Fix Darwin builds (#117)

.goreleaser.yml → .goreleaser.darwin.yml

@@ -1,18 +1,17 @@
 builds:
   - binary: blessclient
     env:
-      - CGO_ENABLED=0
+      - CGO_ENABLED=1
     goos:
       - darwin
-      - linux
     goarch:
       - amd64
     ldflags:
       - "-w -s -X github.com/chanzuckerberg/blessclient/pkg/util.GitSha={{.Commit}} -X github.com/chanzuckerberg/blessclient/pkg/util.Version={{.Version}} -X github.com/chanzuckerberg/blessclient/pkg/util.Dirty=false -X github.com/chanzuckerberg/blessclient/pkg/util.Release=true"
 
 archive:
   files:
-  - none*
+    - none*
 
 release:
   github:

.goreleaser.prerelease.darwin.yml

@@ -0,0 +1,20 @@
+builds:
+  - binary: blessclient
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - darwin
+    goarch:
+      - amd64
+    ldflags:
+      - "-w -s -X github.com/chanzuckerberg/blessclient/pkg/util.GitSha={{.Commit}} -X github.com/chanzuckerberg/blessclient/pkg/util.Version={{.Version}} -X github.com/chanzuckerberg/blessclient/pkg/util.Dirty=false -X github.com/chanzuckerberg/blessclient/pkg/util.Release=true"
+
+archive:
+  files:
+    - none*
+
+release:
+  prerelease: true
+  github:
+    owner: chanzuckerberg
+    name: blessclient

.goreleaser.prerelease.yml

@@ -0,0 +1,20 @@
+builds:
+  - binary: blessclient
+    env:
+      - CGO_ENABLED=1
+    goos:
+      - linux
+    goarch:
+      - amd64
+    ldflags:
+      - "-w -s -X github.com/chanzuckerberg/blessclient/pkg/util.GitSha={{.Commit}} -X github.com/chanzuckerberg/blessclient/pkg/util.Version={{.Version}} -X github.com/chanzuckerberg/blessclient/pkg/util.Dirty=false -X github.com/chanzuckerberg/blessclient/pkg/util.Release=true"
+
+archive:
+  files:
+    - none*
+
+release:
+  prerelease: true
+  github:
+    owner: chanzuckerberg
+    name: blessclient

.travis.yml

@@ -1,19 +1,61 @@
 language: go
-go:
-- '1.11'
-install:
-  - npm install -g snyk
-  - make setup
-jobs:
+go_import_path: github.com/chanzuckerberg/blessclient
+sudo: false
+env:
+  - CGO_ENABLED=1
+stages:
+  - test
+  - publish-osx
+  - publish-linux
+matrix:
   include:
-    - stage: check
+    - os: linux
+      stage: test
+      go: 1.12.x
       script:
         - make test
         - bash <(curl -s https://codecov.io/bash)
-    - stage: check
+    - os: osx
+      stage: test
+      go: 1.12.x
       script:
+        - make test
+    - os: linux
+      stage: test
+      go: 1.12.x
+      script:
+        - npm install -g snyk
         - bash _bin/snyk.sh
-    - stage: check
+    - os: linux
+      stage: test
+      sudo: true
+      go: 1.12.x
       script:
+        - sudo make setup
         - make lint
 
+    # Publish
+    - os: osx
+      if: tag =~ /^v\d+\.\d+\.\d+$/ # only for releases vX.Y.Z
+      stage: publish-osx
+      go: 1.12.x
+      secure: "KV2+lOfog0Qk2FUhwvg40J/cZFtzr/v3cM4Wdrf2FwOSTNdjc0/v2iuhCtD1GnIqUvbkCVziSrtF4qhDvWwKyZ4wzdZcTMV7dJeAFGIZJxQzyKpcnHEJBpFISPR1yFNJ2aD1Qt8pA221SUfHqAz/SEv1TcYA6kEjadycZqG7fQbQaXdqoJTevRqGAZUKJReRyxSBCbuP25BWbn9eo60vCYZY9S1Qnzy+pkppeZwaBpLGNmFZoOrYsXn+YY+MN50LJmmeV76u3kYJTnH7JcO1UfcWzN7EZABdMaWiptFbmwKHiywnBcQ+/oK9mgWvkcXgZKcodErBu5BPTtLcYT0AmveFgLE+U3MqKuphyXYUaVIpKpVNchzOdacHLyFFdvZ7DamX8pEVHvpu+jvaiBX4YX1xDtm12n+fX0wKF+ENgseqIxDDzDZ6w5KxOqVUU3xgitSIiQ9Y5w04aSH6MRtWXAuCcUfsg/ZZ3497PXSt4SVdQWGAAvdi+fAjQ84+fA+pFlKF+xcT1fgleh32ss6JLhes2Cxp7SCTSbRKAnSidhWBMFXgYX6mrY5aOyA00wdlEevNrLfXXiSLtEXGkwbJmC5v1FsOcZnsxfaUeTNSTkeuRWSBlAOkxETGkR9QQmUOhHtQChOLpIVYh3JQezc8kWznPF++VIeIa62VKMSf/RY="
+      script:
+        - make publish-darwin
+    - os: osx
+      if: tag =~ /\+.+/ # only do prerelease for prereleases vX.Y.Z+AAAAA
+      stage: publish-prerelease-osx
+      go: 1.12.x
+      secure: "KV2+lOfog0Qk2FUhwvg40J/cZFtzr/v3cM4Wdrf2FwOSTNdjc0/v2iuhCtD1GnIqUvbkCVziSrtF4qhDvWwKyZ4wzdZcTMV7dJeAFGIZJxQzyKpcnHEJBpFISPR1yFNJ2aD1Qt8pA221SUfHqAz/SEv1TcYA6kEjadycZqG7fQbQaXdqoJTevRqGAZUKJReRyxSBCbuP25BWbn9eo60vCYZY9S1Qnzy+pkppeZwaBpLGNmFZoOrYsXn+YY+MN50LJmmeV76u3kYJTnH7JcO1UfcWzN7EZABdMaWiptFbmwKHiywnBcQ+/oK9mgWvkcXgZKcodErBu5BPTtLcYT0AmveFgLE+U3MqKuphyXYUaVIpKpVNchzOdacHLyFFdvZ7DamX8pEVHvpu+jvaiBX4YX1xDtm12n+fX0wKF+ENgseqIxDDzDZ6w5KxOqVUU3xgitSIiQ9Y5w04aSH6MRtWXAuCcUfsg/ZZ3497PXSt4SVdQWGAAvdi+fAjQ84+fA+pFlKF+xcT1fgleh32ss6JLhes2Cxp7SCTSbRKAnSidhWBMFXgYX6mrY5aOyA00wdlEevNrLfXXiSLtEXGkwbJmC5v1FsOcZnsxfaUeTNSTkeuRWSBlAOkxETGkR9QQmUOhHtQChOLpIVYh3JQezc8kWznPF++VIeIa62VKMSf/RY="
+      script:
+        - make publish-prerelease-darwin
+    - os: linux
+      if: tag =~ /^v/ # we do linux for both prereleases and releases
+      stage: publish-linux
+      sudo: true
+      go: 1.12.x
+      secure: "KV2+lOfog0Qk2FUhwvg40J/cZFtzr/v3cM4Wdrf2FwOSTNdjc0/v2iuhCtD1GnIqUvbkCVziSrtF4qhDvWwKyZ4wzdZcTMV7dJeAFGIZJxQzyKpcnHEJBpFISPR1yFNJ2aD1Qt8pA221SUfHqAz/SEv1TcYA6kEjadycZqG7fQbQaXdqoJTevRqGAZUKJReRyxSBCbuP25BWbn9eo60vCYZY9S1Qnzy+pkppeZwaBpLGNmFZoOrYsXn+YY+MN50LJmmeV76u3kYJTnH7JcO1UfcWzN7EZABdMaWiptFbmwKHiywnBcQ+/oK9mgWvkcXgZKcodErBu5BPTtLcYT0AmveFgLE+U3MqKuphyXYUaVIpKpVNchzOdacHLyFFdvZ7DamX8pEVHvpu+jvaiBX4YX1xDtm12n+fX0wKF+ENgseqIxDDzDZ6w5KxOqVUU3xgitSIiQ9Y5w04aSH6MRtWXAuCcUfsg/ZZ3497PXSt4SVdQWGAAvdi+fAjQ84+fA+pFlKF+xcT1fgleh32ss6JLhes2Cxp7SCTSbRKAnSidhWBMFXgYX6mrY5aOyA00wdlEevNrLfXXiSLtEXGkwbJmC5v1FsOcZnsxfaUeTNSTkeuRWSBlAOkxETGkR9QQmUOhHtQChOLpIVYh3JQezc8kWznPF++VIeIa62VKMSf/RY="
+      script:
+        - sudo apt update -q
+        - sudo apt install -yq libusb-dev libusb-1.0.0-dev
+        - make publish-linux

Makefile

@@ -4,21 +4,51 @@ DIRTY=$(shell if `git diff-index --quiet HEAD --`; then echo false; else echo tr
 LDFLAGS=-ldflags "-w -s -X github.com/chanzuckerberg/blessclient/pkg/util.GitSha=${SHA} -X github.com/chanzuckerberg/blessclient/pkg/util.Version=${VERSION} -X github.com/chanzuckerberg/blessclient/pkg/util.Dirty=${DIRTY}"
 
 setup:
-	curl -L https://git.io/vp6lP | BINDIR=~/.local/bin sh # gometalinter
+	curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.16.0 # golangci-lint
 	curl -L https://raw.githubusercontent.com/chanzuckerberg/bff/master/download.sh | BINDIR=./_bin sh
 
 test:
 	go test -coverprofile=coverage.txt -covermode=atomic ./...
 
-release:
+release: test ## Create a new tag and let travis_ci do the rest
 	bff bump
 	git push
-	goreleaser release --rm-dist
+
+build: ## build the binary
+	go build ${LDFLAGS} .
+.PHONY: build
+
+release-prerelease: test build ## release to github as a 'pre-release'
+	version=`./blessclient version`; \
+	git tag v"$$version"; \
+	git push
+	git push --tags
+.PHONY: release-prerelease
+
+publish-darwin:
+	goreleaser release -f .goreleaser.darwin.yml --debug
+
+publish-prerelease-darwin:
+	goreleaser release -f .goreleaser.prerelease.darwin.yml --debug
+
+publish-linux: build ## Update the github release with a linux build. Must be run after release-darwin
+	tar -zcvf blessclient.tar.gz blessclient
+	github-release upload \
+	--security_token ${GITHUB_TOKEN} \
+	--user czibuildbot \
+	--repo blessclient \
+	--tag ${TRAVIS_TAG} \
+	--name blessclient_${TRAVIS_TAG}_linux_amd64 \
+	--file blessclient.tar.gz
+
 
 install:
 	go install  ${LDFLAGS} .
 
 lint: ## run the fast go linters
-	gometalinter --vendor --fast --deadline=5m --disable=ineffassign ./...
+	golangci-lint run --no-config \
+		--disable-all --enable=deadcode  --enable=gocyclo --enable=golint --enable=varcheck \
+		--enable=structcheck --enable=errcheck --enable=dupl --enable=unparam --enable=goimports \
+		--enable=interfacer --enable=unconvert --enable=gosec --enable=megacheck
 
 .PHONY: test release install lint

cmd/run.go

@@ -139,7 +139,7 @@ func processRegion(ctx context.Context, conf *config.Config, sess *session.Sessi
 
 // getAWSClient configures an aws client
 func getAWSClient(ctx context.Context, conf *config.Config, sess *session.Session, region config.Region) *cziAWS.Client {
-	ctx, span := trace.StartSpan(ctx, "get_aws_client")
+	_, span := trace.StartSpan(ctx, "get_aws_client")
 	defer span.End()
 	// for things meant to be run as a user
 	userConf := &aws.Config{

pkg/bless/client.go

@@ -126,15 +126,15 @@ func (c *Client) RequestCert(ctx context.Context) error {
 	if err != nil {
 		return errors.Wrap(err, "Error writing cert to disk")
 	}
-	err = c.updateSSHAgent(ctx)
+	err = c.updateSSHAgent()
 	if err != nil {
 		// Not a fatal error so just printing a warning
 		log.WithError(err).Warn("Error adding certificate to ssh-agent, is your ssh-agent running?")
 	}
 	return nil
 }
 
-func (c *Client) updateSSHAgent(ctx context.Context) error {
+func (c *Client) updateSSHAgent() error {
 	if !c.conf.ClientConfig.UpdateSSHAgent {
 		log.Debug("Skipping adding to ssh-agent")
 		return nil
@@ -164,7 +164,7 @@ func (c *Client) updateSSHAgent(ctx context.Context) error {
 	}
 
 	// calculate how many seconds before cert expiry
-	certLifetimeSecs := uint32(time.Unix(int64(cert.ValidBefore), 0).Sub(time.Now()) / time.Second)
+	certLifetimeSecs := uint32(time.Until(time.Unix(int64(cert.ValidBefore), 0)) / time.Second)
 	log.Debugf("SSH_AUTH_SOCK: adding key to agent with %ds ttl", certLifetimeSecs)
 
 	a := agent.NewClient(agentSock)

pkg/config/config.go

@@ -29,8 +29,6 @@ const (
 	defaultCacheDir = "cache"
 	// defaultKMSAuthCache is the default kmsauth cache
 	defaultKMSAuthCache = "kmsauth"
-	// defaultAWSSessionCache is the default aws session cache
-	defaultAWSSessionCache = "session"
 	// DefaultSSHPrivateKey is a path to where users usually keep an ssh key
 	DefaultSSHPrivateKey = "~/.ssh/id_ed25519"
 )

pkg/ssh/ssh.go

@@ -166,7 +166,7 @@ func GetSSHVersion() (string, error) {
 // compatible with the ssh client version
 // Particularly: https://github.com/chanzuckerberg/blessclient#ssh-client-78-cant-connect-with-certificates
 func (s *SSH) CheckKeyTypeAndClientVersion(ctx context.Context) {
-	ctx, span := trace.StartSpan(ctx, "check_ssh_client")
+	_, span := trace.StartSpan(ctx, "check_ssh_client")
 	defer span.End()
 	// We check the ssh client version and ssh key type
 	key, err := s.ReadAndParsePrivateKey()

pkg/util/pid_lock_test.go

@@ -64,12 +64,14 @@ func TestLock(t *testing.T) {
 
 	l, err := util.NewLock(lockDir)
 	a.Nil(err)
+	// nolint: gosimple
 	var b backoff.BackOff
 	b = backoff.NewConstantBackOff(time.Millisecond)
 	// Only one retry so we don't wait too long
 	b = backoff.WithMaxRetries(b, uint64(1))
 
 	err = l.Lock(b)
+	// nolint: errcheck
 	defer l.Unlock()
 	if os.Getenv("SHOULD_FAIL_LOCK") == "YES" {
 		// This lock should fail since the other process owns it