use fmt.Errorf isntead of errors.Wrap

Signed-off-by: Matthieu MOREL <matthieu.morel35@gmail.com>

Author: mmorel-35

agent/agent.go

@@ -3,6 +3,7 @@ package agent
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"math/rand"
 	"reflect"
 	"sync"
@@ -11,7 +12,6 @@ import (
 	"github.com/moby/swarmkit/v2/agent/exec"
 	"github.com/moby/swarmkit/v2/api"
 	"github.com/moby/swarmkit/v2/log"
-	"github.com/pkg/errors"
 )
 
 const (
@@ -467,7 +467,7 @@ func (a *Agent) handleSessionMessage(ctx context.Context, message *api.SessionMe
 		if !same {
 			a.keys = message.NetworkBootstrapKeys
 			if err := a.config.Executor.SetNetworkBootstrapKeys(a.keys); err != nil {
-				return errors.Wrap(err, "configuring network key failed")
+				return fmt.Errorf("configuring network key failed: %w", err)
 			}
 		}
 	}

agent/exec/errors_test.go

@@ -3,17 +3,15 @@ package exec
 import (
 	"fmt"
 	"testing"
-
-	"github.com/pkg/errors"
 )
 
 func TestIsTemporary(t *testing.T) {
 	err := fmt.Errorf("err")
 	err1 := MakeTemporary(fmt.Errorf("err1: %w", err))
 	err2 := fmt.Errorf("err2: %w", err1)
-	err3 := errors.Wrap(err2, "err3")
+	err3 := fmt.Errorf("err3: %w", err2)
 	err4 := fmt.Errorf("err4: %w", err3)
-	err5 := errors.Wrap(err4, "err5")
+	err5 := fmt.Errorf("err5: %w", err4)
 
 	if IsTemporary(nil) {
 		t.Error("expected error to not be a temporary error")

ca/certificates.go

@@ -199,13 +199,13 @@ func (rca *RootCA) Signer() (*LocalSigner, error) {
 func (rca *RootCA) IssueAndSaveNewCertificates(kw KeyWriter, cn, ou, org string) (*tls.Certificate, *IssuerInfo, error) {
 	csr, key, err := GenerateNewCSR()
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "error when generating new node certs")
+		return nil, nil, fmt.Errorf("error when generating new node certs: %w", err)
 	}
 
 	// Obtain a signed Certificate
 	certChain, err := rca.ParseValidateAndSignCSR(csr, cn, ou, org)
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "failed to sign node certificate")
+		return nil, nil, fmt.Errorf("failed to sign node certificate: %w", err)
 	}
 	signer, err := rca.Signer()
 	if err != nil { // should never happen, since if ParseValidateAndSignCSR did not fail this root CA must have a signer
@@ -235,7 +235,7 @@ func (rca *RootCA) RequestAndSaveNewCertificates(ctx context.Context, kw KeyWrit
 	// Create a new key/pair and CSR
 	csr, key, err := GenerateNewCSR()
 	if err != nil {
-		return nil, nil, errors.Wrap(err, "error when generating new node certs")
+		return nil, nil, fmt.Errorf("error when generating new node certs: %w", err)
 	}
 
 	// Get the remote manager to issue a CA signed certificate for this node
@@ -397,7 +397,7 @@ func (rca *RootCA) ParseValidateAndSignCSR(csrBytes []byte, cn, ou, org string)
 	}
 	cert, err := signer.Sign(signRequest)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to sign node certificate")
+		return nil, fmt.Errorf("failed to sign node certificate: %w", err)
 	}
 
 	return append(cert, rca.Intermediates...), nil
@@ -423,7 +423,7 @@ func (rca *RootCA) CrossSignCACertificate(otherCAPEM []byte) ([]byte, error) {
 	template.SignatureAlgorithm = signer.parsedCert.SignatureAlgorithm // make sure we can sign with the signer key
 	derBytes, err := x509.CreateCertificate(cryptorand.Reader, template, signer.parsedCert, template.PublicKey, signer.cryptoSigner)
 	if err != nil {
-		return nil, errors.Wrap(err, "could not cross-sign new CA certificate using old CA material")
+		return nil, fmt.Errorf("could not cross-sign new CA certificate using old CA material: %w", err)
 	}
 
 	return pem.EncodeToMemory(&pem.Block{
@@ -448,7 +448,7 @@ func NewRootCA(rootCertBytes, signCertBytes, signKeyBytes []byte, certExpiry tim
 	// Parse all the certificates in the cert bundle
 	parsedCerts, err := helpers.ParseCertificatesPEM(rootCertBytes)
 	if err != nil {
-		return RootCA{}, errors.Wrap(err, "invalid root certificates")
+		return RootCA{}, fmt.Errorf("invalid root certificates: %w", err)
 	}
 	// Check to see if we have at least one valid cert
 	if len(parsedCerts) < 1 {
@@ -465,7 +465,7 @@ func NewRootCA(rootCertBytes, signCertBytes, signKeyBytes []byte, certExpiry tim
 		selfpool := x509.NewCertPool()
 		selfpool.AddCert(cert)
 		if _, err := cert.Verify(x509.VerifyOptions{Roots: selfpool}); err != nil {
-			return RootCA{}, errors.Wrap(err, "error while validating Root CA Certificate")
+			return RootCA{}, fmt.Errorf("error while validating Root CA Certificate: %w", err)
 		}
 		pool.AddCert(cert)
 	}
@@ -480,7 +480,7 @@ func NewRootCA(rootCertBytes, signCertBytes, signKeyBytes []byte, certExpiry tim
 	if len(intermediates) > 0 {
 		parsedIntermediates, _, err = ValidateCertChain(pool, intermediates, false)
 		if err != nil {
-			return RootCA{}, errors.Wrap(err, "invalid intermediate chain")
+			return RootCA{}, fmt.Errorf("invalid intermediate chain: %w", err)
 		}
 		intermediatePool = x509.NewCertPool()
 		for _, cert := range parsedIntermediates {
@@ -616,7 +616,7 @@ func newLocalSigner(keyBytes, certBytes []byte, certExpiry time.Duration, rootPo
 
 	parsedCerts, err := helpers.ParseCertificatesPEM(certBytes)
 	if err != nil {
-		return nil, errors.Wrap(err, "invalid signing CA cert")
+		return nil, fmt.Errorf("invalid signing CA cert: %w", err)
 	}
 	if len(parsedCerts) == 0 {
 		return nil, errors.New("no valid signing CA certificates found")
@@ -629,13 +629,13 @@ func newLocalSigner(keyBytes, certBytes []byte, certExpiry time.Duration, rootPo
 		Intermediates: intermediatePool,
 	}
 	if _, err := parsedCerts[0].Verify(opts); err != nil {
-		return nil, errors.Wrap(err, "error while validating signing CA certificate against roots and intermediates")
+		return nil, fmt.Errorf("error while validating signing CA certificate against roots and intermediates: %w", err)
 	}
 
 	// The key should not be encrypted, but it could be in PKCS8 format rather than PKCS1
 	priv, err := helpers.ParsePrivateKeyPEM(keyBytes)
 	if err != nil {
-		return nil, errors.Wrap(err, "malformed private key")
+		return nil, fmt.Errorf("malformed private key: %w", err)
 	}
 
 	// We will always use the first certificate inside of the root bundle as the active one
@@ -748,7 +748,7 @@ func GetRemoteCA(ctx context.Context, d digest.Digest, connBroker *connectionbro
 	if d != "" {
 		verifier := d.Verifier()
 		if err != nil {
-			return RootCA{}, errors.Wrap(err, "unexpected error getting digest verifier")
+			return RootCA{}, fmt.Errorf("unexpected error getting digest verifier: %w", err)
 		}
 
 		io.Copy(verifier, bytes.NewReader(response.Certificate))

ca/config.go

@@ -173,7 +173,7 @@ func validateRootCAAndTLSCert(rootCA *RootCA, tlsKeyPair *tls.Certificate) error
 	for i, derBytes := range tlsKeyPair.Certificate {
 		parsed, err := x509.ParseCertificate(derBytes)
 		if err != nil {
-			return errors.Wrap(err, "could not validate new root certificates due to parse error")
+			return fmt.Errorf("could not validate new root certificates due to parse error: %w", err)
 		}
 		if i == 0 {
 			leafCert = parsed
@@ -189,7 +189,7 @@ func validateRootCAAndTLSCert(rootCA *RootCA, tlsKeyPair *tls.Certificate) error
 		Intermediates: intermediatePool,
 	}
 	if _, err := leafCert.Verify(opts); err != nil {
-		return errors.Wrap(err, "new root CA does not match existing TLS credentials")
+		return fmt.Errorf("new root CA does not match existing TLS credentials: %w", err)
 	}
 	return nil
 }
@@ -273,20 +273,20 @@ func (s *SecurityConfig) updateTLSCredentials(certificate *tls.Certificate, issu
 	certs := []tls.Certificate{*certificate}
 	clientConfig, err := NewClientTLSConfig(certs, s.rootCA.Pool, ManagerRole)
 	if err != nil {
-		return errors.Wrap(err, "failed to create a new client config using the new root CA")
+		return fmt.Errorf("failed to create a new client config using the new root CA: %w", err)
 	}
 
 	serverConfig, err := NewServerTLSConfig(certs, s.rootCA.Pool)
 	if err != nil {
-		return errors.Wrap(err, "failed to create a new server config using the new root CA")
+		return fmt.Errorf("failed to create a new server config using the new root CA: %w", err)
 	}
 
 	if err := s.ClientTLSCreds.loadNewTLSConfig(clientConfig); err != nil {
-		return errors.Wrap(err, "failed to update the client credentials")
+		return fmt.Errorf("failed to update the client credentials: %w", err)
 	}
 
 	if err := s.ServerTLSCreds.loadNewTLSConfig(serverConfig); err != nil {
-		return errors.Wrap(err, "failed to update the server TLS credentials")
+		return fmt.Errorf("failed to update the server TLS credentials: %w", err)
 	}
 
 	s.certificate = certificate

ca/external.go

@@ -115,7 +115,7 @@ func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert [
 
 	csrJSON, err := json.Marshal(req)
 	if err != nil {
-		return nil, errors.Wrap(err, "unable to JSON-encode CFSSL signing request")
+		return nil, fmt.Errorf("unable to JSON-encode CFSSL signing request: %w", err)
 	}
 
 	// Try each configured proxy URL. Return after the first success. If
@@ -187,14 +187,14 @@ func (eca *ExternalCA) CrossSignRootCA(ctx context.Context, rca RootCA) ([]byte,
 func makeExternalSignRequest(ctx context.Context, client *http.Client, url string, csrJSON []byte) (cert []byte, err error) {
 	resp, err := ctxhttp.Post(ctx, client, url, "application/json", bytes.NewReader(csrJSON))
 	if err != nil {
-		return nil, recoverableErr{err: errors.Wrap(err, "unable to perform certificate signing request")}
+		return nil, recoverableErr{err: fmt.Errorf("unable to perform certificate signing request: %w", err)}
 	}
 	defer resp.Body.Close()
 
 	b := io.LimitReader(resp.Body, CertificateMaxSize)
 	body, err := io.ReadAll(b)
 	if err != nil {
-		return nil, recoverableErr{err: errors.Wrap(err, "unable to read CSR response body")}
+		return nil, recoverableErr{err: fmt.Errorf("unable to read CSR response body: %w", err)}
 	}
 
 	if resp.StatusCode != http.StatusOK {
@@ -204,7 +204,7 @@ func makeExternalSignRequest(ctx context.Context, client *http.Client, url strin
 	var apiResponse api.Response
 	if err := json.Unmarshal(body, &apiResponse); err != nil {
 		log.G(ctx).Debugf("unable to JSON-parse CFSSL API response body: %s", string(body))
-		return nil, recoverableErr{err: errors.Wrap(err, "unable to parse JSON response")}
+		return nil, recoverableErr{err: fmt.Errorf("unable to parse JSON response: %w", err)}
 	}
 
 	if !apiResponse.Success || apiResponse.Result == nil {

ca/keyreadwriter.go

@@ -3,6 +3,7 @@ package ca
 import (
 	"crypto/x509"
 	"encoding/pem"
+	"fmt"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -195,7 +196,7 @@ func (k *KeyReadWriter) Read() ([]byte, []byte, error) {
 	if k.headersObj != nil {
 		newHeaders, err := k.headersObj.UnmarshalHeaders(keyBlock.Headers, k.kekData)
 		if err != nil {
-			return nil, nil, errors.Wrap(err, "unable to read TLS key headers")
+			return nil, nil, fmt.Errorf("unable to read TLS key headers: %w", err)
 		}
 		k.headersObj = newHeaders
 	}

ca/reconciler.go

@@ -54,7 +54,7 @@ func IssuerFromAPIRootCA(rootCA *api.RootCA) (*IssuerInfo, error) {
 	}
 	issuerCerts, err := helpers.ParseCertificatesPEM(wantedIssuer)
 	if err != nil {
-		return nil, errors.Wrap(err, "invalid certificate in cluster root CA object")
+		return nil, fmt.Errorf("invalid certificate in cluster root CA object: %w", err)
 	}
 	if len(issuerCerts) == 0 {
 		return nil, errors.New("invalid certificate in cluster root CA object")
@@ -222,7 +222,7 @@ func (r *rootRotationReconciler) finishRootRotation(tx store.Tx, expectedRootCA
 	updatedRootCA, err := NewRootCA(cluster.RootCA.RootRotation.CACert, signerCert, cluster.RootCA.RootRotation.CAKey,
 		DefaultNodeCertExpiration, nil)
 	if err != nil {
-		return errors.Wrap(err, "invalid cluster root rotation object")
+		return fmt.Errorf("invalid cluster root rotation object: %w", err)
 	}
 	cluster.RootCA = api.RootCA{
 		CACert:     cluster.RootCA.RootRotation.CACert,

ca/server.go

@@ -696,7 +696,7 @@ func (s *Server) UpdateRootCA(ctx context.Context, cluster *api.Cluster, reconci
 		// Attempt to update our local RootCA with the new parameters
 		updatedRootCA, err := RootCAFromAPI(rCA, expiry)
 		if err != nil {
-			return errors.Wrap(err, "invalid Root CA object in cluster")
+			return fmt.Errorf("invalid Root CA object in cluster: %w", err)
 		}
 
 		s.localRootCA = &updatedRootCA

ca/server_test.go

@@ -652,7 +652,7 @@ func (r *rootRotationTester) convergeRootCA(wantRootCA *api.RootCA, descr string
 	require.NoError(r.t, r.tc.MemoryStore.Update(func(tx store.Tx) error {
 		clusters, err := store.FindClusters(tx, store.All)
 		if err != nil || len(clusters) != 1 {
-			return errors.Wrap(err, "unable to find cluster")
+			return fmt.Errorf("unable to find cluster: %w", err)
 		}
 		clusters[0].RootCA = *wantRootCA
 		return store.UpdateCluster(tx, clusters[0])

ca/testutils/externalutils.go

@@ -17,7 +17,6 @@ import (
 	cfsslerrors "github.com/cloudflare/cfssl/errors"
 	"github.com/cloudflare/cfssl/signer"
 	"github.com/moby/swarmkit/v2/ca"
-	"github.com/pkg/errors"
 )
 
 var crossSignPolicy = config.SigningProfile{
@@ -56,7 +55,7 @@ func NewExternalSigningServer(rootCA ca.RootCA, basedir string) (*ExternalSignin
 	}
 	serverCert, _, err := rootCA.IssueAndSaveNewCertificates(ca.NewKeyReadWriter(serverPaths, nil, nil), serverCN, serverOU, "")
 	if err != nil {
-		return nil, errors.Wrap(err, "unable to get TLS server certificate")
+		return nil, fmt.Errorf("unable to get TLS server certificate: %w", err)
 	}
 
 	serverTLSConfig := &tls.Config{
@@ -67,7 +66,7 @@ func NewExternalSigningServer(rootCA ca.RootCA, basedir string) (*ExternalSignin
 
 	tlsListener, err := tls.Listen("tcp", "localhost:0", serverTLSConfig)
 	if err != nil {
-		return nil, errors.Wrap(err, "unable to create TLS connection listener")
+		return nil, fmt.Errorf("unable to create TLS connection listener: %w", err)
 	}
 
 	assignedPort := tlsListener.Addr().(*net.TCPAddr).Port