all: gofmt for go1.18 (fixes missing build-tags)

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

api/revoke/revoke_test.go

@@ -142,9 +142,9 @@ func TestOCSPGeneration(t *testing.T) {
 		Subject: pkix.Name{
 			Organization: []string{"cfssl unit test"},
 		},
-		AuthorityKeyId: []byte{42, 42, 42, 42},
-		KeyUsage:       x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
-		IsCA:           true,
+		AuthorityKeyId:        []byte{42, 42, 42, 42},
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		IsCA:                  true,
 		BasicConstraintsValid: true,
 	}
 	issuerBytes, err := x509.CreateCertificate(rand.Reader, &issuerTemplate, &issuerTemplate, &privKey.PublicKey, privKey)

bundler/bundle_from_file_test.go

@@ -27,9 +27,11 @@ type fileTest struct {
 	bundleChecking func(*testing.T, *Bundle)
 }
 
-/* ========== BundleFromFile Test Setup =============
+/*
+	========== BundleFromFile Test Setup =============
 
 For each pair of crypto algorithm X and key size Y, a CA chain is constructed:
+
 	Test_root_CA -> inter-L1 -> inter-L2--> cfssl-leaf-ecdsa256
 	                                    |-> cfssl-leaf-ecdsa384
 	                                    |-> cfssl-leaf-ecdsa521
@@ -44,8 +46,10 @@ Two inter-* certs are assembled in intermediates.crt
 
 There is also an expired L1 cert, sharing the same CSR with inter-L1. Also the
 root CA processes the inter-L2 CSR directly to generate inter-L2-direct cert.
-*	Test_root_CA--> inter-L1-expired
+
+	Test_root_CA--> inter-L1-expired
 	            |-> inter-L2-direct
+
 Using inter-L2-direct as additional intermediate cert should shorten the
 bundle chain.
 */

certdb/sql/sql_mysql_test.go

@@ -1,3 +1,4 @@
+//go:build mysql
 // +build mysql
 
 package sql

certdb/sql/sql_pq_test.go

@@ -1,3 +1,4 @@
+//go:build postgresql
 // +build postgresql
 
 package sql

cli/config.go

@@ -69,7 +69,7 @@ type Config struct {
 	AKI               string
 	DBConfigFile      string
 	CRLExpiration     time.Duration
-	Disable     	  string
+	Disable           string
 }
 
 // registerFlags defines all cfssl command flags and associates their values with variables.

cli/crl/crl.go

@@ -1,4 +1,4 @@
-//Package crl implements the crl command
+// Package crl implements the crl command
 package crl
 
 import (

cli/gencrl/gencrl.go

@@ -1,4 +1,4 @@
-//Package gencrl implements the gencrl command
+// Package gencrl implements the gencrl command
 package gencrl
 
 import (

cmd/cfssl/cfssl.go

@@ -4,6 +4,7 @@ also a tool to start a HTTP server to handle web requests for signing, bundling
 and verification.
 
 Usage:
+
 	cfssl command [-flags] arguments
 
 	The commands are

cmd/mkbundle/mkbundle.go

@@ -2,6 +2,7 @@
 // All certificates in the input file paths are checked for revocation and bundled together.
 //
 // Usage:
+//
 //	mkbundle -f bundle_file -nw number_of_workers certificate_file_path ...
 package main
 

crypto/pkcs7/pkcs7.go

@@ -3,17 +3,17 @@
 // to PKCS #7 format from another encoding such as PEM conforms to this implementation.
 // reference: https://www.openssl.org/docs/man1.1.0/apps/crl2pkcs7.html
 //
-//			PKCS #7 Data type, reference: https://tools.ietf.org/html/rfc2315
+// PKCS #7 Data type, reference: https://tools.ietf.org/html/rfc2315
 //
 // The full pkcs#7 cryptographic message syntax allows for cryptographic enhancements,
 // for example data can be encrypted and signed and then packaged through pkcs#7 to be
 // sent over a network and then verified and decrypted.  It is asn1, and the type of
 // PKCS #7 ContentInfo, which comprises the PKCS #7 structure, is:
 //
-//			ContentInfo ::= SEQUENCE {
-//				contentType ContentType,
-//				content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
-//			}
+//	ContentInfo ::= SEQUENCE {
+//		contentType ContentType,
+//		content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL
+//	}
 //
 // There are 6 possible ContentTypes, data, signedData, envelopedData,
 // signedAndEnvelopedData, digestedData, and encryptedData.  Here signedData, Data, and encrypted
@@ -22,15 +22,14 @@
 // formats.
 // The ContentType signedData has the form:
 //
-//
-//			signedData ::= SEQUENCE {
-//				version Version,
-//				digestAlgorithms DigestAlgorithmIdentifiers,
-//				contentInfo ContentInfo,
-//				certificates [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL
-//				crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
-//				signerInfos SignerInfos
-//			}
+//	signedData ::= SEQUENCE {
+//		version Version,
+//		digestAlgorithms DigestAlgorithmIdentifiers,
+//		contentInfo ContentInfo,
+//		certificates [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL
+//		crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
+//		signerInfos SignerInfos
+//	}
 //
 // As of yet signerInfos and digestAlgorithms are not parsed, as they are not relevant to
 // this system's use of PKCS #7 data.  Version is an integer type, note that PKCS #7 is

csr/csr_test.go

@@ -115,7 +115,7 @@ func TestParseRequest(t *testing.T) {
 		Hosts:      []string{"cloudflare.com", "www.cloudflare.com", "192.168.0.1", "jdoe@example.com", "https://www.cloudflare.com"},
 		KeyRequest: NewKeyRequest(),
 		Extensions: []pkix.Extension{
-			pkix.Extension{
+			{
 				Id:    asn1.ObjectIdentifier{1, 2, 3, 4, 5},
 				Value: []byte("AgEB"),
 			},

errors/doc.go

@@ -7,6 +7,7 @@ It formats to a json object that consists of an error message and a 4-digit code
 Example: {"code":1002, "message": "Failed to decode certificate"}
 
 The index of codes are listed below:
+
 	1XXX: CertificateError
 	    1000: Unknown
 	    1001: ReadFailed

ocsp/ocsp.go

@@ -1,9 +1,7 @@
 /*
-
 Package ocsp exposes OCSP signing functionality, much like the signer
 package does for certificate signing.  It also provies a basic OCSP
 responder stack for serving pre-signed OCSP responses.
-
 */
 package ocsp
 

revoke/revoke.go

@@ -57,16 +57,10 @@ func ldapURL(url string) bool {
 // is revoked, the second indicates whether the revocations were
 // successfully checked.. This leads to the following combinations:
 //
-//  false, false: an error was encountered while checking revocations.
-//
-//  false, true:  the certificate was checked successfully and
-//                  it is not revoked.
-//
-//  true, true:   the certificate was checked successfully and
-//                  it is revoked.
-//
-//  true, false:  failure to check revocation status causes
-//                  verification to fail
+// - false, false: an error was encountered while checking revocations.
+// - false, true:  the certificate was checked successfully, and it is not revoked.
+// - true, true:   the certificate was checked successfully, and it is revoked.
+// - true, false:  failure to check revocation status causes verification to fail
 func revCheck(cert *x509.Certificate) (revoked, ok bool, err error) {
 	for _, url := range cert.CRLDistributionPoints {
 		if ldapURL(url) {

revoke/revoke_test.go

@@ -2,7 +2,7 @@ package revoke
 
 import (
 	"crypto/x509"
-	//"crypto/x509/pkix"
+	// "crypto/x509/pkix"
 	"encoding/pem"
 	"fmt"
 	"os"
@@ -48,7 +48,7 @@ sESPRwHkcMUNdAp37FLweUw=
 -----END CERTIFICATE-----`)
 
 // 2014/05/22 14:18:31 Serial number match: intermediate is revoked.
-//	2014/05/22 14:18:31 certificate is revoked via CRL
+// 2014/05/22 14:18:31 certificate is revoked via CRL
 // 2014/05/22 14:18:31 Revoked certificate: misc/intermediate_ca/MobileArmorEnterpriseCA.crt
 var revokedCert = mustParse(`-----BEGIN CERTIFICATE-----
 MIIEEzCCAvugAwIBAgILBAAAAAABGMGjftYwDQYJKoZIhvcNAQEFBQAwcTEoMCYG

scan/crypto/md5/gen.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build ignore
 // +build ignore
 
 // This program generates md5block.go

scan/crypto/md5/md5block_decl.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build amd64 || amd64p32 || 386 || arm
 // +build amd64 amd64p32 386 arm
 
 package md5

scan/crypto/md5/md5block_generic.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !amd64 && !amd64p32 && !386 && !arm
 // +build !amd64,!amd64p32,!386,!arm
 
 package md5

scan/crypto/rsa/pkcs1v15.go

@@ -94,8 +94,8 @@ func DecryptPKCS1v15(rand io.Reader, priv *PrivateKey, ciphertext []byte) (out [
 // session key beforehand and continue the protocol with the resulting value.
 // This will remove any possibility that an attacker can learn any information
 // about the plaintext.
-// See ``Chosen Ciphertext Attacks Against Protocols Based on the RSA
-// Encryption Standard PKCS #1'', Daniel Bleichenbacher, Advances in Cryptology
+// See “Chosen Ciphertext Attacks Against Protocols Based on the RSA
+// Encryption Standard PKCS #1”, Daniel Bleichenbacher, Advances in Cryptology
 // (Crypto '98).
 //
 // Note that if the session key is too small then it may be possible for an
@@ -195,10 +195,12 @@ func nonZeroRandomBytes(s []byte, rand io.Reader) (err error) {
 }
 
 // These are ASN1 DER structures:
-//   DigestInfo ::= SEQUENCE {
-//     digestAlgorithm AlgorithmIdentifier,
-//     digest OCTET STRING
-//   }
+//
+//	DigestInfo ::= SEQUENCE {
+//	  digestAlgorithm AlgorithmIdentifier,
+//	  digest OCTET STRING
+//	}
+//
 // For performance, we don't use the generic ASN1 encoder. Rather, we
 // precompute a prefix of the digest value that makes a valid ASN1 DER string
 // with the correct contents.

scan/crypto/rsa/pkcs1v15_test.go

@@ -186,7 +186,8 @@ type signPKCS1v15Test struct {
 }
 
 // These vectors have been tested with
-//   `openssl rsautl -verify -inkey pk -in signature | hexdump -C`
+//
+//	openssl rsautl -verify -inkey pk -in signature | hexdump -C
 var signPKCS1v15Tests = []signPKCS1v15Test{
 	{"Test.\n", "a4f3fa6ea93bcdd0c57be020c1193ecbfd6f200a3d95c409769b029578fa0e336ad9a347600e40d3ae823b8c7e6bad88cc07c1d54c3a1523cbbb6d58efc362ae"},
 }

scan/crypto/sha1/sha1block_decl.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build amd64 || amd64p32 || arm || 386
 // +build amd64 amd64p32 arm 386
 
 package sha1

scan/crypto/sha1/sha1block_generic.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !amd64 && !amd64p32 && !386 && !arm
 // +build !amd64,!amd64p32,!386,!arm
 
 package sha1

scan/crypto/sha256/sha256block.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !386 && !amd64
 // +build !386,!amd64
 
 // SHA256 block step.

scan/crypto/sha256/sha256block_decl.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build 386 || amd64
 // +build 386 amd64
 
 package sha256

scan/crypto/sha512/sha512block.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build !amd64
 // +build !amd64
 
 // SHA512 block step.

scan/crypto/sha512/sha512block_decl.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
+//go:build amd64
 // +build amd64
 
 package sha512