fix: resolve gosec G404 and G101 findings

pkg/config/context.go

@@ -10,8 +10,8 @@
 	ContextOptionSSHAddPrivateKeys          = "SSH_ADD_PRIVATE_KEYS"
 	ContextOptionGPGAgentForwarding         = "GPG_AGENT_FORWARDING"
 	ContextOptionGitSSHSignatureForwarding  = "GIT_SSH_SIGNATURE_FORWARDING"
-	ContextOptionSSHInjectDockerCredentials = "SSH_INJECT_DOCKER_CREDENTIALS"
-	ContextOptionSSHInjectGitCredentials    = "SSH_INJECT_GIT_CREDENTIALS"
+	ContextOptionSSHInjectDockerCredentials = "SSH_INJECT_DOCKER_CREDENTIALS" //nolint:gosec // G101: context option name, not a credential
+	ContextOptionSSHInjectGitCredentials    = "SSH_INJECT_GIT_CREDENTIALS"    //nolint:gosec // G101: context option name, not a credential
 	ContextOptionExitAfterTimeout           = "EXIT_AFTER_TIMEOUT"
 	ContextOptionTelemetry                  = "TELEMETRY"
 	ContextOptionAgentURL                   = "AGENT_URL"

pkg/image/auth.go

@@ -24,7 +24,7 @@
 	)
 )
 
-const tokenFileLocation = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+const tokenFileLocation = "/var/run/secrets/kubernetes.io/serviceaccount/token" //nolint:gosec // G101: projected service account token file path, not a credential
 
 // See https://github.com/kubernetes/kubernetes/blob/30ae12d018697d3c5f04e225b11f242f5310e097/pkg/serviceaccount/claims.go#L55
 type privateClaims struct {

pkg/random/random.go

@@ -1,14 +1,17 @@
 package random
 
-import "math/rand"
+import (
+	"crypto/rand"
+	"math/big"
+)
 
 var letterRunes = []rune("abcdefghijklmnopqrstuvwxyz")
 
 // String creates a new random string with the given length.
 func String(length int) string {
 	b := make([]rune, length)
 	for i := range b {
-		b[i] = letterRunes[rand.Intn(len(letterRunes))]
+		b[i] = letterRunes[randInt(len(letterRunes))]
 	}
 	return string(b)
 }
@@ -17,5 +20,14 @@
 	if max <= min {
 		return min
 	}
-	return rand.Intn(max-min) + min
+	return randInt(max-min) + min
+}
+
+// randInt returns a cryptographically secure random int in [0, max).
+func randInt(max int) int {
+	n, err := rand.Int(rand.Reader, big.NewInt(int64(max)))
+	if err != nil {
+		panic("crypto/rand failed: " + err.Error())
+	}
+	return int(n.Int64())
 }

pkg/util/rand.go

@@ -1,15 +1,25 @@
 package util
 
 import (
-	"math/rand"
+	"crypto/rand"
+	"math/big"
 )
 
 const letterBytes = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
 
 func RandStringBytes(n int) string {
 	b := make([]byte, n)
 	for i := range b {
-		b[i] = letterBytes[rand.Intn(len(letterBytes))]
+		b[i] = letterBytes[randInt(len(letterBytes))]
 	}
 	return string(b)
 }
+
+// randInt returns a cryptographically secure random int in [0, max).
+func randInt(max int) int {
+	n, err := rand.Int(rand.Reader, big.NewInt(int64(max)))
+	if err != nil {
+		panic("crypto/rand failed: " + err.Error())
+	}
+	return int(n.Int64())
+}