Bump golanglint-ci to 1.60.3

internal/controller/supervisorconfig/oidcclientwatcher/oidc_client_watcher.go

@@ -146,6 +146,7 @@ func (c *oidcClientWatcherController) updateStatus(
 		updated.Status.Phase = supervisorconfigv1alpha1.OIDCClientPhaseError
 	}
 
+	//nolint:gosec // looks like we are willing to accept the risk that there are less than 2147483647 dynamic clients
 	updated.Status.TotalClientSecrets = int32(totalClientSecrets)
 
 	if equality.Semantic.DeepEqual(upstream, updated) {

internal/endpointaddr/endpointaddr.go

@@ -71,7 +71,10 @@ func Parse(endpoint string, defaultPort uint16) (HostPort, error) {
 		return HostPort{}, fmt.Errorf("host %q is not a valid hostname or IP address", host)
 	}
 
-	return HostPort{Host: host, Port: uint16(integerPort)}, nil
+	return HostPort{
+		Host: host,
+		Port: uint16(integerPort), //nolint:gosec // this cast is checked by validation.IsValidPortNum above
+	}, nil
 }
 
 // ParseFromURL wraps Parse but specifically takes a url.URL instead of an endpoint string.

internal/federationdomain/endpoints/chooseidp/chooseidphtml/chooseidphtml.go

@@ -1,4 +1,4 @@
-// Copyright 2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2023-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package chooseidphtml
@@ -28,8 +28,8 @@ var (
 
 	// Parse the Go templated HTML and inject functions providing the minified inline CSS and JS.
 	parsedHTMLTemplate = template.Must(template.New("choose_idp.gohtml").Funcs(template.FuncMap{
-		"minifiedCSS": func() template.CSS { return template.CSS(CSS()) },
-		"minifiedJS":  func() template.JS { return template.JS(JS()) }, //nolint:gosec // This is 100% static input, not attacker-controlled.
+		"minifiedCSS": func() template.CSS { return template.CSS(CSS()) }, //nolint:gosec // This is 100% static input, not attacker-controlled.
+		"minifiedJS":  func() template.JS { return template.JS(JS()) },    //nolint:gosec // This is 100% static input, not attacker-controlled.
 	}).Parse(rawHTMLTemplate))
 
 	// Generate the CSP header value once since it's effectively constant.

internal/federationdomain/endpoints/login/loginhtml/loginhtml.go

@@ -1,4 +1,4 @@
-// Copyright 2022-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2022-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package loginhtml defines HTML templates used by the Supervisor.
@@ -25,7 +25,7 @@ var (
 
 	// Parse the Go templated HTML and inject functions providing the minified inline CSS and JS.
 	parsedHTMLTemplate = template.Must(template.New("login_form.gohtml").Funcs(template.FuncMap{
-		"minifiedCSS": func() template.CSS { return template.CSS(CSS()) },
+		"minifiedCSS": func() template.CSS { return template.CSS(CSS()) }, //nolint:gosec // This is 100% static input, not attacker-controlled.
 	}).Parse(rawHTMLTemplate))
 
 	// Generate the CSP header value once since it's effectively constant.

internal/federationdomain/formposthtml/formposthtml.go

@@ -1,4 +1,4 @@
-// Copyright 2021-2023 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 // Package formposthtml defines HTML templates used by the Supervisor.
@@ -29,8 +29,8 @@ var (
 
 	// Parse the Go templated HTML and inject functions providing the minified inline CSS and JS.
 	parsedHTMLTemplate = template.Must(template.New("form_post.gohtml").Funcs(template.FuncMap{
-		"minifiedCSS": func() template.CSS { return template.CSS(minifiedCSS) },
-		"minifiedJS":  func() template.JS { return template.JS(minifiedJS) }, //nolint:gosec // This is 100% static input, not attacker-controlled.
+		"minifiedCSS": func() template.CSS { return template.CSS(minifiedCSS) }, //nolint:gosec // This is 100% static input, not attacker-controlled.
+		"minifiedJS":  func() template.JS { return template.JS(minifiedJS) },    //nolint:gosec // This is 100% static input, not attacker-controlled.
 	}).Parse(rawHTMLTemplate))
 
 	// Generate the CSP header value once since it's effectively constant.

internal/net/phttp/warning.go

@@ -1,4 +1,4 @@
-// Copyright 2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2021-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package phttp
@@ -40,6 +40,7 @@ func getWarningHandler() rest.WarningHandler {
 	// the client-go rest.WarningHandlers all log warnings with non-empty message and code=299, agent is ignored
 
 	// no deduplication or color output when running from a non-terminal such as a pod
+	//nolint:gosec // this is an int, cast to uintptr, cast back to int
 	if isTerm := term.IsTerminal(int(os.Stderr.Fd())); !isTerm {
 		return rest.WarningLogger{}
 	}

internal/plog/config.go

@@ -57,6 +57,7 @@ func ValidateAndSetLogLevelAndFormatGlobally(ctx context.Context, spec LogSpec)
 	if _, err := logs.GlogSetter(strconv.Itoa(int(klogLevel))); err != nil {
 		panic(err) // programmer error
 	}
+	//nolint:gosec // the range for klogLevel is [0,108]
 	globalLevel.SetLevel(zapcore.Level(-klogLevel)) // klog levels are inverted when zap handles them
 
 	var encoding string

internal/plog/level.go

@@ -1,4 +1,4 @@
-// Copyright 2020-2021 the Pinniped contributors. All Rights Reserved.
+// Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
 // SPDX-License-Identifier: Apache-2.0
 
 package plog
@@ -45,6 +45,7 @@ func Enabled(level LogLevel) bool {
 	l := klogLevelForPlogLevel(level)
 	// check that both our global level and the klog global level agree that the plog level is enabled
 	// klog levels are inverted when zap handles them
+	//nolint:gosec // the range for klogLevel is [0,108]
 	return globalLevel.Enabled(zapcore.Level(-l)) && klog.V(l).Enabled()
 }
 

internal/testutil/totp/totp.go

@@ -80,7 +80,7 @@ func GenerateOTPCode(t *testing.T, token string, when time.Time) (string, int64)
 		((int(sum[offset+2] & mask3)) << shift8) |
 		(int(sum[offset+3]) & mask3))
 
-	modulo := int32(value % int64(math.Pow10(length)))
+	modulo := int32(value % int64(math.Pow10(length))) //nolint:gosec // the resulting number must be less than 10^6
 
 	format := fmt.Sprintf("%%0%dd", length)
 

internal/upstreamoidc/upstreamoidc_test.go

@@ -1461,7 +1461,7 @@ func forceUserInfoWithClaims(subject string, claims string) *coreosoidc.UserInfo
 
 	// this is some dark magic to set a private field
 	claimsField := reflect.ValueOf(userInfo).Elem().FieldByName("claims")
-	claimsPointer := (*[]byte)(unsafe.Pointer(claimsField.UnsafeAddr()))
+	claimsPointer := (*[]byte)(unsafe.Pointer(claimsField.UnsafeAddr())) //nolint:gosec // this is a test hack we are willing to live with
 	*claimsPointer = []byte(claims)
 
 	return userInfo