fix: replace deprecated go-acc with integrated coverage tool (#1526)

# Description

For the control-plane code go-acc is used for generating coverage
report. This module is now archived and uses dependencies with
vulnerabilities (e.g.
[CVE-2026-33186](GHSA-p77j-4mvh-x3m3) ).

## Action

The deprecated dependency is removed and the coverage report generating
is reimplemented with the integrated `go tool cover` tool.

This PR also resolves issue #1357 by upgrading go-grpc version to
1.79.3.

## Type of Change

- [ ] Bugfix
- [ ] New Feature
- [ ] Breaking Change
- [x] Refactor
- [ ] Documentation
- [ ] Other (please describe)

## Checklist

- [x] I have read the [contributing
guidelines](/agntcy/repo-template/blob/main/CONTRIBUTING.md)
- [x] Existing issues have been referenced (where applicable)
- [x] I have verified this change is not present in other open pull
requests
- [x] Functionality is documented
- [x] All code style checks pass
- [x] New code contribution is covered by automated tests
- [x] All new and existing tests pass

---------

Signed-off-by: Mark Marton <mark.p.marton@gmail.com>

Author: markpmarton

control-plane/Taskfile.yaml

@@ -1,6 +1,5 @@
 # Copyright AGNTCY Contributors (https://github.com/agntcy)
 # SPDX-License-Identifier: Apache-2.0
-
 ---
 version: "3"
 
@@ -95,20 +94,27 @@ tasks:
   control-plane:coverage-reports:
     desc: Check test coverage
     deps:
-      - tools:all
+      - control-plane:test:if-no-coverage-data
+    vars:
+      # Returns the .coverage directory path for each module where tests are available.
+      COVERAGE_LOCS: $(conc=; sep=; for mod in {{.MODULES}}; do if [ -n "$(find "$mod"
+        -type f -name '*_test.go' 2>/dev/null | head -1)" ]; then
+        conc="$conc$sep${mod}/.coverage"; sep=,; fi; done; echo "$conc")
     cmds:
       - task: control-plane:gogen
-      - task: control-plane:foreach-module
-        vars:
-          CMD: |
-            {{.TOOLS_INSTALL_DIR}}/go-acc --output=$(basename  ${dir})-coverage.out ./...
+      - mkdir -p {{.REPO_ROOT}}/control-plane/.coverage
+      - go tool covdata textfmt -i={{.COVERAGE_LOCS}} -o
+        {{.REPO_ROOT}}/control-plane/.coverage/profile
 
   control-plane:coverage:
     desc: Show coverage in browser
+    dir: "{{.REPO_ROOT}}/control-plane/control-plane"
     deps:
       - control-plane:coverage-reports
+    vars:
+      COVERAGE_PROFILE: "{{.REPO_ROOT}}/control-plane/.coverage/profile"
     cmds:
-      - echo find . -name '*coverage.out' -execdir go tool cover -html=./{} \;
+      - go tool cover -html={{.COVERAGE_PROFILE}}
 
   control-plane:test:
     desc: Run go tests
@@ -118,7 +124,22 @@ tasks:
       - task: control-plane:gogen
       - task: control-plane:foreach-module
         vars:
-          CMD: go test --tags=test -failfast -v 2>&1 ./...
+          CMD: "mkdir -p $PWD/.coverage && go test --tags=test -failfast -cover -v 2>&1
+            ./... -args -test.gocoverdir=$PWD/.coverage"
+
+  control-plane:test:if-no-coverage-data:
+    internal: true
+    desc: Run go tests only when no module under MODULES has a .coverage directory
+    status:
+      - |
+        for mod in {{.MODULES}}; do
+          if [ ! -d "$mod/.coverage" ]; then
+            exit 1
+          fi
+        done
+        exit 0
+    cmds:
+      - task: control-plane:test
 
   control-plane:fetch:
     desc: Download go modules
@@ -173,7 +194,6 @@ tasks:
       - task: control-plane:control-plane:build
       - task: control-plane:token-service:build
 
-
   #  control plane related tasks
   control-plane:control-plane:build:
     desc: Builds the control plane binary

control-plane/control-plane/internal/util/certificates.go

@@ -16,7 +16,6 @@ import (
 )
 
 func LoadCertificates(ctx context.Context, apiConfig config.APIConfig) (credentials.TransportCredentials, error) {
-
 	zlog := zerolog.Ctx(ctx)
 
 	var tlsConfig *tls.Config
@@ -60,17 +59,13 @@ func LoadCertificates(ctx context.Context, apiConfig config.APIConfig) (credenti
 		}
 	}
 
-	// Add custom verification callback for detailed logging
-	tlsConfig.VerifyPeerCertificate = func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
-		zlog.Debug().Int("cert_count", len(rawCerts)).Msg("Received client certificates")
-
-		for i, rawCert := range rawCerts {
-			cert, err := x509.ParseCertificate(rawCert)
-			if err != nil {
-				zlog.Error().Err(err).Int("cert_index", i).Msg("Failed to parse client certificate")
-				continue
-			}
+	// Log peer certs after verification. Use VerifyConnection (not VerifyPeerCertificate) so logging
+	// still runs when TLS session resumption is used; VerifyPeerCertificate can be skipped on resume (gosec G123).
+	tlsConfig.VerifyConnection = func(state tls.ConnectionState) error {
+		certs := state.PeerCertificates
+		zlog.Debug().Int("cert_count", len(certs)).Msg("Received client certificates")
 
+		for i, cert := range certs {
 			zlog.Debug().
 				Int("cert_index", i).
 				Str("subject", cert.Subject.String()).
@@ -80,8 +75,8 @@ func LoadCertificates(ctx context.Context, apiConfig config.APIConfig) (credenti
 				Time("not_after", cert.NotAfter).
 				Msg("Client certificate details")
 		}
-		// log size of verified chains
-		zlog.Debug().Int("verified_chain_count", len(verifiedChains)).Msg("Verified certificate chains")
+
+		zlog.Debug().Int("verified_chain_count", len(state.VerifiedChains)).Msg("Verified certificate chains")
 
 		return nil
 	}

internal/tools/go.mod

@@ -4,12 +4,11 @@ go 1.25.5
 
 require (
 	github.com/golangci/golangci-lint v1.64.8
-	github.com/ory/go-acc v0.2.8
 	github.com/pavius/impi v0.0.3
 	go.opentelemetry.io/build-tools/multimod v0.29.0
 	golang.org/x/vuln v1.1.4
-	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
-	google.golang.org/protobuf v1.36.10
+	google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.6.1
+	google.golang.org/protobuf v1.36.11
 )
 
 require (
@@ -21,7 +20,7 @@ require (
 	github.com/Antonboom/errname v1.0.0 // indirect
 	github.com/Antonboom/nilnil v1.0.1 // indirect
 	github.com/Antonboom/testifylint v1.5.2 // indirect
-	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
 	github.com/Crocmagnon/fatcontext v0.7.1 // indirect
 	github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
 	github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect
@@ -45,7 +44,7 @@ require (
 	github.com/butuzov/ireturn v0.3.1 // indirect
 	github.com/butuzov/mirror v1.3.0 // indirect
 	github.com/catenacyber/perfsprint v0.8.2 // indirect
-	github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charithe/durationcheck v0.0.10 // indirect
 	github.com/chavacava/garif v0.1.0 // indirect
@@ -56,8 +55,6 @@ require (
 	github.com/daixiang0/gci v0.13.5 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/denis-tingaikin/go-header v0.5.0 // indirect
-	github.com/dgraph-io/ristretto v0.2.0 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/ettle/strcase v0.2.0 // indirect
 	github.com/fatih/color v1.18.0 // indirect
@@ -77,7 +74,7 @@ require (
 	github.com/go-toolsmith/astp v1.1.0 // indirect
 	github.com/go-toolsmith/strparse v1.1.0 // indirect
 	github.com/go-toolsmith/typep v1.1.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/go-xmlfmt/xmlfmt v1.1.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gofrs/flock v0.12.1 // indirect
@@ -90,7 +87,6 @@ require (
 	github.com/golangci/revgrep v0.8.0 // indirect
 	github.com/golangci/unconvert v0.0.0-20240309020433-c5143eacb3ed // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/gordonklaus/ineffassign v0.1.0 // indirect
 	github.com/gostaticanalysis/analysisutil v0.7.1 // indirect
 	github.com/gostaticanalysis/comment v1.5.0 // indirect
@@ -101,7 +97,6 @@ require (
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-version v1.7.0 // indirect
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hexops/gotextdiff v1.0.3 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -125,7 +120,6 @@ require (
 	github.com/ldez/usetesting v0.4.2 // indirect
 	github.com/leonklingele/grouper v1.1.2 // indirect
 	github.com/macabu/inamedparam v0.1.3 // indirect
-	github.com/magiconair/properties v1.8.10 // indirect
 	github.com/maratori/testableexamples v1.0.0 // indirect
 	github.com/maratori/testpackage v1.1.1 // indirect
 	github.com/matoous/godox v1.1.0 // indirect
@@ -134,20 +128,15 @@ require (
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgechev/revive v1.7.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moricho/tparallel v0.3.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/nakabonne/nestif v0.3.1 // indirect
 	github.com/nishanths/exhaustive v0.12.0 // indirect
 	github.com/nishanths/predeclared v0.2.2 // indirect
 	github.com/nunnatsa/ginkgolinter v0.19.1 // indirect
 	github.com/olekukonko/tablewriter v0.0.5 // indirect
-	github.com/ory/viper v1.7.5 // indirect
-	github.com/pborman/uuid v1.2.1 // indirect
-	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/pelletier/go-toml/v2 v2.3.0 // indirect
 	github.com/pjbgf/sha1cd v0.5.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/polyfloyd/go-errorlint v1.7.1 // indirect
 	github.com/prometheus/client_golang v1.22.0 // indirect
@@ -169,7 +158,7 @@ require (
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashamelentyev/interfacebloat v1.1.0 // indirect
 	github.com/sashamelentyev/usestdlibvars v1.28.0 // indirect
-	github.com/securego/gosec/v2 v2.22.2 // indirect
+	github.com/securego/gosec/v2 v2.25.0 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/sivchari/containedctx v1.0.3 // indirect
@@ -179,8 +168,7 @@ require (
 	github.com/sourcegraph/go-diff v0.7.0 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/cast v1.10.0 // indirect
-	github.com/spf13/cobra v1.10.1 // indirect
-	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/cobra v1.10.2 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
 	github.com/spf13/viper v1.21.0 // indirect
 	github.com/ssgreg/nlreturn/v2 v2.2.1 // indirect
@@ -211,20 +199,17 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.46.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
-	golang.org/x/mod v0.30.0 // indirect
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.39.0 // indirect
-	golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54 // indirect
-	golang.org/x/text v0.32.0 // indirect
-	golang.org/x/tools v0.39.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+	golang.org/x/telemetry v0.0.0-20260409153401-be6f6cb8b1fa // indirect
+	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
 	golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
-	google.golang.org/grpc v1.79.3 // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect