Encrypt tls key updates

.github/pull_request_template.md

@@ -1,12 +1,19 @@
-#### Pull Request Checklist
-
-- [ ] All changes are Go version 1.16 compliant
-- [ ] Your PR passes all CI checks. If a check cannot be passed for a justifiable reason, that reason must be stated in the commit message and PR description.
-- [ ] If this is your first time contributing, we recommend you read the [Code Contribution Guidelines](https://github.com/lightningnetwork/lnd/blob/master/docs/code_contribution_guidelines.md)
-   - [ ] The code being submitted is commented according to [Code Documentation and Commenting](https://github.com/lightningnetwork/lnd/blob/master/docs/code_contribution_guidelines.md#CodeDocumentation)
-   - [ ] Commits have a logical structure according to [Ideal Git Commit Structure](https://github.com/lightningnetwork/lnd/blob/master/docs/code_contribution_guidelines.md#IdealGitCommitStructure)
-- [ ] For new code: Code is accompanied by tests which exercise both the positive and negative (error paths) conditions (if applicable)
-- [ ] For bug fixes: If possible, code is accompanied by new tests which trigger the bug being fixed to prevent regressions
-- [ ] Any new logging statements use an appropriate subsystem and logging level
-- [ ] For code and documentation: lines are wrapped at 80 characters (the tab character should be counted as 8 characters, not 4, as some IDEs do per default)
-- [ ] A description of your changes [should be added to running the release notes](https://github.com/lightningnetwork/lnd/tree/master/docs/release-notes) for the milestone your change will land in.
+## Change Description
+Description of change / link to associated issue.
+
+## Steps to Test
+Steps for reviewers to follow to test the change.
+
+## Pull Request Checklist
+### Testing
+- [ ] Your PR passes all CI checks.
+- [ ] Tests covering the positive and negative (error paths) are included.
+- [ ] Bug fixes contain tests triggering the bug to prevent regressions.
+
+### Code Style and Documentation
+- [ ] The change obeys the [Code Documentation and Commenting](https://github.com/lightningnetwork/lnd/blob/master/docs/code_contribution_guidelines.md#CodeDocumentation) guidelines, and lines wrap at 80.
+- [ ] Commits follow the [Ideal Git Commit Structure](https://github.com/lightningnetwork/lnd/blob/master/docs/code_contribution_guidelines.md#IdealGitCommitStructure).
+- [ ] Any new logging statements use an appropriate subsystem and logging level.
+- [ ]  [There is a change description in the release notes](https://github.com/lightningnetwork/lnd/tree/master/docs/release-notes), or `[skip ci]` in the commit message for small changes.
+
+📝 Please see our  [Contribution Guidelines](https://github.com/lightningnetwork/lnd/blob/master/docs/code_contribution_guidelines.md) for further guidance.

.github/workflows/docker.yml

@@ -4,6 +4,9 @@ on:
   push:
     tags:
       - 'v*'
+  schedule:
+    # Every day at midnight (UTC).
+    - cron: '0 0 * * *'
 
 defaults:
   run:
@@ -30,15 +33,23 @@ jobs:
           password: ${{ secrets.DOCKER_API_KEY }}
 
       - name: Set env
-        run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
+        run: |
+          echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
+          echo "IMAGE_TAG=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
+
+      - name: Set daily tag
+        if: github.event.schedule == '0 0 * * *'
+        run: |
+          echo "RELEASE_VERSION=master" >> $GITHUB_ENV
+          echo "IMAGE_TAG=daily-testing-$(date -u +%Y%m%d),${DOCKER_REPO}/${DOCKER_IMAGE}:daily-testing-only" >> $GITHUB_ENV
 
       - name: Build and push
         id: docker_build
         uses: lightninglabs/gh-actions/[email protected]
         with:
           push: true
           platforms: linux/amd64,linux/arm64
-          tags: "${{ env.DOCKER_REPO }}/${{ env.DOCKER_IMAGE }}:${{ env.RELEASE_VERSION }}"
+          tags: "${{ env.DOCKER_REPO }}/${{ env.DOCKER_IMAGE }}:${{ env.IMAGE_TAG }}"
           build-args: checkout=${{ env.RELEASE_VERSION }}
 
       - name: Image digest

.github/workflows/main.yml

@@ -16,15 +16,15 @@ env:
   # go needs absolute directories, using the $HOME variable doesn't work here.
   GOCACHE: /home/runner/work/go/pkg/build
   GOPATH: /home/runner/work/go
-  BITCOIN_VERSION: 0.20.1
+  BITCOIN_VERSION: "23.0"
 
   # If you change this value, please change it in the following files as well:
   # /.travis.yml
   # /Dockerfile
   # /dev.Dockerfile
   # /make/builder.Dockerfile
   # /.github/workflows/release.yml
-  GO_VERSION: 1.17.1
+  GO_VERSION: 1.18
 
 jobs:
   ########################
@@ -206,8 +206,9 @@ jobs:
       matrix:
         unit_type:
           - btcd unit-cover
-          - unit tags="kvdb_etcd kvdb_postgres"
-          - travis-race
+          - unit tags="kvdb_etcd"
+          - unit tags="kvdb_postgres"
+          - btcd unit-race
     steps:
       - name: git checkout
         uses: actions/checkout@v2
@@ -258,6 +259,8 @@ jobs:
             args: backend=bitcoind
           - name: bitcoind-notxindex
             args: backend="bitcoind notxindex"
+          - name: bitcoind-rpcpolling
+            args: backend="bitcoind rpcpolling"
           - name: bitcoind-etcd
             args: backend=bitcoind dbbackend=etcd
           - name: bitcoind-postgres
@@ -292,6 +295,7 @@ jobs:
 
       - name: Zip log files on failure
         if: ${{ failure() }}
+        timeout-minutes: 1 # timeout after 1 minute
         run: 7z a logs-itest-${{ matrix.name }}.zip lntest/itest/**/*.log
 
       - name: Upload log files on failure

.github/workflows/release.yaml

@@ -16,7 +16,7 @@ env:
   # /dev.Dockerfile
   # /make/builder.Dockerfile
   # /.github/workflows/main.yml
-  GO_VERSION: 1.17.1
+  GO_VERSION: 1.18
 
 jobs:
   main:
@@ -94,7 +94,7 @@ jobs:
 
             Our release binaries are fully reproducible. Third parties are able to verify that the release binaries were produced properly without having to trust the release manager(s). See our [reproducible builds guide](https://github.com/lightningnetwork/lnd/tree/master/build/release) for how this can be achieved.
             The release binaries are compiled with `go${{ env.GO_VERSION }}`, which is required by verifiers to arrive at the same ones.
-            They include the following build tags: `autopilotrpc`, `signrpc`, `walletrpc`, `chainrpc`, `invoicesrpc`, `routerrpc`, `watchtowerrpc` and `monitoring`. Note that these are already included in the release script, so they do not need to be provided.
+            They include the following build tags: `autopilotrpc`, `signrpc`, `walletrpc`, `chainrpc`, `invoicesrpc`, `neutrinorpc`, `routerrpc`, `watchtowerrpc`, `monitoring`, `peersrpc`, `kvdb_postrgres`, and `kvdb_etcd`. Note that these are already included in the release script, so they do not need to be provided.
 
             The `make release` command can be used to ensure one rebuilds with all the same flags used for the release. If one wishes to build for only a single platform, then `make release sys=<OS-ARCH> tag=<tag>` can be used. 
 

.gitignore

@@ -74,3 +74,6 @@ profile.tmp
 
 # Coverage test
 coverage.txt
+
+# Visual Studio cache/options directory
+.vs/

.golangci.yml

@@ -15,10 +15,15 @@ run:
   build-tags:
     - autopilotrpc
     - chainrpc
+    - dev
     - invoicesrpc
+    - neutrinorpc
+    - peersrpc
     - signrpc
     - walletrpc
     - watchtowerrpc
+    - kvdb_etcd
+    - kvdb_postgres
 
 linters-settings:
   govet:
@@ -27,6 +32,20 @@ linters-settings:
   gofmt:
     # simplify code: gofmt with `-s` option, true by default
     simplify: true
+  tagliatelle:
+    case:
+      rules:
+        json: snake
+  whitespace:
+    multi-func: true
+    multi-if: true
+  gosec:
+    excludes:
+      - G402 # Look for bad TLS connection settings.
+      - G306 # Poor file permissions used when writing to a new file.
+  staticcheck: 
+    go: "1.18"
+    checks: ["-SA1019"]
 
 linters:
   enable-all: true
@@ -38,25 +57,69 @@ linters:
   # even longer by marking them as 'nolint'.
   - lll
 
-  # We don't care (enough) about misaligned structs to lint that.
-  - maligned
+  # We want to allow short variable names.
+  - varnamelen
+
+  # We want to allow TODOs.
+  - godox
 
   # We have long functions, especially in tests. Moving or renaming those would
   # trigger funlen problems that we may not want to solve at that time.
   - funlen
 
   # Disable for now as we haven't yet tuned the sensitivity to our codebase
-  # yet.  Enabling by default for example, would also force new contributors to
+  # yet. Enabling by default for example, would also force new contributors to
   # potentially extensively refactor code, when they want to smaller change to
   # land.
   - gocyclo
+  - gocognit
+  - cyclop
 
   # Instances of table driven tests that don't pre-allocate shouldn't trigger
   # the linter.
   - prealloc
 
   # Init functions are used by loggers throughout the codebase.
   - gochecknoinits
+
+  # Causes stack overflow, see https://github.com/polyfloyd/go-errorlint/issues/19.
+  - errorlint
+
+  # Deprecated linters. See https://golangci-lint.run/usage/linters/.
+  - interfacer
+  - golint
+  - maligned
+  - scopelint
+
+  # New linters that need a code adjustment first.
+  - wrapcheck
+  - nolintlint
+  - paralleltest
+  - tparallel
+  - testpackage
+  - gofumpt
+  - gomoddirectives
+  - ireturn
+  - maintidx
+  - nlreturn
+  - dogsled
+  - gci
+  - containedctx
+  - contextcheck
+  - errname
+  - exhaustivestruct
+  - goerr113
+  - gomnd
+  - ifshort
+  - noctx
+  - nestif
+  - wsl
+  - exhaustive
+  - forcetypeassert
+  - nilerr
+  - nilnil
+  - stylecheck
+  - thelper
 
 issues:
   # Only show newly introduced problems.
@@ -68,6 +131,36 @@ issues:
     - path: _test\.go
       linters:
         - gosec
+    - path: test*
+      linters:
+        - gosec
+
+    # Allow duplicated code and fmt.Printf() in DB migrations.
+    - path: channeldb/migration*
+      linters:
+        - dupl
+        - forbidigo
+        - godot
+
+    # Allow duplicated code and fmt.Printf() in DB migration tests.
+    - path: channeldb/migtest
+      linters:
+        - dupl
+        - forbidigo
+        - godot
+
+    # Allow fmt.Printf() in lncli.
+    - path: cmd/lncli/*
+      linters:
+        - forbidigo
+
+    # Allow fmt.Printf() in config parsing.
+    - path: config\.go
+      linters:
+        - forbidigo
+    - path: lnd\.go
+      linters:
+        - forbidigo
 
     # Fix false positives because of build flags in itest directory.
     - path: lntest/itest/.*

.travis.yml

@@ -21,12 +21,12 @@ go:
   # /make/builder.Dockerfile
   # /.github/workflows/main.yml
   # /.github/workflows/release.yml
-  - "1.17.x"
+  - "1.18.x"
 
 env:
   global:
     - GOCACHE=$HOME/.go-build
-    - BITCOIN_VERSION=0.20.1
+    - BITCOIN_VERSION="22.0"
 
 sudo: required
 

Dockerfile

@@ -4,7 +4,7 @@
 # /make/builder.Dockerfile
 # /.github/workflows/main.yml
 # /.github/workflows/release.yml
-FROM golang:1.17.1-alpine as builder
+FROM golang:1.18-alpine as builder
 
 # Force Go to use the cgo based DNS resolver. This is required to ensure DNS
 # queries required to connect to linked containers succeed.
@@ -14,13 +14,14 @@ ENV GODEBUG netdns=cgo
 # image to be built from a specified Git state.  The default image
 # will use the Git tip of master by default.
 ARG checkout="master"
+ARG git_url="https://github.com/lightningnetwork/lnd"
 
 # Install dependencies and build the binaries.
 RUN apk add --no-cache --update alpine-sdk \
     git \
     make \
     gcc \
-&&  git clone https://github.com/lightningnetwork/lnd /go/src/github.com/lightningnetwork/lnd \
+&&  git clone $git_url /go/src/github.com/lightningnetwork/lnd \
 &&  cd /go/src/github.com/lightningnetwork/lnd \
 &&  git checkout $checkout \
 &&  make release-install

LICENSE

@@ -1,4 +1,4 @@
-Copyright (C) 2015-2018 Lightning Labs and The Lightning Network Developers
+Copyright (C) 2015-2022 Lightning Labs and The Lightning Network Developers
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal