Add self-contained gometalinter build tooling.

tools/vendor/github.com/GoASTScanner/gas/LICENSE.txt

@@ -0,0 +1,154 @@
+Apache License
+
+Version 2.0, January 2004
+
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made
+available under the License, as indicated by a copyright notice that is included
+in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems, and
+issue tracking systems that are managed by, or on behalf of, the Licensor for
+the purpose of discussing and improving the Work, but excluding communication
+that is conspicuously marked or otherwise designated in writing by the copyright
+owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License,
+each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section) patent
+license to make, have made, use, offer to sell, sell, import, and otherwise
+transfer the Work, where such license applies only to those patent claims
+licensable by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s) with the Work
+to which such Contribution(s) was submitted. If You institute patent litigation
+against any entity (including a cross-claim or counterclaim in a lawsuit)
+alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate as of the date
+such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+You must give any other recipients of the Work or Derivative Works a copy of
+this License; and You must cause any modified files to carry prominent notices
+stating that You changed the files; and You must retain, in the Source form of
+any Derivative Works that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work, excluding those notices
+that do not pertain to any part of the Derivative Works; and If the Work
+includes a "NOTICE" text file as part of its distribution, then any Derivative
+Works that You distribute must include a readable copy of the attribution
+notices contained within such NOTICE file, excluding those notices that do not
+pertain to any part of the Derivative Works, in at least one of the following
+places: within a NOTICE text file distributed as part of the Derivative Works;
+within the Source form or documentation, if provided along with the Derivative
+Works; or, within a display generated by the Derivative Works, if and wherever
+such third-party notices normally appear. The contents of the NOTICE file are
+for informational purposes only and do not modify the License. You may add Your
+own attribution notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE text from the Work, provided that such
+additional attribution notices cannot be construed as modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License. 5. Submission of Contributions.
+Unless You explicitly state otherwise, any Contribution intentionally submitted
+for inclusion in the Work by You to the Licensor shall be under the terms and
+conditions of this License, without any additional terms or conditions.
+Notwithstanding the above, nothing herein shall supersede or modify the terms of
+any separate license agreement you may have executed with Licensor regarding
+such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties
+or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any character
+arising as a result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill, work stoppage,
+computer failure or malfunction, or any and all other commercial damages or
+losses), even if such Contributor has been advised of the possibility of such
+damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred
+by, or claims asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

tools/vendor/github.com/GoASTScanner/gas/README.md

@@ -0,0 +1,114 @@
+
+
+## GAS - Go AST Scanner
+
+Inspects source code for security problems by scanning the Go AST.
+
+### License
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License [here](http://www.apache.org/licenses/LICENSE-2.0).
+
+### Project status
+
+[![Build Status](https://travis-ci.org/GoASTScanner/gas.svg?branch=master)](https://travis-ci.org/GoASTScanner/gas)
+[![GoDoc](https://godoc.org/github.com/GoASTScanner/gas?status.svg)](https://godoc.org/github.com/GoASTScanner/gas)
+
+Gas is still in alpha and accepting feedback from early adopters. We do
+not consider it production ready at this time.
+
+### Usage
+
+Gas can be configured to only run a subset of rules, to exclude certain file
+paths, and produce reports in different formats. By default all rules will be
+run against the supplied input files. To recursively scan from the current
+directory you can supply './...' as the input argument.
+
+#### Selecting rules
+
+By default Gas will run all rules against the supplied file paths. It is however possible to select a subset of rules to run via the '-include=' flag,
+or to specify a set of rules to explicitly exclude using the '-exclude=' flag.
+
+##### Available rules
+
+  - G101: Look for hardcoded credentials
+  - G102: Bind to all interfaces
+  - G103: Audit the use of unsafe block
+  - G104: Audit errors not checked
+  - G105: Audit the use of math/big.Int.Exp
+  - G201: SQL query construction using format string
+  - G202: SQL query construction using string concatenation
+  - G203: Use of unescaped data in HTML templates
+  - G204: Audit use of command execution
+  - G301: Poor file permissions used when creating a directory
+  - G302: Poor file permisions used with chmod
+  - G303: Creating tempfile using a predictable path
+  - G401: Detect the usage of DES, RC4, or MD5
+  - G402: Look for bad TLS connection settings
+  - G403: Ensure minimum RSA key length of 2048 bits
+  - G404: Insecure random number source (rand)
+  - G501: Import blacklist: crypto/md5
+  - G502: Import blacklist: crypto/des
+  - G503: Import blacklist: crypto/rc4
+  - G504: Import blacklist: net/http/cgi
+
+
+```
+# Run a specific set of rules
+$ gas -include=G101,G203,G401 ./...
+
+# Run everything except for rule G303
+$ gas -exclude=G303 ./...
+```
+
+#### Excluding files:
+
+Gas can be told to \ignore paths that match a supplied pattern using the 'skip' command line option. This is
+accomplished via [go-glob](github.com/ryanuber/go-glob). Multiple patterns can be specified as follows:
+
+```
+$ gas -skip=tests* -skip=*_example.go ./...
+```
+
+#### Annotating code
+
+As with all automated detection tools there will be cases of false positives. In cases where Gas reports a failure that has been manually verified as being safe it is possible to annotate the code with a '#nosec' comment.
+
+The annotation causes Gas to stop processing any further nodes within the
+AST so can apply to a whole block or more granularly to a single expression.
+
+```go
+
+import "md5" // #nosec
+
+
+func main(){
+
+    /* #nosec */
+    if x > y {
+        h := md5.New() // this will also be ignored
+    }
+
+}
+
+```
+
+In some cases you may also want to revisit places where #nosec annotations
+have been used. To run the scanner and ignore any #nosec annotations you
+can do the following:
+
+```
+$ gas -nosec=true ./...
+```
+
+### Output formats
+
+Gas currently supports text, json and csv output formats. By default
+results will be reported to stdout, but can also be written to an output
+file. The output format is controlled by the '-fmt' flag, and the output file is controlled by the '-out' flag as follows:
+
+```
+# Write output in json format to results.json
+$ gas -fmt=json -out=results.json *.go
+```

tools/vendor/github.com/GoASTScanner/gas/core/analyzer.go

@@ -0,0 +1,235 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package core holds the central scanning logic used by GAS
+package core
+
+import (
+	"go/ast"
+	"go/importer"
+	"go/parser"
+	"go/token"
+	"go/types"
+	"log"
+	"os"
+	"path"
+	"reflect"
+	"strings"
+)
+
+// ImportInfo is used to track aliased and initialization only imports.
+type ImportInfo struct {
+	Imported map[string]string
+	Aliased  map[string]string
+	InitOnly map[string]bool
+}
+
+func NewImportInfo() *ImportInfo {
+	return &ImportInfo{
+		make(map[string]string),
+		make(map[string]string),
+		make(map[string]bool),
+	}
+}
+
+// The Context is populated with data parsed from the source code as it is scanned.
+// It is passed through to all rule functions as they are called. Rules may use
+// this data in conjunction withe the encoutered AST node.
+type Context struct {
+	FileSet  *token.FileSet
+	Comments ast.CommentMap
+	Info     *types.Info
+	Pkg      *types.Package
+	Root     *ast.File
+	Config   map[string]interface{}
+	Imports  *ImportInfo
+}
+
+// The Rule interface used by all rules supported by GAS.
+type Rule interface {
+	Match(ast.Node, *Context) (*Issue, error)
+}
+
+// A RuleSet maps lists of rules to the type of AST node they should be run on.
+// The anaylzer will only invoke rules contained in the list associated with the
+// type of AST node it is currently visiting.
+type RuleSet map[reflect.Type][]Rule
+
+// Metrics used when reporting information about a scanning run.
+type Metrics struct {
+	NumFiles int `json:"files"`
+	NumLines int `json:"lines"`
+	NumNosec int `json:"nosec"`
+	NumFound int `json:"found"`
+}
+
+// The Analyzer object is the main object of GAS. It has methods traverse an AST
+// and invoke the correct checking rules as on each node as required.
+type Analyzer struct {
+	ignoreNosec bool
+	ruleset     RuleSet
+	context     *Context
+	logger      *log.Logger
+	Issues      []*Issue `json:"issues"`
+	Stats       *Metrics `json:"metrics"`
+}
+
+// NewAnalyzer builds a new anaylzer.
+func NewAnalyzer(conf map[string]interface{}, logger *log.Logger) Analyzer {
+	if logger == nil {
+		logger = log.New(os.Stdout, "[gas]", 0)
+	}
+	a := Analyzer{
+		ignoreNosec: conf["ignoreNosec"].(bool),
+		ruleset:     make(RuleSet),
+		context:     &Context{nil, nil, nil, nil, nil, nil, nil},
+		logger:      logger,
+		Issues:      make([]*Issue, 0, 16),
+		Stats:       &Metrics{0, 0, 0, 0},
+	}
+
+	// TODO(tkelsey): use the inc/exc lists
+
+	return a
+}
+
+func (gas *Analyzer) process(filename string, source interface{}) error {
+	mode := parser.ParseComments
+	gas.context.FileSet = token.NewFileSet()
+	root, err := parser.ParseFile(gas.context.FileSet, filename, source, mode)
+	if err == nil {
+		gas.context.Comments = ast.NewCommentMap(gas.context.FileSet, root, root.Comments)
+		gas.context.Root = root
+
+		// here we get type info
+		gas.context.Info = &types.Info{
+			Types:      make(map[ast.Expr]types.TypeAndValue),
+			Defs:       make(map[*ast.Ident]types.Object),
+			Uses:       make(map[*ast.Ident]types.Object),
+			Selections: make(map[*ast.SelectorExpr]*types.Selection),
+			Scopes:     make(map[ast.Node]*types.Scope),
+			Implicits:  make(map[ast.Node]types.Object),
+		}
+
+		conf := types.Config{Importer: importer.Default()}
+		gas.context.Pkg, err = conf.Check("pkg", gas.context.FileSet, []*ast.File{root}, gas.context.Info)
+		if err != nil {
+			// TODO(gm) Type checker not currently considering all files within a package
+			// see: issue #113
+			gas.logger.Printf(`Error during type checking: "%s"`, err)
+			err = nil
+		}
+
+		gas.context.Imports = NewImportInfo()
+		for _, pkg := range gas.context.Pkg.Imports() {
+			gas.context.Imports.Imported[pkg.Path()] = pkg.Name()
+		}
+		ast.Walk(gas, root)
+		gas.Stats.NumFiles++
+	}
+	return err
+}
+
+// AddRule adds a rule into a rule set list mapped to the given AST node's type.
+// The node is only needed for its type and is not otherwise used.
+func (gas *Analyzer) AddRule(r Rule, nodes []ast.Node) {
+	for _, n := range nodes {
+		t := reflect.TypeOf(n)
+		if val, ok := gas.ruleset[t]; ok {
+			gas.ruleset[t] = append(val, r)
+		} else {
+			gas.ruleset[t] = []Rule{r}
+		}
+	}
+}
+
+// Process reads in a source file, convert it to an AST and traverse it.
+// Rule methods added with AddRule will be invoked as necessary.
+func (gas *Analyzer) Process(filename string) error {
+	err := gas.process(filename, nil)
+	fun := func(f *token.File) bool {
+		gas.Stats.NumLines += f.LineCount()
+		return true
+	}
+	gas.context.FileSet.Iterate(fun)
+	return err
+}
+
+// ProcessSource will convert a source code string into an AST and traverse it.
+// Rule methods added with AddRule will be invoked as necessary. The string is
+// identified by the filename given but no file IO will be done.
+func (gas *Analyzer) ProcessSource(filename string, source string) error {
+	err := gas.process(filename, source)
+	fun := func(f *token.File) bool {
+		gas.Stats.NumLines += f.LineCount()
+		return true
+	}
+	gas.context.FileSet.Iterate(fun)
+	return err
+}
+
+// ignore a node (and sub-tree) if it is tagged with a "#nosec" comment
+func (gas *Analyzer) ignore(n ast.Node) bool {
+	if groups, ok := gas.context.Comments[n]; ok && !gas.ignoreNosec {
+		for _, group := range groups {
+			if strings.Contains(group.Text(), "#nosec") {
+				gas.Stats.NumNosec++
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// Visit runs the GAS visitor logic over an AST created by parsing go code.
+// Rule methods added with AddRule will be invoked as necessary.
+func (gas *Analyzer) Visit(n ast.Node) ast.Visitor {
+	if !gas.ignore(n) {
+
+		// Track aliased and initialization imports
+		if imported, ok := n.(*ast.ImportSpec); ok {
+			path := strings.Trim(imported.Path.Value, `"`)
+			if imported.Name != nil {
+				if imported.Name.Name == "_" {
+					// Initialization import
+					gas.context.Imports.InitOnly[path] = true
+				} else {
+					// Aliased import
+					gas.context.Imports.Aliased[path] = imported.Name.Name
+				}
+			}
+			// unsafe is not included in Package.Imports()
+			if path == "unsafe" {
+				gas.context.Imports.Imported[path] = path
+			}
+		}
+
+		if val, ok := gas.ruleset[reflect.TypeOf(n)]; ok {
+			for _, rule := range val {
+				ret, err := rule.Match(n, gas.context)
+				if err != nil {
+					file, line := GetLocation(n, gas.context)
+					file = path.Base(file)
+					gas.logger.Printf("Rule error: %v => %s (%s:%d)\n", reflect.TypeOf(rule), err, file, line)
+				}
+				if ret != nil {
+					gas.Issues = append(gas.Issues, ret)
+					gas.Stats.NumFound++
+				}
+			}
+		}
+		return gas
+	}
+	return nil
+}

tools/vendor/github.com/GoASTScanner/gas/core/call_list.go

@@ -0,0 +1,73 @@
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package core
+
+import (
+	"go/ast"
+)
+
+type set map[string]bool
+
+/// CallList is used to check for usage of specific packages
+/// and functions.
+type CallList map[string]set
+
+/// NewCallList creates a new empty CallList
+func NewCallList() CallList {
+	return make(CallList)
+}
+
+/// AddAll will add several calls to the call list at once
+func (c CallList) AddAll(selector string, idents ...string) {
+	for _, ident := range idents {
+		c.Add(selector, ident)
+	}
+}
+
+/// Add a selector and call to the call list
+func (c CallList) Add(selector, ident string) {
+	if _, ok := c[selector]; !ok {
+		c[selector] = make(set)
+	}
+	c[selector][ident] = true
+}
+
+/// Contains returns true if the package and function are
+/// members of this call list.
+func (c CallList) Contains(selector, ident string) bool {
+	if idents, ok := c[selector]; ok {
+		_, found := idents[ident]
+		return found
+	}
+	return false
+}
+
+/// ContainsCallExpr resolves the call expression name and type
+/// or package and determines if it exists within the CallList
+func (c CallList) ContainsCallExpr(n ast.Node, ctx *Context) bool {
+	selector, ident, err := GetCallInfo(n, ctx)
+	if err != nil {
+		return false
+	}
+	// Try direct resolution
+	if c.Contains(selector, ident) {
+		return true
+	}
+
+	// Also support explicit path
+	if path, ok := GetImportPath(selector, ctx); ok {
+		return c.Contains(path, ident)
+	}
+	return false
+}

tools/vendor/github.com/GoASTScanner/gas/core/helpers.go

@@ -0,0 +1,220 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package core
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"go/types"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// helpfull "canned" matching routines ----------------------------------------
+
+func selectName(n ast.Node, s reflect.Type) (string, bool) {
+	t := reflect.TypeOf(&ast.SelectorExpr{})
+	if node, ok := SimpleSelect(n, s, t).(*ast.SelectorExpr); ok {
+		t = reflect.TypeOf(&ast.Ident{})
+		if ident, ok := SimpleSelect(node.X, t).(*ast.Ident); ok {
+			return strings.Join([]string{ident.Name, node.Sel.Name}, "."), ok
+		}
+	}
+	return "", false
+}
+
+// MatchCall will match an ast.CallNode if its method name obays the given regex.
+func MatchCall(n ast.Node, r *regexp.Regexp) *ast.CallExpr {
+	t := reflect.TypeOf(&ast.CallExpr{})
+	if name, ok := selectName(n, t); ok && r.MatchString(name) {
+		return n.(*ast.CallExpr)
+	}
+	return nil
+}
+
+// MatchCallByPackage ensures that the specified package is imported,
+// adjusts the name for any aliases and ignores cases that are
+// initialization only imports.
+//
+// Usage:
+// 	node, matched := MatchCallByPackage(n, ctx, "math/rand", "Read")
+//
+func MatchCallByPackage(n ast.Node, c *Context, pkg string, names ...string) (*ast.CallExpr, bool) {
+
+	importedName, found := GetImportedName(pkg, c)
+	if !found {
+		return nil, false
+	}
+
+	if callExpr, ok := n.(*ast.CallExpr); ok {
+		packageName, callName, err := GetCallInfo(callExpr, c)
+		if err != nil {
+			return nil, false
+		}
+		if packageName == importedName {
+			for _, name := range names {
+				if callName == name {
+					return callExpr, true
+				}
+			}
+		}
+	}
+	return nil, false
+}
+
+// MatchCallByType ensures that the node is a call expression to a
+// specific object type.
+//
+// Usage:
+// 	node, matched := MatchCallByType(n, ctx, "bytes.Buffer", "WriteTo", "Write")
+//
+func MatchCallByType(n ast.Node, ctx *Context, requiredType string, calls ...string) (*ast.CallExpr, bool) {
+	if callExpr, ok := n.(*ast.CallExpr); ok {
+		typeName, callName, err := GetCallInfo(callExpr, ctx)
+		if err != nil {
+			return nil, false
+		}
+		if typeName == requiredType {
+			for _, call := range calls {
+				if call == callName {
+					return callExpr, true
+				}
+			}
+		}
+	}
+	return nil, false
+}
+
+// MatchCompLit will match an ast.CompositeLit if its string value obays the given regex.
+func MatchCompLit(n ast.Node, r *regexp.Regexp) *ast.CompositeLit {
+	t := reflect.TypeOf(&ast.CompositeLit{})
+	if name, ok := selectName(n, t); ok && r.MatchString(name) {
+		return n.(*ast.CompositeLit)
+	}
+	return nil
+}
+
+// GetInt will read and return an integer value from an ast.BasicLit
+func GetInt(n ast.Node) (int64, error) {
+	if node, ok := n.(*ast.BasicLit); ok && node.Kind == token.INT {
+		return strconv.ParseInt(node.Value, 0, 64)
+	}
+	return 0, fmt.Errorf("Unexpected AST node type: %T", n)
+}
+
+// GetInt will read and return a float value from an ast.BasicLit
+func GetFloat(n ast.Node) (float64, error) {
+	if node, ok := n.(*ast.BasicLit); ok && node.Kind == token.FLOAT {
+		return strconv.ParseFloat(node.Value, 64)
+	}
+	return 0.0, fmt.Errorf("Unexpected AST node type: %T", n)
+}
+
+// GetInt will read and return a char value from an ast.BasicLit
+func GetChar(n ast.Node) (byte, error) {
+	if node, ok := n.(*ast.BasicLit); ok && node.Kind == token.CHAR {
+		return node.Value[0], nil
+	}
+	return 0, fmt.Errorf("Unexpected AST node type: %T", n)
+}
+
+// GetInt will read and return a string value from an ast.BasicLit
+func GetString(n ast.Node) (string, error) {
+	if node, ok := n.(*ast.BasicLit); ok && node.Kind == token.STRING {
+		return strconv.Unquote(node.Value)
+	}
+	return "", fmt.Errorf("Unexpected AST node type: %T", n)
+}
+
+// GetCallObject returns the object and call expression and associated
+// object for a given AST node. nil, nil will be returned if the
+// object cannot be resolved.
+func GetCallObject(n ast.Node, ctx *Context) (*ast.CallExpr, types.Object) {
+	switch node := n.(type) {
+	case *ast.CallExpr:
+		switch fn := node.Fun.(type) {
+		case *ast.Ident:
+			return node, ctx.Info.Uses[fn]
+		case *ast.SelectorExpr:
+			return node, ctx.Info.Uses[fn.Sel]
+		}
+	}
+	return nil, nil
+}
+
+// GetCallInfo returns the package or type and name  associated with a
+// call expression.
+func GetCallInfo(n ast.Node, ctx *Context) (string, string, error) {
+	switch node := n.(type) {
+	case *ast.CallExpr:
+		switch fn := node.Fun.(type) {
+		case *ast.SelectorExpr:
+			switch expr := fn.X.(type) {
+			case *ast.Ident:
+				if expr.Obj != nil && expr.Obj.Kind == ast.Var {
+					t := ctx.Info.TypeOf(expr)
+					if t != nil {
+						return t.String(), fn.Sel.Name, nil
+					} else {
+						return "undefined", fn.Sel.Name, fmt.Errorf("missing type info")
+					}
+				} else {
+					return expr.Name, fn.Sel.Name, nil
+				}
+			}
+		case *ast.Ident:
+			return ctx.Pkg.Name(), fn.Name, nil
+		}
+	}
+	return "", "", fmt.Errorf("unable to determine call info")
+}
+
+// GetImportedName returns the name used for the package within the
+// code. It will resolve aliases and ignores initalization only imports.
+func GetImportedName(path string, ctx *Context) (string, bool) {
+	importName, imported := ctx.Imports.Imported[path]
+	if !imported {
+		return "", false
+	}
+
+	if _, initonly := ctx.Imports.InitOnly[path]; initonly {
+		return "", false
+	}
+
+	if alias, ok := ctx.Imports.Aliased[path]; ok {
+		importName = alias
+	}
+	return importName, true
+}
+
+// GetImportPath resolves the full import path of an identifer based on
+// the imports in the current context.
+func GetImportPath(name string, ctx *Context) (string, bool) {
+	for path, _ := range ctx.Imports.Imported {
+		if imported, ok := GetImportedName(path, ctx); ok && imported == name {
+			return path, true
+		}
+	}
+	return "", false
+}
+
+// GetLocation returns the filename and line number of an ast.Node
+func GetLocation(n ast.Node, ctx *Context) (string, int) {
+	fobj := ctx.FileSet.File(n.Pos())
+	return fobj.Name(), fobj.Line(n.Pos())
+}

tools/vendor/github.com/GoASTScanner/gas/core/issue.go

@@ -0,0 +1,108 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package core
+
+import (
+	"encoding/json"
+	"fmt"
+	"go/ast"
+	"os"
+)
+
+// Score type used by severity and confidence values
+type Score int
+
+const (
+	Low    Score = iota // Low value
+	Medium              // Medium value
+	High                // High value
+)
+
+// An Issue is returnd by a GAS rule if it discovers an issue with the scanned code.
+type Issue struct {
+	Severity   Score  `json:"severity"`   // issue severity (how problematic it is)
+	Confidence Score  `json:"confidence"` // issue confidence (how sure we are we found it)
+	What       string `json:"details"`    // Human readable explanation
+	File       string `json:"file"`       // File name we found it in
+	Code       string `json:"code"`       // Impacted code line
+	Line       int    `json:"line"`       // Line number in file
+}
+
+// MetaData is embedded in all GAS rules. The Severity, Confidence and What message
+// will be passed tbhrough to reported issues.
+type MetaData struct {
+	Severity   Score
+	Confidence Score
+	What       string
+}
+
+// MarshalJSON is used convert a Score object into a JSON representation
+func (c Score) MarshalJSON() ([]byte, error) {
+	return json.Marshal(c.String())
+}
+
+// String converts a Score into a string
+func (c Score) String() string {
+	switch c {
+	case High:
+		return "HIGH"
+	case Medium:
+		return "MEDIUM"
+	case Low:
+		return "LOW"
+	}
+	return "UNDEFINED"
+}
+
+func codeSnippet(file *os.File, start int64, end int64, n ast.Node) (string, error) {
+	if n == nil {
+		return "", fmt.Errorf("Invalid AST node provided")
+	}
+
+	size := (int)(end - start) // Go bug, os.File.Read should return int64 ...
+	file.Seek(start, 0)
+
+	buf := make([]byte, size)
+	if nread, err := file.Read(buf); err != nil || nread != size {
+		return "", fmt.Errorf("Unable to read code")
+	}
+	return string(buf), nil
+}
+
+// NewIssue creates a new Issue
+func NewIssue(ctx *Context, node ast.Node, desc string, severity Score, confidence Score) *Issue {
+	var code string
+	fobj := ctx.FileSet.File(node.Pos())
+	name := fobj.Name()
+	line := fobj.Line(node.Pos())
+
+	if file, err := os.Open(fobj.Name()); err == nil {
+		defer file.Close()
+		s := (int64)(fobj.Position(node.Pos()).Offset) // Go bug, should be int64
+		e := (int64)(fobj.Position(node.End()).Offset) // Go bug, should be int64
+		code, err = codeSnippet(file, s, e, node)
+		if err != nil {
+			code = err.Error()
+		}
+	}
+
+	return &Issue{
+		File:       name,
+		Line:       line,
+		What:       desc,
+		Confidence: confidence,
+		Severity:   severity,
+		Code:       code,
+	}
+}

tools/vendor/github.com/GoASTScanner/gas/core/resolve.go

@@ -0,0 +1,81 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package core
+
+import "go/ast"
+
+func resolveIdent(n *ast.Ident, c *Context) bool {
+	if n.Obj == nil || n.Obj.Kind != ast.Var {
+		return true
+	}
+	if node, ok := n.Obj.Decl.(ast.Node); ok {
+		return TryResolve(node, c)
+	}
+	return false
+}
+
+func resolveAssign(n *ast.AssignStmt, c *Context) bool {
+	for _, arg := range n.Rhs {
+		if !TryResolve(arg, c) {
+			return false
+		}
+	}
+	return true
+}
+
+func resolveCompLit(n *ast.CompositeLit, c *Context) bool {
+	for _, arg := range n.Elts {
+		if !TryResolve(arg, c) {
+			return false
+		}
+	}
+	return true
+}
+
+func resolveBinExpr(n *ast.BinaryExpr, c *Context) bool {
+	return (TryResolve(n.X, c) && TryResolve(n.Y, c))
+}
+
+func resolveCallExpr(n *ast.CallExpr, c *Context) bool {
+	// TODO(tkelsey): next step, full function resolution
+	return false
+}
+
+// TryResolve will attempt, given a subtree starting at some ATS node, to resolve
+// all values contained within to a known constant. It is used to check for any
+// unkown values in compound expressions.
+func TryResolve(n ast.Node, c *Context) bool {
+	switch node := n.(type) {
+	case *ast.BasicLit:
+		return true
+
+	case *ast.CompositeLit:
+		return resolveCompLit(node, c)
+
+	case *ast.Ident:
+		return resolveIdent(node, c)
+
+	case *ast.AssignStmt:
+		return resolveAssign(node, c)
+
+	case *ast.CallExpr:
+		return resolveCallExpr(node, c)
+
+	case *ast.BinaryExpr:
+		return resolveBinExpr(node, c)
+	}
+
+	return false
+}

tools/vendor/github.com/GoASTScanner/gas/core/select.go

@@ -0,0 +1,404 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package core
+
+import (
+	"fmt"
+	"go/ast"
+	"reflect"
+)
+
+// SelectFunc is like an AST visitor, but has a richer interface. It
+// is called with the current ast.Node being visitied and that nodes depth in
+// the tree. The function can return true to continue traversing the tree, or
+// false to end traversal here.
+type SelectFunc func(ast.Node, int) bool
+
+func walkIdentList(list []*ast.Ident, depth int, fun SelectFunc) {
+	for _, x := range list {
+		depthWalk(x, depth, fun)
+	}
+}
+
+func walkExprList(list []ast.Expr, depth int, fun SelectFunc) {
+	for _, x := range list {
+		depthWalk(x, depth, fun)
+	}
+}
+
+func walkStmtList(list []ast.Stmt, depth int, fun SelectFunc) {
+	for _, x := range list {
+		depthWalk(x, depth, fun)
+	}
+}
+
+func walkDeclList(list []ast.Decl, depth int, fun SelectFunc) {
+	for _, x := range list {
+		depthWalk(x, depth, fun)
+	}
+}
+
+func depthWalk(node ast.Node, depth int, fun SelectFunc) {
+	if !fun(node, depth) {
+		return
+	}
+
+	switch n := node.(type) {
+	// Comments and fields
+	case *ast.Comment:
+
+	case *ast.CommentGroup:
+		for _, c := range n.List {
+			depthWalk(c, depth+1, fun)
+		}
+
+	case *ast.Field:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		walkIdentList(n.Names, depth+1, fun)
+		depthWalk(n.Type, depth+1, fun)
+		if n.Tag != nil {
+			depthWalk(n.Tag, depth+1, fun)
+		}
+		if n.Comment != nil {
+			depthWalk(n.Comment, depth+1, fun)
+		}
+
+	case *ast.FieldList:
+		for _, f := range n.List {
+			depthWalk(f, depth+1, fun)
+		}
+
+		// Expressions
+	case *ast.BadExpr, *ast.Ident, *ast.BasicLit:
+
+	case *ast.Ellipsis:
+		if n.Elt != nil {
+			depthWalk(n.Elt, depth+1, fun)
+		}
+
+	case *ast.FuncLit:
+		depthWalk(n.Type, depth+1, fun)
+		depthWalk(n.Body, depth+1, fun)
+
+	case *ast.CompositeLit:
+		if n.Type != nil {
+			depthWalk(n.Type, depth+1, fun)
+		}
+		walkExprList(n.Elts, depth+1, fun)
+
+	case *ast.ParenExpr:
+		depthWalk(n.X, depth+1, fun)
+
+	case *ast.SelectorExpr:
+		depthWalk(n.X, depth+1, fun)
+		depthWalk(n.Sel, depth+1, fun)
+
+	case *ast.IndexExpr:
+		depthWalk(n.X, depth+1, fun)
+		depthWalk(n.Index, depth+1, fun)
+
+	case *ast.SliceExpr:
+		depthWalk(n.X, depth+1, fun)
+		if n.Low != nil {
+			depthWalk(n.Low, depth+1, fun)
+		}
+		if n.High != nil {
+			depthWalk(n.High, depth+1, fun)
+		}
+		if n.Max != nil {
+			depthWalk(n.Max, depth+1, fun)
+		}
+
+	case *ast.TypeAssertExpr:
+		depthWalk(n.X, depth+1, fun)
+		if n.Type != nil {
+			depthWalk(n.Type, depth+1, fun)
+		}
+
+	case *ast.CallExpr:
+		depthWalk(n.Fun, depth+1, fun)
+		walkExprList(n.Args, depth+1, fun)
+
+	case *ast.StarExpr:
+		depthWalk(n.X, depth+1, fun)
+
+	case *ast.UnaryExpr:
+		depthWalk(n.X, depth+1, fun)
+
+	case *ast.BinaryExpr:
+		depthWalk(n.X, depth+1, fun)
+		depthWalk(n.Y, depth+1, fun)
+
+	case *ast.KeyValueExpr:
+		depthWalk(n.Key, depth+1, fun)
+		depthWalk(n.Value, depth+1, fun)
+
+	// Types
+	case *ast.ArrayType:
+		if n.Len != nil {
+			depthWalk(n.Len, depth+1, fun)
+		}
+		depthWalk(n.Elt, depth+1, fun)
+
+	case *ast.StructType:
+		depthWalk(n.Fields, depth+1, fun)
+
+	case *ast.FuncType:
+		if n.Params != nil {
+			depthWalk(n.Params, depth+1, fun)
+		}
+		if n.Results != nil {
+			depthWalk(n.Results, depth+1, fun)
+		}
+
+	case *ast.InterfaceType:
+		depthWalk(n.Methods, depth+1, fun)
+
+	case *ast.MapType:
+		depthWalk(n.Key, depth+1, fun)
+		depthWalk(n.Value, depth+1, fun)
+
+	case *ast.ChanType:
+		depthWalk(n.Value, depth+1, fun)
+
+	// Statements
+	case *ast.BadStmt:
+
+	case *ast.DeclStmt:
+		depthWalk(n.Decl, depth+1, fun)
+
+	case *ast.EmptyStmt:
+
+	case *ast.LabeledStmt:
+		depthWalk(n.Label, depth+1, fun)
+		depthWalk(n.Stmt, depth+1, fun)
+
+	case *ast.ExprStmt:
+		depthWalk(n.X, depth+1, fun)
+
+	case *ast.SendStmt:
+		depthWalk(n.Chan, depth+1, fun)
+		depthWalk(n.Value, depth+1, fun)
+
+	case *ast.IncDecStmt:
+		depthWalk(n.X, depth+1, fun)
+
+	case *ast.AssignStmt:
+		walkExprList(n.Lhs, depth+1, fun)
+		walkExprList(n.Rhs, depth+1, fun)
+
+	case *ast.GoStmt:
+		depthWalk(n.Call, depth+1, fun)
+
+	case *ast.DeferStmt:
+		depthWalk(n.Call, depth+1, fun)
+
+	case *ast.ReturnStmt:
+		walkExprList(n.Results, depth+1, fun)
+
+	case *ast.BranchStmt:
+		if n.Label != nil {
+			depthWalk(n.Label, depth+1, fun)
+		}
+
+	case *ast.BlockStmt:
+		walkStmtList(n.List, depth+1, fun)
+
+	case *ast.IfStmt:
+		if n.Init != nil {
+			depthWalk(n.Init, depth+1, fun)
+		}
+		depthWalk(n.Cond, depth+1, fun)
+		depthWalk(n.Body, depth+1, fun)
+		if n.Else != nil {
+			depthWalk(n.Else, depth+1, fun)
+		}
+
+	case *ast.CaseClause:
+		walkExprList(n.List, depth+1, fun)
+		walkStmtList(n.Body, depth+1, fun)
+
+	case *ast.SwitchStmt:
+		if n.Init != nil {
+			depthWalk(n.Init, depth+1, fun)
+		}
+		if n.Tag != nil {
+			depthWalk(n.Tag, depth+1, fun)
+		}
+		depthWalk(n.Body, depth+1, fun)
+
+	case *ast.TypeSwitchStmt:
+		if n.Init != nil {
+			depthWalk(n.Init, depth+1, fun)
+		}
+		depthWalk(n.Assign, depth+1, fun)
+		depthWalk(n.Body, depth+1, fun)
+
+	case *ast.CommClause:
+		if n.Comm != nil {
+			depthWalk(n.Comm, depth+1, fun)
+		}
+		walkStmtList(n.Body, depth+1, fun)
+
+	case *ast.SelectStmt:
+		depthWalk(n.Body, depth+1, fun)
+
+	case *ast.ForStmt:
+		if n.Init != nil {
+			depthWalk(n.Init, depth+1, fun)
+		}
+		if n.Cond != nil {
+			depthWalk(n.Cond, depth+1, fun)
+		}
+		if n.Post != nil {
+			depthWalk(n.Post, depth+1, fun)
+		}
+		depthWalk(n.Body, depth+1, fun)
+
+	case *ast.RangeStmt:
+		if n.Key != nil {
+			depthWalk(n.Key, depth+1, fun)
+		}
+		if n.Value != nil {
+			depthWalk(n.Value, depth+1, fun)
+		}
+		depthWalk(n.X, depth+1, fun)
+		depthWalk(n.Body, depth+1, fun)
+
+	// Declarations
+	case *ast.ImportSpec:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		if n.Name != nil {
+			depthWalk(n.Name, depth+1, fun)
+		}
+		depthWalk(n.Path, depth+1, fun)
+		if n.Comment != nil {
+			depthWalk(n.Comment, depth+1, fun)
+		}
+
+	case *ast.ValueSpec:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		walkIdentList(n.Names, depth+1, fun)
+		if n.Type != nil {
+			depthWalk(n.Type, depth+1, fun)
+		}
+		walkExprList(n.Values, depth+1, fun)
+		if n.Comment != nil {
+			depthWalk(n.Comment, depth+1, fun)
+		}
+
+	case *ast.TypeSpec:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		depthWalk(n.Name, depth+1, fun)
+		depthWalk(n.Type, depth+1, fun)
+		if n.Comment != nil {
+			depthWalk(n.Comment, depth+1, fun)
+		}
+
+	case *ast.BadDecl:
+
+	case *ast.GenDecl:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		for _, s := range n.Specs {
+			depthWalk(s, depth+1, fun)
+		}
+
+	case *ast.FuncDecl:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		if n.Recv != nil {
+			depthWalk(n.Recv, depth+1, fun)
+		}
+		depthWalk(n.Name, depth+1, fun)
+		depthWalk(n.Type, depth+1, fun)
+		if n.Body != nil {
+			depthWalk(n.Body, depth+1, fun)
+		}
+
+	// Files and packages
+	case *ast.File:
+		if n.Doc != nil {
+			depthWalk(n.Doc, depth+1, fun)
+		}
+		depthWalk(n.Name, depth+1, fun)
+		walkDeclList(n.Decls, depth+1, fun)
+		// don't walk n.Comments - they have been
+		// visited already through the individual
+		// nodes
+
+	case *ast.Package:
+		for _, f := range n.Files {
+			depthWalk(f, depth+1, fun)
+		}
+
+	default:
+		panic(fmt.Sprintf("gas.depthWalk: unexpected node type %T", n))
+	}
+}
+
+type Selector interface {
+	Final(ast.Node)
+	Partial(ast.Node) bool
+}
+
+func Select(s Selector, n ast.Node, bits ...reflect.Type) {
+	fun := func(n ast.Node, d int) bool {
+		if d < len(bits) && reflect.TypeOf(n) == bits[d] {
+			if d == len(bits)-1 {
+				s.Final(n)
+				return false
+			} else if s.Partial(n) {
+				return true
+			}
+		}
+		return false
+	}
+	depthWalk(n, 0, fun)
+}
+
+// SimpleSelect will try to match a path through a sub-tree starting at a given AST node.
+// The type of each node in the path at a given depth must match its entry in list of
+// node types given.
+func SimpleSelect(n ast.Node, bits ...reflect.Type) ast.Node {
+	var found ast.Node
+	fun := func(n ast.Node, d int) bool {
+		if found != nil {
+			return false // short cut logic if we have found a match
+		}
+
+		if d < len(bits) && reflect.TypeOf(n) == bits[d] {
+			if d == len(bits)-1 {
+				found = n
+				return false
+			}
+			return true
+		}
+		return false
+	}
+
+	depthWalk(n, 0, fun)
+	return found
+}

tools/vendor/github.com/GoASTScanner/gas/filelist.go

@@ -0,0 +1,87 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/ryanuber/go-glob"
+)
+
+// fileList uses a map for patterns to ensure each pattern only
+// appears once
+type fileList struct {
+	patterns map[string]struct{}
+}
+
+func newFileList(paths ...string) *fileList {
+	f := &fileList{
+		patterns: make(map[string]struct{}),
+	}
+	for _, p := range paths {
+		f.patterns[p] = struct{}{}
+	}
+	return f
+}
+
+func (f *fileList) String() string {
+	ps := make([]string, 0, len(f.patterns))
+	for p := range f.patterns {
+		ps = append(ps, p)
+	}
+	sort.Strings(ps)
+	return strings.Join(ps, ", ")
+}
+
+func (f *fileList) Set(path string) error {
+	if path == "" {
+		// don't bother adding the empty path
+		return nil
+	}
+	f.patterns[path] = struct{}{}
+	return nil
+}
+
+func (f fileList) Contains(path string) bool {
+	for p := range f.patterns {
+		if strings.Contains(p, glob.GLOB) {
+			if glob.Glob(p, path) {
+				if logger != nil {
+					logger.Printf("skipping: %s\n", path)
+				}
+				return true
+			}
+		} else {
+			// check if only a sub-folder of the path is excluded
+			if strings.Contains(path, p) {
+				if logger != nil {
+					logger.Printf("skipping: %s\n", path)
+				}
+				return true
+			}
+
+		}
+	}
+	return false
+}
+
+/*
+func (f fileList) Dump() {
+	for k, _ := range f.paths {
+		println(k)
+	}
+}
+*/

tools/vendor/github.com/GoASTScanner/gas/main.go

@@ -0,0 +1,293 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io/ioutil"
+	"log"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	gas "github.com/GoASTScanner/gas/core"
+	"github.com/GoASTScanner/gas/output"
+)
+
+type recursion bool
+
+const (
+	recurse   recursion = true
+	noRecurse recursion = false
+)
+
+var (
+	// #nosec flag
+	flagIgnoreNoSec = flag.Bool("nosec", false, "Ignores #nosec comments when set")
+
+	// format output
+	flagFormat = flag.String("fmt", "text", "Set output format. Valid options are: json, csv, html, or text")
+
+	// output file
+	flagOutput = flag.String("out", "", "Set output file for results")
+
+	// config file
+	flagConfig = flag.String("conf", "", "Path to optional config file")
+
+	// quiet
+	flagQuiet = flag.Bool("quiet", false, "Only show output when errors are found")
+
+	usageText = `
+GAS - Go AST Scanner
+
+Gas analyzes Go source code to look for common programming mistakes that
+can lead to security problems.
+
+USAGE:
+
+	# Check a single Go file
+	$ gas example.go
+
+	# Check all files under the current directory and save results in
+	# json format.
+	$ gas -fmt=json -out=results.json ./...
+
+	# Run a specific set of rules (by default all rules will be run):
+	$ gas -include=G101,G203,G401 ./...
+
+	# Run all rules except the provided
+	$ gas -exclude=G101 ./...
+
+`
+
+	logger *log.Logger
+)
+
+func extendConfList(conf map[string]interface{}, name string, inputStr string) {
+	if inputStr == "" {
+		conf[name] = []string{}
+	} else {
+		input := strings.Split(inputStr, ",")
+		if val, ok := conf[name]; ok {
+			if data, ok := val.(*[]string); ok {
+				conf[name] = append(*data, input...)
+			} else {
+				logger.Fatal("Config item must be a string list: ", name)
+			}
+		} else {
+			conf[name] = input
+		}
+	}
+}
+
+func buildConfig(incRules string, excRules string) map[string]interface{} {
+	config := make(map[string]interface{})
+	if flagConfig != nil && *flagConfig != "" { // parse config if we have one
+		if data, err := ioutil.ReadFile(*flagConfig); err == nil {
+			if err := json.Unmarshal(data, &(config)); err != nil {
+				logger.Fatal("Could not parse JSON config: ", *flagConfig, ": ", err)
+			}
+		} else {
+			logger.Fatal("Could not read config file: ", *flagConfig)
+		}
+	}
+
+	// add in CLI include and exclude data
+	extendConfList(config, "include", incRules)
+	extendConfList(config, "exclude", excRules)
+
+	// override ignoreNosec if given on CLI
+	if flagIgnoreNoSec != nil {
+		config["ignoreNosec"] = *flagIgnoreNoSec
+	} else {
+		val, ok := config["ignoreNosec"]
+		if !ok {
+			config["ignoreNosec"] = false
+		} else if _, ok := val.(bool); !ok {
+			logger.Fatal("Config value must be a bool: 'ignoreNosec'")
+		}
+	}
+
+	return config
+}
+
+// #nosec
+func usage() {
+
+	fmt.Fprintln(os.Stderr, usageText)
+	fmt.Fprint(os.Stderr, "OPTIONS:\n\n")
+	flag.PrintDefaults()
+	fmt.Fprint(os.Stderr, "\n\nRULES:\n\n")
+
+	// sorted rule list for eas of reading
+	rl := GetFullRuleList()
+	keys := make([]string, 0, len(rl))
+	for key := range rl {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	for _, k := range keys {
+		v := rl[k]
+		fmt.Fprintf(os.Stderr, "\t%s: %s\n", k, v.description)
+	}
+	fmt.Fprint(os.Stderr, "\n")
+}
+
+func main() {
+
+	// Setup usage description
+	flag.Usage = usage
+
+	//  Exclude files
+	excluded := newFileList("*_test.go")
+	flag.Var(excluded, "skip", "File pattern to exclude from scan. Uses simple * globs and requires full or partial match")
+
+	incRules := ""
+	flag.StringVar(&incRules, "include", "", "Comma separated list of rules IDs to include. (see rule list)")
+
+	excRules := ""
+	flag.StringVar(&excRules, "exclude", "", "Comma separated list of rules IDs to exclude. (see rule list)")
+
+	// Custom commands / utilities to run instead of default analyzer
+	tools := newUtils()
+	flag.Var(tools, "tool", "GAS utilities to assist with rule development")
+
+	// Setup logging
+	logger = log.New(os.Stderr, "[gas] ", log.LstdFlags)
+
+	// Parse command line arguments
+	flag.Parse()
+
+	// Ensure at least one file was specified
+	if flag.NArg() == 0 {
+
+		fmt.Fprintf(os.Stderr, "\nError: FILE [FILE...] or './...' expected\n")
+		flag.Usage()
+		os.Exit(1)
+	}
+
+	// Run utils instead of analysis
+	if len(tools.call) > 0 {
+		tools.run(flag.Args()...)
+		os.Exit(0)
+	}
+
+	// Setup analyzer
+	config := buildConfig(incRules, excRules)
+	analyzer := gas.NewAnalyzer(config, logger)
+	AddRules(&analyzer, config)
+
+	toAnalyze := getFilesToAnalyze(flag.Args(), excluded)
+
+	for _, file := range toAnalyze {
+		logger.Printf(`Processing "%s"...`, file)
+		if err := analyzer.Process(file); err != nil {
+			logger.Printf(`Failed to process: "%s"`, file)
+			logger.Println(err)
+			logger.Fatalf(`Halting execution.`)
+		}
+	}
+
+	issuesFound := len(analyzer.Issues) > 0
+	// Exit quietly if nothing was found
+	if !issuesFound && *flagQuiet {
+		os.Exit(0)
+	}
+
+	// Create output report
+	if *flagOutput != "" {
+		outfile, err := os.Create(*flagOutput)
+		if err != nil {
+			logger.Fatalf("Couldn't open: %s for writing. Reason - %s", *flagOutput, err)
+		}
+		defer outfile.Close()
+		output.CreateReport(outfile, *flagFormat, &analyzer)
+	} else {
+		output.CreateReport(os.Stdout, *flagFormat, &analyzer)
+	}
+
+	// Do we have an issue? If so exit 1
+	if issuesFound {
+		os.Exit(1)
+	}
+}
+
+// getFilesToAnalyze lists all files
+func getFilesToAnalyze(paths []string, excluded *fileList) []string {
+	//log.Println("getFilesToAnalyze: start")
+	var toAnalyze []string
+	for _, relativePath := range paths {
+		//log.Printf("getFilesToAnalyze: processing \"%s\"\n", path)
+		// get the absolute path before doing anything else
+		path, err := filepath.Abs(relativePath)
+		if err != nil {
+			log.Fatal(err)
+		}
+		if filepath.Base(relativePath) == "..." {
+			toAnalyze = append(
+				toAnalyze,
+				listFiles(filepath.Dir(path), recurse, excluded)...,
+			)
+		} else {
+			var (
+				finfo os.FileInfo
+				err   error
+			)
+			if finfo, err = os.Stat(path); err != nil {
+				logger.Fatal(err)
+			}
+			if !finfo.IsDir() {
+				if shouldInclude(path, excluded) {
+					toAnalyze = append(toAnalyze, path)
+				}
+			} else {
+				toAnalyze = listFiles(path, noRecurse, excluded)
+			}
+		}
+	}
+	//log.Println("getFilesToAnalyze: end")
+	return toAnalyze
+}
+
+// listFiles returns a list of all files found that pass the shouldInclude check.
+// If doRecursiveWalk it true, it will walk the tree rooted at absPath, otherwise it
+// will only include files directly within the dir referenced by absPath.
+func listFiles(absPath string, doRecursiveWalk recursion, excluded *fileList) []string {
+	var files []string
+
+	walk := func(path string, info os.FileInfo, err error) error {
+		if info.IsDir() && doRecursiveWalk == noRecurse {
+			return filepath.SkipDir
+		}
+		if shouldInclude(path, excluded) {
+			files = append(files, path)
+		}
+		return nil
+	}
+
+	if err := filepath.Walk(absPath, walk); err != nil {
+		log.Fatal(err)
+	}
+	return files
+}
+
+// shouldInclude checks if a specific path which is expected to reference
+// a regular file should be included
+func shouldInclude(path string, excluded *fileList) bool {
+	return filepath.Ext(path) == ".go" && !excluded.Contains(path)
+}

tools/vendor/github.com/GoASTScanner/gas/output/formatter.go

@@ -0,0 +1,116 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package output
+
+import (
+	"encoding/csv"
+	"encoding/json"
+	htmlTemplate "html/template"
+	"io"
+	"strconv"
+	plainTemplate "text/template"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+// The output format for reported issues
+type ReportFormat int
+
+const (
+	ReportText ReportFormat = iota // Plain text format
+	ReportJSON                     // Json format
+	ReportCSV                      // CSV format
+)
+
+var text = `Results:
+{{ range $index, $issue := .Issues }}
+[{{ $issue.File }}:{{ $issue.Line }}] - {{ $issue.What }} (Confidence: {{ $issue.Confidence}}, Severity: {{ $issue.Severity }})
+  > {{ $issue.Code }}
+
+{{ end }}
+Summary:
+   Files: {{.Stats.NumFiles}}
+   Lines: {{.Stats.NumLines}}
+   Nosec: {{.Stats.NumNosec}}
+  Issues: {{.Stats.NumFound}}
+
+`
+
+func CreateReport(w io.Writer, format string, data *gas.Analyzer) error {
+	var err error
+	switch format {
+	case "json":
+		err = reportJSON(w, data)
+	case "csv":
+		err = reportCSV(w, data)
+	case "html":
+		err = reportFromHTMLTemplate(w, html, data)
+	case "text":
+		err = reportFromPlaintextTemplate(w, text, data)
+	default:
+		err = reportFromPlaintextTemplate(w, text, data)
+	}
+	return err
+}
+
+func reportJSON(w io.Writer, data *gas.Analyzer) error {
+	raw, err := json.MarshalIndent(data, "", "\t")
+	if err != nil {
+		panic(err)
+	}
+
+	_, err = w.Write(raw)
+	if err != nil {
+		panic(err)
+	}
+	return err
+}
+
+func reportCSV(w io.Writer, data *gas.Analyzer) error {
+	out := csv.NewWriter(w)
+	defer out.Flush()
+	for _, issue := range data.Issues {
+		err := out.Write([]string{
+			issue.File,
+			strconv.Itoa(issue.Line),
+			issue.What,
+			issue.Severity.String(),
+			issue.Confidence.String(),
+			issue.Code,
+		})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func reportFromPlaintextTemplate(w io.Writer, reportTemplate string, data *gas.Analyzer) error {
+	t, e := plainTemplate.New("gas").Parse(reportTemplate)
+	if e != nil {
+		return e
+	}
+
+	return t.Execute(w, data)
+}
+
+func reportFromHTMLTemplate(w io.Writer, reportTemplate string, data *gas.Analyzer) error {
+	t, e := htmlTemplate.New("gas").Parse(reportTemplate)
+	if e != nil {
+		return e
+	}
+
+	return t.Execute(w, data)
+}

tools/vendor/github.com/GoASTScanner/gas/output/template.go

@@ -0,0 +1,401 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package output
+
+const html = `
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Go AST Scanner</title>
+  <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/bulma/0.2.1/css/bulma.min.css" integrity="sha256-DRcOKg8NK1KkSkcymcGmxOtS/lAn0lHWJXRa15gMHHk=" crossorigin="anonymous"/>
+  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/react/15.3.2/react.min.js" integrity="sha256-cLWs9L+cjZg8CjGHMpJqUgKKouPlmoMP/0wIdPtaPGs=" crossorigin="anonymous"></script>
+  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/react/15.3.2/react-dom.min.js" integrity="sha256-JIW8lNqN2EtqC6ggNZYnAdKMJXRQfkPMvdRt+b0/Jxc=" crossorigin="anonymous"></script>
+  <script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/babel-standalone/6.17.0/babel.min.js" integrity="sha256-1IWWLlCKFGFj/cjryvC7GDF5wRYnf9tSvNVVEj8Bm+o=" crossorigin="anonymous"></script>
+  <style>
+    div.issue div.tag, div.panel-block input[type="checkbox"] {
+      margin-right: 0.5em;
+    }
+    
+    label.disabled {
+      text-decoration: line-through;
+    }
+    
+    nav.panel select {
+      width: 100%;
+    }
+
+    .break-word {
+      word-wrap: break-word;
+    }
+  </style>
+</head>
+<body>
+  <section class="section">
+    <div class="container">
+      <div id="content"></div>
+    </div>
+  </section>
+  <script>
+    var data = {{ . }};
+  </script>
+  <script type="text/babel">
+    var IssueTag = React.createClass({
+      render: function() {
+        var level = ""
+        if (this.props.level === "HIGH") {
+          level = "is-danger";
+        }
+        if (this.props.level === "MEDIUM") {
+          level = "is-warning";
+        }
+        return (
+          <div className={ "tag " + level }>
+            { this.props.label }: { this.props.level }
+          </div>
+        );
+      }
+    });
+    
+    var Issue = React.createClass({
+      render: function() {
+        return (
+          <div className="issue box">
+            <div className="is-pulled-right">
+              <IssueTag label="Severity" level={ this.props.data.severity }/>
+              <IssueTag label="Confidence" level={ this.props.data.confidence }/>
+            </div>
+            <p>
+              <strong className="break-word">
+                { this.props.data.file } (line { this.props.data.line })
+              </strong>
+              <br/>
+              { this.props.data.details }
+            </p>
+            <figure className="highlight">
+              <pre>
+                <code className="golang hljs">
+                  { this.props.data.code }
+                </code>
+              </pre>
+            </figure>
+          </div>
+        );
+      }
+    });
+    
+    var Stats = React.createClass({
+      render: function() {
+        return (
+          <p className="help">
+            Scanned { this.props.data.metrics.files.toLocaleString() } files
+            with { this.props.data.metrics.lines.toLocaleString() } lines of code.
+          </p>
+        );
+      }
+    });
+    
+    var Issues = React.createClass({
+      render: function() {
+        if (this.props.data.metrics.files === 0) {
+          return (
+            <div className="notification">
+              No source files found. Do you even Go?
+            </div>
+          );
+        }
+    
+        if (this.props.data.issues.length === 0) {
+          return (
+            <div>
+              <div className="notification">
+                Awesome! No issues found!
+              </div>
+              <Stats data={ this.props.data } />
+            </div>
+          );
+        }
+    
+        var issues = this.props.data.issues
+          .filter(function(issue) {
+            return this.props.severity.includes(issue.severity);
+          }.bind(this))
+          .filter(function(issue) {
+            return this.props.confidence.includes(issue.confidence);
+          }.bind(this))
+          .filter(function(issue) {
+            if (this.props.issueType) {
+              return issue.details.toLowerCase().startsWith(this.props.issueType.toLowerCase());
+            } else {
+              return true
+            }
+          }.bind(this))
+          .map(function(issue) {
+            return (<Issue data={issue} />);
+          }.bind(this));
+    
+        if (issues.length === 0) {
+          return (
+            <div>
+              <div className="notification">
+                No issues matched given filters
+                (of total { this.props.data.issues.length } issues).
+              </div>
+              <Stats data={ this.props.data } />
+            </div>
+          );
+        }
+    
+        return (
+          <div className="issues">
+            { issues }
+            <Stats data={ this.props.data } />
+          </div>
+        );
+      }
+    });
+    
+    var LevelSelector = React.createClass({
+      handleChange: function(level) {
+        return function(e) {
+          var updated = this.props.selected
+            .filter(function(item) { return item != level; });
+          if (e.target.checked) {
+            updated.push(level);
+          }
+          this.props.onChange(updated);
+        }.bind(this);
+      },
+      render: function() {
+        var highDisabled = !this.props.available.includes("HIGH");
+        var mediumDisabled = !this.props.available.includes("MEDIUM");
+        var lowDisabled = !this.props.available.includes("LOW");
+     
+        return (
+          <span>
+            <label className={"label checkbox " + (highDisabled ? "disabled" : "") }>
+              <input
+                type="checkbox"
+                checked={ this.props.selected.includes("HIGH") }
+                disabled={ highDisabled }
+                onChange={ this.handleChange("HIGH") }/>
+              High
+            </label>
+            <label className={"label checkbox " + (mediumDisabled ? "disabled" : "") }>
+              <input
+                type="checkbox"
+                checked={ this.props.selected.includes("MEDIUM") }
+                disabled={ mediumDisabled }
+                onChange={ this.handleChange("MEDIUM") }/>
+              Medium
+            </label>
+            <label className={"label checkbox " + (lowDisabled ? "disabled" : "") }>
+              <input
+                type="checkbox"
+                checked={ this.props.selected.includes("LOW") }
+                disabled={ lowDisabled }
+                onChange={ this.handleChange("LOW") }/>
+              Low
+            </label>
+          </span>
+        );
+      }
+    });
+    
+    var Navigation = React.createClass({
+      updateSeverity: function(vals) {
+        this.props.onSeverity(vals);
+      },
+      updateConfidence: function(vals) {
+        this.props.onConfidence(vals);
+      },
+      updateIssueType: function(e) {
+        if (e.target.value == "all") {
+          this.props.onIssueType(null);
+        } else {
+          this.props.onIssueType(e.target.value);
+        }
+      },
+      render: function() {
+        var issueTypes = this.props.allIssueTypes
+          .map(function(it) {
+            return (
+              <option value={ it } selected={ this.props.issueType == it }>
+                { it }
+              </option>
+            );
+          }.bind(this));
+    
+        return (
+          <nav className="panel">
+            <div className="panel-heading">
+              Filters
+            </div>
+            <div className="panel-block">
+              <strong>
+                Severity
+              </strong>
+            </div>
+            <div className="panel-block">
+              <LevelSelector 
+                selected={ this.props.severity }
+                available={ this.props.allSeverities }
+                onChange={ this.updateSeverity } />
+            </div>
+            <div className="panel-block">
+              <strong>
+                Confidence
+              </strong>
+            </div>
+            <div className="panel-block">
+              <LevelSelector
+                selected={ this.props.confidence }
+                available={ this.props.allConfidences }
+                onChange={ this.updateConfidence } />
+            </div>
+            <div className="panel-block">
+              <strong>
+                Issue Type
+              </strong>
+            </div>
+            <div className="panel-block">
+              <select onChange={ this.updateIssueType }>
+                <option value="all" selected={ !this.props.issueType }>
+                  (all)
+                </option>
+                { issueTypes }
+              </select>
+            </div>
+          </nav>
+        );
+      }
+    });
+    
+    var IssueBrowser = React.createClass({
+      getInitialState: function() {
+        return {};
+      },
+      componentWillMount: function() {
+        this.updateIssues(this.props.data);
+      },
+      handleSeverity: function(val) {
+        this.updateIssueTypes(this.props.data.issues, val, this.state.confidence);
+        this.setState({severity: val});
+      },
+      handleConfidence: function(val) {
+        this.updateIssueTypes(this.props.data.issues, this.state.severity, val);
+        this.setState({confidence: val});
+      },
+      handleIssueType: function(val) {
+        this.setState({issueType: val});
+      },
+      updateIssues: function(data) {
+        if (!data) {
+          this.setState({data: data});
+          return;
+        }
+    
+        var allSeverities = data.issues
+          .map(function(issue) {
+            return issue.severity
+          })
+          .sort()
+          .filter(function(item, pos, ary) {
+            return !pos || item != ary[pos - 1];
+          });
+    
+        var allConfidences = data.issues
+          .map(function(issue) {
+            return issue.confidence
+          })
+          .sort()
+          .filter(function(item, pos, ary) {
+            return !pos || item != ary[pos - 1];
+          });
+    
+        var selectedSeverities = allSeverities;
+        var selectedConfidences = allConfidences;
+    
+        this.updateIssueTypes(data.issues, selectedSeverities, selectedConfidences);
+    
+        this.setState({
+          data: data,
+          severity: selectedSeverities,
+          allSeverities: allSeverities,
+          confidence: selectedConfidences,
+          allConfidences: allConfidences,
+          issueType: null
+        });
+      },
+      updateIssueTypes: function(issues, severities, confidences) {
+        var allTypes = issues
+          .filter(function(issue) {
+            return severities.includes(issue.severity);
+          })
+          .filter(function(issue) {
+            return confidences.includes(issue.confidence);
+          })
+          .map(function(issue) {
+            return issue.details;
+          })
+          .sort()
+          .filter(function(item, pos, ary) {
+            return !pos || item != ary[pos - 1];
+          });
+    
+        if (this.state.issueType && !allTypes.includes(this.state.issueType)) {
+          this.setState({issueType: null});
+        }
+    
+        this.setState({allIssueTypes: allTypes});
+      },
+      render: function() {
+        return (
+          <div className="content">
+            <div className="columns">
+              <div className="column is-one-quarter">
+                <Navigation
+                  severity={ this.state.severity } 
+                  confidence={ this.state.confidence }
+                  issueType={ this.state.issueType }
+                  allSeverities={ this.state.allSeverities } 
+                  allConfidences={ this.state.allConfidences }
+                  allIssueTypes={ this.state.allIssueTypes }
+                  onSeverity={ this.handleSeverity } 
+                  onConfidence={ this.handleConfidence } 
+                  onIssueType={ this.handleIssueType }
+                />
+              </div>
+              <div className="column is-three-quarters">
+                <Issues
+                  data={ this.props.data }
+                  severity={ this.state.severity }
+                  confidence={ this.state.confidence }
+                  issueType={ this.state.issueType }
+                />
+              </div>
+            </div>
+          </div>
+        );
+      }
+    });
+    
+    ReactDOM.render(
+      <IssueBrowser data={ data } />,
+      document.getElementById("content")
+    );
+  </script>
+</body>
+</html>`

tools/vendor/github.com/GoASTScanner/gas/rulelist.go

@@ -0,0 +1,91 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+	"github.com/GoASTScanner/gas/rules"
+)
+
+type RuleInfo struct {
+	description string
+	build       func(map[string]interface{}) (gas.Rule, []ast.Node)
+}
+
+// GetFullRuleList get the full list of all rules available to GAS
+func GetFullRuleList() map[string]RuleInfo {
+	return map[string]RuleInfo{
+		// misc
+		"G101": RuleInfo{"Look for hardcoded credentials", rules.NewHardcodedCredentials},
+		"G102": RuleInfo{"Bind to all interfaces", rules.NewBindsToAllNetworkInterfaces},
+		"G103": RuleInfo{"Audit the use of unsafe block", rules.NewUsingUnsafe},
+		"G104": RuleInfo{"Audit errors not checked", rules.NewNoErrorCheck},
+		"G105": RuleInfo{"Audit the use of big.Exp function", rules.NewUsingBigExp},
+
+		// injection
+		"G201": RuleInfo{"SQL query construction using format string", rules.NewSqlStrFormat},
+		"G202": RuleInfo{"SQL query construction using string concatenation", rules.NewSqlStrConcat},
+		"G203": RuleInfo{"Use of unescaped data in HTML templates", rules.NewTemplateCheck},
+		"G204": RuleInfo{"Audit use of command execution", rules.NewSubproc},
+
+		// filesystem
+		"G301": RuleInfo{"Poor file permissions used when creating a directory", rules.NewMkdirPerms},
+		"G302": RuleInfo{"Poor file permisions used when creation file or using chmod", rules.NewFilePerms},
+		"G303": RuleInfo{"Creating tempfile using a predictable path", rules.NewBadTempFile},
+
+		// crypto
+		"G401": RuleInfo{"Detect the usage of DES, RC4, or MD5", rules.NewUsesWeakCryptography},
+		"G402": RuleInfo{"Look for bad TLS connection settings", rules.NewIntermediateTlsCheck},
+		"G403": RuleInfo{"Ensure minimum RSA key length of 2048 bits", rules.NewWeakKeyStrength},
+		"G404": RuleInfo{"Insecure random number source (rand)", rules.NewWeakRandCheck},
+
+		// blacklist
+		"G501": RuleInfo{"Import blacklist: crypto/md5", rules.NewBlacklist_crypto_md5},
+		"G502": RuleInfo{"Import blacklist: crypto/des", rules.NewBlacklist_crypto_des},
+		"G503": RuleInfo{"Import blacklist: crypto/rc4", rules.NewBlacklist_crypto_rc4},
+		"G504": RuleInfo{"Import blacklist: net/http/cgi", rules.NewBlacklist_net_http_cgi},
+	}
+}
+
+func AddRules(analyzer *gas.Analyzer, conf map[string]interface{}) {
+	var all map[string]RuleInfo
+
+	inc := conf["include"].([]string)
+	exc := conf["exclude"].([]string)
+
+	// add included rules
+	if len(inc) == 0 {
+		all = GetFullRuleList()
+	} else {
+		all = map[string]RuleInfo{}
+		tmp := GetFullRuleList()
+		for _, v := range inc {
+			if val, ok := tmp[v]; ok {
+				all[v] = val
+			}
+		}
+	}
+
+	// remove excluded rules
+	for _, v := range exc {
+		delete(all, v)
+	}
+
+	for _, v := range all {
+		analyzer.AddRule(v.build(conf))
+	}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/big.go

@@ -0,0 +1,44 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+)
+
+type UsingBigExp struct {
+	gas.MetaData
+	pkg   string
+	calls []string
+}
+
+func (r *UsingBigExp) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if _, matched := gas.MatchCallByType(n, c, r.pkg, r.calls...); matched {
+		return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+	}
+	return nil, nil
+}
+func NewUsingBigExp(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &UsingBigExp{
+		pkg:   "*math/big.Int",
+		calls: []string{"Exp"},
+		MetaData: gas.MetaData{
+			What:       "Use of math/big.Int.Exp function should be audited for modulus == 0",
+			Severity:   gas.Low,
+			Confidence: gas.High,
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/bind.go

@@ -0,0 +1,52 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+// Looks for net.Listen("0.0.0.0") or net.Listen(":8080")
+type BindsToAllNetworkInterfaces struct {
+	gas.MetaData
+	call    *regexp.Regexp
+	pattern *regexp.Regexp
+}
+
+func (r *BindsToAllNetworkInterfaces) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, r.call); node != nil {
+		if arg, err := gas.GetString(node.Args[1]); err == nil {
+			if r.pattern.MatchString(arg) {
+				return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+			}
+		}
+	}
+	return
+}
+
+func NewBindsToAllNetworkInterfaces(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BindsToAllNetworkInterfaces{
+		call:    regexp.MustCompile(`^(net|tls)\.Listen$`),
+		pattern: regexp.MustCompile(`^(0.0.0.0|:).*$`),
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       "Binds to all network interfaces",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/blacklist.go

@@ -0,0 +1,79 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type BlacklistImport struct {
+	gas.MetaData
+	Path string
+}
+
+func (r *BlacklistImport) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node, ok := n.(*ast.ImportSpec); ok {
+		if r.Path == node.Path.Value && node.Name.String() != "_" {
+			return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewBlacklist_crypto_md5(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+		Path: `"crypto/md5"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}
+
+func NewBlacklist_crypto_des(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+		Path: `"crypto/des"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}
+
+func NewBlacklist_crypto_rc4(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+		Path: `"crypto/rc4"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}
+
+func NewBlacklist_net_http_cgi(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BlacklistImport{
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.High,
+			What:       "Go versions < 1.6.3 are vulnerable to Httpoxy attack: (CVE-2016-5386)",
+		},
+		Path: `"net/http/cgi"`,
+	}, []ast.Node{(*ast.ImportSpec)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/errors.go

@@ -0,0 +1,96 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+	"go/types"
+)
+
+type NoErrorCheck struct {
+	gas.MetaData
+	whitelist gas.CallList
+}
+
+func returnsError(callExpr *ast.CallExpr, ctx *gas.Context) int {
+	if tv := ctx.Info.TypeOf(callExpr); tv != nil {
+		switch t := tv.(type) {
+		case *types.Tuple:
+			for pos := 0; pos < t.Len(); pos += 1 {
+				variable := t.At(pos)
+				if variable != nil && variable.Type().String() == "error" {
+					return pos
+				}
+			}
+		case *types.Named:
+			if t.String() == "error" {
+				return 0
+			}
+		}
+	}
+	return -1
+}
+
+func (r *NoErrorCheck) Match(n ast.Node, ctx *gas.Context) (*gas.Issue, error) {
+	switch stmt := n.(type) {
+	case *ast.AssignStmt:
+		for _, expr := range stmt.Rhs {
+			if callExpr, ok := expr.(*ast.CallExpr); ok && !r.whitelist.ContainsCallExpr(callExpr, ctx) {
+				pos := returnsError(callExpr, ctx)
+				if pos < 0 || pos >= len(stmt.Lhs) {
+					return nil, nil
+				}
+				if id, ok := stmt.Lhs[pos].(*ast.Ident); ok && id.Name == "_" {
+					return gas.NewIssue(ctx, n, r.What, r.Severity, r.Confidence), nil
+				}
+			}
+		}
+	case *ast.ExprStmt:
+		if callExpr, ok := stmt.X.(*ast.CallExpr); ok && !r.whitelist.ContainsCallExpr(callExpr, ctx) {
+			pos := returnsError(callExpr, ctx)
+			if pos >= 0 {
+				return gas.NewIssue(ctx, n, r.What, r.Severity, r.Confidence), nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewNoErrorCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+
+	// TODO(gm) Come up with sensible defaults here. Or flip it to use a
+	// black list instead.
+	whitelist := gas.NewCallList()
+	whitelist.AddAll("bytes.Buffer", "Write", "WriteByte", "WriteRune", "WriteString")
+	whitelist.AddAll("fmt", "Print", "Printf", "Println")
+	whitelist.Add("io.PipeWriter", "CloseWithError")
+
+	if configured, ok := conf["G104"]; ok {
+		if whitelisted, ok := configured.(map[string][]string); ok {
+			for key, val := range whitelisted {
+				whitelist.AddAll(key, val...)
+			}
+		}
+	}
+	return &NoErrorCheck{
+		MetaData: gas.MetaData{
+			Severity:   gas.Low,
+			Confidence: gas.High,
+			What:       "Errors unhandled.",
+		},
+		whitelist: whitelist,
+	}, []ast.Node{(*ast.AssignStmt)(nil), (*ast.ExprStmt)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/fileperms.go

@@ -0,0 +1,85 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"fmt"
+	"go/ast"
+	"strconv"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type FilePermissions struct {
+	gas.MetaData
+	mode  int64
+	pkg   string
+	calls []string
+}
+
+func getConfiguredMode(conf map[string]interface{}, configKey string, defaultMode int64) int64 {
+	var mode int64 = defaultMode
+	if value, ok := conf[configKey]; ok {
+		switch value.(type) {
+		case int64:
+			mode = value.(int64)
+		case string:
+			if m, e := strconv.ParseInt(value.(string), 0, 64); e != nil {
+				mode = defaultMode
+			} else {
+				mode = m
+			}
+		}
+	}
+	return mode
+}
+
+func (r *FilePermissions) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if callexpr, matched := gas.MatchCallByPackage(n, c, r.pkg, r.calls...); matched {
+		modeArg := callexpr.Args[len(callexpr.Args)-1]
+		if mode, err := gas.GetInt(modeArg); err == nil && mode > r.mode {
+			return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewFilePerms(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	mode := getConfiguredMode(conf, "G302", 0600)
+	return &FilePermissions{
+		mode:  mode,
+		pkg:   "os",
+		calls: []string{"OpenFile", "Chmod"},
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       fmt.Sprintf("Expect file permissions to be %#o or less", mode),
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}
+
+func NewMkdirPerms(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	mode := getConfiguredMode(conf, "G301", 0700)
+	return &FilePermissions{
+		mode:  mode,
+		pkg:   "os",
+		calls: []string{"Mkdir", "MkdirAll"},
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       fmt.Sprintf("Expect directory permissions to be %#o or less", mode),
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/hardcoded_credentials.go

@@ -0,0 +1,148 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+	"go/token"
+	"regexp"
+
+	"github.com/nbutton23/zxcvbn-go"
+	"strconv"
+)
+
+type Credentials struct {
+	gas.MetaData
+	pattern          *regexp.Regexp
+	entropyThreshold float64
+	perCharThreshold float64
+	truncate         int
+	ignoreEntropy    bool
+}
+
+func truncate(s string, n int) string {
+	if n > len(s) {
+		return s
+	}
+	return s[:n]
+}
+
+func (r *Credentials) isHighEntropyString(str string) bool {
+	s := truncate(str, r.truncate)
+	info := zxcvbn.PasswordStrength(s, []string{})
+	entropyPerChar := info.Entropy / float64(len(s))
+	return (info.Entropy >= r.entropyThreshold ||
+		(info.Entropy >= (r.entropyThreshold/2) &&
+			entropyPerChar >= r.perCharThreshold))
+}
+
+func (r *Credentials) Match(n ast.Node, ctx *gas.Context) (*gas.Issue, error) {
+	switch node := n.(type) {
+	case *ast.AssignStmt:
+		return r.matchAssign(node, ctx)
+	case *ast.GenDecl:
+		return r.matchGenDecl(node, ctx)
+	}
+	return nil, nil
+}
+
+func (r *Credentials) matchAssign(assign *ast.AssignStmt, ctx *gas.Context) (*gas.Issue, error) {
+	for _, i := range assign.Lhs {
+		if ident, ok := i.(*ast.Ident); ok {
+			if r.pattern.MatchString(ident.Name) {
+				for _, e := range assign.Rhs {
+					if val, err := gas.GetString(e); err == nil {
+						if r.ignoreEntropy || (!r.ignoreEntropy && r.isHighEntropyString(val)) {
+							return gas.NewIssue(ctx, assign, r.What, r.Severity, r.Confidence), nil
+						}
+					}
+				}
+			}
+		}
+	}
+	return nil, nil
+}
+
+func (r *Credentials) matchGenDecl(decl *ast.GenDecl, ctx *gas.Context) (*gas.Issue, error) {
+	if decl.Tok != token.CONST && decl.Tok != token.VAR {
+		return nil, nil
+	}
+	for _, spec := range decl.Specs {
+		if valueSpec, ok := spec.(*ast.ValueSpec); ok {
+			for index, ident := range valueSpec.Names {
+				if r.pattern.MatchString(ident.Name) && valueSpec.Values != nil {
+					// const foo, bar = "same value"
+					if len(valueSpec.Values) <= index {
+						index = len(valueSpec.Values) - 1
+					}
+					if val, err := gas.GetString(valueSpec.Values[index]); err == nil {
+						if r.ignoreEntropy || (!r.ignoreEntropy && r.isHighEntropyString(val)) {
+							return gas.NewIssue(ctx, valueSpec, r.What, r.Severity, r.Confidence), nil
+						}
+					}
+				}
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewHardcodedCredentials(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	pattern := `(?i)passwd|pass|password|pwd|secret|token`
+	entropyThreshold := 80.0
+	perCharThreshold := 3.0
+	ignoreEntropy := false
+	var truncateString int = 16
+	if val, ok := conf["G101"]; ok {
+		conf := val.(map[string]string)
+		if configPattern, ok := conf["pattern"]; ok {
+			pattern = configPattern
+		}
+		if configIgnoreEntropy, ok := conf["ignore_entropy"]; ok {
+			if parsedBool, err := strconv.ParseBool(configIgnoreEntropy); err == nil {
+				ignoreEntropy = parsedBool
+			}
+		}
+		if configEntropyThreshold, ok := conf["entropy_threshold"]; ok {
+			if parsedNum, err := strconv.ParseFloat(configEntropyThreshold, 64); err == nil {
+				entropyThreshold = parsedNum
+			}
+		}
+		if configCharThreshold, ok := conf["per_char_threshold"]; ok {
+			if parsedNum, err := strconv.ParseFloat(configCharThreshold, 64); err == nil {
+				perCharThreshold = parsedNum
+			}
+		}
+		if configTruncate, ok := conf["truncate"]; ok {
+			if parsedInt, err := strconv.Atoi(configTruncate); err == nil {
+				truncateString = parsedInt
+			}
+		}
+	}
+
+	return &Credentials{
+		pattern:          regexp.MustCompile(pattern),
+		entropyThreshold: entropyThreshold,
+		perCharThreshold: perCharThreshold,
+		ignoreEntropy:    ignoreEntropy,
+		truncate:         truncateString,
+		MetaData: gas.MetaData{
+			What:       "Potential hardcoded credentials",
+			Confidence: gas.Low,
+			Severity:   gas.High,
+		},
+	}, []ast.Node{(*ast.AssignStmt)(nil), (*ast.GenDecl)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/rand.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type WeakRand struct {
+	gas.MetaData
+	funcNames   []string
+	packagePath string
+}
+
+func (w *WeakRand) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	for _, funcName := range w.funcNames {
+		if _, matched := gas.MatchCallByPackage(n, c, w.packagePath, funcName); matched {
+			return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
+		}
+	}
+
+	return nil, nil
+}
+
+func NewWeakRandCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &WeakRand{
+		funcNames:   []string{"Read", "Int"},
+		packagePath: "math/rand",
+		MetaData: gas.MetaData{
+			Severity:   gas.High,
+			Confidence: gas.Medium,
+			What:       "Use of weak random number generator (math/rand instead of crypto/rand)",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/rsa.go

@@ -0,0 +1,51 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"fmt"
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type WeakKeyStrength struct {
+	gas.MetaData
+	pattern *regexp.Regexp
+	bits    int
+}
+
+func (w *WeakKeyStrength) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if node := gas.MatchCall(n, w.pattern); node != nil {
+		if bits, err := gas.GetInt(node.Args[1]); err == nil && bits < (int64)(w.bits) {
+			return gas.NewIssue(c, n, w.What, w.Severity, w.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewWeakKeyStrength(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	bits := 2048
+	return &WeakKeyStrength{
+		pattern: regexp.MustCompile(`^rsa\.GenerateKey$`),
+		bits:    bits,
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       fmt.Sprintf("RSA keys should be at least %d bits", bits),
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/sql.go

@@ -0,0 +1,99 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type SqlStatement struct {
+	gas.MetaData
+	pattern *regexp.Regexp
+}
+
+type SqlStrConcat struct {
+	SqlStatement
+}
+
+// see if we can figure out what it is
+func (s *SqlStrConcat) checkObject(n *ast.Ident) bool {
+	if n.Obj != nil {
+		return n.Obj.Kind != ast.Var && n.Obj.Kind != ast.Fun
+	}
+	return false
+}
+
+// Look for "SELECT * FROM table WHERE " + " ' OR 1=1"
+func (s *SqlStrConcat) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if node, ok := n.(*ast.BinaryExpr); ok {
+		if start, ok := node.X.(*ast.BasicLit); ok {
+			if str, e := gas.GetString(start); s.pattern.MatchString(str) && e == nil {
+				if _, ok := node.Y.(*ast.BasicLit); ok {
+					return nil, nil // string cat OK
+				}
+				if second, ok := node.Y.(*ast.Ident); ok && s.checkObject(second) {
+					return nil, nil
+				}
+				return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewSqlStrConcat(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &SqlStrConcat{
+		SqlStatement: SqlStatement{
+			pattern: regexp.MustCompile(`(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) `),
+			MetaData: gas.MetaData{
+				Severity:   gas.Medium,
+				Confidence: gas.High,
+				What:       "SQL string concatenation",
+			},
+		},
+	}, []ast.Node{(*ast.BinaryExpr)(nil)}
+}
+
+type SqlStrFormat struct {
+	SqlStatement
+	call *regexp.Regexp
+}
+
+// Looks for "fmt.Sprintf("SELECT * FROM foo where '%s', userInput)"
+func (s *SqlStrFormat) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, s.call); node != nil {
+		if arg, e := gas.GetString(node.Args[0]); s.pattern.MatchString(arg) && e == nil {
+			return gas.NewIssue(c, n, s.What, s.Severity, s.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewSqlStrFormat(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &SqlStrFormat{
+		call: regexp.MustCompile(`^fmt\.Sprintf$`),
+		SqlStatement: SqlStatement{
+			pattern: regexp.MustCompile("(?)(SELECT|DELETE|INSERT|UPDATE|INTO|FROM|WHERE) "),
+			MetaData: gas.MetaData{
+				Severity:   gas.Medium,
+				Confidence: gas.High,
+				What:       "SQL string formatting",
+			},
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/subproc.go

@@ -0,0 +1,56 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+	"strings"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type Subprocess struct {
+	pattern *regexp.Regexp
+}
+
+func (r *Subprocess) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+	if node := gas.MatchCall(n, r.pattern); node != nil {
+		for _, arg := range node.Args {
+			if !gas.TryResolve(arg, c) {
+				what := "Subprocess launching with variable."
+				return gas.NewIssue(c, n, what, gas.High, gas.High), nil
+			}
+		}
+
+		// call with partially qualified command
+		if str, err := gas.GetString(node.Args[0]); err == nil {
+			if !strings.HasPrefix(str, "/") {
+				what := "Subprocess launching with partial path."
+				return gas.NewIssue(c, n, what, gas.Medium, gas.High), nil
+			}
+		}
+
+		what := "Subprocess launching should be audited."
+		return gas.NewIssue(c, n, what, gas.Low, gas.High), nil
+	}
+	return nil, nil
+}
+
+func NewSubproc(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &Subprocess{
+		pattern: regexp.MustCompile(`^exec\.Command|syscall\.Exec$`),
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/tempfiles.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type BadTempFile struct {
+	gas.MetaData
+	args *regexp.Regexp
+	call *regexp.Regexp
+}
+
+func (t *BadTempFile) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, t.call); node != nil {
+		if arg, e := gas.GetString(node.Args[0]); t.args.MatchString(arg) && e == nil {
+			return gas.NewIssue(c, n, t.What, t.Severity, t.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+func NewBadTempFile(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &BadTempFile{
+		call: regexp.MustCompile(`ioutil\.WriteFile|os\.Create`),
+		args: regexp.MustCompile(`^/tmp/.*$|^/var/tmp/.*$`),
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       "File creation in shared tmp directory without using ioutil.Tempfile",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/templates.go

@@ -0,0 +1,49 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type TemplateCheck struct {
+	gas.MetaData
+	call *regexp.Regexp
+}
+
+func (t *TemplateCheck) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCall(n, t.call); node != nil {
+		for _, arg := range node.Args {
+			if _, ok := arg.(*ast.BasicLit); !ok { // basic lits are safe
+				return gas.NewIssue(c, n, t.What, t.Severity, t.Confidence), nil
+			}
+		}
+	}
+	return nil, nil
+}
+
+func NewTemplateCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &TemplateCheck{
+		call: regexp.MustCompile(`^template\.(HTML|JS|URL)$`),
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.Low,
+			What:       "this method will not auto-escape HTML. Verify data is well formed.",
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/tls.go

@@ -0,0 +1,191 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"fmt"
+	"go/ast"
+	"reflect"
+	"regexp"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type InsecureConfigTLS struct {
+	MinVersion  int16
+	MaxVersion  int16
+	pattern     *regexp.Regexp
+	goodCiphers []string
+}
+
+func stringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}
+
+func (t *InsecureConfigTLS) processTlsCipherSuites(n ast.Node, c *gas.Context) *gas.Issue {
+	a := reflect.TypeOf(&ast.KeyValueExpr{})
+	b := reflect.TypeOf(&ast.CompositeLit{})
+	if node, ok := gas.SimpleSelect(n, a, b).(*ast.CompositeLit); ok {
+		for _, elt := range node.Elts {
+			if ident, ok := elt.(*ast.SelectorExpr); ok {
+				if !stringInSlice(ident.Sel.Name, t.goodCiphers) {
+					str := fmt.Sprintf("TLS Bad Cipher Suite: %s", ident.Sel.Name)
+					return gas.NewIssue(c, n, str, gas.High, gas.High)
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func (t *InsecureConfigTLS) processTlsConfVal(n *ast.KeyValueExpr, c *gas.Context) *gas.Issue {
+	if ident, ok := n.Key.(*ast.Ident); ok {
+		switch ident.Name {
+		case "InsecureSkipVerify":
+			if node, ok := n.Value.(*ast.Ident); ok {
+				if node.Name != "false" {
+					return gas.NewIssue(c, n, "TLS InsecureSkipVerify set true.", gas.High, gas.High)
+				}
+			} else {
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS InsecureSkipVerify may be true.", gas.High, gas.Low)
+			}
+
+		case "PreferServerCipherSuites":
+			if node, ok := n.Value.(*ast.Ident); ok {
+				if node.Name == "false" {
+					return gas.NewIssue(c, n, "TLS PreferServerCipherSuites set false.", gas.Medium, gas.High)
+				}
+			} else {
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS PreferServerCipherSuites may be false.", gas.Medium, gas.Low)
+			}
+
+		case "MinVersion":
+			if ival, ierr := gas.GetInt(n.Value); ierr == nil {
+				if (int16)(ival) < t.MinVersion {
+					return gas.NewIssue(c, n, "TLS MinVersion too low.", gas.High, gas.High)
+				}
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS MinVersion may be too low.", gas.High, gas.Low)
+			}
+
+		case "MaxVersion":
+			if ival, ierr := gas.GetInt(n.Value); ierr == nil {
+				if (int16)(ival) < t.MaxVersion {
+					return gas.NewIssue(c, n, "TLS MaxVersion too low.", gas.High, gas.High)
+				}
+				// TODO(tk): symbol tab look up to get the actual value
+				return gas.NewIssue(c, n, "TLS MaxVersion may be too low.", gas.High, gas.Low)
+			}
+
+		case "CipherSuites":
+			if ret := t.processTlsCipherSuites(n, c); ret != nil {
+				return ret
+			}
+
+		}
+
+	}
+	return nil
+}
+
+func (t *InsecureConfigTLS) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if node := gas.MatchCompLit(n, t.pattern); node != nil {
+		for _, elt := range node.Elts {
+			if kve, ok := elt.(*ast.KeyValueExpr); ok {
+				gi = t.processTlsConfVal(kve, c)
+				if gi != nil {
+					break
+				}
+			}
+		}
+	}
+	return
+}
+
+func NewModernTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
+	return &InsecureConfigTLS{
+		pattern:    regexp.MustCompile(`^tls\.Config$`),
+		MinVersion: 0x0303, // TLS 1.2 only
+		MaxVersion: 0x0303,
+		goodCiphers: []string{
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+		},
+	}, []ast.Node{(*ast.CompositeLit)(nil)}
+}
+
+func NewIntermediateTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28default.29
+	return &InsecureConfigTLS{
+		pattern:    regexp.MustCompile(`^tls\.Config$`),
+		MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
+		MaxVersion: 0x0303,
+		goodCiphers: []string{
+			"TLS_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+		},
+	}, []ast.Node{(*ast.CompositeLit)(nil)}
+}
+
+func NewCompatTlsCheck(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	// https://wiki.mozilla.org/Security/Server_Side_TLS#Old_compatibility_.28default.29
+	return &InsecureConfigTLS{
+		pattern:    regexp.MustCompile(`^tls\.Config$`),
+		MinVersion: 0x0301, // TLS 1.2, 1.1, 1.0
+		MaxVersion: 0x0303,
+		goodCiphers: []string{
+			"TLS_RSA_WITH_RC4_128_SHA",
+			"TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+			"TLS_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_RC4_128_SHA",
+			"TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+			"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+			"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+			"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+		},
+	}, []ast.Node{(*ast.CompositeLit)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/unsafe.go

@@ -0,0 +1,45 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	gas "github.com/GoASTScanner/gas/core"
+	"go/ast"
+)
+
+type UsingUnsafe struct {
+	gas.MetaData
+	pkg   string
+	calls []string
+}
+
+func (r *UsingUnsafe) Match(n ast.Node, c *gas.Context) (gi *gas.Issue, err error) {
+	if _, matches := gas.MatchCallByPackage(n, c, r.pkg, r.calls...); matches {
+		return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+	}
+	return nil, nil
+}
+
+func NewUsingUnsafe(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	return &UsingUnsafe{
+		pkg:   "unsafe",
+		calls: []string{"Alignof", "Offsetof", "Sizeof", "Pointer"},
+		MetaData: gas.MetaData{
+			What:       "Use of unsafe calls should be audited",
+			Severity:   gas.Low,
+			Confidence: gas.High,
+		},
+	}, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/rules/weakcrypto.go

@@ -0,0 +1,53 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package rules
+
+import (
+	"go/ast"
+
+	gas "github.com/GoASTScanner/gas/core"
+)
+
+type UsesWeakCryptography struct {
+	gas.MetaData
+	blacklist map[string][]string
+}
+
+func (r *UsesWeakCryptography) Match(n ast.Node, c *gas.Context) (*gas.Issue, error) {
+
+	for pkg, funcs := range r.blacklist {
+		if _, matched := gas.MatchCallByPackage(n, c, pkg, funcs...); matched {
+			return gas.NewIssue(c, n, r.What, r.Severity, r.Confidence), nil
+		}
+	}
+	return nil, nil
+}
+
+// Uses des.* md5.* or rc4.*
+func NewUsesWeakCryptography(conf map[string]interface{}) (gas.Rule, []ast.Node) {
+	calls := make(map[string][]string)
+	calls["crypto/des"] = []string{"NewCipher", "NewTripleDESCipher"}
+	calls["crypto/md5"] = []string{"New", "Sum"}
+	calls["crypto/rc4"] = []string{"NewCipher"}
+	rule := &UsesWeakCryptography{
+		blacklist: calls,
+		MetaData: gas.MetaData{
+			Severity:   gas.Medium,
+			Confidence: gas.High,
+			What:       "Use of weak cryptographic primitive",
+		},
+	}
+	return rule, []ast.Node{(*ast.CallExpr)(nil)}
+}

tools/vendor/github.com/GoASTScanner/gas/tools.go

@@ -0,0 +1,276 @@
+// (c) Copyright 2016 Hewlett Packard Enterprise Development LP
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"fmt"
+	"go/ast"
+	"go/importer"
+	"go/parser"
+	"go/token"
+	"go/types"
+	"os"
+	"strings"
+)
+
+type command func(args ...string)
+type utilities struct {
+	commands map[string]command
+	call     []string
+}
+
+// Custom commands / utilities to run instead of default analyzer
+func newUtils() *utilities {
+	utils := make(map[string]command)
+	utils["ast"] = dumpAst
+	utils["callobj"] = dumpCallObj
+	utils["uses"] = dumpUses
+	utils["types"] = dumpTypes
+	utils["defs"] = dumpDefs
+	utils["comments"] = dumpComments
+	utils["imports"] = dumpImports
+	return &utilities{utils, make([]string, 0)}
+}
+
+func (u *utilities) String() string {
+	i := 0
+	keys := make([]string, len(u.commands))
+	for k := range u.commands {
+		keys[i] = k
+		i++
+	}
+	return strings.Join(keys, ", ")
+}
+
+func (u *utilities) Set(opt string) error {
+	if _, ok := u.commands[opt]; !ok {
+		return fmt.Errorf("valid tools are: %s", u.String())
+
+	}
+	u.call = append(u.call, opt)
+	return nil
+}
+
+func (u *utilities) run(args ...string) {
+	for _, util := range u.call {
+		if cmd, ok := u.commands[util]; ok {
+			cmd(args...)
+		}
+	}
+}
+
+func shouldSkip(path string) bool {
+	st, e := os.Stat(path)
+	if e != nil {
+		// #nosec
+		fmt.Fprintf(os.Stderr, "Skipping: %s - %s\n", path, e)
+		return true
+	}
+	if st.IsDir() {
+		// #nosec
+		fmt.Fprintf(os.Stderr, "Skipping: %s - directory\n", path)
+		return true
+	}
+	return false
+}
+
+func dumpAst(files ...string) {
+	for _, arg := range files {
+		// Ensure file exists and not a directory
+		if shouldSkip(arg) {
+			continue
+		}
+
+		// Create the AST by parsing src.
+		fset := token.NewFileSet() // positions are relative to fset
+		f, err := parser.ParseFile(fset, arg, nil, 0)
+		if err != nil {
+			// #nosec
+			fmt.Fprintf(os.Stderr, "Unable to parse file %s\n", err)
+			continue
+		}
+
+		// Print the AST. #nosec
+		ast.Print(fset, f)
+	}
+}
+
+type context struct {
+	fileset  *token.FileSet
+	comments ast.CommentMap
+	info     *types.Info
+	pkg      *types.Package
+	config   *types.Config
+	root     *ast.File
+}
+
+func createContext(filename string) *context {
+	fileset := token.NewFileSet()
+	root, e := parser.ParseFile(fileset, filename, nil, parser.ParseComments)
+	if e != nil {
+		// #nosec
+		fmt.Fprintf(os.Stderr, "Unable to parse file: %s. Reason: %s\n", filename, e)
+		return nil
+	}
+	comments := ast.NewCommentMap(fileset, root, root.Comments)
+	info := &types.Info{
+		Types:      make(map[ast.Expr]types.TypeAndValue),
+		Defs:       make(map[*ast.Ident]types.Object),
+		Uses:       make(map[*ast.Ident]types.Object),
+		Selections: make(map[*ast.SelectorExpr]*types.Selection),
+		Scopes:     make(map[ast.Node]*types.Scope),
+		Implicits:  make(map[ast.Node]types.Object),
+	}
+	config := types.Config{Importer: importer.Default()}
+	pkg, e := config.Check("main.go", fileset, []*ast.File{root}, info)
+	if e != nil {
+		// #nosec
+		fmt.Fprintf(os.Stderr, "Type check failed for file: %s. Reason: %s\n", filename, e)
+		return nil
+	}
+	return &context{fileset, comments, info, pkg, &config, root}
+}
+
+func printObject(obj types.Object) {
+	fmt.Println("OBJECT")
+	if obj == nil {
+		fmt.Println("object is nil")
+		return
+	}
+	fmt.Printf("   Package = %v\n", obj.Pkg())
+	if obj.Pkg() != nil {
+		fmt.Println("   Path = ", obj.Pkg().Path())
+		fmt.Println("   Name = ", obj.Pkg().Name())
+		fmt.Println("   String = ", obj.Pkg().String())
+	}
+	fmt.Printf("   Name = %v\n", obj.Name())
+	fmt.Printf("   Type = %v\n", obj.Type())
+	fmt.Printf("   Id = %v\n", obj.Id())
+}
+
+func checkContext(ctx *context, file string) bool {
+	// #nosec
+	if ctx == nil {
+		fmt.Fprintln(os.Stderr, "Failed to create context for file: ", file)
+		return false
+	}
+	return true
+}
+
+func dumpCallObj(files ...string) {
+
+	for _, file := range files {
+		if shouldSkip(file) {
+			continue
+		}
+		context := createContext(file)
+		if !checkContext(context, file) {
+			return
+		}
+		ast.Inspect(context.root, func(n ast.Node) bool {
+			var obj types.Object
+			switch node := n.(type) {
+			case *ast.Ident:
+				obj = context.info.ObjectOf(node) //context.info.Uses[node]
+			case *ast.SelectorExpr:
+				obj = context.info.ObjectOf(node.Sel) //context.info.Uses[node.Sel]
+			default:
+				obj = nil
+			}
+			if obj != nil {
+				printObject(obj)
+			}
+			return true
+		})
+	}
+}
+
+func dumpUses(files ...string) {
+	for _, file := range files {
+		if shouldSkip(file) {
+			continue
+		}
+		context := createContext(file)
+		if !checkContext(context, file) {
+			return
+		}
+		for ident, obj := range context.info.Uses {
+			fmt.Printf("IDENT: %v, OBJECT: %v\n", ident, obj)
+		}
+	}
+}
+
+func dumpTypes(files ...string) {
+	for _, file := range files {
+		if shouldSkip(file) {
+			continue
+		}
+		context := createContext(file)
+		if !checkContext(context, file) {
+			return
+		}
+		for expr, tv := range context.info.Types {
+			fmt.Printf("EXPR: %v, TYPE: %v\n", expr, tv)
+		}
+	}
+}
+
+func dumpDefs(files ...string) {
+	for _, file := range files {
+		if shouldSkip(file) {
+			continue
+		}
+		context := createContext(file)
+		if !checkContext(context, file) {
+			return
+		}
+		for ident, obj := range context.info.Defs {
+			fmt.Printf("IDENT: %v, OBJ: %v\n", ident, obj)
+		}
+	}
+}
+
+func dumpComments(files ...string) {
+	for _, file := range files {
+		if shouldSkip(file) {
+			continue
+		}
+		context := createContext(file)
+		if !checkContext(context, file) {
+			return
+		}
+		for _, group := range context.comments.Comments() {
+			fmt.Println(group.Text())
+		}
+	}
+}
+
+func dumpImports(files ...string) {
+	for _, file := range files {
+		if shouldSkip(file) {
+			continue
+		}
+		context := createContext(file)
+		if !checkContext(context, file) {
+			return
+		}
+		for _, pkg := range context.pkg.Imports() {
+			fmt.Println(pkg.Path(), pkg.Name())
+			for _, name := range pkg.Scope().Names() {
+				fmt.Println("  => ", name)
+			}
+		}
+	}
+}

tools/vendor/github.com/GoASTScanner/gas/vendor.conf

@@ -0,0 +1,7 @@
+# package
+github.com/GoAstScanner/gas
+
+# import
+github.com/GoASTScanner/gas	cc52ef5
+github.com/nbutton23/zxcvbn-go	a22cb81
+github.com/ryanuber/go-glob	v0.1