Merge branch 'master' into dependabot/go_modules/google.golang.org/grpc-1.79.2

dopey · web-flow · commit 20a980bf7598 · 2026-03-10T20:44:06.000-07:00
diff --git a/README.md b/README.md
@@ -29,7 +29,7 @@ You can use `step-ca` to:
 
 As you design your PKI, if you need any of the following, [consider our commerical CA](http://smallstep.com):
 - Multiple certificate authorities
-- Active revocation (CRL, OSCP)
+- Active revocation (CRL, OCSP)
 - Turnkey high-volume, high availability CA
 - An API for seamless IaC management of your PKI
 - Integrated support for SCEP & NDES, for migrating from legacy Active Directory Certificate Services deployments
diff --git a/acme/challenge.go b/acme/challenge.go
@@ -531,7 +531,7 @@ func validateWireOIDCClaims(o *wireprovisioner.OIDCOptions, token *oidc.IDToken,
 
 type wireDpopPayload struct {
 	// AccessToken is the token generated by wire-server
-	AccessToken string `json:"access_token"` //nolint:gosec // field name required by Wire protocol
+	AccessToken string `json:"access_token"`
 }
 
 func wireDPOP01Validate(ctx context.Context, ch *Challenge, db WireDB, accountJWK *jose.JSONWebKey, payload []byte) error {
@@ -1618,7 +1618,7 @@ func uitoa(val uint) string {
 		val = v
 	}
 	// val < 10
-	buf[i] = byte('0' + val) //nolint:gosec // val is always 0-9 here
+	buf[i] = byte('0' + val)
 	return string(buf[i:])
 }
 
diff --git a/api/crl.go b/api/crl.go
@@ -41,6 +41,6 @@ func CRL(w http.ResponseWriter, r *http.Request) {
 	} else {
 		w.Header().Add("Content-Type", "application/pkix-crl")
 		w.Header().Add("Content-Disposition", "attachment; filename=\"crl.der\"")
-		w.Write(crlInfo.Data) //nolint:gosec // writing CRL binary data
+		w.Write(crlInfo.Data)
 	}
 }
diff --git a/authority/admin/db/nosql/provisioner.go b/authority/admin/db/nosql/provisioner.go
@@ -29,16 +29,16 @@ type dbProvisioner struct {
 
 type dbBasicAuth struct {
 	Username string `json:"username"`
-	Password string `json:"password"` //nolint:gosec // field name for database storage
+	Password string `json:"password"`
 }
 
 type dbWebhook struct {
 	Name                 string       `json:"name"`
 	ID                   string       `json:"id"`
 	URL                  string       `json:"url"`
 	Kind                 string       `json:"kind"`
-	Secret               string       `json:"secret"`                //nolint:gosec // field name for database storage
-	BearerToken          string       `json:"bearerToken,omitempty"` //nolint:gosec // field name for database storage
+	Secret               string       `json:"secret"`
+	BearerToken          string       `json:"bearerToken,omitempty"`
 	BasicAuth            *dbBasicAuth `json:"basicAuth,omitempty"`
 	DisableTLSClientAuth bool         `json:"disableTLSClientAuth,omitempty"`
 	CertType             string       `json:"certType,omitempty"`
diff --git a/authority/config/config.go b/authority/config/config.go
@@ -79,7 +79,7 @@ type Config struct {
 	Monitoring       json.RawMessage      `json:"monitoring,omitempty"`
 	AuthorityConfig  *AuthConfig          `json:"authority,omitempty"`
 	TLS              *TLSOptions          `json:"tls,omitempty"`
-	Password         string               `json:"password,omitempty"` //nolint:gosec // field name for CA configuration
+	Password         string               `json:"password,omitempty"`
 	Templates        *templates.Templates `json:"templates,omitempty"`
 	CommonName       string               `json:"commonName,omitempty"`
 	CRL              *CRLConfig           `json:"crl,omitempty"`
@@ -263,7 +263,7 @@ func (c *Config) Save(filename string) error {
 	var b bytes.Buffer
 	enc := json.NewEncoder(&b)
 	enc.SetIndent("", "\t")
-	if err := enc.Encode(c); err != nil {
+	if err := enc.Encode(c); err != nil { //nolint:gosec // config struct contains password field by design
 		return fmt.Errorf("error encoding configuration: %w", err)
 	}
 	if err := os.WriteFile(filename, b.Bytes(), 0600); err != nil {
diff --git a/authority/provisioner/aws.go b/authority/provisioner/aws.go
@@ -469,7 +469,7 @@ func (p *AWS) readURLv1(url string) (*http.Response, error) {
 	if err != nil {
 		return nil, err
 	}
-	resp, err := client.Do(req) //nolint:gosec // request to AWS metadata service
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -485,7 +485,7 @@ func (p *AWS) readURLv2(url string) (*http.Response, error) {
 		return nil, err
 	}
 	req.Header.Set(awsMetadataTokenTTLHeader, p.config.tokenTTL)
-	resp, err := client.Do(req) //nolint:gosec // request to AWS metadata service
+	resp, err := client.Do(req)
 	if err != nil {
 		return nil, err
 	}
@@ -504,7 +504,7 @@ func (p *AWS) readURLv2(url string) (*http.Response, error) {
 		return nil, err
 	}
 	req.Header.Set(awsMetadataTokenHeader, string(token))
-	resp, err = client.Do(req) //nolint:gosec // request to AWS metadata service
+	resp, err = client.Do(req)
 	if err != nil {
 		return nil, err
 	}
diff --git a/authority/provisioner/azure.go b/authority/provisioner/azure.go
@@ -66,8 +66,8 @@ func newAzureConfig(tenantID string) *azureConfig {
 }
 
 type azureIdentityToken struct {
-	AccessToken  string `json:"access_token"`  //nolint:gosec // field name required by Azure API
-	RefreshToken string `json:"refresh_token"` //nolint:gosec // field name required by Azure API
+	AccessToken  string `json:"access_token"`
+	RefreshToken string `json:"refresh_token"`
 	ClientID     string `json:"client_id"`
 	ExpiresIn    int64  `json:"expires_in,string"`
 	ExpiresOn    int64  `json:"expires_on,string"`
@@ -212,7 +212,7 @@ func (p *Azure) GetIdentityToken(subject, caURL string) (string, error) {
 	query.Add("api-version", azureIdentityTokenAPIVersion)
 	req.URL.RawQuery = query.Encode()
 
-	resp, err := http.DefaultClient.Do(req) //nolint:gosec // request to Azure metadata service
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return "", errors.Wrap(err, "error getting identity token, are you in a Azure VM?")
 	}
@@ -510,7 +510,7 @@ func (p *Azure) getAzureEnvironment() (string, error) {
 	query.Add("api-version", "2021-02-01")
 	req.URL.RawQuery = query.Encode()
 
-	resp, err := http.DefaultClient.Do(req) //nolint:gosec // request to Azure metadata service
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return "", errors.Wrap(err, "error getting azure instance environment, are you in a Azure VM?")
 	}
diff --git a/authority/provisioner/gcp.go b/authority/provisioner/gcp.go
@@ -199,7 +199,7 @@ func (p *GCP) GetIdentityToken(subject, caURL string) (string, error) {
 		return "", errors.Wrap(err, "error creating identity request")
 	}
 	req.Header.Set("Metadata-Flavor", "Google")
-	resp, err := http.DefaultClient.Do(req) //nolint:gosec // request to GCP metadata service
+	resp, err := http.DefaultClient.Do(req)
 	if err != nil {
 		return "", errors.Wrap(err, "error doing identity request, are you in a GCP VM?")
 	}
diff --git a/authority/provisioner/k8sSA.go b/authority/provisioner/k8sSA.go
@@ -36,7 +36,7 @@ const (
 type k8sSAPayload struct {
 	jose.Claims
 	Namespace          string `json:"kubernetes.io/serviceaccount/namespace,omitempty"`
-	SecretName         string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"` //nolint:gosec // field name required by Kubernetes API
+	SecretName         string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"`
 	ServiceAccountName string `json:"kubernetes.io/serviceaccount/service-account.name,omitempty"`
 	ServiceAccountUID  string `json:"kubernetes.io/serviceaccount/service-account.uid,omitempty"`
 }
diff --git a/authority/provisioner/oidc.go b/authority/provisioner/oidc.go
@@ -84,7 +84,7 @@ type OIDC struct {
 	Type                  string   `json:"type"`
 	Name                  string   `json:"name"`
 	ClientID              string   `json:"clientID"`
-	ClientSecret          string   `json:"clientSecret"` //nolint:gosec // field name required by OIDC configuration
+	ClientSecret          string   `json:"clientSecret"`
 	ConfigurationEndpoint string   `json:"configurationEndpoint"`
 	TenantID              string   `json:"tenantID,omitempty"`
 	Admins                []string `json:"admins,omitempty"`
diff --git a/authority/provisioner/webhook.go b/authority/provisioner/webhook.go
@@ -141,7 +141,7 @@ type Webhook struct {
 	BearerToken          string `json:"-"`
 	BasicAuth            struct {
 		Username string
-		Password string //nolint:gosec // field name for basic auth configuration
+		Password string
 	} `json:"-"`
 }
 
diff --git a/ca/acmeClient.go b/ca/acmeClient.go
@@ -51,7 +51,7 @@ func NewACMEClient(endpoint string, contact []string, opts ...ClientOption) (*AC
 	}
 	req.Header.Set("User-Agent", UserAgent)
 	enforceRequestID(req)
-	resp, err := ac.client.Do(req) //nolint:gosec // request to configured ACME server
+	resp, err := ac.client.Do(req)
 	if err != nil {
 		return nil, errors.Wrapf(err, "client GET %s failed", endpoint)
 	}
@@ -113,7 +113,7 @@ func (c *ACMEClient) GetNonce() (string, error) {
 	}
 	req.Header.Set("User-Agent", UserAgent)
 	enforceRequestID(req)
-	resp, err := c.client.Do(req) //nolint:gosec // request to configured ACME server
+	resp, err := c.client.Do(req)
 	if err != nil {
 		return "", errors.Wrapf(err, "client GET %s failed", c.dir.NewNonce)
 	}
@@ -193,7 +193,7 @@ func (c *ACMEClient) post(payload []byte, url string, headerOps ...withHeaderOpt
 	req.Header.Set("Content-Type", "application/jose+json")
 	req.Header.Set("User-Agent", UserAgent)
 	enforceRequestID(req)
-	resp, err := c.client.Do(req) //nolint:gosec // request to configured ACME server
+	resp, err := c.client.Do(req)
 	if err != nil {
 		return nil, errors.Wrapf(err, "client POST %s failed", c.dir.NewOrder)
 	}
diff --git a/ca/client.go b/ca/client.go
@@ -143,7 +143,7 @@ func enforceRequestID(r *http.Request) {
 func (c *uaClient) Do(req *http.Request) (*http.Response, error) {
 	req.Header.Set("User-Agent", UserAgent)
 	enforceRequestID(req)
-	return c.Client.Do(req) //nolint:gosec // request to configured CA server
+	return c.Client.Do(req) //nolint:gosec // request to user-configured CA server
 }
 
 // RetryFunc defines the method used to retry a request. If it returns true, the
@@ -823,7 +823,7 @@ retry:
 		return nil, err
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := httpClient.Do(req) //nolint:gosec // request to configured CA server
+	resp, err := httpClient.Do(req)
 	if err != nil {
 		return nil, clientError(err)
 	}
@@ -900,7 +900,7 @@ retry:
 		return nil, err
 	}
 	httpReq.Header.Set("Content-Type", "application/json")
-	resp, err := httpClient.Do(httpReq) //nolint:gosec // request to configured CA server
+	resp, err := httpClient.Do(httpReq)
 	if err != nil {
 		return nil, clientError(err)
 	}
diff --git a/cas/apiv1/options.go b/cas/apiv1/options.go
@@ -88,7 +88,7 @@ type CertificateIssuer struct {
 	Provisioner string `json:"provisioner,omitempty"`
 	Certificate string `json:"crt,omitempty"`
 	Key         string `json:"key,omitempty"`
-	Password    string `json:"password,omitempty"` //nolint:gosec // field name for CA configuration
+	Password    string `json:"password,omitempty"`
 }
 
 // Validate checks the fields in Options.
diff --git a/commands/onboard.go b/commands/onboard.go
@@ -213,7 +213,7 @@ func onboardPKI(cfg onboardingConfiguration) (*config.Config, string, error) {
 		return nil, "", err
 	}
 
-	b, err := json.MarshalIndent(caConfig, "", "   ")
+	b, err := json.MarshalIndent(caConfig, "", "   ") //nolint:gosec // config struct contains password field by design
 	if err != nil {
 		return nil, "", errors.Wrapf(err, "error marshaling %s", p.GetCAConfigPath())
 	}
diff --git a/examples/basic-client/client.go b/examples/basic-client/client.go
@@ -23,7 +23,7 @@ func printResponse(name string, v interface{}) {
 
 func main() {
 	if len(os.Args) != 2 {
-		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0]) //nolint:gosec // example code writing to stderr
+		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0])
 		os.Exit(1)
 	}
 
diff --git a/examples/basic-federation/client/main.go b/examples/basic-federation/client/main.go
@@ -12,7 +12,7 @@ import (
 
 func main() {
 	if len(os.Args) != 2 {
-		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0]) //nolint:gosec // example code writing to stderr
+		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0])
 		os.Exit(1)
 	}
 
diff --git a/examples/basic-federation/server/main.go b/examples/basic-federation/server/main.go
@@ -12,7 +12,7 @@ import (
 
 func main() {
 	if len(os.Args) != 2 {
-		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0]) //nolint:gosec // example code writing to stderr
+		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0])
 		os.Exit(1)
 	}
 
diff --git a/examples/bootstrap-client/client.go b/examples/bootstrap-client/client.go
@@ -12,7 +12,7 @@ import (
 
 func main() {
 	if len(os.Args) != 2 {
-		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0]) //nolint:gosec // example code writing to stderr
+		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0])
 		os.Exit(1)
 	}
 
diff --git a/examples/bootstrap-mtls-server/server.go b/examples/bootstrap-mtls-server/server.go
@@ -12,7 +12,7 @@ import (
 
 func main() {
 	if len(os.Args) != 2 {
-		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0]) //nolint:gosec // example code writing to stderr
+		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0])
 		os.Exit(1)
 	}
 
diff --git a/examples/bootstrap-tls-server/server.go b/examples/bootstrap-tls-server/server.go
@@ -12,7 +12,7 @@ import (
 
 func main() {
 	if len(os.Args) != 2 {
-		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0]) //nolint:gosec // example code writing to stderr
+		fmt.Fprintf(os.Stderr, "Usage: %s <token>\n", os.Args[0])
 		os.Exit(1)
 	}
 
diff --git a/logging/clf.go b/logging/clf.go
@@ -29,26 +29,26 @@ func (f *CommonLogFormat) Format(entry *logrus.Entry) ([]byte, error) {
 		if v, ok := entry.Data[name]; ok {
 			switch v := v.(type) {
 			case error:
-				data[i] = v.Error() //nolint:gosec // i is bounded by len(clfFields)
+				data[i] = v.Error()
 			case string:
 				if v == "" {
-					data[i] = "-" //nolint:gosec // i is bounded by len(clfFields)
+					data[i] = "-"
 				} else {
-					data[i] = v //nolint:gosec // i is bounded by len(clfFields)
+					data[i] = v
 				}
 			case time.Time:
-				data[i] = v.Format(time.RFC3339) //nolint:gosec // i is bounded by len(clfFields)
+				data[i] = v.Format(time.RFC3339)
 			case time.Duration:
-				data[i] = strconv.FormatInt(int64(v/time.Millisecond), 10) //nolint:gosec // i is bounded by len(clfFields)
+				data[i] = strconv.FormatInt(int64(v/time.Millisecond), 10)
 			case int:
-				data[i] = strconv.FormatInt(int64(v), 10) //nolint:gosec // i is bounded by len(clfFields)
+				data[i] = strconv.FormatInt(int64(v), 10)
 			case int64:
-				data[i] = strconv.FormatInt(v, 10) //nolint:gosec // i is bounded by len(clfFields)
+				data[i] = strconv.FormatInt(v, 10)
 			default:
-				data[i] = fmt.Sprintf("%v", v) //nolint:gosec // i is bounded by len(clfFields)
+				data[i] = fmt.Sprintf("%v", v)
 			}
 		} else {
-			data[i] = "-" //nolint:gosec // i is bounded by len(clfFields)
+			data[i] = "-"
 		}
 	}
 
diff --git a/pki/helm.go b/pki/helm.go
@@ -16,7 +16,7 @@ import (
 type helmVariables struct {
 	*linkedca.Configuration
 	Defaults     *linkedca.Defaults
-	Password     string //nolint:gosec // field name for helm template variables
+	Password     string
 	EnableSSH    bool
 	EnableAdmin  bool
 	TLS          authconfig.TLSOptions
diff --git a/pki/pki.go b/pki/pki.go
@@ -986,7 +986,7 @@ func (p *PKI) Save(opt ...ConfigOption) error {
 			return err
 		}
 
-		b, err := json.MarshalIndent(cfg, "", "\t")
+		b, err := json.MarshalIndent(cfg, "", "\t") //nolint:gosec // config struct contains password field by design
 		if err != nil {
 			return errors.Wrapf(err, "error marshaling %s", p.config)
 		}
diff --git a/scep/api/api.go b/scep/api/api.go
@@ -443,7 +443,7 @@ func writeResponse(w http.ResponseWriter, r *http.Request, res Response) {
 	}
 
 	w.Header().Set("Content-Type", contentHeader(res))
-	_, _ = w.Write(res.Data) //nolint:gosec // writing SCEP protocol response
+	_, _ = w.Write(res.Data)
 }
 
 func fail(w http.ResponseWriter, r *http.Request, err error) {
diff --git a/scripts/badger-migration/main.go b/scripts/badger-migration/main.go
@@ -64,14 +64,14 @@ func (*dryRunDB) Set(bucket, key, value []byte) error { return nil }
 
 func usage(fs *flag.FlagSet) {
 	name := filepath.Base(os.Args[0])
-	fmt.Fprintf(os.Stderr, "%s is a tool to migrate data from BadgerDB to MySQL or PostgreSQL.\n", name) //nolint:gosec // script usage message
+	fmt.Fprintf(os.Stderr, "%s is a tool to migrate data from BadgerDB to MySQL or PostgreSQL.\n", name)
 	fmt.Fprintln(os.Stderr, "\nUsage:")
-	fmt.Fprintf(os.Stderr, "  %s [-v1|-v2] -dir=<path> [-value-dir=<path>] -type=type -database=<source>\n", name) //nolint:gosec // script usage message
+	fmt.Fprintf(os.Stderr, "  %s [-v1|-v2] -dir=<path> [-value-dir=<path>] -type=type -database=<source>\n", name)
 	fmt.Fprintln(os.Stderr, "\nExamples:")
-	fmt.Fprintf(os.Stderr, "  %s -v1 -dir /var/lib/step-ca/db -type=mysql -database \"user@unix/step_ca\"\n", name)                         //nolint:gosec // script usage message
-	fmt.Fprintf(os.Stderr, "  %s -v1 -dir /var/lib/step-ca/db -type=mysql -database \"user:password@tcp(localhost:3306)/step_ca\"\n", name) //nolint:gosec // script usage message
-	fmt.Fprintf(os.Stderr, "  %s -v2 -dir /var/lib/step-ca/db -type=postgresql -database \"user=postgres dbname=step_ca\"\n", name)         //nolint:gosec // script usage message
-	fmt.Fprintf(os.Stderr, "  %s -v2 -dir /var/lib/step-ca/db -dry-run\"\n", name)                                                          //nolint:gosec // script usage message
+	fmt.Fprintf(os.Stderr, "  %s -v1 -dir /var/lib/step-ca/db -type=mysql -database \"user@unix/step_ca\"\n", name)
+	fmt.Fprintf(os.Stderr, "  %s -v1 -dir /var/lib/step-ca/db -type=mysql -database \"user:password@tcp(localhost:3306)/step_ca\"\n", name)
+	fmt.Fprintf(os.Stderr, "  %s -v2 -dir /var/lib/step-ca/db -type=postgresql -database \"user=postgres dbname=step_ca\"\n", name)
+	fmt.Fprintf(os.Stderr, "  %s -v2 -dir /var/lib/step-ca/db -dry-run\"\n", name)
 	fmt.Fprintln(os.Stderr, "\nOptions:")
 	fs.PrintDefaults()
 }
diff --git a/test/integration/scep/internal/x509/oid.go b/test/integration/scep/internal/x509/oid.go
@@ -103,7 +103,7 @@ func appendBase128BigInt(dst []byte, n *big.Int) []byte {
 	}
 
 	for i := base128BigIntLength(n) - 1; i >= 0; i-- {
-		o := byte(big.NewInt(0).Rsh(n, uint(i)*7).Bits()[0])
+		o := byte(big.NewInt(0).Rsh(n, uint(i)*7).Bits()[0]) //nolint:gosec // intentional truncation, masked to 0x7f immediately after
 		o &= 0x7f
 		if i != 0 {
 			o |= 0x80

Original file line number	Diff line number	Diff line change
`@@ -531,7 +531,7 @@ func validateWireOIDCClaims(o wireprovisioner.OIDCOptions, token oidc.IDToken,`
`531`	`531`
`532`	`532`	`type wireDpopPayload struct {`
`533`	`533`	`// AccessToken is the token generated by wire-server`
`534`		- AccessToken string `json:"access_token"` //nolint:gosec // field name required by Wire protocol
	`534`	+ AccessToken string `json:"access_token"`
`535`	`535`	`}`
`536`	`536`
`537`	`537`	`func wireDPOP01Validate(ctx context.Context, ch Challenge, db WireDB, accountJWK jose.JSONWebKey, payload []byte) error {`
`@@ -1618,7 +1618,7 @@ func uitoa(val uint) string {`
`1618`	`1618`	`val = v`
`1619`	`1619`	`}`
`1620`	`1620`	`// val < 10`
`1621`		`- buf[i] = byte('0' + val) //nolint:gosec // val is always 0-9 here`
	`1621`	`+ buf[i] = byte('0' + val)`
`1622`	`1622`	`return string(buf[i:])`
`1623`	`1623`	`}`
`1624`	`1624`
Original file line number	Diff line number	Diff line change
`@@ -41,6 +41,6 @@ func CRL(w http.ResponseWriter, r *http.Request) {`
`41`	`41`	`} else {`
`42`	`42`	`w.Header().Add("Content-Type", "application/pkix-crl")`
`43`	`43`	`w.Header().Add("Content-Disposition", "attachment; filename=\"crl.der\"")`
`44`		`- w.Write(crlInfo.Data) //nolint:gosec // writing CRL binary data`
	`44`	`+ w.Write(crlInfo.Data)`
`45`	`45`	`}`
`46`	`46`	`}`
Original file line number	Diff line number	Diff line change
`@@ -469,7 +469,7 @@ func (p AWS) readURLv1(url string) (http.Response, error) {`
`469`	`469`	`if err != nil {`
`470`	`470`	`return nil, err`
`471`	`471`	`}`
`472`		`- resp, err := client.Do(req) //nolint:gosec // request to AWS metadata service`
	`472`	`+ resp, err := client.Do(req)`
`473`	`473`	`if err != nil {`
`474`	`474`	`return nil, err`
`475`	`475`	`}`
`@@ -485,7 +485,7 @@ func (p AWS) readURLv2(url string) (http.Response, error) {`
`485`	`485`	`return nil, err`
`486`	`486`	`}`
`487`	`487`	`req.Header.Set(awsMetadataTokenTTLHeader, p.config.tokenTTL)`
`488`		`- resp, err := client.Do(req) //nolint:gosec // request to AWS metadata service`
	`488`	`+ resp, err := client.Do(req)`
`489`	`489`	`if err != nil {`
`490`	`490`	`return nil, err`
`491`	`491`	`}`
`@@ -504,7 +504,7 @@ func (p AWS) readURLv2(url string) (http.Response, error) {`
`504`	`504`	`return nil, err`
`505`	`505`	`}`
`506`	`506`	`req.Header.Set(awsMetadataTokenHeader, string(token))`
`507`		`- resp, err = client.Do(req) //nolint:gosec // request to AWS metadata service`
	`507`	`+ resp, err = client.Do(req)`
`508`	`508`	`if err != nil {`
`509`	`509`	`return nil, err`
`510`	`510`	`}`
Original file line number	Diff line number	Diff line change
`@@ -199,7 +199,7 @@ func (p *GCP) GetIdentityToken(subject, caURL string) (string, error) {`
`199`	`199`	`return "", errors.Wrap(err, "error creating identity request")`
`200`	`200`	`}`
`201`	`201`	`req.Header.Set("Metadata-Flavor", "Google")`
`202`		`- resp, err := http.DefaultClient.Do(req) //nolint:gosec // request to GCP metadata service`
	`202`	`+ resp, err := http.DefaultClient.Do(req)`
`203`	`203`	`if err != nil {`
`204`	`204`	`return "", errors.Wrap(err, "error doing identity request, are you in a GCP VM?")`
`205`	`205`	`}`
Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ const (`
`36`	`36`	`type k8sSAPayload struct {`
`37`	`37`	`jose.Claims`
`38`	`38`	Namespace string `json:"kubernetes.io/serviceaccount/namespace,omitempty"`
`39`		- SecretName string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"` //nolint:gosec // field name required by Kubernetes API
	`39`	+ SecretName string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"`
`40`	`40`	ServiceAccountName string `json:"kubernetes.io/serviceaccount/service-account.name,omitempty"`
`41`	`41`	ServiceAccountUID string `json:"kubernetes.io/serviceaccount/service-account.uid,omitempty"`
`42`	`42`	`}`