mirror of
https://github.com/luxfi/lattice.git
synced 2026-09-24 00:25:44 +00:00
zeekay
ae2f23dd35
Static-checks job has been failing on every PR (including #3) due to a shell-interpolation bug in the Makefile + a build of accumulated lint findings the bug had been hiding. Cleaned up end-to-end so make checks runs green and PR #3 (security/readuint-slice-dos-2026-03-03) can land. 1. Makefile fmt-step: quote $$FMTOUT in `[ -z $$FMTOUT ]` test. Unquoted, multi-file go-fmt output word-splits and the test sees `[ -z FILE1 FILE2 ]` -> "/bin/sh: [: FILE2: unexpected operator". Same fix to the trailing `echo $$FMTOUT`. 2. go fmt sweep: gpu/gpu.go, gpu/gpu_test.go, types/reduction_test.go, types/trust_test.go had whitespace-only formatter findings that the crashing fmt-test step had been hiding. 3. ST1003 (mixed-case identifier): four wire-format-pinned consts in types/trust.go (TrustCpuGpuCompositeTEE / IOLevelCpu*) carry a //lint:ignore directive — their String() return values are part of the wire/log contract documented at line 80 ("do not rename"), so the Go-side identifiers must stay byte-aligned with the wire spelling. 4. ST1005 (capitalized error string): two error strings in gpu/gpu.go rephrased to lead with a noun ("ring degree N" / "modulus Q-1" instead of capital "N" / capital "Q") without changing semantics. 5. ST1000 (package comment): gpu/gpu_montgomery_*.go file header reformatted so the "Package gpu" line is the leading sentence. 6. G104 (unhandled errors): four `prng.Read(b)` call sites in gpu/gpu.go now `_, _ = prng.Read(b)` — the PRNG is keyed sampling output; read length is bounded by buffer length and a short read here is not a correctness issue. 7. G115 (int -> uint conversion): types/reduction.go switches `bitlen` to int (matches bits.Len64's return type, used only against literal small ints in the comparison ladder). gpu/gpu_montgomery_purego.go adds /* #nosec G115 */ on uint32(s.N) — s.N is validated >0 and bounded by ring degree above. 8. NO-STUB POLICY: gpu/gpu_montgomery_stub.go renamed to gpu/gpu_montgomery_purego.go and given a real pure-Go body that delegates to ring.SubRing.NTT / INTT (the canonical Go implementation in this repo). The "stub" name was misleading: there should never be a Lux Go file that returns "GPU unavailable" errors when the cgo+gpu build tag is unset — the pure-Go path is the canonical reference and always works. Output is byte-equal to the cgo+gpu path, identical semantics across build tags. Same rename for ring/ntt_simd_stub.go -> ring/ntt_simd_dispatch_purego.go with comment update: it's a dispatch hook (returns false to signal "use canonical scalar NTT below"), not an incomplete impl. Verification: * make checks: all 6 substeps PASS (go fmt / vet / goimports / staticcheck / govulncheck / gosec) on this branch. * go test -count=1 ./...: all packages green; ring + ringqp + schemes/bgv + schemes/ckks + multiparty + utils/* all pass.
86 lines
2.0 KiB
Makefile
86 lines
2.0 KiB
Makefile
.DEFAULT_GOAL := test
|
|
|
|
.PHONY: test_gotest
|
|
test_gotest:
|
|
go clean -testcache
|
|
go test -timeout=0 ./...
|
|
|
|
.PHONY: checks
|
|
checks: check_tools
|
|
@echo Checking correct formatting of files
|
|
|
|
@FMTOUT=$$(go fmt ./...); \
|
|
if [ -z "$$FMTOUT" ]; then\
|
|
echo "go fmt: OK";\
|
|
else \
|
|
echo "go fmt: problems in files:";\
|
|
echo "$$FMTOUT";\
|
|
false;\
|
|
fi
|
|
|
|
@if GOVETOUT=$$(go vet ./... 2>&1); then\
|
|
echo "go vet: OK";\
|
|
else \
|
|
echo "go vet: problems in files:";\
|
|
echo "$$GOVETOUT";\
|
|
false;\
|
|
fi
|
|
|
|
@GOIMPORTSOUT=$$(goimports -l .); \
|
|
if [ -z "$$GOIMPORTSOUT" ]; then\
|
|
echo "goimports: OK";\
|
|
else \
|
|
echo "goimports: problems in files:";\
|
|
echo "$$GOIMPORTSOUT";\
|
|
false;\
|
|
fi
|
|
|
|
@STATICCHECKOUT=$$(staticcheck -checks all ./...); \
|
|
if [ -z "$$STATICCHECKOUT" ]; then\
|
|
echo "staticcheck: OK";\
|
|
else \
|
|
echo "staticcheck: problems in files:";\
|
|
echo "$$STATICCHECKOUT";\
|
|
false;\
|
|
fi
|
|
|
|
@GOVULNCHECKOUT=$$(govulncheck ./...); \
|
|
if echo "$$GOVULNCHECKOUT" | grep -q "No vulnerabilities found"; then\
|
|
echo "govulncheck: OK";\
|
|
else \
|
|
echo "govulncheck:" >&2;\
|
|
echo "$$GOVULNCHECKOUT" >&2;\
|
|
false;\
|
|
fi
|
|
|
|
@GOSECOUT=$$(gosec -quiet ./...); \
|
|
if [ -z "$$GOSECOUT" ]; then\
|
|
echo "gosec: OK";\
|
|
else \
|
|
echo "gosec: problems in files:";\
|
|
echo "$$GOSECOUT";\
|
|
false;\
|
|
fi
|
|
|
|
@echo Checking all local changes are committed
|
|
go mod tidy
|
|
out=`git status --porcelain`; echo "$$out"; [ -z "$$out" ]
|
|
|
|
.PHONY: test
|
|
test: test_gotest
|
|
|
|
.PHONY: ci_test
|
|
ci_test: checks test_gotest
|
|
|
|
EXECUTABLES = goimports staticcheck govulncheck gosec
|
|
.PHONY: get_tools
|
|
get_tools:
|
|
go install golang.org/x/tools/cmd/goimports@latest
|
|
go install honnef.co/go/tools/cmd/[email protected]
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
go install github.com/securego/gosec/v2/cmd/gosec@latest
|
|
|
|
.PHONY: check_tools
|
|
check_tools:
|
|
@$(foreach exec,$(EXECUTABLES),\
|
|
$(if $(shell which $(exec)),true,$(error "$(exec) not found in PATH, consider running `make get_tools`.")))
|