Fix spelling errors and run codespell automatically

.codespell-ignore

@@ -0,0 +1,6 @@
+AtLeast
+destOp
+ECT
+inport
+renderD
+requestor

.devcontainer/Dockerfile

@@ -50,6 +50,7 @@ RUN sed -r -i 's/^Components: main$/Components: main contrib/g' /etc/apt/sources
       lxc-templates \
       make \
       man-db \
+      pipx \
       pkg-config \
       protoc-gen-go \
       python3-matplotlib \
@@ -69,6 +70,9 @@ RUN sed -r -i 's/^Components: main$/Components: main contrib/g' /etc/apt/sources
       # zfsutils-linux
       xz-utils
 
+# With pipx >= 1.5.0, we could use pipx --global instead.
+RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install codespell
+
 # Add vscode user and add it to sudoers.
 RUN groupadd -g 1000 $USERNAME && \
     useradd -s /bin/bash -u $USER_UID -g $USER_GID -m $USERNAME && \

.github/workflows/tests.yml

@@ -90,10 +90,13 @@ jobs:
             libtool \
             libudev-dev \
             make \
+            pipx \
             pkg-config \
             shellcheck
 
-          python3 -m pip install flake8
+          # With pipx >= 1.5.0, we could use pipx --global instead.
+          PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin \
+            pipx install codespell flake8
 
       - name: Fix repository permissions
         run: |

Makefile

@@ -307,6 +307,10 @@ endif
 ifeq ($(shell command -v flake8),)
 	echo "Please install flake8"
 	exit 1
+endif
+ifeq ($(shell command -v codespell),)
+	echo "Please install codespell"
+	exit 1
 endif
 	flake8 test/deps/import-busybox
 	shellcheck --shell sh test/*.sh test/includes/*.sh test/suites/*.sh test/backends/*.sh test/lint/*.sh

cmd/generate-database/README.md

@@ -47,7 +47,7 @@ ensure the file has been cleared of content:
 
 ### Generation Directive Arguments
 
-The generation directive aruments have the following form:
+The generation directive arguments have the following form:
 
 `//generate-database:mapper <command> flags <kind> <args...>`
 

cmd/generate-database/db/parse.go

@@ -344,7 +344,7 @@ func parseField(f *types.Var, structTag string, kind string, pkgName string) (*F
 		return nil, fmt.Errorf("Unexported field name %q", name)
 	}
 
-	// Ignore fields that are marked with a tag of `db:"ingore"`
+	// Ignore fields that are marked with a tag of `db:"ignore"`
 	if structTag != "" {
 		tagValue := reflect.StructTag(structTag).Get("db")
 		if tagValue == "ignore" {

cmd/generate-database/file/boilerplate/boilerplate.go

@@ -21,7 +21,7 @@ type preparer interface {
 
 // RegisterStmt register a SQL statement.
 //
-// Registered statements will be prepared upfront and re-used, to speed up
+// Registered statements will be prepared upfront and reused, to speed up
 // execution.
 //
 // Return a unique registration code.

cmd/incus-user/main_daemon.go

@@ -63,7 +63,7 @@ func (c *cmdDaemon) Run(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("Failed to obtain connection info: %w", err)
 	}
 
-	// Keep track of the socket path we used to succefully connect to the server
+	// Keep track of the socket path we used to successfully connect to the server
 	serverUnixPath := cinfo.SocketPath
 
 	// Validate the configuration.

cmd/incus/admin_init_interactive.go

@@ -243,7 +243,7 @@ func (c *cmdAdminInit) askClustering(config *api.InitPreseed, d incus.InstanceSe
 				return fmt.Errorf(i18n.G("Failed to setup trust relationship with cluster: %w"), err)
 			}
 
-			// Now we have setup trust, don't send to server, othwerwise it will try and setup trust
+			// Now we have setup trust, don't send to server, otherwise it will try and setup trust
 			// again and if using a one-time join token, will fail.
 			config.Cluster.ClusterToken = ""
 
@@ -772,7 +772,7 @@ func (c *cmdAdminInit) askDaemon(config *api.InitPreseed, d incus.InstanceServer
 This means that unless you manually configured your host otherwise,
 you will not have enough uids and gids to allocate to your containers.
 
-Your container's own allocation can be re-used to avoid the problem.
+Your container's own allocation can be reused to avoid the problem.
 Doing so makes your nested containers slightly less safe as they could
 in theory attack their parent container and gain more privileges than
 they otherwise would.`) + "\n\n")

cmd/incus/copy.go

@@ -471,7 +471,7 @@ func (c *cmdCopy) Run(cmd *cobra.Command, args []string) error {
 	keepVolatile := c.flagRefresh
 	instanceOnly := c.flagInstanceOnly
 
-	// If not target name is specified, one will be chosed by the server
+	// If target name is not specified, one will be chosen by the server
 	if len(args) < 2 {
 		return c.copyInstance(conf, args[0], "", keepVolatile, ephem, stateful, instanceOnly, mode, c.flagStorage, false)
 	}

cmd/incus/move.go

@@ -316,7 +316,7 @@ func (c *cmdMove) moveInstance(sourceResource string, destResource string, state
 			return err
 		}
 
-		// Fetch the current isntance.
+		// Fetch the current instance.
 		inst, _, err := source.GetInstance(sourceName)
 		if err != nil {
 			return err

cmd/incus/storage_bucket.go

@@ -518,7 +518,7 @@ Pre-defined column shorthand chars:
 	return cmd
 }
 
-const defaultStorageBucketColumns = "nd"
+const defaultStorageBucketColumns = "nd" // codespell:ignore nd
 
 func (c *cmdStorageBucketList) parseColumns(clustered bool) ([]storageBucketColumn, error) {
 	columnsShorthandMap := map[rune]storageBucketColumn{

cmd/incusd/api_cluster.go

@@ -2160,8 +2160,8 @@ func internalClusterPostAccept(d *Daemon, r *http.Request) response.Response {
 		return response.BadRequest(fmt.Errorf("No name provided"))
 	}
 
-	// Redirect all requests to the leader, which is the one with
-	// knowning what nodes are part of the raft cluster.
+	// Redirect all requests to the leader, which is the one
+	// knowing what nodes are part of the raft cluster.
 	localClusterAddress := s.LocalConfig.ClusterAddress()
 
 	leader, err := s.Cluster.LeaderAddress()

cmd/incusd/api_internal_recover.go

@@ -319,7 +319,7 @@ func internalRecoverScan(ctx context.Context, s *state.State, userPools []api.St
 
 	// Create the pools themselves.
 	for _, pool := range pools {
-		// Create missing storage pool DB record if neeed.
+		// Create missing storage pool DB record if needed.
 		if pool.ID() == storagePools.PoolIDTemporary {
 			var instPoolVol *backupConfig.Config // Instance volume used for new pool record.
 			var poolID int64                     // Pool ID of created pool record.

cmd/incusd/api_project.go

@@ -1578,7 +1578,7 @@ func projectValidateConfig(s *state.State, config map[string]string) error {
 		// gendoc:generate(entity=project, group=restricted, key=restricted.containers.privilege)
 		// Possible values are `unprivileged`, `isolated`, and `allow`.
 		//
-		// - When set to `unpriviliged`, this option prevents setting {config:option}`instance-security:security.privileged` to `true`.
+		// - When set to `unprivileged`, this option prevents setting {config:option}`instance-security:security.privileged` to `true`.
 		// - When set to `isolated`, this option prevents setting {config:option}`instance-security:security.privileged` and {config:option}`instance-security:security.idmap.isolated` to `true`.
 		// - When set to `allow`, there is no restriction.
 		// ---

cmd/incusd/daemon.go

@@ -1839,7 +1839,7 @@ func (d *Daemon) Stop(ctx context.Context, sig os.Signal) error {
 	if sig == unix.SIGPWR || sig == unix.SIGTERM {
 		if d.db.Cluster != nil {
 			// waitForOperations will block until all operations are done, or it's forced to shut down.
-			// For the latter case, we re-use the shutdown channel which is filled when a shutdown is
+			// For the latter case, we reuse the shutdown channel which is filled when a shutdown is
 			// initiated using `shutdown`.
 			waitForOperations(ctx, d.db.Cluster, s.GlobalConfig.ShutdownTimeout())
 		}

cmd/incusd/daemon_images.go

@@ -544,7 +544,7 @@ func ImageDownload(ctx context.Context, r *http.Request, s *state.State, op *ope
 		return nil, false, fmt.Errorf("Unsupported protocol: %v", protocol)
 	}
 
-	// Override visiblity
+	// Override visibility
 	info.Public = args.Public
 
 	// We want to enable auto-update only if we were passed an

cmd/incusd/dev_incus.go

@@ -328,9 +328,9 @@ func devIncusAPI(d *Daemon, f hoistFunc) http.Handler {
  *    event, we use SO_PEERCRED to extract the creds for the socket.
  *
  * 2. We store a map from the connection pointer to the pid for that
- *    connection, so that once the HTTP negotiation occurrs and we get a
+ *    connection, so that once the HTTP negotiation occurs and we get a
  *    ResponseWriter, we know (because we negotiated on the first byte) which
- *    pid the connection belogs to.
+ *    pid the connection belongs to.
  *
  * 3. Regular HTTP negotiation and dispatch occurs via net/http.
  *

cmd/incusd/instance.go

@@ -672,7 +672,7 @@ func pruneExpiredAndAutoCreateInstanceSnapshotsTask(d *Daemon) (task.Func, task.
 			return
 		}
 
-		// Get list of instances on the local member that are due to have snaphots creating.
+		// Get list of instances on the local member that are due to have snapshots creating.
 		filter := dbCluster.InstanceFilter{Node: &s.ServerName}
 
 		err = s.DB.Cluster.Transaction(ctx, func(ctx context.Context, tx *db.ClusterTx) error {

cmd/incusd/instance_access.go

@@ -15,7 +15,7 @@ import (
 
 // swagger:operation GET /1.0/instances/{name}/access instances instance_access
 //
-//	Get who has access to an instnace
+//	Get who has access to an instance
 //
 //	Gets the access information for the instance.
 //

cmd/incusd/instance_test.go

@@ -208,7 +208,7 @@ func (suite *containerTestSuite) TestContainer_LoadFromDB() {
 	suite.Exactly(
 		apiC1,
 		apiC2,
-		"The loaded container isn't excactly the same as the created one.",
+		"The loaded container isn't exactly the same as the created one.",
 	)
 }
 

cmd/incusd/main_test.go

@@ -20,7 +20,7 @@ func mockStartDaemon() (*Daemon, error) {
 	d := defaultDaemon()
 	d.os.MockMode = true
 
-	// Setup test certificates. We re-use the ones already on disk under
+	// Setup test certificates. We reuse the ones already on disk under
 	// the test/ directory, to avoid generating new ones, which is
 	// expensive.
 	err := sys.SetupTestCerts(internalUtil.VarPath())

cmd/incusd/migration_connection.go

@@ -111,7 +111,7 @@ func (c *migrationConn) AcceptIncoming(r *http.Request, w http.ResponseWriter) e
 }
 
 // WebSocket returns the underlying websocket connection.
-// If the connection isn't yet active it will either wait for an incoming connection or if configured, will atempt
+// If the connection isn't yet active it will either wait for an incoming connection or if configured, will attempt
 // to initiate a new outbound connection. If the context is cancelled before the connection is established it
 // will return with an error.
 func (c *migrationConn) WebSocket(ctx context.Context) (*websocket.Conn, error) {

cmd/incusd/networks.go

@@ -42,7 +42,7 @@ import (
 	"github.com/lxc/incus/v6/shared/util"
 )
 
-// Lock to prevent concurent networks creation.
+// Lock to prevent concurrent networks creation.
 var networkCreateLock sync.Mutex
 
 var networksCmd = APIEndpoint{
@@ -1187,7 +1187,7 @@ func networkPost(d *Daemon, r *http.Request) response.Response {
 	//        network having already been renamed in the database, which is
 	//        a chicken-and-egg problem for cluster notifications (the
 	//        serving node should typically do the database job, so the
-	//        network is not yet renamed inthe db when the notified node
+	//        network is not yet renamed in the db when the notified node
 	//        runs network.Start).
 	if s.ServerClustered {
 		return response.BadRequest(fmt.Errorf("Renaming clustered network not supported"))

cmd/incusd/snapshot_common.go

@@ -107,7 +107,7 @@ func cronSpecIsNow(spec string) (bool, error) {
 	now := time.Now()
 
 	// Truncate the time now back to the start of the minute.
-	// This is neded because the cron scheduler will add a minute to the scheduled time
+	// This is needed because the cron scheduler will add a minute to the scheduled time
 	// and we don't want the next scheduled time to roll over to the next minute and break
 	// the time comparison below.
 	now = now.Truncate(time.Minute)

cmd/incusd/storage.go

@@ -24,7 +24,7 @@ import (
 )
 
 // Simple cache used to store the activated drivers on this server.
-// This allows us to avoid querying the database everytime and API call is made.
+// This allows us to avoid querying the database every time an API call is made.
 var (
 	storagePoolUsedDriversCacheVal      atomic.Value
 	storagePoolSupportedDriversCacheVal atomic.Value

cmd/incusd/storage_pools.go

@@ -31,7 +31,7 @@ import (
 	"github.com/lxc/incus/v6/shared/util"
 )
 
-// Lock to prevent concurent storage pools creation.
+// Lock to prevent concurrent storage pools creation.
 var storagePoolCreateLock sync.Mutex
 
 var storagePoolsCmd = APIEndpoint{

cmd/incusd/storage_volumes.go

@@ -359,7 +359,7 @@ func storagePoolVolumesGet(d *Daemon, r *http.Request) response.Response {
 			}
 
 			// The project name used for custom volumes varies based on whether the
-			// project has the featues.storage.volumes feature enabled.
+			// project has the features.storage.volumes feature enabled.
 			customVolProjectName = project.StorageVolumeProjectFromRecord(p, db.StoragePoolVolumeTypeCustom)
 
 			projectImages, err = tx.GetImagesFingerprints(ctx, requestProjectName, false)

cmd/lxc-to-incus/main_migrate_test.go

@@ -26,15 +26,15 @@ func TestValidateConfig(t *testing.T) {
 			true,
 		},
 		{
-			"container name missmatch (1)",
+			"container name mismatch (1)",
 			[]string{
 				"lxc.uts.name = c2",
 			},
 			"Container name doesn't match lxc.uts.name / lxc.utsname",
 			true,
 		},
 		{
-			"container name missmatch (2)",
+			"container name mismatch (2)",
 			[]string{
 				"lxc.utsname = c2",
 			},

cmd/lxd-to-incus/db.go

@@ -92,7 +92,7 @@ func lz4Uncompress(zfilename string) error {
 
 	zinfo, err := zfile.Stat()
 	if err != nil {
-		return fmt.Errorf("Fialed to get file info for %q: %w", zfilename, err)
+		return fmt.Errorf("Failed to get file info for %q: %w", zfilename, err)
 	}
 
 	// use the same mode for the output file

cmd/lxd-to-incus/validate.go

@@ -83,7 +83,7 @@ func (c *cmdMigrate) validate(source source, target target) error {
 			return false, nil
 		}
 
-		// Check if any instance is persent.
+		// Check if any instance is present.
 		names, err = srcClient.GetInstanceNames(api.InstanceTypeAny)
 		if err != nil {
 			return false, err

doc/config_options.txt

@@ -1863,7 +1863,7 @@ When set to `allow`, {config:option}`instance-security:security.nesting` can be
 :type: "string"
 Possible values are `unprivileged`, `isolated`, and `allow`.
 
-- When set to `unpriviliged`, this option prevents setting {config:option}`instance-security:security.privileged` to `true`.
+- When set to `unprivileged`, this option prevents setting {config:option}`instance-security:security.privileged` to `true`.
 - When set to `isolated`, this option prevents setting {config:option}`instance-security:security.privileged` and {config:option}`instance-security:security.idmap.isolated` to `true`.
 - When set to `allow`, there is no restriction.
 ```

doc/reference/storage_zfs.md

@@ -39,7 +39,7 @@ Note that this method might have ramifications for restoring snapshots.
 See {ref}`storage-zfs-limitations` below.
 
 Incus automatically enables trimming support on all newly created pools on ZFS 0.8 or later.
-This increases the lifetime of SSDs by allowing better block re-use by the controller, and it also allows to free space on the root file system when using a loop-backed ZFS pool.
+This increases the lifetime of SSDs by allowing better block reuse by the controller, and it also allows to free space on the root file system when using a loop-backed ZFS pool.
 If you are running a ZFS version earlier than 0.8 and want to enable trimming, upgrade to at least version 0.8.
 Then use the following commands to make sure that trimming is automatically enabled for the ZFS pool in the future and trim all currently unused space:
 

doc/rest-api.yaml

@@ -4045,7 +4045,7 @@ definitions:
                 type: string
                 x-go-name: Description
             err:
-                description: Operation error mesage
+                description: Operation error message
                 example: Some error message
                 type: string
                 x-go-name: Err
@@ -4087,7 +4087,7 @@ definitions:
                     items:
                         type: string
                     type: array
-                description: Affected resourcs
+                description: Affected resources
                 example:
                     instances:
                         - /1.0/instances/foo
@@ -9169,7 +9169,7 @@ paths:
                     $ref: '#/responses/Forbidden'
                 "500":
                     $ref: '#/responses/InternalServerError'
-            summary: Get who has access to an instnace
+            summary: Get who has access to an instance
             tags:
                 - instances
     /1.0/instances/{name}/backups:

internal/rsync/rsync.go

@@ -460,7 +460,7 @@ func AtLeast(min string) bool {
 		return false
 	}
 
-	// Load minium version.
+	// Load minimum version.
 	minVer, err := version.NewDottedVersion(min)
 	if err != nil {
 		return false