Add Sigsum support to tkey-verification

.github/workflows/ci.yaml

@@ -26,12 +26,12 @@ jobs:
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
-      - name: check for SPDX tags
-        run: ./tools/spdx-ensure
-
       - name: make
         run: make
 
+      - name: tests
+        run: go test ./...
+
   reuse-compliance-check:
     runs-on: ubuntu-latest
     steps:

.github/workflows/golangci-lint.yml

@@ -7,48 +7,19 @@ on:
 
 permissions:
   contents: read
-  # Optional: allow read access to pull request. Use with `only-new-issues` option.
+  # Optional: allow read access to pull requests. Use with `only-new-issues` option.
   # pull-requests: read
 
 jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-go@v6
         with:
-          go-version: '1.21'
-          cache: false
+          go-version: stable
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v8
         with:
-          # Require: The version of golangci-lint to use.
-          # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
-          # When `install-mode` is `goinstall` the value can be v1.2.3, `latest`, or the hash of a commit.
-          version: v1.55.2
-
-          # Optional: working directory, useful for monorepos
-          # working-directory: somedir
-
-          # Optional: golangci-lint command line arguments.
-          #
-          # Note: By default, the `.golangci.yml` file should be at the root of the repository.
-          # The location of the configuration file can be changed by using `--config=`
-          # args: --timeout=30m --config=/my/path/.golangci.yml --issues-exit-code=0 
-
-          # Optional: show only new issues if it's a pull request. The default value is `false`.
-          # only-new-issues: true
-
-          # Optional: if set to true, then all caching functionality will be completely disabled,
-          #           takes precedence over all other caching options.
-          # skip-cache: true
-
-          # Optional: if set to true, then the action won't cache or restore ~/go/pkg.
-          # skip-pkg-cache: true
-
-          # Optional: if set to true, then the action won't cache or restore ~/.cache/go-build.
-          # skip-build-cache: true
-
-          # Optional: The mode to install golangci-lint. It can be 'binary' or 'goinstall'.
-          # install-mode: "goinstall"
+          version: v2.4

.gitignore

@@ -1,6 +1,8 @@
 /dist
 /show-pubkey
 /tkey-verification
+/tkey-sigsum-submit
+/tkey-verify
 /certs
 
 

.golangci.yml

@@ -1,37 +1,92 @@
+version: "2"
 linters:
-  presets:
-    # found in: golangci-lint help linters
-    - bugs
-    - comment
-    - complexity
-    - error
-    - format
-    - import
-    - metalinter
-    - module
-    - performance
-    - sql
-    # - style  # turned off, can be too much
-    - test
-    - unused
+  enable:
+    - asasalint
+    - asciicheck
+    - bidichk
+    - bodyclose
+    - contextcheck
+    - dupword
+    - durationcheck
+    - errchkjson
+    - errorlint
+    - exhaustive
+    - fatcontext
+    - gocheckcompilerdirectives
+    - gochecksumtype
+    - gocritic
+    - gocyclo
+    - godox
+    - gomoddirectives
+    - gomodguard
+    - gosec
+    - gosmopolitan
+    - loggercheck
+    - maintidx
+    - makezero
+    - misspell
+    - musttag
+    - nilerr
+    - nilnesserr
+    - perfsprint
+    - prealloc
+    - protogetter
+    - reassign
+    - recvcheck
+    - revive
+    - rowserrcheck
+    - spancheck
+    - sqlclosecheck
+    - testableexamples
+    - testifylint
+    - thelper
+    - tparallel
+    - usetesting
+    - wrapcheck
+    - zerologlint
   disable:
     - cyclop
+    - depguard
+    - exhaustruct
     - funlen
-    - gci
     - gocognit
-    - gofumpt
-    - nestif
-    - exhaustruct  # TODO? annoying for now
     - godot
-    - depguard
+    - nestif
     - noctx
     - unparam
-
+    - err113
+    - paralleltest
+    - recvcheck
+    - testpackage
+  settings:
+    govet:
+      enable:
+        - shadow
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+    rules:
+      - linters:
+          - revive
+        text: "var-naming: avoid meaningless package names"
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0
-
-linters-settings:
-  govet:
-    enable:
-      - shadow
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Makefile

@@ -2,19 +2,28 @@ shasum = sha512sum
 CGO = 0
 
 .PHONY: all
-all: tkey-verification
+all: tkey-sigsum-submit tkey-verification tkey-verify
 
 # APP_VERSION ?= $(shell git describe --dirty --always | sed -n "s/^v\(.*\)/\1/p")
 APP_VERSION ?= $(shell git describe --dirty --always | sed -n "s/^v\(.*\)/\1/p")
+
 # .PHONY to let go-build handle deps and rebuilds
+.PHONY: tkey-sigsum-submit
+tkey-sigsum-submit:
+	CGO_ENABLED=$(CGO) go build -ldflags "-w -X main.version=$(APP_VERSION) -buildid=" -trimpath -buildvcs=false ./cmd/tkey-sigsum-submit
+
+.PHONY: tkey-verify
+tkey-verify:
+	CGO_ENABLED=$(CGO) go build -ldflags "-w -X main.version=$(APP_VERSION) -buildid=" -trimpath -buildvcs=false ./cmd/tkey-verify
+
 .PHONY: tkey-verification
 tkey-verification:
 	CGO_ENABLED=$(CGO) go build -ldflags "-w -X main.version=$(APP_VERSION) -buildid=" -trimpath -buildvcs=false ./cmd/tkey-verification
 	./tkey-verification --version
 
 .PHONY: podman
 podman:
-	podman run --arch=amd64 --rm --mount type=bind,source=$(CURDIR),target=/src -w /src -it ghcr.io/tillitis/tkey-builder:4 make -j
+	podman run --arch=amd64 --rm --mount type=bind,source=$(CURDIR),target=/src -w /src -it ghcr.io/tillitis/tkey-builder:5rc2 make -j
 
 .PHONY: check-digests
 check-digests:
@@ -23,14 +32,22 @@ check-digests:
 	$(shasum) -c verisigner-v0.0.3.bin.sha512
 
 .PHONY: man
-man: doc/tkey-verification.1
+man: doc/tkey-verification.1 doc/tkey-verify.1 doc/tkey-sigsum-submit.1
 
 doc/tkey-verification.1: doc/tkey-verification.scd
 	scdoc < $^ > $@
 
+doc/tkey-verify.1: doc/tkey-verify.scd
+	scdoc < $^ > $@
+
+doc/tkey-sigsum-submit.1: doc/tkey-sigsum-submit.scd
+	scdoc < $^ > $@
+
 .PHONY: clean
 clean:
+	rm -f tkey-sigsum-submit
 	rm -f tkey-verification
+	rm -f tkey-verify
 
 .PHONY: lint
 lint: