diff --git a/cmd/synapse-backupper/generate_config_test.go b/cmd/synapse-backupper/generate_config_test.go index 61b0c8c..1cc2961 100644 --- a/cmd/synapse-backupper/generate_config_test.go +++ b/cmd/synapse-backupper/generate_config_test.go @@ -140,13 +140,8 @@ func TestGenerateConfig_AllKeys(t *testing.T) { } out := buf.String() - requiredKeys := []string{ - "host", "port", "user", "password", "database", "sslmode", "exclude_tables", - "dir", "retention_days", "cron", - "pq_scheme", "classical_scheme", - "pq_public_key_path", "classical_public_key_path", - "healthz", "log", - } + requiredKeys := make([]string, 0, 16) + requiredKeys = append(requiredKeys, "host", "port", "user", "password", "database", "sslmode", "exclude_tables", "dir", "retention_days", "cron", "pq_scheme", "classical_scheme", "pq_public_key_path", "classical_public_key_path", "healthz", "log") for _, key := range requiredKeys { if !strings.Contains(out, key) { diff --git a/cmd/synapse-backupper/keygen_test.go b/cmd/synapse-backupper/keygen_test.go index 2c16a08..dec889a 100644 --- a/cmd/synapse-backupper/keygen_test.go +++ b/cmd/synapse-backupper/keygen_test.go @@ -74,12 +74,9 @@ func TestKeygenCmdBoth(t *testing.T) { } // Verify all 4 files exist. - files := []string{ - prefix + ".pq.pub.pem", - prefix + ".pq.priv.pem", - prefix + ".classical.pub.pem", - prefix + ".classical.priv.pem", - } + files := make([]string, 0, 4) + files = append(files, prefix+".pq.pub.pem", prefix+".pq.priv.pem", prefix+".classical.pub.pem", prefix+".classical.priv.pem") + for _, f := range files { if _, err := os.Stat(f); err != nil { t.Errorf("expected file %s to exist: %v", f, err) @@ -274,7 +271,10 @@ func TestKeygenCmdPermissions(t *testing.T) { t.Fatalf("Execute failed: %v", err) } - pubFiles := []string{prefix + ".pq.pub.pem", prefix + ".classical.pub.pem"} + pubFiles := make([]string, 0, 2) + + pubFiles = append(pubFiles, prefix+".pq.pub.pem", prefix+".classical.pub.pem") + for _, f := range pubFiles { info, err := os.Stat(f) if err != nil { @@ -286,7 +286,10 @@ func TestKeygenCmdPermissions(t *testing.T) { } } - privFiles := []string{prefix + ".pq.priv.pem", prefix + ".classical.priv.pem"} + privFiles := make([]string, 0, 2) + + privFiles = append(privFiles, prefix+".pq.priv.pem", prefix+".classical.priv.pem") + for _, f := range privFiles { info, err := os.Stat(f) if err != nil { diff --git a/cmd/synapse-backupper/restore.go b/cmd/synapse-backupper/restore.go index 97b1fc9..49aedc1 100644 --- a/cmd/synapse-backupper/restore.go +++ b/cmd/synapse-backupper/restore.go @@ -94,9 +94,11 @@ var restoreCmd = &cobra.Command{ } decryptor := newRestoreDecryptor(registry) + privateKeys := make([]crypto.RecipientPriv, 0, 2) + privateKeys = append(privateKeys, pqPriv, classicalPriv) if err := decryptor.Decrypt( inFile, - []crypto.RecipientPriv{pqPriv, classicalPriv}, + privateKeys, out, ); err != nil { return err diff --git a/cmd/synapse-backupper/restore_test.go b/cmd/synapse-backupper/restore_test.go index 598a339..60d2711 100644 --- a/cmd/synapse-backupper/restore_test.go +++ b/cmd/synapse-backupper/restore_test.go @@ -153,7 +153,10 @@ func TestRestoreCmd_Structure(t *testing.T) { t.Fatalf("expected Use='restore', got %q", restoreCmd.Use) } - requiredFlags := []string{"in", "privkey-pq", "privkey-classical"} + requiredFlags := make([]string, 0, 3) + + requiredFlags = append(requiredFlags, "in", "privkey-pq", "privkey-classical") + for _, f := range requiredFlags { if restoreCmd.Flag(f) == nil { t.Fatalf("missing required --%s flag", f) @@ -172,7 +175,9 @@ func TestRestoreCmd_Structure(t *testing.T) { } func TestRestoreCmd_RequiredFlags(t *testing.T) { - required := []string{"in", "privkey-pq", "privkey-classical"} + required := make([]string, 0, 3) + required = append(required, "in", "privkey-pq", "privkey-classical") + for _, name := range required { flag := restoreCmd.Flag(name) if flag == nil { diff --git a/pkg/adapters/crypto/composite/composite_test.go b/pkg/adapters/crypto/composite/composite_test.go index fe68678..2877d51 100644 --- a/pkg/adapters/crypto/composite/composite_test.go +++ b/pkg/adapters/crypto/composite/composite_test.go @@ -18,6 +18,16 @@ import ( "git.tswf.io/infra/go-synapse-backupper/pkg/domain/crypto" ) +func makeRecipientPubs(pqPub, classicalPub crypto.RecipientPub) []crypto.RecipientPub { + pubs := make([]crypto.RecipientPub, 0, 2) + return append(pubs, pqPub, classicalPub) +} + +func makeRecipientPrivs(pqPriv, classicalPriv crypto.RecipientPriv) []crypto.RecipientPriv { + privs := make([]crypto.RecipientPriv, 0, 2) + return append(privs, pqPriv, classicalPriv) +} + // --------------------------------------------------------------------------- // Test KEM harness // @@ -286,7 +296,7 @@ func TestGoldenFormat( out := &bytes.Buffer{} if err := dec.Decrypt( bytes.NewReader(goldenBytes), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ); err != nil { t.Fatalf("Decrypt(golden) failed: %v", err) @@ -304,8 +314,8 @@ func TestRoundTrip( for _, size := range sizes { t.Run(fmt.Sprintf("size=%d", size), func(t *testing.T) { plaintext := make([]byte, size) - for i := 0; i < size; i++ { - plaintext[i] = byte(i) + for index := 0; index < size; index++ { + plaintext[index] = byte(index) } reg := fakeRegistry(t) @@ -318,7 +328,7 @@ func TestRoundTrip( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader(plaintext), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -328,7 +338,7 @@ func TestRoundTrip( out := &bytes.Buffer{} if err := dec.Decrypt( bytes.NewReader(encrypted.Bytes()), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ); err != nil { t.Fatalf("Decrypt: %v", err) @@ -354,7 +364,7 @@ func TestEmptyPlaintextSingleFinalChunk( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader(nil), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -394,7 +404,7 @@ func TestExactly64KiBTwoChunks( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader(plaintext), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -486,7 +496,7 @@ func TestTamperPayload( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader(plaintext), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -504,7 +514,7 @@ func TestTamperPayload( out := &bytes.Buffer{} err := dec.Decrypt( bytes.NewReader(buf), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ) if !errors.Is(err, ErrTamperingDetected) { @@ -526,7 +536,7 @@ func TestTamperWrappedCEK( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader([]byte{0xAA}), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -545,7 +555,7 @@ func TestTamperWrappedCEK( out := &bytes.Buffer{} err := dec.Decrypt( bytes.NewReader(buf), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ) if !errors.Is(err, ErrTamperingDetected) { @@ -575,7 +585,7 @@ func TestWrongPrivKey( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader([]byte{0x11, 0x22, 0x33}), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -605,7 +615,7 @@ func TestFormatConformance( var out bytes.Buffer if err := enc.Encrypt( bytes.NewReader([]byte{0x42}), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &out, rand.Reader, ); err != nil { @@ -649,7 +659,7 @@ func TestUnsupportedVersionNoGCM( out := &bytes.Buffer{} err := dec.Decrypt( reader, - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ) if !errors.Is(err, ErrUnsupportedVersion) { @@ -723,7 +733,7 @@ func TestMalformedHeaderCtLenOverflow( _, classicalPriv := generateFakeKeyPair(t, fakeRegistry(t), fakeClassicalSchemeID, rand.Reader) err := dec.Decrypt( reader, - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), &bytes.Buffer{}, ) if !errors.Is(err, ErrMalformedHeader) { @@ -754,7 +764,7 @@ func TestZeroLengthNonFinalChunk( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader([]byte{0xAA}), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -770,7 +780,7 @@ func TestZeroLengthNonFinalChunk( out := &bytes.Buffer{} err := dec.Decrypt( bytes.NewReader(corrupt.Bytes()), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ) if !errors.Is(err, ErrMalformedChunk) { @@ -792,7 +802,7 @@ func TestOversizedChunk( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader([]byte{0xAA}), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -808,7 +818,7 @@ func TestOversizedChunk( out := &bytes.Buffer{} err := dec.Decrypt( bytes.NewReader(corrupt.Bytes()), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ) if !errors.Is(err, ErrMalformedChunk) { @@ -833,7 +843,7 @@ func TestPrematureEOF( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader(plaintext), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rand.Reader, ); err != nil { @@ -853,7 +863,7 @@ func TestPrematureEOF( out := &bytes.Buffer{} err := dec.Decrypt( bytes.NewReader(encrypted.Bytes()[:truncatedLen]), - []crypto.RecipientPriv{pqPriv, classicalPriv}, + makeRecipientPrivs(pqPriv, classicalPriv), out, ) if !errors.Is(err, ErrUnexpectedEOF) { diff --git a/pkg/adapters/crypto/composite/golden_generate_test.go b/pkg/adapters/crypto/composite/golden_generate_test.go index 75bb106..a9045f1 100644 --- a/pkg/adapters/crypto/composite/golden_generate_test.go +++ b/pkg/adapters/crypto/composite/golden_generate_test.go @@ -88,7 +88,7 @@ func TestGenerateGoldenFixture( var encrypted bytes.Buffer if err := enc.Encrypt( bytes.NewReader([]byte{0xAA}), - []crypto.RecipientPub{pqPub, classicalPub}, + makeRecipientPubs(pqPub, classicalPub), &encrypted, rng, ); err != nil { diff --git a/pkg/adapters/pgdump/pgdump_test.go b/pkg/adapters/pgdump/pgdump_test.go index bac699a..232eae3 100644 --- a/pkg/adapters/pgdump/pgdump_test.go +++ b/pkg/adapters/pgdump/pgdump_test.go @@ -44,10 +44,8 @@ func mockCommandContext( } func TestDump_Success(t *testing.T) { - wantArgs := []string{ - "--format=custom", - "--exclude-table=e2e_one_time_keys_json", - } + wantArgs := make([]string, 0, 2) + wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json") adapter := &adapter{ commandContext: mockCommandContext( @@ -78,10 +76,8 @@ func TestDump_Success(t *testing.T) { func TestDump_WaitAfterStdoutEOF(t *testing.T) { // This test verifies that after io.Copy returns (stdout EOF), // cmd.Wait() is called and the exit code is verified before returning. - wantArgs := []string{ - "--format=custom", - "--exclude-table=e2e_one_time_keys_json", - } + wantArgs := make([]string, 0, 2) + wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json") adapter := &adapter{ commandContext: mockCommandContext( @@ -110,10 +106,8 @@ func TestDump_WaitAfterStdoutEOF(t *testing.T) { } func TestDump_NonZeroExitCode(t *testing.T) { - wantArgs := []string{ - "--format=custom", - "--exclude-table=e2e_one_time_keys_json", - } + wantArgs := make([]string, 0, 2) + wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json") adapter := &adapter{ commandContext: mockCommandContext( @@ -200,10 +194,8 @@ func TestDump_ContextCancellation(t *testing.T) { } func TestDump_DefaultExcludeTables(t *testing.T) { - wantArgs := []string{ - "--format=custom", - "--exclude-table=e2e_one_time_keys_json", - } + wantArgs := make([]string, 0, 2) + wantArgs = append(wantArgs, "--format=custom", "--exclude-table=e2e_one_time_keys_json") adapter := &adapter{ commandContext: mockCommandContext( @@ -227,11 +219,8 @@ func TestDump_DefaultExcludeTables(t *testing.T) { } func TestDump_CustomExcludeTables(t *testing.T) { - wantArgs := []string{ - "--format=custom", - "--exclude-table=table_a", - "--exclude-table=table_b", - } + wantArgs := make([]string, 0, 3) + wantArgs = append(wantArgs, "--format=custom", "--exclude-table=table_a", "--exclude-table=table_b") adapter := &adapter{ commandContext: mockCommandContext( @@ -288,12 +277,10 @@ func TestDump_EnvVars(t *testing.T) { t.Errorf("PGPASSWORD must not be passed to pg_dump subprocess") } - wantEnvVars := []string{ - "PGHOST=myhost", - "PGPORT=5433", - "PGUSER=myuser", - "PGDATABASE=mydb", - } + wantEnvVars := make([]string, 0, 4) + + wantEnvVars = append(wantEnvVars, "PGHOST=myhost", "PGPORT=5433", "PGUSER=myuser", "PGDATABASE=mydb") + for _, wantEnv := range wantEnvVars { if !strings.Contains(envStr, wantEnv) { t.Errorf("env missing %q", wantEnv)