Merge branch 'master' into secrets

itoffshore · web-flow · commit aea0dc3663e4 · 2025-05-25T13:59:34.000+01:00
diff --git a/acme/api/eab.go b/acme/api/eab.go
@@ -129,7 +129,7 @@ func validateEABJWS(ctx context.Context, jws *jose.JSONWebSignature) (string, *a
 	keyID := header.KeyID
 	nonce := header.Nonce
 
-	if !(algorithm == jose.HS256 || algorithm == jose.HS384 || algorithm == jose.HS512) {
+	if algorithm != jose.HS256 && algorithm != jose.HS384 && algorithm != jose.HS512 {
 		return "", acme.NewError(acme.ErrorMalformedType, "'alg' field set to invalid algorithm '%s'", algorithm)
 	}
 
diff --git a/api/sshRenew.go b/api/sshRenew.go
@@ -21,8 +21,8 @@ type SSHRenewRequest struct {
 
 // Validate validates the SSHSignRequest.
 func (s *SSHRenewRequest) Validate() error {
-	switch {
-	case s.OTT == "":
+	switch s.OTT {
+	case "":
 		return errs.BadRequest("missing or empty ott")
 	default:
 		return nil
diff --git a/authority/provisioner/acme.go b/authority/provisioner/acme.go
@@ -17,7 +17,7 @@ import (
 // ACMEChallenge represents the supported acme challenges.
 type ACMEChallenge string
 
-//nolint:stylecheck,revive // better names
+//nolint:staticcheck,revive // better names
 const (
 	// HTTP_01 is the http-01 ACME challenge.
 	HTTP_01 ACMEChallenge = "http-01"
diff --git a/authority/provisioner/utils_test.go b/authority/provisioner/utils_test.go
@@ -1042,10 +1042,12 @@ func generateAzureToken(sub, iss, aud, tenantID, subscriptionID, resourceGroup,
 	if err != nil {
 		return "", err
 	}
+
 	var xmsMirID string
-	if resourceType == "vm" {
+	switch resourceType {
+	case "vm":
 		xmsMirID = fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Compute/virtualMachines/%s", subscriptionID, resourceGroup, resourceName)
-	} else if resourceType == "uai" {
+	case "uai":
 		xmsMirID = fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.ManagedIdentity/userAssignedIdentities/%s", subscriptionID, resourceGroup, resourceName)
 	}
 
diff --git a/authority/tls.go b/authority/tls.go
@@ -610,7 +610,7 @@ func (a *Authority) Revoke(ctx context.Context, revokeOpts *RevokeOptions) error
 	}
 
 	// If not mTLS nor ACME, then get the TokenID of the token.
-	if !(revokeOpts.MTLS || revokeOpts.ACME) {
+	if !revokeOpts.MTLS && !revokeOpts.ACME {
 		token, err := jose.ParseSigned(revokeOpts.OTT)
 		if err != nil {
 			return errs.Wrap(http.StatusUnauthorized, err, "authority.Revoke; error parsing token", opts...)
diff --git a/ca/acmeClient_test.go b/ca/acmeClient_test.go
@@ -112,11 +112,11 @@ func TestNewACMEClient(t *testing.T) {
 			i := 0
 			srv.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				assert.Equals(t, "step-http-client/1.0", r.Header.Get("User-Agent")) // check default User-Agent header
-				switch {
-				case i == 0:
+				switch i {
+				case 0:
 					render.JSONStatus(w, r, tc.r1, tc.rc1)
 					i++
-				case i == 1:
+				case 1:
 					w.Header().Set("Replay-Nonce", "abc123")
 					render.JSONStatus(w, r, []byte{}, 200)
 					i++
diff --git a/cas/stepcas/issuer.go b/cas/stepcas/issuer.go
@@ -91,8 +91,8 @@ func validateX5CIssuer(iss *apiv1.CertificateIssuer) error {
 // not given, then it will download it from the CA. If the password is not set
 // it will be prompted.
 func validateJWKIssuer(iss *apiv1.CertificateIssuer) error {
-	switch {
-	case iss.Provisioner == "":
+	switch iss.Provisioner {
+	case "":
 		return errors.New("stepCAS `certificateIssuer.provisioner` cannot be empty")
 	default:
 		return nil
diff --git a/cas/stepcas/stepcas_test.go b/cas/stepcas/stepcas_test.go
@@ -130,13 +130,13 @@ func testCAHelper(t *testing.T) (*url.URL, *ca.Client) {
 		_ = json.NewDecoder(r.Body).Decode(v)
 	}
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.RequestURI == "/root/"+testRootFingerprint:
+		switch r.RequestURI {
+		case "/root/" + testRootFingerprint:
 			w.WriteHeader(http.StatusOK)
 			writeJSON(w, api.RootResponse{
 				RootPEM: api.NewCertificate(testRootCrt),
 			})
-		case r.RequestURI == "/sign":
+		case "/sign":
 			var msg api.SignRequest
 			parseJSON(r, &msg)
 			if msg.CsrPEM.DNSNames[0] == "fail.doe.org" {
@@ -148,7 +148,7 @@ func testCAHelper(t *testing.T) (*url.URL, *ca.Client) {
 			writeJSON(w, api.SignResponse{
 				CertChainPEM: []api.Certificate{api.NewCertificate(testCrt), api.NewCertificate(testIssCrt)},
 			})
-		case r.RequestURI == "/renew":
+		case "/renew":
 			if r.Header.Get("Authorization") == "Bearer fail" {
 				w.WriteHeader(http.StatusBadRequest)
 				fmt.Fprintf(w, `{"error":"fail","message":"fail"}`)
@@ -158,7 +158,7 @@ func testCAHelper(t *testing.T) (*url.URL, *ca.Client) {
 			writeJSON(w, api.SignResponse{
 				CertChainPEM: []api.Certificate{api.NewCertificate(testCrt), api.NewCertificate(testIssCrt)},
 			})
-		case r.RequestURI == "/revoke":
+		case "/revoke":
 			var msg api.RevokeRequest
 			parseJSON(r, &msg)
 			if msg.Serial == "fail" {
@@ -170,7 +170,7 @@ func testCAHelper(t *testing.T) (*url.URL, *ca.Client) {
 			writeJSON(w, api.RevokeResponse{
 				Status: "ok",
 			})
-		case r.RequestURI == "/provisioners":
+		case "/provisioners":
 			w.WriteHeader(http.StatusOK)
 			writeJSON(w, api.ProvisionersResponse{
 				NextCursor: "cursor",
@@ -188,7 +188,7 @@ func testCAHelper(t *testing.T) (*url.URL, *ca.Client) {
 					},
 				},
 			})
-		case r.RequestURI == "/provisioners?cursor=cursor":
+		case "/provisioners?cursor=cursor":
 			w.WriteHeader(http.StatusOK)
 			writeJSON(w, api.ProvisionersResponse{})
 		default:
diff --git a/cas/vaultcas/auth/approle/approle_test.go b/cas/vaultcas/auth/approle/approle_test.go
@@ -16,15 +16,15 @@ func testCAHelper(t *testing.T) (*url.URL, *vault.Client) {
 	t.Helper()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.RequestURI == "/v1/auth/approle/login":
+		switch r.RequestURI {
+		case "/v1/auth/approle/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
 					"client_token": "hvs.0000"
 				  }
 				}`)
-		case r.RequestURI == "/v1/auth/custom-approle/login":
+		case "/v1/auth/custom-approle/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
diff --git a/cas/vaultcas/auth/aws/aws_test.go b/cas/vaultcas/auth/aws/aws_test.go
@@ -16,15 +16,15 @@ func testCAHelper(t *testing.T) (*url.URL, *vault.Client) {
 	t.Helper()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.RequestURI == "/v1/auth/aws/login":
+		switch r.RequestURI {
+		case "/v1/auth/aws/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
 					"client_token": "hvs.0000"
 				  }
 				}`)
-		case r.RequestURI == "/v1/auth/custom-aws/login":
+		case "/v1/auth/custom-aws/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
diff --git a/cas/vaultcas/auth/kubernetes/kubernetes_test.go b/cas/vaultcas/auth/kubernetes/kubernetes_test.go
@@ -19,15 +19,15 @@ func testCAHelper(t *testing.T) (*url.URL, *vault.Client) {
 	t.Helper()
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.RequestURI == "/v1/auth/kubernetes/login":
+		switch r.RequestURI {
+		case "/v1/auth/kubernetes/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
 					"client_token": "hvs.0000"
 				  }
 				}`)
-		case r.RequestURI == "/v1/auth/custom-kubernetes/login":
+		case "/v1/auth/custom-kubernetes/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
diff --git a/cas/vaultcas/vaultcas.go b/cas/vaultcas/vaultcas.go
@@ -212,12 +212,12 @@ func (v *VaultCAS) RevokeCertificate(req *apiv1.RevokeCertificateRequest) (*apiv
 func (v *VaultCAS) createCertificate(cr *x509.CertificateRequest, lifetime time.Duration) (*x509.Certificate, []*x509.Certificate, error) {
 	var vaultPKIRole string
 
-	switch {
-	case cr.PublicKeyAlgorithm == x509.RSA:
+	switch cr.PublicKeyAlgorithm {
+	case x509.RSA:
 		vaultPKIRole = v.config.PKIRoleRSA
-	case cr.PublicKeyAlgorithm == x509.ECDSA:
+	case x509.ECDSA:
 		vaultPKIRole = v.config.PKIRoleEC
-	case cr.PublicKeyAlgorithm == x509.Ed25519:
+	case x509.Ed25519:
 		vaultPKIRole = v.config.PKIRoleEd25519
 	default:
 		return nil, nil, fmt.Errorf("unsupported public key algorithm %v", cr.PublicKeyAlgorithm)
diff --git a/cas/vaultcas/vaultcas_test.go b/cas/vaultcas/vaultcas_test.go
@@ -97,48 +97,48 @@ func testCAHelper(t *testing.T) (*url.URL, *vault.Client) {
 	}
 
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch {
-		case r.RequestURI == "/v1/auth/approle/login":
+		switch r.RequestURI {
+		case "/v1/auth/approle/login":
 			w.WriteHeader(http.StatusOK)
 			fmt.Fprintf(w, `{
 				  "auth": {
 					"client_token": "98a4c7ab-b1fe-361b-ba0b-e307aacfd587"
 				  }
 				}`)
-		case r.RequestURI == "/v1/pki/sign/ec":
+		case "/v1/pki/sign/ec":
 			w.WriteHeader(http.StatusOK)
 			cert := map[string]interface{}{"data": map[string]interface{}{"certificate": testCertificateSigned + "\n" + testRootCertificate}}
 			writeJSON(w, cert)
 			return
-		case r.RequestURI == "/v1/pki/sign/rsa":
+		case "/v1/pki/sign/rsa":
 			w.WriteHeader(http.StatusOK)
 			cert := map[string]interface{}{"data": map[string]interface{}{"certificate": testCertificateSigned + "\n" + testRootCertificate}}
 			writeJSON(w, cert)
 			return
-		case r.RequestURI == "/v1/pki/sign/ed25519":
+		case "/v1/pki/sign/ed25519":
 			w.WriteHeader(http.StatusOK)
 			cert := map[string]interface{}{"data": map[string]interface{}{"certificate": testCertificateSigned + "\n" + testRootCertificate}}
 			writeJSON(w, cert)
 			return
-		case r.RequestURI == "/v1/pki/cert/ca_chain":
+		case "/v1/pki/cert/ca_chain":
 			w.WriteHeader(http.StatusOK)
 			cert := map[string]interface{}{"data": map[string]interface{}{"certificate": testCertificateSigned + "\n" + testRootCertificate}}
 			writeJSON(w, cert)
 			return
-		case r.RequestURI == "/v1/pki/revoke":
+		case "/v1/pki/revoke":
 			buf := new(bytes.Buffer)
 			buf.ReadFrom(r.Body)
 			m := make(map[string]string)
 			json.Unmarshal(buf.Bytes(), &m)
-			switch {
-			case m["serial_number"] == "1c-71-6e-18-cc-f4-70-29-5f-75-ee-64-a8-fe-69-ad":
+			switch m["serial_number"] {
+			case "1c-71-6e-18-cc-f4-70-29-5f-75-ee-64-a8-fe-69-ad":
 				w.WriteHeader(http.StatusOK)
 				return
-			case m["serial_number"] == "01-e2-40":
+			case "01-e2-40":
 				w.WriteHeader(http.StatusOK)
 				return
 			// both
-			case m["serial_number"] == "01-34-3e":
+			case "01-34-3e":
 				w.WriteHeader(http.StatusOK)
 				return
 			default:
diff --git a/examples/basic-client/client.go b/examples/basic-client/client.go
@@ -1,3 +1,4 @@
+//nolint:govet // example code; allow unused variables
 package main
 
 import (
@@ -95,10 +96,11 @@ func main() {
 	// An http server will use the tls.Config like:
 	_ = &http.Server{
 		Addr: ":443",
-		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 			w.Write([]byte("Hello world"))
 		}),
-		TLSConfig: tlsConfig,
+		TLSConfig:         tlsConfig,
+		ReadHeaderTimeout: 30 * time.Second,
 	}
 
 	// Get tls.Config for a client
diff --git a/examples/basic-federation/server/main.go b/examples/basic-federation/server/main.go
@@ -31,9 +31,9 @@ func main() {
 				name = r.TLS.PeerCertificates[0].Subject.CommonName
 				issuer = r.TLS.PeerCertificates[len(r.TLS.PeerCertificates)-1].Issuer.CommonName
 			}
-
-			w.Write([]byte(fmt.Sprintf("Hello %s (cert issued by '%s') at %s", name, issuer, time.Now().UTC())))
+			fmt.Fprintf(w, "Hello %s (cert issued by '%s') at %s", name, issuer, time.Now().UTC())
 		}),
+		ReadHeaderTimeout: 30 * time.Second,
 	}, ca.AddFederationToClientCAs(), ListTrustedRoots())
 	if err != nil {
 		panic(err)
diff --git a/examples/bootstrap-mtls-server/server.go b/examples/bootstrap-mtls-server/server.go
@@ -29,8 +29,9 @@ func main() {
 			if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
 				name = r.TLS.PeerCertificates[0].Subject.CommonName
 			}
-			w.Write([]byte(fmt.Sprintf("Hello %s at %s!!!", name, time.Now().UTC())))
+			fmt.Fprintf(w, "Hello %s at %s!!!", name, time.Now().UTC())
 		}),
+		ReadHeaderTimeout: 30 * time.Second,
 	})
 	if err != nil {
 		panic(err)
diff --git a/examples/bootstrap-tls-server/server.go b/examples/bootstrap-tls-server/server.go
@@ -29,8 +29,9 @@ func main() {
 			if r.TLS != nil && len(r.TLS.PeerCertificates) > 0 {
 				name = r.TLS.PeerCertificates[0].Subject.CommonName
 			}
-			w.Write([]byte(fmt.Sprintf("Hello %s at %s!!!", name, time.Now().UTC())))
+			fmt.Fprintf(w, "Hello %s at %s!!!", name, time.Now().UTC())
 		}),
+		ReadHeaderTimeout: 30 * time.Second,
 	}, ca.VerifyClientCertIfGiven())
 	if err != nil {
 		panic(err)
diff --git a/go.mod b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-tpm v0.9.5
 	github.com/google/uuid v1.6.0
-	github.com/googleapis/gax-go/v2 v2.14.1
+	github.com/googleapis/gax-go/v2 v2.14.2
 	github.com/hashicorp/vault/api v1.16.0
 	github.com/hashicorp/vault/api/auth/approle v0.9.0
 	github.com/hashicorp/vault/api/auth/aws v0.9.0
@@ -41,8 +41,8 @@ require (
 	golang.org/x/crypto v0.38.0
 	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
 	golang.org/x/net v0.40.0
-	google.golang.org/api v0.232.0
-	google.golang.org/grpc v1.72.0
+	google.golang.org/api v0.233.0
+	google.golang.org/grpc v1.72.1
 	google.golang.org/protobuf v1.36.6
 )
 
@@ -51,7 +51,7 @@ require (
 	cloud.google.com/go/auth v0.16.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/compute/metadata v0.6.0 // indirect
-	cloud.google.com/go/iam v1.5.0 // indirect
+	cloud.google.com/go/iam v1.5.2 // indirect
 	cloud.google.com/go/kms v1.21.2 // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	filippo.io/edwards25519 v1.1.0 // indirect
@@ -165,9 +165,9 @@ require (
 	golang.org/x/text v0.25.0 // indirect
 	golang.org/x/time v0.11.0 // indirect
 	golang.org/x/tools v0.31.0 // indirect
-	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250414145226-207652e42e2e // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 // indirect
+	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250505200425-f936aa4a68b2 // indirect
 	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
diff --git a/test/integration/scep/internal/x509/oid.go b/test/integration/scep/internal/x509/oid.go

Original file line number	Diff line number	Diff line change
`@@ -129,7 +129,7 @@ func validateEABJWS(ctx context.Context, jws jose.JSONWebSignature) (string, a`
`129`	`129`	`keyID := header.KeyID`
`130`	`130`	`nonce := header.Nonce`
`131`	`131`
`132`		`- if !(algorithm == jose.HS256 \|\| algorithm == jose.HS384 \|\| algorithm == jose.HS512) {`
	`132`	`+ if algorithm != jose.HS256 && algorithm != jose.HS384 && algorithm != jose.HS512 {`
`133`	`133`	`return "", acme.NewError(acme.ErrorMalformedType, "'alg' field set to invalid algorithm '%s'", algorithm)`
`134`	`134`	`}`
`135`	`135`
Original file line number	Diff line number	Diff line change
`@@ -1042,10 +1042,12 @@ func generateAzureToken(sub, iss, aud, tenantID, subscriptionID, resourceGroup,`
`1042`	`1042`	`if err != nil {`
`1043`	`1043`	`return "", err`
`1044`	`1044`	`}`
	`1045`	`+`
`1045`	`1046`	`var xmsMirID string`
`1046`		`- if resourceType == "vm" {`
	`1047`	`+ switch resourceType {`
	`1048`	`+ case "vm":`
`1047`	`1049`	`xmsMirID = fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.Compute/virtualMachines/%s", subscriptionID, resourceGroup, resourceName)`
`1048`		`- } else if resourceType == "uai" {`
	`1050`	`+ case "uai":`
`1049`	`1051`	`xmsMirID = fmt.Sprintf("/subscriptions/%s/resourceGroups/%s/providers/Microsoft.ManagedIdentity/userAssignedIdentities/%s", subscriptionID, resourceGroup, resourceName)`
`1050`	`1052`	`}`
`1051`	`1053`
Original file line number	Diff line number	Diff line change
`@@ -610,7 +610,7 @@ func (a Authority) Revoke(ctx context.Context, revokeOpts RevokeOptions) error`
`610`	`610`	`}`
`611`	`611`
`612`	`612`	`// If not mTLS nor ACME, then get the TokenID of the token.`
`613`		`- if !(revokeOpts.MTLS \|\| revokeOpts.ACME) {`
	`613`	`+ if !revokeOpts.MTLS && !revokeOpts.ACME {`
`614`	`614`	`token, err := jose.ParseSigned(revokeOpts.OTT)`
`615`	`615`	`if err != nil {`
`616`	`616`	`return errs.Wrap(http.StatusUnauthorized, err, "authority.Revoke; error parsing token", opts...)`