golangci-lint: add nilerr & misc error reporting improvements

.golangci.yml

@@ -19,6 +19,7 @@ linters:
     - gosec
     - misspell
     - nakedret
+    - nilerr
     - unconvert
     - unparam
     - whitespace

pkg/common/container/process/winapi.go

@@ -145,7 +145,7 @@ func (a *api) QuerySystemExtendedHandleInformation() ([]SystemHandleInformationE
 		handlesList := (*SystemExtendedHandleInformation)(unsafe.Pointer(&buffer[0]))
 		handles := unsafe.Slice(&handlesList.Handles[0], int(handlesList.NumberOfHandles))
 
-		return handles, nil
+		return handles, nil //nolint:nilerr
 	}
 
 	return nil, status

pkg/common/plugin/facade.go

@@ -52,7 +52,7 @@ func (f *Facade) InitLog(log logrus.FieldLogger) {
 // that come out of plugin implementations.
 func (f *Facade) WrapErr(err error) error {
 	if err == nil {
-		return err
+		return nil
 	}
 
 	// Embellish the gRPC status with the prefix, if necessary.

pkg/common/telemetry/statsd.go

@@ -16,7 +16,7 @@ func newStatsdRunner(c *MetricsConfig) (sinkRunner, error) {
 	for _, sc := range c.FileConfig.Statsd {
 		sink, err := metrics.NewStatsdSink(sc.Address)
 		if err != nil {
-			return runner, nil
+			return nil, err
 		}
 
 		runner.loadedSinks = append(runner.loadedSinks, sink)

pkg/server/plugin/keymanager/awskms/awskms.go

@@ -807,7 +807,7 @@ func (p *Plugin) createDefaultPolicy(ctx context.Context) (*string, error) {
 	roleName, err := roleNameFromARN(*result.Arn)
 	if err != nil {
 		// the server has not assumed any role, use default KMS policy and log a warn message
-		p.log.Warn("In a future version of SPIRE, it will be mandatory for the SPIRE servers to assume an AWS IAM Role when using the default AWS KMS key policy. Please assign an IAM role to this SPIRE Server instance.")
+		p.log.Warn("In a future version of SPIRE, it will be mandatory for the SPIRE servers to assume an AWS IAM Role when using the default AWS KMS key policy. Please assign an IAM role to this SPIRE Server instance.", reasonTag, err)
 		return nil, nil
 	}
 

pkg/server/plugin/keymanager/awskms/awskms_test.go

@@ -719,6 +719,7 @@ func TestGenerateKey(t *testing.T) {
 				{
 					Level:   logrus.WarnLevel,
 					Message: "In a future version of SPIRE, it will be mandatory for the SPIRE servers to assume an AWS IAM Role when using the default AWS KMS key policy. Please assign an IAM role to this SPIRE Server instance.",
+					Data:    logrus.Fields{reasonTag: `incomplete resource, expected 'resource-type/resource-id' but got "example-account-id"`},
 				},
 			},
 		},
@@ -734,6 +735,7 @@ func TestGenerateKey(t *testing.T) {
 				{
 					Level:   logrus.WarnLevel,
 					Message: "In a future version of SPIRE, it will be mandatory for the SPIRE servers to assume an AWS IAM Role when using the default AWS KMS key policy. Please assign an IAM role to this SPIRE Server instance.",
+					Data:    logrus.Fields{reasonTag: `arn does not contain an assumed role: "arn:aws:sts::example-account-id:user/development"`},
 				},
 			},
 		},

pkg/server/server.go

@@ -520,7 +520,7 @@ func (s *Server) CheckHealth() health.State {
 func (s *Server) tryGetBundle() error {
 	client, err := server_util.NewServerClient(s.config.BindLocalAddress)
 	if err != nil {
-		return errors.New("cannot create registration client")
+		return fmt.Errorf("cannot create registration client: %w", err)
 	}
 	defer client.Release()
 
@@ -531,7 +531,7 @@ func (s *Server) tryGetBundle() error {
 	// As currently coded however, the API isn't served until after
 	// the server CA has been signed by upstream.
 	if _, err := bundleClient.GetBundle(context.Background(), &bundlev1.GetBundleRequest{}); err != nil {
-		return errors.New("unable to fetch bundle")
+		return fmt.Errorf("unable to fetch bundle: %w", err)
 	}
 	return nil
 }

test/integration/setup/node-attestation/client.go

@@ -230,7 +230,7 @@ func doX509popStep(ctx context.Context) error {
 
 	// Ban agent
 	if err := banAgent(ctx, client, svidResp.Id); err != nil {
-		return errors.New("failed to ban agent")
+		return fmt.Errorf("failed to ban agent: %w", err)
 	}
 
 	// Reattest banned agent, it MUST fail