chore: enable all rules from perfsprint

.golangci.yaml

@@ -83,15 +83,15 @@ linters-settings:
       - simmilar
   perfsprint:
     # Optimizes even if it requires an int or uint type cast.
-    int-conversion: false
+    int-conversion: true
     # Optimizes into `err.Error()` even if it is only equivalent for non-nil errors.
     err-error: true
     # Optimizes `fmt.Errorf`.
     errorf: true
     # Optimizes `fmt.Sprintf` with only one argument.
-    sprintf1: false
+    sprintf1: true
     # Optimizes into strings concatenation.
-    strconcat: false
+    strconcat: true
   revive:
     ignore-generated-header: true
   testifylint:
@@ -152,8 +152,5 @@ issues:
       linters:
         - gocritic
       text: "importShadow:"
-    - linters:
-        - perfsprint
-      text: "fmt.Sprint"
   exclude-use-default: false
   max-same-issues: 0

magefiles/magefile.go

@@ -54,7 +54,7 @@ func buildLdflags() (string, error) {
 	if err != nil {
 		return "", err
 	}
-	return fmt.Sprintf("-s -w -X=github.com/aquasecurity/trivy/pkg/version/app.ver=%s", ver), nil
+	return "-s -w -X=github.com/aquasecurity/trivy/pkg/version/app.ver=" + ver, nil
 }
 
 type Tool mg.Namespace

pkg/cache/redis_test.go

@@ -66,7 +66,7 @@ func TestRedisCache_PutArtifact(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			err = c.PutArtifact(tt.args.artifactID, tt.args.artifactConfig)
@@ -152,7 +152,7 @@ func TestRedisCache_PutBlob(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			err = c.PutBlob(tt.args.blobID, tt.args.blobConfig)
@@ -234,7 +234,7 @@ func TestRedisCache_GetArtifact(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			got, err := c.GetArtifact(tt.artifactID)
@@ -324,7 +324,7 @@ func TestRedisCache_GetBlob(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			got, err := c.GetBlob(tt.blobID)
@@ -433,7 +433,7 @@ func TestRedisCache_MissingBlobs(t *testing.T) {
 				addr = "dummy:6379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			missingArtifact, missingBlobIDs, err := c.MissingBlobs(tt.args.artifactID, tt.args.blobIDs)
@@ -456,7 +456,7 @@ func TestRedisCache_Close(t *testing.T) {
 	defer s.Close()
 
 	t.Run("close", func(t *testing.T) {
-		c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", s.Addr()), "", "", "", false, 0)
+		c, err := cache.NewRedisCache("redis://"+s.Addr(), "", "", "", false, 0)
 		require.NoError(t, err)
 
 		closeErr := c.Close()
@@ -478,7 +478,7 @@ func TestRedisCache_Clear(t *testing.T) {
 	s.Set("foo", "bar")
 
 	t.Run("clear", func(t *testing.T) {
-		c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", s.Addr()), "", "", "", false, 0)
+		c, err := cache.NewRedisCache("redis://"+s.Addr(), "", "", "", false, 0)
 		require.NoError(t, err)
 
 		require.NoError(t, c.Clear())
@@ -532,7 +532,7 @@ func TestRedisCache_DeleteBlobs(t *testing.T) {
 				addr = "dummy:16379"
 			}
 
-			c, err := cache.NewRedisCache(fmt.Sprintf("redis://%s", addr), "", "", "", false, 0)
+			c, err := cache.NewRedisCache("redis://"+addr, "", "", "", false, 0)
 			require.NoError(t, err)
 
 			err = c.DeleteBlobs(tt.args.blobIDs)

pkg/commands/app.go

@@ -136,7 +136,7 @@ func loadPluginCommands() []*cobra.Command {
 	for _, p := range plugins {
 		p := p
 		cmd := &cobra.Command{
-			Use:     fmt.Sprintf("%s [flags]", p.Name),
+			Use:     p.Name + " [flags]",
 			Short:   p.Summary,
 			Long:    p.Description,
 			GroupID: groupPlugin,

pkg/commands/artifact/run.go

@@ -341,16 +341,13 @@ func Run(ctx context.Context, opts flag.Options, targetKind TargetKind) (err err
 	defer func() {
 		if errors.Is(err, context.DeadlineExceeded) {
 			// e.g. https://aquasecurity.github.io/trivy/latest/docs/configuration/
-			log.WarnContext(ctx, fmt.Sprintf("Provide a higher timeout value, see %s", doc.URL("/docs/configuration/", "")))
+			log.WarnContext(ctx, "Provide a higher timeout value, see "+doc.URL("/docs/configuration/", ""))
 		}
 	}()
 
 	if opts.ServerAddr != "" && opts.Scanners.AnyEnabled(types.MisconfigScanner, types.SecretScanner) {
 		log.WarnContext(ctx,
-			fmt.Sprintf(
-				"Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see %s",
-				doc.URL("/docs/references/modes/client-server", ""),
-			),
+			"Trivy runs in client/server mode, but misconfiguration and license scanning will be done on the client side, see "+doc.URL("/docs/references/modes/client-server", ""),
 		)
 	}
 

pkg/dependency/id.go

@@ -1,7 +1,7 @@
 package dependency
 
 import (
-	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/mitchellh/hashstructure/v2"
@@ -52,5 +52,5 @@ func UID(filePath string, pkg types.Package) string {
 	if err != nil {
 		log.Warn("Failed to calculate the package hash", log.String("pkg", pkg.Name), log.Err(err))
 	}
-	return fmt.Sprintf("%x", hash)
+	return strconv.FormatUint(hash, 16)
 }

pkg/dependency/parser/golang/binary/parse.go

@@ -3,7 +3,6 @@ package binary
 import (
 	"cmp"
 	"debug/buildinfo"
-	"fmt"
 	"runtime/debug"
 	"slices"
 	"sort"
@@ -60,7 +59,7 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
 	stdlibVersion := strings.TrimPrefix(info.GoVersion, "go")
 	stdlibVersion, _, _ = strings.Cut(stdlibVersion, " ")
 	// Add the `v` prefix to be consistent with module and dependency versions.
-	stdlibVersion = fmt.Sprintf("v%s", stdlibVersion)
+	stdlibVersion = "v" + stdlibVersion
 
 	ldflags := p.ldFlags(info.Settings)
 	pkgs := make(ftypes.Packages, 0, len(info.Deps)+2)

pkg/dependency/parser/golang/mod/parse.go

@@ -1,7 +1,6 @@
 package mod
 
 import (
-	"fmt"
 	"io"
 	"regexp"
 	"sort"
@@ -96,7 +95,7 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependenc
 				Name: "stdlib",
 				// Our versioning library doesn't support canonical (goX.Y.Z) format,
 				// So we need to add `v` prefix for consistency (with module and dependency versions).
-				Version:      fmt.Sprintf("v%s", toolchainVer),
+				Version:      "v" + toolchainVer,
 				Relationship: ftypes.RelationshipDirect, // Considered a direct dependency as the main module depends on the standard packages.
 			}
 		}

pkg/dependency/parser/java/pom/artifact.go

@@ -170,7 +170,7 @@ func evaluateVariable(s string, props map[string]string, seenProps []string) str
 func printLoopedPropertiesStack(env string, usedProps []string) {
 	var s string
 	for _, prop := range usedProps {
-		s += fmt.Sprintf("%s -> ", prop)
+		s += prop + " -> "
 	}
 	log.Warn("Lopped properties were detected", log.String("prop", s+env))
 }

pkg/dependency/parser/java/pom/pom.go

@@ -69,7 +69,7 @@ func (p *pom) projectProperties() map[string]string {
 		}
 
 		// e.g. ${project.groupId}
-		key := fmt.Sprintf("project.%s", k)
+		key := "project." + k
 		projectProperties[key] = v
 
 		// It is deprecated, but still available.

pkg/dependency/parser/ruby/gemspec/parse.go

@@ -2,7 +2,6 @@ package gemspec
 
 import (
 	"bufio"
-	"fmt"
 	"regexp"
 	"strings"
 
@@ -64,19 +63,19 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) (pkgs []ftypes.Package, deps []ftypes
 
 		// Capture name, version, license, and licenses
 		switch {
-		case strings.HasPrefix(line, fmt.Sprintf("%s.name", newVar)):
+		case strings.HasPrefix(line, newVar+".name"):
 			// https://guides.rubygems.org/specification-reference/#name
 			name = findSubString(nameRegexp, line, "name")
 			name = trim(name)
-		case strings.HasPrefix(line, fmt.Sprintf("%s.version", newVar)):
+		case strings.HasPrefix(line, newVar+".version"):
 			// https://guides.rubygems.org/specification-reference/#version
 			version = findSubString(versionRegexp, line, "version")
 			version = trim(version)
-		case strings.HasPrefix(line, fmt.Sprintf("%s.licenses", newVar)):
+		case strings.HasPrefix(line, newVar+".licenses"):
 			// https://guides.rubygems.org/specification-reference/#licenses=
 			license = findSubString(licensesRegexp, line, "licenses")
 			license = parseLicenses(license)
-		case strings.HasPrefix(line, fmt.Sprintf("%s.license", newVar)):
+		case strings.HasPrefix(line, newVar+".license"):
 			// https://guides.rubygems.org/specification-reference/#license=
 			license = findSubString(licenseRegexp, line, "license")
 			license = trim(license)

pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go

@@ -98,7 +98,7 @@ func (a *historyAnalyzer) Analyze(ctx context.Context, input analyzer.ConfigAnal
 	}
 
 	if !userFound && input.Config.Config.User != "" {
-		user := fmt.Sprintf("USER %s", input.Config.Config.User)
+		user := "USER " + input.Config.Config.User
 		dockerfile.WriteString(user)
 	}
 

pkg/fanal/analyzer/language/rust/cargo/cargo.go

@@ -3,7 +3,6 @@ package cargo
 import (
 	"context"
 	"errors"
-	"fmt"
 	"io"
 	"io/fs"
 	"maps"
@@ -238,7 +237,7 @@ func (a cargoAnalyzer) matchVersion(currentVersion, constraint string) (bool, er
 	//   - 1.2.* -> 1.2.*
 	//   - ^1.2  -> ^1.2
 	if _, err := goversion.Parse(constraint); err == nil {
-		constraint = fmt.Sprintf("^%s", constraint)
+		constraint = "^" + constraint
 	}
 
 	ver, err := semver.Parse(currentVersion)

pkg/fanal/analyzer/secret/secret.go

@@ -3,7 +3,6 @@ package secret
 import (
 	"bytes"
 	"context"
-	"fmt"
 	"io"
 	"os"
 	"path/filepath"
@@ -131,7 +130,7 @@ func (a *SecretAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInput
 	// Also, paths to these files do not have "/" prefix.
 	// We need to add a "/" prefix to properly filter paths from the config file.
 	if input.Dir == "" { // add leading `/` for files extracted from image
-		filePath = fmt.Sprintf("/%s", filePath)
+		filePath = "/" + filePath
 	}
 
 	result := a.scanner.Scan(secret.ScanArgs{

pkg/fanal/applier/docker.go

@@ -115,7 +115,7 @@ func ApplyLayers(layers []ftypes.BlobInfo) ftypes.ArtifactDetail {
 
 		// Apply OS packages
 		for _, pkgInfo := range layer.PackageInfos {
-			key := fmt.Sprintf("%s/type:ospkg", pkgInfo.FilePath)
+			key := pkgInfo.FilePath + "/type:ospkg"
 			nestedMap.SetByString(key, sep, pkgInfo)
 		}
 
@@ -131,7 +131,7 @@ func ApplyLayers(layers []ftypes.BlobInfo) ftypes.ArtifactDetail {
 				Digest: layer.Digest,
 				DiffID: layer.DiffID,
 			}
-			key := fmt.Sprintf("%s/type:config", config.FilePath)
+			key := config.FilePath + "/type:config"
 			nestedMap.SetByString(key, sep, config)
 		}
 

pkg/fanal/image/daemon/image_test.go

@@ -1,7 +1,6 @@
 package daemon
 
 import (
-	"fmt"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -33,7 +32,7 @@ func TestMain(m *testing.M) {
 	te := engine.NewDockerEngine(opt)
 	defer te.Close()
 
-	os.Setenv("DOCKER_HOST", fmt.Sprintf("tcp://%s", te.Listener.Addr().String()))
+	os.Setenv("DOCKER_HOST", "tcp://"+te.Listener.Addr().String())
 
 	os.Exit(m.Run())
 }