chore(ci): add rules to .golintci.yaml (#4397)

.golangci.yml

@@ -15,6 +15,16 @@ linters-settings:
     severity: warning
     confidence: 0.8
 
+  gosec:
+    excludes:
+      - G115
+      - G301
+      - G306
+
+  gosimple:
+    excludes:
+      - S1009
+
   lll:
     # max line length, lines longer will be reported. Default is 120.
     # '\t' is counted as 1 character by default, and can be changed with the tab-width option
@@ -95,6 +105,14 @@ issues:
       linters:
         - govet
 
+    - text: 'printf: non-constant format*'
+      linters:
+        - govet
+
+    - text: 'return both a `nil` error and an invalid value*'
+      linters:
+        - nilnil
+
     - linters:
         - revive
       text: "package comment should be of the form"

Makefile

@@ -20,7 +20,7 @@ help: Makefile
 
 .PHONY: lint
 lint:
-	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.61
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.62
 	golangci-lint run
 
 clean:

devnet/bob.Dockerfile

@@ -1,7 +1,7 @@
 # Copyright 2021 ChainSafe Systems (ON)
 # SPDX-License-Identifier: LGPL-3.0-only
 
-FROM golang:1.20
+FROM golang:1.23
 
 ARG DD_API_KEY=somekey
 ARG CHAIN=westend-local

devnet/substrate_alice.Dockerfile

@@ -3,7 +3,7 @@
 
 ARG POLKADOT_VERSION=v0.9.37
 
-FROM golang:1.20 as openmetrics
+FROM golang:1.23 as openmetrics
 ARG METRICS_NAMESPACE=substrate.local.devnet
 
 WORKDIR /devnet

devnet/substrate_bob.Dockerfile

@@ -3,7 +3,7 @@
 
 ARG POLKADOT_VERSION=v0.9.37
 
-FROM golang:1.20 as openmetrics
+FROM golang:1.23 as openmetrics
 
 ARG METRICS_NAMESPACE=substrate.local.devnet
 

dot/network/block_announce.go

@@ -145,7 +145,7 @@ func (s *Service) getBlockAnnounceHandshake() (Handshake, error) {
 
 	return &BlockAnnounceHandshake{
 		Roles:           s.cfg.Roles,
-		BestBlockNumber: uint32(latestBlock.Number), //nolint:gosec
+		BestBlockNumber: uint32(latestBlock.Number),
 		BestBlockHash:   latestBlock.Hash(),
 		GenesisHash:     s.blockState.GenesisHash(),
 	}, nil

dot/network/host.go

@@ -158,9 +158,9 @@ func newHost(ctx context.Context, cfg *Config) (*host, error) {
 		// This needs to be explicitly mentioned
 
 		// maxInPeers is later used in peerstate only and defines available Incoming connection slots
-		uint32(cfg.MaxPeers-cfg.MinPeers), //nolint:gosec
+		uint32(cfg.MaxPeers-cfg.MinPeers),
 		// maxOutPeers is later used in peerstate only and defines available Outgoing connection slots
-		uint32(cfg.MaxPeers/2), //nolint:gosec
+		uint32(cfg.MaxPeers/2),
 		reservedOnly,
 		peerSetSlotAllocTime,
 	)

dot/network/messages/block.go

@@ -108,7 +108,7 @@ func (x *FromBlock) Encode() (FromBlockType, []byte) {
 		if rawValue > uint(math.MaxUint32) {
 			rawValue = math.MaxUint32
 		}
-		binary.LittleEndian.PutUint32(encoded, uint32(rawValue)) //nolint:gosec
+		binary.LittleEndian.PutUint32(encoded, uint32(rawValue))
 		return FromBlockNumber, encoded
 	case common.Hash:
 		return FromBlockHash, rawValue.ToBytes()

dot/network/ratelimiters/sliding_window.go

@@ -52,7 +52,7 @@ func (rl *SlidingWindowRateLimiter) IsLimitExceeded(id common.Hash) bool {
 	recentRequests := rl.recentRequests(id)
 	rl.limits.Put(id, recentRequests)
 
-	return uint32(len(recentRequests)) > rl.maxReqs //nolint:gosec
+	return uint32(len(recentRequests)) > rl.maxReqs
 }
 
 func (rl *SlidingWindowRateLimiter) recentRequests(id common.Hash) []time.Time {

dot/network/utils.go

@@ -88,7 +88,7 @@ func generateKey(seed int64, fp string) (crypto.PrivKey, error) {
 func loadKey(fp string) (crypto.PrivKey, error) {
 	pth := path.Join(filepath.Clean(fp), DefaultKeyFile)
 	if _, err := os.Stat(pth); os.IsNotExist(err) {
-		return nil, nil //nolint:nilnil
+		return nil, nil
 	}
 	keyData, err := os.ReadFile(filepath.Clean(pth))
 	if err != nil {
@@ -106,7 +106,7 @@ func loadKey(fp string) (crypto.PrivKey, error) {
 func makeDir(fp string) error {
 	_, e := os.Stat(fp)
 	if os.IsNotExist(e) {
-		e = os.Mkdir(fp, os.ModePerm) //nolint:gosec
+		e = os.Mkdir(fp, os.ModePerm)
 		if e != nil {
 			return e
 		}
@@ -136,7 +136,7 @@ func saveKey(priv crypto.PrivKey, fp string) (err error) {
 func Uint64ToLEB128(in uint64) []byte {
 	var out []byte
 	for {
-		b := uint8(in & 0x7f) //nolint:gosec
+		b := uint8(in & 0x7f)
 		in >>= 7
 		if in != 0 {
 			b |= 0x80
@@ -200,7 +200,7 @@ func readStream(stream libp2pnetwork.Stream, bufPointer *[]byte, maxSize uint64)
 	buf := *bufPointer
 	if length > uint64(len(buf)) {
 		logger.Warnf("received message with size %d greater than allocated message buffer size %d", length, len(buf))
-		extraBytes := int(length) - len(buf) //nolint:gosec
+		extraBytes := int(length) - len(buf)
 		*bufPointer = append(buf, make([]byte, extraBytes)...)
 		buf = *bufPointer
 	}
@@ -210,7 +210,7 @@ func readStream(stream libp2pnetwork.Stream, bufPointer *[]byte, maxSize uint64)
 		return 0, fmt.Errorf("%w: max %d, got %d", ErrGreaterThanMaxSize, maxSize, length)
 	}
 
-	for tot < int(length) { //nolint:gosec
+	for tot < int(length) {
 		n, err := stream.Read(buf[tot:])
 		if err != nil {
 			return n + tot, err
@@ -219,7 +219,7 @@ func readStream(stream libp2pnetwork.Stream, bufPointer *[]byte, maxSize uint64)
 		tot += n
 	}
 
-	if tot != int(length) { //nolint:gosec
+	if tot != int(length) {
 		return tot, fmt.Errorf("%w: expected %d bytes, received %d bytes", ErrFailedToReadEntireMessage, length, tot)
 	}
 

dot/peerset/peerset.go

@@ -359,7 +359,7 @@ func (ps *PeerSet) reportPeer(change ReputationChange, peers ...peer.ID) error {
 
 			ps.resultMsgCh <- Message{
 				Status: Drop,
-				setID:  uint64(i), //nolint:gosec
+				setID:  uint64(i),
 				PeerID: pid,
 			}
 
@@ -406,7 +406,7 @@ func (ps *PeerSet) allocSlots(setIdx int) error {
 
 		ps.resultMsgCh <- Message{
 			Status: Connect,
-			setID:  uint64(setIdx), //nolint:gosec
+			setID:  uint64(setIdx),
 			PeerID: reservePeer,
 		}
 	}
@@ -444,7 +444,7 @@ func (ps *PeerSet) allocSlots(setIdx int) error {
 
 		ps.resultMsgCh <- Message{
 			Status: Connect,
-			setID:  uint64(setIdx), //nolint:gosec
+			setID:  uint64(setIdx),
 			PeerID: peerID,
 		}
 
@@ -507,7 +507,7 @@ func (ps *PeerSet) removeReservedPeers(setID int, peers ...peer.ID) error {
 
 			ps.resultMsgCh <- Message{
 				Status: Drop,
-				setID:  uint64(setID), //nolint:gosec
+				setID:  uint64(setID),
 				PeerID: peerID,
 			}
 		}
@@ -577,7 +577,7 @@ func (ps *PeerSet) removePeer(setID int, peers ...peer.ID) error {
 		if status := ps.peerState.peerStatus(setID, pid); status == connectedPeer {
 			ps.resultMsgCh <- Message{
 				Status: Drop,
-				setID:  uint64(setID), //nolint:gosec
+				setID:  uint64(setID),
 				PeerID: pid,
 			}
 
@@ -614,7 +614,7 @@ func (ps *PeerSet) incoming(setID int, peers ...peer.ID) error {
 			if !has {
 				ps.resultMsgCh <- Message{
 					Status: Reject,
-					setID:  uint64(setID), //nolint:gosec
+					setID:  uint64(setID),
 					PeerID: pid,
 				}
 				continue
@@ -643,7 +643,7 @@ func (ps *PeerSet) incoming(setID int, peers ...peer.ID) error {
 		state.RUnlock()
 
 		message := Message{
-			setID:  uint64(setID), //nolint:gosec
+			setID:  uint64(setID),
 			PeerID: pid,
 		}
 
@@ -707,7 +707,7 @@ func (ps *PeerSet) disconnect(setIdx int, reason DropReason, peers ...peer.ID) e
 
 		ps.resultMsgCh <- Message{
 			Status: Drop,
-			setID:  uint64(setIdx), //nolint:gosec
+			setID:  uint64(setIdx),
 			PeerID: pid,
 		}
 

dot/rpc/modules/grandpa.go

@@ -103,19 +103,19 @@ func (gm *GrandpaModule) RoundState(r *http.Request, req *EmptyRequest, res *Rou
 		return err
 	}
 
-	totalWeight := uint32(len(voters)) //nolint:gosec
+	totalWeight := uint32(len(voters))
 	roundstate := RoundStateResponse{
-		SetID: uint32(gm.blockFinalityAPI.GetSetID()), //nolint:gosec
+		SetID: uint32(gm.blockFinalityAPI.GetSetID()),
 		Best: RoundState{
-			Round:           uint32(gm.blockFinalityAPI.GetRound()), //nolint:gosec
+			Round:           uint32(gm.blockFinalityAPI.GetRound()),
 			ThresholdWeight: thresholdWeight(totalWeight),
 			TotalWeight:     totalWeight,
 			Prevotes: Votes{
-				CurrentWeight: uint32(len(votes)), //nolint:gosec
+				CurrentWeight: uint32(len(votes)),
 				Missing:       missingPrevotes,
 			},
 			Precommits: Votes{
-				CurrentWeight: uint32(len(commits)), //nolint:gosec
+				CurrentWeight: uint32(len(commits)),
 				Missing:       missingPrecommits,
 			},
 		},

dot/rpc/modules/system.go

@@ -236,9 +236,9 @@ func (sm *SystemModule) SyncState(r *http.Request, req *EmptyRequest, res *SyncS
 	}
 
 	*res = SyncStateResponse{
-		CurrentBlock:  uint32(h.Number),                      //nolint:gosec
-		HighestBlock:  uint32(sm.syncAPI.HighestBlock()),     //nolint:gosec
-		StartingBlock: uint32(sm.networkAPI.StartingBlock()), //nolint:gosec
+		CurrentBlock:  uint32(h.Number),
+		HighestBlock:  uint32(sm.syncAPI.HighestBlock()),
+		StartingBlock: uint32(sm.networkAPI.StartingBlock()),
 	}
 	return nil
 }

dot/state/block.go

@@ -748,7 +748,7 @@ func (bs *BlockState) retrieveRangeFromDatabase(startHash common.Hash,
 	lastPosition := blocksInRange - 1
 
 	inLoopHash := endHeader.Hash()
-	for currentPosition := int(lastPosition); currentPosition >= 0; currentPosition-- { //nolint:gosec
+	for currentPosition := int(lastPosition); currentPosition >= 0; currentPosition-- {
 		hashes[currentPosition] = inLoopHash
 
 		inLoopHeader, err := bs.loadHeaderFromDatabase(inLoopHash)
@@ -840,12 +840,12 @@ func (bs *BlockState) GetArrivalTime(hash common.Hash) (time.Time, error) {
 	}
 
 	ns := binary.LittleEndian.Uint64(arrivalTime)
-	return time.Unix(0, int64(ns)), nil //nolint:gosec
+	return time.Unix(0, int64(ns)), nil
 }
 
 func (bs *BlockState) setArrivalTime(hash common.Hash, arrivalTime time.Time) error {
 	buf := make([]byte, 8)
-	binary.LittleEndian.PutUint64(buf, uint64(arrivalTime.UnixNano())) //nolint:gosec
+	binary.LittleEndian.PutUint64(buf, uint64(arrivalTime.UnixNano()))
 	return bs.db.Put(arrivalTimeKey(hash), buf)
 }
 

dot/state/epoch.go

@@ -475,7 +475,7 @@ func (s *EpochState) GetConfigData(epoch uint64, header *types.Header) (configDa
 		}
 	}
 
-	for tryEpoch := int(epoch); tryEpoch >= 0; tryEpoch-- { //nolint:gosec
+	for tryEpoch := int(epoch); tryEpoch >= 0; tryEpoch-- {
 		if tryEpoch == 0 {
 			return s.genesisEpochDescriptor.ConfigData, nil
 		}
@@ -819,7 +819,7 @@ func (s *EpochState) GetStartSlotForEpoch(epoch uint64, bestBlockHash common.Has
 				if err != nil {
 					return 0, fmt.Errorf("getting slot duration: %w", err)
 				}
-				return uint64(time.Now().UnixNano()) / uint64(slotDuration.Nanoseconds()), nil //nolint:gosec
+				return uint64(time.Now().UnixNano()) / uint64(slotDuration.Nanoseconds()), nil
 			}
 
 			return 0, fmt.Errorf(

dot/state/grandpa.go

@@ -490,7 +490,7 @@ func (s *GrandpaState) GetSetIDByBlockNumber(blockNumber uint) (uint64, error) {
 
 		curr = curr - 1
 
-		if int(curr) < 0 { //nolint:gosec
+		if int(curr) < 0 {
 			return 0, nil
 		}
 	}

dot/state/inmemory_storage.go

@@ -70,7 +70,7 @@ func (s *InmemoryStorageState) StoreTrie(ts *storage.TrieState, header *types.He
 		}
 
 		err = s.pruner.StoreJournalRecord(
-			deletedNodeHashes, insertedNodeHashes, header.Hash(), int64(header.Number)) //nolint:gosec
+			deletedNodeHashes, insertedNodeHashes, header.Hash(), int64(header.Number))
 		if err != nil {
 			return fmt.Errorf("storing journal record: %w", err)
 		}

dot/state/test_helpers.go

@@ -222,7 +222,7 @@ func AddBlocksToStateWithFixedBranches(t *testing.T, blockState *BlockState, dep
 
 		for i := branch.depth; i < depth; i++ {
 			d, err := types.NewBabePrimaryPreDigest(
-				0, uint64(i+uint(j)+99), [32]byte{}, [64]byte{}).ToPreRuntimeDigest() //nolint:gosec
+				0, uint64(i+uint(j)+99), [32]byte{}, [64]byte{}).ToPreRuntimeDigest()
 			require.NoError(t, err)
 			require.NotNil(t, d)
 			digest := types.NewDigest()

dot/state/transaction.go

@@ -93,7 +93,7 @@ func (s *TransactionState) AddToPool(vt *transaction.ValidTransaction) common.Ha
 	hash := s.pool.Insert(vt)
 
 	s.telemetry.SendMessage(
-		telemetry.NewTxpoolImport(uint(s.queue.Len()), uint(s.pool.Len())), //nolint:gosec
+		telemetry.NewTxpoolImport(uint(s.queue.Len()), uint(s.pool.Len())),
 	)
 
 	return hash

dot/sync/fullsync.go

@@ -111,12 +111,12 @@ func (f *FullSyncStrategy) NextActions() ([]*SyncTask, error) {
 	// our best block is equal or ahead of current target.
 	// in the node's pov we are not legging behind so there's nothing to do
 	// or we didn't receive block announces, so lets ask for more blocks
-	if uint32(bestBlockHeader.Number) >= currentTarget { //nolint:gosec
+	if uint32(bestBlockHeader.Number) >= currentTarget {
 		return f.createTasks(reqsFromQueue), nil
 	}
 
 	startRequestAt := bestBlockHeader.Number + 1
-	targetBlockNumber := startRequestAt + uint(f.numOfTasks)*127 //nolint:gosec
+	targetBlockNumber := startRequestAt + uint(f.numOfTasks)*127
 
 	if targetBlockNumber > uint(currentTarget) {
 		targetBlockNumber = uint(currentTarget)
@@ -327,7 +327,7 @@ func (f *FullSyncStrategy) OnBlockAnnounce(from peer.ID, msg *network.BlockAnnou
 	}
 
 	if msg.BestBlock {
-		f.peers.update(from, blockAnnounceHeaderHash, uint32(blockAnnounceHeader.Number)) //nolint:gosec
+		f.peers.update(from, blockAnnounceHeaderHash, uint32(blockAnnounceHeader.Number))
 	}
 
 	highestFinalized, err := f.blockState.GetHighestFinalisedHeader()
@@ -402,7 +402,7 @@ func (f *FullSyncStrategy) IsSynced() bool {
 	}
 
 	logger.Infof("highest block: %d target %d", highestBlock, f.peers.getTarget())
-	return uint32(highestBlock)+messages.MaxBlocksInResponse >= f.peers.getTarget() //nolint:gosec
+	return uint32(highestBlock)+messages.MaxBlocksInResponse >= f.peers.getTarget()
 }
 
 type RequestResponseData struct {

dot/test_utils.go

@@ -43,7 +43,7 @@ func NewTestGenesisRawFile(t *testing.T, config *cfg.Config) (filename string) {
 	b, err := json.Marshal(gen)
 	require.NoError(t, err)
 
-	err = os.WriteFile(filename, b, os.ModePerm) //nolint:gosec
+	err = os.WriteFile(filename, b, os.ModePerm)
 	require.NoError(t, err)
 
 	return filename

internal/database/pebble.go

@@ -29,7 +29,7 @@ func NewPebble(path string, inMemory bool) (*PebbleDB, error) {
 	if inMemory {
 		opts = &pebble.Options{FS: vfs.NewMem()}
 	} else {
-		if err := os.MkdirAll(path, os.ModePerm); err != nil { //nolint:gosec
+		if err := os.MkdirAll(path, os.ModePerm); err != nil {
 			return nil, err
 		}
 	}