Go update

.github/workflows/run_tests.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           cache: true
 
       - name: Update Go modules
@@ -55,14 +55,14 @@ jobs:
     strategy:
       matrix:
         os: [ ubuntu-20.04, windows-2022 ]
-        go_versions: [ '1.19', '1.20', '1.21' ]
+        go_versions: [ '1.20', '1.21', '1.22' ]
         exclude:
-          - os: windows-2022
-            go_versions: '1.19'
           - os: windows-2022
             go_versions: '1.20'
-          - os: ubuntu-20.04
+          - os: windows-2022
             go_versions: '1.21'
+          - os: ubuntu-20.04
+            go_versions: '1.22'
       fail-fast: false
     steps:
       - uses: actions/checkout@v3

go.mod

@@ -1,10 +1,10 @@
 module github.com/nspcc-dev/tzhash
 
-go 1.19
+go 1.20
 
 require (
 	github.com/stretchr/testify v1.8.4
-	golang.org/x/sys v0.12.0
+	golang.org/x/sys v0.17.0
 )
 
 require (

go.sum

@@ -4,8 +4,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
+golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

tz/digest.go

@@ -38,9 +38,7 @@ func Sum(data []byte) [Size]byte {
 
 // Sum implements hash.Hash.
 func (d *digest) Sum(in []byte) []byte {
-	// Make a copy of d so that caller can keep writing and summing.
-	d0 := *d
-	h := d0.checkSum()
+	h := d.checkSum()
 	return append(in, h[:]...)
 }
 

tz/hash.go

@@ -5,7 +5,9 @@
 package tz
 
 import (
+	"crypto/subtle"
 	"errors"
+	"fmt"
 )
 
 // Concat performs combining of hashes based on homomorphic property.
@@ -25,9 +27,8 @@ func Concat(hs [][]byte) ([]byte, error) {
 // Validate checks if hashes in hs combined are equal to h.
 func Validate(h []byte, hs [][]byte) (bool, error) {
 	var (
-		b             []byte
-		got, expected [Size]byte
-		err           error
+		b   []byte
+		err error
 	)
 
 	if len(h) != Size {
@@ -36,16 +37,12 @@ func Validate(h []byte, hs [][]byte) (bool, error) {
 		return false, errors.New("empty slice")
 	}
 
-	copy(expected[:], h)
-
 	b, err = Concat(hs)
 	if err != nil {
-		return false, errors.New("cant concatenate hashes")
+		return false, fmt.Errorf("can't concatenate hashes: %w", err)
 	}
 
-	copy(got[:], b)
-
-	return expected == got, nil
+	return subtle.ConstantTimeCompare(h, b) == 1, nil
 }
 
 // SubtractR returns hash a, such that Concat(a, b) == c

tz/hash_test.go

@@ -145,7 +145,7 @@ func TestHomomorphism(t *testing.T) {
 	)
 
 	b = make([]byte, 64)
-	n, err = rand.Read(b)
+	n, err = rand.Read(b) //nolint:staticcheck // SA1019: rand.Read has been deprecated since Go 1.20 because it shouldn't be used
 	require.Equal(t, 64, n)
 	require.NoError(t, err)
 

tz/sl2_test.go

@@ -10,7 +10,7 @@ import (
 )
 
 func init() {
-	rand.Seed(time.Now().UnixNano())
+	rand.Seed(time.Now().UnixNano()) //nolint:staticcheck // SA1019: rand.Seed has been deprecated since Go 1.20 and an alternative has been available since Go 1.0
 }
 
 func random() (a *sl2) {