remove support for go1.16, enable gofumpt

.github/workflows/go.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: [1.16.x, 1.17.x]
+        go-version: [1.17.x]
     steps:
     - name: Set up Go ${{ matrix.go-version }}
       uses: actions/setup-go@v1
@@ -29,7 +29,7 @@ jobs:
       env:
         GO111MODULE: on
       run: |
-         curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.40.0
+         curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.43.0
          $(go env GOPATH)/bin/golangci-lint run --config ./.golangci.yml
          go vet ./...
   test:

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@v1
         with:
-          go-version: 1.16.x
+          go-version: 1.17.x
       -
         name: Set up QEMU
         uses: docker/setup-qemu-action@v1

.golangci.yml

@@ -20,12 +20,13 @@ linters:
     - structcheck
     - prealloc
     - unconvert
+    - gofumpt
 
 issues:
   exclude-use-default: false
   exclude:
-      - should have a package comment
       - error strings should not be capitalized or end with punctuation or a newline
       - should have comment           # TODO(aead): Remove once all exported ident. have comments!
+
 service:
-  golangci-lint-version: 1.40.0 # use the fixed version to not introduce new linters unexpectedly
+  golangci-lint-version: 1.43.0 # use the fixed version to not introduce new linters unexpectedly

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.16-alpine as build
+FROM golang:1.17-alpine as build
 
 LABEL maintainer="MinIO Inc <dev@min.io>"
 

api_test.go

@@ -12,7 +12,7 @@ import (
 )
 
 func TestClient_CreateKey(t *testing.T) {
-	var server = kestest.NewServer()
+	server := kestest.NewServer()
 	defer server.Close()
 
 	const KeyName = "my-key"
@@ -22,7 +22,7 @@ func TestClient_CreateKey(t *testing.T) {
 }
 
 func TestClient_DeleteKey(t *testing.T) {
-	var server = kestest.NewServer()
+	server := kestest.NewServer()
 	defer server.Close()
 
 	const KeyName = "my-key"
@@ -33,5 +33,4 @@ func TestClient_DeleteKey(t *testing.T) {
 	if err := server.Client().DeleteKey(context.Background(), KeyName); err != nil {
 		t.Fatalf("Failed to delete key %q: %v", KeyName, err)
 	}
-
 }

cmd/kes/config.go

@@ -42,7 +42,7 @@ func connect(config *yml.ServerConfig, quiet quiet, errorLog *stdlog.Logger) (ke
 		if errors.Is(err, os.ErrNotExist) {
 			msg := fmt.Sprintf("Creating directory '%s' ... ", config.KeyStore.Fs.Path.Value())
 			quiet.Print(msg)
-			if err = os.MkdirAll(config.KeyStore.Fs.Path.Value(), 0700); err != nil {
+			if err = os.MkdirAll(config.KeyStore.Fs.Path.Value(), 0o700); err != nil {
 				return nil, fmt.Errorf("failed to create directory %q: %v", config.KeyStore.Fs.Path.Value(), err)
 			}
 			quiet.ClearMessage(msg)
@@ -161,7 +161,7 @@ func connect(config *yml.ServerConfig, quiet quiet, errorLog *stdlog.Logger) (ke
 		quiet.Print(msg)
 		switch c := config.KeyStore.Azure.KeyVault.Credentials; {
 		case c.TenantID.Value() != "" || c.ClientID.Value() != "" || c.Secret.Value() != "":
-			var err = azureStore.AuthenticateWithCredentials(azure.Credentials{
+			err := azureStore.AuthenticateWithCredentials(azure.Credentials{
 				TenantID: config.KeyStore.Azure.KeyVault.Credentials.TenantID.Value(),
 				ClientID: config.KeyStore.Azure.KeyVault.Credentials.ClientID.Value(),
 				Secret:   config.KeyStore.Azure.KeyVault.Credentials.Secret.Value(),
@@ -170,7 +170,7 @@ func connect(config *yml.ServerConfig, quiet quiet, errorLog *stdlog.Logger) (ke
 				return nil, fmt.Errorf("failed to connect to Azure KeyVault: %v", err)
 			}
 		case config.KeyStore.Azure.KeyVault.ManagedIdentity.ClientID.Value() != "":
-			var err = azureStore.AuthenticateWithIdentity(azure.ManagedIdentity{
+			err := azureStore.AuthenticateWithIdentity(azure.ManagedIdentity{
 				ClientID: config.KeyStore.Azure.KeyVault.ManagedIdentity.ClientID.Value(),
 			})
 			if err != nil {

cmd/kes/identity.go

@@ -132,7 +132,7 @@ func listIdentity(args []string) {
 		stdlog.Fatal("Error: too many arguments")
 	}
 
-	var pattern = "*"
+	pattern := "*"
 	if cli.NArg() == 1 {
 		pattern = cli.Arg(0)
 	}

cmd/kes/key.go

@@ -295,7 +295,7 @@ func listKeys(args []string) {
 		stdlog.Fatal("Error: too many arguments")
 	}
 
-	var pattern = "*"
+	pattern := "*"
 	if cli.NArg() == 1 {
 		pattern = cli.Arg(0)
 	}

cmd/kes/log.go

@@ -247,7 +247,7 @@ func traceMetricsWithUI(ctx context.Context, client *kes.Client, rate time.Durat
 		}
 	}()
 
-	var events = ui.PollEvents()
+	events := ui.PollEvents()
 	for {
 		select {
 		case event := <-events:
@@ -415,7 +415,7 @@ func traceErrorLogWithUI(stream *kes.ErrorStream) {
 
 // avgLatency computes the arithmetic mean latency o
 func avgLatency(histogram map[time.Duration]uint64) time.Duration {
-	var latencies = make([]time.Duration, 0, len(histogram))
+	latencies := make([]time.Duration, 0, len(histogram))
 	for l := range histogram {
 		latencies = append(latencies, l)
 	}

cmd/kes/mlock_ref.go

@@ -2,6 +2,7 @@
 // Use of this source code is governed by the AGPLv3
 // license that can be found in the LICENSE file.
 
+//go:build !linux
 // +build !linux
 
 package main

cmd/kes/policy.go

@@ -199,7 +199,7 @@ func listPolicies(args []string) {
 	cli.BoolVar(&insecureSkipVerify, "insecure", false, "Skip X.509 certificate validation during TLS handshake")
 	cli.Parse(args[1:])
 
-	var pattern = "*"
+	pattern := "*"
 	if cli.NArg() == 1 {
 		pattern = cli.Arg(0)
 	}

cmd/kes/server.go

@@ -101,7 +101,7 @@ func server(args []string) {
 	if cli.NArg() > 0 {
 		stdlog.Fatal("Error: too many arguments")
 	}
-	var ctx, cancelCtx = signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	ctx, cancelCtx := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer cancelCtx()
 
 	if mlockFlag {
@@ -206,7 +206,7 @@ func server(args []string) {
 	if err != nil {
 		stdlog.Fatalf("Error: %v", err)
 	}
-	var cache = key.NewCache(store, &key.CacheConfig{
+	cache := key.NewCache(store, &key.CacheConfig{
 		Expiry:        config.Cache.Expiry.Any.Value(),
 		ExpiryUnused:  config.Cache.Expiry.Unused.Value(),
 		ExpiryOffline: config.Cache.Expiry.Offline.Value(),
@@ -234,7 +234,7 @@ func server(args []string) {
 	errorLog.Add(metrics.ErrorEventCounter())
 	auditLog.Add(metrics.AuditEventCounter())
 
-	var server = http.Server{
+	server := http.Server{
 		Addr: config.Address.Value(),
 		Handler: xhttp.NewServerMux(&xhttp.ServerConfig{
 			Version:  version,

cmd/kes/tool.go

@@ -152,7 +152,7 @@ func newIdentityCmd(args []string) {
 	if cli.NArg() > 1 {
 		stdlog.Fatal("Error: too many arguments")
 	}
-	var commonName = ""
+	commonName := ""
 	if cli.NArg() == 1 {
 		commonName = cli.Arg(0)
 	}
@@ -188,7 +188,7 @@ func newIdentityCmd(args []string) {
 		extKeyUsage = []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}
 	}
 
-	var ipAddrs = make([]net.IP, 0, len(ipFlag))
+	ipAddrs := make([]net.IP, 0, len(ipFlag))
 	for _, ipAddr := range ipFlag {
 		ip := net.ParseIP(ipAddr)
 		if ip == nil {
@@ -232,7 +232,7 @@ func newIdentityCmd(args []string) {
 		keyFile  *os.File
 		certFile *os.File
 	)
-	keyFile, err = os.OpenFile(keyPath, fileFlags, 0600)
+	keyFile, err = os.OpenFile(keyPath, fileFlags, 0o600)
 	if err != nil {
 		if errors.Is(err, os.ErrExist) {
 			stdlog.Fatalf("Error: private key %q already exists: Use --force to overwrite it", keyPath)
@@ -241,7 +241,7 @@ func newIdentityCmd(args []string) {
 	}
 	defer keyFile.Close()
 
-	certFile, err = os.OpenFile(certPath, fileFlags, 0600)
+	certFile, err = os.OpenFile(certPath, fileFlags, 0o600)
 	if err != nil {
 		if errors.Is(err, os.ErrExist) {
 			stdlog.Fatalf("Error: certificate %q already exists: Use --force to overwrite it", certPath)
@@ -315,7 +315,7 @@ func identityOfCmd(args []string) {
 		stdlog.Fatalf("Error: invalid --hash: %q", hashFunc)
 	}
 
-	var input = os.Stdin
+	input := os.Stdin
 	if cli.NArg() == 1 && cli.Arg(0) != "-" {
 		f, err := os.Open(cli.Arg(0))
 		if err != nil {
@@ -402,7 +402,7 @@ func migrate(args []string) {
 		stdlog.Fatal("Error: -f or --force cannot be used together with --merge. They are mutually exclusive")
 	}
 
-	var pattern = cli.Arg(0)
+	pattern := cli.Arg(0)
 	if pattern == "" {
 		pattern = "*"
 	}

error.go

@@ -100,7 +100,7 @@ func parseErrorResponse(resp *http.Response) error {
 	defer resp.Body.Close()
 
 	const MaxBodySize = 1 << 20
-	var size = resp.ContentLength
+	size := resp.ContentLength
 	if size < 0 || size > MaxBodySize {
 		size = MaxBodySize
 	}

go.mod

@@ -1,6 +1,6 @@
 module github.com/minio/kes
 
-go 1.14
+go 1.17
 
 require (
 	cloud.google.com/go v0.65.0
@@ -25,3 +25,51 @@ require (
 	google.golang.org/grpc v1.31.1
 	gopkg.in/yaml.v2 v2.4.0
 )
+
+require (
+	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.11 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.2 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
+	github.com/Azure/go-autorest/logger v0.2.0 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
+	github.com/VividCortex/ewma v1.1.1 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v3 v3.0.0 // indirect
+	github.com/cespare/xxhash/v2 v2.1.1 // indirect
+	github.com/dimchansky/utfbom v1.1.1 // indirect
+	github.com/form3tech-oss/jwt-go v3.2.2+incompatible // indirect
+	github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e // indirect
+	github.com/golang/protobuf v1.4.3 // indirect
+	github.com/golang/snappy v0.0.1 // indirect
+	github.com/google/go-cmp v0.5.5 // indirect
+	github.com/googleapis/gax-go/v2 v2.0.5 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.1 // indirect
+	github.com/hashicorp/go-multierror v1.1.0 // indirect
+	github.com/hashicorp/go-retryablehttp v0.6.6 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/vault/sdk v0.2.1 // indirect
+	github.com/jmespath/go-jmespath v0.3.0 // indirect
+	github.com/mattn/go-colorable v0.1.9 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/mattn/go-runewidth v0.0.7 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
+	github.com/mitchellh/mapstructure v1.3.2 // indirect
+	github.com/nsf/termbox-go v0.0.0-20190121233118-02980233997d // indirect
+	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
+	github.com/prometheus/procfs v0.6.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	go.opencensus.io v0.22.4 // indirect
+	golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2 // indirect
+	golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c // indirect
+	golang.org/x/text v0.3.6 // indirect
+	golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1 // indirect
+	google.golang.org/appengine v1.6.6 // indirect
+	google.golang.org/protobuf v1.26.0-rc.1 // indirect
+	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
+)

internal/auth/policy.go

@@ -177,7 +177,7 @@ func (r *Roles) Verify(req *http.Request) error {
 	// root CA certificates.
 	// Therefore, we filter all CA certificates and only
 	// process the remaining leaf certificate(s).
-	var peerCertificates = make([]*x509.Certificate, 0, len(req.TLS.PeerCertificates))
+	peerCertificates := make([]*x509.Certificate, 0, len(req.TLS.PeerCertificates))
 	for _, cert := range req.TLS.PeerCertificates {
 		if cert.IsCA {
 			continue

internal/auth/proxy.go

@@ -112,7 +112,7 @@ func (p *TLSProxy) Verify(req *http.Request) error {
 	// root CA certificates.
 	// Therefore, we filter all CA certificates and only
 	// process the remaining leaf certificate(s).
-	var peerCertificates = make([]*x509.Certificate, 0, len(req.TLS.PeerCertificates))
+	peerCertificates := make([]*x509.Certificate, 0, len(req.TLS.PeerCertificates))
 	for _, cert := range req.TLS.PeerCertificates {
 		if cert.IsCA {
 			continue

internal/aws/secrets-manager.go

@@ -217,7 +217,6 @@ func (s *SecretsManager) List(ctx context.Context) (key.Iterator, error) {
 			// we return !lastPage which then is false.
 			return !lastPage
 		})
-
 		if err != nil {
 			s.logf("aws: failed to list keys: %v", err)
 			iterator.SetErr(errListKey)