Add staticcheck and staticstyle analyzers.

This change also adds support to go_stateify for detecting an appropriate
receiver name, avoiding a large number of false positives.

PiperOrigin-RevId: 335994587

16 files changed, 616 insertions, 123 deletions

diff --git a/Makefile b/Makefile
index e36a3baed..4f7db7d82 100644
--- a/Makefile
+++ b/Makefile
@@ -384,3 +384,7 @@ nogo: ## Surfaces all nogo findings.
 	@$(call submake,build OPTIONS="--build_tag_filters nogo" TARGETS="//...")
 	@$(call submake,run TARGETS="//tools/github" ARGS="-path=$(BUILD_ROOT) -dry-run nogo")
 .PHONY: nogo
+
+gazelle: ## Runs gazelle to update WORKSPACE.
+	@$(call submake,run TARGETS="//:gazelle" ARGS="update-repos -from_file=go.mod -prune")
+.PHONY: gazelle
diff --git a/WORKSPACE b/WORKSPACE
index 6dc060bd5..ef179e617 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -43,7 +43,7 @@ http_archive(
 )
 
 http_archive(
-    name = "io_bazel_rules_go_bazel3", # To replace the above.
+    name = "io_bazel_rules_go_bazel3",  # To replace the above.
     patch_args = ["-p1"],
     patches = [
         "//tools/nogo:io_bazel_rules_go-visibility.patch",
@@ -56,7 +56,7 @@ http_archive(
 )
 
 http_archive(
-    name = "bazel_gazelle_bazel3", # To replace the above.
+    name = "bazel_gazelle_bazel3",  # To replace the above.
     sha256 = "bfd86b3cbe855d6c16c6fce60d76bd51f5c8dbc9cfcaef7a2bb5c1aafd0710e8",
     urls = [
         "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.21.0/bazel-gazelle-v0.21.0.tar.gz",
@@ -81,8 +81,8 @@ gazelle_dependencies()
 go_repository(
     name = "org_golang_x_sys",
     importpath = "golang.org/x/sys",
-    sum = "h1:uYVVQ9WP/Ds2ROhcaGPeIdVq0RIXVLwsHlnvJ+cT1So=",
-    version = "v0.0.0-20200302150141-5c8b2ff67527",
+    sum = "h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=",
+    version = "v0.0.0-20200323222414-85ca7c5b95cd",
 )
 
 # Load C++ rules.
@@ -126,7 +126,7 @@ http_archive(
 )
 
 http_archive(
-    name = "bazel_toolchains_bazel3", # To replace the above.
+    name = "bazel_toolchains_bazel3",  # To replace the above.
     sha256 = "144290c4166bd67e76a54f96cd504ed86416ca3ca82030282760f0823c10be48",
     strip_prefix = "bazel-toolchains-3.1.1",
     urls = [
@@ -208,8 +208,7 @@ http_archive(
 go_repository(
     name = "com_github_sirupsen_logrus",
     importpath = "github.com/sirupsen/logrus",
-    replace = "github.com/Sirupsen/logrus",
-    sum = "h1:cWjBmzJnL1sO88XdqJYmq7aiWClqXIQQMJ3Utgy1f+I=",
+    sum = "h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=",
     version = "v1.4.2",
 )
 
@@ -330,8 +329,8 @@ go_repository(
 go_repository(
     name = "org_golang_x_net",
     importpath = "golang.org/x/net",
-    sum = "h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=",
-    version = "v0.0.0-20200625001655-4c5254603344",
+    sum = "h1:VvcQYSHwXgi7W+TpUR6A9g6Up98WAHf3f/ulnJ62IyA=",
+    version = "v0.0.0-20200822124328-c89045814202",
 )
 
 go_repository(
@@ -358,15 +357,15 @@ go_repository(
 go_repository(
     name = "org_golang_x_tools",
     importpath = "golang.org/x/tools",
-    sum = "h1:YAl/dx/kLsMMIWGqfhFHW9ckqGhmq7Ki0dfoKAgvFTE=",
-    version = "v0.0.0-20200707200213-416e8f4faf8a",
+    sum = "h1:k7tVuG0g1JwmD3Jh8oAl1vQ1C3jb4Hi/dUl1wWDBJpQ=",
+    version = "v0.0.0-20200918232735-d647fc253266",
 )
 
 go_repository(
     name = "org_golang_x_xerrors",
     importpath = "golang.org/x/xerrors",
-    sum = "h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=",
-    version = "v0.0.0-20191204190536-9bdfabe68543",
+    sum = "h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=",
+    version = "v0.0.0-20200804184101-5ec99f83aff1",
 )
 
 go_repository(
@@ -470,8 +469,8 @@ go_repository(
 go_repository(
     name = "com_github_microsoft_go_winio",
     importpath = "github.com/Microsoft/go-winio",
-    sum = "h1:ygIc8M6trr62pF5DucadTWGdEB4mEyvzi0e2nbcmcyA=",
-    version = "v0.4.15-0.20190919025122-fc70bd9a86b5",
+    sum = "h1:9pygWVFqbY9lPxM0peffumuVDyMuIMzNLyO9uFjJuQo=",
+    version = "v0.4.15-0.20200908182639-5b44b70ab3ab",
 )
 
 go_repository(
@@ -484,8 +483,8 @@ go_repository(
 go_repository(
     name = "org_uber_go_atomic",
     importpath = "go.uber.org/atomic",
-    sum = "h1:Ezj3JGmsOnG1MoRWQkPBsKLe9DwWD9QeXzTRzzldNVk=",
-    version = "v1.6.0",
+    sum = "h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=",
+    version = "v1.7.0",
 )
 
 go_repository(
@@ -660,8 +659,8 @@ go_repository(
 go_repository(
     name = "com_github_google_go_cmp",
     importpath = "github.com/google/go-cmp",
-    sum = "h1:/QaMHBdZ26BB3SSst0Iwl10Epc+xhTquomWX0oZEB6w=",
-    version = "v0.5.0",
+    sum = "h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=",
+    version = "v0.5.1",
 )
 
 go_repository(
@@ -786,15 +785,15 @@ go_repository(
 go_repository(
     name = "com_github_urfave_cli",
     importpath = "github.com/urfave/cli",
-    sum = "h1:MCfT24H3f//U5+UCrZp1/riVO3B50BovxtDiNn0XKkk=",
-    version = "v0.0.0-20171014202726-7bc6a0acffa5",
+    sum = "h1:gsqYFH8bb9ekPA12kRo0hfjngWQjkJPlN9R0N78BoUo=",
+    version = "v1.22.2",
 )
 
 go_repository(
     name = "com_github_yuin_goldmark",
     importpath = "github.com/yuin/goldmark",
-    sum = "h1:5tjfNdR2ki3yYQ842+eX2sQHeiwpKJ0RnHO4IYOc4V8=",
-    version = "v1.1.32",
+    sum = "h1:ruQGxdhGHe7FWOJPT0mKs5+pD2Xs1Bm/kdGlHO04FmM=",
+    version = "v1.2.1",
 )
 
 go_repository(
@@ -1024,8 +1023,8 @@ go_repository(
 go_repository(
     name = "com_github_vishvananda_netns",
     importpath = "github.com/vishvananda/netns",
-    sum = "h1:mjAZxE1nh8yvuwhGHpdDqdhtNu2dgbpk93TwoXuk5so=",
-    version = "v0.0.0-20200520041808-52d707b772fe",
+    sum = "h1:4hwBBUfQCFe3Cym0ZtKyq7L16eZUtYKs+BaHDN6mAns=",
+    version = "v0.0.0-20200728191858-db3c7e526aae",
 )
 
 go_repository(
@@ -1073,6 +1072,48 @@ go_repository(
 go_repository(
     name = "com_github_dpjacques_clockwork",
     importpath = "github.com/dpjacques/clockwork",
-    sum = "h1:7krODee+eIlZYoLiEDmP1kLFNCvd0bQ0eEXOympdN6U=",
-    version = "v0.1.1-0.20190114191937-d864eecc357b",
+    sum = "h1:l+j1wSnHcimOzeeKxtspsl6tCBTyikdYxcWqFZ+Ho2c=",
+    version = "v0.1.1-0.20200827220843-c1f524b839be",
+)
+
+go_repository(
+    name = "com_github_cilium_ebpf",
+    importpath = "github.com/cilium/ebpf",
+    sum = "h1:i8+1fuPLjSgAYXUyBlHNhFwjcfAsP4ufiuH1+PWkyDU=",
+    version = "v0.0.0-20200110133405-4032b1d8aae3",
+)
+
+go_repository(
+    name = "com_github_coreos_go_systemd_v22",
+    importpath = "github.com/coreos/go-systemd/v22",
+    sum = "h1:XJIw/+VlJ+87J+doOxznsAWIdmWuViOVhkQamW5YV28=",
+    version = "v22.0.0",
+)
+
+go_repository(
+    name = "com_github_cpuguy83_go_md2man_v2",
+    importpath = "github.com/cpuguy83/go-md2man/v2",
+    sum = "h1:EoUDS0afbrsXAZ9YQ9jdu/mZ2sXgT1/2yyNng4PGlyM=",
+    version = "v2.0.0",
+)
+
+go_repository(
+    name = "com_github_godbus_dbus_v5",
+    importpath = "github.com/godbus/dbus/v5",
+    sum = "h1:ZqHaoEF7TBzh4jzPmqVhE/5A1z9of6orkAe5uHoAeME=",
+    version = "v5.0.3",
+)
+
+go_repository(
+    name = "com_github_russross_blackfriday_v2",
+    importpath = "github.com/russross/blackfriday/v2",
+    sum = "h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=",
+    version = "v2.0.1",
+)
+
+go_repository(
+    name = "com_github_shurcool_sanitized_anchor_name",
+    importpath = "github.com/shurcooL/sanitized_anchor_name",
+    sum = "h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=",
+    version = "v1.0.0",
 )
diff --git a/go.mod b/go.mod
index 2fcba5cc9..7cc40f9ab 100644
--- a/go.mod
+++ b/go.mod
@@ -1,14 +1,15 @@
 module gvisor.dev/gvisor
 
-go 1.14
+go 1.15
 
 replace github.com/Sirupsen/logrus => github.com/sirupsen/logrus v1.6.0
 
 require (
 	cloud.google.com/go v0.52.1-0.20200122224058-0482b626c726 // indirect
-	github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5 // indirect
+	github.com/Microsoft/go-winio v0.4.15-0.20200908182639-5b44b70ab3ab // indirect
 	github.com/Microsoft/hcsshim v0.8.6 // indirect
 	github.com/cenkalti/backoff v1.1.1-0.20190506075156-2146c9339422 // indirect
+	github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3 // indirect
 	github.com/containerd/cgroups v0.0.0-20181219155423-39b18af02c41 // indirect
 	github.com/containerd/containerd v1.3.4 // indirect
 	github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe // indirect
@@ -17,17 +18,19 @@ require (
 	github.com/containerd/ttrpc v0.0.0-20200121165050-0be804eadb15 // indirect
 	github.com/containerd/typeurl v0.0.0-20200205145503-b45ef1f1f737 // indirect
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf // indirect
+	github.com/coreos/go-systemd/v22 v22.0.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
 	github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible // indirect
 	github.com/docker/docker v1.4.2-0.20191028175130-9e7d5ac5ea55 // indirect
 	github.com/docker/go-connections v0.3.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
 	github.com/docker/go-units v0.4.0 // indirect
-	github.com/dpjacques/clockwork v0.1.1-0.20190114191937-d864eecc357b // indirect
+	github.com/dpjacques/clockwork v0.1.1-0.20200827220843-c1f524b839be // indirect
 	github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e // indirect
 	github.com/gofrs/flock v0.6.1-0.20180915234121-886344bea079 // indirect
 	github.com/gogo/googleapis v1.4.0 // indirect
 	github.com/golang/protobuf v1.4.2 // indirect
-	github.com/google/go-cmp v0.5.0 // indirect
+	github.com/google/go-cmp v0.5.1 // indirect
 	github.com/google/go-github/v28 v28.1.2-0.20191108005307-e555eab49ce8 // indirect
 	github.com/google/subcommands v1.0.2-0.20190508160503-636abe8753b8 // indirect
 	github.com/hashicorp/go-multierror v1.0.0 // indirect
@@ -39,13 +42,13 @@ require (
 	github.com/opencontainers/runtime-spec v1.0.2-0.20181111125026-1722abf79c2f // indirect
 	github.com/pborman/uuid v1.2.0 // indirect
 	github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 // indirect
-	github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5 // indirect
+	github.com/urfave/cli v1.22.2 // indirect
 	github.com/vishvananda/netlink v1.0.1-0.20190930145447-2ec5bdc52b86 // indirect
-	github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe // indirect
-	go.uber.org/atomic v1.6.0 // indirect
+	github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae // indirect
+	go.uber.org/atomic v1.7.0 // indirect
 	go.uber.org/multierr v1.2.0 // indirect
 	golang.org/x/time v0.0.0-20191024005414-555d28b269f0 // indirect
-	golang.org/x/tools v0.0.0-20200707200213-416e8f4faf8a // indirect
+	golang.org/x/tools v0.0.0-20200918232735-d647fc253266 // indirect
 	google.golang.org/grpc v1.29.0 // indirect
 	gopkg.in/yaml.v2 v2.2.8 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
diff --git a/go.sum b/go.sum
index f98132971..150d9b5b7 100644
--- a/go.sum
+++ b/go.sum
@@ -18,13 +18,15 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.4.14 h1:+hMXMk01us9KgxGb7ftKQt2Xpf5hH/yky+TDA+qxleU=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
-github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5 h1:ygIc8M6trr62pF5DucadTWGdEB4mEyvzi0e2nbcmcyA=
 github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
+github.com/Microsoft/go-winio v0.4.15-0.20200908182639-5b44b70ab3ab h1:9pygWVFqbY9lPxM0peffumuVDyMuIMzNLyO9uFjJuQo=
+github.com/Microsoft/go-winio v0.4.15-0.20200908182639-5b44b70ab3ab/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
 github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
 github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
 github.com/Microsoft/hcsshim v0.8.8/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
-github.com/Microsoft/hcsshim v0.8.9 h1:VrfodqvztU8YSOvygU+DN1BGaSGxmrNfqOv5oOuX2Bk=
 github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
+github.com/Microsoft/hcsshim v0.8.10 h1:k5wTrpnVU2/xv8ZuzGkbXVd3js5zJ8RnumPo5RxiIxU=
+github.com/Microsoft/hcsshim v0.8.10/go.mod h1:g5uw8EV2mAlzqe94tfNBNdr89fnbD/n3HV0OhsddkmM=
 github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/cenkalti/backoff v1.1.1-0.20190506075156-2146c9339422 h1:8eZxmY1yvxGHzdzTEhI09npjMVGzNAdrqzruTX6jcK4=
 github.com/cenkalti/backoff v1.1.1-0.20190506075156-2146c9339422/go.mod h1:b6Nc7NRH5C4aCISLry0tLnTjcuTEvoiqcWDdsU0sOGM=
@@ -32,12 +34,13 @@ github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/containerd/cgroups v0.0.0-20181219155423-39b18af02c41 h1:5yg0k8gqOssNLsjjCtXIADoPbAtUtQZJfC8hQ4r2oFY=
 github.com/containerd/cgroups v0.0.0-20181219155423-39b18af02c41/go.mod h1:X9rLEHIqSf/wfK8NsPqxJmeZgW4pcfzdXITDrUSJ6uI=
-github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f h1:tSNMc+rJDfmYntojat8lljbt1mgKNpTxUZJsSzJ9Y1s=
-github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
+github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59 h1:qWj4qVYZ95vLWwqyNJCQg7rDsG5wPdze0UaPolH7DUk=
+github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
 github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
 github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e h1:GdiIYd8ZDOrT++e1NjhSD4rGt9zaJukHm4rt5F4mRQc=
 github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
@@ -59,9 +62,12 @@ github.com/containerd/ttrpc v0.0.0-20200121165050-0be804eadb15/go.mod h1:UAxOpgT
 github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
 github.com/containerd/typeurl v0.0.0-20200205145503-b45ef1f1f737 h1:HovfQDS/K3Mr7eyS0QJLxE1CbVUhjZCl6g3OhFJgP1o=
 github.com/containerd/typeurl v0.0.0-20200205145503-b45ef1f1f737/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.0.0 h1:XJIw/+VlJ+87J+doOxznsAWIdmWuViOVhkQamW5YV28=
+github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
+github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible h1:dvc1KSkIYTVjZgHf/CTC2diTYC8PzhaA5sFISRfNVrE=
@@ -74,8 +80,8 @@ github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/dpjacques/clockwork v0.1.1-0.20190114191937-d864eecc357b h1:7krODee+eIlZYoLiEDmP1kLFNCvd0bQ0eEXOympdN6U=
-github.com/dpjacques/clockwork v0.1.1-0.20190114191937-d864eecc357b/go.mod h1:D8mP2A8vVT2GkXqPorSBmhnshhkFBYgzhA90KmJt25Y=
+github.com/dpjacques/clockwork v0.1.1-0.20200827220843-c1f524b839be h1:l+j1wSnHcimOzeeKxtspsl6tCBTyikdYxcWqFZ+Ho2c=
+github.com/dpjacques/clockwork v0.1.1-0.20200827220843-c1f524b839be/go.mod h1:D8mP2A8vVT2GkXqPorSBmhnshhkFBYgzhA90KmJt25Y=
 github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -85,11 +91,12 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e h1:BWhy2j3IXJhjCbC68FptL43tDKIq8FladmaTs3Xs7Z8=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/godbus/dbus/v5 v5.0.3 h1:ZqHaoEF7TBzh4jzPmqVhE/5A1z9of6orkAe5uHoAeME=
+github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.6.1-0.20180915234121-886344bea079 h1:JFTFz3HZTGmgMz4E1TabNBNJljROSYgja1b4l50FNVs=
 github.com/gofrs/flock v0.6.1-0.20180915234121-886344bea079/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/googleapis v1.4.0 h1:zgVt4UpGxcqVOw97aRGxT4svlcmdK35fynLNctY32zI=
 github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
-github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
 github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
@@ -118,8 +125,8 @@ github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5a
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0 h1:/QaMHBdZ26BB3SSst0Iwl10Epc+xhTquomWX0oZEB6w=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-github/v28 v28.1.2-0.20191108005307-e555eab49ce8 h1:zOOUQavr8D4AZrcV4ylUpbGa5j3jfeslN6Xculz3tVU=
 github.com/google/go-github/v28 v28.1.2-0.20191108005307-e555eab49ce8/go.mod h1:g82e6OHbJ0WYrYeOrid1MMfHAtqjxBz+N74tfAt9KrQ=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
@@ -146,7 +153,6 @@ github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANyt
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1 h1:6QPYqodiu3GuPL+7mfx+NwDdp2eTkp9IfEUpgAwUN0o=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
@@ -171,10 +177,11 @@ github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zM
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
 github.com/opencontainers/runc v0.1.1 h1:GlxAyO6x8rfZYN9Tt0Kti5a/cP41iuiO2yYT0IJGY8Y=
 github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
-github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/runtime-spec v1.0.2-0.20181111125026-1722abf79c2f h1:Pyp2f/uuhJIcUgnIeZaAbwOcyNz8TBlEe6mPpC8kXq8=
 github.com/opencontainers/runtime-spec v1.0.2-0.20181111125026-1722abf79c2f/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.2 h1:UfAcuLBJB9Coz72x1hgl8O5RVzTdNiaglX6v2DM6FI0=
+github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
 github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -186,6 +193,8 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2 h1:SPIRibHv4MatM3XXNO2BJeFLZwZ2LvZgfQ5+UNI2im4=
@@ -199,18 +208,18 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2 h1:b6uOv7YOFK0TYG7HtkIgExQo+2RdLuwRft63jn2HWj8=
 github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
-github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
+github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
 github.com/vishvananda/netlink v1.0.1-0.20190930145447-2ec5bdc52b86 h1:7SWt9pGCMaw+N1ZhRsaLKaYNviFhxambdoaoYlDqz1w=
 github.com/vishvananda/netlink v1.0.1-0.20190930145447-2ec5bdc52b86/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
-github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe h1:mjAZxE1nh8yvuwhGHpdDqdhtNu2dgbpk93TwoXuk5so=
-github.com/vishvananda/netns v0.0.0-20200520041808-52d707b772fe/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae h1:4hwBBUfQCFe3Cym0ZtKyq7L16eZUtYKs+BaHDN6mAns=
+github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2 h1:75k/FF0Q2YM8QYo07VPddOLBslDt1MZOdEslOHvmzAs=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.uber.org/atomic v1.6.0 h1:Ezj3JGmsOnG1MoRWQkPBsKLe9DwWD9QeXzTRzzldNVk=
-go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
+go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
 go.uber.org/multierr v1.2.0 h1:6I+W7f5VwC5SV9dNrZ3qXrDB9mD0dyGOi/ZJmYw03T4=
 go.uber.org/multierr v1.2.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
@@ -233,7 +242,6 @@ golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTk
 golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f h1:J5lckAjkw6qYlOZNj90mLYNTEKDvWeuc1yieZ8qUzUE=
 golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
@@ -256,8 +264,8 @@ golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344 h1:vGXIOMxbNfDTk/aXCmfdLgkrSV+Z2tcbze+pEc3v5W4=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202 h1:VvcQYSHwXgi7W+TpUR6A9g6Up98WAHf3f/ulnJ62IyA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -280,20 +288,18 @@ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd h1:xhmwyvizuTgC2qz7ZlMluP20uW+C3Rm0FD/WLDX8884=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121 h1:rITEj+UZHYC927n8GT97eC3zrpzXdb/voyeOuVKS46o=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
@@ -302,7 +308,6 @@ golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0 h1:/5xXl8Y5W96D+TtHSlonuFqGHIWVuyCkGJLwGh9JJFs=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -319,16 +324,16 @@ golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgw
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200707200213-416e8f4faf8a h1:YAl/dx/kLsMMIWGqfhFHW9ckqGhmq7Ki0dfoKAgvFTE=
-golang.org/x/tools v0.0.0-20200707200213-416e8f4faf8a/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200918232735-d647fc253266 h1:k7tVuG0g1JwmD3Jh8oAl1vQ1C3jb4Hi/dUl1wWDBJpQ=
+golang.org/x/tools v0.0.0-20200918232735-d647fc253266/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
diff --git a/pkg/sentry/fs/fsutil/inode_cached.go b/pkg/sentry/fs/fsutil/inode_cached.go
index 9eb6f522e..85a23432b 100644
--- a/pkg/sentry/fs/fsutil/inode_cached.go
+++ b/pkg/sentry/fs/fsutil/inode_cached.go
@@ -22,7 +22,6 @@ import (
 	"gvisor.dev/gvisor/pkg/log"
 	"gvisor.dev/gvisor/pkg/safemem"
 	"gvisor.dev/gvisor/pkg/sentry/fs"
-	"gvisor.dev/gvisor/pkg/sentry/kernel/time"
 	ktime "gvisor.dev/gvisor/pkg/sentry/kernel/time"
 	"gvisor.dev/gvisor/pkg/sentry/memmap"
 	"gvisor.dev/gvisor/pkg/sentry/pgalloc"
@@ -444,7 +443,7 @@ func (c *CachingInodeOperations) TouchAccessTime(ctx context.Context, inode *fs.
 // time.
 //
 // Preconditions: c.attrMu is locked for writing.
-func (c *CachingInodeOperations) touchAccessTimeLocked(now time.Time) {
+func (c *CachingInodeOperations) touchAccessTimeLocked(now ktime.Time) {
 	c.attr.AccessTime = now
 	c.dirtyAttr.AccessTime = true
 }
@@ -461,7 +460,7 @@ func (c *CachingInodeOperations) TouchModificationAndStatusChangeTime(ctx contex
 // and status change times in-place to the current time.
 //
 // Preconditions: c.attrMu is locked for writing.
-func (c *CachingInodeOperations) touchModificationAndStatusChangeTimeLocked(now time.Time) {
+func (c *CachingInodeOperations) touchModificationAndStatusChangeTimeLocked(now ktime.Time) {
 	c.attr.ModificationTime = now
 	c.dirtyAttr.ModificationTime = true
 	c.attr.StatusChangeTime = now
@@ -480,7 +479,7 @@ func (c *CachingInodeOperations) TouchStatusChangeTime(ctx context.Context) {
 // in-place to the current time.
 //
 // Preconditions: c.attrMu is locked for writing.
-func (c *CachingInodeOperations) touchStatusChangeTimeLocked(now time.Time) {
+func (c *CachingInodeOperations) touchStatusChangeTimeLocked(now ktime.Time) {
 	c.attr.StatusChangeTime = now
 	c.dirtyAttr.StatusChangeTime = true
 }
@@ -672,9 +671,6 @@ func (rw *inodeReadWriter) ReadToBlocks(dsts safemem.BlockSeq) (uint64, error) {
 				// Continue.
 				seg, gap = gap.NextSegment(), FileRangeGapIterator{}
 			}
-
-		default:
-			break
 		}
 	}
 	unlock()
@@ -768,9 +764,6 @@ func (rw *inodeReadWriter) WriteFromBlocks(srcs safemem.BlockSeq) (uint64, error
 
 			// Continue.
 			seg, gap = gap.NextSegment(), FileRangeGapIterator{}
-
-		default:
-			break
 		}
 	}
 	rw.maybeGrowFile()
diff --git a/pkg/sentry/memmap/memmap.go b/pkg/sentry/memmap/memmap.go
index a44fa2b95..7fd77925f 100644
--- a/pkg/sentry/memmap/memmap.go
+++ b/pkg/sentry/memmap/memmap.go
@@ -127,7 +127,7 @@ func (t Translation) FileRange() FileRange {
 // Preconditions: Same as Mappable.Translate.
 func CheckTranslateResult(required, optional MappableRange, at usermem.AccessType, ts []Translation, terr error) error {
 	// Verify that the inputs to Mappable.Translate were valid.
-	if !required.WellFormed() || required.Length() <= 0 {
+	if !required.WellFormed() || required.Length() == 0 {
 		panic(fmt.Sprintf("invalid required range: %v", required))
 	}
 	if !usermem.Addr(required.Start).IsPageAligned() || !usermem.Addr(required.End).IsPageAligned() {
@@ -145,7 +145,7 @@ func CheckTranslateResult(required, optional MappableRange, at usermem.AccessTyp
 		return fmt.Errorf("first Translation %+v does not cover start of required range %v", ts[0], required)
 	}
 	for i, t := range ts {
-		if !t.Source.WellFormed() || t.Source.Length() <= 0 {
+		if !t.Source.WellFormed() || t.Source.Length() == 0 {
 			return fmt.Errorf("Translation %+v has invalid Source", t)
 		}
 		if !usermem.Addr(t.Source.Start).IsPageAligned() || !usermem.Addr(t.Source.End).IsPageAligned() {
diff --git a/pkg/sentry/mm/pma.go b/pkg/sentry/mm/pma.go
index 30facebf7..7e5f7de64 100644
--- a/pkg/sentry/mm/pma.go
+++ b/pkg/sentry/mm/pma.go
@@ -36,7 +36,7 @@ import (
 // * ar.Length() != 0.
 func (mm *MemoryManager) existingPMAsLocked(ar usermem.AddrRange, at usermem.AccessType, ignorePermissions bool, needInternalMappings bool) pmaIterator {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -100,7 +100,7 @@ func (mm *MemoryManager) existingVecPMAsLocked(ars usermem.AddrRangeSeq, at user
 //   (i.e. permission checks must have been performed against vmas).
 func (mm *MemoryManager) getPMAsLocked(ctx context.Context, vseg vmaIterator, ar usermem.AddrRange, at usermem.AccessType) (pmaIterator, pmaGapIterator, error) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 		if !vseg.Ok() {
@@ -193,7 +193,7 @@ func (mm *MemoryManager) getVecPMAsLocked(ctx context.Context, ars usermem.AddrR
 // getVecPMAsLocked; other clients should call one of those instead.
 func (mm *MemoryManager) getPMAsInternalLocked(ctx context.Context, vseg vmaIterator, ar usermem.AddrRange, at usermem.AccessType) (pmaIterator, pmaGapIterator, error) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 || !ar.IsPageAligned() {
+		if !ar.WellFormed() || ar.Length() == 0 || !ar.IsPageAligned() {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 		if !vseg.Ok() {
@@ -223,7 +223,7 @@ func (mm *MemoryManager) getPMAsInternalLocked(ctx context.Context, vseg vmaIter
 				// Need a pma here.
 				optAR := vseg.Range().Intersect(pgap.Range())
 				if checkInvariants {
-					if optAR.Length() <= 0 {
+					if optAR.Length() == 0 {
 						panic(fmt.Sprintf("vseg %v and pgap %v do not overlap", vseg, pgap))
 					}
 				}
@@ -560,7 +560,7 @@ func (mm *MemoryManager) isPMACopyOnWriteLocked(vseg vmaIterator, pseg pmaIterat
 // Invalidate implements memmap.MappingSpace.Invalidate.
 func (mm *MemoryManager) Invalidate(ar usermem.AddrRange, opts memmap.InvalidateOpts) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 || !ar.IsPageAligned() {
+		if !ar.WellFormed() || ar.Length() == 0 || !ar.IsPageAligned() {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -583,7 +583,7 @@ func (mm *MemoryManager) Invalidate(ar usermem.AddrRange, opts memmap.Invalidate
 // * ar must be page-aligned.
 func (mm *MemoryManager) invalidateLocked(ar usermem.AddrRange, invalidatePrivate, invalidateShared bool) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 || !ar.IsPageAligned() {
+		if !ar.WellFormed() || ar.Length() == 0 || !ar.IsPageAligned() {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -629,7 +629,7 @@ func (mm *MemoryManager) invalidateLocked(ar usermem.AddrRange, invalidatePrivat
 // * ar must be page-aligned.
 func (mm *MemoryManager) Pin(ctx context.Context, ar usermem.AddrRange, at usermem.AccessType, ignorePermissions bool) ([]PinnedRange, error) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 || !ar.IsPageAligned() {
+		if !ar.WellFormed() || ar.Length() == 0 || !ar.IsPageAligned() {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -715,10 +715,10 @@ func Unpin(prs []PinnedRange) {
 // * oldAR and newAR must be page-aligned.
 func (mm *MemoryManager) movePMAsLocked(oldAR, newAR usermem.AddrRange) {
 	if checkInvariants {
-		if !oldAR.WellFormed() || oldAR.Length() <= 0 || !oldAR.IsPageAligned() {
+		if !oldAR.WellFormed() || oldAR.Length() == 0 || !oldAR.IsPageAligned() {
 			panic(fmt.Sprintf("invalid oldAR: %v", oldAR))
 		}
-		if !newAR.WellFormed() || newAR.Length() <= 0 || !newAR.IsPageAligned() {
+		if !newAR.WellFormed() || newAR.Length() == 0 || !newAR.IsPageAligned() {
 			panic(fmt.Sprintf("invalid newAR: %v", newAR))
 		}
 		if oldAR.Length() > newAR.Length() {
@@ -778,7 +778,7 @@ func (mm *MemoryManager) movePMAsLocked(oldAR, newAR usermem.AddrRange) {
 // into mm.pmas.
 func (mm *MemoryManager) getPMAInternalMappingsLocked(pseg pmaIterator, ar usermem.AddrRange) (pmaGapIterator, error) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 		if !pseg.Range().Contains(ar.Start) {
@@ -831,7 +831,7 @@ func (mm *MemoryManager) getVecPMAInternalMappingsLocked(ars usermem.AddrRangeSe
 // * pseg.Range().Contains(ar.Start).
 func (mm *MemoryManager) internalMappingsLocked(pseg pmaIterator, ar usermem.AddrRange) safemem.BlockSeq {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 		if !pseg.Range().Contains(ar.Start) {
@@ -1050,7 +1050,7 @@ func (pseg pmaIterator) fileRangeOf(ar usermem.AddrRange) memmap.FileRange {
 		if !pseg.Ok() {
 			panic("terminal pma iterator")
 		}
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 		if !pseg.Range().IsSupersetOf(ar) {
diff --git a/pkg/sentry/mm/vma.go b/pkg/sentry/mm/vma.go
index f769d8294..b8df72813 100644
--- a/pkg/sentry/mm/vma.go
+++ b/pkg/sentry/mm/vma.go
@@ -266,7 +266,7 @@ func (mm *MemoryManager) mlockedBytesRangeLocked(ar usermem.AddrRange) uint64 {
 // * ar.Length() != 0.
 func (mm *MemoryManager) getVMAsLocked(ctx context.Context, ar usermem.AddrRange, at usermem.AccessType, ignorePermissions bool) (vmaIterator, vmaGapIterator, error) {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -350,7 +350,7 @@ const guardBytes = 256 * usermem.PageSize
 // * ar must be page-aligned.
 func (mm *MemoryManager) unmapLocked(ctx context.Context, ar usermem.AddrRange) vmaGapIterator {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 || !ar.IsPageAligned() {
+		if !ar.WellFormed() || ar.Length() == 0 || !ar.IsPageAligned() {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -371,7 +371,7 @@ func (mm *MemoryManager) unmapLocked(ctx context.Context, ar usermem.AddrRange)
 // * ar must be page-aligned.
 func (mm *MemoryManager) removeVMAsLocked(ctx context.Context, ar usermem.AddrRange) vmaGapIterator {
 	if checkInvariants {
-		if !ar.WellFormed() || ar.Length() <= 0 || !ar.IsPageAligned() {
+		if !ar.WellFormed() || ar.Length() == 0 || !ar.IsPageAligned() {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 	}
@@ -511,7 +511,7 @@ func (vseg vmaIterator) mappableRangeOf(ar usermem.AddrRange) memmap.MappableRan
 		if vseg.ValuePtr().mappable == nil {
 			panic("MappableRange is meaningless for anonymous vma")
 		}
-		if !ar.WellFormed() || ar.Length() <= 0 {
+		if !ar.WellFormed() || ar.Length() == 0 {
 			panic(fmt.Sprintf("invalid ar: %v", ar))
 		}
 		if !vseg.Range().IsSupersetOf(ar) {
@@ -536,7 +536,7 @@ func (vseg vmaIterator) addrRangeOf(mr memmap.MappableRange) usermem.AddrRange {
 		if vseg.ValuePtr().mappable == nil {
 			panic("MappableRange is meaningless for anonymous vma")
 		}
-		if !mr.WellFormed() || mr.Length() <= 0 {
+		if !mr.WellFormed() || mr.Length() == 0 {
 			panic(fmt.Sprintf("invalid mr: %v", mr))
 		}
 		if !vseg.mappableRange().IsSupersetOf(mr) {
diff --git a/runsc/flag/flag.go b/runsc/flag/flag.go
index ba1ff833f..775325c06 100644
--- a/runsc/flag/flag.go
+++ b/runsc/flag/flag.go
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// Package flag wraps flag primitives.
 package flag
 
 import (
diff --git a/test/packetimpact/testbench/testbench.go b/test/packetimpact/testbench/testbench.go
index 0073a1361..3c85ebbee 100644
--- a/test/packetimpact/testbench/testbench.go
+++ b/test/packetimpact/testbench/testbench.go
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// Package testbench is the packetimpact test API.
 package testbench
 
 import (
diff --git a/tools/go_marshal/gomarshal/generator.go b/tools/go_marshal/gomarshal/generator.go
index 56fbcb5d2..4a53d25be 100644
--- a/tools/go_marshal/gomarshal/generator.go
+++ b/tools/go_marshal/gomarshal/generator.go
@@ -80,15 +80,15 @@ type Generator struct {
 func NewGenerator(srcs []string, out, outTest, outTestUnconditional, pkg string, imports []string) (*Generator, error) {
 	f, err := os.OpenFile(out, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't open output file %q: %v", out, err)
+		return nil, fmt.Errorf("couldn't open output file %q: %w", out, err)
 	}
 	fTest, err := os.OpenFile(outTest, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't open test output file %q: %v", out, err)
+		return nil, fmt.Errorf("couldn't open test output file %q: %w", out, err)
 	}
 	fTestUC, err := os.OpenFile(outTestUnconditional, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0644)
 	if err != nil {
-		return nil, fmt.Errorf("Couldn't open unconditional test output file %q: %v", out, err)
+		return nil, fmt.Errorf("couldn't open unconditional test output file %q: %w", out, err)
 	}
 	g := Generator{
 		inputs:       srcs,
@@ -181,7 +181,7 @@ func (g *Generator) parse() ([]*ast.File, []*token.FileSet, error) {
 		f, err := parser.ParseFile(fset, path, nil, parser.ParseComments)
 		if err != nil {
 			// Not a valid input file?
-			return nil, nil, fmt.Errorf("Input %q can't be parsed: %v", path, err)
+			return nil, nil, fmt.Errorf("input %q can't be parsed: %w", path, err)
 		}
 
 		if debugEnabled() {
diff --git a/tools/go_stateify/main.go b/tools/go_stateify/main.go
index 4f6ed208a..4ec9fbf89 100644
--- a/tools/go_stateify/main.go
+++ b/tools/go_stateify/main.go
@@ -214,9 +214,6 @@ func main() {
 	emitRegister := func(name string) {
 		initCalls = append(initCalls, fmt.Sprintf("%sRegister((*%s)(nil))", statePrefix, name))
 	}
-	emitZeroCheck := func(name string) {
-		fmt.Fprintf(outputFile, "	if !%sIsZeroValue(&x.%s) { %sFailf(\"%s is %%#v, expected zero\", &x.%s) }\n", statePrefix, name, statePrefix, name, name)
-	}
 
 	// Automated warning.
 	fmt.Fprint(outputFile, "// automatically generated by stateify.\n\n")
@@ -349,6 +346,7 @@ func main() {
 
 			for _, gs := range d.Specs {
 				ts := gs.(*ast.TypeSpec)
+				letter := strings.ToLower(ts.Name.Name[:1])
 				switch x := ts.Type.(type) {
 				case *ast.StructType:
 					maybeEmitImports()
@@ -365,29 +363,32 @@ func main() {
 						emitField(name)
 					}
 					emitLoadValue := func(name, typName string) {
-						fmt.Fprintf(outputFile, "	m.LoadValue(%d, new(%s), func(y interface{}) { x.load%s(y.(%s)) })\n", fields[name], typName, camelCased(name), typName)
+						fmt.Fprintf(outputFile, "	stateSourceObject.LoadValue(%d, new(%s), func(y interface{}) { %s.load%s(y.(%s)) })\n", fields[name], typName, letter, camelCased(name), typName)
 					}
 					emitLoad := func(name string) {
-						fmt.Fprintf(outputFile, "	m.Load(%d, &x.%s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	stateSourceObject.Load(%d, &%s.%s)\n", fields[name], letter, name)
 					}
 					emitLoadWait := func(name string) {
-						fmt.Fprintf(outputFile, "	m.LoadWait(%d, &x.%s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	stateSourceObject.LoadWait(%d, &%s.%s)\n", fields[name], letter, name)
 					}
 					emitSaveValue := func(name, typName string) {
-						fmt.Fprintf(outputFile, "	var %s %s = x.save%s()\n", name, typName, camelCased(name))
-						fmt.Fprintf(outputFile, "	m.SaveValue(%d, %s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	var %sValue %s = %s.save%s()\n", name, typName, letter, camelCased(name))
+						fmt.Fprintf(outputFile, "	stateSinkObject.SaveValue(%d, %sValue)\n", fields[name], name)
 					}
 					emitSave := func(name string) {
-						fmt.Fprintf(outputFile, "	m.Save(%d, &x.%s)\n", fields[name], name)
+						fmt.Fprintf(outputFile, "	stateSinkObject.Save(%d, &%s.%s)\n", fields[name], letter, name)
+					}
+					emitZeroCheck := func(name string) {
+						fmt.Fprintf(outputFile, "	if !%sIsZeroValue(&%s.%s) { %sFailf(\"%s is %%#v, expected zero\", &%s.%s) }\n", statePrefix, letter, name, statePrefix, name, letter, name)
 					}
 
 					// Generate the type name method.
-					fmt.Fprintf(outputFile, "func (x *%s) StateTypeName() string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateTypeName() string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return \"%s.%s\"\n", *fullPkg, ts.Name.Name)
 					fmt.Fprintf(outputFile, "}\n\n")
 
 					// Generate the fields method.
-					fmt.Fprintf(outputFile, "func (x *%s) StateFields() []string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateFields() []string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return []string{\n")
 					scanFields(x, "", scanFunctions{
 						normal: emitField,
@@ -402,7 +403,7 @@ func main() {
 					// file not provided to this binary and prevents inherited methods
 					// from being called multiple times by overriding them.
 					if _, ok := simpleMethods[method{ts.Name.Name, "beforeSave"}]; !ok && generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) beforeSave() {}\n\n", ts.Name.Name)
+						fmt.Fprintf(outputFile, "func (%s *%s) beforeSave() {}\n\n", letter, ts.Name.Name)
 					}
 
 					// Generate the save method.
@@ -412,8 +413,8 @@ func main() {
 					// on this specific behavior, but the ability to specify slots
 					// allows a manual implementation to be order-dependent.
 					if generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) StateSave(m %sSink) {\n", ts.Name.Name, statePrefix)
-						fmt.Fprintf(outputFile, "	x.beforeSave()\n")
+						fmt.Fprintf(outputFile, "func (%s *%s) StateSave(stateSinkObject %sSink) {\n", letter, ts.Name.Name, statePrefix)
+						fmt.Fprintf(outputFile, "	%s.beforeSave()\n", letter)
 						scanFields(x, "", scanFunctions{zerovalue: emitZeroCheck})
 						scanFields(x, "", scanFunctions{value: emitSaveValue})
 						scanFields(x, "", scanFunctions{normal: emitSave, wait: emitSave})
@@ -424,14 +425,14 @@ func main() {
 					// the same reason that we do it for beforeSave.
 					_, hasAfterLoad := simpleMethods[method{ts.Name.Name, "afterLoad"}]
 					if !hasAfterLoad && generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) afterLoad() {}\n\n", ts.Name.Name)
+						fmt.Fprintf(outputFile, "func (%s *%s) afterLoad() {}\n\n", letter, ts.Name.Name)
 					}
 
 					// Generate the load method.
 					//
 					// N.B. See the comment above for the save method.
 					if generateSaverLoader {
-						fmt.Fprintf(outputFile, "func (x *%s) StateLoad(m %sSource) {\n", ts.Name.Name, statePrefix)
+						fmt.Fprintf(outputFile, "func (%s *%s) StateLoad(stateSourceObject %sSource) {\n", letter, ts.Name.Name, statePrefix)
 						scanFields(x, "", scanFunctions{normal: emitLoad, wait: emitLoadWait})
 						scanFields(x, "", scanFunctions{value: emitLoadValue})
 						if hasAfterLoad {
@@ -439,7 +440,7 @@ func main() {
 							// AfterLoad is called, the object encodes a dependency on
 							// referred objects (i.e. fields). This means that afterLoad
 							// will not be called until the other afterLoads are called.
-							fmt.Fprintf(outputFile, "	m.AfterLoad(x.afterLoad)\n")
+							fmt.Fprintf(outputFile, "	stateSourceObject.AfterLoad(%s.afterLoad)\n", letter)
 						}
 						fmt.Fprintf(outputFile, "}\n\n")
 					}
@@ -451,10 +452,10 @@ func main() {
 					maybeEmitImports()
 
 					// Generate the info methods.
-					fmt.Fprintf(outputFile, "func (x *%s) StateTypeName() string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateTypeName() string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return \"%s.%s\"\n", *fullPkg, ts.Name.Name)
 					fmt.Fprintf(outputFile, "}\n\n")
-					fmt.Fprintf(outputFile, "func (x *%s) StateFields() []string {\n", ts.Name.Name)
+					fmt.Fprintf(outputFile, "func (%s *%s) StateFields() []string {\n", letter, ts.Name.Name)
 					fmt.Fprintf(outputFile, "	return nil\n")
 					fmt.Fprintf(outputFile, "}\n\n")
 
diff --git a/tools/nogo/BUILD b/tools/nogo/BUILD
index 9f1fcd9c7..a1a97d1d4 100644
--- a/tools/nogo/BUILD
+++ b/tools/nogo/BUILD
@@ -27,6 +27,8 @@ go_library(
     deps = [
         "//tools/checkescape",
         "//tools/checkunsafe",
+        "@co_honnef_go_tools//staticcheck:go_default_library",
+        "@co_honnef_go_tools//stylecheck:go_default_library",
         "@org_golang_x_tools//go/analysis:go_tool_library",
         "@org_golang_x_tools//go/analysis/internal/facts:go_tool_library",
         "@org_golang_x_tools//go/analysis/passes/asmdecl:go_tool_library",
diff --git a/tools/nogo/build.go b/tools/nogo/build.go
index 39c2ae418..55d34760f 100644
--- a/tools/nogo/build.go
+++ b/tools/nogo/build.go
@@ -29,6 +29,9 @@ var (
 	// internalDefault is applied when no paths are provided.
 	internalDefault = fmt.Sprintf("%s/.*", notPath("external"))
 
+	// generatedPrefix is a regex for generated files.
+	generatedPrefix = "^(.*/)?(bazel-genfiles|bazel-out|bazel-bin)/"
+
 	// externalPrefix is external workspace packages.
 	externalPrefix = "^external/"
 )
diff --git a/tools/nogo/config.go b/tools/nogo/config.go
index cfe7b4aa4..8079618ab 100644
--- a/tools/nogo/config.go
+++ b/tools/nogo/config.go
@@ -41,6 +41,8 @@ import (
 	"golang.org/x/tools/go/analysis/passes/unreachable"
 	"golang.org/x/tools/go/analysis/passes/unsafeptr"
 	"golang.org/x/tools/go/analysis/passes/unusedresult"
+	"honnef.co/go/tools/staticcheck"
+	"honnef.co/go/tools/stylecheck"
 
 	"gvisor.dev/gvisor/tools/checkescape"
 	"gvisor.dev/gvisor/tools/checkunsafe"
@@ -123,6 +125,432 @@ var analyzerConfig = map[*analysis.Analyzer]matcher{
 	checkunsafe.Analyzer: internalMatches(),
 }
 
+func init() {
+	staticMatcher := and(
+		// Only match internal, non-generated files.
+		internalMatches(),
+		generatedExcluded(),
+
+		// We use ALL_CAPS for system definitions,
+		// which are common enough in the code base
+		// that we shouldn't annotate exceptions.
+		//
+		// Same story for underscores.
+		resultExcluded([]string{
+			"should not use ALL_CAPS in Go names",
+			"should not use underscores in Go names",
+		}),
+
+		// Exclude existing matches.
+		internalExcluded(
+			"pkg/abi/linux/fuse.go:22",
+			"pkg/abi/linux/fuse.go:25",
+			"pkg/abi/linux/socket.go:113",
+			"pkg/abi/linux/tty.go:73",
+			"pkg/bpf/decoder.go:112",
+			"pkg/cpuid/cpuid_x86.go:675",
+			"pkg/eventchannel/event.go:193",
+			"pkg/eventchannel/event.go:27",
+			"pkg/eventchannel/event_test.go:22",
+			"pkg/eventchannel/rate.go:19",
+			"pkg/gohacks/gohacks_unsafe.go:33",
+			"pkg/log/json.go:30",
+			"pkg/log/log.go:359",
+			"pkg/merkletree/merkletree.go:230",
+			"pkg/merkletree/merkletree.go:243",
+			"pkg/merkletree/merkletree.go:249",
+			"pkg/merkletree/merkletree.go:266",
+			"pkg/merkletree/merkletree.go:355",
+			"pkg/merkletree/merkletree.go:369",
+			"pkg/metric/metric_test.go:20",
+			"pkg/p9/p9test/client_test.go:687",
+			"pkg/p9/transport_test.go:196",
+			"pkg/pool/pool.go:15",
+			"pkg/refs/refcounter.go:510",
+			"pkg/refs/refcounter_test.go:169",
+			"pkg/refs_vfs2/refs.go:16",
+			"pkg/safemem/block_unsafe.go:89",
+			"pkg/seccomp/seccomp.go:82",
+			"pkg/segment/test/set_functions.go:15",
+			"pkg/sentry/arch/signal.go:166",
+			"pkg/sentry/arch/signal.go:171",
+			"pkg/sentry/control/pprof.go:196",
+			"pkg/sentry/devices/memdev/full.go:58",
+			"pkg/sentry/devices/memdev/null.go:59",
+			"pkg/sentry/devices/memdev/random.go:68",
+			"pkg/sentry/devices/memdev/zero.go:86",
+			"pkg/sentry/fdimport/fdimport.go:15",
+			"pkg/sentry/fs/attr.go:257",
+			"pkg/sentry/fsbridge/fs.go:116",
+			"pkg/sentry/fsbridge/vfs.go:124",
+			"pkg/sentry/fsbridge/vfs.go:70",
+			"pkg/sentry/fs/copy_up.go:365",
+			"pkg/sentry/fs/copy_up_test.go:65",
+			"pkg/sentry/fs/dev/net_tun.go:161",
+			"pkg/sentry/fs/dev/net_tun.go:63",
+			"pkg/sentry/fs/dev/null.go:97",
+			"pkg/sentry/fs/dirent_cache.go:64",
+			"pkg/sentry/fs/file_overlay.go:327",
+			"pkg/sentry/fs/file_overlay.go:524",
+			"pkg/sentry/fs/filetest/filetest.go:55",
+			"pkg/sentry/fs/filetest/filetest.go:60",
+			"pkg/sentry/fs/fs.go:77",
+			"pkg/sentry/fs/fsutil/file.go:290",
+			"pkg/sentry/fs/fsutil/file.go:346",
+			"pkg/sentry/fs/fsutil/host_file_mapper.go:105",
+			"pkg/sentry/fs/fsutil/inode_cached.go:676",
+			"pkg/sentry/fs/fsutil/inode_cached.go:772",
+			"pkg/sentry/fs/gofer/attr.go:120",
+			"pkg/sentry/fs/gofer/fifo.go:33",
+			"pkg/sentry/fs/gofer/inode.go:410",
+			"pkg/sentry/fsimpl/devpts/devpts.go:110",
+			"pkg/sentry/fsimpl/devpts/devpts.go:246",
+			"pkg/sentry/fsimpl/devpts/devpts.go:50",
+			"pkg/sentry/fsimpl/devpts/master.go:110",
+			"pkg/sentry/fsimpl/devpts/master.go:55",
+			"pkg/sentry/fsimpl/devpts/replica.go:113",
+			"pkg/sentry/fsimpl/devpts/replica.go:57",
+			"pkg/sentry/fsimpl/devtmpfs/devtmpfs.go:54",
+			"pkg/sentry/fsimpl/ext/disklayout/superblock_64.go:97",
+			"pkg/sentry/fsimpl/ext/disklayout/superblock_old.go:92",
+			"pkg/sentry/fsimpl/ext/disklayout/block_group_32.go:44",
+			"pkg/sentry/fsimpl/ext/disklayout/inode_new.go:91",
+			"pkg/sentry/fsimpl/ext/disklayout/inode_old.go:93",
+			"pkg/sentry/fsimpl/ext/disklayout/superblock_32.go:66",
+			"pkg/sentry/fsimpl/ext/disklayout/block_group_64.go:53",
+			"pkg/sentry/fsimpl/eventfd/eventfd.go:268",
+			"pkg/sentry/fsimpl/ext/directory.go:163",
+			"pkg/sentry/fsimpl/ext/directory.go:164",
+			"pkg/sentry/fsimpl/ext/extent_file.go:142",
+			"pkg/sentry/fsimpl/ext/extent_file.go:143",
+			"pkg/sentry/fsimpl/ext/ext.go:105",
+			"pkg/sentry/fsimpl/ext/filesystem.go:287",
+			"pkg/sentry/fsimpl/ext/regular_file.go:153",
+			"pkg/sentry/fsimpl/ext/symlink.go:113",
+			"pkg/sentry/fsimpl/fuse/connection_control.go:194",
+			"pkg/sentry/fsimpl/fuse/dev.go:387",
+			"pkg/sentry/fsimpl/fuse/dev_test.go:318",
+			"pkg/sentry/fsimpl/fuse/fusefs.go:102",
+			"pkg/sentry/fsimpl/fuse/read_write.go:129",
+			"pkg/sentry/fsimpl/fuse/request_response.go:71",
+			"pkg/sentry/fsimpl/gofer/directory.go:135",
+			"pkg/sentry/fsimpl/gofer/filesystem.go:679",
+			"pkg/sentry/fsimpl/gofer/gofer.go:1694",
+			"pkg/sentry/fsimpl/gofer/gofer.go:276",
+			"pkg/sentry/fsimpl/gofer/regular_file.go:81",
+			"pkg/sentry/fsimpl/gofer/special_file.go:141",
+			"pkg/sentry/fsimpl/host/host.go:184",
+			"pkg/sentry/fsimpl/kernfs/dynamic_bytes_file.go:50",
+			"pkg/sentry/fsimpl/kernfs/dynamic_bytes_file.go:90",
+			"pkg/sentry/fsimpl/kernfs/fd_impl_util.go:273",
+			"pkg/sentry/fsimpl/kernfs/filesystem.go:247",
+			"pkg/sentry/fsimpl/kernfs/inode_impl_util.go:320",
+			"pkg/sentry/fsimpl/kernfs/inode_impl_util.go:497",
+			"pkg/sentry/fsimpl/kernfs/synthetic_directory.go:52",
+			"pkg/sentry/fsimpl/overlay/directory.go:119",
+			"pkg/sentry/fsimpl/overlay/filesystem.go:527",
+			"pkg/sentry/fsimpl/overlay/non_directory.go:152",
+			"pkg/sentry/fsimpl/overlay/overlay.go:115",
+			"pkg/sentry/fsimpl/overlay/overlay.go:719",
+			"pkg/sentry/fsimpl/pipefs/pipefs.go:74",
+			"pkg/sentry/fsimpl/proc/filesystem.go:52",
+			"pkg/sentry/fsimpl/proc/filesystem.go:81",
+			"pkg/sentry/fsimpl/proc/subtasks.go:126",
+			"pkg/sentry/fsimpl/proc/subtasks.go:189",
+			"pkg/sentry/fsimpl/proc/task_fds.go:168",
+			"pkg/sentry/fsimpl/proc/task_fds.go:228",
+			"pkg/sentry/fsimpl/proc/task_fds.go:301",
+			"pkg/sentry/fsimpl/proc/task_fds.go:318",
+			"pkg/sentry/fsimpl/proc/task_fds.go:67",
+			"pkg/sentry/fsimpl/proc/task_files.go:112",
+			"pkg/sentry/fsimpl/proc/task_files.go:158",
+			"pkg/sentry/fsimpl/proc/task_files.go:259",
+			"pkg/sentry/fsimpl/proc/task_files.go:285",
+			"pkg/sentry/fsimpl/proc/task_files.go:305",
+			"pkg/sentry/fsimpl/proc/task_files.go:384",
+			"pkg/sentry/fsimpl/proc/task_files.go:403",
+			"pkg/sentry/fsimpl/proc/task_files.go:428",
+			"pkg/sentry/fsimpl/proc/task_files.go:691",
+			"pkg/sentry/fsimpl/proc/task_files.go:770",
+			"pkg/sentry/fsimpl/proc/task_files.go:797",
+			"pkg/sentry/fsimpl/proc/task_files.go:828",
+			"pkg/sentry/fsimpl/proc/task_files.go:879",
+			"pkg/sentry/fsimpl/proc/task_files.go:910",
+			"pkg/sentry/fsimpl/proc/task_files.go:961",
+			"pkg/sentry/fsimpl/proc/task.go:127",
+			"pkg/sentry/fsimpl/proc/task.go:193",
+			"pkg/sentry/fsimpl/proc/task_net.go:134",
+			"pkg/sentry/fsimpl/proc/task_net.go:475",
+			"pkg/sentry/fsimpl/proc/task_net.go:491",
+			"pkg/sentry/fsimpl/proc/task_net.go:508",
+			"pkg/sentry/fsimpl/proc/task_net.go:665",
+			"pkg/sentry/fsimpl/proc/task_net.go:715",
+			"pkg/sentry/fsimpl/proc/task_net.go:779",
+			"pkg/sentry/fsimpl/proc/tasks_files.go:113",
+			"pkg/sentry/fsimpl/proc/tasks_files.go:388",
+			"pkg/sentry/fsimpl/proc/tasks.go:232",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:145",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:181",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:239",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:291",
+			"pkg/sentry/fsimpl/proc/tasks_sys.go:375",
+			"pkg/sentry/fsimpl/signalfd/signalfd.go:124",
+			"pkg/sentry/fsimpl/signalfd/signalfd.go:15",
+			"pkg/sentry/fsimpl/signalfd/signalfd.go:126",
+			"pkg/sentry/fsimpl/sockfs/sockfs.go:36",
+			"pkg/sentry/fsimpl/sockfs/sockfs.go:79",
+			"pkg/sentry/fsimpl/sys/kcov.go:49",
+			"pkg/sentry/fsimpl/sys/kcov.go:99",
+			"pkg/sentry/fsimpl/sys/sys.go:118",
+			"pkg/sentry/fsimpl/sys/sys.go:56",
+			"pkg/sentry/fsimpl/testutil/testutil.go:257",
+			"pkg/sentry/fsimpl/testutil/testutil.go:260",
+			"pkg/sentry/fsimpl/timerfd/timerfd.go:87",
+			"pkg/sentry/fsimpl/tmpfs/directory.go:112",
+			"pkg/sentry/fsimpl/tmpfs/filesystem.go:195",
+			"pkg/sentry/fsimpl/tmpfs/regular_file.go:226",
+			"pkg/sentry/fsimpl/tmpfs/regular_file.go:346",
+			"pkg/sentry/fsimpl/tmpfs/tmpfs.go:103",
+			"pkg/sentry/fsimpl/tmpfs/tmpfs.go:733",
+			"pkg/sentry/fsimpl/verity/filesystem.go:490",
+			"pkg/sentry/fsimpl/verity/verity.go:156",
+			"pkg/sentry/fsimpl/verity/verity.go:629",
+			"pkg/sentry/fsimpl/verity/verity.go:672",
+			"pkg/sentry/fs/mount.go:162",
+			"pkg/sentry/fs/mount.go:256",
+			"pkg/sentry/fs/mount_overlay.go:144",
+			"pkg/sentry/fs/mounts.go:432",
+			"pkg/sentry/fs/proc/exec_args.go:104",
+			"pkg/sentry/fs/proc/exec_args.go:73",
+			"pkg/sentry/fs/proc/fds.go:269",
+			"pkg/sentry/fs/proc/loadavg.go:33",
+			"pkg/sentry/fs/proc/meminfo.go:39",
+			"pkg/sentry/fs/proc/mounts.go:193",
+			"pkg/sentry/fs/proc/mounts.go:84",
+			"pkg/sentry/fs/proc/net.go:125",
+			"pkg/sentry/fs/proc/proc.go:146",
+			"pkg/sentry/fs/proc/proc.go:204",
+			"pkg/sentry/fs/proc/seqfile/seqfile.go:210",
+			"pkg/sentry/fs/proc/sys.go:146",
+			"pkg/sentry/fs/proc/sys.go:43",
+			"pkg/sentry/fs/proc/sys_net.go:113",
+			"pkg/sentry/fs/proc/sys_net.go:205",
+			"pkg/sentry/fs/proc/sys_net.go:233",
+			"pkg/sentry/fs/proc/sys_net.go:307",
+			"pkg/sentry/fs/proc/sys_net.go:335",
+			"pkg/sentry/fs/proc/sys_net.go:446",
+			"pkg/sentry/fs/proc/sys_net.go:456",
+			"pkg/sentry/fs/proc/sys_net.go:89",
+			"pkg/sentry/fs/proc/task.go:170",
+			"pkg/sentry/fs/proc/task.go:322",
+			"pkg/sentry/fs/proc/task.go:427",
+			"pkg/sentry/fs/proc/task.go:467",
+			"pkg/sentry/fs/proc/task.go:500",
+			"pkg/sentry/fs/proc/task.go:784",
+			"pkg/sentry/fs/proc/task.go:839",
+			"pkg/sentry/fs/proc/task.go:920",
+			"pkg/sentry/fs/proc/uid_gid_map.go:108",
+			"pkg/sentry/fs/proc/uid_gid_map.go:79",
+			"pkg/sentry/fs/proc/uptime.go:75",
+			"pkg/sentry/fs/ramfs/dir.go:447",
+			"pkg/sentry/fs/tmpfs/inode_file.go:436",
+			"pkg/sentry/fs/tmpfs/inode_file.go:537",
+			"pkg/sentry/fs/tty/dir.go:313",
+			"pkg/sentry/fs/tty/master.go:131",
+			"pkg/sentry/fs/tty/master.go:91",
+			"pkg/sentry/fs/tty/replica.go:116",
+			"pkg/sentry/fs/tty/replica.go:88",
+			"pkg/sentry/kernel/auth/id_map.go:269",
+			"pkg/sentry/kernel/fasync/fasync.go:67",
+			"pkg/sentry/kernel/kcov.go:209",
+			"pkg/sentry/kernel/kcov.go:223",
+			"pkg/sentry/kernel/kernel.go:343",
+			"pkg/sentry/kernel/kernel.go:368",
+			"pkg/sentry/kernel/pipe/node_test.go:112",
+			"pkg/sentry/kernel/pipe/node_test.go:119",
+			"pkg/sentry/kernel/pipe/node_test.go:130",
+			"pkg/sentry/kernel/pipe/node_test.go:137",
+			"pkg/sentry/kernel/pipe/node_test.go:149",
+			"pkg/sentry/kernel/pipe/node_test.go:150",
+			"pkg/sentry/kernel/pipe/node_test.go:158",
+			"pkg/sentry/kernel/pipe/node_test.go:174",
+			"pkg/sentry/kernel/pipe/node_test.go:180",
+			"pkg/sentry/kernel/pipe/node_test.go:193",
+			"pkg/sentry/kernel/pipe/node_test.go:202",
+			"pkg/sentry/kernel/pipe/node_test.go:205",
+			"pkg/sentry/kernel/pipe/node_test.go:216",
+			"pkg/sentry/kernel/pipe/node_test.go:219",
+			"pkg/sentry/kernel/pipe/node_test.go:271",
+			"pkg/sentry/kernel/pipe/node_test.go:290",
+			"pkg/sentry/kernel/pipe/pipe_test.go:93",
+			"pkg/sentry/kernel/pipe/reader_writer.go:65",
+			"pkg/sentry/kernel/posixtimer.go:157",
+			"pkg/sentry/kernel/ptrace.go:218",
+			"pkg/sentry/kernel/semaphore/semaphore.go:323",
+			"pkg/sentry/kernel/sessions.go:123",
+			"pkg/sentry/kernel/sessions.go:508",
+			"pkg/sentry/kernel/signal_handlers.go:57",
+			"pkg/sentry/kernel/task_context.go:72",
+			"pkg/sentry/kernel/task_exit.go:67",
+			"pkg/sentry/kernel/task_sched.go:255",
+			"pkg/sentry/kernel/task_sched.go:280",
+			"pkg/sentry/kernel/task_sched.go:323",
+			"pkg/sentry/kernel/task_stop.go:192",
+			"pkg/sentry/kernel/thread_group.go:530",
+			"pkg/sentry/kernel/timekeeper.go:316",
+			"pkg/sentry/kernel/vdso.go:106",
+			"pkg/sentry/kernel/vdso.go:118",
+			"pkg/sentry/memmap/memmap.go:103",
+			"pkg/sentry/memmap/memmap.go:163",
+			"pkg/sentry/mm/address_space.go:42",
+			"pkg/sentry/mm/address_space.go:42",
+			"pkg/sentry/mm/aio_context.go:208",
+			"pkg/sentry/mm/aio_context.go:288",
+			"pkg/sentry/mm/pma.go:683",
+			"pkg/sentry/mm/special_mappable.go:80",
+			"pkg/sentry/platform/systrap/subprocess.go:370",
+			"pkg/sentry/platform/systrap/usertrap/usertrap_amd64.go:124",
+			"pkg/sentry/socket/control/control.go:260",
+			"pkg/sentry/socket/control/control.go:94",
+			"pkg/sentry/socket/control/control_vfs2.go:37",
+			"pkg/sentry/socket/hostinet/stack.go:433",
+			"pkg/sentry/socket/hostinet/stack.go:438",
+			"pkg/sentry/socket/hostinet/stack.go:444",
+			"pkg/sentry/socket/hostinet/stack.go:460",
+			"pkg/sentry/socket/netfilter/tcp_matcher.go:74",
+			"pkg/sentry/socket/netfilter/udp_matcher.go:71",
+			"pkg/sentry/socket/netlink/route/protocol.go:38",
+			"pkg/sentry/socket/socket.go:332",
+			"pkg/sentry/socket/unix/transport/connectioned.go:394",
+			"pkg/sentry/socket/unix/transport/connectionless.go:152",
+			"pkg/sentry/socket/unix/transport/unix.go:436",
+			"pkg/sentry/socket/unix/transport/unix.go:490",
+			"pkg/sentry/socket/unix/transport/unix.go:685",
+			"pkg/sentry/socket/unix/transport/unix.go:795",
+			"pkg/sentry/syscalls/linux/sys_sem.go:62",
+			"pkg/sentry/syscalls/linux/sys_time.go:189",
+			"pkg/sentry/usage/cpu.go:42",
+			"pkg/sentry/vfs/anonfs.go:302",
+			"pkg/sentry/vfs/anonfs.go:99",
+			"pkg/sentry/vfs/dentry.go:214",
+			"pkg/sentry/vfs/epoll.go:168",
+			"pkg/sentry/vfs/epoll.go:314",
+			"pkg/sentry/vfs/file_description.go:549",
+			"pkg/sentry/vfs/file_description_impl_util.go:304",
+			"pkg/sentry/vfs/file_description_impl_util.go:412",
+			"pkg/sentry/vfs/filesystem.go:76",
+			"pkg/sentry/vfs/lock.go:15",
+			"pkg/sentry/vfs/lock.go:47",
+			"pkg/sentry/vfs/memxattr/xattr.go:37",
+			"pkg/sentry/vfs/mount.go:510",
+			"pkg/sentry/vfs/mount.go:667",
+			"pkg/sentry/vfs/mount_test.go:106",
+			"pkg/sentry/vfs/mount_test.go:160",
+			"pkg/sentry/vfs/mount_test.go:215",
+			"pkg/sentry/vfs/mount_unsafe.go:153",
+			"pkg/sentry/vfs/resolving_path.go:228",
+			"pkg/sentry/vfs/vfs.go:897",
+			"pkg/shim/runsc/runsc.go:16",
+			"pkg/shim/runsc/utils.go:16",
+			"pkg/shim/v1/proc/deleted_state.go:16",
+			"pkg/shim/v1/proc/exec.go:16",
+			"pkg/shim/v1/proc/exec_state.go:16",
+			"pkg/shim/v1/proc/init.go:16",
+			"pkg/shim/v1/proc/init_state.go:16",
+			"pkg/shim/v1/proc/io.go:16",
+			"pkg/shim/v1/proc/process.go:16",
+			"pkg/shim/v1/proc/types.go:16",
+			"pkg/shim/v1/proc/utils.go:16",
+			"pkg/shim/v1/shim/api.go:16",
+			"pkg/shim/v1/shim/platform.go:16",
+			"pkg/shim/v1/shim/service.go:16",
+			"pkg/shim/v1/utils/annotations.go:15",
+			"pkg/shim/v1/utils/utils.go:15",
+			"pkg/shim/v1/utils/volumes.go:15",
+			"pkg/shim/v2/api.go:16",
+			"pkg/shim/v2/epoll.go:18",
+			"pkg/shim/v2/options/options.go:15",
+			"pkg/shim/v2/options/options.go:24",
+			"pkg/shim/v2/options/options.go:26",
+			"pkg/shim/v2/runtimeoptions/runtimeoptions.go:16",
+			"pkg/shim/v2/runtimeoptions/runtimeoptions_test.go:22",
+			"pkg/shim/v2/service.go:15",
+			"pkg/shim/v2/service_linux.go:18",
+			"pkg/state/tests/integer_test.go:23",
+			"pkg/state/tests/integer_test.go:28",
+			"pkg/sync/rwmutex_test.go:105",
+			"pkg/syserr/host_linux.go:35",
+			"pkg/tcpip/adapters/gonet/gonet_test.go:144",
+			"pkg/tcpip/adapters/gonet/gonet_test.go:415",
+			"pkg/tcpip/adapters/gonet/gonet_test.go:99",
+			"pkg/tcpip/buffer/view.go:238",
+			"pkg/tcpip/buffer/view.go:238",
+			"pkg/tcpip/buffer/view.go:246",
+			"pkg/tcpip/header/tcp.go:151",
+			"pkg/tcpip/link/sharedmem/pipe/pipe_test.go:493",
+			"pkg/tcpip/stack/iptables.go:293",
+			"pkg/tcpip/stack/iptables_types.go:277",
+			"pkg/tcpip/stack/stack.go:553",
+			"pkg/tcpip/stack/transport_test.go:30",
+			"pkg/tcpip/transport/packet/endpoint.go:126",
+			"pkg/tcpip/transport/raw/endpoint.go:145",
+			"pkg/tcpip/transport/tcp/sack_scoreboard.go:167",
+			"pkg/unet/unet_test.go:634",
+			"pkg/unet/unet_test.go:662",
+			"pkg/unet/unet_test.go:703",
+			"pkg/unet/unet_test.go:98",
+			"pkg/usermem/addr.go:34",
+			"pkg/usermem/usermem.go:171",
+			"pkg/usermem/usermem.go:170",
+			"runsc/boot/compat.go:22",
+			"runsc/boot/compat.go:56",
+			"runsc/boot/loader.go:1115",
+			"runsc/boot/loader.go:1120",
+			"runsc/cmd/checkpoint.go:151",
+			"runsc/config/flags.go:32",
+			"runsc/container/container.go:641",
+			"runsc/container/container.go:988",
+			"runsc/specutils/specutils.go:172",
+			"runsc/specutils/specutils.go:428",
+			"runsc/specutils/specutils.go:436",
+			"runsc/specutils/specutils.go:442",
+			"runsc/specutils/specutils.go:447",
+			"runsc/specutils/specutils.go:454",
+			"test/cmd/test_app/fds.go:171",
+			"test/iptables/filter_output.go:251",
+			"test/packetimpact/testbench/connections.go:77",
+			"tools/bigquery/bigquery.go:106",
+			"tools/checkescape/test1/test1.go:108",
+			"tools/checkescape/test1/test1.go:122",
+			"tools/checkescape/test1/test1.go:137",
+			"tools/checkescape/test1/test1.go:151",
+			"tools/checkescape/test1/test1.go:170",
+			"tools/checkescape/test1/test1.go:39",
+			"tools/checkescape/test1/test1.go:45",
+			"tools/checkescape/test1/test1.go:50",
+			"tools/checkescape/test1/test1.go:64",
+			"tools/checkescape/test1/test1.go:80",
+			"tools/checkescape/test1/test1.go:94",
+			"tools/go_generics/imports.go:51",
+			"tools/go_generics/imports.go:75",
+			"tools/go_marshal/gomarshal/generator.go:177",
+			"tools/go_marshal/gomarshal/generator.go:81",
+			"tools/go_marshal/gomarshal/generator.go:85",
+			"tools/go_marshal/test/escape/escape.go:15",
+			"tools/go_marshal/test/test.go:164",
+		),
+	)
+
+	// Add all staticcheck analyzers; internal only.
+	for _, a := range staticcheck.Analyzers {
+		analyzerConfig[a] = staticMatcher
+	}
+	// Add all stylecheck analyzers; internal only.
+	for _, a := range stylecheck.Analyzers {
+		analyzerConfig[a] = staticMatcher
+	}
+}
+
 var escapesConfig = map[*analysis.Analyzer]matcher{
 	// Informational only: include all packages.
 	checkescape.EscapeAnalyzer: alwaysMatches(),
diff --git a/tools/nogo/matchers.go b/tools/nogo/matchers.go
index 5c39be630..b7b73fa27 100644
--- a/tools/nogo/matchers.go
+++ b/tools/nogo/matchers.go
@@ -102,6 +102,14 @@ func internalMatches() *pathRegexps {
 	}
 }
 
+// generatedExcluded excludes all generated code.
+func generatedExcluded() *pathRegexps {
+	return &pathRegexps{
+		expr:    buildRegexps(generatedPrefix, ".*"),
+		include: false,
+	}
+}
+
 // resultExcluded excludes explicit message contents.
 type resultExcluded []string
 
@@ -117,20 +125,23 @@ func (r resultExcluded) ShouldReport(d analysis.Diagnostic, _ *token.FileSet) bo
 
 // andMatcher is a composite matcher.
 type andMatcher struct {
-	first  matcher
-	second matcher
+	all []matcher
 }
 
 // ShouldReport implements matcher.ShouldReport.
 func (a *andMatcher) ShouldReport(d analysis.Diagnostic, fs *token.FileSet) bool {
-	return a.first.ShouldReport(d, fs) && a.second.ShouldReport(d, fs)
+	for _, m := range a.all {
+		if !m.ShouldReport(d, fs) {
+			return false
+		}
+	}
+	return true
 }
 
 // and is a syntactic convension for andMatcher.
-func and(first matcher, second matcher) *andMatcher {
+func and(ms ...matcher) *andMatcher {
 	return &andMatcher{
-		first:  first,
-		second: second,
+		all: ms,
 	}
 }