From ed26a90f7f22cf9fd29a2dee446aa1b97807413c Mon Sep 17 00:00:00 2001
From: Samuel K <skevetter@pm.me>
Date: Wed, 26 Aug 2026 06:21:09 +0000
Subject: [PATCH] fix(lint): audit gosec G106/G402 insecure TLS sites

Annotate seven self-owned-infrastructure sites with documented
nosec rationale: SSH host key checks target agent-managed servers
reachable only through the tailnet/workspace, and InsecureSkipVerify
targets reachability probes and login flows against the user's own
pro instance which uses a self-signed certificate.
---
 cmd/pro/start.go  | 10 +++++++---
 pkg/ssh/helper.go |  4 ++--
 pkg/ts/derp.go    |  2 +-
 pkg/ts/ssh.go     |  4 ++--
 4 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/cmd/pro/start.go b/cmd/pro/start.go
index c874b2d1b..1c3450bd1 100644
--- a/cmd/pro/start.go
+++ b/cmd/pro/start.go
@@ -1260,7 +1260,7 @@ func (cmd *StartCmd) pingLoftRouter(ctx context.Context, loftPod *corev1.Pod) (s
 	httpClient := &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
-				InsecureSkipVerify: true,
+				InsecureSkipVerify: true, // #nosec G402 -- self-signed cert of the user's own pro instance
 			},
 		},
 	}
@@ -1378,7 +1378,9 @@ func (cmd *StartCmd) loginViaCLI(url string) error {
 	}
 	loginRequestBuf := bytes.NewBuffer(loginRequestBytes)
 	tr := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: true, // #nosec G402 -- self-signed cert of the user's own pro instance
+		},
 	}
 	httpClient := &http.Client{Transport: tr}
 
@@ -1965,7 +1967,9 @@ func isHostReachable(ctx context.Context, host string) (bool, error) {
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	// we disable http2 as Kubernetes has problems with this
 	transport.ForceAttemptHTTP2 = false
-	transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	transport.TLSClientConfig = &tls.Config{
+		InsecureSkipVerify: true, // #nosec G402 -- self-signed cert of the user's own pro instance
+	}
 	// wait until loft is reachable at the given url
 	client := &http.Client{Transport: transport}
 	url := "https://" + host + "/version"
diff --git a/pkg/ssh/helper.go b/pkg/ssh/helper.go
index 3c6de53d9..9a7787b3b 100644
--- a/pkg/ssh/helper.go
+++ b/pkg/ssh/helper.go
@@ -13,7 +13,7 @@ import (
 func NewSSHPassClient(user, addr, password string) (*ssh.Client, error) {
 	clientConfig := &ssh.ClientConfig{
 		Auth:            []ssh.AuthMethod{},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 -- agent-managed SSH server inside its own workspace
 	}
 
 	clientConfig.Auth = append(clientConfig.Auth, ssh.Password(password))
@@ -86,7 +86,7 @@ func StdioClientFromKeyBytesWithUser(
 func ConfigFromKeyBytes(keyBytes []byte) (*ssh.ClientConfig, error) {
 	clientConfig := &ssh.ClientConfig{
 		Auth:            []ssh.AuthMethod{},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 -- agent-managed SSH server inside its own workspace
 	}
 
 	// key file authentication?
diff --git a/pkg/ts/derp.go b/pkg/ts/derp.go
index 9370f9a22..0a0557a19 100644
--- a/pkg/ts/derp.go
+++ b/pkg/ts/derp.go
@@ -17,7 +17,7 @@ type ConnTrackingFunc func(address string)
 func CheckDerpConnection(ctx context.Context, baseUrl *url.URL) error {
 	newTransport := http.DefaultTransport.(*http.Transport).Clone()
 	newTransport.TLSClientConfig = &tls.Config{
-		InsecureSkipVerify: true,
+		InsecureSkipVerify: true, // #nosec G402 -- reachability probe of our own coordinator; no data exchanged
 	}
 
 	client := &http.Client{
diff --git a/pkg/ts/ssh.go b/pkg/ts/ssh.go
index e6357c089..632198011 100644
--- a/pkg/ts/ssh.go
+++ b/pkg/ts/ssh.go
@@ -56,8 +56,8 @@ func newSSHClient(
 
 	clientConfig := &ssh.ClientConfig{
 		User:            user,
-		Auth:            []ssh.AuthMethod{}, // The SSH server is only reachable through the tailnet
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		Auth:            []ssh.AuthMethod{},          // The SSH server is only reachable through the tailnet
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 -- workspace agent server reachable only through the encrypted tailnet
 	}
 
 	sshConn, channels, requests, err := ssh.NewClientConn(conn, address, clientConfig)