From 2b8006615eea6770cd42b42b7fd227876f4b45a8 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Tue, 5 May 2026 14:45:08 +0200
Subject: [PATCH 1/3] treewide: fix modernize findings

---
 cli/main.go         | 2 +-
 coordinator/main.go | 6 ++----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/cli/main.go b/cli/main.go
index 46137e8c94e..5c41877d5f7 100644
--- a/cli/main.go
+++ b/cli/main.go
@@ -42,7 +42,7 @@ func buildVersionString() (string, error) {
 
 	fmt.Fprintf(versionsWriter, "container image versions:\n")
 	imageReplacements := strings.Trim(string(cmd.ReleaseImageReplacements), "\n")
-	for _, image := range strings.Split(imageReplacements, "\n") {
+	for image := range strings.SplitSeq(imageReplacements, "\n") {
 		if !strings.HasPrefix(image, "#") {
 			image = strings.Split(image, "=")[1]
 			fmt.Fprintf(versionsWriter, "\t%s\n", image)
diff --git a/coordinator/main.go b/coordinator/main.go
index e88ed24ab94..9696b2261f8 100644
--- a/coordinator/main.go
+++ b/coordinator/main.go
@@ -314,9 +314,7 @@ func newGRPCServer(credentials credentials.TransportCredentials, serverMetrics *
 }
 
 func gracefulStopGRPC(ctx context.Context, wg *sync.WaitGroup, server *grpc.Server) {
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
+	wg.Go(func() {
 		cleanupDone := make(chan struct{})
 		go func() {
 			server.GracefulStop()
@@ -327,5 +325,5 @@ func gracefulStopGRPC(ctx context.Context, wg *sync.WaitGroup, server *grpc.Serv
 			server.Stop()
 		case <-cleanupDone:
 		}
-	}()
+	})
 }

From d3d7846f18c616c164ff0b1721aa93d2751a1b1d Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Tue, 5 May 2026 14:45:27 +0200
Subject: [PATCH 2/3] scripts: pass tags to modernize

Both `go fix` and `modernize` use the GOFLAGS environment variable, so
we don't need to specify a flag for it.
---
 packages/scripts.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/packages/scripts.nix b/packages/scripts.nix
index 08ef5536ad2..6490425bab5 100644
--- a/packages/scripts.nix
+++ b/packages/scripts.nix
@@ -110,18 +110,16 @@ lib.makeScope pkgs.newScope (scripts: {
     text = ''
       exitcode=0
 
-      tags="${lib.concatStringsSep "," contrastPkgs.contrast.contrast.tags}"
+      export GOFLAGS="-tags=${lib.concatStringsSep "," contrastPkgs.contrast.contrast.tags}"
+
       while IFS= read -r dir; do
-        echo "Running go fix -tags $tags on $dir"
-        go fix -C "$dir" -tags "$tags" ./... || exitcode=$?
+        echo "Running go fix on $dir"
+        go fix -C "$dir" ./... || exitcode=$?
       done < <(go list -f '{{.Dir}}' -m)
 
-      # TODO(katexochen): modernize does not support tags?
-      # The run will fail for packages that contain only code with build tags,
-      # thus we ignore the exit code.
       while IFS= read -r dir; do
         echo "Running modernize on $dir"
-        (cd "$dir" && modernize -fix ./...) || true
+        (cd "$dir" && modernize -fix ./...) || exitcode=$?
       done < <(go list -f '{{.Dir}}' -m)
 
       exit $exitcode

From 5fc654f43f593f9f921495e68eba1e814443f5a0 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Tue, 5 May 2026 18:15:59 +0200
Subject: [PATCH 3/3] scripts: gofix: set CGO_ENABLED=0

This mirrors our go build configurations, which always set it the same
way. Furthermore, there's an issue in CI where containers/storage tries
to compile btrfs C code and fails in some workers. This does not happen
without CGo.
---
 packages/scripts.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/packages/scripts.nix b/packages/scripts.nix
index 6490425bab5..a763036b0ca 100644
--- a/packages/scripts.nix
+++ b/packages/scripts.nix
@@ -111,6 +111,7 @@ lib.makeScope pkgs.newScope (scripts: {
       exitcode=0
 
       export GOFLAGS="-tags=${lib.concatStringsSep "," contrastPkgs.contrast.contrast.tags}"
+      export CGO_ENABLED=0
 
       while IFS= read -r dir; do
         echo "Running go fix on $dir"