veraison · thomas-fossati · Jun 18, 2025 · Jun 17, 2025 · Jun 17, 2025 · Jun 17, 2025
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
@@ -10,13 +10,13 @@ jobs:
     steps:
     - uses: actions/setup-go@v2
       with:
-        go-version: "1.22"
+        go-version: "1.23"
     - name: Checkout code
       uses: actions/checkout@v2
     - name: Install golangci-lint
       run: |
         go version
-        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.54.2
+        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.1.6
     - name: Install mockgen
       run: |
         go install github.com/golang/mock/mockgen@v1.5.0

diff --git a/.golangci.yml b/.golangci.yml
@@ -1,60 +1,68 @@
 # Do not delete linter settings. Linters like gocritic can be enabled on the command line.
 
-linters-settings:
-  dupl:
-    threshold: 100
-  funlen:
-    lines: 100
-    statements: 50
-  goconst:
-    min-len: 2
-    min-occurrences: 3
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - dupImport # https://github.com/go-critic/go-critic/issues/845
-      - ifElseChain
-      - octalLiteral
-      - paramTypeCombine
-      - whyNoLint
-      - wrapperFunc
-  gofmt:
-    simplify: false
-  goimports:
-  golint:
-    min-confidence: 0
-  govet:
-    check-shadowing: true
-  lll:
-    line-length: 140
-  maligned:
-    suggest-new: true
-  misspell:
-    locale: US
-
-linters:
-  disable-all: true
+formatters:
   enable:
-    - errcheck
-    - goconst
-    - gocyclo
     - gofmt
     - goimports
-    - gosec
-    - govet
-    - ineffassign
-    - misspell
-    - revive
-    - staticcheck
-    - typecheck
-    - unconvert
-    - unused
+  settings:
+    gofmt:
+      simplify: false
 
+linters:
+  default: none
+  enable:
+    - dupl # style
+    - errcheck # bugs
+    - funlen # complexity
+    - goconst # style
+    - gocritic # metalinter
+    - gocyclo # complexity
+    - gosec # bugs
+    - govet # bugs
+    - ineffassign
+    - lll  # style
+    - misspell # comment
+    - staticcheck # metalinter
+    - unconvert # style
+    - unused # unused
+  exclusions:
+    rules:
+      - path: '(.+)_test\.go'
+        linters:
+          - dupl
+          - funlen
+          - lll
+          - goconst
+  settings:
+    dupl:
+      threshold: 100
+    funlen:
+      lines: 100
+      statements: 50
+    goconst:
+      min-len: 2
+      min-occurrences: 3
+    gocritic:
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - performance
+        - style
+      disabled-checks:
+        - dupImport # https://github.com/go-critic/go-critic/issues/845
+        - ifElseChain
+        - octalLiteral
+        - paramTypeCombine
+        - whyNoLint
+        - wrapperFunc
+    govet:
+      enable:
+        - shadow
+    lll:
+      line-length: 140
+    misspell:
+      locale: US
 
 issues:
   # max-issues-per-linter default is 50.  Set to 0 to disable limit.
@@ -80,7 +88,4 @@ issues:
         # see it as unused
         - unused
 
-# golangci.com configuration
-# https://github.com/golangci/golangci/wiki/Configuration
-service:
-  golangci-lint-version: 1.23.x # use the fixed version to not introduce new linters unexpectedly
+version: "2"
diff --git a/Makefile b/Makefile
@@ -12,7 +12,7 @@ GOPKG += github.com/veraison/corim/extensions
 
 GOLINT ?= golangci-lint
 
-GOLINT_ARGS ?= run --timeout=3m -E dupl -E gocritic -E gosimple -E lll -E prealloc
+GOLINT_ARGS ?= run --timeout=3m -E dupl -E gocritic -E staticcheck -E lll -E prealloc
 
 .PHONY: lint
 lint:

diff --git a/comid/classid.go b/comid/classid.go
@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"strconv"
 
+	"fortio.org/safecast"
 	"github.com/veraison/corim/encoding"
 	"github.com/veraison/corim/extensions"
 )
@@ -377,19 +378,39 @@ func NewIntClassID(val any) (*ClassID, error) {
 		if len(t) != 8 {
 			return nil, fmt.Errorf("bad int: want 8 bytes, got %d bytes", len(t))
 		}
-		ret = TaggedInt(binary.BigEndian.Uint64(t))
+		ti, err := safecast.Convert[int, uint64](binary.BigEndian.Uint64(t))
+		if err != nil {
+			return nil, err
+		}
+		ret = TaggedInt(ti)
 	case int:
 		ret = TaggedInt(t)
 	case *int:
 		ret = TaggedInt(*t)
 	case int64:
-		ret = TaggedInt(t)
+		ti, err := safecast.Convert[int, int64](t)
+		if err != nil {
+			return nil, err
+		}
+		ret = TaggedInt(ti)
 	case *int64:
-		ret = TaggedInt(*t)
+		ti, err := safecast.Convert[int, int64](*t)
+		if err != nil {
+			return nil, err
+		}
+		ret = TaggedInt(ti)
 	case uint64:
-		ret = TaggedInt(t)
+		ti, err := safecast.Convert[int, uint64](t)
+		if err != nil {
+			return nil, err
+		}
+		ret = TaggedInt(ti)
 	case *uint64:
-		ret = TaggedInt(*t)
+		ti, err := safecast.Convert[int, uint64](*t)
+		if err != nil {
+			return nil, err
+		}
+		ret = TaggedInt(ti)
 	default:
 		return nil, fmt.Errorf("unexpected type for int: %T", t)
 	}
@@ -415,7 +436,15 @@ func (o TaggedInt) Type() string {
 
 func (o TaggedInt) Bytes() []byte {
 	var ret [8]byte
-	binary.BigEndian.PutUint64(ret[:], uint64(o))
+	var uo uint64
+	io := int(o) // Needed for gosec flow typing.
+	// Use 2's complement for negative values since this can't return an error.
+	if io < 0 {
+		uo = ^uint64(0) - uint64(-io) + 1
+	} else {
+		uo = uint64(io)
+	}
+	binary.BigEndian.PutUint64(ret[:], uo)
 	return ret[:]
 }
 

diff --git a/comid/comid.go b/comid/comid.go
@@ -37,7 +37,7 @@ func (o *Comid) RegisterExtensions(exts extensions.Map) error {
 	for p, v := range exts {
 		switch p {
 		case ExtComid:
-			o.Extensions.Register(v)
+			o.Register(v)
 		case ExtEntity:
 			if o.Entities == nil {
 				o.Entities = NewEntities()
@@ -57,7 +57,7 @@ func (o *Comid) RegisterExtensions(exts extensions.Map) error {
 
 // GetExtensions returns previously registered extension
 func (o *Comid) GetExtensions() extensions.IMapValue {
-	return o.Extensions.IMapValue
+	return o.IMapValue
 }
 
 // SetLanguage sets the language used in the target Comid to the supplied
@@ -279,7 +279,7 @@ func (o Comid) Valid() error {
 		return fmt.Errorf("triples validation failed: %w", err)
 	}
 
-	return o.Extensions.validComid(&o)
+	return o.validComid(&o)
 }
 
 // ToCBOR serializes the target Comid to CBOR

diff --git a/comid/cryptokey.go b/comid/cryptokey.go
@@ -393,11 +393,7 @@ func (o TaggedPKIXBase64CertPath) certPath() ([]*x509.Certificate, error) {
 	var rest []byte
 	rest = []byte(o)
 	i := 0
-	for {
-		if len(rest) == 0 {
-			break
-		}
-
+	for len(rest) != 0 {
 		block, rest = pem.Decode(rest)
 		if block == nil {
 			return nil, fmt.Errorf("could not decode PEM block %d", i)

diff --git a/comid/entity.go b/comid/entity.go
@@ -27,7 +27,7 @@ func (o *Entity) RegisterExtensions(exts extensions.Map) error {
 	for p, v := range exts {
 		switch p {
 		case ExtEntity:
-			o.Extensions.Register(v)
+			o.Register(v)
 		default:
 			return fmt.Errorf("%w: %q", extensions.ErrUnexpectedPoint, p)
 		}
@@ -38,7 +38,7 @@ func (o *Entity) RegisterExtensions(exts extensions.Map) error {
 
 // GetExtensions returns previously registered extension
 func (o *Entity) GetExtensions() extensions.IMapValue {
-	return o.Extensions.IMapValue
+	return o.IMapValue
 }
 
 // SetName is used to set the Name field of Entity using supplied name
@@ -90,7 +90,7 @@ func (o Entity) Valid() error {
 		return fmt.Errorf("invalid entity: %w", err)
 	}
 
-	return o.Extensions.validEntity(&o)
+	return o.validEntity(&o)
 }
 
 // UnmarshalCBOR deserializes from CBOR

diff --git a/comid/flagsmap.go b/comid/flagsmap.go
@@ -76,7 +76,7 @@ func (o FlagsMap) IsEmpty() bool {
 		return false
 	}
 
-	return o.Extensions.IsEmpty()
+	return o.IsEmpty()
 }
 
 func (o *FlagsMap) AnySet() bool {
@@ -86,7 +86,7 @@ func (o *FlagsMap) AnySet() bool {
 		return true
 	}
 
-	return o.Extensions.anySet()
+	return o.anySet()
 }
 
 func (o *FlagsMap) setFlag(value *bool, flags ...Flag) {
@@ -112,9 +112,9 @@ func (o *FlagsMap) setFlag(value *bool, flags ...Flag) {
 			o.IsTcb = value
 		default:
 			if value == &True {
-				o.Extensions.setTrue(flag)
+				o.setTrue(flag)
 			} else {
-				o.Extensions.setFalse(flag)
+				o.setFalse(flag)
 			}
 		}
 	}
@@ -150,7 +150,7 @@ func (o *FlagsMap) Clear(flags ...Flag) {
 		case FlagIsTcb:
 			o.IsTcb = nil
 		default:
-			o.Extensions.clear(flag)
+			o.clear(flag)
 		}
 	}
 }
@@ -176,7 +176,7 @@ func (o *FlagsMap) Get(flag Flag) *bool {
 	case FlagIsTcb:
 		return o.IsTcb
 	default:
-		return o.Extensions.get(flag)
+		return o.get(flag)
 	}
 }
 
@@ -193,7 +193,7 @@ func (o *FlagsMap) RegisterExtensions(exts extensions.Map) error {
 	for p, v := range exts {
 		switch p {
 		case ExtFlags:
-			o.Extensions.Register(v)
+			o.Register(v)
 		default:
 			return fmt.Errorf("%w: %q", extensions.ErrUnexpectedPoint, p)
 		}
@@ -204,7 +204,7 @@ func (o *FlagsMap) RegisterExtensions(exts extensions.Map) error {
 
 // GetExtensions returns previously registered extension
 func (o *FlagsMap) GetExtensions() extensions.IMapValue {
-	return o.Extensions.IMapValue
+	return o.IMapValue
 }
 
 // UnmarshalCBOR deserializes from CBOR
@@ -232,5 +232,5 @@ func (o FlagsMap) MarshalJSON() ([]byte, error) {
 // Valid returns an error if the FlagsMap is invalid.
 // nolint:gocritic
 func (o FlagsMap) Valid() error {
-	return o.Extensions.validFlagsMap(&o)
+	return o.validFlagsMap(&o)
 }