Integrate GolangCI-Lint

[hanzei]

Mattermost is currently in the process of using golangci-lint as the default linter for all go projects. mattermost-community/mattermost-plugin-autolink#108 serves as an example of how the migration should look like:

1. Copy .golangci.yml from https://github.com/mattermost/mattermost-plugin-autolink/ into this repository.
2. Copy Makefile from https://github.com/mattermost/mattermost-plugin-autolink/ into this repository.
3. Copy build/ from https://github.com/mattermost/mattermost-plugin-autolink/ into this repository.
4. Run go mod tidy and make dist to ensure the build system works fine.
5. Update linters-settings.goimports.local-prefixes to the go module path i.e. to github.com/mattermost/mattermost-plugin-aws-SNS.
6. Run make golangci-lint and fix all issues that arise.

Fixing an linter issue is sometimes trivial but can also be quite complicated. There might be cases, where ignoring an issue using issues.exclude-rules is needed. If you don't know how to resolve an error, please reach out to @hanzei on the Mattermost Community Server or ask the question here.

[carantunes]

Hi again! Then can I do this one?

[hanzei]

All yours 👍

[hanzei]

Hey @carantunes, I just want to check how you are doing with the ticket. Do you have any questions?

[hanzei]

Making this available for the public agian

[carantunes]

I'm sorry for my absence, I've been quite busy with work.

I did however start a PR (just pushed it), there's are quite a lot of fixes to be done still. I'm working on it, and will ask you some question about the more tricky ones.

[carantunes]

There are a lot of gosec warning which I believe will be the more tricky. Should I just #nosec?

A sample:

server/expvar/endpoint_test.go:67:7: G404: Use of weak random number generator (math/rand instead of crypto/rand) (gosec)
        r := rand.New(rand.NewSource(time.Now().UnixNano()))
             ^
server/utils/kvstore/hashed_key.go:7:2: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec)
        "crypto/md5"
        ^
server/utils/kvstore/hashed_key.go:76:7: G401: Use of weak cryptographic primitive (gosec)
        h := md5.New()
             ^
server/http.go:47:2: G101: Potential hardcoded credentials (gosec)
        routeACUserRedirectWithToken                = "/ac/user_redirect.html"
        ^
server/kv.go:7:2: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec)
        "crypto/md5"
        ^
server/kv.go:89:7: G401: Use of weak cryptographic primitive (gosec)
        h := md5.New()
             ^
server/kv.go:95:7: G401: Use of weak cryptographic primitive (gosec)
        h := md5.New()
             ^
server/kv.go:370:20: G403: RSA keys should be at least 2048 bits (gosec)
                newRSAKey, err = rsa.GenerateKey(rand.Reader, 1024)
                                 ^
server/stats.go:4:2: G501: Blocklisted import crypto/md5: weak cryptographic primitive (gosec)
        "crypto/md5"
        ^
server/stats.go:96:8: G404: Use of weak random number generator (math/rand instead of crypto/rand) (gosec)
                r := rand.New(rand.NewSource(time.Now().UnixNano()))
                     ^
server/command_test.go:299:22: G403: RSA keys should be at least 2048 bits (gosec)
                                conf.rsaKey, _ = rsa.GenerateKey(rand.Reader, 1024)
                                                 ^
server/http_test.go:104:18: G601: Implicit memory aliasing in for loop. (gosec)
                                                foundSub = &savedSub
                                                           ^
server/jira_test_util_test.go:29:19: G601: Implicit memory aliasing in for loop. (gosec)
                ret.Channel.add(&sub)
                                ^

[hanzei]

@carantunes Awesome, thanks for pushing that PR 👍

Yes, the md5 related warning can be ignored using nosec. I'm not sure about the G601. Could you double check if they are valid?