Repository: google/certificate-transparency-go
Pull request #1147 (2023-09-11 17:43:43)

Bump Docker golang base images to 1.21.1
<!---
Describe your changes in detail here.
If this fixes an issue, please write "Fixes #123", substituting the issue number.
-->

The Go base images are updated to `bookworm` as `buster` images were dropped in https://github.com/docker-library/golang/pull/456.

### Checklist

<!---
Go over all the following points, and put an `x` in all the boxes that apply.
Feel free to not tick any boxes that don't apply to this PR (e.g. refactoring may not need a CHANGELOG update).
If you're unsure about any of these, don't hesitate to ask. We're here to help!
-->

- [ ] I have updated the [CHANGELOG](CHANGELOG.md).
  - Adjust the draft version number according to [semantic versioning](https://semver.org/) rules.
- [ ] I have updated [documentation](docs/) accordingly.



Patch:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 980f21ec..fd598b0c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,7 +45,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.1.34
+      uses: github/codeql-action/init@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2.1.34
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.1.34
+      uses: github/codeql-action/autobuild@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2.1.34
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -72,6 +72,6 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.1.34
+      uses: github/codeql-action/analyze@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2.1.34
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 480290e8..47e6f68f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
+        uses: github/codeql-action/upload-sarif@701f152f28d4350ad289a5e31435e9ab6169a7ca # v2.21.6
         with:
           sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5517f7a8..0e1bfff2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,7 @@
 ### Misc
  * #1059: Escape forward slashes in certificate Subject names when used as user quota id strings.
  * Bump Go version from 1.19 to 1.20.
+ * Fix typos
 
 ## v1.1.6
 
@@ -165,7 +166,7 @@ entries whose `start` parameter does not fall on a multiple of the maximum
 permitted number of entries, will have their responses truncated such that
 subsequent requests will align with this boundary.
 This is intended to coerce callers of `get-entries` into all using the same
-`start` and `end` parameters and thereby increase the cachability of
+`start` and `end` parameters and thereby increase the cacheability of
 these requests.
 
 e.g.:
@@ -601,7 +602,7 @@ Commit [3955e4a00c42e83ff17ce25003976159c5d0f0f9](https://api.github.com/repos/g
 
 Published 2018-06-01 14:02:58 +0000 UTC
 
-This release is mostly fixes to the `x509` and `asn1` packages. Some command line utilties were also updated.
+This release is mostly fixes to the `x509` and `asn1` packages. Some command line utilities were also updated.
 
 Commit [ae40d07cce12f1227c6e658e61c9dddb7646f97b](https://api.github.com/repos/google/certificate-transparency-go/commits/ae40d07cce12f1227c6e658e61c9dddb7646f97b) Download [zip](https://api.github.com/repos/google/certificate-transparency-go/zipball/v1.0.5)
 
diff --git a/client/ctclient/cmd/upload.go b/client/ctclient/cmd/upload.go
index 7fe88485..95adda91 100644
--- a/client/ctclient/cmd/upload.go
+++ b/client/ctclient/cmd/upload.go
@@ -38,7 +38,7 @@ func init() {
 			runUpload(cmd.Context())
 		},
 	}
-	// TODO(pavelkalinnikov): Don't share this parameter wiith get-inclusion-proof.
+	// TODO(pavelkalinnikov): Don't share this parameter with get-inclusion-proof.
 	cmd.Flags().StringVar(&certChain, "cert_chain", "", "Name of file containing certificate chain as concatenated PEM files")
 	cmd.Flags().DurationVar(&logMMD, "log_mmd", 24*time.Hour, "Log's maximum merge delay")
 	rootCmd.AddCommand(&cmd)
diff --git a/fixchain/fix.go b/fixchain/fix.go
index 5b7b4700..5f5f4bd7 100644
--- a/fixchain/fix.go
+++ b/fixchain/fix.go
@@ -126,7 +126,7 @@ func (fix *toFix) fixChain() ([][]*x509.Certificate, []*FixError) {
 		if ferrs != nil {
 			retferrs = append(retferrs, ferrs...)
 		}
-		// If adding certs from the chains steming from this cert resulted in
+		// If adding certs from the chains stemming from this cert resulted in
 		// successful verification of chains for fix.cert to fix.root, return
 		// the chains.
 		if chains != nil {
@@ -186,9 +186,9 @@ func (fix *toFix) augmentIntermediates(cert *x509.Certificate, length int, seen
 
 	// For each url in the AIA information of cert, get the corresponding
 	// certificates and recursively build the chains from those certificates,
-	// adding every cert to the pool of intermdiates, running the verifier at
+	// adding every cert to the pool of intermediates, running the verifier at
 	// every cert addition, and returning verified chains of fix.cert as soon
-	// as thay are found.
+	// as they are found.
 	var retferrs []*FixError
 	for _, url := range cert.IssuingCertificateURL {
 		icerts, ferr := fix.getIntermediates(url)
diff --git a/fixchain/logger.go b/fixchain/logger.go
index e866d89c..f8ec2b51 100644
--- a/fixchain/logger.go
+++ b/fixchain/logger.go
@@ -139,7 +139,7 @@ type toPost struct {
 }
 
 // postToLog() is used during the initial queueing of chains to avoid spinning
-// up an excessive number of goroutines, and unecessarily using up memory. If
+// up an excessive number of goroutines, and unnecessarily using up memory. If
 // asyncPostToLog() was called instead, then every time a new chain was queued,
 // a new goroutine would be created, each holding their own chain - regardless
 // of whether there were postServers available to process them or not.  If a
diff --git a/integration/Dockerfile b/integration/Dockerfile
index 0535db39..1047766e 100644
--- a/integration/Dockerfile
+++ b/integration/Dockerfile
@@ -1,6 +1,6 @@
 # This Dockerfile builds a base image for the certificate-transparency-go CloudBuild integration testing.
 # See https://hub.docker.com/_/golang for the set of golang base images.
-FROM golang:buster@sha256:eb3f9ac805435c1b2c965d63ce460988e1000058e1f67881324746362baf9572 as ct_testbase
+FROM golang:1.21.1-bookworm@sha256:d3114db136e7f2d9b08c3fcd374381ba3f8d85c17b80c48dbc53cd938cfb2b64 as ct_testbase
 
 WORKDIR /testbase
 
diff --git a/internal/witness/cmd/feeder/Dockerfile b/internal/witness/cmd/feeder/Dockerfile
index 39dd2a19..07c8aca5 100644
--- a/internal/witness/cmd/feeder/Dockerfile
+++ b/internal/witness/cmd/feeder/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.21-alpine@sha256:96634e55b363cb93d39f78fb18aa64abc7f96d372c176660d7b8b6118939d97b AS builder
+FROM golang:1.21.1-bookworm@sha256:d3114db136e7f2d9b08c3fcd374381ba3f8d85c17b80c48dbc53cd938cfb2b64 as builder
 
 ARG GOFLAGS=""
 ENV GOFLAGS=$GOFLAGS
diff --git a/internal/witness/cmd/witness/Dockerfile b/internal/witness/cmd/witness/Dockerfile
index 38893496..a59ad7b8 100644
--- a/internal/witness/cmd/witness/Dockerfile
+++ b/internal/witness/cmd/witness/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:buster@sha256:eb3f9ac805435c1b2c965d63ce460988e1000058e1f67881324746362baf9572 AS builder
+FROM golang:1.21.1-bookworm@sha256:d3114db136e7f2d9b08c3fcd374381ba3f8d85c17b80c48dbc53cd938cfb2b64 AS builder
 
 ARG GOFLAGS=""
 ENV GOFLAGS=$GOFLAGS
@@ -18,7 +18,7 @@ COPY . .
 RUN go build -o /build/bin/witness ./internal/witness/cmd/witness
 
 # Build release image
-FROM golang:buster@sha256:eb3f9ac805435c1b2c965d63ce460988e1000058e1f67881324746362baf9572
+FROM golang:1.21.1-bookworm@sha256:d3114db136e7f2d9b08c3fcd374381ba3f8d85c17b80c48dbc53cd938cfb2b64
 
 COPY --from=builder /build/bin/witness /bin/witness
 ENTRYPOINT ["/bin/witness"]
diff --git a/jsonclient/client.go b/jsonclient/client.go
index 46d5dde8..a95f19cc 100644
--- a/jsonclient/client.go
+++ b/jsonclient/client.go
@@ -274,7 +274,7 @@ func (c *JSONClient) waitForBackoff(ctx context.Context) error {
 }
 
 // PostAndParseWithRetry makes a HTTP POST call, but retries (with backoff) on
-// retriable errors; the caller should set a deadline on the provided context
+// retryable errors; the caller should set a deadline on the provided context
 // to prevent infinite retries.  Return values are as for PostAndParse.
 func (c *JSONClient) PostAndParseWithRetry(ctx context.Context, path string, req, rsp interface{}) (*http.Response, []byte, error) {
 	if ctx == nil {
diff --git a/submission/races.go b/submission/races.go
index 696ab05c..e1bbee89 100644
--- a/submission/races.go
+++ b/submission/races.go
@@ -137,7 +137,7 @@ func (sub *safeSubmissionState) setResult(logURL string, sct *ct.SignedCertifica
 		}
 	}
 
-	// Cancel any pending Log-requests for which there're no more awaiting
+	// Cancel any pending Log-requests for which there are no more awaiting
 	// Log-groups.
 	for logURL := range sub.logToGroups {
 		if sub.remainingSubmissions <= 0 && sub.cancels[logURL] != nil {
diff --git a/tls/tls.go b/tls/tls.go
index 030074c1..a48c998f 100644
--- a/tls/tls.go
+++ b/tls/tls.go
@@ -638,7 +638,7 @@ func marshalField(out *bytes.Buffer, v reflect.Value, info *fieldInfo) error {
 			}
 		}
 		// Now we have seen all fields in the structure, check that all select(Enum) {..} selector
-		// fields found a source field get get their data from.
+		// fields found a source field to get their data from.
 		for selector, seen := range selectorSeen {
 			if !seen {
 				return syntaxError{info.fieldName(), selector + ": unhandled value for selector"}
diff --git a/trillian/ctfe/ct_server/main.go b/trillian/ctfe/ct_server/main.go
index 33a5f9af..e1acbdb9 100644
--- a/trillian/ctfe/ct_server/main.go
+++ b/trillian/ctfe/ct_server/main.go
@@ -70,7 +70,7 @@ var (
 	tracingProjectID   = flag.String("tracing_project_id", "", "project ID to pass to stackdriver. Can be empty for GCP, consult docs for other platforms.")
 	tracingPercent     = flag.Int("tracing_percent", 0, "Percent of requests to be traced. Zero is a special case to use the DefaultSampler")
 	quotaRemote        = flag.Bool("quota_remote", true, "Enable requesting of quota for IP address sending incoming requests")
-	quotaIntermediate  = flag.Bool("quota_intermediate", true, "Enable requesting of quota for intermediate certificates in sumbmitted chains")
+	quotaIntermediate  = flag.Bool("quota_intermediate", true, "Enable requesting of quota for intermediate certificates in submitted chains")
 	handlerPrefix      = flag.String("handler_prefix", "", "If set e.g. to '/logs' will prefix all handlers that don't define a custom prefix")
 	pkcs11ModulePath   = flag.String("pkcs11_module_path", "", "Path to the PKCS#11 module to use for keys that use the PKCS#11 interface")
 )
diff --git a/trillian/ctfe/doc.go b/trillian/ctfe/doc.go
index 10b5627e..093939aa 100644
--- a/trillian/ctfe/doc.go
+++ b/trillian/ctfe/doc.go
@@ -17,7 +17,7 @@ Package ctfe contains a usage example by providing an implementation of an RFC69
 log server using a Trillian log server as backend storage via its GRPC API.
 
 IMPORTANT: Only code rooted within this part of the tree should refer to the CT
-Github repository. Other parts of the system must not assume that the data they're
+GitHub repository. Other parts of the system must not assume that the data they're
 processing is X.509 or CT related.
 
 The CT repository can be found at: https://github.com/google/certificate-transparency
diff --git a/trillian/ctfe/handlers.go b/trillian/ctfe/handlers.go
index 126a1d18..5ab7d0ff 100644
--- a/trillian/ctfe/handlers.go
+++ b/trillian/ctfe/handlers.go
@@ -981,7 +981,7 @@ func parseGetEntriesRange(r *http.Request, maxRange, logID int64) (int64, int64,
 		// of MaxGetEntriesAllowed.
 		// This is intended to coerce large runs of get-entries requests (e.g. by
 		// monitors/mirrors) into all requesting the same start/end ranges,
-		// thereby making the responses more readily cachable.
+		// thereby making the responses more readily cacheable.
 		d := (end + 1) % maxRange
 		end = end - d
 		alignedGetEntries.Inc(strconv.FormatInt(logID, 10), strconv.FormatBool(d == 0))
diff --git a/trillian/ctfe/instance.go b/trillian/ctfe/instance.go
index 1163972a..0056fd07 100644
--- a/trillian/ctfe/instance.go
+++ b/trillian/ctfe/instance.go
@@ -58,10 +58,10 @@ type InstanceOptions struct {
 	// given request. This string will be used as a User quota key.
 	// If unset, no quota will be requested for remote users.
 	RemoteQuotaUser func(*http.Request) string
-	// CertificateQuotaUser returns a string represeing the passed in
+	// CertificateQuotaUser returns a string representing the passed in
 	// intermediate certificate. This string will be user as a User quota key for
 	// the cert. Quota will be requested for each intermediate in an
-	// add-[pre]-chain request so as to allow individual issers to be rate
+	// add-[pre]-chain request so as to allow individual issuers to be rate
 	// limited. If unset, no quota will be requested for intermediate
 	// certificates.
 	CertificateQuotaUser func(*x509.Certificate) string
diff --git a/trillian/docs/ManualDeployment.md b/trillian/docs/ManualDeployment.md
index 6d264532..d10a3175 100644
--- a/trillian/docs/ManualDeployment.md
+++ b/trillian/docs/ManualDeployment.md
@@ -127,7 +127,7 @@ However, add operations are not immediately incorporated into the Merkle tree.
 Instead, pending add operations are queued up and a separate process, the log
 signer (`github.com/google/trillian/cmd/trillian_log_signer`) periodically
 reads pending entries from the queue.  The signer gives these entries unique,
-monotonicallly increasing, sequence numbers and incorporates them into the
+monotonically increasing, sequence numbers and incorporates them into the
 Merkle tree.
 
  - The `--mysql_uri` option indicates where the MySQL database is available.
diff --git a/trillian/docs/Operation.md b/trillian/docs/Operation.md
index 2bf4d638..5bb6c453 100644
--- a/trillian/docs/Operation.md
+++ b/trillian/docs/Operation.md
@@ -71,7 +71,7 @@ this incorporation relies on a single point of failure (the
 [signer](ManualDeployment.md#primary-signer-election)).  As such, there are
 some CT-specific metrics that can also be alerted on:
 
- - The age of the most recent Merkle treee head.
+ - The age of the most recent Merkle tree head.
  - The size of the current backlog of unmerged submissions.
  - Per-log instance counts of primary signer instances (which is normally 1,
    can transiently be 0, but should never be > 1).
diff --git a/trillian/examples/deployment/docker/ctfe/Dockerfile b/trillian/examples/deployment/docker/ctfe/Dockerfile
index 437acab6..dffa4adc 100644
--- a/trillian/examples/deployment/docker/ctfe/Dockerfile
+++ b/trillian/examples/deployment/docker/ctfe/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:buster@sha256:eb3f9ac805435c1b2c965d63ce460988e1000058e1f67881324746362baf9572 as build
+FROM golang:1.21.1-bookworm@sha256:d3114db136e7f2d9b08c3fcd374381ba3f8d85c17b80c48dbc53cd938cfb2b64 as build
 
 ARG GOFLAGS=""
 ENV GOFLAGS=$GOFLAGS
diff --git a/trillian/integration/ct_functions.sh b/trillian/integration/ct_functions.sh
index 9dba52b0..1e9265c7 100644
--- a/trillian/integration/ct_functions.sh
+++ b/trillian/integration/ct_functions.sh
@@ -100,7 +100,7 @@ ct_provision() {
 
   echo "CT Integration Configuration in ${CT_CFG}:"
   cat "${CT_CFG}"
-  echo "CT Lifeycle Configuration in ${CT_LIFECYCLE_CFG}:"
+  echo "CT Lifecycle Configuration in ${CT_LIFECYCLE_CFG}:"
   cat "${CT_LIFECYCLE_CFG}"
   echo
 }
diff --git a/trillian/integration/hammer.go b/trillian/integration/hammer.go
index 56601a39..dc2b5dac 100644
--- a/trillian/integration/hammer.go
+++ b/trillian/integration/hammer.go
@@ -133,7 +133,7 @@ type HammerConfig struct {
 	// Rate limiter
 	Limiter Limiter
 	// MaxParallelChains sets the upper limit for the number of parallel
-	// add-*-chain requests to make when the biasing model says to perfom an add.
+	// add-*-chain requests to make when the biasing model says to perform an add.
 	MaxParallelChains int
 	// EmitInterval defines how frequently stats are logged.
 	EmitInterval time.Duration
diff --git a/trillian/migrillian/main.go b/trillian/migrillian/main.go
index a2296ef7..3055bcfa 100644
--- a/trillian/migrillian/main.go
+++ b/trillian/migrillian/main.go
@@ -51,7 +51,7 @@ var (
 	etcdServers   = flag.String("etcd_servers", "", "A comma-separated list of etcd servers; no etcd registration if empty")
 	lockDir       = flag.String("lock_file_path", "/migrillian/master", "etcd lock file directory path")
 	electionDelay = flag.Duration("election_delay", 0, "Max random pause before participating in master election")
-	backend       = flag.String("backend", "", "GRPC endpoing to connect to Trillian logservers")
+	backend       = flag.String("backend", "", "GRPC endpoint to connect to Trillian logservers")
 
 	metricsEndpoint = flag.String("metrics_endpoint", "localhost:8099", "Endpoint for serving metrics")
 
diff --git a/types.go b/types.go
index c797d9ce..b6af606b 100644
--- a/types.go
+++ b/types.go
@@ -555,7 +555,7 @@ type LeafEntry struct {
 	ExtraData []byte `json:"extra_data"`
 }
 
-// GetEntriesResponse respresents the JSON response to the get-entries GET method
+// GetEntriesResponse represents the JSON response to the get-entries GET method
 // from section 4.6.
 type GetEntriesResponse struct {
 	Entries []LeafEntry `json:"entries"` // the list of returned entries


Test patch:
diff --git a/loglist3/loglist3_test.go b/loglist3/loglist3_test.go
index 56c65d01..89bf1388 100644
--- a/loglist3/loglist3_test.go
+++ b/loglist3/loglist3_test.go
@@ -85,7 +85,7 @@ var sampleLogList = LogList{
 				{
 					Description: "Google 'Racketeer' log",
 					LogID:       deb64("7kEv4llINIlh4vPgjGgugT7A/3cLbXUXF2OvMBT/l2g="),
-					// Key value chosed to have a hash that starts ee4... (specifically ee412fe25948348961e2f3e08c682e813ec0ff770b6d75171763af3014ff9768)
+					// Key value chosen to have a hash that starts ee4... (specifically ee412fe25948348961e2f3e08c682e813ec0ff770b6d75171763af3014ff9768)
 					Key: deb64("Hy2TPTZ2yq9ASMmMZiB9SZEUx5WNH5G0Ft5Tm9vKMcPXA+ic/Ap3gg6fXzBJR8zLkt5lQjvKMdbHYMGv7yrsZg=="),
 					URL: "https://ct.googleapis.com/racketeer/",
 					MMD: 86400,
diff --git a/signatures_test.go b/signatures_test.go
index 94293377..a4d23987 100644
--- a/signatures_test.go
+++ b/signatures_test.go
@@ -265,7 +265,7 @@ func testVerifySCTSignatureFailsForIncorrectLeafBytes(t *testing.T, sct SignedCe
 		old := entry.Leaf.TimestampedEntry.X509Entry.Data[i]
 		corruptByteAt(entry.Leaf.TimestampedEntry.X509Entry.Data, i)
 		if err := sv.VerifySCTSignature(sct, entry); err == nil {
-			t.Fatalf("Incorrectly verfied signature over corrupted leaf data, uncovered byte at %d?", i)
+			t.Fatalf("Incorrectly verified signature over corrupted leaf data, uncovered byte at %d?", i)
 		}
 		entry.Leaf.TimestampedEntry.X509Entry.Data[i] = old
 	}
diff --git a/submission/distributor_test.go b/submission/distributor_test.go
index aa17d8ee..3cdba7c0 100644
--- a/submission/distributor_test.go
+++ b/submission/distributor_test.go
@@ -126,7 +126,7 @@ func sampleUncollectableLogList() *loglist3.LogList {
 	ll.Operators[0].Logs = append(ll.Operators[0].Logs, &loglist3.Log{
 		Description: "Does not return roots", Key: []byte("VW5jb2xsZWN0YWJsZUxvZ0xpc3Q="),
 		URL:   "uncollectable-roots/log/",
-		DNS:   "uncollectavle.ct.googleapis.com",
+		DNS:   "uncollectable.ct.googleapis.com",
 		MMD:   123,
 		State: &loglist3.LogStates{Usable: &loglist3.LogState{}},
 	})