncheck), then a + minimal job publishes with `gh release create`, without checkout or + third-party action. The tag reaches the scripts through the environment, + and tags of nested modules (`oidc/client/v…`) now trigger it; + - a new `govulncheck` workflow scans every module on every change and + weekly; + - Dependabot also covers the tool modules and the actions, groups related + updates, and waits 7 days before proposing a version. +- `grpc` (and the examples) require `golang.org/x/net` v0.60.0 instead of + v0.58.0: HTTP/2 advisories GO-2026-6603, -6610, -6611, -6612 and -6617. + - The OAuth2 token endpoint refuses a `code_verifier` presented for an authorization code issued without `code_challenge` (RFC 9700 §2.1.1, §4.8.2, #86), under every profile. Under `Profile20` — where PKCE is diff --git a/CLAUDE.md b/CLAUDE.md index 0ccae015..49bda730 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -81,10 +81,16 @@ cd jwt && go test ./... `make test` aggregates coverage but **excludes example `main()` programs** (they bind a socket and block); examples are still built, tested, and linted. -CI: `.github/workflows/go.yml` runs `make sync build test lint` against the -whole workspace in one job. `.github/workflows/release.yml` validates the -workspace and cuts a GitHub release on a `module/vX.Y.Z` tag. `make generate` -is intentionally skipped in CI. +CI (read-only token, every action pinned to a commit SHA, credentials never +persisted; keep it `actionlint`- and `zizmor`-clean): +- `.github/workflows/go.yml` runs `make tools generate check-modules build + test lint` against the whole workspace, then uploads the coverage to + Coveralls from a separate, non-blocking job; +- `govulncheck.yml` runs `make vuln` on every change and weekly; +- `release.yml`, on a `v*` or `**/v*` tag: a read-only `verify` job + (`scripts/release-check.sh` + the whole gate), then a `publish` job + (`contents: write`, environment `release`, `gh release create`, no + checkout). See `docs/releasing.md`. ## Module layout & dependency policy diff --git a/MIGRATION.md b/MIGRATION.md index 1ea3a0ab..6d3c1e9f 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -160,11 +160,20 @@ and linted. ## CI -`.github/workflows/go.yml` runs `make sync`, `make build`, `make test`, and -`make lint` against every module in one job, then publishes the aggregated -coverage to Coveralls. `.github/workflows/release.yml` validates the whole -workspace and publishes a GitHub release when a `module/vX.Y.Z` tag is -pushed. +Every workflow runs with a read-only token and actions pinned to a commit +SHA. +- `.github/workflows/go.yml` builds the pinned tools, generates the mocks, + runs `make check-modules`, `make build`, `make test` and `make lint` + against every module, and uploads the aggregated coverage to Coveralls from + a separate job. +- `.github/workflows/govulncheck.yml` runs `make vuln` on every change and + weekly. +- `.github/workflows/release.yml` runs when a `vX.Y.Z` or `/vX.Y.Z` + tag is pushed. A read-only job verifies it (`scripts/release-check.sh`, + then the whole gate), then a separate job publishes the GitHub release + ([docs/releasing.md](docs/releasing.md)). +- Dependabot proposes updates for every workspace module (go.work mode), the + tool modules and the actions, after a 7-day cooldown. ## Replace directives diff --git a/docs/security-considerations.md b/docs/security-considerations.md index 2d1044c1..9230f22b 100644 --- a/docs/security-considerations.md +++ b/docs/security-considerations.md @@ -958,8 +958,43 @@ No secret is ever placed on a span attribute or log line. See [observability.md](observability.md) for the secrets policy and the full span catalog. +## Toolchain and supply chain + +- **Go toolchain.** Every module requires Go 1.27.2 (its `go` line). The + library cannot be built with a toolchain carrying the standard-library + advisories fixed up to go1.27.2: HTTP/2 server crashes and request + smuggling in `net/http`, `crypto/tls`, `encoding/asn1`, `net/url`, + `encoding/xml`. Build and ship with the latest Go patch release, and run + `govulncheck` on your application: which advisories matter depends on the + code you call. +- **Vulnerability scanning.** The `govulncheck` workflow scans every module + outside the workspace (its own requirements, tests included) on every + change, weekly and before every release; the release workflow never + publishes over a reachable advisory. Known and not reachable: + GO-2026-5932 (`golang.org/x/crypto/openpgp` is unmaintained, no fix) is + reported at module level for the modules that require + `golang.org/x/crypto`; none imports `openpgp`. Accepted reachable + advisories (ID, reason, owner, review date): none. +- **Dependencies.** Dependabot proposes version updates for every module + after a 7-day cooldown (security updates are not delayed). The + development tools (golangci-lint, govulncheck, mockery) are pinned in + modules of their own under `tools/` and never reach a library's module + graph. +- **CI and releases.** + - Every workflow runs with a read-only token, every action is pinned to a + full commit SHA, and checkouts keep no credentials. + - A release is verified with a read-only token (`scripts/release-check.sh`, + build, test, lint, govulncheck) before a separate job publishes the + GitHub release, without checkout or third-party code. + - Module tags are not signed: verify the modules through the Go checksum + database (`sum.golang.org`), as `go get` does by default. Never disable + it (`GONOSUMDB`, `GONOSUMCHECK`, `GOFLAGS=-insecure`) for these modules. + ## Operator checklist +- [ ] Build with Go 1.27.2 or later, the latest patch release, and run + `govulncheck` on your application. + - [ ] Pick a password hasher and review its cost against current hardware. - [ ] Rotate JWT signing keys; expose them through a JWKS endpoint (`oidc/provider` serves one). From ad604ffc8b182ee143960f6b84461c7171353e2c Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 02:14:44 +0200 Subject: [PATCH 7/9] build: refuse replace and exclude directives a consumer would ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit release-check only dropped the in-repo replace directives, and only in their unversioned form, before building the "consumer view" of a module: - a third-party replace, e.g. a local fork providing a symbol, or a patched golang.org/x/net, still applied. The check passed while consumers, who ignore every replace and exclude directive of a dependency, failed or got the vulnerable version; - a versioned in-repo replace (`replace …/security v1.0.0 => ../`) was left in place. It was refused only because `../` stops resolving from the temporary copy, with a misleading message. Read `go mod edit -json` in the copy, drop each in-repo replace by its exact Old.Path[@Old.Version], then refuse any remaining replace and any exclude: a release must not need them. In a dry run: - the reviewer's probe, a third-party replace providing a symbol, is now refused ("keeps replace directives its consumers ignore"); - a versioned in-repo replace is dropped, so a missing core symbol is reported as "undefined: security.ReleaseCheckProbe"; - an exclude is refused. Sort the previous tag with versionsort.suffix=- so that v1.0.0-rc.1 precedes v1.0.0 (release notes start from the right tag), and give the anchor hint in check-modules' last step too. Audit: CI-02. --- scripts/check-modules.sh | 2 +- scripts/release-check.sh | 24 +++++++++++++++++++----- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/scripts/check-modules.sh b/scripts/check-modules.sh index 75e4b894..63241d28 100755 --- a/scripts/check-modules.sh +++ b/scripts/check-modules.sh @@ -82,7 +82,7 @@ echo "==> build, vet and tidy with the generated mocks" for mod in $workspace; do echo " $mod" (cd "$mod" && GOWORK=off go build ./... && GOWORK=off go vet ./... && GOWORK=off go mod tidy -diff) || - fail "$mod does not build, vet or stay tidy on its own (GOWORK=off)" + fail "$mod does not build, vet or stay tidy on its own (GOWORK=off); if its packages just got their first interface, run make tidy and add a mockery_test.go importing testify/mock" done for mod in $tools; do (cd "$mod" && GOWORK=off go mod tidy -diff) || fail "$mod is not tidy" diff --git a/scripts/release-check.sh b/scripts/release-check.sh index 5fdb29db..ffcf94e7 100755 --- a/scripts/release-check.sh +++ b/scripts/release-check.sh @@ -20,14 +20,14 @@ # - the module builds and vets as a consumer resolves it: a copy without # its in-repo replace directives, outside the workspace, so that the # in-repo modules it requires are fetched at their required versions -# (they must be tagged and pushed first). +# (they must be tagged and pushed first). Consumers ignore every replace +# and exclude directive of a dependency, so any other one is refused. # # In GitHub Actions it also writes the module directory, the previous tag of # the same module and whether the version is a pre-release to $GITHUB_OUTPUT. set -eu ROOT=github.com/hyperscale-stack/security -ROOT_RE='github\.com/hyperscale-stack/security' PLACEHOLDER=v0.0.0-00010101000000-000000000000 fail() { @@ -35,6 +35,8 @@ fail() { exit 1 } +command -v jq >/dev/null 2>&1 || fail "jq is required" + tag=${1:-} [ -n "$tag" ] || fail "usage: release-check.sh TAG (v1.2.3 for the core module, /v1.2.3 otherwise)" @@ -81,7 +83,8 @@ git merge-base --is-ancestor HEAD origin/master || fail "HEAD is not on origin/m if [ -n "${GITHUB_OUTPUT:-}" ]; then prefix= [ "$dir" = . ] || prefix=$dir/ - previous=$(git tag --list "${prefix}v[0-9]*" --sort=v:refname | + # versionsort.suffix=- sorts v1.0.0-rc.1 before v1.0.0. + previous=$(git -c versionsort.suffix=- tag --list "${prefix}v[0-9]*" --sort=v:refname | awk -v cur="$tag" '$0 == cur { print prev; exit } { prev = $0 }') prerelease=false case $version in @@ -99,10 +102,21 @@ tmp=$(mktemp -d) trap 'rm -rf "$tmp"' EXIT cp -R "$dir"/. "$tmp"/ cd "$tmp" -! grep -q '^replace[[:space:]]*(' go.mod || fail "$tag: replace blocks are not supported, use one replace line per module" -for old in $(sed -n 's/^replace[[:space:]]\{1,\}\([^[:space:]]*\).*/\1/p' go.mod | grep -E "^$ROOT_RE(/|\$)" || true); do +# Drop each in-repo replace by its exact old path[@version]. +for old in $(go mod edit -json | jq -r --arg root "$ROOT" ' + (.Replace // [])[] | .Old + | select(.Path == $root or (.Path | startswith($root + "/"))) + | .Path + (if .Version then "@" + .Version else "" end)'); do go mod edit -dropreplace="$old" done +replaces=$(go mod edit -json | jq -r '(.Replace // [])[] + | .Old.Path + (if .Old.Version then "@" + .Old.Version else "" end) + + " => " + .New.Path + (if .New.Version then " " + .New.Version else "" end)') +[ -z "$replaces" ] || + fail "$tag: $expected keeps replace directives its consumers ignore: $(printf '%s\n' "$replaces" | paste -sd ';' -)" +excludes=$(go mod edit -json | jq -r '(.Exclude // [])[] | .Path + "@" + .Version') +[ -z "$excludes" ] || + fail "$tag: $expected keeps exclude directives its consumers ignore: $(printf '%s\n' "$excludes" | paste -sd ';' -)" GOWORK=off GOFLAGS=-mod=mod go build ./... || fail "$tag: $expected does not build at the versions it requires (are its in-repo requirements tagged and up to date?)" GOWORK=off GOFLAGS=-mod=mod go vet ./... || From b26e267f8b4c5d0ecf00fbd3c574e302b44b3033 Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 02:14:44 +0200 Subject: [PATCH 8/9] ci: pin goveralls, keep every master run, scope the release scan Coverage: the Coveralls action ran a reporter binary downloaded at run time from a mutable release, verified only against a checksum file of the same release. That ran on master pushes, on a hosted runner where any code can read ACTIONS_RUNTIME_TOKEN and seed caches later runs restore. Upload with goveralls instead, pinned in tools/goveralls (v0.0.12, built from its own go.sum and the checksum database, like the other tools), from the build job with the read-only token as COVERALLS_TOKEN, as goveralls documents for GitHub Actions; a Coveralls outage does not fail the build. The artifact actions and the coverage job go away: the workflows now use only actions/checkout and actions/setup-go. Concurrency: one group per ref meant that a push to master cancelled the run still waiting behind another, so a master commit could end up with no build, test or govulncheck result. Group pull requests by ref (cancelling superseded runs) and everything else by commit. Release gate: scanning every module with -test let one unfixable advisory in a test-only dependency block every release. The release now scans the released module's own code outside the workspace; the full scan stays in the govulncheck workflow, which must be green on the release commit. Dependabot allows goveralls in /tools/*. actionlint: 0 findings; zizmor (online; regular, pedantic and auditor personas): 0 findings. Audit: CI-01, DEP-01. --- .github/dependabot.yml | 2 ++ .github/workflows/go.yml | 50 ++++++++----------------------- .github/workflows/govulncheck.yml | 4 ++- .github/workflows/release.yml | 10 +++++-- Makefile | 9 +++++- tools/goveralls/go.mod | 11 +++++++ tools/goveralls/go.sum | 41 +++++++++++++++++++++++++ 7 files changed, 86 insertions(+), 41 deletions(-) create mode 100644 tools/goveralls/go.mod create mode 100644 tools/goveralls/go.sum diff --git a/.github/dependabot.yml b/.github/dependabot.yml index cb0bf8ca..3ab64d56 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -34,6 +34,8 @@ updates: dependency-type: "all" - dependency-name: "golang.org/x/vuln" dependency-type: "all" + - dependency-name: "github.com/mattn/goveralls" + dependency-type: "all" - dependency-name: "github.com/vektra/mockery/v3" dependency-type: "all" assignees: diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index 9e608f20..39ea5043 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -11,8 +11,11 @@ on: permissions: contents: read +# A pull request keeps only its latest run. Every commit pushed to master gets +# its own group, so that a run waiting behind another is never cancelled and +# every master commit keeps a result. concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: @@ -31,8 +34,8 @@ jobs: go-version-file: go.work cache-dependency-path: "**/go.sum" - # golangci-lint, govulncheck and mockery, each built from its pinned - # module under tools/ and verified by that module's go.sum. + # golangci-lint, govulncheck, goveralls and mockery, each built from its + # pinned module under tools/ and verified by that module's go.sum. - name: Install the pinned tools run: make tools @@ -52,37 +55,10 @@ jobs: - name: Lint all modules run: make lint - - name: Keep the coverage profile - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 - with: - name: coverage - path: build/coverage.out - if-no-files-found: error - retention-days: 7 - - # The Coveralls uploader is third-party code that downloads its reporter - # binary at run time: it runs in a job of its own, away from the Go caches - # the build job saves, and a Coveralls outage never fails the build. - coverage: - name: Coverage (Coveralls) - needs: build - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Fetch the coverage profile - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 - with: - name: coverage - path: build - - - name: Upload to Coveralls - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8 - with: - file: build/coverage.out - format: golang - coverage-reporter-version: v0.6.22 - fail-on-error: false + # goveralls, built from tools/goveralls, authenticates with the + # read-only workflow token; a Coveralls outage never fails the build. + - name: Upload the coverage to Coveralls + continue-on-error: true + env: + COVERALLS_TOKEN: ${{ github.token }} + run: make coveralls diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 7ccc0766..e62f7d79 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -14,8 +14,10 @@ on: permissions: contents: read +# A pull request keeps only its latest run; every other run (master pushes, +# the weekly scan) gets its own group and is never cancelled. concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e746307a..7a35e4fd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -77,8 +77,14 @@ jobs: - name: Lint all modules run: make lint - - name: Scan every module (govulncheck) - run: make vuln + # The released module's own code, outside the workspace: an advisory + # in another module or only reachable from tests does not block this + # release. The full scan (every module, tests included) is the + # govulncheck workflow, green on the release commit (docs/releasing.md). + - name: Scan the released module (govulncheck) + env: + DIR: ${{ steps.tag.outputs.dir }} + run: cd "$DIR" && GOWORK=off "$GITHUB_WORKSPACE/build/bin/govulncheck" ./... publish: name: Publish ${{ github.ref_name }} diff --git a/Makefile b/Makefile index b8138933..4eca7460 100644 --- a/Makefile +++ b/Makefile @@ -10,7 +10,7 @@ MODULES := $(shell find . -name go.mod -not -path '*/vendor/*' -not -path '*/nod # Development tools: one module per tool under tools/, outside the # workspace so that their dependencies never reach a library go.mod, each # pinned and checksum-verified by its own go.mod and go.sum. -TOOLS := golangci-lint govulncheck mockery +TOOLS := golangci-lint govulncheck goveralls mockery .PHONY: all all: test @@ -77,6 +77,13 @@ test: _build generate @cat $(BUILD_DIR)/coverage.body >> $(BUILD_DIR)/coverage.out @rm -f $(BUILD_DIR)/*.cover $(BUILD_DIR)/coverage.body +# Sends build/coverage.out to Coveralls with goveralls (tools/goveralls). CI +# passes the workflow token as COVERALLS_TOKEN (goveralls' GitHub Actions +# setup). +.PHONY: coveralls +coveralls: $(BIN_DIR)/goveralls + @$(BIN_DIR)/goveralls -coverprofile=$(BUILD_DIR)/coverage.out -service=github + .PHONY: coverage coverage: $(BUILD_DIR)/coverage.out @go tool cover -func ./$(BUILD_DIR)/coverage.out diff --git a/tools/goveralls/go.mod b/tools/goveralls/go.mod new file mode 100644 index 00000000..27d5113c --- /dev/null +++ b/tools/goveralls/go.mod @@ -0,0 +1,11 @@ +module github.com/hyperscale-stack/security/tools/goveralls + +go 1.27.2 + +tool github.com/mattn/goveralls + +require ( + github.com/mattn/goveralls v0.0.12 // indirect + golang.org/x/mod v0.10.0 // indirect + golang.org/x/tools v0.8.0 // indirect +) diff --git a/tools/goveralls/go.sum b/tools/goveralls/go.sum new file mode 100644 index 00000000..480ac6d7 --- /dev/null +++ b/tools/goveralls/go.sum @@ -0,0 +1,41 @@ +github.com/mattn/goveralls v0.0.12 h1:PEEeF0k1SsTjOBQ8FOmrOAoCu4ytuMaWCnWe94zxbCg= +github.com/mattn/goveralls v0.0.12/go.mod h1:44ImGEUfmqH8bBtaMrYKsM65LXfNLWmwaxFGjZwgMSQ= +github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= +golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/mod v0.10.0 h1:lFO9qtOdlre5W1jxS3r/4szv2/6iXxScdzjoBMXNhYk= +golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= +golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= +golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= +golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= +golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= +golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= +golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= +golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= +golang.org/x/term v0.7.0/go.mod h1:P32HKFT3hSsZrRxla30E9HqToFYAQPCMs/zFMBUFqPY= +golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= +golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= +golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= +golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= +golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= +golang.org/x/tools v0.8.0 h1:vSDcovVPld282ceKgDimkRSC8kpaH1dgyc9UMzlt84Y= +golang.org/x/tools v0.8.0/go.mod h1:JxBZ99ISMI5ViVkT1tr6tdNmXeTrcpVSD3vZ1RsRdN4= +golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 0027932bf98f10a793f7322dfe26e95013c700cc Mon Sep 17 00:00:00 2001 From: Axel Etcheverry Date: Tue, 13 Oct 2026 02:14:52 +0200 Subject: [PATCH 9/9] docs: document the new gate, Dependabot security updates and mock limits Code-review fixes to the documentation of the build and release changes: - CLAUDE.md: - the per-step gate is `make test lint check-modules` (and `make vuln` before a pull request); - commit what `make tidy` / `go work sync` change, and how to resolve a go.mod conflict; - run `make generate` once before running `go test` directly; - the tests of a published module need `make generate` in a repository checkout. - docs/releasing.md: - release-check also refuses replace and exclude directives; - the release gate scans the released module; - a Dependabot section. Security updates run in a sub-module directory without go.work, so `make tidy` must be pushed onto those PRs before merging. Every entry is checked after a configuration change (the gomod jobs download the toolchain), with a manual fallback; - the tests of published modules. - LIMITATIONS.md: the same limit for published modules' tests. - docs/security-considerations.md: checksum verification is disabled by `GOSUMDB=off` or by a matching `GOPRIVATE`/`GONOSUMDB` pattern. The page named a variable that does not exist and a flag removed from the go command. - MIGRATION.md, CHANGELOG.md: - the token is read-only by default, and only the release publish job gets `contents: write`; - coverage goes through goveralls; - a consumer of the core resolves 23 modules instead of 50, both counts including the consumer; - two Markdown lists were split by a blank line. - .mockery.yaml: why unexported interfaces get mocks too. Audit: CI-01, CI-02, DEP-03. --- .mockery.yaml | 1 + CHANGELOG.md | 25 +++++++++------- CLAUDE.md | 40 ++++++++++++++++--------- LIMITATIONS.md | 8 +++++ MIGRATION.md | 14 +++++---- docs/releasing.md | 52 +++++++++++++++++++++++++++++---- docs/security-considerations.md | 23 ++++++++------- 7 files changed, 118 insertions(+), 45 deletions(-) diff --git a/.mockery.yaml b/.mockery.yaml index 0611757b..f017a647 100644 --- a/.mockery.yaml +++ b/.mockery.yaml @@ -4,6 +4,7 @@ # never committed (.gitignore: mock_*). Every module whose packages get mocks # keeps a mockery_test.go importing testify/mock, so its go.mod and go.sum are # the same with or without them. +# Unexported interfaces included: their in-package mocks serve in-package tests. all: true dir: '{{.InterfaceDir}}' filename: 'mock_{{.InterfaceName | snakecase}}_test.go' diff --git a/CHANGELOG.md b/CHANGELOG.md index a626b1be..58209ef0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -530,10 +530,11 @@ legacy packages (`authentication/`, `authorization/`, the in-tree `replace` directives. The first release of every module is `v1.0.0`; the checklist is [docs/releasing.md](docs/releasing.md). - **Development tools in their own modules**: golangci-lint (v2.14.0, Go - 1.27 support), govulncheck (v1.9.0) and mockery (v3.8.1) are pinned in one - module each under `tools/`, outside `go.work`. The core module no longer - declares the mockery `tool` directive: a consumer importing only the core - now resolves 22 modules instead of 50 (no mockery, cobra, viper, zerolog or + 1.27 support), govulncheck (v1.9.0), goveralls (v0.0.12) and mockery + (v3.8.1) are pinned in one module each under `tools/`, outside `go.work`. + The core module no longer declares the mockery `tool` directive: a + consumer importing only the core now resolves 23 modules instead of 50, + both counts including the consumer (no mockery, cobra, viper, zerolog or `x/tools`). `make lint` builds golangci-lint from its pinned module instead of piping an unpinned install script (`curl …/HEAD/install.sh | sh`). - **Mocks are generated, never committed**: `make generate` (mockery v3, @@ -627,15 +628,20 @@ legacy packages (`authentication/`, `authorization/`, the in-tree ### Security - **CI and release supply chain**: - - every workflow runs with a read-only `GITHUB_TOKEN` - (`permissions: contents: read`); + - the workflows run with a read-only `GITHUB_TOKEN` by default + (`permissions: contents: read`); only the release `publish` job gets + `contents: write`; - every action is pinned to a full commit SHA, which Dependabot keeps current; - checkouts no longer persist credentials; - - Coveralls uploads from a separate, non-blocking job, instead of an - action referenced as `@master` and handed the token; + - the coverage goes to Coveralls through goveralls, built from its pinned + module (`tools/goveralls`), instead of an action referenced as `@master` + and handed the token, and a Coveralls outage no longer fails the build; + - pushes to `master` are never cancelled by a later push, so every master + commit keeps its CI result; - the release workflow is split: a read-only job verifies the tag - (`scripts/release-check.sh`, build, test, lint, govulncheck), then a + (`scripts/release-check.sh`, build, test, lint, govulncheck on the + released module), then a minimal job publishes with `gh release create`, without checkout or third-party action. The tag reaches the scripts through the environment, and tags of nested modules (`oidc/client/v…`) now trigger it; @@ -645,7 +651,6 @@ legacy packages (`authentication/`, `authorization/`, the in-tree updates, and waits 7 days before proposing a version. - `grpc` (and the examples) require `golang.org/x/net` v0.60.0 instead of v0.58.0: HTTP/2 advisories GO-2026-6603, -6610, -6611, -6612 and -6617. - - The OAuth2 token endpoint refuses a `code_verifier` presented for an authorization code issued without `code_challenge` (RFC 9700 §2.1.1, §4.8.2, #86), under every profile. Under `Profile20` — where PKCE is diff --git a/CLAUDE.md b/CLAUDE.md index 49bda730..a4bd72cd 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -38,9 +38,14 @@ These rules are mandatory when working in this repository: follow the RFC to the letter. - **Security:** write secure code with no known vulnerabilities. `gosec` is part of the lint gate — keep it clean. -- **Per-step gate:** at the end of every feature/step, **run the tests and the - linter** (`make test` + `make lint`, or the per-module equivalent). They - MUST pass. +- **Per-step gate:** at the end of every feature/step, run + **`make test lint check-modules`** (and **`make vuln`** before opening a + pull request). They MUST pass. `make generate` runs on its own through + `test`, `lint`, `vuln` and `tidy`. +- **Commit what `make tidy` / `go work sync` change.** CI fails when a + `go.mod` or `go.sum` is out of sync with the workspace or untidy on its own + (`make check-modules`). To resolve a `go.mod` conflict: take either side, + run `make tidy`, then `make check-modules`, and commit. - **Commit per step:** once tests and lint pass, **commit** the step before moving on. Use Conventional Commits with a module scope, as in the git history (`feat(oauth2): ...`, `fix(jwt): ...`, `docs(...): ...`). @@ -71,9 +76,12 @@ make conformance # opt-in: the OpenID Foundation suite against oidc/provider and ``` To run a **single test** or work on one module, `cd` into that module first -(each module is its own `go.mod` with `replace` directives back to the core): +(each module is its own `go.mod` with `replace` directives back to the core). +Run `make generate` once before running `go test` directly: the tests use +the generated mocks. ```sh +make generate cd oauth2 && go test -race -run TestServer_Token ./... cd jwt && go test ./... ``` @@ -81,16 +89,19 @@ cd jwt && go test ./... `make test` aggregates coverage but **excludes example `main()` programs** (they bind a socket and block); examples are still built, tested, and linted. -CI (read-only token, every action pinned to a commit SHA, credentials never +CI (read-only token by default, only the release `publish` job gets +`contents: write`; every action pinned to a commit SHA; credentials never persisted; keep it `actionlint`- and `zizmor`-clean): - `.github/workflows/go.yml` runs `make tools generate check-modules build - test lint` against the whole workspace, then uploads the coverage to - Coveralls from a separate, non-blocking job; -- `govulncheck.yml` runs `make vuln` on every change and weekly; + test lint` against the whole workspace, then `make coveralls` (goveralls, + pinned in `tools/goveralls`; a Coveralls outage does not fail the build); +- `govulncheck.yml` runs `make vuln` (every module, tests included) on every + change and weekly; - `release.yml`, on a `v*` or `**/v*` tag: a read-only `verify` job - (`scripts/release-check.sh` + the whole gate), then a `publish` job - (`contents: write`, environment `release`, `gh release create`, no - checkout). See `docs/releasing.md`. + (`scripts/release-check.sh`, `check-modules`, build, test, lint, and + govulncheck on the released module), then a `publish` job (`contents: + write`, environment `release`, `gh release create`, no checkout). See + `docs/releasing.md`. ## Module layout & dependency policy @@ -391,9 +402,12 @@ by response content). mocks keeps a `mockery_test.go` that imports `testify/mock`, so its `go.mod`/`go.sum` are the same with or without generated mocks (Dependabot and `go mod tidy` never generate them). Every module builds with - `GOWORK=off` without them; only its tests need them. + `GOWORK=off` without them; only its tests need them, so the tests of a + published module only compile after `make generate` in a repository + checkout (a module zip has neither the mocks nor `.mockery.yaml`). Never + hand-write a `Mock` identifier or a `mock_*` file (git-ignored). - **Tools**: one module per tool under `tools/` (golangci-lint, govulncheck, - mockery), outside `go.work`, so their dependencies never reach a library + goveralls, mockery), outside `go.work`, so their dependencies never reach a library `go.mod` and each tool builds with exactly its own tested dependency set. `make tools` installs them into `build/bin` (checksum-verified by each tool's `go.sum`). Bump one with diff --git a/LIMITATIONS.md b/LIMITATIONS.md index b75223df..5cc167a1 100644 --- a/LIMITATIONS.md +++ b/LIMITATIONS.md @@ -327,6 +327,14 @@ PKCE. Not supported, and refused where a provider could select them: holding them) the raw code and tokens they carry during issuance: never log them. +## Tooling + +- The tests use mockery mocks generated by `make generate` and never + committed. A published module's tests (from its module zip: `go test all`, + `go vet` from the module cache, distribution builds) only compile from a + repository checkout after `make generate`; the library code builds without + them. + ## Not planned - **`HTTPDigestFilter` (RFC 7616)** — Digest auth is effectively dead; it diff --git a/MIGRATION.md b/MIGRATION.md index 6d3c1e9f..29254717 100644 --- a/MIGRATION.md +++ b/MIGRATION.md @@ -160,17 +160,19 @@ and linted. ## CI -Every workflow runs with a read-only token and actions pinned to a commit +The workflows run with a read-only token by default (only the release +`publish` job gets `contents: write`), with every action pinned to a commit SHA. - `.github/workflows/go.yml` builds the pinned tools, generates the mocks, runs `make check-modules`, `make build`, `make test` and `make lint` - against every module, and uploads the aggregated coverage to Coveralls from - a separate job. -- `.github/workflows/govulncheck.yml` runs `make vuln` on every change and - weekly. + against every module, and uploads the aggregated coverage to Coveralls + with goveralls (pinned in `tools/goveralls`). +- `.github/workflows/govulncheck.yml` runs `make vuln` (every module, tests + included) on every change and weekly. - `.github/workflows/release.yml` runs when a `vX.Y.Z` or `/vX.Y.Z` tag is pushed. A read-only job verifies it (`scripts/release-check.sh`, - then the whole gate), then a separate job publishes the GitHub release + `check-modules`, build, test, lint, govulncheck on the released module), + then a separate job publishes the GitHub release ([docs/releasing.md](docs/releasing.md)). - Dependabot proposes updates for every workspace module (go.work mode), the tool modules and the actions, after a 7-day cooldown. diff --git a/docs/releasing.md b/docs/releasing.md index c4f516cd..57e1c687 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -69,7 +69,9 @@ requirements are the `github.com/hyperscale-stack/security…` lines of its - a malformed or non-v1 tag; - a module that is never released; - a placeholder requirement (`v0.0.0-00010101000000-000000000000`); - - a commit that is not on `origin/master`. + - a commit that is not on `origin/master`; + - any `replace` directive other than the in-repo ones, and any `exclude` + directive: consumers ignore both, so a release must not need them. It then builds and vets a copy of the module **without its in-repo `replace` directives**, outside the workspace. That is exactly what a @@ -79,7 +81,10 @@ requirements are the `github.com/hyperscale-stack/security…` lines of its that its required versions lack. 4. **The Release workflow** (`.github/workflows/release.yml`) runs on every `v*` and `**/v*` tag, with a read-only token: - - the same check, then `make check-modules build test lint vuln`; + - the same check, then `make check-modules build test lint`, and + govulncheck on the released module's own code (outside the workspace, + tests excluded; the full scan of every module is step 1's `govulncheck` + workflow); - only then a separate job creates the GitHub release, with `contents: write`, no checkout and no third-party action; - `-rc` versions are published as pre-releases, and a sub-module release @@ -103,18 +108,53 @@ requirements are the `github.com/hyperscale-stack/security…` lines of its 1. bump `go.work` and every `go` line together (`go work edit -go=…`, `go mod edit -go=…` in each module and tool module); 2. release patch versions of the affected modules. -- The `govulncheck` workflow runs on every change, weekly, and inside the - release workflow. An advisory with no fixed version keeps it red. Triage +- The `govulncheck` workflow scans every module, tests included, on every + change and weekly. An advisory with no fixed version keeps it red. Triage it: - remove the call path if you can; - otherwise record the decision in `docs/security-considerations.md`: advisory ID, why it is not exploitable or is accepted, owner, review date. - The release workflow never publishes over a reachable advisory. A release - with a documented, accepted advisory is published by hand + The release workflow scans the released module itself, and never + publishes over an advisory reachable from it. A release with a + documented, accepted advisory is published by hand (`gh release create --verify-tag`). +## Dependabot + +- Version updates: the root `gomod` entry runs in go.work mode and updates + every workspace module in one PR. The `/tools/*` entry updates the tool + modules, and the `github-actions` entry updates the SHA pins. A version is + proposed after a 7-day cooldown. +- Security updates (once enabled in the repository settings) run in the + directory of the vulnerable module and do not see `go.work`. A PR that + bumps a dependency in one sub-module leaves the other modules that require + it out of sync, and `make check-modules` fails ("go work sync rewrote …"). + Check out the PR branch, run `make tidy`, and push the result onto it + before merging. +- After a change to `.github/dependabot.yml`, or when the update PRs stop + coming, run "Check for updates" on each entry (Insights → Dependency graph + → Dependabot) and read the log. + - Dependabot's image ships an older Go than the `go` line, so every + `gomod` job downloads the toolchain (`GOTOOLCHAIN=auto`): look for a + toolchain download error. + - For `/tools/*`, check that the three tools are seen: they are + `// indirect` requirements, allowed by name. + - Fallback while an entry fails: bump by hand. For a workspace dependency: + `cd && go get @`, then `make tidy`. For a + tool: `cd tools/ && GOWORK=off go get -tool @`. + Then `make check-modules` and a pull request. + +## Tests of published modules + +The tests use mockery mocks that `make generate` writes as in-package +`mock_*_test.go` files, never committed. A module downloaded from the module +proxy has neither those files nor `.mockery.yaml`, so its tests (`go test` or +`go vet` from the module cache, a consumer's `go test all`, a distribution +build) only compile from a repository checkout after `make generate`. The +library code itself builds without them. + ## Repository settings (maintainer) These are not versioned in the repository; set them once: diff --git a/docs/security-considerations.md b/docs/security-considerations.md index 9230f22b..bc8c0047 100644 --- a/docs/security-considerations.md +++ b/docs/security-considerations.md @@ -969,32 +969,35 @@ span catalog. code you call. - **Vulnerability scanning.** The `govulncheck` workflow scans every module outside the workspace (its own requirements, tests included) on every - change, weekly and before every release; the release workflow never - publishes over a reachable advisory. Known and not reachable: + change and weekly, and it must be green on the commit of a release; the + release workflow also scans the released module itself and never + publishes over an advisory reachable from it. Known and not reachable: GO-2026-5932 (`golang.org/x/crypto/openpgp` is unmaintained, no fix) is reported at module level for the modules that require `golang.org/x/crypto`; none imports `openpgp`. Accepted reachable advisories (ID, reason, owner, review date): none. - **Dependencies.** Dependabot proposes version updates for every module after a 7-day cooldown (security updates are not delayed). The - development tools (golangci-lint, govulncheck, mockery) are pinned in - modules of their own under `tools/` and never reach a library's module - graph. + development tools (golangci-lint, govulncheck, goveralls, mockery) are + pinned in modules of their own under `tools/` and never reach a library's + module graph. - **CI and releases.** - - Every workflow runs with a read-only token, every action is pinned to a - full commit SHA, and checkouts keep no credentials. + - The workflows run with a read-only token by default (only the release + publish job gets `contents: write`), every action is pinned to a full + commit SHA, and checkouts keep no credentials. - A release is verified with a read-only token (`scripts/release-check.sh`, build, test, lint, govulncheck) before a separate job publishes the GitHub release, without checkout or third-party code. - Module tags are not signed: verify the modules through the Go checksum - database (`sum.golang.org`), as `go get` does by default. Never disable - it (`GONOSUMDB`, `GONOSUMCHECK`, `GOFLAGS=-insecure`) for these modules. + database (`sum.golang.org`), as `go get` does by default. Never set + `GOSUMDB=off`, and never let a `GOPRIVATE` or `GONOSUMDB` pattern match + `github.com/hyperscale-stack/*` (`GOINSECURE` and `GONOPROXY` do not + affect checksum verification). ## Operator checklist - [ ] Build with Go 1.27.2 or later, the latest patch release, and run `govulncheck` on your application. - - [ ] Pick a password hasher and review its cost against current hardware. - [ ] Rotate JWT signing keys; expose them through a JWKS endpoint (`oidc/provider` serves one).