From 3950dd94ee6cb12be4d0f28a790bcc3abf39c2a7 Mon Sep 17 00:00:00 2001 From: vergil_on Date: Sun, 9 Aug 2026 00:32:32 +0300 Subject: [PATCH] =?UTF-8?q?style:=20=D0=B7=D0=B0=D0=BC=D0=B5=D0=BD=D0=B8?= =?UTF-8?q?=D1=82=D1=8C=20=D0=BA=D0=BE=D1=80=D0=BE=D1=82=D0=BA=D0=B8=D0=B5?= =?UTF-8?q?=20=D0=B8=D0=BC=D0=B5=D0=BD=D0=B0=20=D0=BF=D0=B5=D1=80=D0=B5?= =?UTF-8?q?=D0=BC=D0=B5=D0=BD=D0=BD=D1=8B=D1=85?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent) Co-authored-by: Sisyphus --- cmd/synapse-backupper/keygen.go | 24 +++--- pkg/adapters/config/config.go | 86 +++++++++++----------- pkg/adapters/crypto/composite/composite.go | 30 ++++---- pkg/adapters/crypto/x25519/x25519.go | 4 +- 4 files changed, 73 insertions(+), 71 deletions(-) diff --git a/cmd/synapse-backupper/keygen.go b/cmd/synapse-backupper/keygen.go index 279323e..17c1596 100644 --- a/cmd/synapse-backupper/keygen.go +++ b/cmd/synapse-backupper/keygen.go @@ -68,12 +68,14 @@ func newKeygenCmdWithDeps(reg crypto.Registry) *cobra.Command { } if !force { - for _, s := range schemes { - pubPath := outPrefix + "." + s.name + ".pub.pem" - privPath := outPrefix + "." + s.name + ".priv.pem" - for _, p := range []string{pubPath, privPath} { - if _, err := os.Stat(p); err == nil { - return fmt.Errorf("file already exists: %s (use --force to overwrite)", p) + for _, scheme := range schemes { + pubPath := outPrefix + "." + scheme.name + ".pub.pem" + privPath := outPrefix + "." + scheme.name + ".priv.pem" + paths := make([]string, 0, 2) + paths = append(paths, pubPath, privPath) + for _, path := range paths { + if _, err := os.Stat(path); err == nil { + return fmt.Errorf("file already exists: %s (use --force to overwrite)", path) } } } @@ -81,9 +83,9 @@ func newKeygenCmdWithDeps(reg crypto.Registry) *cobra.Command { km := keymanager.NewKeyManager(reg) - for _, s := range schemes { - pubPath := outPrefix + "." + s.name + ".pub.pem" - privPath := outPrefix + "." + s.name + ".priv.pem" + for _, scheme := range schemes { + pubPath := outPrefix + "." + scheme.name + ".pub.pem" + privPath := outPrefix + "." + scheme.name + ".priv.pem" pubFile, err := os.OpenFile(pubPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o644) if err != nil { @@ -96,10 +98,10 @@ func newKeygenCmdWithDeps(reg crypto.Registry) *cobra.Command { return fmt.Errorf("create private key file %s: %w", privPath, err) } - if err := km.Generate(s.schemeID, pubFile, privFile, rand.Reader); err != nil { + if err := km.Generate(scheme.schemeID, pubFile, privFile, rand.Reader); err != nil { _ = pubFile.Close() _ = privFile.Close() - return fmt.Errorf("generate %s keys: %w", s.name, err) + return fmt.Errorf("generate %s keys: %w", scheme.name, err) } if err := pubFile.Close(); err != nil { diff --git a/pkg/adapters/config/config.go b/pkg/adapters/config/config.go index 7f8fbac..16760c4 100644 --- a/pkg/adapters/config/config.go +++ b/pkg/adapters/config/config.go @@ -74,88 +74,88 @@ func RegisterFlags(cmd *cobra.Command) { // launch arguments (Cobra flags) → APP_* env variables → config file → defaults. func Load(cmd *cobra.Command) (*Config, error) { // Use a fresh Viper instance so that successive calls do not leak state. - v := viper.New() + viperInstance := viper.New() // Defaults (lowest priority). - v.SetDefault("pg.port", 5432) - v.SetDefault("pg.sslmode", "prefer") - v.SetDefault("pg.exclude_tables", []string{"e2e_one_time_keys_json"}) - v.SetDefault("backup.retention_days", 180) - v.SetDefault("backup.cron", "0 0 3 * * *") - v.SetDefault("pq_scheme", uint16(0x0006)) - v.SetDefault("classical_scheme", uint16(0x0007)) - v.SetDefault("healthz.port", 8080) - v.SetDefault("log.level", "info") - v.SetDefault("shutdown_timeout", 30*time.Second) + viperInstance.SetDefault("pg.port", 5432) + viperInstance.SetDefault("pg.sslmode", "prefer") + viperInstance.SetDefault("pg.exclude_tables", []string{"e2e_one_time_keys_json"}) + viperInstance.SetDefault("backup.retention_days", 180) + viperInstance.SetDefault("backup.cron", "0 0 3 * * *") + viperInstance.SetDefault("pq_scheme", uint16(0x0006)) + viperInstance.SetDefault("classical_scheme", uint16(0x0007)) + viperInstance.SetDefault("healthz.port", 8080) + viperInstance.SetDefault("log.level", "info") + viperInstance.SetDefault("shutdown_timeout", 30*time.Second) // Bind parsed Cobra flags to Viper keys. if cmd != nil { - _ = v.BindPFlag("pg.host", cmd.Flags().Lookup("pg-host")) - _ = v.BindPFlag("pg.port", cmd.Flags().Lookup("pg-port")) - _ = v.BindPFlag("pg.user", cmd.Flags().Lookup("pg-user")) - _ = v.BindPFlag("pg.database", cmd.Flags().Lookup("pg-database")) - _ = v.BindPFlag("pg.sslmode", cmd.Flags().Lookup("pg-sslmode")) - _ = v.BindPFlag("pg.exclude_tables", cmd.Flags().Lookup("pg-exclude-tables")) - _ = v.BindPFlag("backup.dir", cmd.Flags().Lookup("backup-dir")) - _ = v.BindPFlag("backup.retention_days", cmd.Flags().Lookup("backup-retention-days")) - _ = v.BindPFlag("backup.cron", cmd.Flags().Lookup("backup-cron")) - _ = v.BindPFlag("pq_scheme", cmd.Flags().Lookup("pq-scheme")) - _ = v.BindPFlag("classical_scheme", cmd.Flags().Lookup("classical-scheme")) - _ = v.BindPFlag("pq_public_key_path", cmd.Flags().Lookup("pq-public-key-path")) - _ = v.BindPFlag("classical_public_key_path", cmd.Flags().Lookup("classical-public-key-path")) - _ = v.BindPFlag("healthz.port", cmd.Flags().Lookup("healthz-port")) - _ = v.BindPFlag("log.level", cmd.Flags().Lookup("log-level")) - _ = v.BindPFlag("shutdown_timeout", cmd.Flags().Lookup("shutdown-timeout")) + _ = viperInstance.BindPFlag("pg.host", cmd.Flags().Lookup("pg-host")) + _ = viperInstance.BindPFlag("pg.port", cmd.Flags().Lookup("pg-port")) + _ = viperInstance.BindPFlag("pg.user", cmd.Flags().Lookup("pg-user")) + _ = viperInstance.BindPFlag("pg.database", cmd.Flags().Lookup("pg-database")) + _ = viperInstance.BindPFlag("pg.sslmode", cmd.Flags().Lookup("pg-sslmode")) + _ = viperInstance.BindPFlag("pg.exclude_tables", cmd.Flags().Lookup("pg-exclude-tables")) + _ = viperInstance.BindPFlag("backup.dir", cmd.Flags().Lookup("backup-dir")) + _ = viperInstance.BindPFlag("backup.retention_days", cmd.Flags().Lookup("backup-retention-days")) + _ = viperInstance.BindPFlag("backup.cron", cmd.Flags().Lookup("backup-cron")) + _ = viperInstance.BindPFlag("pq_scheme", cmd.Flags().Lookup("pq-scheme")) + _ = viperInstance.BindPFlag("classical_scheme", cmd.Flags().Lookup("classical-scheme")) + _ = viperInstance.BindPFlag("pq_public_key_path", cmd.Flags().Lookup("pq-public-key-path")) + _ = viperInstance.BindPFlag("classical_public_key_path", cmd.Flags().Lookup("classical-public-key-path")) + _ = viperInstance.BindPFlag("healthz.port", cmd.Flags().Lookup("healthz-port")) + _ = viperInstance.BindPFlag("log.level", cmd.Flags().Lookup("log-level")) + _ = viperInstance.BindPFlag("shutdown_timeout", cmd.Flags().Lookup("shutdown-timeout")) } // Config file search with logging. - v.SetConfigName("config") - v.SetConfigType("yaml") + viperInstance.SetConfigName("config") + viperInstance.SetConfigType("yaml") if envLoc := os.Getenv("APP_CONFIG_LOCATION"); envLoc != "" { - v.SetConfigFile(envLoc) - if err := v.ReadInConfig(); err == nil { - logf("Config file found: %s (from APP_CONFIG_LOCATION)", v.ConfigFileUsed()) + viperInstance.SetConfigFile(envLoc) + if err := viperInstance.ReadInConfig(); err == nil { + logf("Config file found: %s (from APP_CONFIG_LOCATION)", viperInstance.ConfigFileUsed()) } else { return nil, fmt.Errorf("config file specified in APP_CONFIG_LOCATION not found: %s", envLoc) } } else { - v.AddConfigPath(".") + viperInstance.AddConfigPath(".") homeDir, _ := os.UserHomeDir() appName := "synapse-backupper" userConfigPath := filepath.Join(homeDir, ".config", appName) - v.AddConfigPath(userConfigPath) + viperInstance.AddConfigPath(userConfigPath) exePath, _ := os.Executable() exeDir := filepath.Dir(exePath) - v.AddConfigPath(exeDir) + viperInstance.AddConfigPath(exeDir) etcPath := filepath.Join("/etc", appName) - v.AddConfigPath(etcPath) + viperInstance.AddConfigPath(etcPath) - if err := v.ReadInConfig(); err != nil { + if err := viperInstance.ReadInConfig(); err != nil { if _, ok := err.(viper.ConfigFileNotFoundError); ok { logf("Configuration file not found. Using defaults and env/args.") } else { return nil, fmt.Errorf("error reading config: %w", err) } } else { - logf("Config file found: %s", v.ConfigFileUsed()) + logf("Config file found: %s", viperInstance.ConfigFileUsed()) } } // Environment variables. - v.SetEnvPrefix("APP") - v.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_")) - v.AutomaticEnv() + viperInstance.SetEnvPrefix("APP") + viperInstance.SetEnvKeyReplacer(strings.NewReplacer(".", "_", "-", "_")) + viperInstance.AutomaticEnv() // pg.password is intentionally not exposed as a CLI flag (CWE-214), but // must still be loadable from APP_PG_PASSWORD. Viper needs an explicit // BindEnv for a nested key that has no bound flag. - _ = v.BindEnv("pg.password") + _ = viperInstance.BindEnv("pg.password") var cfg Config - if err := v.Unmarshal(&cfg); err != nil { + if err := viperInstance.Unmarshal(&cfg); err != nil { return nil, fmt.Errorf("config unmarshal failed: %w", err) } diff --git a/pkg/adapters/crypto/composite/composite.go b/pkg/adapters/crypto/composite/composite.go index be955b4..b8d5573 100644 --- a/pkg/adapters/crypto/composite/composite.go +++ b/pkg/adapters/crypto/composite/composite.go @@ -233,40 +233,40 @@ func writeHeader( wrapNonce, wrappedCek, firstPayloadNonce []byte, ) error { var buf bytes.Buffer - var b4 [4]byte + var scratchBytes [4]byte - binary.BigEndian.PutUint32(b4[:], magic) - buf.Write(b4[:]) // [0:4] magic + binary.BigEndian.PutUint32(scratchBytes[:], magic) + buf.Write(scratchBytes[:]) // [0:4] magic - binary.BigEndian.PutUint16(b4[:2], version) - buf.Write(b4[:2]) // [4:6] version + binary.BigEndian.PutUint16(scratchBytes[:2], version) + buf.Write(scratchBytes[:2]) // [4:6] version - binary.BigEndian.PutUint32(b4[:], flags) - buf.Write(b4[:]) // [6:10] flags + binary.BigEndian.PutUint32(scratchBytes[:], flags) + buf.Write(scratchBytes[:]) // [6:10] flags // [10] nRecipients — composite v2 always carries exactly two slots. buf.WriteByte(byte(maxRecipients)) // Slot 0 (PQ). - binary.BigEndian.PutUint16(b4[:2], pqPub.SchemeID()) - buf.Write(b4[:2]) + binary.BigEndian.PutUint16(scratchBytes[:2], pqPub.SchemeID()) + buf.Write(scratchBytes[:2]) if len(pqPub.KeyID()) != 8 { return ErrMalformedHeader } buf.Write(pqPub.KeyID()) - binary.BigEndian.PutUint32(b4[:], uint32(len(pqCt))) - buf.Write(b4[:]) + binary.BigEndian.PutUint32(scratchBytes[:], uint32(len(pqCt))) + buf.Write(scratchBytes[:]) buf.Write(pqCt) // Slot 1 (classical). - binary.BigEndian.PutUint16(b4[:2], classicalPub.SchemeID()) - buf.Write(b4[:2]) + binary.BigEndian.PutUint16(scratchBytes[:2], classicalPub.SchemeID()) + buf.Write(scratchBytes[:2]) if len(classicalPub.KeyID()) != 8 { return ErrMalformedHeader } buf.Write(classicalPub.KeyID()) - binary.BigEndian.PutUint32(b4[:], uint32(len(classicalCt))) - buf.Write(b4[:]) + binary.BigEndian.PutUint32(scratchBytes[:], uint32(len(classicalCt))) + buf.Write(scratchBytes[:]) buf.Write(classicalCt) // wrapNonce + wrappedCEK + firstPayloadNonce. diff --git a/pkg/adapters/crypto/x25519/x25519.go b/pkg/adapters/crypto/x25519/x25519.go index 24a1049..0e740fc 100644 --- a/pkg/adapters/crypto/x25519/x25519.go +++ b/pkg/adapters/crypto/x25519/x25519.go @@ -136,8 +136,8 @@ func (k *kemAdapter) Decapsulate( // Reject the all-zero public key (identity point), which yields an all-zero shared secret. allZero := true - for _, b := range ciphertext { - if b != 0 { + for _, byteValue := range ciphertext { + if byteValue != 0 { allZero = false break }