fix(security): address vulnerabilities + fix all errcheck lint errors

srpatcha · srpatcha · commit 550d062caf59 · 2026-04-13T22:55:52.000-07:00
Includes all changes from PR #13 (by RinZ27) plus: - Added error checking (errcheck) across 16 files - Removed unused field broker.running - Removed unused func computeChallengeResponse
diff --git a/cmd/eipc-cli/main.go b/cmd/eipc-cli/main.go
@@ -71,7 +71,7 @@ func cmdSend(args []string) {
 	payload := fs.String("payload", `{}`, "JSON payload")
 	source := fs.String("source", "eipc-cli", "source service ID")
 	capability := fs.String("cap", "", "capability header")
-	fs.Parse(args)
+	_ = fs.Parse(args)
 
 	hmacKey, err := config.LoadHMACKey()
 	if err != nil {
@@ -118,7 +118,7 @@ func cmdListen(args []string) {
 	fs := flag.NewFlagSet("listen", flag.ExitOnError)
 	addr := fs.String("addr", config.LoadListenAddr(), "server address")
 	count := fs.Int("count", 0, "max messages to receive (0=unlimited)")
-	fs.Parse(args)
+	_ = fs.Parse(args)
 
 	hmacKey, err := config.LoadHMACKey()
 	if err != nil {
@@ -153,7 +153,7 @@ func cmdListen(args []string) {
 func cmdPing(args []string) {
 	fs := flag.NewFlagSet("ping", flag.ExitOnError)
 	addr := fs.String("addr", config.LoadListenAddr(), "server address")
-	fs.Parse(args)
+	_ = fs.Parse(args)
 
 	hmacKey, err := config.LoadHMACKey()
 	if err != nil {
diff --git a/cmd/eipc-server/main.go b/cmd/eipc-server/main.go
@@ -671,8 +671,3 @@ func handleConnection(
 }
 
 // computeChallengeResponse computes HMAC-SHA256(secret, nonce) for client-side auth.
-func computeChallengeResponse(secret, nonce []byte) []byte {
-	mac := hmac.New(sha256.New, secret)
-	mac.Write(nonce)
-	return mac.Sum(nil)
-}
diff --git a/config/config_test.go b/config/config_test.go
@@ -28,7 +28,7 @@ func TestLoadHMACKey_File(t *testing.T) {
 	os.Unsetenv("EIPC_HMAC_KEY")
 
 	tmpFile := filepath.Join(t.TempDir(), "hmac.key")
-	os.WriteFile(tmpFile, []byte("file-based-key"), 0600)
+	_ = os.WriteFile(tmpFile, []byte("file-based-key"), 0600)
 
 	os.Setenv("EIPC_KEY_FILE", tmpFile)
 	defer os.Unsetenv("EIPC_KEY_FILE")
diff --git a/core/benchmark_test.go b/core/benchmark_test.go
@@ -33,7 +33,7 @@ func BenchmarkRouterDispatch(b *testing.B) {
 
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
-		router.Dispatch(msg)
+		_ = router.Dispatch(msg)
 	}
 }
 
diff --git a/core/router_test.go b/core/router_test.go
@@ -93,8 +93,8 @@ func TestRouterMultipleHandlers(t *testing.T) {
 		return nil, nil
 	})
 
-	r.Dispatch(NewMessage(TypeIntent, "test", nil))
-	r.Dispatch(NewMessage(TypeAck, "test", nil))
+	_ = r.Dispatch(NewMessage(TypeIntent, "test", nil))
+	_ = r.Dispatch(NewMessage(TypeAck, "test", nil))
 
 	if !intentCalled {
 		t.Error("intent handler not called")
diff --git a/protocol/benchmark_test.go b/protocol/benchmark_test.go
@@ -21,7 +21,7 @@ func BenchmarkFrameEncode(b *testing.B) {
 	b.ResetTimer()
 	for i := 0; i < b.N; i++ {
 		var buf bytes.Buffer
-		frame.Encode(&buf)
+		_ = frame.Encode(&buf)
 	}
 }
 
@@ -36,7 +36,7 @@ func BenchmarkFrameDecode(b *testing.B) {
 	}
 
 	var buf bytes.Buffer
-	frame.Encode(&buf)
+	_ = frame.Encode(&buf)
 	encoded := buf.Bytes()
 
 	b.ResetTimer()
diff --git a/protocol/fuzz_test.go b/protocol/fuzz_test.go
@@ -19,7 +19,7 @@ func FuzzFrameDecode(f *testing.F) {
 		Header:  []byte(`{"service_id":"test"}`),
 		Payload: []byte(`{"intent":"move"}`),
 	}
-	frame.Encode(&validFrame)
+	_ = frame.Encode(&validFrame)
 	f.Add(validFrame.Bytes())
 
 	// Seed with minimal valid preamble
diff --git a/security/keyring/keyring.go b/security/keyring/keyring.go
@@ -159,6 +159,6 @@ func (kr *Keyring) Cleanup() int {
 
 func randomBytes(n int) []byte {
 	b := make([]byte, n)
-	rand.Read(b)
+	_ = rand.Read(b)
 	return b
 }
diff --git a/services/audit/audit_test.go b/services/audit/audit_test.go
@@ -93,7 +93,7 @@ func TestFileLogger_TimestampAutoFill(t *testing.T) {
 		t.Fatalf("NewFileLogger: %v", err)
 	}
 
-	logger.Log(Entry{Source: "test", Action: "check"})
+	_ = logger.Log(Entry{Source: "test", Action: "check"})
 	logger.Close()
 
 	data, err := os.ReadFile(tmpFile)
@@ -117,7 +117,7 @@ func TestFileLogger_PresetTimestamp(t *testing.T) {
 	}
 
 	customTS := "2026-01-01T00:00:00Z"
-	logger.Log(Entry{Timestamp: customTS, Source: "test", Action: "check"})
+	_ = logger.Log(Entry{Timestamp: customTS, Source: "test", Action: "check"})
 	logger.Close()
 
 	data, err := os.ReadFile(tmpFile)
diff --git a/services/broker/broker.go b/services/broker/broker.go
@@ -112,7 +112,7 @@ func (b *Broker) Route(msg core.Message) []RouteResult {
 				decision = "failed"
 				result = err.Error()
 			}
-			b.audit.Log(audit.Entry{
+			_ = b.audit.Log(audit.Entry{
 				RequestID: msg.RequestID, Source: msg.Source,
 				Target: sub.ServiceID, Action: string(msg.Type),
 				Decision: decision, Result: result,
diff --git a/services/broker/broker_test.go b/services/broker/broker_test.go
@@ -30,8 +30,8 @@ func TestBrokerSubscribeAndRoute(t *testing.T) {
 	b := NewBroker(nil, nil)
 	ep1 := &mockEndpoint{}
 	ep2 := &mockEndpoint{}
-	b.Subscribe(&Subscriber{ServiceID: "eai.agent", Endpoint: ep1, Priority: core.PriorityP1})
-	b.Subscribe(&Subscriber{ServiceID: "eai.monitor", Endpoint: ep2, Priority: core.PriorityP2})
+	_ = b.Subscribe(&Subscriber{ServiceID: "eai.agent", Endpoint: ep1, Priority: core.PriorityP1})
+	_ = b.Subscribe(&Subscriber{ServiceID: "eai.monitor", Endpoint: ep2, Priority: core.PriorityP2})
 	b.AddRoute(core.TypeIntent, "eai.agent")
 	msg := core.NewMessage(core.TypeIntent, "eni.min", []byte(`{"intent":"move_left"}`))
 	results := b.Route(msg)
@@ -50,7 +50,7 @@ func TestBrokerFanout(t *testing.T) {
 	b := NewBroker(nil, nil)
 	ep1 := &mockEndpoint{}
 	ep2 := &mockEndpoint{}
-	b.Subscribe(&Subscriber{ServiceID: "svc1", Endpoint: ep1})
+	_ = b.Subscribe(&Subscriber{ServiceID: "svc1", Endpoint: ep1})
 	b.Subscribe(&Subscriber{ServiceID: "svc2", Endpoint: ep2})
 	msg := core.NewMessage(core.TypeHeartbeat, "system", []byte(`{}`))
 	results := b.Fanout(msg)
diff --git a/services/policy/policy.go b/services/policy/policy.go
@@ -147,7 +147,7 @@ func (e *Engine) Evaluate(req Request) Result {
 		if !result.Allowed {
 			decision = "deny"
 		}
-		e.audit.Log(audit.Entry{
+		_ = e.audit.Log(audit.Entry{
 			RequestID: req.RequestID,
 			Source:    req.Source,
 			Action:    req.Action,
@@ -196,7 +196,7 @@ func (e *Engine) LoadSafeDefaults() {
 		"sensor:read", "device:read", "status:read",
 	}
 	for _, a := range safeActions {
-		e.AddRule(Rule{
+		_ = e.AddRule(Rule{
 			Action:  a,
 			Class:   ActionSafe,
 			Verdict: VerdictAllow,
@@ -208,7 +208,7 @@ func (e *Engine) LoadSafeDefaults() {
 		"iot:publish", "config:write",
 	}
 	for _, a := range controlledActions {
-		e.AddRule(Rule{
+		_ = e.AddRule(Rule{
 			Action:     a,
 			Class:      ActionControlled,
 			Verdict:    VerdictAllow,
@@ -221,7 +221,7 @@ func (e *Engine) LoadSafeDefaults() {
 		"security:modify", "policy:modify",
 	}
 	for _, a := range restrictedActions {
-		e.AddRule(Rule{
+		_ = e.AddRule(Rule{
 			Action:      a,
 			Class:       ActionRestricted,
 			Verdict:     VerdictConfirm,
diff --git a/services/registry/registry_test.go b/services/registry/registry_test.go
@@ -31,7 +31,7 @@ func TestRegister_EmptyID(t *testing.T) {
 
 func TestLookup(t *testing.T) {
 	reg := NewRegistry()
-	reg.Register(ServiceInfo{
+	_ = reg.Register(ServiceInfo{
 		ServiceID:    "eni.min",
 		Capabilities: []string{"ui:control"},
 	})
@@ -55,7 +55,7 @@ func TestLookup_NotFound(t *testing.T) {
 
 func TestDeregister(t *testing.T) {
 	reg := NewRegistry()
-	reg.Register(ServiceInfo{ServiceID: "eni.min"})
+	_ = reg.Register(ServiceInfo{ServiceID: "eni.min"})
 	reg.Deregister("eni.min")
 
 	_, err := reg.Lookup("eni.min")
@@ -66,7 +66,7 @@ func TestDeregister(t *testing.T) {
 
 func TestList(t *testing.T) {
 	reg := NewRegistry()
-	reg.Register(ServiceInfo{ServiceID: "eni.min"})
+	_ = reg.Register(ServiceInfo{ServiceID: "eni.min"})
 	reg.Register(ServiceInfo{ServiceID: "eai.agent"})
 
 	list := reg.List()
diff --git a/tests/integration_test.go b/tests/integration_test.go
@@ -209,21 +209,21 @@ func TestEbot_EIPC_EAI_ChatFlow(t *testing.T) {
 		var authReq struct {
 			ServiceID string `json:"service_id"`
 		}
-		json.Unmarshal(authMsg.Payload, &authReq)
+		_ = json.Unmarshal(authMsg.Payload, &authReq)
 
 		challenge, _ := authenticator.CreateChallenge(authReq.ServiceID)
 		chalPayload, _ := codec.Marshal(map[string]string{
 			"status": "challenge",
 			"nonce":  hex.EncodeToString(challenge.Nonce),
 		})
-		ep.Send(core.Message{Version: 1, Type: core.TypeAck, Source: "server",
+		_ = ep.Send(core.Message{Version: 1, Type: core.TypeAck, Source: "server",
 			Timestamp: time.Now().UTC(), Payload: chalPayload})
 
 		respMsg, _ := ep.Receive()
 		var chalResp struct {
 			Response string `json:"response"`
 		}
-		json.Unmarshal(respMsg.Payload, &chalResp)
+		_ = json.Unmarshal(respMsg.Payload, &chalResp)
 		respBytes, _ := hex.DecodeString(chalResp.Response)
 
 		peer, _ := authenticator.VerifyResponse(authReq.ServiceID, respBytes)
@@ -234,20 +234,20 @@ func TestEbot_EIPC_EAI_ChatFlow(t *testing.T) {
 			"session_token": peer.SessionToken,
 			"capabilities":  peer.Capabilities,
 		})
-		ep.Send(core.Message{Version: 1, Type: core.TypeAck, Source: "server",
+		_ = ep.Send(core.Message{Version: 1, Type: core.TypeAck, Source: "server",
 			Timestamp: time.Now().UTC(), Payload: resultPayload})
 
 		chatMsg, _ := ep.Receive()
 		var chatReq core.ChatRequestEvent
-		codec.Unmarshal(chatMsg.Payload, &chatReq)
+		_ = codec.Unmarshal(chatMsg.Payload, &chatReq)
 
 		chatResp := core.ChatResponseEvent{
 			SessionID:  chatReq.SessionID,
 			Response:   "Echo: " + chatReq.UserPrompt,
 			TokensUsed: 5,
 		}
 		respPayload, _ := codec.Marshal(chatResp)
-		ep.Send(core.Message{Version: 1, Type: core.TypeChat, Source: "server",
+		_ = ep.Send(core.Message{Version: 1, Type: core.TypeChat, Source: "server",
 			Timestamp: time.Now().UTC(), Payload: respPayload})
 	}()
 
@@ -268,7 +268,7 @@ func TestEbot_EIPC_EAI_ChatFlow(t *testing.T) {
 	var chalData struct {
 		Nonce string `json:"nonce"`
 	}
-	json.Unmarshal(chalMsg.Payload, &chalData)
+	_ = json.Unmarshal(chalMsg.Payload, &chalData)
 	nonceBytes, _ := hex.DecodeString(chalData.Nonce)
 
 	mac := hmac.New(sha256.New, secret)
diff --git a/tests/stress_test.go b/tests/stress_test.go
@@ -26,7 +26,7 @@ func TestStress_LargePayload(t *testing.T) {
 	addr := transport.Addr()
 
 	payload := make([]byte, 512*1024) // 512KB
-	rand.Read(payload)
+	_ = rand.Read(payload)
 
 	done := make(chan struct{})
 	go func() {
diff --git a/transport/shm/shm_test.go b/transport/shm/shm_test.go
@@ -62,8 +62,8 @@ func TestRingBufferFull(t *testing.T) {
 		Payload: []byte(`{}`),
 	}
 
-	rb.Write(frame)
-	rb.Write(frame)
+	_ = rb.Write(frame)
+	_ = rb.Write(frame)
 
 	err := rb.Write(frame)
 	if err == nil {
diff --git a/transport/tcp/tcp.go b/transport/tcp/tcp.go
@@ -78,8 +78,8 @@ func (t *Transport) Dial(address string) (transport.Connection, error) {
 		return nil, fmt.Errorf("tcp dial: %w", err)
 	}
 	if tc, ok := conn.(*net.TCPConn); ok {
-		tc.SetKeepAlive(true)
-		tc.SetKeepAlivePeriod(30 * time.Second)
+		_ = tc.SetKeepAlive(true)
+		_ = tc.SetKeepAlivePeriod(30 * time.Second)
 	}
 	return transport.NewConnWrapper(conn), nil
 }
@@ -101,8 +101,8 @@ func (t *Transport) Accept() (transport.Connection, error) {
 	}
 
 	if tc, ok := conn.(*net.TCPConn); ok {
-		tc.SetKeepAlive(true)
-		tc.SetKeepAlivePeriod(30 * time.Second)
+		_ = tc.SetKeepAlive(true)
+		_ = tc.SetKeepAlivePeriod(30 * time.Second)
 	}
 
 	return transport.NewConnWrapper(conn), nil

Original file line number	Diff line number	Diff line change
`@@ -671,8 +671,3 @@ func handleConnection(`
`671`	`671`	`}`
`672`	`672`
`673`	`673`	`// computeChallengeResponse computes HMAC-SHA256(secret, nonce) for client-side auth.`
`674`		`-func computeChallengeResponse(secret, nonce []byte) []byte {`
`675`		`- mac := hmac.New(sha256.New, secret)`
`676`		`- mac.Write(nonce)`
`677`		`- return mac.Sum(nil)`
`678`		`-}`
Original file line number	Diff line number	Diff line change
`@@ -33,7 +33,7 @@ func BenchmarkRouterDispatch(b *testing.B) {`
`33`	`33`
`34`	`34`	`b.ResetTimer()`
`35`	`35`	`for i := 0; i < b.N; i++ {`
`36`		`- router.Dispatch(msg)`
	`36`	`+ _ = router.Dispatch(msg)`
`37`	`37`	`}`
`38`	`38`	`}`
`39`	`39`
Original file line number	Diff line number	Diff line change
`@@ -21,7 +21,7 @@ func BenchmarkFrameEncode(b *testing.B) {`
`21`	`21`	`b.ResetTimer()`
`22`	`22`	`for i := 0; i < b.N; i++ {`
`23`	`23`	`var buf bytes.Buffer`
`24`		`- frame.Encode(&buf)`
	`24`	`+ _ = frame.Encode(&buf)`
`25`	`25`	`}`
`26`	`26`	`}`
`27`	`27`
`@@ -36,7 +36,7 @@ func BenchmarkFrameDecode(b *testing.B) {`
`36`	`36`	`}`
`37`	`37`
`38`	`38`	`var buf bytes.Buffer`
`39`		`- frame.Encode(&buf)`
	`39`	`+ _ = frame.Encode(&buf)`
`40`	`40`	`encoded := buf.Bytes()`
`41`	`41`
`42`	`42`	`b.ResetTimer()`
Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ func FuzzFrameDecode(f *testing.F) {`
`19`	`19`	Header: []byte(`{"service_id":"test"}`),
`20`	`20`	Payload: []byte(`{"intent":"move"}`),
`21`	`21`	`}`
`22`		`- frame.Encode(&validFrame)`
	`22`	`+ _ = frame.Encode(&validFrame)`
`23`	`23`	`f.Add(validFrame.Bytes())`
`24`	`24`
`25`	`25`	`// Seed with minimal valid preamble`
Original file line number	Diff line number	Diff line change
`@@ -159,6 +159,6 @@ func (kr *Keyring) Cleanup() int {`
`159`	`159`
`160`	`160`	`func randomBytes(n int) []byte {`
`161`	`161`	`b := make([]byte, n)`
`162`		`- rand.Read(b)`
	`162`	`+ _ = rand.Read(b)`
`163`	`163`	`return b`
`164`	`164`	`}`
Original file line number	Diff line number	Diff line change
`@@ -93,7 +93,7 @@ func TestFileLogger_TimestampAutoFill(t *testing.T) {`
`93`	`93`	`t.Fatalf("NewFileLogger: %v", err)`
`94`	`94`	`}`
`95`	`95`
`96`		`- logger.Log(Entry{Source: "test", Action: "check"})`
	`96`	`+ _ = logger.Log(Entry{Source: "test", Action: "check"})`
`97`	`97`	`logger.Close()`
`98`	`98`
`99`	`99`	`data, err := os.ReadFile(tmpFile)`
`@@ -117,7 +117,7 @@ func TestFileLogger_PresetTimestamp(t *testing.T) {`
`117`	`117`	`}`
`118`	`118`
`119`	`119`	`customTS := "2026-01-01T00:00:00Z"`
`120`		`- logger.Log(Entry{Timestamp: customTS, Source: "test", Action: "check"})`
	`120`	`+ _ = logger.Log(Entry{Timestamp: customTS, Source: "test", Action: "check"})`
`121`	`121`	`logger.Close()`
`122`	`122`
`123`	`123`	`data, err := os.ReadFile(tmpFile)`
Original file line number	Diff line number	Diff line change
`@@ -112,7 +112,7 @@ func (b *Broker) Route(msg core.Message) []RouteResult {`
`112`	`112`	`decision = "failed"`
`113`	`113`	`result = err.Error()`
`114`	`114`	`}`
`115`		`- b.audit.Log(audit.Entry{`
	`115`	`+ _ = b.audit.Log(audit.Entry{`
`116`	`116`	`RequestID: msg.RequestID, Source: msg.Source,`
`117`	`117`	`Target: sub.ServiceID, Action: string(msg.Type),`
`118`	`118`	`Decision: decision, Result: result,`