update Go version and linter (#526)

* support symlinks for archive creation (#559)

* support symlinks for archive creation

* fix transporting signatures in overwrite mode

* 1.21 + take versions from sources

.github/workflows/lint_and_test.yaml

@@ -66,7 +66,8 @@ jobs:
           go install golang.org/x/tools/cmd/goimports@latest
       - name: Setup lint
         run: |
-          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.49.0
+          make -f hack/Makefile golangci-lint
+          #curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.54.2
       - name: Lint
         run: |
           PATH=$PATH:$(go env GOPATH)/bin make check

.golangci.yaml

@@ -1,5 +1,5 @@
 run:
-  go: "1.19"
+  go: "1.21"
   timeout: 10m
   tests: false
   allow-parallel-runners: true
@@ -73,6 +73,9 @@ linters:
 
 
     # Disabled with reason
+    - nakedret
+    - depguard
+    - mirror
     - dogsled
     - exhaustruct      # Doesn't really make sense.
     - exhaustive       # Doesn't really make sense.

docs/pluginreference/plugin_accessmethod_compose.md

@@ -28,7 +28,7 @@ If possible, predefined standard options should be used. In such a case only the
 <code>name</code> field should be defined for an option. If required, new options can be
 defined by additionally specifying a type and a description. New options should
 be used very carefully. The chosen names MUST not conflict with names provided
-by other plugins. Therefore, it is highly recommended to use use names prefixed
+by other plugins. Therefore, it is highly recommended to use names prefixed
 by the plugin name.
 
 

docs/pluginreference/plugin_descriptor.md

@@ -114,7 +114,7 @@ It uses the following fields:
   an option. If required, new options can be defined by additionally specifying
   a type and a description. New options should be used very carefully. The
   chosen names MUST not conflict with names provided by other plugins. Therefore
-  it is highly recommended to use use names prefixed by the plugin name.
+  it is highly recommended to use names prefixed by the plugin name.
 
 
 The following predefined option types can be used:
@@ -240,7 +240,7 @@ The descriptor for an action has the following fields:
   element the action should work on. But it might be, that other credentials
   are required to fulfill its task. Therefore, the action can request a dedicated
   consumer type used to lookup the credentials. The consumer attributes are
-  derived from the the action specification and cannot be influenced by the
+  derived from the action specification and cannot be influenced by the
   plugin.
 
 ### Value Merge Handler Descriptor

docs/pluginreference/plugin_valuemergehandler_execute.md

@@ -15,7 +15,7 @@ plugin valuemergehandler execute <name> <spec> [<options>]
 ### Description
 
 
-This command executes a a value merge. The values are taken from *stdin* as JSON
+This command executes a value merge. The values are taken from *stdin* as JSON
 string. It has the following fields:
 
 - **<code>local</code>** *any*
@@ -24,7 +24,7 @@ string. It has the following fields:
 
 - **<code>inbound</code>** *any*
 
-  The value to merge into. THis value is based on the original inbound value.
+  The value to merge into. This value is based on the original inbound value.
 
 This action has to provide an execution result as JSON string on *stdout*. It has the
 following fields:

docs/pluginreference/plugin_valueset.md

@@ -14,7 +14,7 @@ plugin valueset [<options>] <sub command> ...
 
 ### Description
 
-This command group provides all commands used to implement a a value set
+This command group provides all commands used to implement a value set
 described by a value set descriptor ([plugin descriptor](plugin_descriptor.md).
 
 ### SEE ALSO

docs/pluginreference/plugin_valueset_compose.md

@@ -28,7 +28,7 @@ If possible, predefined standard options should be used. In such a case only the
 <code>name</code> field should be defined for an option. If required, new options can be
 defined by additionally specifying a type and a description. New options should
 be used very carefully. The chosen names MUST not conflict with names provided
-by other plugins. Therefore, it is highly recommended to use use names prefixed
+by other plugins. Therefore, it is highly recommended to use names prefixed
 by the plugin name.
 
 

docs/reference/ocm_ocm-uploadhandlers.md

@@ -42,7 +42,7 @@ The following handler names are possible:
 
   - <code>ocm/ociArtifacts</code>: downloading OCI artifacts
 
-    The <code>ociArtifacts</code> downloader is able to to download OCI artifacts
+    The <code>ociArtifacts</code> downloader is able to download OCI artifacts
     as artifact archive according to the OCI distribution spec.
     The following artifact media types are supported:
       - <code>application/vnd.oci.image.manifest.v1+tar</code>

docs/reference/ocm_transfer_commontransportarchive.md

@@ -111,7 +111,7 @@ The uploader name may be a path expression with the following possibilities:
 
   - <code>ocm/ociArtifacts</code>: downloading OCI artifacts
 
-    The <code>ociArtifacts</code> downloader is able to to download OCI artifacts
+    The <code>ociArtifacts</code> downloader is able to download OCI artifacts
     as artifact archive according to the OCI distribution spec.
     The following artifact media types are supported:
       - <code>application/vnd.oci.image.manifest.v1+tar</code>

docs/reference/ocm_transfer_componentversions.md

@@ -167,7 +167,7 @@ The uploader name may be a path expression with the following possibilities:
 
   - <code>ocm/ociArtifacts</code>: downloading OCI artifacts
 
-    The <code>ociArtifacts</code> downloader is able to to download OCI artifacts
+    The <code>ociArtifacts</code> downloader is able to download OCI artifacts
     as artifact archive according to the OCI distribution spec.
     The following artifact media types are supported:
       - <code>application/vnd.oci.image.manifest.v1+tar</code>

go.mod

@@ -1,6 +1,6 @@
 module github.com/open-component-model/ocm
 
-go 1.19
+go 1.21
 
 replace github.com/spf13/cobra => github.com/open-component-model/cobra v0.0.0-20230329075350-b1fd876abfb9
 

hack/Makefile

@@ -33,7 +33,7 @@ ifeq ("v$(JQ)","v0.0")
 	deps += $(detected_OS)_jq
 endif
 
-GOLANGCILINT_VERSION := "v1.49.0"
+GOLANGCILINT_VERSION := "v1.54.2"
 GOLANGCILINTV := $(shell (golangci-lint --version 2>/dev/null || echo 0.0.0) | sed 's/.*v\([0-9\.]*\) .*/\1/')
 ifneq ("v$(GOLANGCILINTV)",$(GOLANGCILINT_VERSION))
   deps += golangci-lint
@@ -50,7 +50,13 @@ install-requirements: $(deps) $(GOPATH)/bin/goimports
 
 .PHONY: golangci-lint
 golangci-lint:
-	go install -v github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCILINT_VERSION)
+	@# no recommended by website
+	@# go install -v github.com/golangci/golangci-lint/cmd/golangci-lint@$(GOLANGCILINT_VERSION)
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(shell go env GOPATH)/bin $(GOLANGCILINT_VERSION)
+
+.PHONY: golangci-lint-version
+golangci-lint-version:
+	@echo "$(GOLANGCILINT_VERSION)"
 
 .PHONY: go-bindata
 go-bindata:

hack/install-requirements.sh

@@ -9,7 +9,9 @@ PROJECT_ROOT="${CURRENT_DIR}"/..
 
 echo "> Install Go packages/binaries"
 
-curl -sfL "https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh" | sh -s -- -b $(go env GOPATH)/bin  v1.49.0
+curl -sfL "https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh" | sh -s -- -b $(go env GOPATH)/bin v1.54.2
+
+GO111MODULE=off go get -u github.com/go-bindata/go-bindata/...
 
 go install github.com/go-bindata/go-bindata/v3/[email protected]
 go install golang.org/x/tools/cmd/goimports@latest

pkg/cobrautils/flag/labelledstring.go

@@ -31,12 +31,12 @@ func (i *labelledStringValue) String() string {
 }
 
 func (i *labelledStringValue) Set(s string) error {
-	idx := strings.Index(s, "=")
-	if idx <= 0 {
+	name, value, found := strings.Cut(s, "=")
+	if !found {
 		return fmt.Errorf("expected <name>=<value>")
 	}
-	i.Name = s[:idx]
-	i.Value = s[idx+1:]
+	i.Name = name
+	i.Value = value
 	return nil
 }
 

pkg/common/accessio/blobaccess/standard.go

@@ -103,10 +103,7 @@ func ProviderForData(mime string, data []byte) BlobAccessProvider {
 	})
 }
 
-type (
-	_blobAccess     = BlobAccess
-	_blobAccessBase = spi.BlobAccessBase
-)
+type _blobAccess = BlobAccess
 
 ////////////////////////////////////////////////////////////////////////////////
 

pkg/common/accessio/resource/doc.go

@@ -81,7 +81,7 @@
 // It implements the minimal implementation interface and offers with
 // the method View a way to create additional views. It can just be
 // instantiated for the base usage.
-// Using the creator NewResourceImplBase is is possible to support
+// Using the creator NewResourceImplBase it is possible to support
 //   - nested use-cases, where an implementations hold a reference
 //     on a parent object
 //   - additional closers are required.

pkg/common/iotools/utils.go

@@ -10,8 +10,6 @@ import (
 
 type NopCloser struct{}
 
-type _nopCloser = NopCloser
-
 func (NopCloser) Close() error {
 	return nil
 }

pkg/contexts/oci/repositories/ctf/testhelper/fill.go

@@ -18,6 +18,7 @@ import (
 	"github.com/open-component-model/ocm/pkg/testutils"
 )
 
+//nolint:gosec // digests of test manifests
 const (
 	TAG             = "v1"
 	DIGEST_MANIFEST = "3d05e105e350edf5be64fe356f4906dd3f9bf442a279e4142db9879bba8e677a"

pkg/contexts/oci/testhelper/manifests.go

@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
+//nolint:gosec // digests of test manifests
 package testhelper
 
 import (

pkg/contexts/ocm/blobhandler/handlers/generic/ocirepo/registration.go

@@ -66,7 +66,7 @@ func (r *RegistrationHandler) RegisterByName(handler string, ctx cpi.Context, co
 
 func (r *RegistrationHandler) GetHandlers(ctx cpi.Context) registrations.HandlerInfos {
 	return registrations.NewLeafHandlerInfo("downloading OCI artifacts", `
-The <code>ociArtifacts</code> downloader is able to to download OCI artifacts
+The <code>ociArtifacts</code> downloader is able to download OCI artifacts
 as artifact archive according to the OCI distribution spec.
 The following artifact media types are supported:
 `+listformat.FormatList("", artdesc.ArchiveBlobTypes()...)+`

pkg/contexts/ocm/cpi/view_rsc.go

@@ -25,8 +25,6 @@ var _ AccessProvider = (*ComponentVersionBasedAccessProvider)(nil)
 // Deprecated: use ComponentVersionBasedAccessProvider.
 type BaseAccess = ComponentVersionBasedAccessProvider
 
-type cvBaseAccess = ComponentVersionBasedAccessProvider
-
 func NewBaseAccess(cv ComponentVersionAccess, acc compdesc.AccessSpec) *ComponentVersionBasedAccessProvider {
 	return &ComponentVersionBasedAccessProvider{vers: cv, access: acc}
 }

pkg/contexts/ocm/interface.go

@@ -197,7 +197,7 @@ func BlobAccessForAccessMethod(m AccessMethodView) (blobaccess.AnnotatedBlobAcce
 // a multi-view version. The original method is closed when
 // the last view is closed.
 // After an access method is used as base object, it should not
-// explicitly closed anymore, because the the views will stop
+// explicitly closed anymore, because the views will stop
 // functioning.
 func AccessMethodAsView(acc ocm.AccessMethod, closer ...io.Closer) AccessMethodView {
 	return cpi.AccessMethodAsView(acc, closer...)

pkg/contexts/ocm/plugin/internal/access.go

@@ -9,8 +9,8 @@ import (
 )
 
 type AccessSpecInfo struct {
-	Short      string
-	MediaType  string
-	Hint       string
-	ConsumerId credentials.ConsumerIdentity
+	Short      string                       `json:"short"`
+	MediaType  string                       `json:"mediaType"`
+	Hint       string                       `json:"hint"`
+	ConsumerId credentials.ConsumerIdentity `json:"consumerId"`
 }

pkg/contexts/ocm/plugin/internal/upload.go

@@ -9,5 +9,5 @@ import (
 )
 
 type UploadTargetSpecInfo struct {
-	ConsumerId credentials.ConsumerIdentity
+	ConsumerId credentials.ConsumerIdentity `json:"consumerId"`
 }

pkg/contexts/ocm/plugin/ppi/cmds/accessmethod/compose/cmd.go

@@ -38,7 +38,7 @@ If possible, predefined standard options should be used. In such a case only the
 <code>name</code> field should be defined for an option. If required, new options can be
 defined by additionally specifying a type and a description. New options should
 be used very carefully. The chosen names MUST not conflict with names provided
-by other plugins. Therefore, it is highly recommended to use use names prefixed
+by other plugins. Therefore, it is highly recommended to use names prefixed
 by the plugin name.
 
 ` + options.DefaultRegistry.Usage(),

pkg/contexts/ocm/plugin/ppi/cmds/mergehandler/execute/cmd.go

@@ -30,7 +30,7 @@ func New(p ppi.Plugin) *cobra.Command {
 		Use:   Name + " <name> <spec>",
 		Short: "execute a value merge",
 		Long: `
-This command executes a a value merge. The values are taken from *stdin* as JSON
+This command executes a value merge. The values are taken from *stdin* as JSON
 string. It has the following fields: 
 
 - **<code>local</code>** *any*
@@ -39,7 +39,7 @@ string. It has the following fields:
 
 - **<code>inbound</code>** *any*
 
-  The value to merge into. THis value is based on the original inbound value.
+  The value to merge into. This value is based on the original inbound value.
 
 This action has to provide an execution result as JSON string on *stdout*. It has the 
 following fields: 

pkg/contexts/ocm/plugin/ppi/cmds/topics/descriptor/topic.go

@@ -158,7 +158,7 @@ It uses the following fields:
   an option. If required, new options can be defined by additionally specifying
   a type and a description. New options should be used very carefully. The
   chosen names MUST not conflict with names provided by other plugins. Therefore
-  it is highly recommended to use use names prefixed by the plugin name.
+  it is highly recommended to use names prefixed by the plugin name.
 
 ` + options.DefaultRegistry.Usage() + `
 
@@ -254,7 +254,7 @@ The descriptor for an action has the following fields:
   element the action should work on. But it might be, that other credentials
   are required to fulfill its task. Therefore, the action can request a dedicated
   consumer type used to lookup the credentials. The consumer attributes are
-  derived from the the action specification and cannot be influenced by the
+  derived from the action specification and cannot be influenced by the
   plugin.
 
 ### Value Merge Handler Descriptor

pkg/contexts/ocm/plugin/ppi/cmds/valueset/cmd.go

@@ -18,7 +18,7 @@ func New(p ppi.Plugin) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:   Name,
 		Short: "valueset operations",
-		Long: `This command group provides all commands used to implement a a value set
+		Long: `This command group provides all commands used to implement a value set
 described by a value set descriptor (<CMD>` + p.Name() + ` descriptor</CMD>.`,
 	}
 

pkg/contexts/ocm/plugin/ppi/cmds/valueset/compose/cmd.go

@@ -39,7 +39,7 @@ If possible, predefined standard options should be used. In such a case only the
 <code>name</code> field should be defined for an option. If required, new options can be
 defined by additionally specifying a type and a description. New options should
 be used very carefully. The chosen names MUST not conflict with names provided
-by other plugins. Therefore, it is highly recommended to use use names prefixed
+by other plugins. Therefore, it is highly recommended to use names prefixed
 by the plugin name.
 
 ` + options.DefaultRegistry.Usage(),

pkg/contexts/ocm/testhelper/resources.go

@@ -2,6 +2,7 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
+//nolint:gosec // digests of test manifests
 package testhelper
 
 import (

pkg/contexts/ocm/valuemergehandler/handlers/maplistmerge/handler.go

@@ -19,9 +19,11 @@ func init() {
 	hpi.Register(New())
 }
 
-// Value is the minimal structure of values usable with the merge algorithm.
-type Value = []Entry
-type Entry = map[string]interface{}
+type (
+	// Value is the minimal structure of values usable with the merge algorithm.
+	Value = []Entry
+	Entry = map[string]interface{}
+)
 
 func New() hpi.Handler {
 	return hpi.New(ALGORITHM, desc, merge)

pkg/contexts/ocm/valuemergehandler/handlers/simplelistmerge/handler.go

@@ -16,9 +16,11 @@ func init() {
 	hpi.Register(New())
 }
 
-// Value is the minimal structure of values usable with the merge algorithm.
-type Value = []Entry
-type Entry = interface{}
+type (
+	// Value is the minimal structure of values usable with the merge algorithm.
+	Value = []Entry
+	Entry = interface{}
+)
 
 func New() hpi.Handler {
 	return hpi.New(ALGORITHM, desc, merge)

pkg/contexts/ocm/valuemergehandler/handlers/simplemapmerge/handler.go

@@ -18,9 +18,11 @@ func init() {
 	hpi.Register(New())
 }
 
-// Value is the minimal structure of values usable with the merge algorithm.
-type Value = map[string]Entry
-type Entry = interface{}
+type (
+	// Value is the minimal structure of values usable with the merge algorithm.
+	Value = map[string]Entry
+	Entry = interface{}
+)
 
 func New() hpi.Handler {
 	return hpi.New(ALGORITHM, desc, merge)

pkg/runtime/datatypes.go

@@ -25,7 +25,6 @@ type (
 	TypeInfo interface {
 		TypeGetter
 	}
-	_TypeInfo = TypeInfo
 )
 
 type (