diff --git a/cmd/pk-put/files.go b/cmd/pk-put/files.go
index 1bd3889ef..eff513fc3 100644
--- a/cmd/pk-put/files.go
+++ b/cmd/pk-put/files.go
@@ -379,6 +379,8 @@ func (up *Uploader) uploadNode(ctx context.Context, n *node) (*client.PutResult,
 	}
 	bb := schema.NewCommonFileMap(n.fullPath, fi)
 	switch {
+	default:
+		return nil, fmt.Errorf("pk-put.files: unsupported file type %v for file %v", mode, n.fullPath)
 	case mode&os.ModeSymlink != 0:
 		// TODO(bradfitz): use VFS here; not os.Readlink
 		target, err := os.Readlink(n.fullPath)
@@ -393,8 +395,6 @@ func (up *Uploader) uploadNode(ctx context.Context, n *node) (*client.PutResult,
 		bb.SetType(schema.TypeSocket)
 	case mode&os.ModeNamedPipe != 0: // fifo
 		bb.SetType(schema.TypeFIFO)
-	default:
-		return nil, fmt.Errorf("pk-put.files: unsupported file type %v for file %v", mode, n.fullPath)
 	case fi.IsDir():
 		ss, err := n.directoryStaticSet()
 		if err != nil {
diff --git a/cmd/pk-put/init.go b/cmd/pk-put/init.go
index 40576411e..758eb2acb 100644
--- a/cmd/pk-put/init.go
+++ b/cmd/pk-put/init.go
@@ -66,7 +66,7 @@ func (c *initCmd) Usage() {
 	for _, v := range c.usageExamples() {
 		usage += v + "\n"
 	}
-	fmt.Fprintf(cmdmain.Stderr, usage)
+	fmt.Fprint(cmdmain.Stderr, usage)
 }
 
 func (c *initCmd) usageExamples() []string {
diff --git a/cmd/pk-put/kvcache.go b/cmd/pk-put/kvcache.go
index d3251b8f9..de0b40437 100644
--- a/cmd/pk-put/kvcache.go
+++ b/cmd/pk-put/kvcache.go
@@ -116,9 +116,6 @@ func (c *KvHaveCache) StatBlobCache(br blob.Ref) (size uint32, ok bool) {
 	if err != nil {
 		log.Fatalf("Could not decode have cache binary value for %v: %v", br, err)
 	}
-	if val < 0 {
-		log.Fatalf("Error decoding have cache binary value for %v: size=%d", br, val)
-	}
 	cachelog.Printf("have cache HIT on %v", br)
 	return uint32(val), true
 }
@@ -127,11 +124,8 @@ func (c *KvHaveCache) NoteBlobExists(br blob.Ref, size uint32) {
 	if !br.Valid() {
 		return
 	}
-	if size < 0 {
-		log.Fatalf("Got a negative blob size to note in have cache for %v", br)
-	}
 	binBr, _ := br.MarshalBinary()
-	binVal := []byte(strconv.Itoa(int(size)))
+	binVal := fmt.Appendf(nil, "%d", size)
 	cachelog.Printf("Adding to have cache %v: %q", br, binVal)
 	if err := c.db.Put(binBr, binVal, nil); err != nil {
 		log.Fatalf("Could not write %v in have cache: %v", br, err)
@@ -181,6 +175,9 @@ func (c *KvStatCache) CachedPutResult(pwd, filename string, fi os.FileInfo, with
 		Permanode: withPermanode,
 	}
 	binKey, err := cacheKey.marshalBinary()
+	if err != nil {
+		return nil, fmt.Errorf("marshaling cache key: %w", err)
+	}
 	binVal, err := c.db.Get(binKey, nil)
 	if err != nil {
 		if err == leveldb.ErrNotFound {
diff --git a/cmd/pk-put/permanode.go b/cmd/pk-put/permanode.go
index 668b77021..685801940 100644
--- a/cmd/pk-put/permanode.go
+++ b/cmd/pk-put/permanode.go
@@ -83,7 +83,7 @@ func (c *permanodeCmd) RunCommand(args []string) error {
 		if err != nil {
 			return fmt.Errorf("Error parsing time %q; expecting time of form %q", c.sigTime, format)
 		}
-		permaNode, err = up.UploadPlannedPermanode(ctxbg, c.key, sigTime)
+		permaNode, err = up.UploadPlannedPermanode(ctxbg, c.key, sigTime) //lint:ignore SA4006 used by handleResult below
 	}
 	if handleResult("permanode", permaNode, err) != nil {
 		return err
@@ -95,9 +95,8 @@ func (c *permanodeCmd) RunCommand(args []string) error {
 	}
 	if c.tag != "" {
 		tags := strings.Split(c.tag, ",")
-		m := schema.NewSetAttributeClaim(permaNode.BlobRef, "tag", tags[0])
 		for _, tag := range tags {
-			m = schema.NewAddAttributeClaim(permaNode.BlobRef, "tag", tag)
+			m := schema.NewAddAttributeClaim(permaNode.BlobRef, "tag", tag)
 			put, err := up.UploadAndSignBlob(ctxbg, m)
 			handleResult("claim-permanode-tag", put, err)
 		}
diff --git a/cmd/pk/dp_idx_rebuild.go b/cmd/pk/dp_idx_rebuild.go
index 44a58a451..7e3280b1b 100644
--- a/cmd/pk/dp_idx_rebuild.go
+++ b/cmd/pk/dp_idx_rebuild.go
@@ -73,7 +73,7 @@ func (c *reindexdpCmd) RunCommand(args []string) error {
 	if err != nil {
 		return err
 	}
-	low := cfg.LowLevelJSONConfig()
+	low := cfg.LowLevelJSONConfig() //lint:ignore SA1019 we use it
 	prefixes, ok := low["prefixes"].(map[string]interface{})
 	if !ok {
 		return fmt.Errorf("No 'prefixes' object in low-level (or converted) config file %s", osutil.UserServerConfigPath())
diff --git a/cmd/pk/dumpconfig.go b/cmd/pk/dumpconfig.go
index 916e78858..d44c523b2 100644
--- a/cmd/pk/dumpconfig.go
+++ b/cmd/pk/dumpconfig.go
@@ -58,7 +58,7 @@ func (c *dumpconfigCmd) RunCommand(args []string) error {
 	if err != nil {
 		return err
 	}
-	lowj, err := json.MarshalIndent(cfg.LowLevelJSONConfig(), "", "  ")
+	lowj, err := json.MarshalIndent(cfg.LowLevelJSONConfig(), "", "  ") //lint:ignore SA1019 we use it still
 	if err != nil {
 		return err
 	}
diff --git a/cmd/pk/whoami.go b/cmd/pk/whoami.go
index ae3689c04..a2e55119b 100644
--- a/cmd/pk/whoami.go
+++ b/cmd/pk/whoami.go
@@ -94,7 +94,7 @@ func whoamiType(c *client.Client, s *schema.Signer) error {
 	if ent == nil {
 		return errors.New("no identity")
 	}
-	fmt.Println(fmt.Sprintf("%T", ent.PrivateKey.PrivateKey))
+	fmt.Printf("%T\n", ent.PrivateKey.PrivateKey)
 	return nil
 }