Bump Go to 1.23.2 and golangci-lint to 1.61.0

.changelog/5854.internal.md

@@ -0,0 +1 @@
+Bump Go to 1.23.2 and golangci-lint to 1.61.0

.github/workflows/ci-lint.yml

@@ -46,7 +46,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22.2"
+          go-version: "1.23.2"
       - name: Set up Rust
         run: rustup show
       - name: Install dependencies

.github/workflows/ci-reproducibility.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22.2"
+          go-version: "1.23.2"
       - name: Set up Rust
         working-directory: build${{ matrix.build_number }}
         run: rustup show

.github/workflows/release-dev.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22.2"
+          go-version: "1.23.2"
       - name: Set up Rust
         run: rustup show
       - name: Install Oasis Node prerequisites

.github/workflows/release.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.22.2"
+          go-version: "1.23.2"
 
       - name: Set up Rust
         run: rustup show

docker/oasis-core-dev/Dockerfile

@@ -1,12 +1,12 @@
 FROM ubuntu:22.04
 
 # Package versions.
-ARG GO_VERSION=1.22.2
+ARG GO_VERSION=1.23.2
 ARG GO_NANCY_VERSION=1.0.33
 ARG GO_NANCY_CHECKSUM=a4bf5290d41b095c04f941ed5380674770c79d59735e33b1bd07a5cd5fbb135d
 ARG GO_PROTOC_VERSION=3.6.1
 ARG GO_PROTOC_GEN_GO_VERSION=1.21.0
-ARG GOLANGCILINT_VERSION=1.56.1
+ARG GOLANGCILINT_VERSION=1.61.0
 ARG GOCOVMERGE_VERSION=b5bfa59ec0adc420475f97f89b58045c721d761c
 ARG GOFUMPT_VERSION=v0.6.0
 ARG GOIMPORTS_VERSION=v0.18.0

docs/development-setup/prerequisites.md

@@ -40,7 +40,7 @@ Core:
   ```
   <!-- markdownlint-enable line-length -->
 
-* [Go] (at least version 1.22.2).
+* [Go] (at least version 1.23.2).
 
   If your distribution provides a new-enough version of Go, just use that.
 
@@ -52,18 +52,18 @@ Core:
   * [ensure `$GOPATH/bin` is in your `PATH`](
     https://tip.golang.org/doc/code.html#GOPATH),
   * [install the desired version of Go](
-    https://golang.org/doc/install#extra_versions), e.g. 1.22.2, with:
+    https://golang.org/doc/install#extra_versions), e.g. 1.23.2, with:
 
     ```
-    go install golang.org/dl/go1.22.2@latest
-    go1.22.2 download
+    go install golang.org/dl/go1.23.2@latest
+    go1.23.2 download
     ```
 
   * instruct the build system to use this particular version of Go by setting
     the `OASIS_GO` environment variable in your `~/.bashrc`:
 
     ```
-    export OASIS_GO=go1.22.2
+    export OASIS_GO=go1.23.2
     ```
 
 * [Rust].

go/.golangci.yml

@@ -10,8 +10,9 @@ linters-settings:
       # https://github.com/securego/gosec#available-rules
       - G402
       - G404
+      - G115 # Integer conversion with overflow check; many false positives
   govet:
-    check-shadowing: true
+    shadow: true
     # Enable once suggested fixes are shown: https://github.com/golangci/golangci-lint/issues/2134
     #enable:
     #  - fieldalignment
@@ -57,10 +58,9 @@ linters:
   disable-all: true
   enable:
     - bodyclose
+    - copyloopvar
     - depguard
     - errcheck
-    - exportloopref
-    - gas
     - goconst
     - gocyclo
     - gofumpt
@@ -70,7 +70,6 @@ linters:
     - gosimple
     - govet
     - ineffassign
-    - megacheck
     - misspell
     - revive
     - rowserrcheck
@@ -80,11 +79,6 @@ linters:
     - unused
 
 run:
-  skip-dirs:
-    # golang-ci-lint requires that files compile for certain linters
-    # to run, and Go plugins do not compile unless `-buildmode=plugin`
-    # is set, which linters do not do.
-    - oasis-test-runner/scenario/pluginsigner/example_signer_plugin
 
 exclude-use-default: false
 
@@ -93,3 +87,8 @@ issues:
     - EXC0014 # un-exclude revive `exported` which warns about incorrect comments on exported items.
   exclude:
     - context-as-argument # revive
+  exclude-dirs:
+    # golang-ci-lint requires that files compile for certain linters
+    # to run, and Go plugins do not compile unless `-buildmode=plugin`
+    # is set, which linters do not do.
+    - oasis-test-runner/scenario/pluginsigner/example_signer_plugin

go/common/args.go

@@ -15,10 +15,12 @@ func TrimArgs(osArgs []string) []string {
 		panic("TrimArgs called with an empty argument list")
 	}
 
+	args := []string{osArgs[0]}
+
 	for i, w := range osArgs {
 		if w == argSeparator {
-			return append([]string{osArgs[0]}, osArgs[i+1:]...)
+			return append(args, osArgs[i+1:]...)
 		}
 	}
-	return osArgs[0:1]
+	return args
 }

go/common/grpc/auth/auth_tls.go

@@ -3,7 +3,6 @@ package auth
 import (
 	"context"
 	"crypto/x509"
-	"fmt"
 	"sync"
 
 	"google.golang.org/grpc/codes"
@@ -34,7 +33,7 @@ func (auth *PeerCertAuthenticator) AuthFunc(ctx context.Context, _ interface{})
 		return status.Errorf(codes.PermissionDenied, "grpc: unexpected peer authentication credentials")
 	}
 	if nPeerCerts := len(tlsAuth.State.PeerCertificates); nPeerCerts != 1 {
-		return status.Errorf(codes.PermissionDenied, fmt.Sprintf("grpc: unexpected number of peer certificates: %d", nPeerCerts))
+		return status.Errorf(codes.PermissionDenied, "grpc: unexpected number of peer certificates: %d", nPeerCerts)
 	}
 	peerCert := tlsAuth.State.PeerCertificates[0]
 	subject := accessctl.SubjectFromX509Certificate(peerCert)

go/common/grpc/auth/auth_tls_pubkeys.go

@@ -2,7 +2,6 @@ package auth
 
 import (
 	"context"
-	"fmt"
 	"sync"
 
 	"google.golang.org/grpc/codes"
@@ -35,7 +34,7 @@ func (auth *PeerPubkeyAuthenticator) AuthFunc(ctx context.Context, _ interface{}
 		return status.Errorf(codes.PermissionDenied, "grpc: unexpected peer authentication credentials")
 	}
 	if nPeerCerts := len(tlsAuth.State.PeerCertificates); nPeerCerts != 1 {
-		return status.Errorf(codes.PermissionDenied, fmt.Sprintf("grpc: unexpected number of peer certificates: %d", nPeerCerts))
+		return status.Errorf(codes.PermissionDenied, "grpc: unexpected number of peer certificates: %d", nPeerCerts)
 	}
 	peerCertRaw := tlsAuth.State.PeerCertificates[0].Raw
 
@@ -46,7 +45,7 @@ func (auth *PeerPubkeyAuthenticator) AuthFunc(ctx context.Context, _ interface{}
 		Keys:       auth.whitelist,
 	})
 	if err != nil {
-		return status.Errorf(codes.PermissionDenied, err.Error())
+		return status.Errorf(codes.PermissionDenied, "%s", err.Error())
 	}
 
 	return nil

go/consensus/cometbft/apps/roothash/transactions.go

@@ -49,7 +49,6 @@ func (app *rootHashApplication) executorCommit(
 	if ctx.IsCheckOnly() {
 		// Notify subscribers about observed commitments.
 		for _, ec := range cc.Commits {
-			ec := ec
 			app.ecn.DeliverExecutorCommitment(cc.ID, &ec)
 		}
 		return nil

go/go.mod

@@ -214,4 +214,4 @@ require (
 	lukechampine.com/blake3 v1.3.0 // indirect
 )
 
-go 1.22.2
+go 1.23.2

go/oasis-test-runner/scenario/e2e/runtime/keymanager_client.go

@@ -115,7 +115,7 @@ func (c *keyManagerRPCClient) fetchPublicKey(ctx context.Context, generation uin
 		if msg == fmt.Sprintf("master secret generation %d not found", generation) {
 			return nil, nil
 		}
-		return nil, fmt.Errorf(msg)
+		return nil, fmt.Errorf("%s", msg)
 	}
 
 	var key secrets.SignedPublicKey
@@ -160,7 +160,7 @@ func (c *keyManagerRPCClient) fetchEphemeralPublicKey(ctx context.Context, epoch
 		if msg == fmt.Sprintf("ephemeral secret for epoch %d not found", epoch) {
 			return nil, nil
 		}
-		return nil, fmt.Errorf(msg)
+		return nil, fmt.Errorf("%s", msg)
 	}
 
 	var key secrets.SignedPublicKey

go/p2p/rpc/client.go

@@ -392,8 +392,6 @@ func (c *client) CallMulti(
 	resultCh := make(chan result, len(peers))
 
 	for _, peer := range peers {
-		peer := peer // Make sure goroutine below operates on the right instance.
-
 		pool.Submit(func() {
 			// Abort early in case we are done.
 			select {

go/runtime/host/loadbalance/loadbalance.go

@@ -90,8 +90,6 @@ func (lb *lbRuntime) Call(ctx context.Context, body *protocol.Body) (*protocol.B
 		}
 		resCh := make(chan *result)
 		for _, rt := range lb.instances {
-			rt := rt // Make sure goroutine below operates on the right instance.
-
 			go func() {
 				rsp, err := rt.Call(ctx, body)
 				resCh <- &result{
@@ -167,9 +165,6 @@ func (lb *lbRuntime) WatchEvents() (<-chan *host.Event, pubsub.ClosableSubscript
 func (lb *lbRuntime) Start() {
 	lb.startOnce.Do(func() {
 		for idx, rt := range lb.instances {
-			idx := idx
-			rt := rt // Make sure goroutine below operates on the right instance.
-
 			// Subscribe to runtime events before starting runtime to make sure we don't miss the
 			// started event.
 			evCh, sub := rt.WatchEvents()
@@ -227,8 +222,6 @@ func (lb *lbRuntime) Abort(ctx context.Context, force bool) error {
 	// We don't know which instance to abort, so we abort all instances.
 	errCh := make(chan error)
 	for _, rt := range lb.instances {
-		rt := rt // Make sure goroutine below operates on the right instance.
-
 		go func() {
 			errCh <- rt.Abort(ctx, force)
 		}()

go/storage/mkvs/debug.go

@@ -46,6 +46,6 @@ func (t *tree) doDumpLocal(ctx context.Context, w io.Writer, ptr *node.Pointer,
 
 		fmt.Fprintf(w, "%s- %s -> %v [%v/%s]", prefix, n.Key, value, n.Clean, n.Hash)
 	default:
-		fmt.Fprintf(w, prefix+"<UNKNOWN>")
+		fmt.Fprintf(w, "%s", prefix+"<UNKNOWN>")
 	}
 }

tests/upgrade/post/go.mod

@@ -1,6 +1,6 @@
 module github.com/oasisprotocol/oasis-core/test-upgrade
 
-go 1.22.2
+go 1.23.2
 
 replace (
 	github.com/cometbft/cometbft => github.com/oasisprotocol/cometbft v0.37.2-oasis1