Fix test script and linter errors

This commit is contained in:
Daniel 2021-10-01 13:58:26 +02:00
parent b4f443f7c2
commit 1e91e2b9f7
28 changed files with 105 additions and 122 deletions

View file

@ -7,6 +7,13 @@ linters:
- funlen - funlen
- whitespace - whitespace
- wsl - wsl
- gomnd
- goerr113
- testpackage
- nestif
- gocognit
- noctx
- gocyclo
linters-settings: linters-settings:
godox: godox:

View file

@ -14,41 +14,39 @@ func init() {
rootCmd.AddCommand(configureCmd) rootCmd.AddCommand(configureCmd)
} }
var ( var configureCmd = &cobra.Command{
configureCmd = &cobra.Command{ Use: "configure <envelope name>",
Use: "configure <envelope name>", Short: "configure (and create) envelope",
Short: "configure (and create) envelope", DisableFlagsInUseLine: true,
DisableFlagsInUseLine: true, Args: cobra.MaximumNArgs(1),
Args: cobra.MaximumNArgs(1), PreRunE: requireTrustStore,
PreRunE: requireTrustStore, RunE: func(cmd *cobra.Command, args []string) (err error) {
RunE: func(cmd *cobra.Command, args []string) (err error) { // check envelope name existence
// check envelope name existence if len(args) == 0 {
if len(args) == 0 { return errors.New("please specify an envelope name")
return errors.New("please specify an envelope name") }
} envelopeName := args[0]
envelopeName := args[0]
// check envelope name // check envelope name
if !truststores.NamePlaysNiceWithFS(envelopeName) { if !truststores.NamePlaysNiceWithFS(envelopeName) {
return errors.New("please only use alphanumeric characters and `- ._+@` for best compatibility with various systems") return errors.New("please only use alphanumeric characters and `- ._+@` for best compatibility with various systems")
} }
// get envelope from trust store // get envelope from trust store
envelope, err := trustStore.GetEnvelope(envelopeName) envelope, err := trustStore.GetEnvelope(envelopeName)
if err != nil && err != jess.ErrEnvelopeNotFound { if err != nil && err != jess.ErrEnvelopeNotFound {
return err
}
// create
if envelope == nil {
envelope, err = newEnvelope(envelopeName)
if err != nil {
return err return err
} }
}
// create // edit (and save)
if envelope == nil { return editEnvelope(envelope)
envelope, err = newEnvelope(envelopeName) },
if err != nil { }
return err
}
}
// edit (and save)
return editEnvelope(envelope)
},
}
)

View file

@ -142,7 +142,6 @@ func (s *Session) Close(data []byte) (*Letter, error) { //nolint:gocognit
for _, tool := range s.signers { for _, tool := range s.signers {
//nolint:scopelint // function is executed immediately within loop //nolint:scopelint // function is executed immediately within loop
err = s.envelope.LoopSenders(tool.Info().Name, func(signet *Signet) error { err = s.envelope.LoopSenders(tool.Info().Name, func(signet *Signet) error {
sig, err := tool.Sign(data, associatedSigningData, signet) sig, err := tool.Sign(data, associatedSigningData, signet)
if err != nil { if err != nil {
return fmt.Errorf("failed to sign with %s: %s", tool.Info().Name, err) return fmt.Errorf("failed to sign with %s: %s", tool.Info().Name, err)
@ -218,7 +217,6 @@ func (s *Session) Open(letter *Letter) ([]byte, error) { //nolint:gocognit,gocyc
for _, tool := range s.signers { for _, tool := range s.signers {
//nolint:scopelint // function is executed immediately within loop //nolint:scopelint // function is executed immediately within loop
err = s.envelope.LoopSenders(tool.Info().Name, func(signet *Signet) error { err = s.envelope.LoopSenders(tool.Info().Name, func(signet *Signet) error {
err := tool.Verify(data, associatedSigningData, letter.Signatures[sigIndex].Value, signet) err := tool.Verify(data, associatedSigningData, letter.Signatures[sigIndex].Value, signet)
if err != nil { if err != nil {
return fmt.Errorf("failed to verify signature (%s) with ID %s: %s", tool.Info().Name, letter.Signatures[sigIndex].ID, err) return fmt.Errorf("failed to verify signature (%s) with ID %s: %s", tool.Info().Name, letter.Signatures[sigIndex].ID, err)
@ -323,7 +321,6 @@ func (s *Session) Open(letter *Letter) ([]byte, error) { //nolint:gocognit,gocyc
// Verify verifies signatures of the given letter. // Verify verifies signatures of the given letter.
func (s *Session) Verify(letter *Letter) error { func (s *Session) Verify(letter *Letter) error {
// debugging: // debugging:
/* /*
fmt.Printf("opening: %+v\n", letter) fmt.Printf("opening: %+v\n", letter)
@ -374,7 +371,6 @@ func (s *Session) Verify(letter *Letter) error {
for _, tool := range s.signers { for _, tool := range s.signers {
//nolint:scopelint // function is executed immediately within loop //nolint:scopelint // function is executed immediately within loop
err = s.envelope.LoopSenders(tool.Info().Name, func(signet *Signet) error { err = s.envelope.LoopSenders(tool.Info().Name, func(signet *Signet) error {
err := tool.Verify(data, associatedSigningData, letter.Signatures[sigIndex].Value, signet) err := tool.Verify(data, associatedSigningData, letter.Signatures[sigIndex].Value, signet)
if err != nil { if err != nil {
return fmt.Errorf("failed to verify signature (%s) with ID %s: %s", tool.Info().Name, letter.Signatures[sigIndex].ID, err) return fmt.Errorf("failed to verify signature (%s) with ID %s: %s", tool.Info().Name, letter.Signatures[sigIndex].ID, err)

View file

@ -111,10 +111,10 @@ func init() {
defaultSecurityLevel = 128 defaultSecurityLevel = 128
// init special test config // init special test config
if RunComprehensiveTests == "true" { //nolint:goconst if RunComprehensiveTests == "true" {
runComprehensiveTestsActive = true runComprehensiveTestsActive = true
} }
if RunTestsInDebugStyle == "true" { //nolint:goconst if RunTestsInDebugStyle == "true" {
runTestsInDebugStyleActive = true runTestsInDebugStyleActive = true
} }
} }
@ -456,7 +456,6 @@ func testInvalidToolset(e *Envelope, whyInvalid string) error {
} }
func getOrMakeSignet(t *testing.T, tool tools.ToolLogic, recipient bool, signetID string) (*Signet, error) { func getOrMakeSignet(t *testing.T, tool tools.ToolLogic, recipient bool, signetID string) (*Signet, error) {
// check if signet already exists // check if signet already exists
signet, err := testTrustStore.GetSignet(signetID, recipient) signet, err := testTrustStore.GetSignet(signetID, recipient)
if err == nil { if err == nil {
@ -503,9 +502,9 @@ func getOrMakeSignet(t *testing.T, tool tools.ToolLogic, recipient bool, signetI
} }
// generateCombinations returns all possible combinations of the given []string slice. // generateCombinations returns all possible combinations of the given []string slice.
// Forked from https://github.com/mxschmitt/golang-combinations/blob/a887187146560effd2677e987b069262f356297f/combinations.go // Forked from https://github.com/mxschmitt/golang-combinations/blob/a887187146560effd2677e987b069262f356297f/combinations.go
// Copyright (c) 2018 Max Schmitt // Copyright (c) 2018 Max Schmitt,
// MIT License // MIT License.
func generateCombinations(set []string) (subsets [][]string) { func generateCombinations(set []string) (subsets [][]string) {
length := uint(len(set)) length := uint(len(set))

View file

@ -10,7 +10,7 @@ var (
minimumSymmetricKeySize = 0 minimumSymmetricKeySize = 0
) )
// Currently recommended toolsets // Currently recommended toolsets.
var ( var (
RecommendedNetwork = []string{"ECDH-X25519", "HKDF(SHA2-256)", "CHACHA20-POLY1305"} RecommendedNetwork = []string{"ECDH-X25519", "HKDF(SHA2-256)", "CHACHA20-POLY1305"}
RecommendedStoragePassword = []string{"PBKDF2-SHA2-256", "HKDF(SHA2-256)", "CHACHA20-POLY1305"} RecommendedStoragePassword = []string{"PBKDF2-SHA2-256", "HKDF(SHA2-256)", "CHACHA20-POLY1305"}

View file

@ -31,7 +31,7 @@ func Get(name string) (*HashTool, error) {
return hashTool, nil return hashTool, nil
} }
// New returns a new hash.Hash with the given Name // New returns a new hash.Hash with the given name.
func New(name string) (hash.Hash, error) { func New(name string) (hash.Hash, error) {
hashTool, err := Get(name) hashTool, err := Get(name)
if err != nil { if err != nil {

View file

@ -3,7 +3,6 @@ package hashtools
import "testing" import "testing"
func TestAll(t *testing.T) { func TestAll(t *testing.T) {
testData := []byte("The quick brown fox jumps over the lazy dog. ") testData := []byte("The quick brown fox jumps over the lazy dog. ")
all := AsList() all := AsList()

View file

@ -16,10 +16,8 @@ import (
- Data: byte block - Data: byte block
*/ */
var ( // ErrIncompatibleFileFormatVersion is returned when an incompatible wire format is encountered.
// ErrIncompatibleFileFormatVersion is returned when an incompatible wire format is encountered. var ErrIncompatibleFileFormatVersion = errors.New("incompatible file format version")
ErrIncompatibleFileFormatVersion = errors.New("incompatible file format version")
)
// ToFileFormat serializes the letter for storing it as a file. // ToFileFormat serializes the letter for storing it as a file.
func (letter *Letter) ToFileFormat() (*container.Container, error) { func (letter *Letter) ToFileFormat() (*container.Container, error) {

View file

@ -24,10 +24,8 @@ import (
- MAC: byte block - MAC: byte block
*/ */
var ( // ErrIncompatibleWireFormatVersion is returned when an incompatible wire format is encountered.
// ErrIncompatibleWireFormatVersion is returned when an incompatible wire format is encountered. var ErrIncompatibleWireFormatVersion = errors.New("incompatible wire format version")
ErrIncompatibleWireFormatVersion = errors.New("incompatible wire format version")
)
// ToWire serializes to letter for sending it over a network connection. // ToWire serializes to letter for sending it over a network connection.
func (letter *Letter) ToWire() (*container.Container, error) { func (letter *Letter) ToWire() (*container.Container, error) {
@ -87,7 +85,8 @@ func (letter *Letter) ToWire() (*container.Container, error) {
} }
// LetterFromWireData is a relay to LetterFromWire to quickly fix import issues of godep. // LetterFromWireData is a relay to LetterFromWire to quickly fix import issues of godep.
// DEPRECATED //
// Deprecated: Please use LetterFromWire with a fresh container directly.
func LetterFromWireData(data []byte) (*Letter, error) { func LetterFromWireData(data []byte) (*Letter, error) {
return LetterFromWire(container.New(data)) return LetterFromWire(container.New(data))
} }

View file

@ -150,7 +150,7 @@ func (letter *Letter) ToJSON() ([]byte, error) {
return json.Marshal(letter) return json.Marshal(letter)
} }
// LetterFromJSON loads a json-serialized letter // LetterFromJSON loads a json-serialized letter.
func LetterFromJSON(data []byte) (*Letter, error) { func LetterFromJSON(data []byte) (*Letter, error) {
letter := &Letter{} letter := &Letter{}

View file

@ -15,7 +15,6 @@ var (
) )
func testAlgorithm(t *testing.T, alg Algorithm, emptyHex, foxHex string) { func testAlgorithm(t *testing.T, alg Algorithm, emptyHex, foxHex string) {
// setup // setup
emptyBytes, err := hex.DecodeString(emptyHex) emptyBytes, err := hex.DecodeString(emptyHex)
if err != nil { if err != nil {

View file

@ -38,7 +38,6 @@ func SetPasswordCallbacks(
// CalculatePasswordSecurityLevel calculates the security level of the given password and iterations of the pbkdf algorithm. // CalculatePasswordSecurityLevel calculates the security level of the given password and iterations of the pbkdf algorithm.
func CalculatePasswordSecurityLevel(password string, iterations int) int { func CalculatePasswordSecurityLevel(password string, iterations int) int {
// TODO: this calculation is pretty conservative and errs on the safe side // TODO: this calculation is pretty conservative and errs on the safe side
// maybe soften this up a litte, but couldn't find any scientific foundation for that // maybe soften this up a litte, but couldn't find any scientific foundation for that

View file

@ -5,7 +5,7 @@ import (
"strings" "strings"
) )
// Security requirements of a letter // Security requirements of a letter.
const ( const (
Confidentiality uint8 = iota Confidentiality uint8 = iota
Integrity Integrity

View file

@ -10,7 +10,6 @@ func checkNoSpec(t *testing.T, a *Requirements, expectedNoSpec string) {
} }
func TestRequirements(t *testing.T) { func TestRequirements(t *testing.T) {
a := NewRequirements() a := NewRequirements()
checkNoSpec(t, a, "") checkNoSpec(t, a, "")

View file

@ -40,14 +40,14 @@ type WireSession struct { //nolint:maligned // TODO
newKeyMaterial [][]byte newKeyMaterial [][]byte
} }
// kxPair is key exchange pair // kxPair is key exchange pair.
type kxPair struct { type kxPair struct {
tool tools.ToolLogic tool tools.ToolLogic
signet *Signet signet *Signet
peer *Signet peer *Signet
} }
// kePair is key encapsulation "pair" // kePair is key encapsulation "pair".
type kePair struct { type kePair struct {
tool tools.ToolLogic tool tools.ToolLogic
signet *Signet signet *Signet

View file

@ -48,7 +48,7 @@ type managedHasher struct {
hash hash.Hash hash hash.Hash
} }
// Sum returns the hash sum of the managed hasher // Sum returns the hash sum of the managed hasher.
func (sh *managedHasher) Sum() ([]byte, error) { func (sh *managedHasher) Sum() ([]byte, error) {
if sh == nil || sh.hash == nil { if sh == nil || sh.hash == nil {
return nil, errors.New("managed hasher is broken") return nil, errors.New("managed hasher is broken")

View file

@ -12,7 +12,7 @@ import (
uuid "github.com/satori/go.uuid" uuid "github.com/satori/go.uuid"
) )
// Special signet types // Special signet types.
const ( const (
SignetSchemePassword = "pw" SignetSchemePassword = "pw"
SignetSchemeKey = "key" SignetSchemeKey = "key"
@ -176,7 +176,7 @@ func (signet *Signet) LoadKey() error {
return signet.tool.StaticLogic.LoadKey(signet) return signet.tool.StaticLogic.LoadKey(signet)
} }
// Tool returns the tool of the signet // Tool returns the tool of the signet.
func (signet *Signet) Tool() (*tools.Tool, error) { func (signet *Signet) Tool() (*tools.Tool, error) {
// load tool // load tool
err := signet.loadTool() err := signet.loadTool()

View file

@ -1,6 +1,6 @@
package jess package jess
// Suite status options // Suite status options.
const ( const (
SuiteStatusDeprecated uint8 = 0 SuiteStatusDeprecated uint8 = 0
SuiteStatusPermitted uint8 = 1 SuiteStatusPermitted uint8 = 1

View file

@ -91,7 +91,6 @@ func TestSuites(t *testing.T) {
} }
} }
} }
func suiteBullshitCheck(suite *Suite) error { //nolint:gocognit,gocyclo func suiteBullshitCheck(suite *Suite) error { //nolint:gocognit,gocyclo

View file

@ -7,7 +7,6 @@ import (
) )
func TestSupply(t *testing.T) { func TestSupply(t *testing.T) {
total := 10 total := 10
supply := NewSignetSupply(total) supply := NewSignetSupply(total)
scheme := "ECDH-X25519" scheme := "ECDH-X25519"

73
test
View file

@ -4,21 +4,21 @@ warnings=0
errors=0 errors=0
scripted=0 scripted=0
goUp="\\e[1A" goUp="\\e[1A"
all=0
fullTestFlags="-short" fullTestFlags="-short"
install=0 install=0
testonly=0
function help { function help {
echo "usage: $0 [command] [options]" echo "usage: $0 [command] [options]"
echo "" echo ""
echo "commands:" echo "commands:"
echo " <none> run baseline tests" echo " <none> run baseline tests"
echo " all run all tests" echo " full run full tests (ie. not short)"
echo " install install deps for running baseline tests" echo " install install deps for running tests"
echo " install all install deps for running all tests"
echo "" echo ""
echo "options:" echo "options:"
echo " --scripted dont jump console lines (still use colors)" echo " --scripted dont jump console lines (still use colors)"
echo " --test-only don run linters only tests"
echo " [package] run tests only on this package" echo " [package] run tests only on this package"
} }
@ -94,12 +94,15 @@ while true; do
goUp="" goUp=""
shift 1 shift 1
;; ;;
"--test-only")
testonly=1
shift 1
;;
"install") "install")
install=1 install=1
shift 1 shift 1
;; ;;
"all") "full")
all=1
fullTestFlags="" fullTestFlags=""
shift 1 shift 1
;; ;;
@ -119,10 +122,9 @@ if [[ $install -eq 1 ]]; then
echo "installing dependencies..." echo "installing dependencies..."
echo "$ go get -u golang.org/x/lint/golint" echo "$ go get -u golang.org/x/lint/golint"
go get -u golang.org/x/lint/golint go get -u golang.org/x/lint/golint
if [[ $all -eq 1 ]]; then # TODO: update golangci-lint version regularly
echo "$ go get -u github.com/golangci/golangci-lint/cmd/golangci-lint" echo "$ curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0"
go get -u github.com/golangci/golangci-lint/cmd/golangci-lint curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.24.0
fi
exit 0 exit 0
fi fi
@ -131,24 +133,24 @@ if [[ $(which go) == "" ]]; then
echo "go command not found" echo "go command not found"
exit 1 exit 1
fi fi
if [[ $(which gofmt) == "" ]]; then if [[ $testonly -eq 0 ]]; then
echo "gofmt command not found" if [[ $(which gofmt) == "" ]]; then
exit 1 echo "gofmt command not found"
fi exit 1
if [[ $(which golint) == "" ]]; then fi
echo "golint command not found" if [[ $(which golint) == "" ]]; then
echo "install with: go get -u golang.org/x/lint/golint" echo "golint command not found"
echo "or run: ./test install" echo "install with: go get -u golang.org/x/lint/golint"
exit 1 echo "or run: ./test install"
fi exit 1
if [[ $all -eq 1 ]]; then fi
if [[ $(which golangci-lint) == "" ]]; then if [[ $(which golangci-lint) == "" ]]; then
echo "golangci-lint command not found" echo "golangci-lint command not found"
echo "install locally with: go get -u github.com/golangci/golangci-lint/cmd/golangci-lint" echo "install with: curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin vX.Y.Z"
echo "or run: ./test install all"
echo ""
echo "hint: install for CI with: curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin vX.Y.Z"
echo "don't forget to specify the version you want" echo "don't forget to specify the version you want"
echo "or run: ./test install"
echo ""
echo "alternatively, install the current dev version with: go get -u github.com/golangci/golangci-lint/cmd/golangci-lint"
exit 1 exit 1
fi fi
fi fi
@ -156,15 +158,10 @@ fi
# target selection # target selection
if [[ "$1" == "" ]]; then if [[ "$1" == "" ]]; then
# get all packages # get all packages
packages=$(go list ./...) packages=$(go list -e ./...)
else else
# single package testing # single package testing
packages=$(go list)/$1 packages=$(go list -e)/$1
if [[ ! -d "$GOPATH/src/$packages" ]]; then
echo "go package $packages does not exist"
help
exit 1
fi
echo "note: only running tests for package $packages" echo "note: only running tests for package $packages"
fi fi
@ -174,13 +171,15 @@ echo "running tests for ${platformInfo//$'\n'/ }:"
# run vet/test on packages # run vet/test on packages
for package in $packages; do for package in $packages; do
packagename=${package#github.com/safing/jess} #TODO: could be queried with `go list .`
packagename=${packagename#/}
echo "" echo ""
echo $package echo $package
checkformat $package if [[ $testonly -eq 0 ]]; then
run golint -set_exit_status -min_confidence 1.0 $package checkformat $package
run go vet $package run golint -set_exit_status -min_confidence 1.0 $package
if [[ $all -eq 1 ]]; then run go vet $package
run golangci-lint run $GOPATH/src/$package run golangci-lint run $packagename
fi fi
run go test -cover $fullTestFlags $package run go test -cover $fullTestFlags $package
done done

View file

@ -11,13 +11,11 @@ import (
"github.com/aead/ecdh" "github.com/aead/ecdh"
) )
var ( var nistCurveInfo = &tools.ToolInfo{
nistCurveInfo = &tools.ToolInfo{ Purpose: tools.PurposeKeyExchange,
Purpose: tools.PurposeKeyExchange, Comment: "FIPS 186",
Comment: "FIPS 186", Author: "NIST, 2009",
Author: "NIST, 2009", }
}
)
func init() { func init() {
tools.Register(&tools.Tool{ tools.Register(&tools.Tool{

View file

@ -7,7 +7,6 @@ import (
"github.com/safing/jess/tools" "github.com/safing/jess/tools"
) )
//nolint:dupl
func init() { func init() {
aesCtrInfo := &tools.ToolInfo{ aesCtrInfo := &tools.ToolInfo{
Purpose: tools.PurposeCipher, Purpose: tools.PurposeCipher,

View file

@ -7,7 +7,6 @@ import (
"github.com/safing/jess/tools" "github.com/safing/jess/tools"
) )
//nolint:dupl
func init() { func init() {
aesGcmInfo := &tools.ToolInfo{ aesGcmInfo := &tools.ToolInfo{
Purpose: tools.PurposeIntegratedCipher, Purpose: tools.PurposeIntegratedCipher,

View file

@ -30,7 +30,7 @@ type ToolInfo struct {
Author string Author string
} }
// Tool Purpose // Tool Purposes.
const ( const (
// Key Management and Creation, as well as Authenticity // Key Management and Creation, as well as Authenticity
@ -71,7 +71,7 @@ const (
PurposeMAC PurposeMAC
) )
// Tool Options // Tool Options.
const ( const (
// Operation // Operation

View file

@ -15,7 +15,6 @@ import (
) )
func TestConformity(t *testing.T) { func TestConformity(t *testing.T) {
// Test that every tool only provides one primary feature, as this enables to automatically assign a distinct role to every tool. // Test that every tool only provides one primary feature, as this enables to automatically assign a distinct role to every tool.
for _, tool := range tools.AsList() { for _, tool := range tools.AsList() {
@ -34,7 +33,6 @@ func TestConformity(t *testing.T) {
} }
} }
} }
func TestPasswordHashingSpeed(t *testing.T) { func TestPasswordHashingSpeed(t *testing.T) {
@ -249,5 +247,4 @@ func TestSignetHandling(t *testing.T) {
} }
} }
} }
} }

View file

@ -6,14 +6,14 @@ import (
"sync" "sync"
) )
// TrustStore filter options // TrustStore filter options.
const ( const (
FilterAny uint8 = iota FilterAny uint8 = iota
FilterSignetOnly FilterSignetOnly
FilterRecipientOnly FilterRecipientOnly
) )
// TrustStore errors // TrustStore errors.
var ( var (
ErrSignetNotFound = errors.New("could not find signet") ErrSignetNotFound = errors.New("could not find signet")
ErrEnvelopeNotFound = errors.New("could not find envelope") ErrEnvelopeNotFound = errors.New("could not find envelope")

View file

@ -18,7 +18,7 @@ const (
permittedCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789- ._+@" permittedCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789- ._+@"
) )
// TrustStore errors // TrustStore errors.
var ( var (
errInvalidSignetIDChars = fmt.Errorf("this trust store only allows these characters in signet IDs: %s", permittedCharacters) errInvalidSignetIDChars = fmt.Errorf("this trust store only allows these characters in signet IDs: %s", permittedCharacters)
errInvalidEnvelopeNameChars = fmt.Errorf("this trust store only allows these characters in envelope names: %s", permittedCharacters) errInvalidEnvelopeNameChars = fmt.Errorf("this trust store only allows these characters in envelope names: %s", permittedCharacters)