refactor: harden diagnostics and consolidate runtime code

audit/internal/app/support_bundle.go

@@ -6,6 +6,7 @@ import (
 	"compress/gzip"
 	"context"
 	_ "embed"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -505,21 +506,16 @@ func BuildSupportBundle(exportDir string) (string, error) {
 		return "", err
 	}
 
-	archiveName := SupportBundleBaseName(now) + ".tar.gz"
-	archivePath := filepath.Join(os.TempDir(), archiveName)
-	if err := createSupportTarGz(archivePath, stageRoot); err != nil {
-		return "", err
-	}
-	return archivePath, nil
+	return createSupportTarGz(os.TempDir(), SupportBundleBaseName(now), stageRoot)
 }
 
 func SupportBundleBaseName(at time.Time) string {
 	at = at.UTC()
 	date := at.Format("2006-01-02")
 	tod := at.Format("150405")
-	ver := bundleVersion()
-	model := serverModelForBundle()
-	sn := serverSerialForBundle()
+	ver := sanitizeFilename(bundleVersion())
+	model := sanitizeFilename(serverModelForBundle())
+	sn := sanitizeFilename(serverSerialForBundle())
 	return fmt.Sprintf("%s (BEE-SP v%s) %s %s %s", date, ver, model, sn, tod)
 }
 
@@ -617,17 +613,15 @@ func copyOptionalFile(src, dst string) error {
 	if err != nil {
 		return err
 	}
-	defer in.Close()
 	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
-		return err
+		return errors.Join(err, in.Close())
 	}
 	out, err := os.Create(dst)
 	if err != nil {
-		return err
+		return errors.Join(err, in.Close())
 	}
-	defer out.Close()
-	_, err = io.Copy(out, in)
-	return err
+	_, copyErr := io.Copy(out, in)
+	return errors.Join(copyErr, in.Close(), out.Close())
 }
 
 func writeManifest(dst, exportDir, stageRoot string) error {
@@ -823,16 +817,12 @@ func copyPath(src, dst string) error {
 		}
 		return err
 	}
-	defer in.Close()
-
 	out, err := os.OpenFile(dst, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, info.Mode().Perm())
 	if err != nil {
-		return err
+		return errors.Join(err, in.Close())
 	}
-	defer out.Close()
-
-	_, err = io.Copy(out, in)
-	return err
+	_, copyErr := io.Copy(out, in)
+	return errors.Join(copyErr, in.Close(), out.Close())
 }
 
 func copyPathFiltered(rootSrc, src, dst string, keep func(rel string, info os.FileInfo) bool) error {
@@ -874,21 +864,35 @@ func copyPathFiltered(rootSrc, src, dst string, keep func(rel string, info os.Fi
 	return copyPath(src, dst)
 }
 
-func createSupportTarGz(dst, srcDir string) error {
-	file, err := os.Create(dst)
+func createSupportTarGz(dir, baseName, srcDir string) (string, error) {
+	archiveFile, err := os.CreateTemp(dir, baseName+"-*.partial")
 	if err != nil {
-		return err
+		return "", err
 	}
-	defer file.Close()
+	partialPath := archiveFile.Name()
+	if err := writeSupportTarGz(archiveFile, srcDir); err != nil {
+		_ = archiveFile.Close()
+		_ = os.Remove(partialPath)
+		return "", err
+	}
+	if err := archiveFile.Close(); err != nil {
+		_ = os.Remove(partialPath)
+		return "", err
+	}
+	archivePath := strings.TrimSuffix(partialPath, ".partial") + ".tar.gz"
+	if err := os.Rename(partialPath, archivePath); err != nil {
+		_ = os.Remove(partialPath)
+		return "", err
+	}
+	return archivePath, nil
+}
 
+func writeSupportTarGz(file *os.File, srcDir string) error {
 	gz := gzip.NewWriter(file)
-	defer gz.Close()
-
 	tw := tar.NewWriter(gz)
-	defer tw.Close()
 
 	base := filepath.Dir(srcDir)
-	return filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
+	walkErr := filepath.Walk(srcDir, func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
 		}
@@ -912,9 +916,21 @@ func createSupportTarGz(dst, srcDir string) error {
 		if err != nil {
 			return err
 		}
-		defer f.Close()
-
-		_, err = io.Copy(tw, f)
-		return err
+		_, copyErr := io.Copy(tw, f)
+		closeErr := f.Close()
+		if copyErr != nil {
+			return copyErr
+		}
+		return closeErr
 	})
+	if walkErr != nil {
+		_ = tw.Close()
+		_ = gz.Close()
+		return walkErr
+	}
+	if err := tw.Close(); err != nil {
+		_ = gz.Close()
+		return err
+	}
+	return gz.Close()
 }