lint: Enable gosec linter

[justaugustus]

What type of PR is this?

/kind cleanup
/area security

What this PR does / why we need it:

Self-directed nerd-snipe: https://twitter.com/stephenaugustus/status/1359356181735755776?s=20
xref: #1694 (comment)

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

[k8s-ci-robot]

@justaugustus: The label(s) area/security cannot be applied, because the repository doesn't have them

In response to this:

What type of PR is this?

/kind cleanup
/area security

What this PR does / why we need it:

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[justaugustus]

@justaugustus: The label(s) area/security cannot be applied, because the repository doesn't have them

kubernetes/test-infra#20815

[hasheddan]

/area security
😉

[k8s-ci-robot]

@hasheddan: The label(s) area/security cannot be applied, because the repository doesn't have them

In response to this:

/area security
😉

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[hasheddan]

ahhh

/area release-eng/security

[saschagrunert]

@justaugustus do you wanna fixup the gosec issues?

[cpanato]

@justaugustus can I take this PR and push the commits to fix the linters, or you are planning to finish this? thanks!

[justaugustus]

(No changes yet; just a rebase.)

[jimangel]

Boosting the failed test:

level=warning msg="[runner] The linter 'golint' is deprecated (since v1.41.0) due to: The repository of the linter has been archived by the owner. Replaced by revive."

Entire thing:

level=warning msg="[runner] The linter 'golint' is deprecated (since v1.41.0) due to: The repository of the linter has been archived by the owner.  Replaced by revive."
pkg/license/download.go:20:2: G505: Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
	"crypto/sha1"
	^
pkg/license/download.go:186:48: G401: Use of weak cryptographic primitive (gosec)
		ddi.Options.CacheDir, fmt.Sprintf("%x.json", sha1.Sum([]byte(url))),
		                                             ^
cmd/schedule-builder/cmd/root.go:127:10: G306: Expect WriteFile permissions to be 0600 or less (gosec)
		err := os.WriteFile(opts.outputFile, []byte(scheduleOut), 0644)
		       ^
pkg/spdx/document.go:21:2: G505: Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
	"crypto/sha1"
	^
pkg/spdx/document.go:236:8: G401: Use of weak cryptographic primitive (gosec)
		h := sha1.New()
		     ^
pkg/spdx/imageanalyzer_distroless.go:125:17: G110: Potential DoS vulnerability via decompression bomb (gosec)
			if _, err := io.Copy(f, tr); err != nil {
			             ^
pkg/spdx/imageanalyzer_distroless.go:266:16: G110: Potential DoS vulnerability via decompression bomb (gosec)
			if _, err = io.Copy(b, tr); err != nil {
			            ^
pkg/spdx/implementation.go:107:17: G305: File traversal when extracting zip/tar archive (gosec)
		targetFile := filepath.Join(tmpDir, hdr.Name)
		              ^
pkg/spdx/implementation.go:114:16: G110: Potential DoS vulnerability via decompression bomb (gosec)
		if _, err := io.Copy(f, tr); err != nil {
		             ^
pkg/spdx/object.go:20:2: G505: Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
	"crypto/sha1"
	^
pkg/spdx/object.go:92:36: G401: Use of weak cryptographic primitive (gosec)
	s1, err := hash.ForFile(filePath, sha1.New())
	                                  ^
pkg/github/github.go:41:2: G101: Potential hardcoded credentials (gosec)
	TokenEnvKey = "GITHUB_TOKEN"
	^
pkg/announce/announce.go:138:12: G306: Expect WriteFile permissions to be 0600 or less (gosec)
	if err := os.WriteFile(
		subjectFile, []byte(subject), 0o755,
	); err != nil {
pkg/announce/announce.go:148:12: G306: Expect WriteFile permissions to be 0600 or less (gosec)
	if err := os.WriteFile(
		announcementFile, []byte(message), 0o755,
	); err != nil {
cmd/gh2gcs/cmd/root.go:246:37: G601: Implicit memory aliasing in for loop. (gosec)
		if err := gh2gcs.DownloadReleases(&releaseCfg, gh, opts.outputDir); err != nil {
		                                  ^
cmd/gh2gcs/cmd/root.go:252:28: G601: Implicit memory aliasing in for loop. (gosec)
			if err := gh2gcs.Upload(&releaseCfg, gh, opts.outputDir); err != nil {
			                        ^
make: *** [Makefile:55: verify-golangci-lint] Error 1

[justaugustus]

/retest-required

[justaugustus]

@justaugustus can I take this PR and push the commits to fix the linters, or you are planning to finish this? thanks!

@cpanato -- Missed this note! If you'd like to carry this across the finish line, go for it :)
/assign @cpanato

[k8s-ci-robot]

@justaugustus: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-release-image-releng-ci	7d757fc	link	/test pull-release-image-releng-ci
pull-release-image-k8s-ci-builder	7d757fc	link	/test pull-release-image-k8s-ci-builder
pull-release-image-kubepkg	7d757fc	link	/test pull-release-image-kubepkg
pull-release-image-kpromo	37c7999	link	/test pull-release-image-kpromo

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[cpanato]

done! @justaugustus @puerco @saschagrunert PTAL

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: justaugustus, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [justaugustus,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment