fix(samples/go): resolve Super-Linter issues in signing and verifying sample

Author: Iwaniukooo11

samples/go/agents/signing_and_verifying/Containerfile

@@ -9,7 +9,7 @@ COPY . .
 
 RUN CGO_ENABLED=0 GOOS=linux go build -o agent .
 
-FROM alpine:latest
+FROM alpine:3.21
 
 WORKDIR /app
 

samples/go/agents/signing_and_verifying/README.md

@@ -57,8 +57,19 @@ python3 __main__.py --agent http://localhost:9999
 
 ## Disclaimer
 
-Important: The sample code provided is for demonstration purposes and illustrates the mechanics of the Agent-to-Agent (A2A) protocol. When building production applications, it is critical to treat any agent operating outside of your direct control as a potentially untrusted entity.
-
-All data received from an external agent—including but not limited to its AgentCard, messages, artifacts, and task statuses—should be handled as untrusted input. For example, a malicious agent could provide an AgentCard containing crafted data in its fields (e.g., description, name, skills.description). If this data is used without sanitization to construct prompts for a Large Language Model (LLM), it could expose your application to prompt injection attacks. Failure to properly validate and sanitize this data before use can introduce security vulnerabilities into your application.
-
-Developers are responsible for implementing appropriate security measures, such as input validation and secure handling of credentials to protect their systems and users.
+Important: The sample code provided is for demonstration purposes
+and illustrates the mechanics of the Agent-to-Agent (A2A) protocol.
+When building production applications, it is critical to treat any agent
+operating outside of your direct control as a potentially untrusted entity.
+
+All data received from an external agent—including but not limited to its AgentCard,
+messages, artifacts, and task statuses—should be handled as untrusted input.
+For example, a malicious agent could provide an AgentCard containing crafted data
+in its fields (e.g., description, name, skills.description). If this data is used
+without sanitization to construct prompts for a Large Language Model (LLM),
+it could expose your application to prompt injection attacks. Failure to properly
+validate and sanitize this data before use can introduce security vulnerabilities
+into your application.
+
+Developers are responsible for implementing appropriate security measures,
+such as input validation and secure handling of credentials to protect their systems and users.

samples/go/agents/signing_and_verifying/main.go

@@ -17,6 +17,12 @@ import (
 	"github.com/a2aproject/a2a-go/a2asrv"
 )
 
+const (
+	modeText  = "text"
+	serverURL = "http://localhost:9999"
+	es256Alg  = "ES256"
+)
+
 func main() {
 	runClientFlag := flag.Bool("client", false, "Run the test client instead of starting server only")
 	flag.Parse()
@@ -44,7 +50,7 @@ func main() {
 	if err != nil {
 		log.Fatalf("Failed to marshal keys JSON: %v", err)
 	}
-	if err := os.WriteFile("public_keys.json", keysJSON, 0644); err != nil {
+	if err := os.WriteFile("public_keys.json", keysJSON, 0600); err != nil {
 		log.Fatalf("Failed to save public_keys.json: %v", err)
 	}
 
@@ -67,16 +73,16 @@ func main() {
 	publicAgentCard := &a2a.AgentCard{
 		Name:               "Signed Agent",
 		Description:        "An Agent that is signed",
-		IconURL:            "http://localhost:9999/",
+		IconURL:            serverURL + "/",
 		Version:            "1.0.0",
-		DefaultInputModes:  []string{"text"},
-		DefaultOutputModes: []string{"text"},
+		DefaultInputModes:  []string{modeText},
+		DefaultOutputModes: []string{modeText},
 		Capabilities:       a2a.AgentCapabilities{Streaming: true, ExtendedAgentCard: true},
 		SupportedInterfaces: []*a2a.AgentInterface{
 			{
 				ProtocolBinding: a2a.TransportProtocolJSONRPC,
 				ProtocolVersion: a2a.Version,
-				URL:             "http://localhost:9999",
+				URL:             serverURL,
 			},
 		},
 		Skills: []a2a.AgentSkill{skill},
@@ -85,16 +91,16 @@ func main() {
 	extendedAgentCard := &a2a.AgentCard{
 		Name:               "Signed Agent - Extended Edition",
 		Description:        "The full-featured signed agent for authenticated users.",
-		IconURL:            "http://localhost:9999/",
+		IconURL:            serverURL + "/",
 		Version:            "1.0.1",
-		DefaultInputModes:  []string{"text"},
-		DefaultOutputModes: []string{"text"},
+		DefaultInputModes:  []string{modeText},
+		DefaultOutputModes: []string{modeText},
 		Capabilities:       a2a.AgentCapabilities{Streaming: true, ExtendedAgentCard: true},
 		SupportedInterfaces: []*a2a.AgentInterface{
 			{
 				ProtocolBinding: a2a.TransportProtocolJSONRPC,
 				ProtocolVersion: a2a.Version,
-				URL:             "http://localhost:9999",
+				URL:             serverURL,
 			},
 		},
 		Skills: []a2a.AgentSkill{
@@ -108,8 +114,8 @@ func main() {
 		privateKey,
 		ProtectedHeader{
 			Kid: kid,
-			Alg: "ES256",
-			Jku: "http://localhost:9999/public_keys.json",
+			Alg: es256Alg,
+			Jku: serverURL + "/public_keys.json",
 		},
 	)
 

samples/go/agents/signing_and_verifying/signing.go

@@ -14,7 +14,7 @@ import (
 // Sentinel errors for signature verification matching Python SDK exception types.
 var (
 	ErrNoSignature       = errors.New("AgentCard has no signatures to verify")
-	ErrInvalidSignatures = errors.New("No valid signature found")
+	ErrInvalidSignatures = errors.New("no valid signature found")
 )
 
 // ProtectedHeader defines the protected header parameters for JWS (RFC 7515).
@@ -84,7 +84,7 @@ func canonicalizeAgentCard(card *a2a.AgentCard) ([]byte, error) {
 // createAgentCardSigner creates a function that signs an AgentCard and appends the signature.
 func createAgentCardSigner(privateKey *ecdsa.PrivateKey, protectedHeader ProtectedHeader) func(card *a2a.AgentCard) (*a2a.AgentCard, error) {
 	if protectedHeader.Alg == "" {
-		protectedHeader.Alg = "ES256"
+		protectedHeader.Alg = es256Alg
 	}
 
 	method := jwt.GetSigningMethod(protectedHeader.Alg)
@@ -145,7 +145,7 @@ func createSignatureVerifier(keyProvider KeyProvider, allowedAlgs []string) func
 				continue
 			}
 			var protectedHeader ProtectedHeader
-			if err := json.Unmarshal(protectedBytes, &protectedHeader); err != nil {
+			if unmarshalErr := json.Unmarshal(protectedBytes, &protectedHeader); unmarshalErr != nil {
 				continue
 			}
 

samples/go/agents/signing_and_verifying/test_client.go

@@ -22,6 +22,7 @@ func keyProvider(kid, jku string) (any, error) {
 		return nil, fmt.Errorf("kid or jku missing")
 	}
 
+	//nolint:gosec // JKU URL is dynamic by design per RFC 7515
 	resp, err := http.Get(jku)
 	if err != nil {
 		return nil, fmt.Errorf("failed to fetch jku: %w", err)
@@ -38,8 +39,8 @@ func keyProvider(kid, jku string) (any, error) {
 	}
 
 	var keys map[string]string
-	if err := json.Unmarshal(body, &keys); err != nil {
-		return nil, fmt.Errorf("failed to unmarshal keys JSON: %w", err)
+	if unmarshalErr := json.Unmarshal(body, &keys); unmarshalErr != nil {
+		return nil, fmt.Errorf("failed to unmarshal keys JSON: %w", unmarshalErr)
 	}
 
 	pemStr, ok := keys[kid]
@@ -62,9 +63,9 @@ func keyProvider(kid, jku string) (any, error) {
 
 func runTestClient() {
 	ctx := context.Background()
-	signatureVerifier := createSignatureVerifier(keyProvider, []string{"ES256"})
+	signatureVerifier := createSignatureVerifier(keyProvider, []string{es256Alg})
 
-	baseURL := "http://localhost:9999"
+	baseURL := serverURL
 
 	log.Printf("Attempting to fetch public agent card from: %s%s", baseURL, a2asrv.WellKnownAgentCardPath)
 
@@ -76,12 +77,15 @@ func runTestClient() {
 	}
 
 	// Verifies the AgentCard using signature_verifier function before returning it
-	if err := signatureVerifier(publicCard); err != nil {
-		log.Fatalf("Failed to verify public agent card signature: %v", err)
+	if verifyErr := signatureVerifier(publicCard); verifyErr != nil {
+		log.Fatalf("Failed to verify public agent card signature: %v", verifyErr)
 	}
 
 	log.Println("Successfully fetched public agent card:")
-	cardJSON, _ := json.MarshalIndent(publicCard, "", "  ")
+	cardJSON, err := json.MarshalIndent(publicCard, "", "  ")
+	if err != nil {
+		log.Fatalf("Failed to marshal public agent card: %v", err)
+	}
 	log.Println(string(cardJSON))
 	log.Println("\nUsing PUBLIC agent card for client initialization (default).")
 
@@ -97,11 +101,14 @@ func runTestClient() {
 	}
 
 	// Verifies the AgentCard using signature_verifier function before returning it
-	if err := signatureVerifier(extendedCard); err != nil {
-		log.Fatalf("Failed to verify extended agent card signature: %v", err)
+	if verifyErr := signatureVerifier(extendedCard); verifyErr != nil {
+		log.Fatalf("Failed to verify extended agent card signature: %v", verifyErr)
 	}
 
 	fmt.Println("Fetched extended card:")
-	extJSON, _ := json.MarshalIndent(extendedCard, "", "  ")
+	extJSON, err := json.MarshalIndent(extendedCard, "", "  ")
+	if err != nil {
+		log.Fatalf("Failed to marshal extended agent card: %v", err)
+	}
 	fmt.Println(string(extJSON))
 }