WH-1934: upgrade golang to 1.19 (#1941)

* upgrade to golang 1.19.3

Co-authored-by: tbjump <>
Co-authored-by: tbjump <unknown>

.github/workflows/build.yml

@@ -48,7 +48,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.17.5"
+          go-version: "1.19.3"
       - run: make node
 
   algorand:
@@ -233,7 +233,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.19.0"
+          go-version: "1.19.3"
       - run: curl https://get.ignite.com/cli@v0.23.0 | bash && mv ignite /usr/local/bin/
       - run: cd wormchain && make proto -B && make test
 
@@ -251,7 +251,7 @@ jobs:
       - uses: actions/checkout@v2
       - uses: actions/setup-go@v2
         with:
-          go-version: "1.17.5"
+          go-version: "1.19.3"
       - name: Install formatter
         run: go install golang.org/x/tools/cmd/goimports@latest
       - name: Formatting checks

.golangci.yml

@@ -5,15 +5,12 @@ linters:
   # Enable specific linter
   # https://golangci-lint.run/usage/linters/#enabled-by-default-linters
   enable:
-    - deadcode
     - errcheck
     - gosimple
     - govet
     - ineffassign
     - staticcheck
-    - structcheck
     - typecheck
     - unused
-    - varcheck
     - gosec
 

DEVELOP.md

@@ -4,7 +4,7 @@
 
 The following dependencies are required for local development:
 
-- [Go](https://golang.org/dl/) >= 1.17.5
+- [Go](https://golang.org/dl/) >= 1.19.3
 - [Tilt](http://tilt.dev/) >= 0.20.8
 - Any of the local Kubernetes clusters supported by Tilt.
   We strongly recommend [minikube](https://kubernetes.io/docs/setup/learning-environment/minikube/) >=

Dockerfile.lint

@@ -1,5 +1,5 @@
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/golang:1.17.5@sha256:90d1ab81f3d157ca649a9ff8d251691b810d95ea6023a03cdca139df58bca599
+FROM docker.io/golang:1.19.3@sha256:dc76ef03e54c34a00dcdca81e55c242d24b34d231637776c4bb5c1a8e8514253
 
 RUN useradd -u 1000 -U -m -d /home/lint lint
 USER 1000

Dockerfile.proto

@@ -1,5 +1,5 @@
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/golang:1.17.5@sha256:90d1ab81f3d157ca649a9ff8d251691b810d95ea6023a03cdca139df58bca599 AS go-tools
+FROM docker.io/golang:1.19.3@sha256:dc76ef03e54c34a00dcdca81e55c242d24b34d231637776c4bb5c1a8e8514253 AS go-tools
 
 # Support additional root CAs
 COPY README.md cert.pem* /certs/
@@ -15,7 +15,7 @@ RUN --mount=type=cache,target=/root/.cache --mount=type=cache,target=/go \
 	cd /app/tools && CGO_ENABLED=0 ./build.sh
 
 # syntax=docker.io/docker/dockerfile:1.3@sha256:42399d4635eddd7a9b8a24be879d2f9a930d0ed040a61324cfdf59ef1357b3b2
-FROM docker.io/golang:1.17.5@sha256:90d1ab81f3d157ca649a9ff8d251691b810d95ea6023a03cdca139df58bca599 AS go-build
+FROM docker.io/golang:1.19.3@sha256:dc76ef03e54c34a00dcdca81e55c242d24b34d231637776c4bb5c1a8e8514253 AS go-build
 
 # Support additional root CAs
 COPY README.md cert.pem* /certs/

bitcoin/Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 docker.io/golang:1.17.5@sha256:90d1ab81f3d157ca649a9ff8d251691b810d95ea6023a03cdca139df58bca599 AS bitcoin-build
+FROM docker.io/golang:1.19.3@sha256:dc76ef03e54c34a00dcdca81e55c242d24b34d231637776c4bb5c1a8e8514253 AS bitcoin-build
 
 ARG ARCH=amd64
 

clients/eth/go.mod

@@ -1,6 +1,6 @@
 module github.com/certusone/wormhole/clients/eth
 
-go 1.17
+go 1.19
 
 require (
 	github.com/certusone/wormhole/node v0.0.0-20210722131135-a191017d22d0

docs/operations.md

@@ -99,7 +99,7 @@ frequency). Light clients have much lower hardware requirements.
 For security reasons, we do not provide a pre-built binary. You need to check out the repo and build the
 guardiand binary from source. A Git repo is much harder to tamper with than release binaries.
 
-To build the Wormhole node, you need [Go](https://golang.org/dl/) >= 1.17.5.
+To build the Wormhole node, you need [Go](https://golang.org/dl/) >= 1.19.0
 
 First, check out the version of the Wormhole repo that you want to deploy:
 

near/test/go.mod

@@ -1,6 +1,6 @@
 module github.com/certusone/wormhole/near
 
-go 1.17
+go 1.19
 
 require (
 	github.com/tidwall/gjson v1.14.1 // indirect

node/cmd/guardiand/adminclient.go

@@ -4,8 +4,8 @@ import (
 	"context"
 	"encoding/hex"
 	"fmt"
-	"io/ioutil"
 	"log"
+	"os"
 	"strconv"
 	"strings"
 	"time"
@@ -179,7 +179,7 @@ func runInjectGovernanceVAA(cmd *cobra.Command, args []string) {
 	}
 	defer conn.Close()
 
-	b, err := ioutil.ReadFile(path)
+	b, err := os.ReadFile(path)
 	if err != nil {
 		log.Fatalf("failed to read file: %v", err)
 	}

node/cmd/guardiand/adminverify.go

@@ -3,8 +3,8 @@ package guardiand
 import (
 	"encoding/hex"
 	"fmt"
-	"io/ioutil"
 	"log"
+	"os"
 	"time"
 
 	"github.com/wormhole-foundation/wormhole/sdk/vaa"
@@ -27,7 +27,7 @@ var AdminClientGovernanceVAAVerifyCmd = &cobra.Command{
 func runGovernanceVAAVerify(cmd *cobra.Command, args []string) {
 	path := args[0]
 
-	b, err := ioutil.ReadFile(path)
+	b, err := os.ReadFile(path)
 	if err != nil {
 		log.Fatalf("failed to read file: %v", err)
 	}

node/cmd/guardiand/guardiankey.go

@@ -5,7 +5,7 @@ import (
 	"crypto/rand"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"os"
 
@@ -70,7 +70,7 @@ func loadGuardianKey(filename string) (*ecdsa.PrivateKey, error) {
 		return nil, fmt.Errorf("invalid block type: %s", p.Type)
 	}
 
-	b, err := ioutil.ReadAll(p.Body)
+	b, err := io.ReadAll(p.Body)
 	if err != nil {
 		return nil, fmt.Errorf("failed to read file: %w", err)
 	}

node/cmd/guardiand/node.go

@@ -8,8 +8,10 @@ import (
 	"net/http"
 	_ "net/http/pprof" // #nosec G108 we are using a custom router (`router := mux.NewRouter()`) and thus not automatically expose pprof.
 	"os"
+	"os/signal"
 	"path"
 	"strings"
+	"syscall"
 
 	"github.com/certusone/wormhole/node/pkg/watchers/wormchain"
 
@@ -437,7 +439,7 @@ func runNode(cmd *cobra.Command, args []string) {
 		go func() {
 			logger.Info("status server listening on [::]:6060")
 			// SECURITY: If making changes, ensure that we always do `router := mux.NewRouter()` before this to avoid accidentally exposing pprof
-			logger.Error("status server crashed", zap.Error(http.ListenAndServe(*statusAddr, router)))
+			logger.Error("status server crashed", zap.Error(http.ListenAndServe(*statusAddr, router))) // #nosec G114 local status server not vulnerable to DoS attack
 		}()
 	}
 
@@ -801,6 +803,14 @@ func runNode(cmd *cobra.Command, args []string) {
 	rootCtx, rootCtxCancel = context.WithCancel(context.Background())
 	defer rootCtxCancel()
 
+	sigterm := make(chan os.Signal, 1)
+	signal.Notify(sigterm, syscall.SIGTERM)
+	go func() {
+		<-sigterm
+		logger.Info("Received sigterm. exiting.")
+		rootCtxCancel()
+	}()
+
 	// Ethereum lock event channel
 	lockC := make(chan *common.MessagePublication)
 

node/cmd/guardiand/publicweb.go

@@ -6,6 +6,7 @@ import (
 	"net"
 	"net/http"
 	"strings"
+	"time"
 
 	publicrpcv1 "github.com/certusone/wormhole/node/pkg/proto/publicrpc/v1"
 	"github.com/certusone/wormhole/node/pkg/supervisor"
@@ -82,7 +83,8 @@ func publicwebServiceRunnable(
 		})))
 
 		srv := &http.Server{
-			Handler: mux,
+			Handler:           mux,
+			ReadHeaderTimeout: 3 * time.Second,
 		}
 
 		// TLS setup

node/cmd/spy/spy.go

@@ -440,7 +440,7 @@ func runSpy(cmd *cobra.Command, args []string) {
 
 		go func() {
 			logger.Info("status server listening on [::]:6060")
-			logger.Error("status server crashed", zap.Error(http.ListenAndServe(*statusAddr, router)))
+			logger.Error("status server crashed", zap.Error(http.ListenAndServe(*statusAddr, router))) // #nosec G114 local status server not vulnerable to DoS attack
 		}()
 	}
 

node/go.mod

@@ -1,6 +1,6 @@
 module github.com/certusone/wormhole/node
 
-go 1.17
+go 1.19
 
 require (
 	cloud.google.com/go/bigtable v1.10.1

node/hack/repair_terra/repair.go

@@ -6,7 +6,7 @@ import (
 	"encoding/hex"
 	"flag"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"net/http"
 	"strconv"
@@ -80,7 +80,7 @@ func getSequencesForTxhash(txhash string, fcd string, contractAddressLogKey stri
 		return []uint64{}, fmt.Errorf("failed to get message: %w", err)
 	}
 	defer resp.Body.Close()
-	txBody, err := ioutil.ReadAll(resp.Body)
+	txBody, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return []uint64{}, fmt.Errorf("failed to read message: %w", err)
 	}
@@ -349,7 +349,7 @@ func main() {
 		}
 		defer resp.Body.Close()
 
-		blocksBody, err := ioutil.ReadAll(resp.Body)
+		blocksBody, err := io.ReadAll(resp.Body)
 		if err != nil {
 			log.Fatalf("failed to read log: %v", err)
 			continue

node/pkg/common/nodekey.go

@@ -2,7 +2,6 @@ package common
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 
 	"github.com/libp2p/go-libp2p/core/crypto"
@@ -11,7 +10,7 @@ import (
 )
 
 func GetOrCreateNodeKey(logger *zap.Logger, path string) (crypto.PrivKey, error) {
-	b, err := ioutil.ReadFile(path)
+	b, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
 			logger.Info("No node key found, generating a new one...", zap.String("path", path))
@@ -26,7 +25,7 @@ func GetOrCreateNodeKey(logger *zap.Logger, path string) (crypto.PrivKey, error)
 				panic(err)
 			}
 
-			err = ioutil.WriteFile(path, s, 0600)
+			err = os.WriteFile(path, s, 0600)
 			if err != nil {
 				return nil, fmt.Errorf("failed to write node key: %w", err)
 			}

node/pkg/common/nodekey_test.go

@@ -2,7 +2,6 @@ package common
 
 import (
 	"fmt"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"testing"
@@ -22,7 +21,7 @@ func TestGetOrCreateNodeKeyWithNewPath(t *testing.T) {
 	assert.NotNil(t, privKey1)
 
 	// Re-read the generated privKey file back into memory
-	b, _ := ioutil.ReadFile(path)
+	b, _ := os.ReadFile(path)
 	privKey2, _ := crypto.UnmarshalPrivateKey(b)
 
 	// Make sure we got the same key

node/pkg/governor/governor_prices.go

@@ -10,7 +10,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"math/big"
 	"net/http"
 	"net/url"
@@ -102,7 +102,7 @@ func (gov *ChainGovernor) queryCoinGecko() error {
 		}
 	}()
 
-	responseData, err := ioutil.ReadAll(response.Body)
+	responseData, err := io.ReadAll(response.Body)
 	if err != nil {
 		gov.logger.Error("cgov: failed to parse coin gecko response, reverting to configured prices", zap.Error(err))
 		gov.revertAllPrices()

node/pkg/notify/discord/notify.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/hex"
 	"fmt"
-	"strings"
 	"sync"
 
 	"github.com/diamondburned/arikawa/v3/api"
@@ -12,6 +11,8 @@ import (
 	"github.com/ethereum/go-ethereum/common"
 	"github.com/wormhole-foundation/wormhole/sdk/vaa"
 	"go.uber.org/zap"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
 )
 
 type DiscordNotifier struct {
@@ -138,6 +139,7 @@ func (d *DiscordNotifier) MissingSignaturesOnObservation(o Observation, hasSigs,
 	}
 
 	for _, cn := range d.chans {
+		caser := cases.Title(language.English)
 		if _, err := d.c.SendMessage(cn.ID, messageText,
 			discord.Embed{
 				Title: "Message with missing signatures",
@@ -145,7 +147,7 @@ func (d *DiscordNotifier) MissingSignaturesOnObservation(o Observation, hasSigs,
 					{Name: "Message ID", Value: wrapCode(o.MessageID()), Inline: true},
 					{Name: "Digest", Value: wrapCode(hex.EncodeToString(o.SigningMsg().Bytes())), Inline: true},
 					{Name: "Quorum", Value: quorumText, Inline: true},
-					{Name: "Source Chain", Value: strings.Title(o.GetEmitterChain().String()), Inline: false},
+					{Name: "Source Chain", Value: caser.String(o.GetEmitterChain().String()), Inline: false},
 					{Name: "Missing Guardians", Value: missingText.String(), Inline: false},
 				},
 			},

node/pkg/proto/gossip/v1/gossip.pb.go

@@ -26,6 +26,7 @@ type GossipMessage struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Message:
+	//
 	//	*GossipMessage_SignedObservation
 	//	*GossipMessage_SignedHeartbeat
 	//	*GossipMessage_SignedVaaWithQuorum

node/pkg/proto/node/v1/node.pb.go

@@ -101,6 +101,7 @@ type GovernanceMessage struct {
 	// Random nonce for disambiguation. Must be identical across all nodes.
 	Nonce uint32 `protobuf:"varint,3,opt,name=nonce,proto3" json:"nonce,omitempty"`
 	// Types that are assignable to Payload:
+	//
 	//	*GovernanceMessage_GuardianSet
 	//	*GovernanceMessage_ContractUpgrade
 	//	*GovernanceMessage_BridgeRegisterChain

node/pkg/proto/node/v1/node_grpc.pb.go

@@ -23,7 +23,6 @@ type NodePrivilegedServiceClient interface {
 	//
 	// A consensus majority of nodes on the network will have to inject the VAA within the
 	// VAA timeout window for it to reach consensus.
-	//
 	InjectGovernanceVAA(ctx context.Context, in *InjectGovernanceVAARequest, opts ...grpc.CallOption) (*InjectGovernanceVAAResponse, error)
 	// FindMissingMessages will detect message sequence gaps in the local VAA store for a
 	// specific emitter chain and address. Start and end slots are the lowest and highest
@@ -147,7 +146,6 @@ type NodePrivilegedServiceServer interface {
 	//
 	// A consensus majority of nodes on the network will have to inject the VAA within the
 	// VAA timeout window for it to reach consensus.
-	//
 	InjectGovernanceVAA(context.Context, *InjectGovernanceVAARequest) (*InjectGovernanceVAAResponse, error)
 	// FindMissingMessages will detect message sequence gaps in the local VAA store for a
 	// specific emitter chain and address. Start and end slots are the lowest and highest

node/pkg/proto/spy/v1/spy.pb.go

@@ -210,6 +210,7 @@ type FilterEntry struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Filter:
+	//
 	//	*FilterEntry_EmitterFilter
 	//	*FilterEntry_BatchFilter
 	//	*FilterEntry_BatchTransactionFilter
@@ -450,6 +451,7 @@ type SubscribeSignedVAAByTypeResponse struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to VaaType:
+	//
 	//	*SubscribeSignedVAAByTypeResponse_SignedVaa
 	//	*SubscribeSignedVAAByTypeResponse_SignedBatchVaa
 	VaaType isSubscribeSignedVAAByTypeResponse_VaaType `protobuf_oneof:"vaa_type"`

node/pkg/telemetry/telemetry.go

@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"io"
 
 	"cloud.google.com/go/logging"
 	"github.com/blendle/zapdriver"
@@ -85,7 +85,7 @@ func New(ctx context.Context, project string, serviceAccountJSON []byte, labels
 func (s *Telemetry) WrapLogger(logger *zap.Logger) *zap.Logger {
 	tc := zapcore.NewCore(
 		s.encoder,
-		zapcore.AddSync(ioutil.Discard),
+		zapcore.AddSync(io.Discard),
 		zap.InfoLevel,
 	)
 

node/pkg/watchers/cosmwasm/watcher.go

@@ -5,7 +5,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strconv"
 	"time"
@@ -190,7 +190,7 @@ func (e *Watcher) Run(ctx context.Context) error {
 				logger.Error("query latest block response error", zap.String("network", networkName), zap.Error(err))
 				continue
 			}
-			blocksBody, err := ioutil.ReadAll(resp.Body)
+			blocksBody, err := io.ReadAll(resp.Body)
 			if err != nil {
 				logger.Error("query latest block response read error", zap.String("network", networkName), zap.Error(err))
 				errC <- err
@@ -237,7 +237,7 @@ func (e *Watcher) Run(ctx context.Context) error {
 					logger.Error("query tx response error", zap.String("network", networkName), zap.Error(err))
 					continue
 				}
-				txBody, err := ioutil.ReadAll(resp.Body)
+				txBody, err := io.ReadAll(resp.Body)
 				if err != nil {
 					logger.Error("query tx response read error", zap.String("network", networkName), zap.Error(err))
 					resp.Body.Close()

node/pkg/watchers/near/nearapi/mock/mock_server.go

@@ -14,7 +14,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -53,7 +52,7 @@ func serveCache(w http.ResponseWriter, req *http.Request, cacheDir string) (stri
 	if err != nil {
 		return "", errors.New("error reading request")
 	}
-	req.Body = ioutil.NopCloser(bytes.NewReader(reqBody))
+	req.Body = io.NopCloser(bytes.NewReader(reqBody))
 
 	hashBytes := sha256.Sum256(reqBody)
 	hashHex := hex.EncodeToString(hashBytes[:])
@@ -76,7 +75,7 @@ func returnFile(w http.ResponseWriter, fileName string) {
 func (s *ForwardingCachingServer) ProxyReq(logger *zap.Logger, req *http.Request) *http.Request {
 	reqBody, err := io.ReadAll(req.Body)
 	check(err)
-	req.Body = ioutil.NopCloser(bytes.NewReader(reqBody))
+	req.Body = io.NopCloser(bytes.NewReader(reqBody))
 
 	url := fmt.Sprintf("%s%s", s.upstreamHost, req.RequestURI)
 	proxyReq, _ := http.NewRequest(req.Method, url, bytes.NewReader(reqBody))
@@ -123,7 +122,7 @@ func (s *ForwardingCachingServer) ServeHTTP(w http.ResponseWriter, req *http.Req
 	}
 
 	reqBody := s.RewriteReq(origReqBody)
-	req.Body = ioutil.NopCloser(bytes.NewReader(reqBody))
+	req.Body = io.NopCloser(bytes.NewReader(reqBody))
 
 	cache_status := ""
 

node/pkg/watchers/near/nearapi/nearapi.go

@@ -5,7 +5,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"math/rand"
 	"net/http"
 	"time"
@@ -84,7 +84,7 @@ func (n HttpNearRpc) Query(ctx context.Context, s string) ([]byte, error) {
 
 			if err == nil {
 				defer resp.Body.Close()
-				result, err := ioutil.ReadAll(resp.Body)
+				result, err := io.ReadAll(resp.Body)
 				if resp.StatusCode == 200 {
 					return result, err
 				}

node/pkg/watchers/wormchain/watcher.go

@@ -5,7 +5,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -140,7 +140,7 @@ func (e *Watcher) Run(ctx context.Context) error {
 				logger.Error("query latest block response error", zap.Error(err))
 				continue
 			}
-			blocksBody, err := ioutil.ReadAll(resp.Body)
+			blocksBody, err := io.ReadAll(resp.Body)
 			if err != nil {
 				logger.Error("query latest block response read error", zap.Error(err))
 				errC <- err
@@ -185,7 +185,7 @@ func (e *Watcher) Run(ctx context.Context) error {
 					logger.Error("query tx response error", zap.Error(err))
 					continue
 				}
-				txBody, err := ioutil.ReadAll(resp.Body)
+				txBody, err := io.ReadAll(resp.Body)
 				if err != nil {
 					logger.Error("query tx response read error", zap.Error(err))
 					resp.Body.Close()

node/tools/go.mod

@@ -1,6 +1,6 @@
 module github.com/certusone/wormhole/node/tools
 
-go 1.17
+go 1.19
 
 require github.com/go-delve/delve v1.7.2
 

scripts/dev-setup.sh

@@ -63,7 +63,7 @@ esac
 
 # Install Go
 ARCH=amd64
-GO=1.17.5
+GO=1.19.3
 
 (
   if [[ -d /usr/local/go ]]; then

sdk/go.mod

@@ -1,6 +1,6 @@
 module github.com/wormhole-foundation/wormhole/sdk
 
-go 1.17
+go 1.19
 
 require (
 	github.com/ethereum/go-ethereum v1.10.21

tools/go.mod

@@ -1,6 +1,6 @@
 module github.com/certusone/wormhole/node/tools
 
-go 1.17
+go 1.19
 
 require (
 	github.com/bufbuild/buf v1.0.0