Repository: google/exposure-notifications-server
Pull request #1291 (2021-01-14 01:04:30)

increase API packages to 100% coverage
towards #1279 

## Proposed Changes

* complete test coverage on API packages

**Release Note**

```release-note
Increase test coverage on pkg/api/... packages
```

google-oss-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/google/exposure-notifications-server/pull/1291#" title="Author self-approved">mikehelmick</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=google%2Fexposure-notifications-server).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/google/exposure-notifications-server/blob/main/OWNERS)~~ [mikehelmick]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
google-oss-robot: @mikehelmick: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-en-server-release-unit | b8e923a58b383cab107094aeb340f3f9ba5f17b8 | [link](https://oss-prow.knative.dev/view/gs/oss-prow/pr-logs/pull/google_exposure-notifications-server/1291/pull-en-server-release-unit/1349522753866174464) | `/test pull-en-server-release-unit`

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->

Patch:
diff --git a/internal/exportimport/database/exportimport.go b/internal/exportimport/database/exportimport.go
index 27ea0b0..3a4d71c 100644
--- a/internal/exportimport/database/exportimport.go
+++ b/internal/exportimport/database/exportimport.go
@@ -26,6 +26,7 @@ import (
 	"github.com/jackc/pgx/v4"
 )
 
+// ExportImportDB contains database methods for managing with export-import configs.
 type ExportImportDB struct {
 	db *database.DB
 }
@@ -62,6 +63,8 @@ func (db *ExportImportDB) GetConfig(ctx context.Context, id int64) (*model.Expor
 	return config, nil
 }
 
+// ListConfigs lists all configs (active and inactive). This is a utility method for the
+// admin console.
 func (db *ExportImportDB) ListConfigs(ctx context.Context) ([]*model.ExportImport, error) {
 	var configs []*model.ExportImport
 
@@ -71,7 +74,7 @@ func (db *ExportImportDB) ListConfigs(ctx context.Context) ([]*model.ExportImpor
 				id, index_file, export_root, region, from_timestamp, thru_timestamp
 			FROM
 				exportimport
-			ORDER BY id DESC
+			ORDER BY id ASC
 		`)
 		if err != nil {
 			return fmt.Errorf("failed to list: %w", err)
@@ -97,6 +100,7 @@ func (db *ExportImportDB) ListConfigs(ctx context.Context) ([]*model.ExportImpor
 	return configs, nil
 }
 
+// ActiveConfigs returns the active export import configurations.
 func (db *ExportImportDB) ActiveConfigs(ctx context.Context) ([]*model.ExportImport, error) {
 	var configs []*model.ExportImport
 
@@ -110,7 +114,7 @@ func (db *ExportImportDB) ActiveConfigs(ctx context.Context) ([]*model.ExportImp
 				from_timestamp <= $1
 			AND
 				(thru_timestamp IS NULL OR thru_timestamp >= $1)
-			ORDER BY id DESC
+			ORDER BY id ASC
 		`, time.Now().UTC())
 		if err != nil {
 			return fmt.Errorf("failed to list: %w", err)
@@ -152,6 +156,7 @@ func scanOneConfig(row pgx.Row) (*model.ExportImport, error) {
 	return &m, nil
 }
 
+// AddConfig saves a new ExportImport configuration.
 func (db *ExportImportDB) AddConfig(ctx context.Context, ei *model.ExportImport) error {
 	if err := ei.Validate(); err != nil {
 		return err
diff --git a/internal/exportimport/model/exportimport.go b/internal/exportimport/model/exportimport.go
index cd61596..f18637d 100644
--- a/internal/exportimport/model/exportimport.go
+++ b/internal/exportimport/model/exportimport.go
@@ -20,6 +20,9 @@ import (
 	"time"
 )
 
+// ExportImport represents the configuration of a set of export files
+// to be imported into this server, by pointing at the index file
+// and remote root directory.
 type ExportImport struct {
 	ID         int64
 	IndexFile  string
@@ -29,6 +32,8 @@ type ExportImport struct {
 	Thru       *time.Time
 }
 
+// Validate checks the contents of an ExportImport file. This is a utility
+// function for the admin console.
 func (ei *ExportImport) Validate() error {
 	if l := len(ei.Region); l == 0 {
 		return fmt.Errorf("region cannot be blank")
@@ -46,6 +51,8 @@ func (ei *ExportImport) Validate() error {
 	return nil
 }
 
+// Active returns true if the ExportImport configuration is currently
+// active based on From and Thru times.
 func (ei *ExportImport) Active() bool {
 	now := time.Now().UTC()
 	return ei.From.Before(now) && (ei.Thru == nil || now.Before(*ei.Thru))
diff --git a/internal/exportimport/model/file.go b/internal/exportimport/model/file.go
index ea37b35..096fe99 100644
--- a/internal/exportimport/model/file.go
+++ b/internal/exportimport/model/file.go
@@ -25,6 +25,8 @@ const (
 	ImportFileFailed   = "FAILED"
 )
 
+// ImportFile represents an individual export file that is scheduled for,
+// or has been attempted or imported into the system.
 type ImportFile struct {
 	ID             int64
 	ExportImportID int64
diff --git a/internal/exportimport/model/importkeys.go b/internal/exportimport/model/importkeys.go
index 24a2cb1..8da5646 100644
--- a/internal/exportimport/model/importkeys.go
+++ b/internal/exportimport/model/importkeys.go
@@ -16,13 +16,15 @@ package model
 
 import (
 	"crypto/ecdsa"
-	"crypto/x509"
-	"encoding/pem"
-	"errors"
-	"fmt"
 	"time"
+
+	"github.com/google/exposure-notifications-server/pkg/keys"
 )
 
+// ImportFilePublicKey represents a possible signing key
+// for export files being imported into this system.
+// A given ExportImportID can have more than one associated key,
+// and more than one that is currently valid.
 type ImportFilePublicKey struct {
 	ExportImportID int64
 	KeyID          string
@@ -33,19 +35,5 @@ type ImportFilePublicKey struct {
 }
 
 func (pk *ImportFilePublicKey) PublicKey() (*ecdsa.PublicKey, error) {
-	block, _ := pem.Decode([]byte(pk.PublicKeyPEM))
-	if block == nil {
-		return nil, errors.New("unable to decode PEM block containing PUBLIC KEY")
-	}
-	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
-	if err != nil {
-		return nil, fmt.Errorf("x509.ParsePKIXPublicKey: %w", err)
-	}
-
-	switch typ := pub.(type) {
-	case *ecdsa.PublicKey:
-		return typ, nil
-	default:
-		return nil, fmt.Errorf("unsupported public key type: %T", typ)
-	}
+	return keys.ParseECDSAPublicKey(pk.PublicKeyPEM)
 }
diff --git a/internal/generate/config.go b/internal/generate/config.go
index 17a7d08..98e32c3 100644
--- a/internal/generate/config.go
+++ b/internal/generate/config.go
@@ -46,7 +46,7 @@ type Config struct {
 	SimulateSameDayRelease       bool          `env:"SIMULATE_SAME_DAY_RELEASE, default=false"`
 	MaxIntervalAge               time.Duration `env:"MAX_INTERVAL_AGE_ON_PUBLISH, default=360h"`
 	MaxMagnitudeSymptomOnsetDays uint          `env:"MAX_SYMPTOM_ONSET_DAYS, default=14"`
-	MaxSypmtomOnsetReportDays    uint          `env:"MAX_VALID_SYMPOTOM_ONSET_REPORT_DAYS, default=28"`
+	MaxSymptomOnsetReportDays    uint          `env:"MAX_VALID_SYMPTOM_ONSET_REPORT_DAYS, default=28"`
 	CreatedAtTruncateWindow      time.Duration `env:"TRUNCATE_WINDOW, default=1h"`
 	DefaultRegion                string        `env:"DEFAULT_REGION, default=US"`
 	ChanceOfKeyRevision          int           `env:"CHANCE_OF_KEY_REVISION, default=30"` // 0-100 are valid values.
@@ -76,7 +76,7 @@ func (c *Config) MaxSymptomOnsetDays() uint {
 }
 
 func (c *Config) MaxValidSymptomOnsetReportDays() uint {
-	return c.MaxSypmtomOnsetReportDays
+	return c.MaxSymptomOnsetReportDays
 }
 
 func (c *Config) DefaultSymptomOnsetDaysAgo() uint {
diff --git a/internal/integration/helpers.go b/internal/integration/helpers.go
index e91830d..05f5bd1 100644
--- a/internal/integration/helpers.go
+++ b/internal/integration/helpers.go
@@ -278,7 +278,7 @@ func Seed(tb testing.TB, ctx context.Context, db *database.DB, exportPeriod time
 		Version: "v1",
 		From:    time.Now().Add(-1 * time.Minute),
 	}
-	haID := testutil.InitalizeVerificationDB(ctx, tb, db, ha, haKey, sk)
+	haID := testutil.InitializeVerificationDB(ctx, tb, db, ha, haKey, sk)
 	jwtCfg := &testutil.JWTConfig{
 		HealthAuthority:    ha,
 		HealthAuthorityKey: haKey,
diff --git a/internal/jsonutil/marshal_error.go b/internal/jsonutil/marshal.go
similarity index 91%
rename from internal/jsonutil/marshal_error.go
rename to internal/jsonutil/marshal.go
index 732f3f5..2d47ae6 100644
--- a/internal/jsonutil/marshal_error.go
+++ b/internal/jsonutil/marshal.go
@@ -21,6 +21,8 @@ import (
 	"strings"
 )
 
+// MarshalResponse is a helper function to write an object to the http.ResponseWriter
+// with fallback error template.
 func MarshalResponse(w http.ResponseWriter, status int, response interface{}) {
 	w.Header().Set("Content-Type", "application/json")
 
diff --git a/internal/publish/config.go b/internal/publish/config.go
index b96e7c4..6e61f30 100644
--- a/internal/publish/config.go
+++ b/internal/publish/config.go
@@ -64,10 +64,10 @@ type Config struct {
 	// Symptom onset settings.
 	// Maximum valid range. TEKs presneted with values outside this range, but still "reasonable" will not be saved.
 	MaxMagnitudeSymptomOnsetDays uint `env:"MAX_SYMPTOM_ONSET_DAYS, default=14"`
-	// MaxValidSypmtomOnsetReportDays indicates how many days would be considered
+	// MaxValidSymptomOnsetReportDays indicates how many days would be considered
 	// a valid symptom onset report (-val..+val). Anything outside
 	// that range would be subject to the default symptom onset flags (see below).
-	MaxSypmtomOnsetReportDays uint `env:"MAX_VALID_SYMPOTOM_ONSET_REPORT_DAYS, default=28"`
+	MaxSymptomOnsetReportDays uint `env:"MAX_VALID_SYMPTOM_ONSET_REPORT_DAYS, default=28"`
 
 	// TEKs that arrive without a days since symptom onset (i.e. no symptom onset date),
 	// then the upload date minus DEFAULT_SYMPTOM_ONSET_DAYS_AGO is used.
@@ -118,9 +118,9 @@ func (c *Config) Validate() error {
 		result = multierror.Append(result,
 			fmt.Errorf("env var `MAX_SYMPTOM_ONSET_DAYS` must be > 0, got: %v", c.MaxMagnitudeSymptomOnsetDays))
 	}
-	if c.MaxSypmtomOnsetReportDays == 0 {
+	if c.MaxSymptomOnsetReportDays == 0 {
 		result = multierror.Append(result,
-			fmt.Errorf("env var `MAX_VALID_SYMPOTOM_ONSET_REPORT_DAYS` must be > 0, got: %v", c.MaxSypmtomOnsetReportDays))
+			fmt.Errorf("env var `MAX_VALID_SYMPTOM_ONSET_REPORT_DAYS` must be > 0, got: %v", c.MaxSymptomOnsetReportDays))
 	}
 
 	return result.ErrorOrNil()
@@ -147,7 +147,7 @@ func (c *Config) MaxSymptomOnsetDays() uint {
 }
 
 func (c *Config) MaxValidSymptomOnsetReportDays() uint {
-	return c.MaxSypmtomOnsetReportDays
+	return c.MaxSymptomOnsetReportDays
 }
 
 func (c *Config) DefaultSymptomOnsetDaysAgo() uint {
diff --git a/internal/publish/model/exposure_model.go b/internal/publish/model/exposure_model.go
index d1873e8..16ab02a 100644
--- a/internal/publish/model/exposure_model.go
+++ b/internal/publish/model/exposure_model.go
@@ -462,7 +462,7 @@ type KeyTransform struct {
 // * exposure keys are exactly 16 bytes in length after base64 decoding
 // * minInterval <= interval number +intervalCount <= maxInterval
 // * MinIntervalCount <= interval count <= MaxIntervalCount
-func TransformExposureKey(exposureKey verifyapi.ExposureKey, appPackageName string, upcaseRegions []string, settings *KeyTransform) (*Exposure, error) {
+func TransformExposureKey(exposureKey verifyapi.ExposureKey, appPackageName string, uppercaseRegions []string, settings *KeyTransform) (*Exposure, error) {
 	binKey, err := base64util.DecodeString(exposureKey.Key)
 	if err != nil {
 		return nil, err
@@ -472,7 +472,7 @@ func TransformExposureKey(exposureKey verifyapi.ExposureKey, appPackageName stri
 		ExposureKey:      binKey,
 		TransmissionRisk: exposureKey.TransmissionRisk,
 		AppPackageName:   appPackageName,
-		Regions:          upcaseRegions,
+		Regions:          uppercaseRegions,
 		IntervalNumber:   exposureKey.IntervalNumber,
 		IntervalCount:    exposureKey.IntervalCount,
 		CreatedAt:        settings.CreatedAt,
@@ -622,7 +622,7 @@ func (t *Transformer) TransformPublish(ctx context.Context, inData *verifyapi.Pu
 	// days ago to approximate symptom onset.
 	//
 	// There are launched applications using this sever that rely on this
-	// behavior - that are passing invalid symotom onset interviews, those
+	// behavior - that are passing invalid symptom onset interviews, those
 	// are screened about above when the onsetInterval is set.
 	if daysSince := math.Abs(float64(DaysBetweenIntervals(onsetInterval, currentInterval))); onsetInterval == 0 || daysSince > float64(t.maxValidSymptomOnsetReportDays) {
 		logger.Debugw("defaulting days since symptom onset")
@@ -639,15 +639,15 @@ func (t *Transformer) TransformPublish(ctx context.Context, inData *verifyapi.Pu
 	// There is no set of "valid" regions overall, but it is defined
 	// elsewhere by what regions an authorized application may write to.
 	// See `authorizedapp.Config`
-	upcaseRegions := make([]string, len(regions))
+	uppercaseRegions := make([]string, len(regions))
 	for i, r := range regions {
-		upcaseRegions[i] = strings.ToUpper(r)
+		uppercaseRegions[i] = strings.ToUpper(r)
 	}
 
 	var transformWarnings []string
 	var transformErrors *multierror.Error
 	for i, exposureKey := range inData.Keys {
-		exposure, err := TransformExposureKey(exposureKey, inData.HealthAuthorityID, upcaseRegions, &settings)
+		exposure, err := TransformExposureKey(exposureKey, inData.HealthAuthorityID, uppercaseRegions, &settings)
 		if err != nil {
 			logger.Debugw("individual key transform failed", "error", err)
 			transformErrors = multierror.Append(transformErrors, fmt.Errorf("key %d cannot be imported: %w", i, err))
diff --git a/internal/utils/utils.go b/internal/utils/utils.go
index 5dfc3a4..14c95b0 100644
--- a/internal/utils/utils.go
+++ b/internal/utils/utils.go
@@ -154,8 +154,8 @@ func IssueJWT(t *testing.T, cfg *JWTConfig) (jwtText, hmacKey string) {
 	return
 }
 
-// InitalizeVerificationDB links the vdb, HA and SigningKeys together
-func InitalizeVerificationDB(ctx context.Context, tb testing.TB, db *database.DB, ha *vm.HealthAuthority, hak *vm.HealthAuthorityKey, sk *SigningKey) int64 {
+// InitializeVerificationDB links the vdb, HA and SigningKeys together
+func InitializeVerificationDB(ctx context.Context, tb testing.TB, db *database.DB, ha *vm.HealthAuthority, hak *vm.HealthAuthorityKey, sk *SigningKey) int64 {
 	verDB := vdb.New(db)
 	exist, err := verDB.GetHealthAuthority(context.Background(), ha.Issuer)
 	if exist != nil && err == nil {
diff --git a/internal/verification/model/health_authority.go b/internal/verification/model/health_authority.go
index 18d11a5..082538b 100644
--- a/internal/verification/model/health_authority.go
+++ b/internal/verification/model/health_authority.go
@@ -17,12 +17,12 @@ package model
 
 import (
 	"crypto/ecdsa"
-	"crypto/x509"
-	"encoding/pem"
 	"errors"
 	"fmt"
 	"strings"
 	"time"
+
+	"github.com/google/exposure-notifications-server/pkg/keys"
 )
 
 // HealthAuthority represents a public health authority that is authorized to
@@ -104,19 +104,5 @@ func (k HealthAuthorityKey) Revoke() {
 // PublicKey decodes the PublicKeyPEM text and returns the `*ecdsa.PublicKey`
 // This system only supports verifying ECDSA JWTs, `alg: ES256`.
 func (k *HealthAuthorityKey) PublicKey() (*ecdsa.PublicKey, error) {
-	block, _ := pem.Decode([]byte(k.PublicKeyPEM))
-	if block == nil || block.Type != "PUBLIC KEY" {
-		return nil, errors.New("unable to decode PEM block containing PUBLIC KEY")
-	}
-	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
-	if err != nil {
-		return nil, fmt.Errorf("x509.ParsePKIXPublicKey: %w", err)
-	}
-
-	switch typ := pub.(type) {
-	case *ecdsa.PublicKey:
-		return typ, nil
-	default:
-		return nil, fmt.Errorf("unsupported public key type: %T", typ)
-	}
+	return keys.ParseECDSAPublicKey(k.PublicKeyPEM)
 }
diff --git a/pkg/api/v1/exposure_types.go b/pkg/api/v1/exposure_types.go
index 149db9d..1ffaa85 100644
--- a/pkg/api/v1/exposure_types.go
+++ b/pkg/api/v1/exposure_types.go
@@ -49,7 +49,7 @@ const (
 	ErrorBadRequest = "bad_request"
 	// ErrorInternalError
 	ErrorInternalError = "internal_error"
-	// ErrorMissingRevisionToken indicates no reivison token passed when one is needed
+	// ErrorMissingRevisionToken indicates no revision token passed when one is needed
 	ErrorMissingRevisionToken = "missing_revision_token"
 	// ErrorInvalidRevisionToken indicates a revision token was passed, but is missing a
 	// key or has invalid metadata.
diff --git a/pkg/api/v1/stats_types.go b/pkg/api/v1/stats_types.go
index c052f92..663bcf5 100644
--- a/pkg/api/v1/stats_types.go
+++ b/pkg/api/v1/stats_types.go
@@ -74,6 +74,7 @@ type StatsDay struct {
 	RequestsMissingOnsetDate int64 `json:"requests_missing_onset_date"`
 }
 
+// PublishRequests is a summary of one day's publish requests by platform.
 type PublishRequests struct {
 	UnknownPlatform int64 `json:"unknown"`
 	Android         int64 `json:"android"`
diff --git a/pkg/keys/ecdsa_pem.go b/pkg/keys/ecdsa_pem.go
new file mode 100644
index 0000000..f51308d
--- /dev/null
+++ b/pkg/keys/ecdsa_pem.go
@@ -0,0 +1,43 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package keys
+
+import (
+	"crypto/ecdsa"
+	"crypto/x509"
+	"encoding/pem"
+	"errors"
+	"fmt"
+)
+
+// ParseECDSAPublicKey is a convenience function for decoding an
+// ECDSA public key in PEM format.
+func ParseECDSAPublicKey(pemBlock string) (*ecdsa.PublicKey, error) {
+	block, _ := pem.Decode([]byte(pemBlock))
+	if block == nil {
+		return nil, errors.New("unable to decode PEM block containing PUBLIC KEY")
+	}
+	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("x509.ParsePKIXPublicKey: %w", err)
+	}
+
+	switch typ := pub.(type) {
+	case *ecdsa.PublicKey:
+		return typ, nil
+	default:
+		return nil, fmt.Errorf("unsupported public key type: %T", typ)
+	}
+}
diff --git a/pkg/keys/hashicorp_vault.go b/pkg/keys/hashicorp_vault.go
index 4750e58..11fed9b 100644
--- a/pkg/keys/hashicorp_vault.go
+++ b/pkg/keys/hashicorp_vault.go
@@ -17,7 +17,6 @@ package keys
 import (
 	"context"
 	"crypto"
-	"crypto/ecdsa"
 	"encoding/base64"
 	"fmt"
 	"io"
@@ -411,15 +410,5 @@ func (s *HashiCorpVaultSigner) getPublicKey() (crypto.PublicKey, error) {
 		return nil, fmt.Errorf("invalid public_key type %T", publicKeyPEMRaw)
 	}
 
-	publicKey, err := parsePublicKeyPEM(publicKeyPEM)
-	if err != nil {
-		return nil, err
-	}
-
-	typed, ok := publicKey.(*ecdsa.PublicKey)
-	if !ok {
-		return nil, fmt.Errorf("invalid public key type: %T", publicKey)
-	}
-
-	return typed, nil
+	return ParseECDSAPublicKey(publicKeyPEM)
 }
diff --git a/tools/verify/main.go b/tools/verify/main.go
index 8d24439..2a717cb 100644
--- a/tools/verify/main.go
+++ b/tools/verify/main.go
@@ -18,10 +18,8 @@ package main
 import (
 	"context"
 	"crypto/ecdsa"
-	"crypto/x509"
 	"encoding/asn1"
 	"encoding/base64"
-	"encoding/pem"
 	"flag"
 	"fmt"
 	"io/ioutil"
@@ -29,6 +27,7 @@ import (
 
 	"github.com/google/exposure-notifications-server/internal/buildinfo"
 	"github.com/google/exposure-notifications-server/pkg/base64util"
+	"github.com/google/exposure-notifications-server/pkg/keys"
 	"github.com/google/exposure-notifications-server/pkg/logging"
 	"github.com/sethvargo/go-signalcontext"
 )
@@ -83,16 +82,7 @@ func realMain(ctx context.Context) error {
 	logger := logging.FromContext(ctx)
 
 	// Validate the signature
-	block, _ := pem.Decode(pemBytes)
-	if block == nil || block.Type != "PUBLIC KEY" {
-		return fmt.Errorf("unable to decode PEM block containing PUBLIC KEY")
-	}
-	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
-	if err != nil {
-		return fmt.Errorf("unable to decode public key, x509.ParsePKIXPublicKey: %w", err)
-	}
-
-	publicKey, err := publicKeyAsECDSA(pub)
+	publicKey, err := keys.ParseECDSAPublicKey(string(pemBytes))
 	if err != nil {
 		return err
 	}
@@ -126,12 +116,3 @@ func convert1363ToAsn1(b []byte) ([]byte, error) {
 
 	return asn1.Marshal(rs)
 }
-
-func publicKeyAsECDSA(pub interface{}) (*ecdsa.PublicKey, error) {
-	switch typ := pub.(type) {
-	case *ecdsa.PublicKey:
-		return pub.(*ecdsa.PublicKey), nil
-	default:
-		return nil, fmt.Errorf("unsupported public key type: %T", typ)
-	}
-}


Test patch:
diff --git a/docs/playbooks/playbook_test.go b/docs/playbooks/playbook_test.go
index 5c8104e..b9f0b63 100644
--- a/docs/playbooks/playbook_test.go
+++ b/docs/playbooks/playbook_test.go
@@ -114,6 +114,8 @@ func setDiff(xs, ys []string) []string {
 // Test to ensure every playbook has a corresponding alert, and every alert has
 // a corresponding laybook.
 func TestPlaybooks(t *testing.T) {
+	t.Parallel()
+
 	playbooks := allPlaybookNames(t)
 	alerts := allAlertNames(t)
 	for _, x := range setDiff(playbooks, alerts) {
diff --git a/internal/admin/handle_authorized_apps_test.go b/internal/admin/handle_authorized_apps_test.go
index fee3610..014c065 100644
--- a/internal/admin/handle_authorized_apps_test.go
+++ b/internal/admin/handle_authorized_apps_test.go
@@ -22,6 +22,8 @@ import (
 )
 
 func TestRenderAuthorizedApps(t *testing.T) {
+	t.Parallel()
+
 	m := TemplateMap{}
 	authorizedApp := model.NewAuthorizedApp()
 	m["app"] = authorizedApp
diff --git a/internal/admin/handle_export_importers_test.go b/internal/admin/handle_export_importers_test.go
index 68e68cd..c71d912 100644
--- a/internal/admin/handle_export_importers_test.go
+++ b/internal/admin/handle_export_importers_test.go
@@ -21,7 +21,9 @@ import (
 	"github.com/google/exposure-notifications-server/internal/exportimport/model"
 )
 
-func TestRednerExportImporters(t *testing.T) {
+func TestRenderExportImporters(t *testing.T) {
+	t.Parallel()
+
 	m := TemplateMap{}
 	model := new(model.ExportImport)
 	m["model"] = model
diff --git a/internal/admin/handle_exports_test.go b/internal/admin/handle_exports_test.go
index d59b621..944c016 100644
--- a/internal/admin/handle_exports_test.go
+++ b/internal/admin/handle_exports_test.go
@@ -23,6 +23,8 @@ import (
 )
 
 func TestRenderExports(t *testing.T) {
+	t.Parallel()
+
 	m := TemplateMap{}
 	exportConfig := &model.ExportConfig{}
 	m["export"] = exportConfig
@@ -47,6 +49,8 @@ func TestRenderExports(t *testing.T) {
 }
 
 func TestSplitRegions(t *testing.T) {
+	t.Parallel()
+
 	tests := []struct {
 		r string
 		e []string
diff --git a/internal/admin/handle_mirrors_test.go b/internal/admin/handle_mirrors_test.go
index 98fc162..8caf7fb 100644
--- a/internal/admin/handle_mirrors_test.go
+++ b/internal/admin/handle_mirrors_test.go
@@ -22,6 +22,8 @@ import (
 )
 
 func TestRenderMirrors(t *testing.T) {
+	t.Parallel()
+
 	m := TemplateMap{}
 	mirror := &model.Mirror{}
 	m["mirror"] = mirror
diff --git a/internal/admin/handle_signature_infos_test.go b/internal/admin/handle_signature_infos_test.go
index 2a9bfe4..45c1e67 100644
--- a/internal/admin/handle_signature_infos_test.go
+++ b/internal/admin/handle_signature_infos_test.go
@@ -22,6 +22,8 @@ import (
 )
 
 func TestRenderSignatureInfo(t *testing.T) {
+	t.Parallel()
+
 	m := TemplateMap{}
 	sigInfo := &model.SignatureInfo{}
 	m["siginfo"] = sigInfo
diff --git a/internal/authorizedapp/model/authorized_app_model_test.go b/internal/authorizedapp/model/authorized_app_model_test.go
index c51f9c4..e52456c 100644
--- a/internal/authorizedapp/model/authorized_app_model_test.go
+++ b/internal/authorizedapp/model/authorized_app_model_test.go
@@ -23,6 +23,8 @@ import (
 )
 
 func TestAuthorizedApp_IsAllowedRegion(t *testing.T) {
+	t.Parallel()
+
 	cfg := NewAuthorizedApp()
 	cfg.AllowedRegions = map[string]struct{}{
 		"US": {},
@@ -38,6 +40,8 @@ func TestAuthorizedApp_IsAllowedRegion(t *testing.T) {
 }
 
 func TestAllAllowedRegions(t *testing.T) {
+	t.Parallel()
+
 	cfg := NewAuthorizedApp()
 	cfg.AllowedRegions = map[string]struct{}{
 		"US": {},
@@ -55,6 +59,8 @@ func TestAllAllowedRegions(t *testing.T) {
 }
 
 func TestRegionsOnePerLine(t *testing.T) {
+	t.Parallel()
+
 	cfg := NewAuthorizedApp()
 	cfg.AllowedRegions = map[string]struct{}{
 		"US": {},
@@ -69,6 +75,8 @@ func TestRegionsOnePerLine(t *testing.T) {
 }
 
 func TestAllAllowedHealthAuthorityIDs(t *testing.T) {
+	t.Parallel()
+
 	cfg := NewAuthorizedApp()
 	cfg.AllowedHealthAuthorityIDs[12] = struct{}{}
 	cfg.AllowedHealthAuthorityIDs[42] = struct{}{}
@@ -84,8 +92,9 @@ func TestAllAllowedHealthAuthorityIDs(t *testing.T) {
 }
 
 func TestValidate(t *testing.T) {
-	cfg := NewAuthorizedApp()
+	t.Parallel()
 
+	cfg := NewAuthorizedApp()
 	got := cfg.Validate()
 	want := []string{
 		"Health Authority ID cannot be empty",
@@ -97,6 +106,8 @@ func TestValidate(t *testing.T) {
 }
 
 func TestIsAllowedRegions(t *testing.T) {
+	t.Parallel()
+
 	cfg := NewAuthorizedApp()
 
 	if !cfg.IsAllowedRegion("foo") {
diff --git a/internal/database/connection_test.go b/internal/database/connection_test.go
index d1a86e3..a2e4ebb 100644
--- a/internal/database/connection_test.go
+++ b/internal/database/connection_test.go
@@ -22,6 +22,8 @@ import (
 )
 
 func TestDBValues(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		name   string
 		config Config
diff --git a/internal/database/lock_test.go b/internal/database/lock_test.go
index 95b91cd..e1126fa 100644
--- a/internal/database/lock_test.go
+++ b/internal/database/lock_test.go
@@ -115,7 +115,7 @@ func TestMultiLock(t *testing.T) {
 		t.Fatalf("failed to release locks: %v", err)
 	}
 
-	// should still fail, because there is still ovelap w/ the second lock.
+	// should still fail, because there is still overlap w/ the second lock.
 	if _, err := testDB.MultiLock(ctx, overlappingLocks, time.Minute); err == nil {
 		t.Fatalf("expected lock acquisition to fail, but didn't.")
 	} else if !errors.Is(err, ErrAlreadyLocked) {
diff --git a/internal/e2e/e2e_test.go b/internal/e2e/e2e_test.go
index 87953e9..e9b98df 100644
--- a/internal/e2e/e2e_test.go
+++ b/internal/e2e/e2e_test.go
@@ -105,6 +105,7 @@ func checkResp(r *http.Response) ([]byte, error) {
 }
 
 func TestPublishEndpoint(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 
 	tc := initConfig(t, ctx)
diff --git a/internal/export/batcher_test.go b/internal/export/batcher_test.go
index 9375751..358bf69 100644
--- a/internal/export/batcher_test.go
+++ b/internal/export/batcher_test.go
@@ -28,8 +28,9 @@ type simpleBatchRange struct {
 
 // TestMakeBatchRanges tests makeBatchRanges().
 func TestMakeBatchRanges(t *testing.T) {
-	now := "12-10 10:11"
+	t.Parallel()
 
+	now := "12-10 10:11"
 	testCases := []struct {
 		name      string
 		period    time.Duration
diff --git a/internal/export/database/export_test.go b/internal/export/database/export_test.go
index 65ade7a..ca9a0c8 100644
--- a/internal/export/database/export_test.go
+++ b/internal/export/database/export_test.go
@@ -254,7 +254,11 @@ func TestBatches(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			ctx := context.Background()
 			testDB, _ := testDatabaseInstance.NewDatabase(t)
 
@@ -575,6 +579,8 @@ func TestTravelerKeys(t *testing.T) {
 
 // TestExcludeRegions ensures excluded regions are excluded.
 func TestExcludeRegions(t *testing.T) {
+	t.Parallel()
+
 	inclRegion, exclRegion := "US", "EU"
 	inclRegions, exclRegions, bothRegions := []string{inclRegion}, []string{exclRegion}, []string{inclRegion, exclRegion}
 	now := time.Now()
diff --git a/internal/export/exportfile_test.go b/internal/export/exportfile_test.go
index 8d51d0c..d0ea1cb 100644
--- a/internal/export/exportfile_test.go
+++ b/internal/export/exportfile_test.go
@@ -32,6 +32,8 @@ import (
 )
 
 func TestMarshalUnmarshalExportFile(t *testing.T) {
+	t.Parallel()
+
 	batchStartTime := time.Date(2020, 5, 1, 0, 0, 0, 0, time.UTC).Truncate(time.Second)
 	batchEndTime := batchStartTime.Add(1 * time.Hour)
 
diff --git a/internal/export/model/export_model_test.go b/internal/export/model/export_model_test.go
index a073890..866e4b5 100644
--- a/internal/export/model/export_model_test.go
+++ b/internal/export/model/export_model_test.go
@@ -21,6 +21,8 @@ import (
 )
 
 func TestExportRegions(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		name         string
 		region       string
@@ -42,7 +44,11 @@ func TestExportRegions(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			ec := ExportConfig{
 				OutputRegion: tc.region,
 				InputRegions: tc.inputRegions,
@@ -56,6 +62,8 @@ func TestExportRegions(t *testing.T) {
 }
 
 func TestEffectiveMaxRecords(t *testing.T) {
+	t.Parallel()
+
 	eb := &ExportBatch{
 		MaxRecordsOverride: nil,
 	}
diff --git a/internal/export/server_test.go b/internal/export/server_test.go
index 5f0044a..654172c 100644
--- a/internal/export/server_test.go
+++ b/internal/export/server_test.go
@@ -27,6 +27,8 @@ import (
 
 // TestNewServer tests NewServer().
 func TestNewServer(t *testing.T) {
+	t.Parallel()
+
 	emptyStorage := &storage.GoogleCloudStorage{}
 	emptyKMS := &keys.GoogleCloudKMS{}
 	emptyDB := &database.DB{}
diff --git a/internal/export/worker_test.go b/internal/export/worker_test.go
index 9d79c48..cf06169 100644
--- a/internal/export/worker_test.go
+++ b/internal/export/worker_test.go
@@ -396,7 +396,7 @@ func TestVariableBatchMaxSize(t *testing.T) {
 	exposures := make([]*publishmodel.Exposure, 20)
 	want := make(map[string]struct{})
 	for i := 0; i < 20; i++ {
-		// All keys alignd to the same hour.
+		// All keys aligned to the same hour.
 		exposures[i] = &publishmodel.Exposure{
 			ExposureKey:     getKey(t),
 			Regions:         []string{"US"},
diff --git a/internal/exportimport/database/exportimport_test.go b/internal/exportimport/database/exportimport_test.go
index 4a3a75b..01a0fe2 100644
--- a/internal/exportimport/database/exportimport_test.go
+++ b/internal/exportimport/database/exportimport_test.go
@@ -40,12 +40,19 @@ func TestAddGetUpdateExportConfig(t *testing.T) {
 	fromTime := time.Now().UTC().Add(-1 * time.Second)
 	want := []*model.ExportImport{
 		{
-			IndexFile:  "https://mysever/exports/index.txt",
+			IndexFile:  "https://myserver/exports/index.txt",
 			ExportRoot: "https://myserver/",
 			Region:     "US",
 			From:       fromTime,
 			Thru:       nil,
 		},
+		{
+			IndexFile:  "https://myserver2/exports/index.txt",
+			ExportRoot: "https://myserver2/",
+			Region:     "US",
+			From:       fromTime.Add(time.Hour),
+			Thru:       nil,
+		},
 	}
 	for _, w := range want {
 		if err := exportImportDB.AddConfig(ctx, w); err != nil {
@@ -53,13 +60,59 @@ func TestAddGetUpdateExportConfig(t *testing.T) {
 		}
 	}
 
-	got, err := exportImportDB.ActiveConfigs(ctx)
-	if err != nil {
-		t.Fatal(err)
+	// list active configs
+	{
+		got, err := exportImportDB.ActiveConfigs(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if diff := cmp.Diff(want[0:1], got, database.ApproxTime); diff != "" {
+			t.Errorf("mismatch (-want, +got):\n%s", diff)
+		}
 	}
 
-	if diff := cmp.Diff(want, got, database.ApproxTime); diff != "" {
-		t.Errorf("mismatch (-want, +got):\n%s", diff)
+	// retrieve config by ID.
+	{
+		for i := range want {
+			got, err := exportImportDB.GetConfig(ctx, want[i].ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if diff := cmp.Diff(want[i], got, database.ApproxTime); diff != "" {
+				t.Errorf("mismatch (-want, +got):\n%s", diff)
+			}
+		}
+	}
+
+	// list all configs
+	{
+		got, err := exportImportDB.ListConfigs(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if diff := cmp.Diff(want, got, database.ApproxTime); diff != "" {
+			t.Errorf("mismatch (-want, +got):\n%s", diff)
+		}
+	}
+
+	// Change time one second config
+	want[1].From = fromTime
+	if err := exportImportDB.UpdateConfig(ctx, want[1]); err != nil {
+		t.Fatalf("failed to update config: %v", err)
+	}
+
+	// list active configs, all are active now.
+	{
+		got, err := exportImportDB.ActiveConfigs(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+		if diff := cmp.Diff(want, got, database.ApproxTime); diff != "" {
+			t.Errorf("mismatch (-want, +got):\n%s", diff)
+		}
 	}
 }
 
diff --git a/internal/exportimport/import_test.go b/internal/exportimport/import_test.go
index 92b0d8e..75d3026 100644
--- a/internal/exportimport/import_test.go
+++ b/internal/exportimport/import_test.go
@@ -57,6 +57,8 @@ func (k *keyGenerator) fakeExposureKey(t testing.TB) []byte {
 }
 
 func TestTransform(t *testing.T) {
+	t.Parallel()
+
 	ctx := context.Background()
 	logger := logging.FromContext(ctx)
 
diff --git a/internal/exportimport/model/exportimport_test.go b/internal/exportimport/model/exportimport_test.go
new file mode 100644
index 0000000..61448af
--- /dev/null
+++ b/internal/exportimport/model/exportimport_test.go
@@ -0,0 +1,146 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package model
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func timePtr(t time.Time) *time.Time {
+	return &t
+}
+
+func TestValidate(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name string
+		ei   *ExportImport
+		want string
+	}{
+		{
+			name: "no_region",
+			ei:   &ExportImport{},
+			want: "region cannot be blank",
+		},
+		{
+			name: "too_big_region",
+			ei: &ExportImport{
+				Region: "ABCDEF",
+			},
+			want: "region cannot be longer than 5 characters",
+		},
+		{
+			name: "no_index_file",
+			ei: &ExportImport{
+				Region: "US",
+			},
+			want: "IndexFile cannot be blank",
+		},
+		{
+			name: "no_export_root",
+			ei: &ExportImport{
+				Region:    "US",
+				IndexFile: "a/index.txt",
+			},
+			want: "ExportRoot cannot be blank",
+		},
+		{
+			name: "valid",
+			ei: &ExportImport{
+				Region:     "US",
+				IndexFile:  "a/index.txt",
+				ExportRoot: "a",
+			},
+			want: "",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := ""
+			err := tc.ei.Validate()
+			if err != nil {
+				got = err.Error()
+			}
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("unmarshal mismatch (-want +got):\n%v", diff)
+			}
+		})
+	}
+}
+
+func TestActive(t *testing.T) {
+	t.Parallel()
+
+	now := time.Now().UTC()
+
+	cases := []struct {
+		name string
+		ei   *ExportImport
+		want bool
+	}{
+		{
+			name: "valid_time",
+			ei: &ExportImport{
+				From: now.Add(-1 * time.Second),
+			},
+			want: true,
+		},
+		{
+			name: "valid_time_with_exp",
+			ei: &ExportImport{
+				From: now.Add(-1 * time.Second),
+				Thru: timePtr(now.Add(time.Hour)),
+			},
+			want: true,
+		},
+		{
+			name: "expired",
+			ei: &ExportImport{
+				From: now.Add(-2 * time.Hour),
+				Thru: timePtr(now.Add(-1 * time.Hour)),
+			},
+			want: false,
+		},
+		{
+			name: "future",
+			ei: &ExportImport{
+				From: now.Add(2 * time.Hour),
+			},
+			want: false,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := tc.ei.Active()
+			if diff := cmp.Diff(tc.want, got); diff != "" {
+				t.Errorf("unmarshal mismatch (-want +got):\n%v", diff)
+			}
+		})
+	}
+}
diff --git a/internal/exportimport/model/file_test.go b/internal/exportimport/model/file_test.go
index 3180a1a..4616e72 100644
--- a/internal/exportimport/model/file_test.go
+++ b/internal/exportimport/model/file_test.go
@@ -19,7 +19,7 @@ import (
 	"time"
 )
 
-func TestShoudlTry(t *testing.T) {
+func TestShouldTry(t *testing.T) {
 	t.Parallel()
 
 	now := time.Now().UTC()
diff --git a/internal/exportimport/scheduler_test.go b/internal/exportimport/scheduler_test.go
index fcd8f0b..1b341a1 100644
--- a/internal/exportimport/scheduler_test.go
+++ b/internal/exportimport/scheduler_test.go
@@ -46,7 +46,7 @@ func TestSyncFileFromIndexErrorsInExportRoot(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	// test data ensures that URL parsing stripps extra slashes.
+	// test data ensures that URL parsing strips extra slashes.
 	index := strings.Join([]string{"a.zip", "/b.zip", "//c.zip", ""}, "\n")
 
 	if _, _, err := syncFilesFromIndex(ctx, exportImportDB, config, index); err == nil {
@@ -196,6 +196,8 @@ func TestSyncFilenameShapes(t *testing.T) {
 		tc := tc
 
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			config := tc.config
 			if err := exportImportDB.AddConfig(ctx, config); err != nil {
 				t.Fatal(err)
@@ -261,6 +263,8 @@ func TestSyncFileFromIndex(t *testing.T) {
 		tc := tc
 
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			config := &model.ExportImport{
 				IndexFile:  "https://mysever/exports/index.txt",
 				ExportRoot: tc.exportRoot,
@@ -272,7 +276,7 @@ func TestSyncFileFromIndex(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			// test data ensures that URL parsing stripps extra slashes.
+			// test data ensures that URL parsing strips extra slashes.
 			index := strings.Join([]string{"a.zip", "/b.zip", "//c.zip", ""}, "\n")
 
 			if n, f, err := syncFilesFromIndex(ctx, exportImportDB, config, index); err != nil {
diff --git a/internal/federationin/federationin_test.go b/internal/federationin/federationin_test.go
index 0d35b33..39e6e93 100644
--- a/internal/federationin/federationin_test.go
+++ b/internal/federationin/federationin_test.go
@@ -140,6 +140,8 @@ func (sdb *syncDB) startFederationSync(ctx context.Context, query *model.Federat
 
 // TestFederationPull tests the federationPull() function.
 func TestFederationPull(t *testing.T) {
+	t.Parallel()
+
 	batchTime := time.Now().Truncate(time.Second)
 	// Make all items have reasonable interval numbers based on test time.
 	intervalNumber := publishmodel.IntervalNumber(batchTime.Add(-2 * 24 * time.Hour))
@@ -243,7 +245,7 @@ func TestFederationPull(t *testing.T) {
 							verifyapi.TransmissionRiskConfirmedStandard),
 							"US"),
 							federation.ExposureKey_CONFIRMED_TEST),
-							1), // TOO OLD - Key will be droped
+							1), // TOO OLD - Key will be dropped
 						setReportType(setRegions(setTransmissionRisk(copyExposureKey(ccc),
 							verifyapi.TransmissionRiskConfirmedStandard),
 							"US"),
diff --git a/internal/federationout/federationout_test.go b/internal/federationout/federationout_test.go
index 15e5147..ef99b45 100644
--- a/internal/federationout/federationout_test.go
+++ b/internal/federationout/federationout_test.go
@@ -130,6 +130,8 @@ func (t *testIterator) provideInput(_ context.Context, _ publishdb.IterateExposu
 
 // TestFetch tests the fetch() function.
 func TestFetch(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		name              string
 		includeRegions    []string
@@ -538,6 +540,8 @@ func TestFetch(t *testing.T) {
 
 // TestRawToken tests rawToken().
 func TestRawToken(t *testing.T) {
+	t.Parallel()
+
 	want := "Abc123"
 	md := metadata.New(map[string]string{"authorization": fmt.Sprintf("Bearer %s", want)})
 	ctx := metadata.NewIncomingContext(context.Background(), md)
@@ -554,6 +558,8 @@ func TestRawToken(t *testing.T) {
 
 // TestRawTokenErrors tests error responses from rawToken().
 func TestRawTokenErrors(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		name  string
 		mdMap map[string][]string
@@ -593,6 +599,8 @@ func TestRawTokenErrors(t *testing.T) {
 
 // TestIntersect tests intersect().
 func TestIntersect(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		name string
 		aa   []string
@@ -650,6 +658,8 @@ func TestIntersect(t *testing.T) {
 
 // TestUnion tests union().
 func TestUnion(t *testing.T) {
+	t.Parallel()
+
 	testCases := []struct {
 		name string
 		aa   []string
diff --git a/internal/flag/flag_test.go b/internal/flag/flag_test.go
new file mode 100644
index 0000000..4b7d892
--- /dev/null
+++ b/internal/flag/flag_test.go
@@ -0,0 +1,83 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package flag
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestString(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name  string
+		value []string
+		want  string
+	}{
+		{
+			name:  "empty",
+			value: []string{},
+			want:  "[]",
+		},
+		{
+			name:  "single",
+			value: []string{"A"},
+			want:  "[A]",
+		},
+		{
+			name:  "multi",
+			value: []string{"A", "B", "C"},
+			want:  "[A B C]",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			var l RegionListVar = tc.value
+			if r := l.String(); r != tc.want {
+				t.Errorf("wrong value, want: %q got: %q", tc.want, r)
+			}
+		})
+	}
+}
+
+func TestSetError(t *testing.T) {
+	t.Parallel()
+
+	var l RegionListVar = []string{"A"}
+	if err := l.Set("A"); err == nil {
+		t.Fatal("expected error, got nil")
+	}
+}
+
+func TestSet(t *testing.T) {
+	t.Parallel()
+
+	var l RegionListVar
+	if err := l.Set("A, B, C,D, A"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var want RegionListVar = []string{"A", "B", "C", "D"}
+	if diff := cmp.Diff(want, l); diff != "" {
+		t.Fatalf("mismatch (-want, +got):\n%s", diff)
+	}
+}
diff --git a/internal/jsonutil/marshal_test.go b/internal/jsonutil/marshal_test.go
new file mode 100644
index 0000000..0cdc08c
--- /dev/null
+++ b/internal/jsonutil/marshal_test.go
@@ -0,0 +1,82 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package jsonutil
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func TestEscapeJSON(t *testing.T) {
+	t.Parallel()
+
+	want := `{\"a\": \"b\"}`
+	got := escapeJSON(`{"a": "b"}`)
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("unmarshal mismatch (-want +got):\n%v", diff)
+	}
+}
+
+func TestMarshalResponse(t *testing.T) {
+	t.Parallel()
+
+	w := httptest.NewRecorder()
+
+	toSave := map[string]string{
+		"name": "Steve",
+	}
+
+	MarshalResponse(w, http.StatusOK, toSave)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("wrong response code, want: %v got: %v", http.StatusOK, w.Code)
+	}
+
+	got := w.Body.String()
+	want := `{"name":"Steve"}`
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("unmarshal mismatch (-want +got):\n%v", diff)
+	}
+}
+
+func TestMarshalResponseError(t *testing.T) {
+	t.Parallel()
+
+	w := httptest.NewRecorder()
+
+	type Circular struct {
+		Name string    `json:"name"`
+		Next *Circular `json:"next"`
+	}
+
+	badInput := &Circular{
+		Name: "Bob",
+	}
+	badInput.Next = badInput
+
+	MarshalResponse(w, http.StatusInternalServerError, badInput)
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("wrong response code, want: %v got: %v", http.StatusOK, w.Code)
+	}
+
+	got := w.Body.String()
+	want := `{"error":"json: unsupported value: encountered a cycle via *jsonutil.Circular"}`
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("unmarshal mismatch (-want +got):\n%v", diff)
+	}
+}
diff --git a/internal/jsonutil/unmarshal_test.go b/internal/jsonutil/unmarshal_test.go
index f2bb0ad..73fa1b7 100644
--- a/internal/jsonutil/unmarshal_test.go
+++ b/internal/jsonutil/unmarshal_test.go
@@ -16,10 +16,12 @@ package jsonutil
 
 import (
 	"bytes"
+	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -28,7 +30,26 @@ import (
 	"github.com/google/go-cmp/cmp"
 )
 
+func TestBodyTooLarge(t *testing.T) {
+	t.Parallel()
+
+	input := make(map[string]string, 1)
+	input["padding"] = strings.Repeat("0", maxBodyBytes+10)
+
+	largeJSON, err := json.Marshal(input)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	errors := []string{
+		`http: request body too large`,
+	}
+	unmarshalTestHelper(t, []string{string(largeJSON)}, errors, http.StatusRequestEntityTooLarge)
+}
+
 func TestInvalidHeader(t *testing.T) {
+	t.Parallel()
+
 	body := ioutil.NopCloser(bytes.NewReader([]byte("")))
 	r := httptest.NewRequest("POST", "/", body)
 	r.Header.Set("content-type", "application/text")
@@ -49,6 +70,8 @@ func TestInvalidHeader(t *testing.T) {
 }
 
 func TestEmptyBody(t *testing.T) {
+	t.Parallel()
+
 	invalidJSON := []string{
 		``,
 	}
@@ -58,6 +81,8 @@ func TestEmptyBody(t *testing.T) {
 	unmarshalTestHelper(t, invalidJSON, errors, http.StatusBadRequest)
 }
 func TestMultipleJson(t *testing.T) {
+	t.Parallel()
+
 	invalidJSON := []string{
 		`{"temporaryExposureKeys":
 			[{"key": "ABC"},
@@ -79,6 +104,8 @@ func TestMultipleJson(t *testing.T) {
 }
 
 func TestInvalidJSON(t *testing.T) {
+	t.Parallel()
+
 	invalidJSON := []string{
 		`totally not json`,
 		`{"key": "value", badKey: 6`,
@@ -93,6 +120,8 @@ func TestInvalidJSON(t *testing.T) {
 }
 
 func TestInvalidStructure(t *testing.T) {
+	t.Parallel()
+
 	invalidJSON := []string{
 		`{"temporaryExposureKeys": 42}`,
 		`{"temporaryExposureKeys": ["41", 42]}`,
@@ -111,6 +140,8 @@ func TestInvalidStructure(t *testing.T) {
 }
 
 func TestValidPublishMessage(t *testing.T) {
+	t.Parallel()
+
 	intervalNumber := int32(time.Date(2020, 04, 17, 20, 04, 01, 1, time.UTC).Unix() / 600)
 	json := `{"temporaryExposureKeys": [
 		  {"key": "ABC", "rollingStartNumber": %v, "rollingPeriod": 144, "TransmissionRisk": 2},
diff --git a/internal/keyrotation/rotate_test.go b/internal/keyrotation/rotate_test.go
index 9a323dc..3431b95 100644
--- a/internal/keyrotation/rotate_test.go
+++ b/internal/keyrotation/rotate_test.go
@@ -33,6 +33,7 @@ import (
 
 func TestRotateKeys(t *testing.T) {
 	t.Parallel()
+
 	ctx := context.Background()
 
 	kms := keys.TestKeyManager(t)
diff --git a/internal/metrics/exporter_test.go b/internal/metrics/exporter_test.go
index 24e4bcf..761c5b9 100644
--- a/internal/metrics/exporter_test.go
+++ b/internal/metrics/exporter_test.go
@@ -23,6 +23,8 @@ import (
 )
 
 func TestMetrics(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		name string
 		f    func(e Exporter)
@@ -63,7 +65,11 @@ func TestMetrics(t *testing.T) {
 	}
 
 	for _, c := range cases {
+		c := c
+
 		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+
 			var got []string
 			hook := func(e zapcore.Entry) error {
 				got = append(got, e.Message)
diff --git a/internal/performance/export_test.go b/internal/performance/export_test.go
index a8afa7a..87bb877 100644
--- a/internal/performance/export_test.go
+++ b/internal/performance/export_test.go
@@ -45,6 +45,8 @@ type testConfig struct {
 }
 
 func TestExport(t *testing.T) {
+	t.Parallel()
+
 	const (
 		keysPerPublish = 14
 		exportPeriod   = 10 * time.Minute
diff --git a/internal/publish/model/exposure_model_test.go b/internal/publish/model/exposure_model_test.go
index 10d5d5e..ccf9dff 100644
--- a/internal/publish/model/exposure_model_test.go
+++ b/internal/publish/model/exposure_model_test.go
@@ -86,7 +86,9 @@ func (c *testConfig) DebugReleaseSameDayKeys() bool {
 }
 
 func TestIntervalNumber(t *testing.T) {
-	// Since time to interval is lossy, truncate down to the beginnging of a window.
+	t.Parallel()
+
+	// Since time to interval is lossy, truncate down to the beginging of a window.
 	now := time.Now().Truncate(verifyapi.IntervalLength)
 
 	interval := IntervalNumber(now)
@@ -98,6 +100,8 @@ func TestIntervalNumber(t *testing.T) {
 }
 
 func TestInvalidNew(t *testing.T) {
+	t.Parallel()
+
 	errMsg := "maxExposureKeys must be > 0"
 	cases := []struct {
 		maxKeys        uint
@@ -127,6 +131,8 @@ func TestInvalidNew(t *testing.T) {
 }
 
 func TestInvalidBase64(t *testing.T) {
+	t.Parallel()
+
 	ctx := context.Background()
 	transformer, err := NewTransformer(&testConfig{
 		maxExposureKeys:     1,
@@ -158,6 +164,8 @@ func TestInvalidBase64(t *testing.T) {
 }
 
 func TestDifferentEncodings(t *testing.T) {
+	t.Parallel()
+
 	data := "this is some data"
 
 	cases := []struct {
@@ -185,6 +193,8 @@ func TestDifferentEncodings(t *testing.T) {
 }
 
 func TestPublishValidation(t *testing.T) {
+	t.Parallel()
+
 	maxAge := 24 * 5 * time.Hour
 
 	captureStartTime := time.Date(2020, 2, 29, 11, 15, 1, 0, time.UTC)
@@ -334,7 +344,11 @@ func TestPublishValidation(t *testing.T) {
 	}
 
 	for _, c := range cases {
+		c := c
+
 		t.Run(c.name, func(t *testing.T) {
+			t.Parallel()
+
 			ctx := context.Background()
 			tf, err := NewTransformer(&testConfig{
 				maxExposureKeys:     2,
@@ -344,7 +358,7 @@ func TestPublishValidation(t *testing.T) {
 				maxSymptomOnsetDays: maxSymptomOnsetDays,
 				debugReleaseSameDay: c.sameDay})
 			if err != nil {
-				t.Fatalf("unepected error: %v", err)
+				t.Fatalf("unexpected error: %v", err)
 			}
 
 			_, err = tf.TransformPublish(ctx, c.p, []string{}, nil, captureStartTime)
@@ -376,6 +390,8 @@ func encodeKey(key []byte) string {
 }
 
 func TestStillValidKey(t *testing.T) {
+	t.Parallel()
+
 	now := timeutils.UTCMidnight(time.Now())
 	batchWindow := TruncateWindow(now, time.Minute)
 	intervalNumber := IntervalNumber(now) - 1
@@ -419,7 +435,11 @@ func TestStillValidKey(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+
+		tc := tc
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			allowedAge := 2 * 24 * time.Hour
 			transformer, err := NewTransformer(&testConfig{
 				maxExposureKeys:     10,
@@ -453,6 +473,8 @@ func TestStillValidKey(t *testing.T) {
 }
 
 func TestReportTypeToTransmissionRisk(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		name   string
 		report string
@@ -468,7 +490,11 @@ func TestReportTypeToTransmissionRisk(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			got := ReportTypeTransmissionRisk(tc.report, tc.inTR)
 			if tc.wantTR != got {
 				t.Fatalf("wrong output transmission risk, want: %v got %v", tc.wantTR, got)
@@ -484,6 +510,8 @@ func timePtr(t time.Time) *time.Time { return &t }
 func stringPtr(s string) *string     { return &s }
 
 func TestTransform(t *testing.T) {
+	t.Parallel()
+
 	captureStartTime := time.Date(2020, 2, 29, 11, 15, 1, 0, time.UTC)
 	intervalNumber := IntervalNumber(captureStartTime)
 
@@ -539,7 +567,7 @@ func TestTransform(t *testing.T) {
 				},
 				HealthAuthorityID: appPackage,
 			},
-			Regions: []string{"us", "cA", "Mx"}, // will be upcased
+			Regions: []string{"us", "cA", "Mx"}, // will be uppercased
 			Claims:  nil,
 			Want: []*Exposure{
 				{
@@ -1011,7 +1039,11 @@ func TestTransform(t *testing.T) {
 	ctx := context.Background()
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.Name, func(t *testing.T) {
+			t.Parallel()
+
 			result, err := transformer.TransformPublish(ctx, tc.Publish, tc.Regions, tc.Claims, batchTime)
 			if err != nil && tc.PartialError == "" {
 				t.Fatalf("TransformPublish returned unexpected error: %v", err)
@@ -1043,6 +1075,8 @@ func TestTransform(t *testing.T) {
 }
 
 func TestDefaultSymptomOnset(t *testing.T) {
+	t.Parallel()
+
 	now := time.Now()
 	onsetDaysAgo := uint(4)
 
@@ -1096,7 +1130,11 @@ func TestDefaultSymptomOnset(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			allowedAge := 6 * 24 * time.Hour
 			transformer, err := NewTransformer(&testConfig{
 				maxExposureKeys:         10,
@@ -1129,6 +1167,8 @@ func TestDefaultSymptomOnset(t *testing.T) {
 }
 
 func TestTransformOverlapping(t *testing.T) {
+	t.Parallel()
+
 	now := time.Now()
 	allowedAge := 3 * 24 * time.Hour
 	twoDaysAgoInterval := IntervalNumber(now) - 1 - 288
@@ -1158,7 +1198,7 @@ func TestTransformOverlapping(t *testing.T) {
 				},
 				HealthAuthorityID: "State Health Dept",
 			},
-			regions:             []string{"us", "cA", "Mx"}, // will be upcased
+			regions:             []string{"us", "cA", "Mx"}, // will be uppercased
 			maxSameIntervalKeys: 3,
 			error:               "exposure keys have non aligned overlapping intervals",
 		},
@@ -1179,7 +1219,7 @@ func TestTransformOverlapping(t *testing.T) {
 				},
 				HealthAuthorityID: "State Health Dept",
 			},
-			regions:             []string{"us", "cA", "Mx"}, // will be upcased
+			regions:             []string{"us", "cA", "Mx"}, // will be uppercased
 			maxSameIntervalKeys: 3,
 			error:               "exposure keys have non aligned overlapping intervals",
 		},
@@ -1267,7 +1307,11 @@ func TestTransformOverlapping(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			ctx := context.Background()
 			transformer, err := NewTransformer(&testConfig{
 				maxExposureKeys:     10,
@@ -1292,6 +1336,8 @@ func TestTransformOverlapping(t *testing.T) {
 }
 
 func TestExposure_HasDaysSinceSymptomOnset(t *testing.T) {
+	t.Parallel()
+
 	e := &Exposure{}
 
 	if e.HasDaysSinceSymptomOnset() {
@@ -1304,6 +1350,8 @@ func TestExposure_HasDaysSinceSymptomOnset(t *testing.T) {
 }
 
 func TestExposure_HasDaysHealthAuthorityID(t *testing.T) {
+	t.Parallel()
+
 	e := &Exposure{}
 
 	if e.HasHealthAuthorityID() {
@@ -1316,6 +1364,8 @@ func TestExposure_HasDaysHealthAuthorityID(t *testing.T) {
 }
 
 func TestExposureRevisionFields(t *testing.T) {
+	t.Parallel()
+
 	revTime := time.Now().UTC().Truncate(time.Minute)
 	revType := "revisedType"
 
@@ -1351,6 +1401,8 @@ func TestExposureRevisionFields(t *testing.T) {
 }
 
 func TestDaysFromSymptomOnset(t *testing.T) {
+	t.Parallel()
+
 	// Node that everything is based on midnight UTC so we'll start there.
 	now := timeutils.UTCMidnight(time.Now().UTC())
 
@@ -1411,7 +1463,11 @@ func TestDaysFromSymptomOnset(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			got := DaysBetweenIntervals(tc.onset, tc.check)
 			if tc.want != got {
 				t.Fatalf("wrong day instance between %v and %v, got: %v want: %v", tc.onset, tc.check, got, tc.want)
@@ -1487,7 +1543,11 @@ func TestReviseKeys_FromFederation(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			ctx := context.Background()
 			existing := make(map[string]*Exposure)
 			existing[tc.existing.ExposureKeyBase64()] = tc.existing
@@ -1617,6 +1677,8 @@ func TestReviseKeys(t *testing.T) {
 }
 
 func TestExposureReview(t *testing.T) {
+	t.Parallel()
+
 	createdAt := time.Now().UTC().Add(-1 * time.Hour).Truncate(time.Hour)
 	revisedAt := time.Now().UTC().Add(time.Hour).Truncate(time.Hour)
 
@@ -1791,7 +1853,11 @@ func TestExposureReview(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			result, err := tc.previous.Revise(tc.incoming)
 			if result != tc.needsRevision {
 				t.Errorf("revision decision mismatch: want: %v got: %v", tc.needsRevision, result)
@@ -1815,6 +1881,8 @@ func TestExposureReview(t *testing.T) {
 }
 
 func TestExposureFromExportFile(t *testing.T) {
+	t.Parallel()
+
 	validTEK := []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 	invalidTEK := []byte{0, 1}
 
@@ -2058,7 +2126,11 @@ func TestExposureFromExportFile(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			thisConfig := config
 			if tc.modifyConfig != nil {
 				thisConfig = tc.modifyConfig(config)
diff --git a/internal/publish/model/stats_test.go b/internal/publish/model/stats_test.go
index 96aa5af..22c7850 100644
--- a/internal/publish/model/stats_test.go
+++ b/internal/publish/model/stats_test.go
@@ -150,6 +150,7 @@ func minPadSlice(s []int64, size int) []int64 {
 }
 
 func TestReduce(t *testing.T) {
+	t.Parallel()
 
 	hour := timeutils.UTCMidnight(time.Now().UTC()).Add(-48 * time.Hour)
 	startTime := hour
diff --git a/internal/publish/platform_test.go b/internal/publish/platform_test.go
index 32dff8c..fe87a5c 100644
--- a/internal/publish/platform_test.go
+++ b/internal/publish/platform_test.go
@@ -56,7 +56,11 @@ func TestPlatform(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			if got := platform(tc.userAgent); got != tc.wantPlatform {
 				t.Fatalf("wrong platform, want: %q got: %q", tc.wantPlatform, got)
 			}
diff --git a/internal/publish/publish_test.go b/internal/publish/publish_test.go
index cdee074..af947c5 100644
--- a/internal/publish/publish_test.go
+++ b/internal/publish/publish_test.go
@@ -126,7 +126,6 @@ func TestPublishWithBypass(t *testing.T) {
 		SkipKeys           map[int]bool // which keys should be skipped (partial success)
 		MaintenanceMode    bool
 	}{
-
 		{
 			Name:       "successful_insert_bypass_ha_verification",
 			TestRegion: regions.next(),
@@ -457,33 +456,35 @@ func TestPublishWithBypass(t *testing.T) {
 			addVer = "v1Alpha1_"
 		}
 
-		ctx := context.Background()
-
-		// Database init for all modules that will be used.
-		testDB, _ := testDatabaseInstance.NewDatabase(t)
-
-		kms := keys.TestKeyManager(t)
-		keyID := keys.TestEncryptionKey(t, kms)
-
-		tokenAAD := make([]byte, 16)
-		if _, err := rand.Read(tokenAAD); err != nil {
-			t.Fatalf("not enough entropy: %v", err)
-		}
-		// Configure revision keys.
-		revDB, err := revisiondb.New(testDB, &revisiondb.KMSConfig{WrapperKeyID: keyID, KeyManager: kms})
-		if err != nil {
-			t.Fatalf("unable to create revision DB handle: %v", err)
-		}
-		if _, err := revDB.CreateRevisionKey(ctx); err != nil {
-			t.Fatalf("unable to create revision key: %v", err)
-		}
-
 		for _, tc := range cases {
+			tc := tc
+
 			if tc.SkipVersions[ver] {
 				continue
 			}
 
 			t.Run(addVer+tc.Name, func(t *testing.T) {
+				ctx := context.Background()
+
+				// Database init for all modules that will be used.
+				testDB, _ := testDatabaseInstance.NewDatabase(t)
+
+				kms := keys.TestKeyManager(t)
+				keyID := keys.TestEncryptionKey(t, kms)
+
+				tokenAAD := make([]byte, 16)
+				if _, err := rand.Read(tokenAAD); err != nil {
+					t.Fatalf("not enough entropy: %v", err)
+				}
+				// Configure revision keys.
+				revDB, err := revisiondb.New(testDB, &revisiondb.KMSConfig{WrapperKeyID: keyID, KeyManager: kms})
+				if err != nil {
+					t.Fatalf("unable to create revision DB handle: %v", err)
+				}
+				if _, err := revDB.CreateRevisionKey(ctx); err != nil {
+					t.Fatalf("unable to create revision key: %v", err)
+				}
+
 				// And set up publish handler up front.
 				config := Config{}
 				config.AuthorizedApp.CacheDuration = time.Nanosecond
@@ -500,7 +501,7 @@ func TestPublishWithBypass(t *testing.T) {
 				config.ResponsePaddingMinBytes = 100
 				config.ResponsePaddingRange = 100
 				config.MaxMagnitudeSymptomOnsetDays = 14
-				config.MaxSypmtomOnsetReportDays = 28
+				config.MaxSymptomOnsetReportDays = 28
 				config.Maintenance = tc.MaintenanceMode
 				env := serverenv.New(ctx,
 					serverenv.WithDatabase(testDB),
@@ -519,7 +520,7 @@ func TestPublishWithBypass(t *testing.T) {
 
 				// See if there is a health authority to set up.
 				if tc.HealthAuthority != nil {
-					testutil.InitalizeVerificationDB(ctx, t, testDB, tc.HealthAuthority, tc.HealthAuthorityKey, signingKey)
+					testutil.InitializeVerificationDB(ctx, t, testDB, tc.HealthAuthority, tc.HealthAuthorityKey, signingKey)
 					cfg := &testutil.JWTConfig{
 						HealthAuthority:    tc.HealthAuthority,
 						HealthAuthorityKey: tc.HealthAuthorityKey,
@@ -575,27 +576,24 @@ func TestPublishWithBypass(t *testing.T) {
 					t.Fatal(err)
 				}
 
-				server := httptest.NewServer(handler)
-				defer server.Close()
-
 				// make the request
 				contentType := "application/json"
 				if tc.ContentType != "" {
 					contentType = tc.ContentType
 				}
-				request, err := http.NewRequest("POST", server.URL, strings.NewReader(string(jsonString)))
+				request, err := http.NewRequest("POST", "", strings.NewReader(string(jsonString)))
 				if err != nil {
 					t.Fatal(err)
 				}
 				request.Header.Set("Content-Type", contentType)
 				request.Header.Set("User-Agent", tc.UserAgent)
-				resp, err := server.Client().Do(request)
-				if err != nil {
-					t.Fatal(err)
-				}
+
+				rr := httptest.NewRecorder()
+				handler.ServeHTTP(rr, request)
+				resp := rr.Result()
 
 				// Response content type should always be application/json
-				if got, want := resp.Header.Get("Content-Type"), "application/json"; got != want {
+				if got, want := rr.Header().Get("Content-Type"), "application/json"; got != want {
 					t.Errorf("expected %#v to be %#v", got, want)
 				}
 
@@ -770,11 +768,11 @@ func TestPublishWithBypass(t *testing.T) {
 	}
 }
 
-type RevisionTokenChanger func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) string
+type RevisionTokenChanger func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) (string, error)
 
-func TokenIdentity(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) string {
+func TokenIdentity(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) (string, error) {
 	t.Helper()
-	return token
+	return token, nil
 }
 
 type PublishDataChanger func(t *testing.T, data *verifyapi.Publish) (bool, *verifyapi.Publish)
@@ -836,7 +834,7 @@ func TestKeyRevision(t *testing.T) {
 	}
 	// Init verification db with new HA
 	signingKey := testutil.GetSigningKey(t)
-	testutil.InitalizeVerificationDB(ctx, t, testDB, healthAuthority, healthAuthorityKey, signingKey)
+	testutil.InitializeVerificationDB(ctx, t, testDB, healthAuthority, healthAuthorityKey, signingKey)
 
 	defaultSymptomOnsetDaysAgo := uint(1)
 	// And set up publish handler up front.
@@ -880,9 +878,6 @@ func TestKeyRevision(t *testing.T) {
 		t.Fatalf("unable to create publish handler: %v", err)
 	}
 	handler := pubHandler.Handle()
-	server := httptest.NewServer(handler)
-	defer server.Close()
-
 	pubDB := pubdb.New(testDB)
 
 	// the first key in each publish will be at this time.
@@ -921,8 +916,8 @@ func TestKeyRevision(t *testing.T) {
 				VerificationPayload: "totally not a JWT",
 			},
 			RevErrorCode: verifyapi.ErrorMissingRevisionToken,
-			RevTokenMesser: func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) string {
-				return ""
+			RevTokenMesser: func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) (string, error) {
+				return "", nil
 			},
 			PublishMesser:    PublishIdentity,
 			ReportTypeMesser: ReportTypeIdentity,
@@ -997,14 +992,14 @@ func TestKeyRevision(t *testing.T) {
 				VerificationPayload: "totally not a JWT",
 			},
 			RevErrorCode: verifyapi.ErrorInvalidRevisionToken,
-			RevTokenMesser: func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) string {
+			RevTokenMesser: func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) (string, error) {
 				tokenBytes, err := base64util.DecodeString(token)
 				if err != nil {
-					return ""
+					return "", err
 				}
 				revToken, err := tm.UnmarshalRevisionToken(ctx, tokenBytes, aad)
 				if err != nil {
-					return ""
+					return "", err
 				}
 				// Gotta throw some new keys in, or we can't mint a new revision token.
 				newKeys := []*model.Exposure{
@@ -1017,9 +1012,9 @@ func TestKeyRevision(t *testing.T) {
 				revToken.RevisableKeys = revToken.RevisableKeys[0:1]
 				tokenBytes, err = tm.MakeRevisionToken(ctx, revToken, newKeys, aad)
 				if err != nil {
-					return ""
+					return "", err
 				}
-				return base64.StdEncoding.EncodeToString(tokenBytes)
+				return base64.StdEncoding.EncodeToString(tokenBytes), nil
 			},
 			PublishMesser:    PublishIdentity,
 			ReportTypeMesser: ReportTypeIdentity,
@@ -1032,7 +1027,7 @@ func TestKeyRevision(t *testing.T) {
 				HealthAuthorityID:   haName,
 				VerificationPayload: "totally not a JWT",
 			},
-			RevTokenMesser: func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) string {
+			RevTokenMesser: func(ctx context.Context, t *testing.T, token string, tm *revision.TokenManager, aad []byte) (string, error) {
 				// This function doesn't change the revision token, but it does
 				// rotate the keys so that this token is effectively useless.
 				t.Helper()
@@ -1051,8 +1046,7 @@ func TestKeyRevision(t *testing.T) {
 						}
 					}
 				}
-
-				return token
+				return token, nil
 			},
 			PublishMesser: func(t *testing.T, data *verifyapi.Publish) (bool, *verifyapi.Publish) {
 				t.Helper()
@@ -1085,6 +1079,8 @@ func TestKeyRevision(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.Name, func(t *testing.T) {
 			ctx = context.Background()
 
@@ -1109,11 +1105,15 @@ func TestKeyRevision(t *testing.T) {
 					t.Fatal(err)
 				}
 
-				// make the initial request
-				resp, err := server.Client().Post(server.URL, "application/json", strings.NewReader(string(jsonString)))
+				request, err := http.NewRequest("POST", "", strings.NewReader(string(jsonString)))
 				if err != nil {
 					t.Fatal(err)
 				}
+				request.Header.Set("Content-Type", "application/json")
+
+				rr := httptest.NewRecorder()
+				handler.ServeHTTP(rr, request)
+				resp := rr.Result()
 
 				// For non success status, check that they body contains the expected message
 				defer resp.Body.Close()
@@ -1136,7 +1136,9 @@ func TestKeyRevision(t *testing.T) {
 			var keysAreRevisions bool
 			// Make the revision.
 			{
-				revisionToken = tc.RevTokenMesser(ctx, t, revisionToken, tm, tokenAAD)
+				if revisionToken, err = tc.RevTokenMesser(ctx, t, revisionToken, tm, tokenAAD); err != nil {
+					t.Fatal(err)
+				}
 				// Add the revision token to publish request.
 				tc.Publish.RevisionToken = revisionToken
 
@@ -1167,11 +1169,15 @@ func TestKeyRevision(t *testing.T) {
 					t.Fatal(err)
 				}
 
-				// make the initial request
-				resp, err := server.Client().Post(server.URL, "application/json", strings.NewReader(string(jsonString)))
+				request, err := http.NewRequest("POST", "", strings.NewReader(string(jsonString)))
 				if err != nil {
 					t.Fatal(err)
 				}
+				request.Header.Set("Content-Type", "application/json")
+
+				rr := httptest.NewRecorder()
+				handler.ServeHTTP(rr, request)
+				resp := rr.Result()
 
 				// For non success status, check that they body contains the expected message
 				defer resp.Body.Close()
diff --git a/internal/publish/stats_test.go b/internal/publish/stats_test.go
index 7c1032d..21cf33a 100644
--- a/internal/publish/stats_test.go
+++ b/internal/publish/stats_test.go
@@ -83,7 +83,7 @@ func TestRetrieveMetrics(t *testing.T) {
 		Version: "v1",
 		From:    time.Now().Add(-1 * time.Minute),
 	}
-	healthAuthorityID := testutil.InitalizeVerificationDB(ctx, t, testDB, healthAuthority, healthAuthorityKey, authKey)
+	healthAuthorityID := testutil.InitializeVerificationDB(ctx, t, testDB, healthAuthority, healthAuthorityKey, authKey)
 
 	// Add some raw publish info metrics.
 	rawStats := []model.PublishInfo{
@@ -125,8 +125,6 @@ func TestRetrieveMetrics(t *testing.T) {
 		t.Fatalf("unable to create publish handler: %v", err)
 	}
 	metricsHandler := pubHandler.HandleStats()
-	server := httptest.NewServer(metricsHandler)
-	defer server.Close()
 
 	// get the authentication token.
 	jwtConfig := &testutil.StatsJWTConfig{
@@ -143,16 +141,15 @@ func TestRetrieveMetrics(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	httpRequest, err := http.NewRequest("POST", server.URL, strings.NewReader(string(jsonString)))
+	httpRequest, err := http.NewRequest("POST", "", strings.NewReader(string(jsonString)))
 	if err != nil {
 		t.Fatal(err)
 	}
 	httpRequest.Header.Set("Content-Type", "application/json")
 	httpRequest.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
-	resp, err := server.Client().Do(httpRequest)
-	if err != nil {
-		t.Fatal(err)
-	}
+	rr := httptest.NewRecorder()
+	metricsHandler.ServeHTTP(rr, httpRequest)
+	resp := rr.Result()
 
 	defer resp.Body.Close()
 	respBytes, err := ioutil.ReadAll(resp.Body)
@@ -240,15 +237,13 @@ func TestRetrieveMetrics_AuthErrors(t *testing.T) {
 		Version: "v1",
 		From:    time.Now().Add(-1 * time.Minute),
 	}
-	_ = testutil.InitalizeVerificationDB(ctx, t, testDB, healthAuthority, healthAuthorityKey, authKey)
+	_ = testutil.InitializeVerificationDB(ctx, t, testDB, healthAuthority, healthAuthorityKey, authKey)
 
 	pubHandler, err := NewHandler(ctx, &config, env)
 	if err != nil {
 		t.Fatalf("unable to create publish handler: %v", err)
 	}
 	metricsHandler := pubHandler.HandleStats()
-	server := httptest.NewServer(metricsHandler)
-	defer server.Close()
 
 	// get the authentication token.
 	jwtConfig := &testutil.StatsJWTConfig{
@@ -285,14 +280,18 @@ func TestRetrieveMetrics_AuthErrors(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.Name, func(t *testing.T) {
+			t.Parallel()
+
 			// make the stats request with auth token.
 			request := &verifyapi.StatsRequest{}
 			jsonString, err := json.Marshal(request)
 			if err != nil {
 				t.Fatal(err)
 			}
-			httpRequest, err := http.NewRequest("POST", server.URL, strings.NewReader(string(jsonString)))
+			httpRequest, err := http.NewRequest("POST", "", strings.NewReader(string(jsonString)))
 			if err != nil {
 				t.Fatal(err)
 			}
@@ -300,10 +299,9 @@ func TestRetrieveMetrics_AuthErrors(t *testing.T) {
 			if tc.Authorization != "" {
 				httpRequest.Header.Set("Authorization", tc.Authorization)
 			}
-			resp, err := server.Client().Do(httpRequest)
-			if err != nil {
-				t.Fatal(err)
-			}
+			rr := httptest.NewRecorder()
+			metricsHandler.ServeHTTP(rr, httpRequest)
+			resp := rr.Result()
 
 			defer resp.Body.Close()
 			respBytes, err := ioutil.ReadAll(resp.Body)
diff --git a/internal/verification/database/health_authority_db_test.go b/internal/verification/database/health_authority_db_test.go
index 713c350..800d1a0 100644
--- a/internal/verification/database/health_authority_db_test.go
+++ b/internal/verification/database/health_authority_db_test.go
@@ -85,7 +85,11 @@ func TestAddHealthAuthorityErrors(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			ctx := context.Background()
 			if err := haDB.AddHealthAuthority(ctx, tc.ha); err == nil {
 				t.Error("missing expected error")
diff --git a/internal/verification/model/health_authority_test.go b/internal/verification/model/health_authority_test.go
index 45b5997..746d5e1 100644
--- a/internal/verification/model/health_authority_test.go
+++ b/internal/verification/model/health_authority_test.go
@@ -49,7 +49,11 @@ func TestSetJWKS(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			ha := &HealthAuthority{}
 			ha.SetJWKS(tc.input)
 			if diff := cmp.Diff(tc.want, ha.JwksURI); diff != "" {
@@ -60,6 +64,8 @@ func TestSetJWKS(t *testing.T) {
 }
 
 func TestIsValid(t *testing.T) {
+	t.Parallel()
+
 	now := time.Now().UTC()
 	cases := []struct {
 		name  string
@@ -93,7 +99,11 @@ func TestIsValid(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			hak := HealthAuthorityKey{
 				From: tc.from,
 				Thru: tc.thru,
@@ -106,6 +116,8 @@ func TestIsValid(t *testing.T) {
 }
 
 func TestPublicKeyParse(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		name     string
 		pemBlock string
@@ -141,7 +153,11 @@ NTG3+oqI0Q6a3kPOuAAAupr373j7O1YXrM2KAix966EPwTNlK7YCcJa0m6PKz9DT
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			hak := HealthAuthorityKey{
 				PublicKeyPEM: tc.pemBlock,
 			}
diff --git a/pkg/api/v1/stats_types_test.go b/pkg/api/v1/stats_types_test.go
new file mode 100644
index 0000000..00bba16
--- /dev/null
+++ b/pkg/api/v1/stats_types_test.go
@@ -0,0 +1,28 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package v1
+
+import "testing"
+
+func TestTotal(t *testing.T) {
+	p := &PublishRequests{
+		UnknownPlatform: 6,
+		Android:         22,
+		IOS:             45,
+	}
+	if want, got := int64(73), p.Total(); want != got {
+		t.Fatalf("addition not working, want: %v got: %v", want, got)
+	}
+}
diff --git a/pkg/api/v1/veritifcation_types_test.go b/pkg/api/v1/veritifcation_types_test.go
index 6bb3e3c..70060fc 100644
--- a/pkg/api/v1/veritifcation_types_test.go
+++ b/pkg/api/v1/veritifcation_types_test.go
@@ -20,6 +20,8 @@ import (
 )
 
 func TestValidateClaims(t *testing.T) {
+	t.Parallel()
+
 	c := NewVerificationClaims()
 	c.ReportType = "bogus"
 
diff --git a/pkg/api/v1alpha1/verification_types_test.go b/pkg/api/v1alpha1/verification_types_test.go
index 0ef8a55..a7f0117 100644
--- a/pkg/api/v1alpha1/verification_types_test.go
+++ b/pkg/api/v1alpha1/verification_types_test.go
@@ -21,7 +21,20 @@ import (
 	"github.com/google/go-cmp/cmp"
 )
 
+func TestNewVerificationClaims(t *testing.T) {
+	got := NewVerificationClaims()
+	want := &VerificationClaims{
+		TransmissionRisks: []TransmissionRiskOverride{},
+	}
+
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Errorf("mismatch (-want +got):\n%v", diff)
+	}
+}
+
 func TestTransmissionRiskVectorSort(t *testing.T) {
+	t.Parallel()
+
 	got := TransmissionRiskVector{
 		{0, 0},
 		{3, 100},
diff --git a/pkg/base64util/decode_test.go b/pkg/base64util/decode_test.go
index 77c9695..8a74788 100644
--- a/pkg/base64util/decode_test.go
+++ b/pkg/base64util/decode_test.go
@@ -19,6 +19,8 @@ import (
 )
 
 func TestDecodeString(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		encoded string
 		raw     string
diff --git a/pkg/cache/cache_test.go b/pkg/cache/cache_test.go
index d838ebf..75cb66a 100644
--- a/pkg/cache/cache_test.go
+++ b/pkg/cache/cache_test.go
@@ -38,6 +38,8 @@ func checkSize(t *testing.T, c *Cache, want int) {
 }
 
 func TestCache(t *testing.T) {
+	t.Parallel()
+
 	duration := time.Millisecond * 500
 	cache, err := New(duration)
 	if err != nil {
@@ -79,6 +81,8 @@ func TestCache(t *testing.T) {
 }
 
 func TestWriteThruCache(t *testing.T) {
+	t.Parallel()
+
 	cache, err := New(time.Second)
 	if err != nil {
 		t.Fatal(err)
@@ -107,6 +111,8 @@ func TestWriteThruCache(t *testing.T) {
 }
 
 func TestWriteThruError(t *testing.T) {
+	t.Parallel()
+
 	cache, err := New(time.Second)
 	if err != nil {
 		t.Fatal(err)
@@ -124,19 +130,23 @@ func TestWriteThruError(t *testing.T) {
 		t.Errorf("incorrect error, want: `nope` got: %v", err.Error())
 	}
 	if got != nil {
-		t.Errorf("unexpecetd cached item, want: nil, got %v", got)
+		t.Errorf("unexpected cached item, want: nil, got %v", got)
 	}
 }
 
 func TestInvalidDuration(t *testing.T) {
+	t.Parallel()
+
 	if _, err := New(-1 * time.Second); err == nil {
-		t.Fatal("expecterd error, got nil")
-	} else if strings.Contains(err.Error(), "duration cannot be nagative") {
+		t.Fatal("expected error, got nil")
+	} else if !strings.Contains(err.Error(), "duration cannot be negative") {
 		t.Fatalf("wrong error: want: `duration cannot be negative` got: %v", err.Error())
 	}
 }
 
 func TestConcurrentReaders(t *testing.T) {
+	t.Parallel()
+
 	cache, err := New(time.Second * 5)
 	if err != nil {
 		t.Fatal(err)
diff --git a/pkg/jwks/jwks_test.go b/pkg/jwks/jwks_test.go
index 8cefa7e..ec4c7cd 100644
--- a/pkg/jwks/jwks_test.go
+++ b/pkg/jwks/jwks_test.go
@@ -65,6 +65,7 @@ func encodePublic(keys ...string) []string {
 // as well. It might behoove future engineers to break this up into multiple
 // tests.
 func TestUpdateHA(t *testing.T) {
+	t.Parallel()
 	//
 	// Constants for testing.
 	//
@@ -121,7 +122,7 @@ func TestUpdateHA(t *testing.T) {
 	// Run the tests.
 	//
 	// Again, each test tests individual pieces of the service, and then an
-	// "end-to-end" test is runn where the DB is validated.
+	// "end-to-end" test is run where the DB is validated.
 	for i, test := range tests {
 		test := test
 
@@ -234,6 +235,7 @@ func TestUpdateHA(t *testing.T) {
 
 func TestStrip(t *testing.T) {
 	t.Parallel()
+
 	tests := []struct {
 		k1, k2 string
 	}{
diff --git a/pkg/keys/ecdsa_pem_test.go b/pkg/keys/ecdsa_pem_test.go
new file mode 100644
index 0000000..e31f05f
--- /dev/null
+++ b/pkg/keys/ecdsa_pem_test.go
@@ -0,0 +1,54 @@
+// Copyright 2021 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package keys
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
+	"strings"
+	"testing"
+)
+
+func TestParseECDSAPublicKey_DecodeError(t *testing.T) {
+	t.Parallel()
+
+	_, err := ParseECDSAPublicKey("foo")
+	if err == nil {
+		t.Fatalf("expected error, got nil")
+	}
+}
+
+func TestParseECDSAPublicKey_WrongKeyType(t *testing.T) {
+	t.Parallel()
+
+	pk, err := rsa.GenerateKey(rand.Reader, 1024)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	x509EncodedPub := x509.MarshalPKCS1PublicKey(&pk.PublicKey)
+	pemEncodedPub := pem.EncodeToMemory(&pem.Block{Type: "RSA PUBLIC KEY", Bytes: x509EncodedPub})
+	pemPublicKey := string(pemEncodedPub)
+
+	_, err = ParseECDSAPublicKey(pemPublicKey)
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if want := "x509.ParsePKIXPublicKey"; !strings.Contains(err.Error(), want) {
+		t.Fatalf("wrong error, want: %q got: %q", want, err.Error())
+	}
+}
diff --git a/pkg/keys/hashicorp_vault_test.go b/pkg/keys/hashicorp_vault_test.go
index 5bc6af1..5acc2b6 100644
--- a/pkg/keys/hashicorp_vault_test.go
+++ b/pkg/keys/hashicorp_vault_test.go
@@ -35,6 +35,8 @@ import (
 )
 
 func TestNewHashiCorpVaultSigner(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		name       string
 		client     *vaultapi.Client
diff --git a/pkg/secrets/cacher_test.go b/pkg/secrets/cacher_test.go
index 2b25062..dd31442 100644
--- a/pkg/secrets/cacher_test.go
+++ b/pkg/secrets/cacher_test.go
@@ -31,6 +31,7 @@ func (sm *testSecretManager) GetSecretValue(ctx context.Context, name string) (s
 }
 
 func TestCacher_GetSecretValue(t *testing.T) {
+	t.Parallel()
 	ctx := context.Background()
 
 	sm := &testSecretManager{value: "first"}
diff --git a/pkg/secrets/hashicorp_vault_test.go b/pkg/secrets/hashicorp_vault_test.go
index de2cd64..b854848 100644
--- a/pkg/secrets/hashicorp_vault_test.go
+++ b/pkg/secrets/hashicorp_vault_test.go
@@ -29,6 +29,8 @@ import (
 )
 
 func TestHashiCorpVault_GetSecretValue(t *testing.T) {
+	t.Parallel()
+
 	cases := []struct {
 		name   string
 		setup  func(client *vaultapi.Client) error
@@ -151,6 +153,8 @@ func TestHashiCorpVault_GetSecretValue(t *testing.T) {
 		tc := tc
 
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			// Create a Vault server.
 			ctx := context.Background()
 			core, _, token := vault.TestCoreUnsealedWithConfig(t, &vault.CoreConfig{
diff --git a/pkg/timeutils/math_test.go b/pkg/timeutils/math_test.go
index e7576c0..3850fe6 100644
--- a/pkg/timeutils/math_test.go
+++ b/pkg/timeutils/math_test.go
@@ -24,6 +24,8 @@ import (
 )
 
 func TestSubtractDays(t *testing.T) {
+	t.Parallel()
+
 	day := time.Date(2020, 10, 31, 4, 15, 0, 0, time.UTC)
 
 	cases := []struct {
@@ -44,7 +46,11 @@ func TestSubtractDays(t *testing.T) {
 	}
 
 	for _, tc := range cases {
+		tc := tc
+
 		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
 			got := SubtractDays(day, tc.days)
 			if diff := cmp.Diff(tc.want, got); diff != "" {
 				t.Fatalf("mismatch (-want, +got):\n%s", diff)
diff --git a/pkg/timeutils/midnight_test.go b/pkg/timeutils/midnight_test.go
index 77f3078..16f42ce 100644
--- a/pkg/timeutils/midnight_test.go
+++ b/pkg/timeutils/midnight_test.go
@@ -24,6 +24,8 @@ import (
 )
 
 func TestLocalMidnight(t *testing.T) {
+	t.Parallel()
+
 	day := time.Date(2020, 10, 31, 4, 15, 0, 0, time.Local)
 	want := time.Date(2020, 10, 31, 0, 0, 0, 0, time.Local)
 	got := LocalMidnight(day)
@@ -38,6 +40,8 @@ func TestLocalMidnight(t *testing.T) {
 }
 
 func TestUTCMidnight(t *testing.T) {
+	t.Parallel()
+
 	day := time.Date(2020, 10, 31, 4, 15, 0, 0, time.Local)
 	want := time.Date(2020, 10, 31, 0, 0, 0, 0, time.UTC)
 	got := UTCMidnight(day)
diff --git a/pkg/verification/utils_test.go b/pkg/verification/utils_test.go
index a1a94af..68a3bc4 100644
--- a/pkg/verification/utils_test.go
+++ b/pkg/verification/utils_test.go
@@ -23,6 +23,8 @@ import (
 )
 
 func TestCalculateHMAC(t *testing.T) {
+	t.Parallel()
+
 	secret := []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 
 	eKeys := []verifyapi.ExposureKey{
@@ -55,6 +57,8 @@ func TestCalculateHMAC(t *testing.T) {
 }
 
 func TestCalculateDualHMACs(t *testing.T) {
+	t.Parallel()
+
 	secret := []byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
 
 	eKeys := []verifyapi.ExposureKey{