chore: improve Makefile and update various files for improved functionality and security checks

Author: Ivan

Makefile

@@ -25,7 +25,8 @@ GO_LEGACY_WINXP ?= /usr/local/go-legacy-winxp/bin/go
 GOFLAGS := -mod=vendor
 GOPROXY := off
 GOSUMDB := off
-export GOFLAGS GOPROXY GOSUMDB
+GOTOOLCHAIN ?= local
+export GOFLAGS GOPROXY GOSUMDB GOTOOLCHAIN
 LIBS_ROOT ?= ../../Reticulum-Go-Projects
 GOVULNCHECK_VER ?= v1.1.4
 NFPM_VER ?= v2.41.3

pkg/cli/git.go

@@ -254,5 +254,5 @@ func EmitGitJSON(w io.Writer, event string, fields map[string]any) {
 
 // GitBundleVerify wraps git bundle verify for tests.
 func GitBundleVerify(path string) error {
-	return exec.Command("git", "bundle", "verify", "-q", path).Run()
+	return exec.Command("git", "bundle", "verify", "-q", path).Run() // #nosec G204 -- fixed git binary
 }

pkg/link/resource_metadata_unpack.go

@@ -5,6 +5,7 @@ package link
 
 import (
 	"fmt"
+	"math"
 	"strconv"
 
 	"quad4/msgpack/v5/pkg/msgpack"
@@ -51,6 +52,9 @@ func metadataMapKey(k any) string {
 	case uint32:
 		return strconv.Itoa(int(x))
 	case uint64:
+		if x > math.MaxInt {
+			return fmt.Sprint(k)
+		}
 		return strconv.Itoa(int(x))
 	default:
 		return fmt.Sprint(k)

pkg/packet/testdata/handshake_vectors.json

@@ -3,14 +3,14 @@
   "vectors": [
     {
       "name": "announce_h2",
-      "raw_hex": "4100abababababababababababababababab4f070d727898b6f3e6c51f585387b9c100d293002f17a6dcca4ce5e902619b26beae78ee6c51cba622adcf85657c1eb07ad97ec87043c607d47c8bb9ace71e703ae1a864a0c2df89522e694b344d86542372ea66915f2f5fedf916e0647f3314006a8a2a755ba843d191cdd6a31816a3baa230341d116c2872e969fd2674d00a0117b9fd5cfd544676577623e9d8996dbac3d1a259507b98ad576871664bbd3d240996d7070102",
+      "raw_hex": "4100abababababababababababababababab749dfe39a82e14abcfe05e592cadb8d300ff9c7aa64168ddc1b0b5d6a824ee9eca2c570ac06d7a1a6ec61372f668e1f24a4f7aeecd079915be05fb5dcbc5c3af1c77bd3478964f334bad94ff4b397cc56972ea66915f2f5fedf916a20acd13f3006a8a48dcf3a85be66bedfcee089433b497e301b700adabd22946832af40358fe3fbc63733932f04c9fc661b2f9bdedc2ecd30c09cb11ed9c5160b716a7b46526cbdac4020102",
       "packet_type_name": "ANNOUNCE",
       "context_name": "NONE",
       "header_type": 1,
       "destination_type_name": "SINGLE",
       "tree": {
         "ok": true,
-        "raw_hex": "4100abababababababababababababababab4f070d727898b6f3e6c51f585387b9c100d293002f17a6dcca4ce5e902619b26beae78ee6c51cba622adcf85657c1eb07ad97ec87043c607d47c8bb9ace71e703ae1a864a0c2df89522e694b344d86542372ea66915f2f5fedf916e0647f3314006a8a2a755ba843d191cdd6a31816a3baa230341d116c2872e969fd2674d00a0117b9fd5cfd544676577623e9d8996dbac3d1a259507b98ad576871664bbd3d240996d7070102",
+        "raw_hex": "4100abababababababababababababababab749dfe39a82e14abcfe05e592cadb8d300ff9c7aa64168ddc1b0b5d6a824ee9eca2c570ac06d7a1a6ec61372f668e1f24a4f7aeecd079915be05fb5dcbc5c3af1c77bd3478964f334bad94ff4b397cc56972ea66915f2f5fedf916a20acd13f3006a8a48dcf3a85be66bedfcee089433b497e301b700adabd22946832af40358fe3fbc63733932f04c9fc661b2f9bdedc2ecd30c09cb11ed9c5160b716a7b46526cbdac4020102",
         "raw_len": 185,
         "flags": 65,
         "hops": 0,
@@ -23,22 +23,22 @@
         "destination_type_name": "SINGLE",
         "context": 0,
         "context_name": "NONE",
-        "destination_hash": "4f070d727898b6f3e6c51f585387b9c1",
+        "destination_hash": "749dfe39a82e14abcfe05e592cadb8d3",
         "transport_id": "abababababababababababababababab",
         "data_len": 150,
-        "data_hex_prefix": "d293002f17a6dcca4ce5e902619b26beae78ee6c51cba622adcf85657c1eb07a"
+        "data_hex_prefix": "ff9c7aa64168ddc1b0b5d6a824ee9eca2c570ac06d7a1a6ec61372f668e1f24a"
       }
     },
     {
       "name": "path_response_announce",
-      "raw_hex": "5100abababababababababababababababab4f070d727898b6f3e6c51f585387b9c10bd293002f17a6dcca4ce5e902619b26beae78ee6c51cba622adcf85657c1eb07ad97ec87043c607d47c8bb9ace71e703ae1a864a0c2df89522e694b344d86542372ea66915f2f5fedf916e0647f3314006a8a2a755ba843d191cdd6a31816a3baa230341d116c2872e969fd2674d00a0117b9fd5cfd544676577623e9d8996dbac3d1a259507b98ad576871664bbd3d240996d7070102",
+      "raw_hex": "5100abababababababababababababababab749dfe39a82e14abcfe05e592cadb8d30bff9c7aa64168ddc1b0b5d6a824ee9eca2c570ac06d7a1a6ec61372f668e1f24a4f7aeecd079915be05fb5dcbc5c3af1c77bd3478964f334bad94ff4b397cc56972ea66915f2f5fedf916a20acd13f3006a8a48dcf3a85be66bedfcee089433b497e301b700adabd22946832af40358fe3fbc63733932f04c9fc661b2f9bdedc2ecd30c09cb11ed9c5160b716a7b46526cbdac4020102",
       "packet_type_name": "ANNOUNCE",
       "context_name": "PATH_RESPONSE",
       "header_type": 1,
       "destination_type_name": "SINGLE",
       "tree": {
         "ok": true,
-        "raw_hex": "5100abababababababababababababababab4f070d727898b6f3e6c51f585387b9c10bd293002f17a6dcca4ce5e902619b26beae78ee6c51cba622adcf85657c1eb07ad97ec87043c607d47c8bb9ace71e703ae1a864a0c2df89522e694b344d86542372ea66915f2f5fedf916e0647f3314006a8a2a755ba843d191cdd6a31816a3baa230341d116c2872e969fd2674d00a0117b9fd5cfd544676577623e9d8996dbac3d1a259507b98ad576871664bbd3d240996d7070102",
+        "raw_hex": "5100abababababababababababababababab749dfe39a82e14abcfe05e592cadb8d30bff9c7aa64168ddc1b0b5d6a824ee9eca2c570ac06d7a1a6ec61372f668e1f24a4f7aeecd079915be05fb5dcbc5c3af1c77bd3478964f334bad94ff4b397cc56972ea66915f2f5fedf916a20acd13f3006a8a48dcf3a85be66bedfcee089433b497e301b700adabd22946832af40358fe3fbc63733932f04c9fc661b2f9bdedc2ecd30c09cb11ed9c5160b716a7b46526cbdac4020102",
         "raw_len": 185,
         "flags": 81,
         "hops": 0,
@@ -51,22 +51,22 @@
         "destination_type_name": "SINGLE",
         "context": 11,
         "context_name": "PATH_RESPONSE",
-        "destination_hash": "4f070d727898b6f3e6c51f585387b9c1",
+        "destination_hash": "749dfe39a82e14abcfe05e592cadb8d3",
         "transport_id": "abababababababababababababababab",
         "data_len": 150,
-        "data_hex_prefix": "d293002f17a6dcca4ce5e902619b26beae78ee6c51cba622adcf85657c1eb07a"
+        "data_hex_prefix": "ff9c7aa64168ddc1b0b5d6a824ee9eca2c570ac06d7a1a6ec61372f668e1f24a"
       }
     },
     {
       "name": "link_request",
-      "raw_hex": "02004f070d727898b6f3e6c51f585387b9c100cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
+      "raw_hex": "0200749dfe39a82e14abcfe05e592cadb8d300cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
       "packet_type_name": "LINKREQUEST",
       "context_name": "NONE",
       "header_type": 0,
       "destination_type_name": "SINGLE",
       "tree": {
         "ok": true,
-        "raw_hex": "02004f070d727898b6f3e6c51f585387b9c100cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
+        "raw_hex": "0200749dfe39a82e14abcfe05e592cadb8d300cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
         "raw_len": 83,
         "flags": 2,
         "hops": 0,
@@ -79,7 +79,7 @@
         "destination_type_name": "SINGLE",
         "context": 0,
         "context_name": "NONE",
-        "destination_hash": "4f070d727898b6f3e6c51f585387b9c1",
+        "destination_hash": "749dfe39a82e14abcfe05e592cadb8d3",
         "data_len": 64,
         "data_hex_prefix": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
       }

pkg/rnsgit/config.go

@@ -44,7 +44,7 @@ func DefaultClientConfigDir() string {
 	home := os.Getenv("HOME")
 	if home != "" {
 		legacy := filepath.Join(home, ".config", "rngit", "config")
-		if st, err := os.Stat(legacy); err == nil && !st.IsDir() {
+		if st, err := os.Stat(legacy); err == nil && !st.IsDir() { // #nosec G703 -- legacy config probe
 			return filepath.Join(home, ".rngit", "reticulum")
 		}
 		return filepath.Join(home, ".rngit")
@@ -181,7 +181,7 @@ func EnsureServerConfig(dir string) error {
 }
 
 func parseINI(path string) (map[string]map[string]string, error) {
-	f, err := os.Open(path) // #nosec G304 -- operator config path
+	f, err := os.Open(path) // #nosec G304 G703 -- operator config path
 	if err != nil {
 		return nil, err
 	}

pkg/rnsgit/gitexec.go

@@ -40,7 +40,7 @@ func (g *GitRunner) ListRefs(repoPath string) (string, error) {
 		return "", fmt.Errorf("git for-each-ref: %w: %s", err, strings.TrimSpace(string(stderr)))
 	}
 	headRef := "master"
-	if b, err := os.ReadFile(filepath.Join(repoPath, "HEAD")); err == nil {
+	if b, err := os.ReadFile(filepath.Join(repoPath, "HEAD")); err == nil { // #nosec G304 -- bare repo HEAD
 		s := strings.TrimSpace(string(b))
 		if after, ok := strings.CutPrefix(s, "ref: "); ok {
 			headRef = after
@@ -146,7 +146,7 @@ func (g *GitRunner) DeleteRef(repoPath, ref string) error {
 
 // InitBare creates a bare repository.
 func (g *GitRunner) InitBare(path string) error {
-	if err := os.MkdirAll(path, 0o755); err != nil {
+	if err := os.MkdirAll(path, 0o755); err != nil { // #nosec G301 -- bare git repo root
 		return err
 	}
 	_, stderr, err := g.run(path, "init", "--bare")
@@ -158,7 +158,7 @@ func (g *GitRunner) InitBare(path string) error {
 
 // CloneBare mirrors a remote into path.
 func (g *GitRunner) CloneBare(source, path string) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil { // #nosec G301 -- bare git parent dir
 		return err
 	}
 	_, stderr, err := g.run("", "clone", "--bare", source, path)

pkg/rnsgit/mgmt.go

@@ -222,10 +222,10 @@ func (n *Node) fetchReleaseArtifact(group, repo, tag, artifact string) ([]byte,
 
 func (n *Node) createRelease(group, repo, tag, notes string) error {
 	dir := filepath.Join(n.releasesDir(group, repo), tag)
-	if err := os.MkdirAll(filepath.Join(dir, "artifacts"), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Join(dir, "artifacts"), 0o755); err != nil { // #nosec G301 -- release artifacts dir
 		return err
 	}
-	return os.WriteFile(filepath.Join(dir, "RELEASE.md"), []byte(notes), 0o644)
+	return os.WriteFile(filepath.Join(dir, "RELEASE.md"), []byte(notes), 0o644) // #nosec G306 -- release notes
 }
 
 func (n *Node) workDir(group string) string {
@@ -260,13 +260,13 @@ func (n *Node) readWorkDoc(group, docID string) ([]byte, error) {
 
 func (n *Node) createWorkDoc(group, title, content string, remote *identity.Identity) (string, error) {
 	dir := n.workDir(group)
-	if err := os.MkdirAll(dir, 0o755); err != nil {
+	if err := os.MkdirAll(dir, 0o755); err != nil { // #nosec G301 -- work doc directory
 		return "", err
 	}
 	id := fmt.Sprintf("%d", time.Now().Unix())
 	body := title + "\n" + content + "\nauthor:" + hex.EncodeToString(remote.Hash())
 	path := filepath.Join(dir, id+".txt")
-	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil { // #nosec G306 -- work doc file
 		return "", err
 	}
 	return id, nil

pkg/rnsgit/mirror.go

@@ -35,9 +35,10 @@ func (n *Node) syncMirrors() {
 			synced, _ := n.git.ConfigValue(ra.Path, "repository.rngit.upstream.sync")
 			if synced != "" {
 				var ts int64
-				fmt.Sscanf(synced, "%d", &ts)
-				if time.Since(time.Unix(ts, 0)) < time.Duration(n.cfg.MirrorIntervalHrs)*time.Hour {
-					continue
+				if _, err := fmt.Sscanf(synced, "%d", &ts); err == nil {
+					if time.Since(time.Unix(ts, 0)) < time.Duration(n.cfg.MirrorIntervalHrs)*time.Hour {
+						continue
+					}
 				}
 			}
 			source, err := n.git.ConfigValue(ra.Path, "repository.rngit.upstream.source")

pkg/rnsgit/msgpack.go

@@ -5,6 +5,7 @@ package rnsgit
 
 import (
 	"fmt"
+	"math"
 
 	"quad4/msgpack/v5/pkg/msgpack"
 )
@@ -88,12 +89,24 @@ func byteFromAny(v any) (byte, bool) {
 	case uint8:
 		return x, true
 	case int8:
+		if x < 0 {
+			return 0, false
+		}
 		return byte(x), true
 	case int:
+		if x < 0 || x > math.MaxUint8 {
+			return 0, false
+		}
 		return byte(x), true
 	case int64:
+		if x < 0 || x > math.MaxUint8 {
+			return 0, false
+		}
 		return byte(x), true
 	case uint64:
+		if x > math.MaxUint8 {
+			return 0, false
+		}
 		return byte(x), true
 	default:
 		return 0, false
@@ -105,7 +118,9 @@ func MetadataResultCodeRaw(packed []byte) (byte, bool) {
 	var m map[int]int
 	if err := msgpack.Unmarshal(packed, &m); err == nil {
 		if v, ok := m[IdxResultCode]; ok {
-			return byte(v), true
+			if b, ok := byteFromAny(v); ok {
+				return b, true
+			}
 		}
 	}
 	var anyMap map[any]any
@@ -141,6 +156,9 @@ func toIntKey(k any) (int, bool) {
 	case uint32:
 		return int(x), true
 	case uint64:
+		if x > math.MaxInt {
+			return 0, false
+		}
 		return int(x), true
 	default:
 		return 0, false

pkg/rnsgit/permissions.go

@@ -86,7 +86,7 @@ func NewAccessTable(cfg *ServerConfig) (*AccessTable, error) {
 		}
 		groupAllowed := filepath.Join(filepath.Dir(abs), group+".allowed")
 		applyAllowedFile(ga, groupAllowed)
-		if err := os.MkdirAll(abs, 0o755); err != nil {
+		if err := os.MkdirAll(abs, 0o755); err != nil { // #nosec G301 -- git group directory
 			return nil, err
 		}
 		entries, _ := os.ReadDir(abs)
@@ -339,7 +339,7 @@ func (ra *RepoAccess) permSet(perm int) PermissionSet {
 
 // WriteAllowedFile saves permission lines to path.
 func WriteAllowedFile(path string, content string) error {
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil { // #nosec G301 -- allowed file parent dir
 		return err
 	}
 	var buf bytes.Buffer
@@ -354,7 +354,7 @@ func WriteAllowedFile(path string, content string) error {
 		buf.WriteString(line)
 		buf.WriteByte('\n')
 	}
-	return os.WriteFile(path, buf.Bytes(), 0o644)
+	return os.WriteFile(path, buf.Bytes(), 0o644) // #nosec G306 -- allowed file
 }
 
 // ReadAllowedFile returns the contents of an allowed file.