From 2d03a2e7b0c2621f03538c641546edf34ba204b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zolt=C3=A1n=20Papp?= <zoltan.pmail@gmail.com>
Date: Tue, 8 Sep 2026 20:33:04 +0200
Subject: [PATCH] [client] Fix lint findings on the file drop overlay wait

gosec G101 matched the identifier fileDropWatchName: its default pattern
includes a bare "pw", which hits case-insensitively inside "fileDropWatch",
and the constant's value then cleared the entropy threshold. Nothing here is
credential-shaped, so rename rather than suppress. Any fileDropW... spelling
keeps the match, hence fileDropReceiverLabel.

overlayWait and the non-iOS overlayWaiter are read only by the iOS overlay
address wait, and the linter analyses the default build only. Suppress with a
reason; the field stays in engine.go as part of the lifecycle.
---
 client/internal/engine.go              | 2 +-
 client/internal/engine_filedrop.go     | 6 +++---
 client/internal/engine_overlay_wait.go | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/client/internal/engine.go b/client/internal/engine.go
index f93d54772..d9fe42059 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -257,7 +257,7 @@ type Engine struct {
 	fileDrop        *filedrop.Manager
 	fileDropRunning bool
 	fileDropPort    uint16
-	overlayWait     overlayWaiter
+	overlayWait     overlayWaiter //nolint:unused // only read by the iOS overlay wait
 
 	statusRecorder *peer.Status
 
diff --git a/client/internal/engine_filedrop.go b/client/internal/engine_filedrop.go
index 81d94c887..229d86347 100644
--- a/client/internal/engine_filedrop.go
+++ b/client/internal/engine_filedrop.go
@@ -15,7 +15,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/peer"
 )
 
-const fileDropWatchName = "the file drop receiver"
+const fileDropReceiverLabel = "the file drop receiver"
 
 type filedropResolver struct {
 	status *peer.Status
@@ -49,7 +49,7 @@ func (e *Engine) startFileDrop() {
 	wgAddr := e.wgInterface.Address()
 	if !e.overlayAddrReady(wgAddr.IP) {
 		log.Infof("file drop receiver waits for the overlay address %s", wgAddr.IP)
-		e.armOverlayWatch(fileDropWatchName, e.restartFileDrop)
+		e.armOverlayWatch(fileDropReceiverLabel, e.restartFileDrop)
 		return
 	}
 
@@ -71,7 +71,7 @@ func (e *Engine) startFileDrop() {
 	if v6 := wgAddr.IPv6; v6.IsValid() {
 		if err := e.fileDrop.AddReceiverListener(e.ctx, netip.AddrPortFrom(v6, bound)); err != nil {
 			log.Warnf("failed to add IPv6 file drop listener: %v", err)
-			e.armOverlayWatch(fileDropWatchName, e.restartFileDrop)
+			e.armOverlayWatch(fileDropReceiverLabel, e.restartFileDrop)
 		}
 	}
 
diff --git a/client/internal/engine_overlay_wait.go b/client/internal/engine_overlay_wait.go
index 285ed3736..337c48883 100644
--- a/client/internal/engine_overlay_wait.go
+++ b/client/internal/engine_overlay_wait.go
@@ -8,7 +8,7 @@ import "net/netip"
 // overlay address in the same call chain that creates the interface, or hands
 // the engine an interface that already carries it, so a listener bound right
 // after has nothing to wait for. See the iOS variant for what the wait is.
-type overlayWaiter struct{}
+type overlayWaiter struct{} //nolint:unused // the iOS variant carries the state
 
 // overlayAddrReady reports whether ip can be bound. Always true here.
 func (e *Engine) overlayAddrReady(netip.Addr) bool {