
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
gopkg.in/alecthomas/gometalinter.v1
Advanced tools
The number of tools for statically checking Go source for errors and warnings is impressive.
This is a tool that concurrently runs a whole bunch of those linters and normalises their output to a standard format:
<file>:<line>:[<column>]: <message> (<linter>)
eg.
stutter.go:9::warning: unused global variable unusedGlobal (varcheck)
stutter.go:12:6:warning: exported type MyStruct should have comment or be unexported (golint)
It is intended for use with editor/IDE integration.
:GoMetaLinter command.let g:syntastic_go_checkers = ['gometalinter']Disabled by default (enable with --enable=<linter>):
--line-length=N).Additional linters can be added through the command line with --linter=NAME:COMMAND:PATTERN (see below).
gometalinter now supports a JSON configuration file which can be loaded via
--config=<file>. The format of this file is determined by the Config struct
in config.go.
The configuration file mostly corresponds to command-line flags, with the following exceptions:
Here is an example configuration file:
{
"DisableAll": true,
"Enable": ["deadcode", "unconvert"]
}
There are two options for installing gometalinter.
go get -u gopkg.in/alecthomas/gometalinter.v1.
I will generally only tag a new stable version when it has passed the Travis
regression tests. The downside is that the binary will be called gometalinter.v1.go get -u github.com/alecthomas/gometalinter.
This has the downside that changes to gometalinter may break.gometalinter supports suppression of linter messages via comment directives. The form of the directive is:
// nolint[: <linter>[, <linter>, ...]]
Suppression works in the following way:
Line-level suppression
A comment directive suppresses any linter messages on that line.
eg. In this example any messages for a := 10 will be suppressed and errcheck
messages for defer r.Close() will also be suppressed.
a := 10 // nolint
a = 2
defer r.Close() // nolint: errcheck
Statement-level suppression
A comment directive at the same indentation level as a statement it immediately precedes will also suppress any linter messages in that entire statement.
eg. In this example all messages for SomeFunc() will be suppressed.
// nolint
func SomeFunc() {
}
Implementation details: gometalinter now performs parsing of Go source code, to extract linter directives and associate them with line ranges. To avoid unnecessary processing, parsing is on-demand: the first time a linter emits a message for a file, that file is parsed for directives.
Install gometalinter (see above).
Install all known linters:
$ gometalinter --install
Installing:
structcheck
aligncheck
deadcode
gocyclo
ineffassign
dupl
golint
gotype
goimports
errcheck
varcheck
interfacer
goconst
gosimple
staticcheck
unparam
unused
misspell
lll
gas
safesql
Run it:
$ cd example
$ gometalinter ./...
stutter.go:13::warning: unused struct field MyStruct.Unused (structcheck)
stutter.go:9::warning: unused global variable unusedGlobal (varcheck)
stutter.go:12:6:warning: exported type MyStruct should have comment or be unexported (golint)
stutter.go:16:6:warning: exported type PublicUndocumented should have comment or be unexported (golint)
stutter.go:8:1:warning: unusedGlobal is unused (deadcode)
stutter.go:12:1:warning: MyStruct is unused (deadcode)
stutter.go:16:1:warning: PublicUndocumented is unused (deadcode)
stutter.go:20:1:warning: duplicateDefer is unused (deadcode)
stutter.go:21:15:warning: error return value not checked (defer a.Close()) (errcheck)
stutter.go:22:15:warning: error return value not checked (defer a.Close()) (errcheck)
stutter.go:27:6:warning: error return value not checked (doit() // test for errcheck) (errcheck)
stutter.go:29::error: unreachable code (vet)
stutter.go:26::error: missing argument for Printf("%d"): format reads arg 1, have only 0 args (vet)
Gometalinter also supports the commonly seen <path>/... recursive path
format. Note that this can be very slow, and you may need to increase the linter --deadline to allow linters to complete.
gometalinter sets two bits of the exit status to indicate different issues:
| Bit | Meaning |
|---|---|
| 0 | A linter generated an issue. |
| 1 | An underlying error occurred; eg. a linter failed to execute. In this situation a warning will also be displayed. |
eg. linter only = 1, underlying only = 2, linter + underlying = 3
gometalinter in CI?There are two main problems running in a CI:
gometalinter --install --update to errorgometalinter adds a new linter.I have solved 1 by vendoring the linters.
For 2, the best option is to disable all linters, then explicitly enable the ones you want:
gometalinter --disable-all --enable=errcheck --enable=vet --enable=vetshadow ...
gometalinter work with Go 1.5 vendoring?gometalinter has a --vendor flag that just sets GO15VENDOREXPERIMENT=1, however the
underlying tools must support it. Ensure that all of the linters are up to date and built with Go 1.5
(gometalinter --install --force) then run gometalinter --vendor .. That should be it.
gometalinter --install install a fork of gocyclo?I forked gocyclo because the upstream behaviour is to recursively check all
subdirectories even when just a single directory is specified. This made it
unusably slow when vendoring. The recursive behaviour can be achieved with
gometalinter by explicitly specifying <path>/.... There is a
pull request open.
That's more of a statement than a question, but okay.
Sometimes gometalinter will not report issues that you think it should. There are three things to try in that case:
go get -u github.com/alecthomas/gometalinter
gometalinter --install
If you're lucky, this will fix the problem.
If that doesn't help, the problem may be elsewhere (in no particular order):
To find out what's going on run in debug mode:
gometalinter --debug
This will show all output from the linters and should indicate why it is failing.
Failing all else, if the problem looks like a bug please file an issue and
include the output of gometalinter --debug.
Additional linters can be configured via the command line:
$ gometalinter --linter='vet:go tool vet -printfuncs=Infof,Debugf,Warningf,Errorf {path}:PATH:LINE:MESSAGE' .
stutter.go:21:15:warning: error return value not checked (defer a.Close()) (errcheck)
stutter.go:22:15:warning: error return value not checked (defer a.Close()) (errcheck)
stutter.go:27:6:warning: error return value not checked (doit() // test for errcheck) (errcheck)
stutter.go:9::warning: unused global variable unusedGlobal (varcheck)
stutter.go:13::warning: unused struct field MyStruct.Unused (structcheck)
stutter.go:12:6:warning: exported type MyStruct should have comment or be unexported (golint)
stutter.go:16:6:warning: exported type PublicUndocumented should have comment or be unexported (deadcode)
gometalinter supports checkstyle
compatible XML output format. It is tiggered with --checkstyle flag:
gometalinter --checkstyle
Checkstyle format can be used to integrate gometalinter with Jenkins CI with the help of Checkstyle Plugin.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.