Repository: kopia/kopia
Pull request #1072 (2021-05-15 17:58:36)

Upgraded linter to 1.40.1

codecov[bot]: # [Codecov](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia) Report
> Merging [#1072](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia) (d979769) into [master](https://codecov.io/gh/kopia/kopia/commit/41931f21ce6650e65e151f727a08c1e9ea31242f?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia) (41931f2) will **decrease** coverage by `2.70%`.
> The diff coverage is `75.17%`.

[![Impacted file tree graph](https://codecov.io/gh/kopia/kopia/pull/1072/graphs/tree.svg?width=650&height=150&src=pr&token=CRK4RMRFSH&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia)](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia)

```diff
@@            Coverage Diff             @@
##           master    #1072      +/-   ##
==========================================
- Coverage   62.89%   60.18%   -2.71%     
==========================================
  Files         134      346     +212     
  Lines        7750    17204    +9454     
==========================================
+ Hits         4874    10354    +5480     
- Misses       2198     5456    +3258     
- Partials      678     1394     +716     
```


| [Impacted Files](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia) | Coverage Δ | |
|---|---|---|
| [cli/auto\_upgrade.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2F1dG9fdXBncmFkZS5nbw==) | `58.33% <ø> (ø)` | |
| [cli/command\_acl\_add.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfYWNsX2FkZC5nbw==) | `27.77% <0.00%> (ø)` | |
| [cli/command\_benchmark\_compression.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfYmVuY2htYXJrX2NvbXByZXNzaW9uLmdv) | `15.51% <0.00%> (ø)` | |
| [cli/command\_blob\_list.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfYmxvYl9saXN0Lmdv) | `65.00% <ø> (ø)` | |
| [cli/command\_cache\_clear.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfY2FjaGVfY2xlYXIuZ28=) | `54.16% <ø> (ø)` | |
| [cli/command\_cache\_set.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfY2FjaGVfc2V0Lmdv) | `21.87% <ø> (ø)` | |
| [cli/command\_cache\_sync.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfY2FjaGVfc3luYy5nbw==) | `66.66% <ø> (ø)` | |
| [cli/command\_maintenance\_run.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfbWFpbnRlbmFuY2VfcnVuLmdv) | `100.00% <ø> (ø)` | |
| [cli/command\_manifest\_show.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfbWFuaWZlc3Rfc2hvdy5nbw==) | `38.88% <0.00%> (ø)` | |
| [cli/command\_mount.go](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia#diff-Y2xpL2NvbW1hbmRfbW91bnQuZ28=) | `19.29% <ø> (ø)` | |
| ... and [386 more](https://codecov.io/gh/kopia/kopia/pull/1072/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia) | |

------

[Continue to review full report at Codecov](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=footer&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia). Last update [fcd507a...d979769](https://codecov.io/gh/kopia/kopia/pull/1072?src=pr&el=lastupdated&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=kopia).


Patch:
diff --git a/.golangci.yml b/.golangci.yml
index 9330088c..438315df 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -50,6 +50,10 @@ linters:
   enable-all: true
   disable:
     - maligned
+    - tagliatelle
+    - golint
+    - interfacer
+    - scopelint
     - prealloc
     - gochecknoglobals
     - gochecknoinits
@@ -78,6 +82,7 @@ issues:
       - nestif
       - wrapcheck
       - nolintlint
+      - forcetypeassert
     - text: "Magic number: 1e"
       linters:
       - gomnd
diff --git a/Makefile b/Makefile
index 8903f9dc..2da80a9b 100644
--- a/Makefile
+++ b/Makefile
@@ -59,6 +59,10 @@ lint: $(linter)
 lint-and-log: $(linter)
 	$(linter) --deadline $(LINTER_DEADLINE) run $(linter_flags) | tee .linterr.txt
 
+lint-all: $(linter)
+	GOOS=windows $(linter) --deadline $(LINTER_DEADLINE) run $(linter_flags)
+	GOOS=linux $(linter) --deadline $(LINTER_DEADLINE) run $(linter_flags)
+	GOOS=darwin $(linter) --deadline $(LINTER_DEADLINE) run $(linter_flags)
 
 vet:
 	go vet -all .
diff --git a/cli/app.go b/cli/app.go
index 76dd4389..19978344 100644
--- a/cli/app.go
+++ b/cli/app.go
@@ -314,6 +314,7 @@ func assertDirectRepository(act func(ctx context.Context, rep repo.DirectReposit
 
 func (c *App) directRepositoryWriteAction(act func(ctx context.Context, rep repo.DirectRepositoryWriter) error) func(ctx *kingpin.ParseContext) error {
 	return c.maybeRepositoryAction(assertDirectRepository(func(ctx context.Context, rep repo.DirectRepository) error {
+		// nolint:wrapcheck
 		return repo.DirectWriteSession(ctx, rep, repo.WriteSessionOptions{
 			Purpose:  "directRepositoryWriteAction",
 			OnUpload: c.progress.UploadedBytes,
@@ -344,6 +345,7 @@ func (c *App) repositoryReaderAction(act func(ctx context.Context, rep repo.Repo
 
 func (c *App) repositoryWriterAction(act func(ctx context.Context, rep repo.RepositoryWriter) error) func(ctx *kingpin.ParseContext) error {
 	return c.maybeRepositoryAction(func(ctx context.Context, rep repo.Repository) error {
+		// nolint:wrapcheck
 		return repo.WriteSession(ctx, rep, repo.WriteSessionOptions{
 			Purpose:  "repositoryWriterAction",
 			OnUpload: c.progress.UploadedBytes,
@@ -430,6 +432,7 @@ func (c *App) maybeRunMaintenance(ctx context.Context, rep repo.Repository) erro
 		Purpose:  "maybeRunMaintenance",
 		OnUpload: c.progress.UploadedBytes,
 	}, func(w repo.DirectRepositoryWriter) error {
+		// nolint:wrapcheck
 		return snapshotmaintenance.Run(ctx, w, maintenance.ModeAuto, false, maintenance.SafetyFull)
 	})
 
diff --git a/cli/auto_upgrade.go b/cli/auto_upgrade.go
index 96cde931..95938f88 100644
--- a/cli/auto_upgrade.go
+++ b/cli/auto_upgrade.go
@@ -27,6 +27,7 @@ func maybeAutoUpgradeRepository(ctx context.Context, r repo.Repository) error {
 
 	log(ctx).Debugf("Setting default maintenance parameters...")
 
+	// nolint:wrapcheck
 	return repo.DirectWriteSession(ctx, dr, repo.WriteSessionOptions{
 		Purpose: "setDefaultMaintenanceParameters",
 	}, func(w repo.DirectRepositoryWriter) error {
diff --git a/cli/command_acl_add.go b/cli/command_acl_add.go
index 6e1015f3..8da2eed7 100644
--- a/cli/command_acl_add.go
+++ b/cli/command_acl_add.go
@@ -47,5 +47,5 @@ func (c *commandACLAdd) run(ctx context.Context, rep repo.RepositoryWriter) erro
 		Access: al,
 	}
 
-	return acl.AddACL(ctx, rep, e)
+	return errors.Wrap(acl.AddACL(ctx, rep, e), "error adding ACL entry")
 }
diff --git a/cli/command_benchmark_compression.go b/cli/command_benchmark_compression.go
index 98922a76..f41d2d54 100644
--- a/cli/command_benchmark_compression.go
+++ b/cli/command_benchmark_compression.go
@@ -126,7 +126,7 @@ type benchResult struct {
 
 func hashOf(b []byte) uint64 {
 	h := fnv.New64a()
-	h.Write(b) //nolint:errcheck
+	h.Write(b)
 
 	return h.Sum64()
 }
diff --git a/cli/command_blob_list.go b/cli/command_blob_list.go
index 010d8ce5..27c3940d 100644
--- a/cli/command_blob_list.go
+++ b/cli/command_blob_list.go
@@ -32,6 +32,7 @@ func (c *commandBlobList) run(ctx context.Context, rep repo.DirectRepository) er
 	jl.begin(&c.jo)
 	defer jl.end()
 
+	// nolint:wrapcheck
 	return rep.BlobReader().ListBlobs(ctx, blob.ID(c.blobListPrefix), func(b blob.Metadata) error {
 		if c.blobListMaxSize != 0 && b.Length > c.blobListMaxSize {
 			return nil
@@ -46,6 +47,7 @@ func (c *commandBlobList) run(ctx context.Context, rep repo.DirectRepository) er
 		} else {
 			c.out.printStdout("%-70v %10v %v\n", b.BlobID, b.Length, formatTimestamp(b.Timestamp))
 		}
+
 		return nil
 	})
 }
diff --git a/cli/command_cache_clear.go b/cli/command_cache_clear.go
index eee23a0e..40538e84 100644
--- a/cli/command_cache_clear.go
+++ b/cli/command_cache_clear.go
@@ -52,6 +52,7 @@ func clearCacheDirectory(ctx context.Context, d string) error {
 	log(ctx).Infof("Clearing cache directory: %v.", d)
 
 	err := retry.WithExponentialBackoffNoValue(ctx, "delete cache", func() error {
+		// nolint:wrapcheck
 		return os.RemoveAll(d)
 	}, retry.Always)
 	if err != nil {
diff --git a/cli/command_cache_set.go b/cli/command_cache_set.go
index 0dd56e2d..ea1bb939 100644
--- a/cli/command_cache_set.go
+++ b/cli/command_cache_set.go
@@ -68,5 +68,6 @@ func (c *commandCacheSetParams) run(ctx context.Context, rep repo.RepositoryWrit
 		return errors.Errorf("no changes")
 	}
 
+	// nolint:wrapcheck
 	return repo.SetCachingOptions(ctx, c.svc.repositoryConfigFileName(), opts)
 }
diff --git a/cli/command_cache_sync.go b/cli/command_cache_sync.go
index 9d30cc4f..110bb43e 100644
--- a/cli/command_cache_sync.go
+++ b/cli/command_cache_sync.go
@@ -14,5 +14,6 @@ func (c *commandCacheSync) setup(svc appServices, parent commandParent) {
 }
 
 func (c *commandCacheSync) run(ctx context.Context, rep repo.DirectRepositoryWriter) error {
+	// nolint:wrapcheck
 	return rep.ContentManager().SyncMetadataCache(ctx)
 }
diff --git a/cli/command_content_rewrite.go b/cli/command_content_rewrite.go
index f2364baf..920990f8 100644
--- a/cli/command_content_rewrite.go
+++ b/cli/command_content_rewrite.go
@@ -41,6 +41,7 @@ func (c *commandContentRewrite) setup(svc appServices, parent commandParent) {
 func (c *commandContentRewrite) runContentRewriteCommand(ctx context.Context, rep repo.DirectRepositoryWriter) error {
 	c.svc.advancedCommand(ctx)
 
+	// nolint:wrapcheck
 	return maintenance.RewriteContents(ctx, rep, &maintenance.RewriteContentsOptions{
 		ContentIDRange: c.contentRange.contentIDRange(),
 		ContentIDs:     toContentIDs(c.contentRewriteIDs),
diff --git a/cli/command_diff.go b/cli/command_diff.go
index be74a1e0..a705d651 100644
--- a/cli/command_diff.go
+++ b/cli/command_diff.go
@@ -63,7 +63,7 @@ func (c *commandDiff) run(ctx context.Context, rep repo.Repository) error {
 	}
 
 	if isDir1 {
-		return d.Compare(ctx, ent1, ent2)
+		return errors.Wrap(d.Compare(ctx, ent1, ent2), "error comparing directories")
 	}
 
 	return errors.New("comparing files not implemented yet")
diff --git a/cli/command_index_optimize.go b/cli/command_index_optimize.go
index 3b144af4..3bb30837 100644
--- a/cli/command_index_optimize.go
+++ b/cli/command_index_optimize.go
@@ -41,5 +41,6 @@ func (c *commandIndexOptimize) runOptimizeCommand(ctx context.Context, rep repo.
 		opt.DropDeletedBefore = rep.Time().Add(-age)
 	}
 
+	// nolint:wrapcheck
 	return rep.ContentManager().CompactIndexes(ctx, opt)
 }
diff --git a/cli/command_maintenance_run.go b/cli/command_maintenance_run.go
index d06206e6..f4b2a1d3 100644
--- a/cli/command_maintenance_run.go
+++ b/cli/command_maintenance_run.go
@@ -29,5 +29,6 @@ func (c *commandMaintenanceRun) run(ctx context.Context, rep repo.DirectReposito
 		mode = maintenance.ModeFull
 	}
 
+	// nolint:wrapcheck
 	return snapshotmaintenance.Run(ctx, rep, mode, c.maintenanceRunForce, c.safety)
 }
diff --git a/cli/command_mount.go b/cli/command_mount.go
index 299ed913..344ee718 100644
--- a/cli/command_mount.go
+++ b/cli/command_mount.go
@@ -65,9 +65,11 @@ func (c *commandMount) run(ctx context.Context, rep repo.Repository) error {
 	}
 
 	if c.mountTraceFS {
+		// nolint:forcetypeassert
 		entry = loggingfs.Wrap(entry, log(ctx).Debugf).(fs.Directory)
 	}
 
+	// nolint:forcetypeassert
 	entry = cachefs.Wrap(entry, c.newFSCache()).(fs.Directory)
 
 	ctrl, mountErr := mount.Directory(ctx, entry, c.mountPoint,
diff --git a/cli/command_policy_edit.go b/cli/command_policy_edit.go
index 3858d90b..ac016371 100644
--- a/cli/command_policy_edit.go
+++ b/cli/command_policy_edit.go
@@ -90,6 +90,7 @@ func (c *commandPolicyEdit) run(ctx context.Context, rep repo.RepositoryWriter)
 			updated = &policy.Policy{}
 			d := json.NewDecoder(bytes.NewBufferString(edited))
 			d.DisallowUnknownFields()
+			// nolint:wrapcheck
 			return d.Decode(updated)
 		}); err != nil {
 			return errors.Wrap(err, "unable to launch editor")
diff --git a/cli/command_repository_connect.go b/cli/command_repository_connect.go
index 33e51d22..85f572d3 100644
--- a/cli/command_repository_connect.go
+++ b/cli/command_repository_connect.go
@@ -37,6 +37,7 @@ func (c *commandRepositoryConnect) setup(svc advancedAppServices, parent command
 				return errors.Wrap(err, "can't connect to storage")
 			}
 
+			// nolint:wrapcheck
 			return svc.runConnectCommandWithStorage(ctx, &c.co, st)
 		})
 	}
diff --git a/cli/command_repository_connect_from_config.go b/cli/command_repository_connect_from_config.go
index 95198909..72e2a1b5 100644
--- a/cli/command_repository_connect_from_config.go
+++ b/cli/command_repository_connect_from_config.go
@@ -46,6 +46,7 @@ func (c *storageFromConfigFlags) connectToStorageFromConfigFile(ctx context.Cont
 		return nil, errors.Wrap(err, "unable to open config")
 	}
 
+	// nolint:wrapcheck
 	return blob.NewStorage(ctx, *cfg.Storage)
 }
 
@@ -59,5 +60,6 @@ func (c *storageFromConfigFlags) connectToStorageFromConfigToken(ctx context.Con
 		c.sps.setPasswordFromToken(pass)
 	}
 
+	// nolint:wrapcheck
 	return blob.NewStorage(ctx, ci)
 }
diff --git a/cli/command_repository_create.go b/cli/command_repository_create.go
index c7c36ae0..6853a1ca 100644
--- a/cli/command_repository_create.go
+++ b/cli/command_repository_create.go
@@ -77,7 +77,6 @@ func (c *commandRepositoryCreate) ensureEmpty(ctx context.Context, s blob.Storag
 	hasDataError := errors.Errorf("has data")
 
 	err := s.ListBlobs(ctx, "", func(cb blob.Metadata) error {
-		// nolint:wrapcheck
 		return hasDataError
 	})
 
@@ -128,6 +127,7 @@ func (c *commandRepositoryCreate) populateRepository(ctx context.Context, passwo
 	}
 	defer rep.Close(ctx) //nolint:errcheck
 
+	// nolint:wrapcheck
 	return repo.WriteSession(ctx, rep, repo.WriteSessionOptions{
 		Purpose: "populateRepository",
 	}, func(w repo.RepositoryWriter) error {
diff --git a/cli/command_repository_repair.go b/cli/command_repository_repair.go
index e4ccac8b..68f502eb 100644
--- a/cli/command_repository_repair.go
+++ b/cli/command_repository_repair.go
@@ -88,7 +88,6 @@ func (c *commandRepositoryRepair) recoverFormatBlob(ctx context.Context, st blob
 
 				log(ctx).Infof("recovered replica block from %v", bi.BlobID)
 
-				// nolint:wrapcheck
 				return errSuccess
 			}
 
diff --git a/cli/command_repository_set_client.go b/cli/command_repository_set_client.go
index 5f21b8c1..acf7ad4b 100644
--- a/cli/command_repository_set_client.go
+++ b/cli/command_repository_set_client.go
@@ -83,5 +83,6 @@ func (c *commandRepositorySetClient) run(ctx context.Context, rep repo.Repositor
 		return errors.Errorf("no changes")
 	}
 
+	// nolint:wrapcheck
 	return repo.SetClientOptions(ctx, c.svc.repositoryConfigFileName(), opt)
 }
diff --git a/cli/command_repository_status.go b/cli/command_repository_status.go
index b024d4af..35229f8c 100644
--- a/cli/command_repository_status.go
+++ b/cli/command_repository_status.go
@@ -94,7 +94,7 @@ func (c *commandRepositoryStatus) run(ctx context.Context, rep repo.Repository)
 func scanCacheDir(dirname string) (fileCount int, totalFileLength int64, err error) {
 	entries, err := ioutil.ReadDir(dirname)
 	if err != nil {
-		return 0, 0, nil
+		return 0, 0, errors.Wrap(err, "unable to read cache directory")
 	}
 
 	for _, e := range entries {
diff --git a/cli/command_repository_sync.go b/cli/command_repository_sync.go
index e0359a11..353b0b40 100644
--- a/cli/command_repository_sync.go
+++ b/cli/command_repository_sync.go
@@ -344,7 +344,7 @@ func (c *commandRepositorySyncTo) ensureRepositoriesHaveSameFormatBlob(ctx conte
 				return errors.Errorf("destination repository does not have a format blob")
 			}
 
-			return dst.PutBlob(ctx, repo.FormatBlobID, gather.FromSlice(srcData))
+			return errors.Wrap(dst.PutBlob(ctx, repo.FormatBlobID, gather.FromSlice(srcData)), "error saving format blob")
 		}
 
 		return errors.Wrap(err, "error reading destination repository format blob")
diff --git a/cli/command_repository_upgrade.go b/cli/command_repository_upgrade.go
index 596a49bf..1bf2a7bd 100644
--- a/cli/command_repository_upgrade.go
+++ b/cli/command_repository_upgrade.go
@@ -14,5 +14,6 @@ func (c *commandRepositoryUpgrade) setup(svc appServices, parent commandParent)
 }
 
 func (c *commandRepositoryUpgrade) run(ctx context.Context, rep repo.DirectRepositoryWriter) error {
+	// nolint:wrapcheck
 	return rep.Upgrade(ctx)
 }
diff --git a/cli/command_server_cancel.go b/cli/command_server_cancel.go
index b79530b1..9c6710fd 100644
--- a/cli/command_server_cancel.go
+++ b/cli/command_server_cancel.go
@@ -18,5 +18,6 @@ func (c *commandServerCancel) setup(svc appServices, parent commandParent) {
 }
 
 func (c *commandServerCancel) runServerCancelUpload(ctx context.Context, cli *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return cli.Post(ctx, "sources/cancel", &serverapi.Empty{}, &serverapi.Empty{})
 }
diff --git a/cli/command_server_flush.go b/cli/command_server_flush.go
index a56ab65b..ea93b9d3 100644
--- a/cli/command_server_flush.go
+++ b/cli/command_server_flush.go
@@ -18,5 +18,6 @@ func (c *commandServerFlush) setup(svc appServices, parent commandParent) {
 }
 
 func (c *commandServerFlush) run(ctx context.Context, cli *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return cli.Post(ctx, "flush", &serverapi.Empty{}, &serverapi.Empty{})
 }
diff --git a/cli/command_server_pause.go b/cli/command_server_pause.go
index 0c640346..7f11a5c9 100644
--- a/cli/command_server_pause.go
+++ b/cli/command_server_pause.go
@@ -18,5 +18,6 @@ func (c *commandServerPause) setup(svc appServices, parent commandParent) {
 }
 
 func runServerPause(ctx context.Context, cli *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return cli.Post(ctx, "sources/pause", &serverapi.Empty{}, &serverapi.Empty{})
 }
diff --git a/cli/command_server_refresh.go b/cli/command_server_refresh.go
index ec6c00ae..cd621da0 100644
--- a/cli/command_server_refresh.go
+++ b/cli/command_server_refresh.go
@@ -18,5 +18,6 @@ func (c *commandServerRefresh) setup(svc appServices, parent commandParent) {
 }
 
 func (c *commandServerRefresh) run(ctx context.Context, cli *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return cli.Post(ctx, "refresh", &serverapi.Empty{}, &serverapi.Empty{})
 }
diff --git a/cli/command_server_resume.go b/cli/command_server_resume.go
index f8a55c80..f2465a75 100644
--- a/cli/command_server_resume.go
+++ b/cli/command_server_resume.go
@@ -18,5 +18,6 @@ func (c *commandServerResume) setup(svc appServices, parent commandParent) {
 }
 
 func (c *commandServerResume) run(ctx context.Context, cli *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return cli.Post(ctx, "sources/resume", &serverapi.Empty{}, &serverapi.Empty{})
 }
diff --git a/cli/command_server_start.go b/cli/command_server_start.go
index 09d08bb2..d241d69e 100644
--- a/cli/command_server_start.go
+++ b/cli/command_server_start.go
@@ -186,7 +186,7 @@ func (c *commandServerStart) run(ctx context.Context, rep repo.Repository) error
 		return err
 	}
 
-	return srv.SetRepository(ctx, nil)
+	return errors.Wrap(srv.SetRepository(ctx, nil), "error setting active repository")
 }
 
 func initPrometheus(mux *http.ServeMux) error {
diff --git a/cli/command_server_tls.go b/cli/command_server_tls.go
index a828053c..4b065b80 100644
--- a/cli/command_server_tls.go
+++ b/cli/command_server_tls.go
@@ -24,11 +24,13 @@
 const oneDay = 24 * time.Hour
 
 func (c *commandServerStart) generateServerCertificate(ctx context.Context) (*x509.Certificate, *rsa.PrivateKey, error) {
-	return tlsutil.GenerateServerCertificate(
+	cert, key, err := tlsutil.GenerateServerCertificate(
 		ctx,
 		c.serverStartTLSGenerateRSAKeySize,
 		time.Duration(c.serverStartTLSGenerateCertValidDays)*oneDay,
 		c.serverStartTLSGenerateCertNames)
+
+	return cert, key, errors.Wrap(err, "error generating server certificate")
 }
 
 func (c *commandServerStart) startServerWithOptionalTLS(ctx context.Context, httpServer *http.Server) error {
@@ -90,7 +92,7 @@ func (c *commandServerStart) startServerWithOptionalTLSAndListener(ctx context.C
 		fmt.Fprintf(c.out.stderr(), "SERVER ADDRESS: https://%v\n", httpServer.Addr)
 		c.showServerUIPrompt(ctx)
 
-		return httpServer.ServeTLS(listener, c.serverStartTLSCertFile, c.serverStartTLSKeyFile)
+		return errors.Wrap(httpServer.ServeTLS(listener, c.serverStartTLSCertFile, c.serverStartTLSKeyFile), "error starting TLS server")
 
 	case c.serverStartTLSGenerateCert:
 		// PEM files not provided, generate in-memory TLS cert/key but don't persit.
@@ -126,7 +128,7 @@ func (c *commandServerStart) startServerWithOptionalTLSAndListener(ctx context.C
 		fmt.Fprintf(c.out.stderr(), "SERVER ADDRESS: https://%v\n", httpServer.Addr)
 		c.showServerUIPrompt(ctx)
 
-		return httpServer.ServeTLS(listener, "", "")
+		return errors.Wrap(httpServer.ServeTLS(listener, "", ""), "error starting TLS server")
 
 	default:
 		if !c.serverStartInsecure {
@@ -136,7 +138,7 @@ func (c *commandServerStart) startServerWithOptionalTLSAndListener(ctx context.C
 		fmt.Fprintf(c.out.stderr(), "SERVER ADDRESS: http://%v\n", httpServer.Addr)
 		c.showServerUIPrompt(ctx)
 
-		return httpServer.Serve(listener)
+		return errors.Wrap(httpServer.Serve(listener), "error starting server")
 	}
 }
 
diff --git a/cli/command_snapshot_create.go b/cli/command_snapshot_create.go
index 6c76a63d..cde92040 100644
--- a/cli/command_snapshot_create.go
+++ b/cli/command_snapshot_create.go
@@ -212,6 +212,7 @@ func parseTimestamp(timestamp string) (time.Time, error) {
 		return time.Time{}, nil
 	}
 
+	// nolint:wrapcheck
 	return time.Parse(timeFormat, timestamp)
 }
 
diff --git a/cli/command_snapshot_delete.go b/cli/command_snapshot_delete.go
index d485db5b..56b8ff12 100644
--- a/cli/command_snapshot_delete.go
+++ b/cli/command_snapshot_delete.go
@@ -54,7 +54,7 @@ func (c *commandSnapshotDelete) deleteSnapshot(ctx context.Context, rep repo.Rep
 
 	log(ctx).Infof("Deleting %v...", desc)
 
-	return rep.DeleteManifest(ctx, m.ID)
+	return errors.Wrap(rep.DeleteManifest(ctx, m.ID), "error deleting manifest")
 }
 
 func (c *commandSnapshotDelete) deleteSnapshotsByRootObjectID(ctx context.Context, rep repo.RepositoryWriter, rootID object.ID) error {
diff --git a/cli/command_snapshot_expire.go b/cli/command_snapshot_expire.go
index 63fe4dfc..46cceb27 100644
--- a/cli/command_snapshot_expire.go
+++ b/cli/command_snapshot_expire.go
@@ -28,6 +28,7 @@ func (c *commandSnapshotExpire) setup(svc appServices, parent commandParent) {
 
 func (c *commandSnapshotExpire) getSnapshotSourcesToExpire(ctx context.Context, rep repo.Repository) ([]snapshot.SourceInfo, error) {
 	if c.snapshotExpireAll {
+		// nolint:wrapcheck
 		return snapshot.ListSources(ctx, rep)
 	}
 
diff --git a/cli/command_snapshot_migrate.go b/cli/command_snapshot_migrate.go
index e72cee99..01d1dcb6 100644
--- a/cli/command_snapshot_migrate.go
+++ b/cli/command_snapshot_migrate.go
@@ -195,7 +195,7 @@ func (c *commandSnapshotMigrate) migrateSinglePolicy(ctx context.Context, source
 
 	log(ctx).Infof("migrating policy for %v", si)
 
-	return policy.SetPolicy(ctx, destRepo, si, pol)
+	return errors.Wrap(policy.SetPolicy(ctx, destRepo, si, pol), "error setting policy")
 }
 
 func (c *commandSnapshotMigrate) findPreviousSnapshotManifestWithStartTime(ctx context.Context, rep repo.Repository, sourceInfo snapshot.SourceInfo, startTime time.Time) (*snapshot.Manifest, error) {
@@ -314,6 +314,7 @@ func (c *commandSnapshotMigrate) getSourcesToMigrate(ctx context.Context, rep re
 	}
 
 	if c.migrateAll {
+		// nolint:wrapcheck
 		return snapshot.ListSources(ctx, rep)
 	}
 
diff --git a/cli/command_snapshot_verify.go b/cli/command_snapshot_verify.go
index 598d0efb..6f9f1c64 100644
--- a/cli/command_snapshot_verify.go
+++ b/cli/command_snapshot_verify.go
@@ -303,5 +303,6 @@ func (c *commandSnapshotVerify) loadSourceManifests(ctx context.Context, rep rep
 		}
 	}
 
+	// nolint:wrapcheck
 	return snapshot.LoadSnapshots(ctx, rep, manifestIDs)
 }
diff --git a/cli/config.go b/cli/config.go
index 81a758b8..7ea61519 100644
--- a/cli/config.go
+++ b/cli/config.go
@@ -87,6 +87,7 @@ func resolveSymlink(path string) (string, error) {
 		return path, nil
 	}
 
+	// nolint:wrapcheck
 	return filepath.EvalSymlinks(path)
 }
 
diff --git a/cli/storage_azure.go b/cli/storage_azure.go
index f8b1078c..04eca12e 100644
--- a/cli/storage_azure.go
+++ b/cli/storage_azure.go
@@ -23,5 +23,6 @@ func (c *storageAzureFlags) setup(_ storageProviderServices, cmd *kingpin.CmdCla
 }
 
 func (c *storageAzureFlags) connect(ctx context.Context, isNew bool) (blob.Storage, error) {
+	// nolint:wrapcheck
 	return azure.New(ctx, &c.azOptions)
 }
diff --git a/cli/storage_b2.go b/cli/storage_b2.go
index 47aae1ea..3110abf0 100644
--- a/cli/storage_b2.go
+++ b/cli/storage_b2.go
@@ -23,5 +23,6 @@ func (c *storageB2Flags) setup(_ storageProviderServices, cmd *kingpin.CmdClause
 }
 
 func (c *storageB2Flags) connect(ctx context.Context, isNew bool) (blob.Storage, error) {
+	// nolint:wrapcheck
 	return b2.New(ctx, &c.b2options)
 }
diff --git a/cli/storage_filesystem.go b/cli/storage_filesystem.go
index 7c23953a..97071130 100644
--- a/cli/storage_filesystem.go
+++ b/cli/storage_filesystem.go
@@ -70,6 +70,7 @@ func (c *storageFilesystemFlags) connect(ctx context.Context, isNew bool) (blob.
 		}
 	}
 
+	// nolint:wrapcheck
 	return filesystem.New(ctx, &fso)
 }
 
diff --git a/cli/storage_gcs.go b/cli/storage_gcs.go
index 54c3352a..387b8893 100644
--- a/cli/storage_gcs.go
+++ b/cli/storage_gcs.go
@@ -39,5 +39,6 @@ func (c *storageGCSFlags) connect(ctx context.Context, isNew bool) (blob.Storage
 		c.options.ServiceAccountCredentialsFile = ""
 	}
 
+	// nolint:wrapcheck
 	return gcs.New(ctx, &c.options)
 }
diff --git a/cli/storage_rclone.go b/cli/storage_rclone.go
index de0ac2f1..050968f5 100644
--- a/cli/storage_rclone.go
+++ b/cli/storage_rclone.go
@@ -40,5 +40,6 @@ func (c *storageRcloneFlags) connect(ctx context.Context, isNew bool) (blob.Stor
 		c.opt.EmbeddedConfig = string(cfg)
 	}
 
+	// nolint:wrapcheck
 	return rclone.New(ctx, &c.opt)
 }
diff --git a/cli/storage_s3.go b/cli/storage_s3.go
index 87f9114a..e81fc269 100644
--- a/cli/storage_s3.go
+++ b/cli/storage_s3.go
@@ -28,5 +28,6 @@ func (c *storageS3Flags) setup(_ storageProviderServices, cmd *kingpin.CmdClause
 }
 
 func (c *storageS3Flags) connect(ctx context.Context, isNew bool) (blob.Storage, error) {
+	// nolint:wrapcheck
 	return s3.New(ctx, &c.s3options)
 }
diff --git a/cli/storage_sftp.go b/cli/storage_sftp.go
index 22dca8d7..ffd46b7e 100644
--- a/cli/storage_sftp.go
+++ b/cli/storage_sftp.go
@@ -71,5 +71,6 @@ func (c *storageSFTPFlags) connect(ctx context.Context, isNew bool) (blob.Storag
 		sftpo.DirectoryShards = []int{}
 	}
 
+	// nolint:wrapcheck
 	return sftp.New(ctx, &sftpo)
 }
diff --git a/cli/storage_webdav.go b/cli/storage_webdav.go
index fb53aa41..621ff1ea 100644
--- a/cli/storage_webdav.go
+++ b/cli/storage_webdav.go
@@ -38,5 +38,6 @@ func (c *storageWebDAVFlags) connect(ctx context.Context, isNew bool) (blob.Stor
 		wo.DirectoryShards = []int{}
 	}
 
+	// nolint:wrapcheck
 	return webdav.New(ctx, &wo)
 }
diff --git a/cli/update_check.go b/cli/update_check.go
index 742ff6d4..ddb1ce72 100644
--- a/cli/update_check.go
+++ b/cli/update_check.go
@@ -61,7 +61,7 @@ func (c *App) writeUpdateState(us *updateState) error {
 		return errors.Wrap(err, "unable to marshal JSON")
 	}
 
-	return atomicfile.Write(c.updateStateFilename(), &buf)
+	return errors.Wrap(atomicfile.Write(c.updateStateFilename(), &buf), "error writing update state")
 }
 
 func (c *App) removeUpdateState() {
diff --git a/fs/cachefs/cache.go b/fs/cachefs/cache.go
index d4e1e7a0..481e7454 100644
--- a/fs/cachefs/cache.go
+++ b/fs/cachefs/cache.go
@@ -89,6 +89,7 @@ func (c *Cache) Readdir(ctx context.Context, d fs.Directory) (fs.Entries, error)
 		return c.getEntries(ctx, cacheID, dirCacheExpiration, d.Readdir)
 	}
 
+	// nolint:wrapcheck
 	return d.Readdir(ctx)
 }
 
diff --git a/fs/entry.go b/fs/entry.go
index 6cdacd49..0e9eeecb 100644
--- a/fs/entry.go
+++ b/fs/entry.go
@@ -88,7 +88,6 @@ func ReadDirAndFindChild(ctx context.Context, d Directory, name string) (Entry,
 
 	e := children.FindByName(name)
 	if e == nil {
-		// nolint:wrapcheck
 		return nil, ErrEntryNotFound
 	}
 
diff --git a/fs/localfs/local_fs.go b/fs/localfs/local_fs.go
index 32cc55db..448ae9c1 100644
--- a/fs/localfs/local_fs.go
+++ b/fs/localfs/local_fs.go
@@ -242,6 +242,7 @@ func (fsf *filesystemFile) Open(ctx context.Context) (fs.Reader, error) {
 }
 
 func (fsl *filesystemSymlink) Readlink(ctx context.Context) (string, error) {
+	// nolint:wrapcheck
 	return os.Readlink(fsl.fullPath())
 }
 
diff --git a/fs/virtualfs/virtualfs.go b/fs/virtualfs/virtualfs.go
index b15cfb67..e95ed3cd 100644
--- a/fs/virtualfs/virtualfs.go
+++ b/fs/virtualfs/virtualfs.go
@@ -69,6 +69,7 @@ type staticDirectory struct {
 
 // Child gets the named child of a directory.
 func (sd *staticDirectory) Child(ctx context.Context, name string) (fs.Entry, error) {
+	// nolint:wrapcheck
 	return fs.ReadDirAndFindChild(ctx, sd, name)
 }
 
diff --git a/internal/acl/access_level.go b/internal/acl/access_level.go
index 971eced4..47c39c21 100644
--- a/internal/acl/access_level.go
+++ b/internal/acl/access_level.go
@@ -43,6 +43,7 @@ func (a AccessLevel) MarshalJSON() ([]byte, error) {
 		return nil, errors.Errorf("Invalid access level: %v", a)
 	}
 
+	// nolint:wrapcheck
 	return json.Marshal(j)
 }
 
diff --git a/internal/apiclient/apiclient.go b/internal/apiclient/apiclient.go
index 614e5245..d42a0a0e 100644
--- a/internal/apiclient/apiclient.go
+++ b/internal/apiclient/apiclient.go
@@ -183,6 +183,7 @@ type basicAuthTransport struct {
 func (t basicAuthTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req.SetBasicAuth(t.username, t.password)
 
+	// nolint:wrapcheck
 	return t.base.RoundTrip(req)
 }
 
diff --git a/internal/atomicfile/atomicfile.go b/internal/atomicfile/atomicfile.go
index 3af39afb..4469b291 100644
--- a/internal/atomicfile/atomicfile.go
+++ b/internal/atomicfile/atomicfile.go
@@ -50,5 +50,6 @@ func MaybePrefixLongFilenameOnWindows(fname string) string {
 
 // Write is a wrapper around atomic.WriteFile that handles long file names on Windows.
 func Write(filename string, r io.Reader) error {
+	// nolint:wrapcheck
 	return atomic.WriteFile(MaybePrefixLongFilenameOnWindows(filename), r)
 }
diff --git a/internal/auth/authn.go b/internal/auth/authn.go
index 90a9dd01..e0ea0025 100644
--- a/internal/auth/authn.go
+++ b/internal/auth/authn.go
@@ -80,7 +80,7 @@ func (a htpasswdAuthenticator) IsValid(ctx context.Context, rep repo.Repository,
 }
 
 func (a htpasswdAuthenticator) Refresh(ctx context.Context) error {
-	return a.f.Reload(nil)
+	return errors.Wrap(a.f.Reload(nil), "error reloading password file")
 }
 
 // AuthenticateHtpasswdFile returns an authenticator that accepts users in the provided htpasswd file.
diff --git a/internal/cache/persistent_lru_cache.go b/internal/cache/persistent_lru_cache.go
index 1d7bf422..4be7e492 100644
--- a/internal/cache/persistent_lru_cache.go
+++ b/internal/cache/persistent_lru_cache.go
@@ -197,7 +197,7 @@ func (c *PersistentCache) sweepDirectory(ctx context.Context) (err error) {
 		totalRetainedSize += it.Length
 
 		if totalRetainedSize > c.maxSizeBytes {
-			oldest := heap.Pop(&h).(blob.Metadata)
+			oldest := heap.Pop(&h).(blob.Metadata) //nolint:forcetypeassert
 			if delerr := c.cacheStorage.DeleteBlob(ctx, oldest.BlobID); delerr != nil {
 				log(ctx).Errorf("unable to remove %v: %v", oldest.BlobID, delerr)
 			} else {
@@ -237,7 +237,6 @@ func NewPersistentCache(ctx context.Context, description string, cacheStorage St
 
 	// verify that cache storage is functional by listing from it
 	if err := c.cacheStorage.ListBlobs(ctx, "", func(it blob.Metadata) error {
-		// nolint:wrapcheck
 		return errGood
 	}); err != nil && !errors.Is(err, errGood) {
 		return nil, errors.Wrapf(err, "unable to open %v", c.description)
diff --git a/internal/cache/storage_protection.go b/internal/cache/storage_protection.go
index bd6fd32b..41da8bf2 100644
--- a/internal/cache/storage_protection.go
+++ b/internal/cache/storage_protection.go
@@ -47,6 +47,7 @@ func (p checksumProtection) Protect(id string, b []byte) []byte {
 }
 
 func (p checksumProtection) Verify(id string, b []byte) ([]byte, error) {
+	// nolint:wrapcheck
 	return hmac.VerifyAndStrip(b, p.Secret)
 }
 
@@ -82,7 +83,12 @@ func (authenticatedEncryptionProtection) SupportsPartial() bool {
 }
 
 func (p authenticatedEncryptionProtection) Verify(id string, b []byte) ([]byte, error) {
-	return p.e.Decrypt(nil, b, p.deriveIV(id))
+	v, err := p.e.Decrypt(nil, b, p.deriveIV(id))
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to decrypt cache content")
+	}
+
+	return v, nil
 }
 
 type authenticatedEncryptionProtectionKey []byte
diff --git a/internal/diff/diff.go b/internal/diff/diff.go
index b20f5819..c5dd020e 100644
--- a/internal/diff/diff.go
+++ b/internal/diff/diff.go
@@ -36,6 +36,7 @@ func (c *Comparer) Compare(ctx context.Context, e1, e2 fs.Entry) error {
 
 // Close removes all temporary files used by the comparer.
 func (c *Comparer) Close() error {
+	// nolint:wrapcheck
 	return os.RemoveAll(c.tmpDir)
 }
 
diff --git a/internal/hmac/hmac.go b/internal/hmac/hmac.go
index 2bdfe0b5..9157723c 100644
--- a/internal/hmac/hmac.go
+++ b/internal/hmac/hmac.go
@@ -11,7 +11,7 @@
 // Append computes HMAC-SHA256 checksum for a given block of bytes and appends it.
 func Append(data, secret []byte) []byte {
 	h := hmac.New(sha256.New, secret)
-	h.Write(data) // nolint:errcheck
+	h.Write(data)
 
 	return h.Sum(data)
 }
@@ -27,7 +27,7 @@ func VerifyAndStrip(b, secret []byte) ([]byte, error) {
 	signature := b[p:]
 
 	h := hmac.New(sha256.New, secret)
-	h.Write(data) // nolint:errcheck
+	h.Write(data)
 
 	var sigBuf [32]byte
 	validSignature := h.Sum(sigBuf[:0])
diff --git a/internal/iocopy/copy.go b/internal/iocopy/copy.go
index b676e582..9c21001d 100644
--- a/internal/iocopy/copy.go
+++ b/internal/iocopy/copy.go
@@ -18,9 +18,11 @@
 
 // Copy is equivalent to io.Copy().
 func Copy(dst io.Writer, src io.Reader) (int64, error) {
+	// nolint:forcetypeassert
 	bufPtr := bufferPool.Get().(*[]byte)
 
 	defer bufferPool.Put(bufPtr)
 
+	// nolint:wrapcheck
 	return io.CopyBuffer(dst, src, *bufPtr)
 }
diff --git a/internal/logfile/logfile.go b/internal/logfile/logfile.go
index d6b212c7..b39f84f0 100644
--- a/internal/logfile/logfile.go
+++ b/internal/logfile/logfile.go
@@ -315,5 +315,6 @@ func (w *onDemandBackend) Log(level logging.Level, depth int, rec *logging.Recor
 		return errors.New("no backend")
 	}
 
+	// nolint:wrapcheck
 	return w.backend.Log(level, depth+1, rec)
 }
diff --git a/internal/mockfs/mockfs.go b/internal/mockfs/mockfs.go
index 6b33200d..ed3a5db7 100644
--- a/internal/mockfs/mockfs.go
+++ b/internal/mockfs/mockfs.go
@@ -208,6 +208,7 @@ func (imd *Directory) Subdir(name ...string) *Directory {
 			panic(fmt.Sprintf("'%s' is not a directory in '%s'", n, i.Name()))
 		}
 
+		// nolint:forcetypeassert
 		i = i2.(*Directory)
 	}
 
@@ -239,6 +240,7 @@ func (imd *Directory) OnReaddir(cb func()) {
 
 // Child gets the named child of a directory.
 func (imd *Directory) Child(ctx context.Context, name string) (fs.Entry, error) {
+	// nolint:wrapcheck
 	return fs.ReadDirAndFindChild(ctx, imd, name)
 }
 
diff --git a/internal/mount/mount_net_use.go b/internal/mount/mount_net_use.go
index 11f59fc6..34fcc8ca 100644
--- a/internal/mount/mount_net_use.go
+++ b/internal/mount/mount_net_use.go
@@ -106,6 +106,7 @@ func (c netuseController) Unmount(ctx context.Context) error {
 		return errors.Wrap(err, "unable to delete drive with 'net use'")
 	}
 
+	// nolint:wrapcheck
 	return c.inner.Unmount(ctx)
 }
 
diff --git a/internal/mount/mount_webdav.go b/internal/mount/mount_webdav.go
index c0099e50..308f8a2d 100644
--- a/internal/mount/mount_webdav.go
+++ b/internal/mount/mount_webdav.go
@@ -74,7 +74,7 @@ type webdavController struct {
 }
 
 func (c webdavController) Unmount(ctx context.Context) error {
-	return c.s.Shutdown(ctx)
+	return errors.Wrap(c.s.Shutdown(ctx), "error shutting down webdav server")
 }
 
 func (c webdavController) MountPath() string {
diff --git a/internal/parallelwork/parallel_work_queue.go b/internal/parallelwork/parallel_work_queue.go
index b37c8481..443a0a12 100644
--- a/internal/parallelwork/parallel_work_queue.go
+++ b/internal/parallelwork/parallel_work_queue.go
@@ -67,6 +67,7 @@ func (v *Queue) Process(ctx context.Context, workers int) error {
 				select {
 				case <-ctx.Done():
 					// context canceled - some other worker returned an error.
+					// nolint:wrapcheck
 					return ctx.Err()
 
 				default:
@@ -86,6 +87,7 @@ func (v *Queue) Process(ctx context.Context, workers int) error {
 		})
 	}
 
+	// nolint:wrapcheck
 	return eg.Wait()
 }
 
diff --git a/internal/passwordpersist/passwordpersist_file.go b/internal/passwordpersist/passwordpersist_file.go
index 3d20dd01..a9a2a98f 100644
--- a/internal/passwordpersist/passwordpersist_file.go
+++ b/internal/passwordpersist/passwordpersist_file.go
@@ -38,6 +38,7 @@ func (filePasswordStorage) PersistPassword(ctx context.Context, configFile, pass
 	fn := passwordFileName(configFile)
 	log(ctx).Debugf("Saving password to file %v.", fn)
 
+	// nolint:wrapcheck
 	return ioutil.WriteFile(fn, []byte(base64.StdEncoding.EncodeToString([]byte(password))), 0o600)
 }
 
diff --git a/internal/server/api_estimate.go b/internal/server/api_estimate.go
index 6f8497ab..6a248b88 100644
--- a/internal/server/api_estimate.go
+++ b/internal/server/api_estimate.go
@@ -93,6 +93,7 @@ func (s *Server) handleEstimate(ctx context.Context, r *http.Request, body []byt
 			return errors.Wrap(err, "unable to get policy tree")
 		}
 
+		// nolint:wrapcheck
 		return snapshotfs.Estimate(estimatectx, rep, dir, policyTree, estimateTaskProgress{ctrl})
 	})
 
diff --git a/internal/server/api_mount.go b/internal/server/api_mount.go
index 876ecd95..093c2810 100644
--- a/internal/server/api_mount.go
+++ b/internal/server/api_mount.go
@@ -38,11 +38,11 @@ func (s *Server) handleMountCreate(ctx context.Context, r *http.Request, body []
 		}
 
 		if actual, loaded := s.mounts.LoadOrStore(oid, c); loaded {
-			c.Unmount(ctx) // nolint:errcheck
-			c = actual.(mount.Controller)
+			c.Unmount(ctx)                // nolint:errcheck
+			c = actual.(mount.Controller) // nolint:forcetypeassert
 		}
 	} else {
-		c = v.(mount.Controller)
+		c = v.(mount.Controller) // nolint:forcetypeassert
 	}
 
 	log(ctx).Debugf("mount for %v => %v", oid, c.MountPath())
@@ -61,7 +61,7 @@ func (s *Server) handleMountGet(ctx context.Context, r *http.Request, body []byt
 		return nil, notFoundError("mount point not found")
 	}
 
-	c := v.(mount.Controller)
+	c := v.(mount.Controller) // nolint:forcetypeassert
 
 	return &serverapi.MountedSnapshot{
 		Path: c.MountPath(),
@@ -77,7 +77,7 @@ func (s *Server) handleMountDelete(ctx context.Context, r *http.Request, body []
 		return nil, notFoundError("mount point not found")
 	}
 
-	c := v.(mount.Controller)
+	c := v.(mount.Controller) // nolint:forcetypeassert
 
 	if err := c.Unmount(ctx); err != nil {
 		return nil, internalServerError(err)
@@ -94,8 +94,8 @@ func (s *Server) handleMountList(ctx context.Context, r *http.Request, body []by
 	}
 
 	s.mounts.Range(func(key, val interface{}) bool {
-		oid := key.(object.ID)
-		c := val.(mount.Controller)
+		oid := key.(object.ID)      // nolint:forcetypeassert
+		c := val.(mount.Controller) // nolint:forcetypeassert
 
 		res.Items = append(res.Items, &serverapi.MountedSnapshot{
 			Path: c.MountPath(),
@@ -109,7 +109,7 @@ func (s *Server) handleMountList(ctx context.Context, r *http.Request, body []by
 
 func (s *Server) unmountAll(ctx context.Context) {
 	s.mounts.Range(func(key, val interface{}) bool {
-		c := val.(mount.Controller)
+		c := val.(mount.Controller) // nolint:forcetypeassert
 
 		log(ctx).Debugf("unmounting %v from %v", key, c.MountPath())
 
diff --git a/internal/server/api_sources.go b/internal/server/api_sources.go
index 80be5c91..7766c853 100644
--- a/internal/server/api_sources.go
+++ b/internal/server/api_sources.go
@@ -90,6 +90,7 @@ func (s *Server) handleSourcesCreate(ctx context.Context, r *http.Request, body
 		if err = repo.WriteSession(ctx, s.rep, repo.WriteSessionOptions{
 			Purpose: "handleSourcesCreate",
 		}, func(w repo.RepositoryWriter) error {
+			// nolint:wrapcheck
 			return policy.SetPolicy(ctx, w, sourceInfo, &req.InitialPolicy)
 		}); err != nil {
 			return nil, internalServerError(errors.Wrap(err, "unable to set initial policy"))
diff --git a/internal/server/grpc_session.go b/internal/server/grpc_session.go
index 91be04c2..1c40ad03 100644
--- a/internal/server/grpc_session.go
+++ b/internal/server/grpc_session.go
@@ -99,6 +99,7 @@ func (s *Server) Session(srv grpcapi.KopiaRepository_SessionServer) error {
 		return err
 	}
 
+	// nolint:wrapcheck
 	return repo.DirectWriteSession(ctx, dr, opt, func(dw repo.DirectRepositoryWriter) error {
 		// channel to which workers will be sending errors, only holds 1 slot and sends are non-blocking.
 		lastErr := make(chan error, 1)
diff --git a/internal/server/server.go b/internal/server/server.go
index 8293a9a5..aa651feb 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -194,6 +194,7 @@ func (s *Server) isAuthCookieValid(username, cookieValue string) bool {
 }
 
 func (s *Server) generateShortTermAuthCookie(username string, now time.Time) (string, error) {
+	// nolint:wrapcheck
 	return jwt.NewWithClaims(jwt.SigningMethodHS256, &jwt.StandardClaims{
 		Subject:   username,
 		NotBefore: now.Add(-time.Minute).Unix(),
@@ -510,9 +511,11 @@ func periodicMaintenanceOnce(ctx context.Context, rep repo.Repository) error {
 		return errors.Errorf("not a direct repository")
 	}
 
+	// nolint:wrapcheck
 	return repo.DirectWriteSession(ctx, dr, repo.WriteSessionOptions{
 		Purpose: "periodicMaintenanceOnce",
 	}, func(w repo.DirectRepositoryWriter) error {
+		// nolint:wrapcheck
 		return snapshotmaintenance.Run(ctx, w, maintenance.ModeAuto, false, maintenance.SafetyFull)
 	})
 }
diff --git a/internal/server/source_manager.go b/internal/server/source_manager.go
index f1c32a4a..04e6b78e 100644
--- a/internal/server/source_manager.go
+++ b/internal/server/source_manager.go
@@ -229,6 +229,7 @@ func (s *sourceManager) snapshot(ctx context.Context) error {
 	s.server.beginUpload(ctx, s.src)
 	defer s.server.endUpload(ctx, s.src)
 
+	// nolint:wrapcheck
 	return s.server.taskmgr.Run(ctx,
 		"Snapshot",
 		fmt.Sprintf("%v at %v", s.src, clock.Now().Format(time.RFC3339)),
@@ -258,6 +259,7 @@ func (s *sourceManager) snapshotInternal(ctx context.Context, ctrl uitask.Contro
 
 	onUpload := func(int64) {}
 
+	// nolint:wrapcheck
 	return repo.WriteSession(ctx, s.server.rep, repo.WriteSessionOptions{
 		Purpose: "Source Manager Uploader",
 		OnUpload: func(numBytes int64) {
diff --git a/internal/serverapi/client_wrappers.go b/internal/serverapi/client_wrappers.go
index f8d5d372..cb8a81e0 100644
--- a/internal/serverapi/client_wrappers.go
+++ b/internal/serverapi/client_wrappers.go
@@ -43,21 +43,25 @@ func CancelUpload(ctx context.Context, c *apiclient.KopiaAPIClient, match *snaps
 
 // CreateRepository invokes the 'repo/create' API.
 func CreateRepository(ctx context.Context, c *apiclient.KopiaAPIClient, req *CreateRepositoryRequest) error {
+	// nolint:wrapcheck
 	return c.Post(ctx, "repo/create", req, &StatusResponse{})
 }
 
 // ConnectToRepository invokes the 'repo/connect' API.
 func ConnectToRepository(ctx context.Context, c *apiclient.KopiaAPIClient, req *ConnectRepositoryRequest) error {
+	// nolint:wrapcheck
 	return c.Post(ctx, "repo/connect", req, &StatusResponse{})
 }
 
 // DisconnectFromRepository invokes the 'repo/disconnect' API.
 func DisconnectFromRepository(ctx context.Context, c *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return c.Post(ctx, "repo/disconnect", &Empty{}, &Empty{})
 }
 
 // Shutdown invokes the 'repo/shutdown' API.
 func Shutdown(ctx context.Context, c *apiclient.KopiaAPIClient) error {
+	// nolint:wrapcheck
 	return c.Post(ctx, "shutdown", &Empty{}, &Empty{})
 }
 
diff --git a/internal/webdavmount/webdavmount.go b/internal/webdavmount/webdavmount.go
index 3a2d76c0..c3730d35 100644
--- a/internal/webdavmount/webdavmount.go
+++ b/internal/webdavmount/webdavmount.go
@@ -60,6 +60,7 @@ func (f *webdavFile) Read(b []byte) (int, error) {
 		return 0, err
 	}
 
+	// nolint:wrapcheck
 	return r.Read(b)
 }
 
@@ -69,6 +70,7 @@ func (f *webdavFile) Seek(offset int64, whence int) (int64, error) {
 		return 0, err
 	}
 
+	// nolint:wrapcheck
 	return r.Seek(offset, whence)
 }
 
@@ -83,6 +85,7 @@ func (f *webdavFile) Close() error {
 	f.mu.Unlock()
 
 	if r != nil {
+		// nolint:wrapcheck
 		return r.Close()
 	}
 
diff --git a/repo/api_server_repository.go b/repo/api_server_repository.go
index 93a2590a..db90a460 100644
--- a/repo/api_server_repository.go
+++ b/repo/api_server_repository.go
@@ -58,6 +58,7 @@ func (r *apiServerRepository) ClientOptions() ClientOptions {
 }
 
 func (r *apiServerRepository) OpenObject(ctx context.Context, id object.ID) (object.Reader, error) {
+	// nolint:wrapcheck
 	return object.Open(ctx, r, id)
 }
 
@@ -66,6 +67,7 @@ func (r *apiServerRepository) NewObjectWriter(ctx context.Context, opt object.Wr
 }
 
 func (r *apiServerRepository) VerifyObject(ctx context.Context, id object.ID) ([]content.ID, error) {
+	// nolint:wrapcheck
 	return object.VerifyObject(ctx, r, id)
 }
 
@@ -76,6 +78,7 @@ func (r *apiServerRepository) GetManifest(ctx context.Context, id manifest.ID, d
 		return nil, errors.Wrap(err, "GetManifest")
 	}
 
+	// nolint:wrapcheck
 	return mm.Metadata, json.Unmarshal(mm.Payload, data)
 }
 
@@ -162,6 +165,7 @@ func (r *apiServerRepository) ContentInfo(ctx context.Context, contentID content
 }
 
 func (r *apiServerRepository) GetContent(ctx context.Context, contentID content.ID) ([]byte, error) {
+	// nolint:wrapcheck
 	return r.contentCache.GetOrLoad(ctx, string(contentID), func() ([]byte, error) {
 		var result []byte
 
diff --git a/repo/blob/azure/azure_storage.go b/repo/blob/azure/azure_storage.go
index 71569033..493dd8c8 100644
--- a/repo/blob/azure/azure_storage.go
+++ b/repo/blob/azure/azure_storage.go
@@ -55,6 +55,7 @@ func (az *azStorage) GetBlob(ctx context.Context, b blob.ID, offset, length int6
 			return nil, errors.Wrap(err, "AddReader")
 		}
 
+		// nolint:wrapcheck
 		return ioutil.ReadAll(throttled)
 	}
 
@@ -63,6 +64,7 @@ func (az *azStorage) GetBlob(ctx context.Context, b blob.ID, offset, length int6
 		return nil, translateError(err)
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthExactly(fetched, length)
 }
 
@@ -197,7 +199,7 @@ func (az *azStorage) DisplayName() string {
 }
 
 func (az *azStorage) Close(ctx context.Context) error {
-	return az.bucket.Close()
+	return errors.Wrap(az.bucket.Close(), "error closing bucket")
 }
 
 func toBandwidth(bytesPerSecond int) iothrottler.Bandwidth {
diff --git a/repo/blob/b2/b2_storage.go b/repo/blob/b2/b2_storage.go
index 1fca5abf..4f3b9957 100644
--- a/repo/blob/b2/b2_storage.go
+++ b/repo/blob/b2/b2_storage.go
@@ -74,6 +74,7 @@ func (s *b2Storage) GetBlob(ctx context.Context, id blob.ID, offset, length int6
 		return nil, translateError(err)
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthExactly(fetched, length)
 }
 
diff --git a/repo/blob/config.go b/repo/blob/config.go
index 10581886..a5a39dbf 100644
--- a/repo/blob/config.go
+++ b/repo/blob/config.go
@@ -40,6 +40,7 @@ func (c *ConnectionInfo) UnmarshalJSON(b []byte) error {
 
 // MarshalJSON returns JSON-encoded storage configuration.
 func (c ConnectionInfo) MarshalJSON() ([]byte, error) {
+	// nolint:wrapcheck
 	return json.Marshal(struct {
 		Type string      `json:"type"`
 		Data interface{} `json:"config"`
diff --git a/repo/blob/filesystem/filesystem_storage.go b/repo/blob/filesystem/filesystem_storage.go
index 9992ae31..5881107f 100644
--- a/repo/blob/filesystem/filesystem_storage.go
+++ b/repo/blob/filesystem/filesystem_storage.go
@@ -84,6 +84,7 @@ func (fs *fsImpl) GetBlobFromPath(ctx context.Context, dirPath, path string, off
 		defer f.Close() //nolint:errcheck,gosec
 
 		if length < 0 {
+			// nolint:wrapcheck
 			return ioutil.ReadAll(f)
 		}
 
@@ -104,7 +105,6 @@ func (fs *fsImpl) GetBlobFromPath(ctx context.Context, dirPath, path string, off
 					// this sometimes fails on macOS for unknown reasons, likely a bug in the filesystem
 					// retry deals with this transient state.
 					// see see https://github.com/kopia/kopia/issues/299
-					// nolint:wrapcheck
 					return nil, errRetriableInvalidLength
 				}
 			}
@@ -123,6 +123,7 @@ func (fs *fsImpl) GetBlobFromPath(ctx context.Context, dirPath, path string, off
 		return nil, err
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthExactly(val.([]byte), length)
 }
 
@@ -144,6 +145,7 @@ func (fs *fsImpl) GetMetadataFromPath(ctx context.Context, dirPath, path string)
 }
 
 func (fs *fsImpl) PutBlobInPath(ctx context.Context, dirPath, path string, data blob.Bytes) error {
+	// nolint:wrapcheck
 	return retry.WithExponentialBackoffNoValue(ctx, "PutBlobInPath:"+path, func() error {
 		randSuffix := make([]byte, 8)
 		if _, err := rand.Read(randSuffix); err != nil {
@@ -194,6 +196,7 @@ func (fs *fsImpl) createTempFileAndDir(tempFile string) (*os.File, error) {
 			return nil, errors.Wrap(err, "cannot create directory")
 		}
 
+		// nolint:wrapcheck
 		return os.OpenFile(tempFile, flags, fs.fileMode()) //nolint:gosec
 	}
 
@@ -202,6 +205,7 @@ func (fs *fsImpl) createTempFileAndDir(tempFile string) (*os.File, error) {
 }
 
 func (fs *fsImpl) DeleteBlobInPath(ctx context.Context, dirPath, path string) error {
+	// nolint:wrapcheck
 	return retry.WithExponentialBackoffNoValue(ctx, "DeleteBlobInPath:"+path, func() error {
 		err := os.Remove(path)
 		if err == nil || os.IsNotExist(err) {
@@ -231,6 +235,7 @@ func (fs *fsImpl) ReadDir(ctx context.Context, dirname string) ([]os.FileInfo, e
 func (fs *fsImpl) SetTimeInPath(ctx context.Context, dirPath, filePath string, n time.Time) error {
 	log(ctx).Debugf("updating timestamp on %v to %v", filePath, n)
 
+	// nolint:wrapcheck
 	return os.Chtimes(filePath, n, n)
 }
 
@@ -253,6 +258,7 @@ func (fs *fsStorage) TouchBlob(ctx context.Context, blobID blob.ID, threshold ti
 
 	log(ctx).Debugf("updating timestamp on %v to %v", path, n)
 
+	// nolint:wrapcheck
 	return os.Chtimes(path, n, n)
 }
 
diff --git a/repo/blob/gcs/gcs_storage.go b/repo/blob/gcs/gcs_storage.go
index 1fd3e789..6fe5b903 100644
--- a/repo/blob/gcs/gcs_storage.go
+++ b/repo/blob/gcs/gcs_storage.go
@@ -53,6 +53,7 @@ func (gcs *gcsStorage) GetBlob(ctx context.Context, b blob.ID, offset, length in
 		}
 		defer reader.Close() //nolint:errcheck
 
+		// nolint:wrapcheck
 		return ioutil.ReadAll(reader)
 	}
 
@@ -61,6 +62,7 @@ func (gcs *gcsStorage) GetBlob(ctx context.Context, b blob.ID, offset, length in
 		return nil, translateError(err)
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthExactly(fetched, length)
 }
 
@@ -174,7 +176,7 @@ func (gcs *gcsStorage) DisplayName() string {
 }
 
 func (gcs *gcsStorage) Close(ctx context.Context) error {
-	return gcs.storageClient.Close()
+	return errors.Wrap(gcs.storageClient.Close(), "error closing GCS storage")
 }
 
 func toBandwidth(bytesPerSecond int) iothrottler.Bandwidth {
diff --git a/repo/blob/readonly/readonly_storage.go b/repo/blob/readonly/readonly_storage.go
index e9fe073e..4902a215 100644
--- a/repo/blob/readonly/readonly_storage.go
+++ b/repo/blob/readonly/readonly_storage.go
@@ -19,33 +19,34 @@ type readonlyStorage struct {
 }
 
 func (s readonlyStorage) GetBlob(ctx context.Context, id blob.ID, offset, length int64) ([]byte, error) {
+	// nolint:wrapcheck
 	return s.base.GetBlob(ctx, id, offset, length)
 }
 
 func (s readonlyStorage) GetMetadata(ctx context.Context, id blob.ID) (blob.Metadata, error) {
+	// nolint:wrapcheck
 	return s.base.GetMetadata(ctx, id)
 }
 
 func (s readonlyStorage) SetTime(ctx context.Context, id blob.ID, t time.Time) error {
-	// nolint:wrapcheck
 	return ErrReadonly
 }
 
 func (s readonlyStorage) PutBlob(ctx context.Context, id blob.ID, data blob.Bytes) error {
-	// nolint:wrapcheck
 	return ErrReadonly
 }
 
 func (s readonlyStorage) DeleteBlob(ctx context.Context, id blob.ID) error {
-	// nolint:wrapcheck
 	return ErrReadonly
 }
 
 func (s readonlyStorage) ListBlobs(ctx context.Context, prefix blob.ID, callback func(blob.Metadata) error) error {
+	// nolint:wrapcheck
 	return s.base.ListBlobs(ctx, prefix, callback)
 }
 
 func (s readonlyStorage) Close(ctx context.Context) error {
+	// nolint:wrapcheck
 	return s.base.Close(ctx)
 }
 
diff --git a/repo/blob/retrying/retrying_storage.go b/repo/blob/retrying/retrying_storage.go
index d3d8dff0..69191561 100644
--- a/repo/blob/retrying/retrying_storage.go
+++ b/repo/blob/retrying/retrying_storage.go
@@ -18,6 +18,7 @@ type retryingStorage struct {
 
 func (s retryingStorage) GetBlob(ctx context.Context, id blob.ID, offset, length int64) ([]byte, error) {
 	v, err := retry.WithExponentialBackoff(ctx, fmt.Sprintf("GetBlob(%v,%v,%v)", id, offset, length), func() (interface{}, error) {
+		// nolint:wrapcheck
 		return s.Storage.GetBlob(ctx, id, offset, length)
 	}, isRetriable)
 	if err != nil {
@@ -29,6 +30,7 @@ func (s retryingStorage) GetBlob(ctx context.Context, id blob.ID, offset, length
 
 func (s retryingStorage) GetMetadata(ctx context.Context, id blob.ID) (blob.Metadata, error) {
 	v, err := retry.WithExponentialBackoff(ctx, "GetMetadata("+string(id)+")", func() (interface{}, error) {
+		// nolint:wrapcheck
 		return s.Storage.GetMetadata(ctx, id)
 	}, isRetriable)
 	if err != nil {
@@ -40,6 +42,7 @@ func (s retryingStorage) GetMetadata(ctx context.Context, id blob.ID) (blob.Meta
 
 func (s retryingStorage) SetTime(ctx context.Context, id blob.ID, t time.Time) error {
 	_, err := retry.WithExponentialBackoff(ctx, "GetMetadata("+string(id)+")", func() (interface{}, error) {
+		// nolint:wrapcheck
 		return true, s.Storage.SetTime(ctx, id, t)
 	}, isRetriable)
 
@@ -48,6 +51,7 @@ func (s retryingStorage) SetTime(ctx context.Context, id blob.ID, t time.Time) e
 
 func (s retryingStorage) PutBlob(ctx context.Context, id blob.ID, data blob.Bytes) error {
 	_, err := retry.WithExponentialBackoff(ctx, "PutBlob("+string(id)+")", func() (interface{}, error) {
+		// nolint:wrapcheck
 		return true, s.Storage.PutBlob(ctx, id, data)
 	}, isRetriable)
 
@@ -56,6 +60,7 @@ func (s retryingStorage) PutBlob(ctx context.Context, id blob.ID, data blob.Byte
 
 func (s retryingStorage) DeleteBlob(ctx context.Context, id blob.ID) error {
 	_, err := retry.WithExponentialBackoff(ctx, "DeleteBlob("+string(id)+")", func() (interface{}, error) {
+		// nolint:wrapcheck
 		return true, s.Storage.DeleteBlob(ctx, id)
 	}, isRetriable)
 
diff --git a/repo/blob/s3/s3_storage.go b/repo/blob/s3/s3_storage.go
index 71f69b3e..9207ebf2 100644
--- a/repo/blob/s3/s3_storage.go
+++ b/repo/blob/s3/s3_storage.go
@@ -75,6 +75,7 @@ func (s *s3Storage) GetBlob(ctx context.Context, b blob.ID, offset, length int64
 		return nil, translateError(err)
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthExactly(fetched, length)
 }
 
diff --git a/repo/blob/sftp/sftp_storage.go b/repo/blob/sftp/sftp_storage.go
index e67723fa..814081bf 100644
--- a/repo/blob/sftp/sftp_storage.go
+++ b/repo/blob/sftp/sftp_storage.go
@@ -62,6 +62,7 @@ func (s *sftpImpl) GetBlobFromPath(ctx context.Context, dirPath, fullPath string
 
 	if length < 0 {
 		// read entire blob
+		// nolint:wrapcheck
 		return ioutil.ReadAll(r)
 	}
 
@@ -86,6 +87,7 @@ func (s *sftpImpl) GetBlobFromPath(ctx context.Context, dirPath, fullPath string
 		return nil, errors.Wrap(err, "read error")
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthExactly(b, length)
 }
 
@@ -139,6 +141,7 @@ func (s *sftpImpl) PutBlobInPath(ctx context.Context, dirPath, fullPath string,
 }
 
 func (s *sftpImpl) SetTimeInPath(ctx context.Context, dirPath, fullPath string, n time.Time) error {
+	// nolint:wrapcheck
 	return s.cli.Chtimes(fullPath, n, n)
 }
 
@@ -152,6 +155,7 @@ func (s *sftpImpl) createTempFileAndDir(tempFile string) (*sftp.File, error) {
 			return nil, errors.Wrap(err, "cannot create directory")
 		}
 
+		// nolint:wrapcheck
 		return s.cli.OpenFile(tempFile, flags)
 	}
 
@@ -180,6 +184,7 @@ func (s *sftpImpl) DeleteBlobInPath(ctx context.Context, dirPath, fullPath strin
 }
 
 func (s *sftpImpl) ReadDir(ctx context.Context, dirname string) ([]os.FileInfo, error) {
+	// nolint:wrapcheck
 	return s.cli.ReadDir(dirname)
 }
 
@@ -236,9 +241,11 @@ func getHostKeyCallback(opt *Options) (ssh.HostKeyCallback, error) {
 		// this file is no longer needed after `knownhosts.New` returns, so we can delete it.
 		defer os.Remove(tmpFile) // nolint:errcheck
 
+		// nolint:wrapcheck
 		return knownhosts.New(tmpFile)
 	}
 
+	// nolint:wrapcheck
 	return knownhosts.New(opt.knownHostsFile())
 }
 
diff --git a/repo/blob/sharded/sharded.go b/repo/blob/sharded/sharded.go
index 8e18edc1..46a0030a 100644
--- a/repo/blob/sharded/sharded.go
+++ b/repo/blob/sharded/sharded.go
@@ -37,6 +37,8 @@ type Storage struct {
 // GetBlob implements blob.Storage.
 func (s Storage) GetBlob(ctx context.Context, blobID blob.ID, offset, length int64) ([]byte, error) {
 	dirPath, filePath := s.GetShardedPathAndFilePath(blobID)
+
+	// nolint:wrapcheck
 	return s.Impl.GetBlobFromPath(ctx, dirPath, filePath, offset, length)
 }
 
@@ -112,6 +114,7 @@ func (s Storage) GetMetadata(ctx context.Context, blobID blob.ID) (blob.Metadata
 func (s Storage) PutBlob(ctx context.Context, blobID blob.ID, data blob.Bytes) error {
 	dirPath, filePath := s.GetShardedPathAndFilePath(blobID)
 
+	// nolint:wrapcheck
 	return s.Impl.PutBlobInPath(ctx, dirPath, filePath, data)
 }
 
@@ -119,12 +122,15 @@ func (s Storage) PutBlob(ctx context.Context, blobID blob.ID, data blob.Bytes) e
 func (s Storage) SetTime(ctx context.Context, blobID blob.ID, n time.Time) error {
 	dirPath, filePath := s.GetShardedPathAndFilePath(blobID)
 
+	// nolint:wrapcheck
 	return s.Impl.SetTimeInPath(ctx, dirPath, filePath, n)
 }
 
 // DeleteBlob implements blob.Storage.
 func (s Storage) DeleteBlob(ctx context.Context, blobID blob.ID) error {
 	dirPath, filePath := s.GetShardedPathAndFilePath(blobID)
+
+	// nolint:wrapcheck
 	return s.Impl.DeleteBlobInPath(ctx, dirPath, filePath)
 }
 
diff --git a/repo/blob/storage.go b/repo/blob/storage.go
index 7057dcc4..e8b5929d 100644
--- a/repo/blob/storage.go
+++ b/repo/blob/storage.go
@@ -109,6 +109,7 @@ func ListAllBlobs(ctx context.Context, st Storage, prefix ID) ([]Metadata, error
 // IterateAllPrefixesInParallel invokes the provided callback and returns the first error returned by the callback or nil.
 func IterateAllPrefixesInParallel(ctx context.Context, parallelism int, st Storage, prefixes []ID, callback func(Metadata) error) error {
 	if len(prefixes) == 1 {
+		// nolint:wrapcheck
 		return st.ListBlobs(ctx, prefixes[0], callback)
 	}
 
diff --git a/repo/blob/webdav/webdav_storage.go b/repo/blob/webdav/webdav_storage.go
index 8fa3fad8..88b6a578 100644
--- a/repo/blob/webdav/webdav_storage.go
+++ b/repo/blob/webdav/webdav_storage.go
@@ -56,6 +56,7 @@ func (d *davStorageImpl) GetBlobFromPath(ctx context.Context, dirPath, path stri
 		return nil, errors.Wrap(blob.ErrInvalidRange, "invalid offset")
 	}
 
+	// nolint:wrapcheck
 	return blob.EnsureLengthAndTruncate(data[offset:], length)
 }
 
@@ -118,12 +119,15 @@ func (d *davStorageImpl) PutBlobInPath(ctx context.Context, dirPath, filePath st
 
 	b := buf.Bytes()
 
+	// nolint:wrapcheck
 	return retry.WithExponentialBackoffNoValue(ctx, "WriteTemporaryFileAndCreateParentDirs", func() error {
 		mkdirAttempted := false
 
 		for {
+			// nolint:wrapcheck
 			err := d.translateError(d.cli.Write(tmpPath, b, defaultFilePerm))
 			if err == nil {
+				// nolint:wrapcheck
 				return d.cli.Rename(tmpPath, filePath, true)
 			}
 
@@ -152,6 +156,7 @@ func (d *davStorageImpl) SetTimeInPath(ctx context.Context, dirPath, filePath st
 
 func (d *davStorageImpl) DeleteBlobInPath(ctx context.Context, dirPath, filePath string) error {
 	return d.translateError(retry.WithExponentialBackoffNoValue(ctx, "DeleteBlobInPath", func() error {
+		// nolint:wrapcheck
 		return d.cli.Remove(filePath)
 	}, isRetriable))
 }
diff --git a/repo/caching.go b/repo/caching.go
index 5a27b91e..99e5369c 100644
--- a/repo/caching.go
+++ b/repo/caching.go
@@ -55,8 +55,8 @@ func setupCachingOptionsWithDefaults(ctx context.Context, configPath string, lc
 		}
 
 		h := sha256.New()
-		h.Write(uniqueID)           //nolint:errcheck
-		h.Write([]byte(configPath)) //nolint:errcheck
+		h.Write(uniqueID)
+		h.Write([]byte(configPath))
 		lc.Caching.CacheDirectory = filepath.Join(cacheDir, "kopia", hex.EncodeToString(h.Sum(nil))[0:16])
 	} else {
 		d, err := filepath.Abs(opt.CacheDirectory)
diff --git a/repo/compression/compressor_gzip.go b/repo/compression/compressor_gzip.go
index 87b07406..a1b52c5a 100644
--- a/repo/compression/compressor_gzip.go
+++ b/repo/compression/compressor_gzip.go
@@ -41,6 +41,7 @@ func (c *gzipCompressor) Compress(output *bytes.Buffer, input []byte) error {
 		return errors.Wrap(err, "unable to write header")
 	}
 
+	// nolint:forcetypeassert
 	w := c.pool.Get().(*gzip.Writer)
 	defer c.pool.Put(w)
 
diff --git a/repo/compression/compressor_pgzip.go b/repo/compression/compressor_pgzip.go
index 4b7b67a3..a3e3a0ec 100644
--- a/repo/compression/compressor_pgzip.go
+++ b/repo/compression/compressor_pgzip.go
@@ -41,6 +41,7 @@ func (c *pgzipCompressor) Compress(output *bytes.Buffer, input []byte) error {
 		return errors.Wrap(err, "unable to write header")
 	}
 
+	// nolint:forcetypeassert
 	w := c.pool.Get().(*pgzip.Writer)
 	defer c.pool.Put(w)
 
diff --git a/repo/compression/compressor_s2.go b/repo/compression/compressor_s2.go
index 89737f00..2d35a266 100644
--- a/repo/compression/compressor_s2.go
+++ b/repo/compression/compressor_s2.go
@@ -45,6 +45,7 @@ func (c *s2Compressor) Compress(output *bytes.Buffer, input []byte) error {
 		return errors.Wrap(err, "unable to write header")
 	}
 
+	// nolint:forcetypeassert
 	w := c.pool.Get().(*s2.Writer)
 	defer c.pool.Put(w)
 
diff --git a/repo/compression/compressor_zstd.go b/repo/compression/compressor_zstd.go
index b438869f..225a19e2 100644
--- a/repo/compression/compressor_zstd.go
+++ b/repo/compression/compressor_zstd.go
@@ -42,6 +42,7 @@ func (c *zstdCompressor) Compress(output *bytes.Buffer, input []byte) error {
 		return errors.Wrap(err, "unable to write header")
 	}
 
+	// nolint:forcetypeassert
 	w := c.pool.Get().(*zstd.Encoder)
 	defer c.pool.Put(w)
 
diff --git a/repo/connect.go b/repo/connect.go
index c066564d..55dcbd12 100644
--- a/repo/connect.go
+++ b/repo/connect.go
@@ -31,7 +31,6 @@ func Connect(ctx context.Context, configFile string, st blob.Storage, password s
 	formatBytes, err := st.GetBlob(ctx, FormatBlobID, 0, -1)
 	if err != nil {
 		if errors.Is(err, blob.ErrBlobNotFound) {
-			// nolint:wrapcheck
 			return ErrRepositoryNotInitialized
 		}
 
@@ -73,7 +72,7 @@ func verifyConnect(ctx context.Context, configFile, password string) error {
 		return err
 	}
 
-	return r.Close(ctx)
+	return errors.Wrap(r.Close(ctx), "error closing repository")
 }
 
 // Disconnect removes the specified configuration file and any local cache directories.
@@ -98,6 +97,7 @@ func Disconnect(ctx context.Context, configFile string) error {
 		log(ctx).Errorf("unable to remove maintenance lock file", maintenanceLock)
 	}
 
+	// nolint:wrapcheck
 	return os.Remove(configFile)
 }
 
diff --git a/repo/content/blob_crypto.go b/repo/content/blob_crypto.go
index d3099945..e9725c69 100644
--- a/repo/content/blob_crypto.go
+++ b/repo/content/blob_crypto.go
@@ -22,7 +22,12 @@ func getIndexBlobIV(s blob.ID) ([]byte, error) {
 		return nil, errors.Errorf("blob id too short: %v", s)
 	}
 
-	return hex.DecodeString(string(s[len(s)-(aes.BlockSize*2):])) //nolint:gomnd
+	v, err := hex.DecodeString(string(s[len(s)-(aes.BlockSize*2):])) //nolint:gomnd
+	if err != nil {
+		return nil, errors.Errorf("invalid blob ID: %v", s)
+	}
+
+	return v, nil
 }
 
 func encryptFullBlob(h hashing.HashFunc, enc encryption.Encryptor, data []byte, prefix blob.ID, sessionID SessionID) (blob.ID, []byte, error) {
diff --git a/repo/content/committed_read_manager.go b/repo/content/committed_read_manager.go
index e444d109..405ed97f 100644
--- a/repo/content/committed_read_manager.go
+++ b/repo/content/committed_read_manager.go
@@ -242,6 +242,7 @@ func (sm *SharedManager) decryptAndVerify(encrypted, iv []byte) ([]byte, error)
 
 // IndexBlobs returns the list of active index blobs.
 func (sm *SharedManager) IndexBlobs(ctx context.Context, includeInactive bool) ([]IndexBlobInfo, error) {
+	// nolint:wrapcheck
 	return sm.indexBlobManager.listIndexBlobs(ctx, includeInactive)
 }
 
@@ -324,14 +325,14 @@ func (sm *SharedManager) release(ctx context.Context) error {
 	log(ctx).Debugf("closing shared manager")
 
 	if err := sm.committedContents.close(); err != nil {
-		return errors.Wrap(err, "error closed committed content index")
+		return errors.Wrap(err, "error closing committed content index")
 	}
 
 	sm.contentCache.close(ctx)
 	sm.metadataCache.close(ctx)
 	sm.encryptionBufferPool.Close()
 
-	return sm.st.Close(ctx)
+	return errors.Wrap(sm.st.Close(ctx), "error closing storage")
 }
 
 // NewSharedManager returns SharedManager that is used by SessionWriteManagers on top of a repository.
diff --git a/repo/content/content_cache_data.go b/repo/content/content_cache_data.go
index 3533bead..f666eef3 100644
--- a/repo/content/content_cache_data.go
+++ b/repo/content/content_cache_data.go
@@ -27,7 +27,9 @@ func adjustCacheKey(cacheKey cacheKey) cacheKey {
 func (c *contentCacheForData) getContent(ctx context.Context, cacheKey cacheKey, blobID blob.ID, offset, length int64) ([]byte, error) {
 	cacheKey = adjustCacheKey(cacheKey)
 
+	// nolint:wrapcheck
 	return c.pc.GetOrLoad(ctx, string(cacheKey), func() ([]byte, error) {
+		// nolint:wrapcheck
 		return c.st.GetBlob(ctx, blobID, offset, length)
 	})
 }
diff --git a/repo/content/content_cache_metadata.go b/repo/content/content_cache_metadata.go
index c41fdbff..752ccdb7 100644
--- a/repo/content/content_cache_metadata.go
+++ b/repo/content/content_cache_metadata.go
@@ -53,7 +53,7 @@ func (c *contentCacheForMetadata) sync(ctx context.Context) error {
 		return errors.Wrap(err, "error listing blobs")
 	}
 
-	return eg.Wait()
+	return errors.Wrap(eg.Wait(), "error synchronizing metadata cache")
 }
 
 func (c *contentCacheForMetadata) mutexForBlob(blobID blob.ID) *sync.Mutex {
diff --git a/repo/content/content_cache_passthrough.go b/repo/content/content_cache_passthrough.go
index d8bb531a..021e11b8 100644
--- a/repo/content/content_cache_passthrough.go
+++ b/repo/content/content_cache_passthrough.go
@@ -14,5 +14,6 @@ type passthroughContentCache struct {
 func (c passthroughContentCache) close(ctx context.Context) {}
 
 func (c passthroughContentCache) getContent(ctx context.Context, cacheKey cacheKey, blobID blob.ID, offset, length int64) ([]byte, error) {
+	// nolint:wrapcheck
 	return c.st.GetBlob(ctx, blobID, offset, length)
 }
diff --git a/repo/content/content_manager.go b/repo/content/content_manager.go
index 5fffb93e..6be02e1c 100644
--- a/repo/content/content_manager.go
+++ b/repo/content/content_manager.go
@@ -755,6 +755,7 @@ func (bm *WriteManager) SyncMetadataCache(ctx context.Context) error {
 
 // DecryptBlob returns the contents of an encrypted blob that can be decrypted (n,m,l).
 func (bm *WriteManager) DecryptBlob(ctx context.Context, blobID blob.ID) ([]byte, error) {
+	// nolint:wrapcheck
 	return bm.indexBlobManager.getIndexBlob(ctx, blobID)
 }
 
diff --git a/repo/content/content_manager_lock_free.go b/repo/content/content_manager_lock_free.go
index dea02144..1b62691d 100644
--- a/repo/content/content_manager_lock_free.go
+++ b/repo/content/content_manager_lock_free.go
@@ -140,7 +140,7 @@ func (bm *WriteManager) writePackFileNotLocked(ctx context.Context, packFile blo
 	bm.Stats.wroteContent(data.Length())
 	bm.onUpload(int64(data.Length()))
 
-	return bm.st.PutBlob(ctx, packFile, data)
+	return errors.Wrap(bm.st.PutBlob(ctx, packFile, data), "error writing pack file")
 }
 
 func (sm *SharedManager) hashData(output, data []byte) []byte {
diff --git a/repo/content/content_manager_own_writes.go b/repo/content/content_manager_own_writes.go
index 2f66def2..40e42bac 100644
--- a/repo/content/content_manager_own_writes.go
+++ b/repo/content/content_manager_own_writes.go
@@ -64,6 +64,7 @@ func (n *memoryOwnWritesCache) merge(ctx context.Context, prefix blob.ID, source
 	var result []blob.Metadata
 
 	n.entries.Range(func(key, value interface{}) bool {
+		// nolint:forcetypeassert
 		md := value.(blob.Metadata)
 		if !strings.HasPrefix(string(md.BlobID), string(prefix)) {
 			return true
@@ -95,7 +96,7 @@ func (d *persistentOwnWritesCache) add(ctx context.Context, mb blob.Metadata) er
 		return errors.Wrap(err, "unable to marshal JSON")
 	}
 
-	return d.st.PutBlob(ctx, mb.BlobID, gather.FromSlice(j))
+	return errors.Wrap(d.st.PutBlob(ctx, mb.BlobID, gather.FromSlice(j)), "error adding blob to own writes cache")
 }
 
 func (d *persistentOwnWritesCache) merge(ctx context.Context, prefix blob.ID, source []blob.Metadata) ([]blob.Metadata, error) {
diff --git a/repo/content/index_v1.go b/repo/content/index_v1.go
index a0613cc8..b7a8d359 100644
--- a/repo/content/index_v1.go
+++ b/repo/content/index_v1.go
@@ -286,7 +286,7 @@ func (b *indexV1) entryToInfo(contentID ID, entryData []byte) (Info, error) {
 // Close closes the index and the underlying reader.
 func (b *indexV1) Close() error {
 	if closer, ok := b.readerAt.(io.Closer); ok {
-		return closer.Close()
+		return errors.Wrap(closer.Close(), "error closing index file")
 	}
 
 	return nil
@@ -348,7 +348,7 @@ func (b packIndexBuilder) buildV1(output io.Writer) error {
 		return errors.Wrap(err, "error writing extra random suffix to ensure indexes are always globally unique")
 	}
 
-	return w.Flush()
+	return errors.Wrap(w.Flush(), "error flushing index")
 }
 
 func (b *indexBuilderV1) prepareExtraData(allContents []Info) []byte {
diff --git a/repo/content/index_v2.go b/repo/content/index_v2.go
index 94e2a2ae..7d48eed8 100644
--- a/repo/content/index_v2.go
+++ b/repo/content/index_v2.go
@@ -423,7 +423,7 @@ func (b *indexV2) entryToInfo(contentID ID, entryData []byte) (Info, error) {
 // Close closes the index and the underlying reader.
 func (b *indexV2) Close() error {
 	if closer, ok := b.readerAt.(io.Closer); ok {
-		return closer.Close()
+		return errors.Wrap(closer.Close(), "error closing index file")
 	}
 
 	return nil
@@ -639,7 +639,7 @@ func (b packIndexBuilder) buildV2(output io.Writer) error {
 		return errors.Wrap(err, "error writing extra random suffix to ensure indexes are always globally unique")
 	}
 
-	return w.Flush()
+	return errors.Wrap(w.Flush(), "error flushing index")
 }
 
 func (b *indexBuilderV2) prepareExtraData(sortedInfos []Info) []byte {
diff --git a/repo/content/merged.go b/repo/content/merged.go
index 72a5cd0d..8632192e 100644
--- a/repo/content/merged.go
+++ b/repo/content/merged.go
@@ -126,6 +126,7 @@ func (m mergedIndex) Iterate(r IDRange, cb func(i Info) error) error {
 	var pendingItem Info
 
 	for len(minHeap) > 0 {
+		// nolint:forcetypeassert
 		min := heap.Pop(&minHeap).(*nextInfo)
 		if pendingItem == nil || pendingItem.GetContentID() != min.it.GetContentID() {
 			if pendingItem != nil {
diff --git a/repo/encryption/aead_helpers.go b/repo/encryption/aead_helpers.go
index d9355f9c..0292d61b 100644
--- a/repo/encryption/aead_helpers.go
+++ b/repo/encryption/aead_helpers.go
@@ -36,5 +36,10 @@ func aeadOpenPrefixedWithNonce(output []byte, a cipher.AEAD, ciphertext, content
 		return nil, errors.Errorf("ciphertext too short")
 	}
 
-	return a.Open(output[:0], ciphertext[0:a.NonceSize()], ciphertext[a.NonceSize():], contentID)
+	v, err := a.Open(output[:0], ciphertext[0:a.NonceSize()], ciphertext[a.NonceSize():], contentID)
+	if err != nil {
+		return nil, errors.Errorf("unable to decrypt content")
+	}
+
+	return v, nil
 }
diff --git a/repo/encryption/aes256_gcm_hmac_sha256_encryptor.go b/repo/encryption/aes256_gcm_hmac_sha256_encryptor.go
index f41a9113..e1905380 100644
--- a/repo/encryption/aes256_gcm_hmac_sha256_encryptor.go
+++ b/repo/encryption/aes256_gcm_hmac_sha256_encryptor.go
@@ -19,6 +19,7 @@ type aes256GCMHmacSha256 struct {
 
 // aeadForContent returns cipher.AEAD using key derived from a given contentID.
 func (e aes256GCMHmacSha256) aeadForContent(contentID []byte) (cipher.AEAD, error) {
+	// nolint:forcetypeassert
 	h := e.hmacPool.Get().(hash.Hash)
 	defer e.hmacPool.Put(h)
 	h.Reset()
@@ -35,6 +36,7 @@ func (e aes256GCMHmacSha256) aeadForContent(contentID []byte) (cipher.AEAD, erro
 		return nil, errors.Wrap(err, "unable to create AES-256 cipher")
 	}
 
+	// nolint:wrapcheck
 	return cipher.NewGCM(c)
 }
 
diff --git a/repo/encryption/chacha20_poly1305_hmac_sha256_encryptor.go b/repo/encryption/chacha20_poly1305_hmac_sha256_encryptor.go
index 8e228aeb..f8a73eb0 100644
--- a/repo/encryption/chacha20_poly1305_hmac_sha256_encryptor.go
+++ b/repo/encryption/chacha20_poly1305_hmac_sha256_encryptor.go
@@ -19,6 +19,7 @@ type chacha20poly1305hmacSha256Encryptor struct {
 
 // aeadForContent returns cipher.AEAD using key derived from a given contentID.
 func (e chacha20poly1305hmacSha256Encryptor) aeadForContent(contentID []byte) (cipher.AEAD, error) {
+	// nolint:forcetypeassert
 	h := e.hmacPool.Get().(hash.Hash)
 	defer e.hmacPool.Put(h)
 
@@ -31,6 +32,7 @@ func (e chacha20poly1305hmacSha256Encryptor) aeadForContent(contentID []byte) (c
 	var hashBuf [32]byte
 	key := h.Sum(hashBuf[:0])
 
+	// nolint:wrapcheck
 	return chacha20poly1305.New(key)
 }
 
diff --git a/repo/format_block.go b/repo/format_block.go
index 43fabf27..f635cfc7 100644
--- a/repo/format_block.go
+++ b/repo/format_block.go
@@ -103,7 +103,6 @@ func recoverFormatBlobWithLength(ctx context.Context, st blob.Storage, blobID bl
 	}
 
 	if chunkLength <= minRecoverableChunkLength {
-		// nolint:wrapcheck
 		return nil, errFormatBlobNotFound
 	}
 
@@ -133,7 +132,6 @@ func recoverFormatBlobWithLength(ctx context.Context, st blob.Storage, blobID bl
 		}
 	}
 
-	// nolint:wrapcheck
 	return nil, errFormatBlobNotFound
 }
 
@@ -148,7 +146,7 @@ func verifyFormatBlobChecksum(b []byte) ([]byte, bool) {
 
 	data, checksum := b[0:len(b)-formatBlobChecksumSize], b[len(b)-formatBlobChecksumSize:]
 	h := hmac.New(sha256.New, formatBlobChecksumSecret)
-	h.Write(data) //nolint:errcheck
+	h.Write(data)
 	actualChecksum := h.Sum(nil)
 
 	if !hmac.Equal(actualChecksum, checksum) {
@@ -267,7 +265,7 @@ func encryptFormatBytes(f *formatBlob, format *repositoryObjectFormat, masterKey
 
 func addFormatBlobChecksumAndLength(fb []byte) ([]byte, error) {
 	h := hmac.New(sha256.New, formatBlobChecksumSecret)
-	h.Write(fb) //nolint:errcheck
+	h.Write(fb)
 	checksummedFormatBytes := h.Sum(fb)
 
 	l := len(checksummedFormatBytes)
diff --git a/repo/grpc_repository_client.go b/repo/grpc_repository_client.go
index 5dcc4d58..a9a3d60f 100644
--- a/repo/grpc_repository_client.go
+++ b/repo/grpc_repository_client.go
@@ -173,6 +173,7 @@ func (r *grpcRepositoryClient) ClientOptions() ClientOptions {
 }
 
 func (r *grpcRepositoryClient) OpenObject(ctx context.Context, id object.ID) (object.Reader, error) {
+	// nolint:wrapcheck
 	return object.Open(ctx, r, id)
 }
 
@@ -181,6 +182,7 @@ func (r *grpcRepositoryClient) NewObjectWriter(ctx context.Context, opt object.W
 }
 
 func (r *grpcRepositoryClient) VerifyObject(ctx context.Context, id object.ID) ([]content.ID, error) {
+	// nolint:wrapcheck
 	return object.VerifyObject(ctx, r, id)
 }
 
@@ -410,12 +412,13 @@ func (r *grpcRepositoryClient) maybeRetry(ctx context.Context, attempt sessionAt
 // If the grpcRepositoryClient set to automatically retry and the provided callback returns io.EOF,
 // the inner session will be killed and re-established as necessary.
 func (r *grpcRepositoryClient) retry(ctx context.Context, attempt sessionAttemptFunc) (interface{}, error) {
+	// nolint:wrapcheck
 	return retry.WithExponentialBackoff(ctx, "invoking GRPC API", func() (interface{}, error) {
 		v, err := r.inSessionWithoutRetry(ctx, attempt)
 		if errors.Is(err, io.EOF) {
 			r.killInnerSession()
 
-			return nil, errShouldRetry //nolint:wrapcheck
+			return nil, errShouldRetry
 		}
 
 		return v, err
@@ -497,6 +500,7 @@ func unhandledSessionResponse(resp *apipb.SessionResponse) error {
 }
 
 func (r *grpcRepositoryClient) GetContent(ctx context.Context, contentID content.ID) ([]byte, error) {
+	// nolint:wrapcheck
 	return r.contentCache.GetOrLoad(ctx, string(contentID), func() ([]byte, error) {
 		v, err := r.maybeRetry(ctx, func(ctx context.Context, sess *grpcInnerSession) (interface{}, error) {
 			return sess.GetContent(ctx, contentID)
@@ -723,6 +727,7 @@ func (r *grpcRepositoryClient) getOrEstablishInnerSession(ctx context.Context) (
 			return nil, errors.Wrap(err, "error establishing session")
 		}
 
+		// nolint:forcetypeassert
 		r.innerSession = v.(*grpcInnerSession)
 	}
 
diff --git a/repo/hashing/blake3_hashes.go b/repo/hashing/blake3_hashes.go
index 826d1bd0..2cfbaece 100644
--- a/repo/hashing/blake3_hashes.go
+++ b/repo/hashing/blake3_hashes.go
@@ -17,6 +17,7 @@ func newBlake3(key []byte) (hash.Hash, error) {
 		key = xKey[:blake3KeySize]
 	}
 
+	// nolint:wrapcheck
 	return blake3.NewKeyed(key[:blake3KeySize])
 }
 
diff --git a/repo/hashing/hashing.go b/repo/hashing/hashing.go
index e44b7f2e..9a32e128 100644
--- a/repo/hashing/hashing.go
+++ b/repo/hashing/hashing.go
@@ -55,11 +55,12 @@ func truncatedHMACHashFuncFactory(hf func() hash.Hash, truncate int) HashFuncFac
 		}
 
 		return func(output, b []byte) []byte {
+			// nolint:forcetypeassert
 			h := pool.Get().(hash.Hash)
 			defer pool.Put(h)
 
 			h.Reset()
-			h.Write(b) // nolint:errcheck
+			h.Write(b)
 
 			return h.Sum(output)[0:truncate]
 		}, nil
@@ -83,11 +84,12 @@ func truncatedKeyedHashFuncFactory(hf func(key []byte) (hash.Hash, error), trunc
 		}
 
 		return func(output, b []byte) []byte {
+			// nolint:forcetypeassert
 			h := pool.Get().(hash.Hash)
 			defer pool.Put(h)
 
 			h.Reset()
-			h.Write(b) // nolint:errcheck
+			h.Write(b)
 
 			return h.Sum(output)[0:truncate]
 		}, nil
diff --git a/repo/initialize.go b/repo/initialize.go
index 480f90be..cf17808d 100644
--- a/repo/initialize.go
+++ b/repo/initialize.go
@@ -49,7 +49,6 @@ func Initialize(ctx context.Context, st blob.Storage, opt *NewRepositoryOptions,
 	// get the blob - expect ErrNotFound
 	_, err := st.GetBlob(ctx, FormatBlobID, 0, -1)
 	if err == nil {
-		// nolint:wrapcheck
 		return ErrAlreadyInitialized
 	}
 
diff --git a/repo/maintenance/content_rewrite.go b/repo/maintenance/content_rewrite.go
index c3c5960b..afcda808 100644
--- a/repo/maintenance/content_rewrite.go
+++ b/repo/maintenance/content_rewrite.go
@@ -111,6 +111,7 @@ func RewriteContents(ctx context.Context, rep repo.DirectRepositoryWriter, opt *
 	log(ctx).Debugf("Total bytes rewritten %v", units.BytesStringBase10(totalBytes))
 
 	if failedCount == 0 {
+		// nolint:wrapcheck
 		return rep.ContentManager().Flush(ctx)
 	}
 
diff --git a/repo/maintenance/drop_deleted_contents.go b/repo/maintenance/drop_deleted_contents.go
index bd6a38da..d56051b6 100644
--- a/repo/maintenance/drop_deleted_contents.go
+++ b/repo/maintenance/drop_deleted_contents.go
@@ -12,6 +12,7 @@
 func DropDeletedContents(ctx context.Context, rep repo.DirectRepositoryWriter, dropDeletedBefore time.Time, safety SafetyParameters) error {
 	log(ctx).Infof("Dropping contents deleted before %v", dropDeletedBefore)
 
+	// nolint:wrapcheck
 	return rep.ContentManager().CompactIndexes(ctx, content.CompactOptions{
 		AllIndexes:                       true,
 		DropDeletedBefore:                dropDeletedBefore,
diff --git a/repo/maintenance/index_compaction.go b/repo/maintenance/index_compaction.go
index fd2e46f7..53bfa55d 100644
--- a/repo/maintenance/index_compaction.go
+++ b/repo/maintenance/index_compaction.go
@@ -13,6 +13,7 @@
 func IndexCompaction(ctx context.Context, rep repo.DirectRepositoryWriter, safety SafetyParameters) error {
 	log(ctx).Infof("Compacting indexes...")
 
+	// nolint:wrapcheck
 	return rep.ContentManager().CompactIndexes(ctx, content.CompactOptions{
 		MaxSmallBlobs:                    maxSmallBlobsForIndexCompaction,
 		DisableEventualConsistencySafety: safety.DisableEventualConsistencySafety,
diff --git a/repo/maintenance/maintenance_schedule.go b/repo/maintenance/maintenance_schedule.go
index 50584b68..a6e21716 100644
--- a/repo/maintenance/maintenance_schedule.go
+++ b/repo/maintenance/maintenance_schedule.go
@@ -66,6 +66,7 @@ func getAES256GCM(rep repo.DirectRepository) (cipher.AEAD, error) {
 		return nil, errors.Wrap(err, "unable to create AES-256 cipher")
 	}
 
+	// nolint:wrapcheck
 	return cipher.NewGCM(c)
 }
 
@@ -128,6 +129,7 @@ func SetSchedule(ctx context.Context, rep repo.DirectRepositoryWriter, s *Schedu
 	result := append([]byte(nil), nonce...)
 	ciphertext := c.Seal(result, nonce, v, maintenanceScheduleAEADExtraData)
 
+	// nolint:wrapcheck
 	return rep.BlobStorage().PutBlob(ctx, maintenanceScheduleBlobID, gather.FromSlice(ciphertext))
 }
 
diff --git a/repo/object/object_reader.go b/repo/object/object_reader.go
index 19f4561a..4ec17335 100644
--- a/repo/object/object_reader.go
+++ b/repo/object/object_reader.go
@@ -314,7 +314,7 @@ func decompress(output *bytes.Buffer, b []byte) error {
 		return errors.Errorf("unsupported compressor %x", compressorID)
 	}
 
-	return compressor.Decompress(output, b)
+	return errors.Wrap(compressor.Decompress(output, b), "error decompressing")
 }
 
 type readerWithData struct {
diff --git a/repo/object/object_writer.go b/repo/object/object_writer.go
index 17599ccc..b95f341a 100644
--- a/repo/object/object_writer.go
+++ b/repo/object/object_writer.go
@@ -162,6 +162,8 @@ func (w *objectWriter) flushBuffer() error {
 	w.asyncWritesWG.Add(1)
 
 	asyncBuf := w.om.bufferPool.Allocate(length)
+
+	// nolint:gocritic
 	asyncBytes := append(asyncBuf.Data[:0], w.buffer.Bytes()...)
 
 	go func() {
diff --git a/repo/open.go b/repo/open.go
index e6bb4116..1efbfb48 100644
--- a/repo/open.go
+++ b/repo/open.go
@@ -105,7 +105,12 @@ func getContentCacheOrNil(ctx context.Context, opt *content.CachingOptions, pass
 		return nil, errors.Wrap(err, "unable to initialize protection")
 	}
 
-	return cache.NewPersistentCache(ctx, "cache-storage", cs, prot, opt.MaxCacheSizeBytes, cache.DefaultTouchThreshold, cache.DefaultSweepFrequency)
+	pc, err := cache.NewPersistentCache(ctx, "cache-storage", cs, prot, opt.MaxCacheSizeBytes, cache.DefaultTouchThreshold, cache.DefaultSweepFrequency)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to open persistent cache")
+	}
+
+	return pc, nil
 }
 
 // OpenAPIServer connects remote repository over Kopia API.
@@ -181,7 +186,6 @@ func openWithConfig(ctx context.Context, st blob.Storage, lc *LocalConfig, passw
 
 	repoConfig, err := f.decryptFormatBytes(masterKey)
 	if err != nil {
-		// nolint:wrapcheck
 		return nil, ErrInvalidPassword
 	}
 
@@ -268,7 +272,7 @@ func writeCacheMarker(cacheDir string) error {
 		return errors.Wrap(err, "unable to write cachedir marker contents")
 	}
 
-	return f.Close()
+	return errors.Wrap(f.Close(), "error closing cache marker file")
 }
 
 func readAndCacheFormatBlobBytes(ctx context.Context, st blob.Storage, cacheDirectory string) ([]byte, error) {
diff --git a/repo/repository.go b/repo/repository.go
index b5990149..9015517a 100644
--- a/repo/repository.go
+++ b/repo/repository.go
@@ -126,36 +126,43 @@ func (r *directRepository) NewObjectWriter(ctx context.Context, opt object.Write
 
 // OpenObject opens the reader for a given object, returns object.ErrNotFound.
 func (r *directRepository) OpenObject(ctx context.Context, id object.ID) (object.Reader, error) {
+	// nolint:wrapcheck
 	return object.Open(ctx, r.cmgr, id)
 }
 
 // VerifyObject verifies that the given object is stored properly in a repository and returns backing content IDs.
 func (r *directRepository) VerifyObject(ctx context.Context, id object.ID) ([]content.ID, error) {
+	// nolint:wrapcheck
 	return object.VerifyObject(ctx, r.cmgr, id)
 }
 
 // GetManifest returns the given manifest data and metadata.
 func (r *directRepository) GetManifest(ctx context.Context, id manifest.ID, data interface{}) (*manifest.EntryMetadata, error) {
+	// nolint:wrapcheck
 	return r.mmgr.Get(ctx, id, data)
 }
 
 // PutManifest saves the given manifest payload with a set of labels.
 func (r *directRepository) PutManifest(ctx context.Context, labels map[string]string, payload interface{}) (manifest.ID, error) {
+	// nolint:wrapcheck
 	return r.mmgr.Put(ctx, labels, payload)
 }
 
 // FindManifests returns metadata for manifests matching given set of labels.
 func (r *directRepository) FindManifests(ctx context.Context, labels map[string]string) ([]*manifest.EntryMetadata, error) {
+	// nolint:wrapcheck
 	return r.mmgr.Find(ctx, labels)
 }
 
 // DeleteManifest deletes the manifest with a given ID.
 func (r *directRepository) DeleteManifest(ctx context.Context, id manifest.ID) error {
+	// nolint:wrapcheck
 	return r.mmgr.Delete(ctx, id)
 }
 
 // ListActiveSessions returns the map of active sessions.
 func (r *directRepository) ListActiveSessions(ctx context.Context) (map[content.SessionID]*content.SessionInfo, error) {
+	// nolint:wrapcheck
 	return r.cmgr.ListActiveSessions(ctx)
 }
 
@@ -232,7 +239,7 @@ func (r *directRepository) Flush(ctx context.Context) error {
 		return errors.Wrap(err, "error flushing manifests")
 	}
 
-	return r.cmgr.Flush(ctx)
+	return errors.Wrap(r.cmgr.Flush(ctx), "error flushing contents")
 }
 
 // ObjectFormat returns the object format.
diff --git a/snapshot/manager.go b/snapshot/manager.go
index 84d839d4..ed5dce9b 100644
--- a/snapshot/manager.go
+++ b/snapshot/manager.go
@@ -93,7 +93,6 @@ func LoadSnapshot(ctx context.Context, rep repo.Repository, manifestID manifest.
 	em, err := rep.GetManifest(ctx, manifestID, sm)
 	if err != nil {
 		if errors.Is(err, manifest.ErrNotFound) {
-			// nolint:wrapcheck
 			return nil, ErrSnapshotNotFound
 		}
 
diff --git a/snapshot/manifest.go b/snapshot/manifest.go
index 34d3dc4b..2f76924d 100644
--- a/snapshot/manifest.go
+++ b/snapshot/manifest.go
@@ -54,6 +54,7 @@ func (p Permissions) MarshalJSON() ([]byte, error) {
 
 	s := "0" + strconv.FormatInt(int64(p), 8)
 
+	// nolint:wrapcheck
 	return json.Marshal(&s)
 }
 
diff --git a/snapshot/restore/local_fs_output.go b/snapshot/restore/local_fs_output.go
index 2c75f6b6..7cda0a82 100644
--- a/snapshot/restore/local_fs_output.go
+++ b/snapshot/restore/local_fs_output.go
@@ -269,6 +269,7 @@ func isWindows() bool {
 func (o *FilesystemOutput) createDirectory(ctx context.Context, path string) error {
 	switch stat, err := os.Stat(path); {
 	case os.IsNotExist(err):
+		// nolint:wrapcheck
 		return os.MkdirAll(path, 0o700)
 	case err != nil:
 		return errors.Wrap(err, "failed to stat path "+path)
@@ -308,6 +309,7 @@ func (o *FilesystemOutput) copyFileContent(ctx context.Context, targetPath strin
 
 	log(ctx).Debugf("copying file contents to: %v", targetPath)
 
+	// nolint:wrapcheck
 	return atomicfile.Write(targetPath, r)
 }
 
diff --git a/snapshot/restore/local_fs_output_darwin.go b/snapshot/restore/local_fs_output_darwin.go
index e8e1e4ec..2d48ecb9 100644
--- a/snapshot/restore/local_fs_output_darwin.go
+++ b/snapshot/restore/local_fs_output_darwin.go
@@ -8,14 +8,17 @@
 )
 
 func symlinkChown(path string, uid, gid int) error {
+	// nolint:wrapcheck
 	return unix.Lchown(path, uid, gid)
 }
 
 func symlinkChmod(path string, mode os.FileMode) error {
+	// nolint:wrapcheck
 	return unix.Fchmodat(unix.AT_FDCWD, path, uint32(mode), unix.AT_SYMLINK_NOFOLLOW)
 }
 
 func symlinkChtimes(linkPath string, atime, mtime time.Time) error {
+	// nolint:wrapcheck
 	return unix.Lutimes(linkPath, []unix.Timeval{
 		unix.NsecToTimeval(atime.UnixNano()),
 		unix.NsecToTimeval(mtime.UnixNano()),
diff --git a/snapshot/restore/local_fs_output_unix.go b/snapshot/restore/local_fs_output_unix.go
index 25339884..dae3db72 100644
--- a/snapshot/restore/local_fs_output_unix.go
+++ b/snapshot/restore/local_fs_output_unix.go
@@ -10,6 +10,7 @@
 )
 
 func symlinkChown(path string, uid, gid int) error {
+	// nolint:wrapcheck
 	return unix.Lchown(path, uid, gid)
 }
 
@@ -19,6 +20,7 @@ func symlinkChmod(path string, mode os.FileMode) error {
 }
 
 func symlinkChtimes(linkPath string, atime, mtime time.Time) error {
+	// nolint:wrapcheck
 	return unix.Lutimes(linkPath, []unix.Timeval{
 		unix.NsecToTimeval(atime.UnixNano()),
 		unix.NsecToTimeval(mtime.UnixNano()),
diff --git a/snapshot/restore/local_fs_output_windows.go b/snapshot/restore/local_fs_output_windows.go
index 14575688..c6477f2f 100644
--- a/snapshot/restore/local_fs_output_windows.go
+++ b/snapshot/restore/local_fs_output_windows.go
@@ -40,5 +40,6 @@ func symlinkChtimes(linkPath string, atime, mtime time.Time) error {
 
 	defer windows.CloseHandle(h) //nolint:errcheck
 
+	// nolint:wrapcheck
 	return windows.SetFileTime(h, &ftw, &fta, &ftw)
 }
diff --git a/snapshot/restore/tar_output.go b/snapshot/restore/tar_output.go
index 03d21daf..51278762 100644
--- a/snapshot/restore/tar_output.go
+++ b/snapshot/restore/tar_output.go
@@ -54,6 +54,7 @@ func (o *TarOutput) Close(ctx context.Context) error {
 		return errors.Wrap(err, "error closing tar")
 	}
 
+	// nolint:wrapcheck
 	return o.w.Close()
 }
 
diff --git a/snapshot/restore/zip_output.go b/snapshot/restore/zip_output.go
index caf0da49..f70e61da 100644
--- a/snapshot/restore/zip_output.go
+++ b/snapshot/restore/zip_output.go
@@ -38,6 +38,7 @@ func (o *ZipOutput) Close(ctx context.Context) error {
 		return errors.Wrap(err, "error closing zip")
 	}
 
+	// nolint:wrapcheck
 	return o.w.Close()
 }
 
diff --git a/snapshot/snapshotfs/all_sources.go b/snapshot/snapshotfs/all_sources.go
index 364e302a..bce4d98f 100644
--- a/snapshot/snapshotfs/all_sources.go
+++ b/snapshot/snapshotfs/all_sources.go
@@ -54,6 +54,7 @@ func (s *repositoryAllSources) LocalFilesystemPath() string {
 }
 
 func (s *repositoryAllSources) Child(ctx context.Context, name string) (fs.Entry, error) {
+	// nolint:wrapcheck
 	return fs.ReadDirAndFindChild(ctx, s, name)
 }
 
diff --git a/snapshot/snapshotfs/estimate.go b/snapshot/snapshotfs/estimate.go
index f0830620..e6f3957a 100644
--- a/snapshot/snapshotfs/estimate.go
+++ b/snapshot/snapshotfs/estimate.go
@@ -110,6 +110,7 @@ func estimate(ctx context.Context, relativePath string, entry fs.Entry, policyTr
 	// see if the context got canceled
 	select {
 	case <-ctx.Done():
+		// nolint:wrapcheck
 		return ctx.Err()
 
 	default:
diff --git a/snapshot/snapshotfs/repofs.go b/snapshot/snapshotfs/repofs.go
index d5a4e3b4..4b3e4446 100644
--- a/snapshot/snapshotfs/repofs.go
+++ b/snapshot/snapshotfs/repofs.go
@@ -121,6 +121,7 @@ func (rd *repositoryDirectory) Summary(ctx context.Context) (*fs.DirectorySummar
 }
 
 func (rd *repositoryDirectory) Child(ctx context.Context, name string) (fs.Entry, error) {
+	// nolint:wrapcheck
 	return fs.ReadDirAndFindChild(ctx, rd, name)
 }
 
diff --git a/snapshot/snapshotfs/snapshot_tree_walker.go b/snapshot/snapshotfs/snapshot_tree_walker.go
index 7fb1eb1c..e0a00089 100644
--- a/snapshot/snapshotfs/snapshot_tree_walker.go
+++ b/snapshot/snapshotfs/snapshot_tree_walker.go
@@ -66,6 +66,7 @@ func (w *TreeWalker) Run(ctx context.Context) error {
 		log(ctx).Infof("  Processed %v contents, discovered %v...", completed, enqueued)
 	}
 
+	// nolint:wrapcheck
 	return w.queue.Process(ctx, w.Parallelism)
 }
 
diff --git a/snapshot/snapshotfs/source_directories.go b/snapshot/snapshotfs/source_directories.go
index 892771fd..ba788df0 100644
--- a/snapshot/snapshotfs/source_directories.go
+++ b/snapshot/snapshotfs/source_directories.go
@@ -54,6 +54,7 @@ func (s *sourceDirectories) LocalFilesystemPath() string {
 }
 
 func (s *sourceDirectories) Child(ctx context.Context, name string) (fs.Entry, error) {
+	// nolint:wrapcheck
 	return fs.ReadDirAndFindChild(ctx, s, name)
 }
 
diff --git a/snapshot/snapshotfs/source_snapshots.go b/snapshot/snapshotfs/source_snapshots.go
index b176f0c8..198d0a87 100644
--- a/snapshot/snapshotfs/source_snapshots.go
+++ b/snapshot/snapshotfs/source_snapshots.go
@@ -61,6 +61,7 @@ func safeName(path string) string {
 }
 
 func (s *sourceSnapshots) Child(ctx context.Context, name string) (fs.Entry, error) {
+	// nolint:wrapcheck
 	return fs.ReadDirAndFindChild(ctx, s, name)
 }
 
diff --git a/snapshot/snapshotfs/upload.go b/snapshot/snapshotfs/upload.go
index 8098bb99..3ab4aa3a 100644
--- a/snapshot/snapshotfs/upload.go
+++ b/snapshot/snapshotfs/upload.go
@@ -247,6 +247,7 @@ func (u *Uploader) uploadStreamingFileInternal(ctx context.Context, relativePath
 }
 
 func (u *Uploader) copyWithProgress(dst io.Writer, src io.Reader, completed, length int64) (int64, error) {
+	// nolint:forcetypeassert
 	uploadBufPtr := u.uploadBufPool.Get().(*[]byte)
 	defer u.uploadBufPool.Put(uploadBufPtr)
 
@@ -495,7 +496,6 @@ func (u *Uploader) foreachEntryUnlessCanceled(ctx context.Context, parallel int,
 		eg.Go(func() error {
 			for entry := range ch {
 				if u.IsCanceled() {
-					// nolint:wrapcheck
 					return errCanceled
 				}
 
@@ -509,6 +509,7 @@ func (u *Uploader) foreachEntryUnlessCanceled(ctx context.Context, parallel int,
 		})
 	}
 
+	// nolint:wrapcheck
 	return eg.Wait()
 }
 
diff --git a/snapshot/snapshotfs/upload_actions.go b/snapshot/snapshotfs/upload_actions.go
index f243223c..be811bd4 100644
--- a/snapshot/snapshotfs/upload_actions.go
+++ b/snapshot/snapshotfs/upload_actions.go
@@ -155,7 +155,7 @@ func runActionCommand(
 	cmd.Stderr = os.Stderr
 
 	if h.Mode == "async" {
-		return cmd.Start()
+		return errors.Wrap(cmd.Start(), "error starting action command asynchronously")
 	}
 
 	v, err := cmd.Output()
@@ -186,6 +186,7 @@ func parseCaptures(v []byte, captures map[string]string) error {
 		}
 	}
 
+	// nolint:wrapcheck
 	return s.Err()
 }
 
@@ -214,7 +215,9 @@ func (u *Uploader) executeBeforeFolderAction(ctx context.Context, actionType str
 
 	if p := captures["KOPIA_SNAPSHOT_PATH"]; p != "" {
 		hc.SnapshotPath = p
-		return localfs.Directory(hc.SnapshotPath)
+		d, err := localfs.Directory(hc.SnapshotPath)
+
+		return d, errors.Wrap(err, "error getting local directory specified in KOPIA_SNAPSHOT_PATH")
 	}
 
 	return nil, nil
diff --git a/snapshot/snapshotmaintenance/snapshotmaintenance.go b/snapshot/snapshotmaintenance/snapshotmaintenance.go
index be3f4d22..d8657989 100644
--- a/snapshot/snapshotmaintenance/snapshotmaintenance.go
+++ b/snapshot/snapshotmaintenance/snapshotmaintenance.go
@@ -13,6 +13,7 @@
 
 // Run runs the complete snapshot and repository maintenance.
 func Run(ctx context.Context, dr repo.DirectRepositoryWriter, mode maintenance.Mode, force bool, safety maintenance.SafetyParameters) error {
+	// nolint:wrapcheck
 	return maintenance.RunExclusive(ctx, dr, mode, force,
 		func(runParams maintenance.RunParameters) error {
 			// run snapshot GC before full maintenance
@@ -22,6 +23,7 @@ func(runParams maintenance.RunParameters) error {
 				}
 			}
 
+			// nolint:wrapcheck
 			return maintenance.Run(ctx, runParams, safety)
 		})
 }
diff --git a/tools/tools.mk b/tools/tools.mk
index 0fb72d3a..39d45351 100644
--- a/tools/tools.mk
+++ b/tools/tools.mk
@@ -98,7 +98,7 @@ TOOLS_DIR:=$(SELF_DIR)$(slash).tools
 retry:=$(SELF_DIR)/retry.sh
 
 # tool versions
-GOLANGCI_LINT_VERSION=1.37.1
+GOLANGCI_LINT_VERSION=1.40.1
 NODE_VERSION=14.15.4
 HUGO_VERSION=0.82.0
 GOTESTSUM_VERSION=0.5.3


Test patch:
diff --git a/repo/crypto_key_derivation_nontest.go b/repo/crypto_key_derivation_nontest.go
index 4623e310..05ae9c3c 100644
--- a/repo/crypto_key_derivation_nontest.go
+++ b/repo/crypto_key_derivation_nontest.go
@@ -15,6 +15,7 @@ func (f *formatBlob) deriveMasterKeyFromPassword(password string) ([]byte, error
 
 	switch f.KeyDerivationAlgorithm {
 	case "scrypt-65536-8-1":
+		// nolint:wrapcheck
 		return scrypt.Key([]byte(password), f.UniqueID, 65536, 8, 1, masterKeySize)
 
 	default: