More linting; improve 'nCryptDeleteKey' error handling.

Author: joshdrake

internal/bcrypt_pbkdf/bcrypt_pbkdf_test.go

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 //
-//nolint:revive,stylecheck // ignore underscore in package
+//nolint:revive,staticcheck // ignore underscore in package
 package bcrypt_pbkdf
 
 import (

jose/encrypt_test.go

@@ -103,7 +103,7 @@ func rsaEqual(priv *rsa.PrivateKey, x crypto.PrivateKey) bool {
 	if !ok {
 		return false
 	}
-	if !(priv.PublicKey.N.Cmp(xx.N) == 0 && priv.PublicKey.E == xx.E) || priv.D.Cmp(xx.D) != 0 {
+	if (priv.PublicKey.N.Cmp(xx.N) != 0 || priv.PublicKey.E != xx.E) || priv.D.Cmp(xx.D) != 0 {
 		return false
 	}
 	if len(priv.Primes) != len(xx.Primes) {

kms/capi/ncrypt_windows.go

@@ -292,10 +292,13 @@ func nCryptOpenKey(provisionerHandle uintptr, containerName string, legacyKeySpe
 }
 
 func nCryptDeleteKey(keyHandle uintptr) error {
-	r, _, _ := procNCryptDeleteKey.Call(
+	r, _, err := procNCryptDeleteKey.Call(
 		keyHandle,
 		0,
 	)
+	if !errors.Is(err, windows.Errno(0)) {
+		return fmt.Errorf("NCryptDeleteKey returned %w", err)
+	}
 	if r != 0 {
 		return fmt.Errorf("NCryptDeleteKey returned %v", errNoToStr(uint32(r)))
 	}

x509util/certificate.go

@@ -188,7 +188,7 @@ func (c *Certificate) GetCertificate() *x509.Certificate {
 // See also https://datatracker.ietf.org/doc/html/rfc5280.html#section-4.2.1.6
 func (c *Certificate) hasExtendedSANs() bool {
 	for _, san := range c.SANs {
-		if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") {
+		if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") { //nolint:staticcheck // QF1001, this version is more semantically readable
 			return true
 		}
 	}

x509util/certificate_request.go

@@ -320,7 +320,7 @@ func (c *CertificateRequest) GetLeafCertificate() *Certificate {
 // See also https://datatracker.ietf.org/doc/html/rfc5280.html#section-4.2.1.6
 func (c *CertificateRequest) hasExtendedSANs() bool {
 	for _, san := range c.SANs {
-		if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") {
+		if !(san.Type == DNSType || san.Type == EmailType || san.Type == IPType || san.Type == URIType || san.Type == AutoType || san.Type == "") { //nolint:staticcheck // QF1001, this version is more semantically readable
 			return true
 		}
 	}