fix(lint): audit gosec G106/G402 insecure TLS sites

cmd/pro/start.go

@@ -1260,7 +1260,7 @@ func (cmd *StartCmd) pingLoftRouter(ctx context.Context, loftPod *corev1.Pod) (s
 	httpClient := &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
-				InsecureSkipVerify: true,
+				InsecureSkipVerify: true, // #nosec G402 -- self-signed cert of the user's own pro instance
 			},
 		},
 	}
@@ -1378,7 +1378,9 @@ func (cmd *StartCmd) loginViaCLI(url string) error {
 	}
 	loginRequestBuf := bytes.NewBuffer(loginRequestBytes)
 	tr := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+		TLSClientConfig: &tls.Config{
+			InsecureSkipVerify: true, // #nosec G402 -- self-signed cert of the user's own pro instance
+		},
 	}
 	httpClient := &http.Client{Transport: tr}
 
@@ -1965,7 +1967,9 @@ func isHostReachable(ctx context.Context, host string) (bool, error) {
 	transport := http.DefaultTransport.(*http.Transport).Clone()
 	// we disable http2 as Kubernetes has problems with this
 	transport.ForceAttemptHTTP2 = false
-	transport.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
+	transport.TLSClientConfig = &tls.Config{
+		InsecureSkipVerify: true, // #nosec G402 -- self-signed cert of the user's own pro instance
+	}
 	// wait until loft is reachable at the given url
 	client := &http.Client{Transport: transport}
 	url := "https://" + host + "/version"

pkg/ssh/helper.go

@@ -13,7 +13,7 @@ import (
 func NewSSHPassClient(user, addr, password string) (*ssh.Client, error) {
 	clientConfig := &ssh.ClientConfig{
 		Auth:            []ssh.AuthMethod{},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 -- agent-managed SSH server inside its own workspace
 	}
 
 	clientConfig.Auth = append(clientConfig.Auth, ssh.Password(password))
@@ -86,7 +86,7 @@ func StdioClientFromKeyBytesWithUser(
 func ConfigFromKeyBytes(keyBytes []byte) (*ssh.ClientConfig, error) {
 	clientConfig := &ssh.ClientConfig{
 		Auth:            []ssh.AuthMethod{},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 -- agent-managed SSH server inside its own workspace
 	}
 
 	// key file authentication?

pkg/ts/derp.go

@@ -17,7 +17,7 @@ type ConnTrackingFunc func(address string)
 func CheckDerpConnection(ctx context.Context, baseUrl *url.URL) error {
 	newTransport := http.DefaultTransport.(*http.Transport).Clone()
 	newTransport.TLSClientConfig = &tls.Config{
-		InsecureSkipVerify: true,
+		InsecureSkipVerify: true, // #nosec G402 -- reachability probe of our own coordinator; no data exchanged
 	}
 
 	client := &http.Client{

pkg/ts/ssh.go

@@ -56,8 +56,8 @@
 
 	clientConfig := &ssh.ClientConfig{
 		User:            user,
-		Auth:            []ssh.AuthMethod{}, // The SSH server is only reachable through the tailnet
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+		Auth:            []ssh.AuthMethod{},          // The SSH server is only reachable through the tailnet
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // #nosec G106 -- workspace agent server reachable only through the encrypted tailnet
 	}
 
 	sshConn, channels, requests, err := ssh.NewClientConn(conn, address, clientConfig)