fixing some of the missed/ignored errors

build-index/cmd/cmd.go

@@ -32,6 +32,7 @@ import (
 	"github.com/uber/kraken/metrics"
 	"github.com/uber/kraken/nginx"
 	"github.com/uber/kraken/origin/blobclient"
+	"github.com/uber/kraken/utils/closers"
 	"github.com/uber/kraken/utils/configutil"
 	"github.com/uber/kraken/utils/log"
 
@@ -116,7 +117,10 @@ func Run(flags *Flags, opts ...Option) {
 		log.SetGlobalLogger(overrides.logger.Sugar())
 	} else {
 		zlog := log.ConfigureLogger(config.ZapLogging)
-		defer zlog.Sync()
+		defer func() {
+			// if flushing logs fails, we can't do anything about the error.
+			_ = zlog.Sync() //nolint:errcheck
+		}()
 	}
 
 	stats := overrides.metrics
@@ -126,7 +130,7 @@ func Run(flags *Flags, opts ...Option) {
 			log.Fatalf("Failed to init metrics: %s", err)
 		}
 		stats = s
-		defer closer.Close()
+		defer closers.Close(closer)
 	}
 
 	go metrics.EmitVersion(stats)

build-index/tagserver/server.go

@@ -142,7 +142,10 @@ func (s *Server) ListenAndServe() error {
 }
 
 func (s *Server) healthHandler(w http.ResponseWriter, r *http.Request) error {
-	fmt.Fprintln(w, "OK")
+	_, err := fmt.Fprintln(w, "OK")
+	if err != nil {
+		return handler.Errorf("write health check: %s", err)
+	}
 	return nil
 }
 
@@ -155,7 +158,10 @@ func (s *Server) readinessCheckHandler(w http.ResponseWriter, r *http.Request) e
 	if err != nil {
 		return handler.Errorf("not ready to serve traffic: %s", err).Status(http.StatusServiceUnavailable)
 	}
-	fmt.Fprintln(w, "OK")
+	_, err = fmt.Fprintln(w, "OK")
+	if err != nil {
+		return handler.Errorf("write readiness check: %s", err)
+	}
 	return nil
 }
 

core/digester_test.go

@@ -40,7 +40,8 @@ func TestFromBytes(t *testing.T) {
 	require := require.New(t)
 
 	d := NewDigester()
-	d.FromBytes([]byte(_testStr))
+	_, err := d.FromBytes([]byte(_testStr))
+	require.NoError(err)
 
 	hexDigest := d.Digest().Hex()
 	require.NoError(ValidateSHA256(hexDigest))
@@ -52,7 +53,8 @@ func TestFromReader(t *testing.T) {
 
 	d := NewDigester()
 	r := strings.NewReader(_testStr)
-	d.FromReader(r)
+	_, err := d.FromReader(r)
+	require.NoError(err)
 
 	hexDigest := d.Digest().Hex()
 	require.NoError(ValidateSHA256(hexDigest))

lib/backend/gcsbackend/client.go

@@ -20,6 +20,8 @@ import (
 	"io"
 	"path"
 
+	"github.com/uber/kraken/utils/closers"
+
 	"github.com/uber-go/tally"
 	"github.com/uber/kraken/core"
 	"github.com/uber/kraken/lib/backend"
@@ -245,7 +247,7 @@ func (g *GCSImpl) Download(objectName string, w io.Writer) (int64, error) {
 		}
 		return 0, err
 	}
-	defer rc.Close()
+	defer closers.Close(rc)
 
 	r, err := io.CopyN(w, rc, int64(g.config.BufferGuard))
 	if err != nil && err != io.EOF {

lib/backend/httpbackend/http.go

@@ -20,6 +20,8 @@ import (
 	"io"
 	"time"
 
+	"github.com/uber/kraken/utils/closers"
+
 	"github.com/uber-go/tally"
 	"github.com/uber/kraken/core"
 	"github.com/uber/kraken/lib/backend"
@@ -105,7 +107,7 @@ func (c *Client) Download(namespace, name string, dst io.Writer) error {
 		}
 		return err
 	}
-	defer resp.Body.Close()
+	defer closers.Close(resp.Body)
 	if _, err := io.Copy(dst, resp.Body); err != nil {
 		return fmt.Errorf("copy: %s", err)
 	}

lib/backend/httpbackend/http_test.go

@@ -68,7 +68,8 @@ func TestHttpDownloadFileNotFound(t *testing.T) {
 	r := chi.NewRouter()
 	r.Get("/data/{blob}", func(w http.ResponseWriter, req *http.Request) {
 		w.WriteHeader(http.StatusNotFound)
-		w.Write([]byte("file not found"))
+		_, err := w.Write([]byte("file not found"))
+		require.NoError(err)
 	})
 	addr, stop := testutil.StartServer(r)
 	defer stop()

lib/backend/registrybackend/blobclient.go

@@ -20,6 +20,8 @@ import (
 	"net/http"
 	"strconv"
 
+	"github.com/uber/kraken/utils/closers"
+
 	"github.com/uber-go/tally"
 	"github.com/uber/kraken/core"
 	"github.com/uber/kraken/lib/backend"
@@ -145,7 +147,7 @@ func (c *BlobClient) downloadHelper(namespace, name, query string, dst io.Writer
 		}
 		return fmt.Errorf("get blob: %s", err)
 	}
-	defer resp.Body.Close()
+	defer closers.Close(resp.Body)
 
 	if _, err := io.Copy(dst, resp.Body); err != nil {
 		return fmt.Errorf("copy: %s", err)

lib/backend/registrybackend/blobclient_test.go

@@ -108,7 +108,8 @@ func TestBlobDownloadFileNotFound(t *testing.T) {
 	r := chi.NewRouter()
 	r.Get(fmt.Sprintf("/v2/%s/blobs/{blob}", namespace), func(w http.ResponseWriter, req *http.Request) {
 		w.WriteHeader(http.StatusNotFound)
-		w.Write([]byte("file not found"))
+		_, err := w.Write([]byte("file not found"))
+		require.NoError(err)
 	})
 	r.Head(fmt.Sprintf("/v2/%s/blobs/{blob}", namespace), func(w http.ResponseWriter, req *http.Request) {
 		w.WriteHeader(http.StatusNotFound)

lib/backend/testfs/client.go

@@ -26,8 +26,8 @@ import (
 	"github.com/uber/kraken/lib/backend"
 	"github.com/uber/kraken/lib/backend/backenderrors"
 	"github.com/uber/kraken/lib/backend/namepath"
+	"github.com/uber/kraken/utils/closers"
 	"github.com/uber/kraken/utils/httputil"
-
 	"go.uber.org/zap"
 	"gopkg.in/yaml.v2"
 )
@@ -127,7 +127,7 @@ func (c *Client) Download(namespace, name string, dst io.Writer) error {
 		}
 		return err
 	}
-	defer resp.Body.Close()
+	defer closers.Close(resp.Body)
 	if _, err := io.Copy(dst, resp.Body); err != nil {
 		return fmt.Errorf("copy: %s", err)
 	}
@@ -150,7 +150,7 @@ func (c *Client) List(prefix string, opts ...backend.ListOption) (*backend.ListR
 	if err != nil {
 		return nil, err
 	}
-	defer resp.Body.Close()
+	defer closers.Close(resp.Body)
 	var paths []string
 	if err := json.NewDecoder(resp.Body).Decode(&paths); err != nil {
 		return nil, fmt.Errorf("json: %s", err)

lib/backend/testfs/server.go

@@ -24,6 +24,8 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/uber/kraken/utils/log"
+
 	"github.com/uber/kraken/utils/handler"
 
 	"github.com/go-chi/chi"
@@ -57,11 +59,17 @@ func (s *Server) Handler() http.Handler {
 
 // Cleanup cleans up the underlying directory of s.
 func (s *Server) Cleanup() {
-	os.RemoveAll(s.dir)
+	err := os.RemoveAll(s.dir)
+	if err != nil {
+		log.Error(err)
+	}
 }
 
 func (s *Server) healthHandler(w http.ResponseWriter, r *http.Request) {
-	w.Write([]byte("OK"))
+	_, err := w.Write([]byte("OK"))
+	if err != nil {
+		log.Error(err)
+	}
 }
 
 func (s *Server) statHandler(w http.ResponseWriter, r *http.Request) error {

lib/containerruntime/containerd/client.go

@@ -16,6 +16,7 @@ package containerd
 import (
 	"context"
 	"fmt"
+	"github.com/uber/kraken/utils/closers"
 
 	"github.com/containerd/containerd"
 )
@@ -38,7 +39,7 @@ func (c *Impl) PullImage(ctx context.Context, ns, repo, tag string) error {
 	if err != nil {
 		return fmt.Errorf("new containerd client: %s", err)
 	}
-	defer client.Close()
+	defer closers.Close(client)
 
 	_, err = client.Pull(ctx, fmt.Sprintf("%s/%s:%s", c.registry, repo, tag), containerd.WithPullUnpack)
 	if err != nil {

lib/dockerregistry/blobs.go

@@ -21,6 +21,8 @@ import (
 	"os"
 	"time"
 
+	"github.com/uber/kraken/utils/closers"
+
 	"github.com/uber/kraken/lib/dockerregistry/transfer"
 	"github.com/uber/kraken/lib/store"
 
@@ -86,7 +88,7 @@ func (b *blobs) getContent(ctx context.Context, path string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	defer r.Close()
+	defer closers.Close(r)
 	return io.ReadAll(r)
 }
 

lib/dockerregistry/manifests.go

@@ -18,6 +18,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/uber/kraken/utils/closers"
+
 	"github.com/uber-go/tally"
 	"github.com/uber/kraken/lib/store"
 
@@ -117,13 +119,17 @@ func (t *manifests) getDigest(path string, subtype PathSubType) ([]byte, error)
 	if err != nil {
 		return nil, fmt.Errorf("transferer download: %w", err)
 	}
-	defer blob.Close()
+	defer closers.Close(blob)
 
 	// Only verify if we haven't already verified this (repo, digest) combination
 	cacheKey := fmt.Sprintf("%s:%s", repo, digest.String())
 	shouldEmitMetrics := !t.verifiedCache.Has(cacheKey)
 
-	_, _ = t.verify(path, repo, digest, blob, shouldEmitMetrics)
+	// Signature verification is currently not enforced: errors from t.verify are ignored.
+	// This is intentional because verification enforcement is planned for a future release.
+	// Risks: manifests may be accepted without verification, which could allow untrusted content.
+	// TODO: Remove error ignoring and enforce verification once the feature is activated.
+	_, _ = t.verify(path, repo, digest, blob, shouldEmitMetrics) //nolint:errcheck
 
 	if shouldEmitMetrics {
 		t.verifiedCache.Add(cacheKey)

lib/dockerregistry/storage_driver_test.go

@@ -160,20 +160,20 @@ func TestStorageDriverWriter(t *testing.T) {
 	content := []byte("this is a test for upload writer")
 	for _, tc := range testCases {
 		t.Run(fmt.Sprintf("GetWriter %s", tc.input), func(t *testing.T) {
-			require := require.New(t)
 			w, err := sd.Writer(contextFixture(), tc.input, false)
-			require.Equal(tc.err, err)
+			require.Equal(t, tc.err, err)
 			if err != nil {
 				return
 			}
-			w.Write(content)
-			w.Close()
+			_, err = w.Write(content)
+			require.NoError(t, err)
+			require.NoError(t, w.Close())
 			r, err := sd.Reader(contextFixture(), tc.input, 0)
-			require.NoError(err)
-			defer r.Close()
+			require.NoError(t, err)
 			data, err := io.ReadAll(r)
-			require.NoError(err)
-			require.Equal(content, data)
+			require.NoError(t, err)
+			require.Equal(t, content, data)
+			require.NoError(t, r.Close())
 		})
 	}
 }

lib/dockerregistry/testutils_test.go

@@ -73,8 +73,16 @@ func (d *testDriver) setup() (*KrakenStorageDriver, testImageUploadBundle) {
 	if err != nil {
 		log.Panic(err)
 	}
-	defer writer.Close()
-	writer.Write([]byte(uploadContent))
+	defer func() {
+		err := writer.Close()
+		if err != nil {
+			log.Panic(err)
+		}
+	}()
+	_, err = writer.Write([]byte(uploadContent))
+	if err != nil {
+		log.Panic(err)
+	}
 
 	config := core.NewBlobFixture()
 	layer1 := core.NewBlobFixture()