Repository navigation
Expand file tree
/
Copy path.golangci.yml
More file actions
87 lines (87 loc) · 2.69 KB
/
Copy path.golangci.yml
File metadata and controls
87 lines (87 loc) · 2.69 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
version: "2"
run:
modules-download-mode: readonly
linters:
default: none
enable:
- errcheck
- govet
- misspell
- unconvert
- gosec
disable:
- depguard
- errcheck # TODO: Enable after fixing existing issues
settings:
govet:
# enable-all is intentionally avoided to keep the noisy
# fieldalignment analyzer off; shadow is turned on explicitly.
enable:
- shadow
disable:
- fieldalignment
misspell:
locale: US
ignore-rules:
- tempset # intentional name for temporary ipset
gosec:
excludes:
- G101 # Hardcoded credentials - false positives on variable names like "PrivateKey"
- G115 # Integer overflow - safe conversions: WASM bit extraction, timestamps, bounded lengths
- G204 # Command injection - uses exec.CommandContext with args array, not shell strings
- G304 # File path traversal - all paths are admin-controlled (config files, CLI args)
- G703 # Path traversal via taint analysis - same admin-controlled paths as G304
- G401 # MD5 weak crypto - used for checksums/deduplication, not cryptographic security
- G501 # Import blocklist md5 - used for checksums, not security
- G505 # Import blocklist sha1 - used for checksums, not security
# NOTE: G306 (file permissions) NOT excluded - must be handled case-by-case
exclusions:
generated: lax
presets:
- comments
- common-false-positives
- legacy
- std-error-handling
rules:
- linters:
- gosec
path: _test\.go
# Suppress G103 (unsafe) for crypto/packet code - intentional for zero-copy performance
- linters:
- gosec
text: "G103:"
path: "nhp/core/(packet|scheme|verifier|wasm)"
# Suppress G104 (unhandled errors) for logging operations where errors are non-fatal
- linters:
- gosec
text: "G104:"
path: "nhp/(log|etcd)/"
# Suppress G407 (hardcoded IV) - IV is randomly generated at runtime before use
- linters:
- gosec
text: "G407:"
paths:
- "nhp/core/wasm/policy/" # Exclude generated WASM policy code
- "third_party/"
- "builtin/"
- "examples/"
- "node_modules/" # JS dependencies that incidentally ship Go sources (e.g. flatted's golang/ subdir)
issues:
max-issues-per-linter: 50
max-same-issues: 10
formatters:
enable:
- gofmt
- goimports
settings:
goimports:
local-prefixes:
- github.com/OpenNHP/opennhp
exclusions:
generated: lax
paths:
- "nhp/core/wasm/policy/"
- "third_party/"
- "builtin/"
- "examples/"
- "node_modules/"