Linting

client/mdm/canonical_loaders.go

@@ -0,0 +1,25 @@
+//go:build windows || darwin
+
+package mdm
+
+import "strings"
+
+// canonicalKey maps the lowercase form of a managed-config value name to
+// its canonical mdm.Key* form. Admins commonly write PascalCase value
+// names in ADMX / Group Policy ("ManagementURL"); the iOS/AppConfig and
+// macOS plist conventions are camelCase ("managementURL"); both must
+// resolve to the same Policy lookup.
+//
+// Lives in a desktop-loader-only file (build tag `windows || darwin`)
+// because no other build path consumes it. Linux / FreeBSD / mobile
+// builds don't ship a platform loader that reads arbitrary-case key
+// names, so they don't need the canonicalisation table — and including
+// the var unconditionally would trigger the `unused` golangci-lint
+// check on those platforms.
+var canonicalKey = func() map[string]string {
+	m := make(map[string]string, len(AllKeys))
+	for _, k := range AllKeys {
+		m[strings.ToLower(k)] = k
+	}
+	return m
+}()

client/mdm/policy.go

@@ -11,7 +11,6 @@ package mdm
 import (
 	"sort"
 	"strconv"
-	"strings"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -76,18 +75,6 @@ var SecretKeys = map[string]struct{}{
 	KeyPreSharedKey: {},
 }
 
-// canonicalKey maps the lowercase form of a managed-config value name to its
-// canonical mdm.Key* form. Admins commonly write PascalCase value names in
-// ADMX / Group Policy ("ManagementURL"), the iOS/AppConfig and macOS plist
-// conventions are camelCase ("managementURL"); both must resolve to the
-// same Policy lookup. Shared across all platform loaders.
-var canonicalKey = func() map[string]string {
-	m := make(map[string]string, len(AllKeys))
-	for _, k := range AllKeys {
-		m[strings.ToLower(k)] = k
-	}
-	return m
-}()
 
 // Policy holds MDM-managed settings read from the platform source. A nil or
 // empty Policy means no enforcement is active.

client/mdm/policy_mobile.go

@@ -6,8 +6,10 @@ package mdm
 // Kotlin/Java on Android) reads the OS managed-config store and pushes the
 // resulting dictionary in-process via a gomobile entry point that lands in
 // Phase 5 / Phase 6. The stub keeps the package compilable for mobile
-// loadPlatformPolicy is a stub used on mobile (iOS/Android) builds that returns a nil policy map and no error.
-// The actual managed-config policy is supplied by the native platform layer.
+// builds and returns (nil, nil) — the platform-absent sentinel that
+// LoadPolicy in policy.go treats as "no MDM source present".
+//
+//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
 func loadPlatformPolicy() (map[string]any, error) {
 	return nil, nil
 }

client/mdm/policy_other.go

@@ -4,8 +4,12 @@ package mdm
 
 // loadPlatformPolicy returns no policy on platforms without an MDM channel
 // (Linux, FreeBSD). MDM enforcement is off and the client behaves as if
-// loadPlatformPolicy reports that no platform MDM policy is available on non-Windows/Darwin/iOS/Android builds.
-// It returns a nil policy map and a nil error to indicate MDM enforcement is not present on this platform.
+// the feature did not exist. Returns (nil, nil) — the platform-absent
+// sentinel the caller (LoadPolicy in policy.go) treats as "no MDM
+// source present"; an error here would just translate to the same
+// outcome with an extra log line.
+//
+//nolint:nilnil // (nil, nil) is the documented platform-absent sentinel; see LoadPolicy.
 func loadPlatformPolicy() (map[string]any, error) {
 	return nil, nil
 }

client/server/mdm.go

@@ -350,7 +350,7 @@ func loginRequestHasConfigOverrides(msg *proto.LoginRequest) bool {
 	}
 	return msg.ManagementUrl != "" ||
 		msg.AdminURL != "" ||
-		msg.PreSharedKey != "" ||
+		msg.PreSharedKey != "" || //nolint:staticcheck // SA1019: legacy proto field still accepted by Login
 		msg.OptionalPreSharedKey != nil ||
 		len(msg.CustomDNSAddress) > 0 ||
 		len(msg.NatExternalIPs) > 0 || msg.CleanNATExternalIPs ||

client/ui/client_ui.go

@@ -328,7 +328,6 @@ type serviceClient struct {
 	isUpdateIconActive   bool
 	isEnforcedUpdate     bool
 	lastNotifiedVersion  string
-	settingsEnabled      bool
 	profilesEnabled      bool
 	networksEnabled      bool
 	// networksMenuEnabled caches the last applied enabled-state of the
@@ -1274,18 +1273,6 @@ func (s *serviceClient) getSrvClient(timeout time.Duration) (proto.DaemonService
 	return s.conn, nil
 }
 
-// setSettingsEnabled enables or disables the settings menu based on the provided state
-func (s *serviceClient) setSettingsEnabled(enabled bool) {
-	if s.mSettings != nil {
-		if enabled {
-			s.mSettings.Enable()
-		} else {
-			s.mSettings.Hide()
-			s.mSettings.SetTooltip("Settings are disabled by daemon")
-		}
-	}
-}
-
 // checkAndUpdateFeatures checks the current features and updates the UI accordingly
 func (s *serviceClient) checkAndUpdateFeatures() {
 	features, err := s.getFeatures()