cloudflare/cfrpki: cmd/octorpki/octorpki.go; 103 LoC

Found a possible issue in [cloudflare/cfrpki](https://www.github.com/cloudflare/cfrpki) at [cmd/octorpki/octorpki.go](https://github.com/cloudflare/cfrpki/blob/9abe2d30dc69114443ef39480e11b485dd9e830f/cmd/octorpki/octorpki.go#L805-L907)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first
issue it finds, so please do not limit your consideration to the contents of the below message.

> range-loop variable tal used in defer or goroutine at line 834

[Click here to see the code in its original context.](https://github.com/cloudflare/cfrpki/blob/9abe2d30dc69114443ef39480e11b485dd9e830f/cmd/octorpki/octorpki.go#L805-L907)

Click here to show the 103 line(s) of Go which triggered the analyzer.

```go
for i, tal := range s.Tals {
tSpan := tracer.StartSpan(
"explore",
opentracing.ChildOf(span.Context()),
)
tSpan.SetTag("tal", tal.Path)

validator := pki.NewValidator()
validator.DecoderConfig.ValidateStrict = s.StrictCms

sm := pki.NewSimpleManager()
manager[i] = sm
manager[i].ReportErrors = true
manager[i].Validator = validator
manager[i].FileSeeker = s.Fetcher
manager[i].Log = s
manager[i].StrictHash = s.StrictHash
manager[i].StrictManifests = s.StrictManifests

go func(sm *pki.SimpleManager) {
for err := range sm.Errors {
tSpan.SetTag("error", true)
tSpan.LogKV("event", "resource issue", "type", "skipping resource", "message", err)
//log.Errorf("Error when processing %v (for %v): %v.", path, rsync, err)
log.Error(err)
sentry.WithScope(func(scope *sentry.Scope) {
if errC, ok := err.(interface{ SetSentryScope(*sentry.Scope) }); ok {
errC.SetSentryScope(scope)
}
scope.SetTag("TrustAnchor", tal.Path)
sentry.CaptureException(err)
})
}

//log.Warn("Closed errors")
}(sm)
manager[i].AddInitial([]*pki.PKIFile{tal})
s.CountExplore = manager[i].Explore(!s.UseManifest, false)

// Insertion of SIAs in db to allow rsync to update the repos
var count int
for _, obj := range manager[i].Validator.TALs {
tal := obj.Resource.(*librpki.RPKITAL)
//s.RsyncFetch[tal.GetURI()] = time.Now().UTC()
if !obj.CertTALValid {
s.TalsFetch[obj.File.Path] = tal
}
count++
}
for _, obj := range manager[i].Validator.ValidObjects {
if obj.Type == pki.TYPE_CER {
cer := obj.Resource.(*librpki.RPKICertificate)
var RsyncGN string
var RRDPGN string
var hasRRDP bool
for _, sia := range cer.SubjectInformationAccess {
gn := string(sia.GeneralName)
if sia.AccessMethod.Equal(CertRepository) {
RsyncGN = gn
} else if sia.AccessMethod.Equal(CertRRDP) {
hasRRDP = true
RRDPGN = gn
}
}
gnExtracted, gnExtractedDomain, err := syncpki.ExtractRsyncDomainModule(RsyncGN)
if err != nil {
log.Errorf("Could not add cert rsync %s due to %v", RsyncGN, err)
continue
}

if hasRRDP {
prev, ok := s.RRDPFetchDomain[RRDPGN]
if ok && prev != gnExtractedDomain {
log.Errorf("rrdp %s tries to override %s with %s", RRDPGN, prev, gnExtractedDomain)
continue
}
s.RRDPFetchDomain[RRDPGN] = gnExtractedDomain
s.RRDPFetch[RRDPGN] = gnExtracted
}
s.RsyncFetch[gnExtracted] = RRDPGN
s.CurrentRepos[gnExtracted] = time.Now().UTC()
count++

// map the rrdp and rsync by TAL for info page
iaId, ok := iatmp[gnExtracted]
if !ok {
iaIdTmp := SIA{
gnExtracted,
RRDPGN,
}
ia[i] = append(ia[i], iaIdTmp)
iaId = &(ia[i][len(ia[i])-1])
iatmp[gnExtracted] = iaId
}
iaId.Rsync = gnExtracted
iaId.RRDP = RRDPGN

}
}
sm.Close()
tSpan.LogKV("count-valid", count, "count-total", s.CountExplore)
tSpan.Finish()
}

```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: 9abe2d30dc69114443ef39480e11b485dd9e830f