gosec G101 matched the identifier fileDropWatchName: its default pattern
includes a bare "pw", which hits case-insensitively inside "fileDropWatch",
and the constant's value then cleared the entropy threshold. Nothing here is
credential-shaped, so rename rather than suppress. Any fileDropW... spelling
keeps the match, hence fileDropReceiverLabel.
overlayWait and the non-iOS overlayWaiter are read only by the iOS overlay
address wait, and the linter analyses the default build only. Suppress with a
reason; the field stays in engine.go as part of the lifecycle.
iOS applies the tunnel address out of band, after handing the engine the
tun fd, so the receiver bound to that address a moment too early and failed
with EADDRNOTAVAIL. Nothing retried it, leaving the peer able to send but
never to receive for the life of the connection.
Wait for the address to appear and bind then, and let a rebind start a
receiver that is down rather than skipping it. Only the subsystems that
asked to be bound are bound, so the SSH sessions and DNS queries that other
listeners are carrying are left alone.
The wait itself is iOS-only: every other platform assigns the address in the
call chain that creates the interface, or is handed one that already carries
it, so there it compiles down to nothing.
Zoltán Papp