address issues identified by gosec (#371)

Signed-off-by: Harper, Jason M <[email protected]>

Author: harp-intel

cmd/metrics/metrics_server.go

@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"regexp"
 	"strings"
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -37,7 +38,12 @@ func startPrometheusServer(listenAddr string) {
 	mux.Handle("/metrics", promhttp.Handler())
 	slog.Info("Starting Prometheus metrics server", slog.String("address", listenAddr))
 	go func() {
-		err := http.ListenAndServe(listenAddr, mux)
+		server := &http.Server{
+			Addr:              listenAddr,
+			Handler:           mux,
+			ReadHeaderTimeout: 3 * time.Second,
+		}
+		err := server.ListenAndServe()
 		if err != nil && err != http.ErrServerClosed {
 			slog.Error("Prometheus HTTP server ListenAndServe error", slog.String("error", err.Error()))
 		}

internal/util/util.go

@@ -511,7 +511,10 @@ func CreateFlatTGZ(files []string, tarballPath string) error {
 		}
 
 		if _, err := io.Copy(tarWriter, srcFile); err != nil {
-			srcFile.Close() // Ensure file is closed before returning
+			closeErr := srcFile.Close() // Ensure file is closed before returning
+			if closeErr != nil {
+				return fmt.Errorf("failed to close file %s after copy error: %w", file, closeErr)
+			}
 			return fmt.Errorf("failed to copy file %s to tarball: %w", file, err)
 		}