diff --git a/.github/.golangci.yml b/.github/.golangci.yml index 931b9ed..5a448b8 100644 --- a/.github/.golangci.yml +++ b/.github/.golangci.yml @@ -5,78 +5,94 @@ linters: - asciicheck - bidichk - bodyclose + - canonicalheader - containedctx - contextcheck + - copyloopvar - cyclop - decorder #- depguard - dogsled - dupl - durationcheck + - err113 - errcheck - errchkjson - errname - errorlint - - execinquery - exhaustive - exhaustruct - exportloopref + - fatcontext - forbidigo - forcetypeassert - funlen - #- gci + - gci + - ginkgolinter + - gocheckcompilerdirectives #- gochecknoglobals - gochecknoinits + - gochecksumtype - gocognit - goconst - gocritic - gocyclo - godot - godox - - goerr113 - gofmt - gofumpt - goheader - goimports - #- gomnd - gomoddirectives - gomodguard - goprintffuncname - gosec - gosimple + - gosmopolitan - govet - grouper - importas + - inamedparam - ineffassign - interfacebloat + - intrange - ireturn - lll - - logrlint + - loggercheck - maintidx - makezero + - mirror - misspell + #- mnd + - musttag - nakedret - nestif - nilerr - nilnil - #- nlreturn + - nlreturn - noctx - nolintlint #- nonamedreturns - nosprintfhostport - paralleltest + - perfsprint - prealloc - predeclared - promlinter + - protogetter - reassign - revive - rowserrcheck + - sloglint + - spancheck - sqlclosecheck - staticcheck - stylecheck + - tagalign - tagliatelle - tenv - testableexamples + - testifylint - testpackage - thelper - tparallel @@ -90,20 +106,31 @@ linters: - whitespace - wrapcheck - wsl - presets: - - bugs - - unused - fast: false + - zerologlint linters-settings: dupl: threshold: 100 - errcheck: - check-type-assertions: true - check-blank: true + #errcheck: + # check-type-assertions: true + # check-blank: true + # exclude-functions: + # - io.ReadFull + exhaustive: + ignore-enum-types: "hash.Hash" funlen: lines: 100 statements: 50 + gci: + sections: + - standard # Standard section: captures all standard packages. + - default # Default section: contains all imports that could not be matched to another section type. + - prefix(github.com/bytemare/hash2curve) # Custom section: groups all imports with the specified Prefix. + skip-generated: true + # Enable custom order of sections. + # If `true`, make the section order the same as the order of `sections`. + # Default: false + custom-order: true gocognit: min-complexity: 15 goconst: @@ -129,32 +156,48 @@ linters-settings: simplify: true goimports: local-prefixes: github.com/bytemare/hash2curve - gomnd: - settings: - mnd: - checks: - - argument - - case - - condition - - operation - - return - - assign + gosimple: + checks: [ "all" ] govet: - check-shadowing: true - - # settings per analyzer - settings: - printf: # analyzer name, run `go tool vet help` to see all analyzers - funcs: # run `go tool vet help printf` to see available settings for `printf` analyzer - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Infof - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Warnf - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Errorf - - (github.com/golangci/golangci-lint/pkg/logutils.Log).Fatalf - - # enable or disable analyzers by name + shadow: true + disable-all: true enable: + - asmdecl + - assign + - atomic - atomicalign - disable-all: false + - bools + - buildtag + - cgocall + - composites + - copylocks + - deepequalerrors + - errorsas + - fieldalignment + - findcall + - framepointer + - httpresponse + - ifaceassert + - loopclosure + - lostcancel + - nilfunc + - nilness + - printf + - reflectvaluecompare + - shadow + - shift + - sigchanyzer + - sortslice + - stdmethods + - stringintconv + - structtag + - testinggoroutine + - tests + - unmarshal + - unreachable + - unsafeptr + - unusedresult + - unusedwrite lll: line-length: 120 # tab width ('\t') in spaces. Default to 1. @@ -163,6 +206,18 @@ linters-settings: suggest-new: true misspell: locale: US + mnd: + checks: + - argument + - condition + - return + - assign + #ignored-functions: + # - 'nist.setMapping' + # - 'big.NewInt' + # - 'hash2curve.HashToFieldXMD' + nlreturn: + block-size: 2 prealloc: simple: false for-loops: true @@ -185,13 +240,13 @@ linters-settings: issues: # List of regexps of issue texts to exclude, empty list by default. - # But independently from this option we use default exclude patterns, + # But independently of this option we use default exclude patterns, # it can be disabled by `exclude-use-default: false`. To list all # excluded by default patterns execute `golangci-lint run --help` exclude: - "should have a package comment, unless it's in another file for this package" - #exclude-rules: + #exclude-rules: #- path: internal/hash.go # linters: # - errcheck @@ -202,7 +257,7 @@ issues: max-issues-per-linter: 0 max-same-issues: 0 - # Independently from option `exclude` we use default exclude patterns, + # Independently of option `exclude` we use default exclude patterns, # it can be disabled by this option. To list all # excluded by default patterns execute `golangci-lint run --help`. # Default value for this option is true. @@ -211,5 +266,5 @@ issues: run: tests: false -#output: -# format: github-actions \ No newline at end of file +output: + formats: github-actions \ No newline at end of file diff --git a/.github/sonar-project.properties b/.github/sonar-project.properties new file mode 100644 index 0000000..2d8466f --- /dev/null +++ b/.github/sonar-project.properties @@ -0,0 +1,8 @@ +sonar.organization=bytemare +sonar.projectKey=bytemare_hash2curve +sonar.sources=. +sonar.tests=tests/ +sonar.test.exclusions=examples_test.go,tests/** +sonar.verbose=true +sonar.coverage.exclusions=examples_test.go,tests/** +sonar.go.coverage.reportPaths=.github/coverage.out \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index c8c8da7..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,130 +0,0 @@ -name: h2c -on: - pull_request: - branches: - - main - -permissions: - contents: read - -jobs: - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - uses: step-security/harden-runner@9ff9d14760a73102d9fa2f47131624137f50ead8 - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - objects.githubusercontent.com:443 - proxy.golang.org:443 - raw.githubusercontent.com:443 - - - name: Checkout repo - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b - with: - fetch-depth: 0 - - name: Setup Go - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 - with: - go-version-file: ./go.mod - - # Linting - - name: Linting - uses: golangci/golangci-lint-action@9d1e0624a798bb64f6c3cea93db47765312263dc - with: - version: latest - args: --config=./.github/.golangci.yml ./... - only-new-issues: true - - test: - name: Test - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - go: [ '1.22', '1.21' ] - steps: - - uses: step-security/harden-runner@9ff9d14760a73102d9fa2f47131624137f50ead8 - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - github.com:443 - proxy.golang.org:443 - storage.googleapis.com:443 - sum.golang.org:443 - - - name: Checkout repo - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b - with: - fetch-depth: 0 - - name: Setup Go - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 - with: - go-version: ${{ matrix.go }} - - # Test - - name: Run Tests - run: cd .github && make test - - analyze: - name: Analyze - runs-on: ubuntu-latest - steps: - - uses: step-security/harden-runner@9ff9d14760a73102d9fa2f47131624137f50ead8 - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.codecov.io:443 - api.github.com:443 - cli.codecov.io:443 - ea6ne4j2sb.execute-api.eu-central-1.amazonaws.com:443 - github.com:443 - objects.githubusercontent.com:443 - proxy.golang.org:443 - scanner.sonarcloud.io:443 - sonarcloud.io:443 - storage.googleapis.com:443 - - - name: Checkout repo - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b - with: - fetch-depth: 0 - - name: Setup Go - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 - with: - go-version-file: ./go.mod - - # Coverage - - name: Run coverage - run: cd .github && make cover - - # Codecov - - name: Codecov - uses: codecov/codecov-action@dad251dcaf4fdaa10dfaa1c32aab58f9cb23a448 - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} - with: - file: .github/coverage.out - - # Sonar - - name: SonarCloud Scan - uses: SonarSource/sonarcloud-github-action@6bbd64e0cb2194e04addb429d669a9ee873eeeef - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} - with: - args: > - -Dsonar.organization=bytemare-github - -Dsonar.projectKey=bytemare_hash2curve - -Dsonar.go.coverage.reportPaths=.github/coverage.out - -Dsonar.sources=. - -Dsonar.test.exclusions=tests/** - -Dsonar.coverage.exclusions=tests/** - -Dsonar.tests=tests/ - -Dsonar.verbose=true diff --git a/.github/workflows/code-scan.yml b/.github/workflows/code-scan.yml new file mode 100644 index 0000000..ce2d08d --- /dev/null +++ b/.github/workflows/code-scan.yml @@ -0,0 +1,35 @@ +name: Code Scan + +on: + push: + branches: + - main + pull_request: + branches: + - main + schedule: + # random HH:MM to avoid a load spike on GitHub Actions at 00:00 + - cron: '4 1 * * *' + +permissions: {} + +jobs: + Lint: + permissions: + contents: read + uses: bytemare/workflows/.github/workflows/golangci-lint.yml@b1646a1525a16e413436f5b74e308685a2f7d7d3 + with: + config-path: ./.github/.golangci.yml + scope: ./... + + Analyze: + permissions: + contents: read + uses: bytemare/workflows/.github/workflows/scan-go.yml@b1646a1525a16e413436f5b74e308685a2f7d7d3 + with: + sonar-configuration: .github/sonar-project.properties + secrets: + github: ${{ secrets.GITHUB_TOKEN }} + sonar: ${{ secrets.SONAR_TOKEN }} + codecov: ${{ secrets.CODECOV_TOKEN }} + semgrep: ${{ secrets.SEMGREP_APP_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 4340496..ecad8b7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -10,46 +10,14 @@ on: schedule: - cron: '31 10 * * 0' -permissions: - contents: read +permissions: {} jobs: - codeql: - name: CodeQL - runs-on: ubuntu-latest + CodeQL: permissions: actions: read contents: read security-events: write - - strategy: - fail-fast: false - - steps: - - uses: step-security/harden-runner@9ff9d14760a73102d9fa2f47131624137f50ead8 - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.github.com:443 - github.com:443 - objects.githubusercontent.com:443 - proxy.golang.org:443 - storage.googleapis.com:443 - sum.golang.org:443 - uploads.github.com:443 - - - name: Checkout repository - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b - - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@8fcfedf57053e09257688fce7a0beeb18b1b9ae3 - with: - languages: go - - - name: Autobuild - uses: github/codeql-action/autobuild@8fcfedf57053e09257688fce7a0beeb18b1b9ae3 - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8fcfedf57053e09257688fce7a0beeb18b1b9ae3 + uses: bytemare/workflows/.github/workflows/codeql.yml@b1646a1525a16e413436f5b74e308685a2f7d7d3 + with: + language: go diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index e2a8a16..13c8a34 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -1,73 +1,39 @@ -name: Scorecard analysis workflow +name: Scorecard Analysis Workflow + on: push: - # Only the default branch is supported. + branches: + - main + pull_request: branches: - main schedule: # Weekly on Saturdays. - cron: '30 1 * * 6' - pull_request: - # All branches are supported. - branches: [ main ] -permissions: read-all +permissions: {} jobs: analysis: - name: Scorecard analysis - runs-on: ubuntu-latest permissions: - # Needed for Code scanning upload + # Needed if using Code scanning alerts security-events: write # Needed for GitHub OIDC token if publish_results is true id-token: write + # Needed for nested workflow + actions: read + attestations: read + checks: read + contents: read + deployments: read + issues: read + discussions: read + packages: read + pages: read + pull-requests: read + repository-projects: read + statuses: read - steps: - - uses: step-security/harden-runner@9ff9d14760a73102d9fa2f47131624137f50ead8 - with: - disable-sudo: true - egress-policy: block - allowed-endpoints: > - api.github.com:443 - api.osv.dev:443 - api.securityscorecards.dev:443 - fulcio.sigstore.dev:443 - github.com:443 - oss-fuzz-build-logs.storage.googleapis.com:443 - rekor.sigstore.dev:443 - tuf-repo-cdn.sigstore.dev:443 - www.bestpractices.dev:443 - - - name: "Checkout code" - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b - with: - persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@fad9a3cc533bb069b1f01f272f1f630895cd690a - with: - results_file: results.sarif - results_format: sarif - # Read-only PAT token. To create it, - # follow the steps in https://github.com/ossf/scorecard-action#pat-token-creation. - # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} - # Publish the results to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, - # regardless of the value entered here. - publish_results: true - - # Upload the results as artifacts (optional). - - name: "Upload artifact" - uses: actions/upload-artifact@552bf3722c16e81001aea7db72d8cedf64eb5f68 - with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard. - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@8fcfedf57053e09257688fce7a0beeb18b1b9ae3 - with: - sarif_file: results.sarif + uses: bytemare/workflows/.github/workflows/scorecard.yml@b1646a1525a16e413436f5b74e308685a2f7d7d3 + secrets: + token: ${{ secrets.SCORECARD_TOKEN }} \ No newline at end of file diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml new file mode 100644 index 0000000..15cfc8f --- /dev/null +++ b/.github/workflows/tests.yml @@ -0,0 +1,22 @@ +name: Run Tests + +on: + push: + branches: + - main + pull_request: + branches: + - main + +permissions: {} + +jobs: + Test: + strategy: + fail-fast: false + matrix: + go: [ '1.22', '1.21' ] + uses: bytemare/workflows/.github/workflows/test-go.yml@b1646a1525a16e413436f5b74e308685a2f7d7d3 + with: + command: cd .github && make test + version: ${{ matrix.go }} diff --git a/go.mod b/go.mod index 3bada63..6a29a52 100644 --- a/go.mod +++ b/go.mod @@ -5,6 +5,6 @@ go 1.22.2 require github.com/bytemare/hash v0.3.0 require ( - golang.org/x/crypto v0.22.0 // indirect - golang.org/x/sys v0.19.0 // indirect + golang.org/x/crypto v0.23.0 // indirect + golang.org/x/sys v0.20.0 // indirect ) diff --git a/go.sum b/go.sum index 1dfcd9c..e61b624 100644 --- a/go.sum +++ b/go.sum @@ -1,6 +1,6 @@ github.com/bytemare/hash v0.3.0 h1:RqFMt3mqpF7UxLdjBrsOZm/2cz0cQiAOnYc9gDLopWE= github.com/bytemare/hash v0.3.0/go.mod h1:YKOBchL0l8hRLFinVCL8YUKokGNIMhrWEHPHo3EV7/M= -golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30= -golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M= -golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o= -golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI= +golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= +golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= +golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= diff --git a/h2f.go b/h2f.go index f1b1d3e..4c71029 100644 --- a/h2f.go +++ b/h2f.go @@ -45,8 +45,7 @@ func HashToFieldXMD(id crypto.Hash, input, dst []byte, count, ext, securityLengt func reduceUniform(uniform []byte, count, securityLength uint, modulo *big.Int) []*big.Int { res := make([]*big.Int, count) - var i uint - for i = 0; i < count; i++ { + for i := range count { offset := i * securityLength res[i] = reduce(uniform[offset:offset+securityLength], modulo) }