diff --git a/cmds/demoplugin/accessmethods/demo.go b/cmds/demoplugin/accessmethods/demo.go
index 5b22521bc6..df91686592 100644
--- a/cmds/demoplugin/accessmethods/demo.go
+++ b/cmds/demoplugin/accessmethods/demo.go
@@ -104,7 +104,11 @@ func (a *AccessMethod) ComposeAccessSpecification(p ppi.Plugin, opts ppi.Config,
 func (a *AccessMethod) Reader(p ppi.Plugin, spec ppi.AccessSpec, creds credentials.Credentials) (io.ReadCloser, error) {
 	my := spec.(*AccessSpec)
 
-	cfg, _ := p.GetConfig()
+	cfg, err := p.GetConfig()
+	if err != nil {
+		return nil, errors.Wrapf(err, "can't get config for access method %s", my.MediaType)
+	}
+
 	root := os.TempDir()
 	if cfg != nil && cfg.(*config.Config).AccessMethods.Path != "" {
 		root = cfg.(*config.Config).Uploaders.Path
diff --git a/cmds/demoplugin/uploaders/demo.go b/cmds/demoplugin/uploaders/demo.go
index b3697c9b6c..eae170eece 100644
--- a/cmds/demoplugin/uploaders/demo.go
+++ b/cmds/demoplugin/uploaders/demo.go
@@ -80,7 +80,11 @@ func (a *Uploader) Writer(p ppi.Plugin, arttype, mediatype, hint string, repo pp
 	var file *os.File
 	var err error
 
-	cfg, _ := p.GetConfig()
+	cfg, err := p.GetConfig()
+	if err != nil {
+		return nil, nil, errors.Wrapf(err, "can't get config for access method %s", mediatype)
+	}
+
 	root := os.TempDir()
 	if cfg != nil && cfg.(*config.Config).Uploaders.Path != "" {
 		root = cfg.(*config.Config).Uploaders.Path
diff --git a/cmds/ocm/commands/misccmds/rsakeypair/cmd.go b/cmds/ocm/commands/misccmds/rsakeypair/cmd.go
index b23367b63f..c7b2f541f9 100644
--- a/cmds/ocm/commands/misccmds/rsakeypair/cmd.go
+++ b/cmds/ocm/commands/misccmds/rsakeypair/cmd.go
@@ -140,7 +140,10 @@ func (o *Command) Complete(args []string) error {
 	if o.rootcerts != "" {
 		pool, err := signutils.GetCertPool(o.rootcerts, false)
 		if err != nil {
-			path, _ := utils2.ResolvePath(o.rootcerts)
+			path, err := utils2.ResolvePath(o.rootcerts)
+			if err != nil {
+				return errors.Wrapf(err, "failed to resolve root certificates")
+			}
 			data, err := vfs.ReadFile(o.Context.FileSystem(), path)
 			if err != nil {
 				return errors.Wrapf(err, "cannot read root cert file %q", o.rootcerts)
@@ -190,7 +193,10 @@ func (o *Command) Complete(args []string) error {
 		raw := []byte(o.cacert)
 		cert, pool, err := signutils.GetCertificate(o.cacert, false)
 		if err != nil {
-			path, _ := utils2.ResolvePath(o.cacert)
+			path, err := utils2.ResolvePath(o.cacert)
+			if err != nil {
+				return errors.Wrapf(err, "failed to resolve cacert file %q", o.cacert)
+			}
 			data, err := vfs.ReadFile(o.Context.FileSystem(), path)
 			if err != nil {
 				return errors.Wrapf(err, "cannot read ca cert file %q", o.cacert)
@@ -222,7 +228,10 @@ func (o *Command) Complete(args []string) error {
 	if o.cakey != "" {
 		key, err := parse.ParsePrivateKey(o.cakey)
 		if err != nil {
-			path, _ := utils2.ResolvePath(o.cakey)
+			path, err := utils2.ResolvePath(o.cakey)
+			if err != nil {
+				return errors.Wrapf(err, "failed to resolve ca key file %q", o.cakey)
+			}
 			data, err := vfs.ReadFile(o.Context.FileSystem(), path)
 			if err != nil {
 				return errors.Wrapf(err, "cannot read private key file %q", o.cakey)
diff --git a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/attached.go b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/attached.go
index 534c2e48e7..342bd44388 100644
--- a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/attached.go
+++ b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/attached.go
@@ -22,9 +22,15 @@ func Attachment(d digest.Digest, suffix string) string {
 var ExplodeAttached = processing.Explode(explodeAttached)
 
 func explodeAttached(o interface{}) []interface{} {
-	obj := o.(*Object)
+	obj, ok := o.(*Object)
+	if !ok {
+		return nil
+	}
 	result := []interface{}{o}
-	blob, _ := obj.Artifact.Blob()
+	blob, err := obj.Artifact.Blob()
+	if err != nil {
+		return result
+	}
 	dig := blob.Digest()
 	prefix := Attachment(dig, "")
 	list, err := obj.Namespace.ListTags()
@@ -38,9 +44,14 @@ func explodeAttached(o interface{}) []interface{} {
 					s := obj.Spec
 					s.Tag = &t
 					s.Digest = nil
+					key, err := Key(a)
+					if err != nil {
+						// this is questionable behaviour. :think:
+						return nil
+					}
 					att := &Object{
 						History:    hist,
-						Key:        Key(a),
+						Key:        key,
 						Spec:       s,
 						AttachKind: l[len(prefix):],
 						Namespace:  obj.Namespace,
diff --git a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/clean.go b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/clean.go
index 79f81173c2..bae7f9860d 100644
--- a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/clean.go
+++ b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/clean.go
@@ -31,7 +31,10 @@ func clean(iterable data.Iterable) data.Iterable {
 		e := it.Next().(*Object)
 		data.Add(e)
 		l := len(e.History)
-		blob, _ := e.Artifact.Blob()
+		blob, err := e.Artifact.Blob()
+		if err != nil {
+			return nil
+		}
 
 		if l > depth[blob.Digest()] {
 			depth[blob.Digest()] = l
@@ -43,7 +46,10 @@ func clean(iterable data.Iterable) data.Iterable {
 
 	output.Print(data, "clean in")
 	for i := 0; i < len(data); i++ {
-		e := data[i].(*Object)
+		e, ok := data[i].(*Object)
+		if !ok {
+			return nil
+		}
 		l := len(e.History)
 		blob, _ := e.Artifact.Blob()
 		dig := blob.Digest()
diff --git a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/closure.go b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/closure.go
index 3a800dda85..d1164f1d46 100644
--- a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/closure.go
+++ b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/closure.go
@@ -18,7 +18,10 @@ func ClosureExplode(opts *output.Options, e interface{}) []interface{} {
 }
 
 func traverse(hist common.History, o *Object, octx out.Context) []output.Object {
-	blob, _ := o.Artifact.Blob()
+	blob, err := o.Artifact.Blob()
+	if err != nil {
+		return nil
+	}
 	key := common.NewNameVersion("", blob.Digest().String())
 	if err := hist.Add(oci.KIND_OCIARTIFACT, key); err != nil {
 		return nil
@@ -38,9 +41,13 @@ func traverse(hist common.History, o *Object, octx out.Context) []output.Object
 			if err != nil {
 				out.Errf(octx, "Warning: lookup nested artifact %q [%s]: %s\n", ref.Digest, hist, err)
 			}
+			version, err := Key(nested)
+			if err != nil {
+				out.Errf(octx, "Failed to find nested key %q [%s]: %s\n", ref.Digest, hist, err)
+			}
 			obj := &Object{
 				History: hist.Copy(),
-				Key:     Key(nested),
+				Key:     version,
 				Spec: oci.RefSpec{
 					UniformRepositorySpec: o.Spec.UniformRepositorySpec,
 					ArtSpec: oci.ArtSpec{
diff --git a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/typehandler.go b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/typehandler.go
index 901269471c..8ecf453dd6 100644
--- a/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/typehandler.go
+++ b/cmds/ocm/commands/ocicmds/common/handlers/artifacthdlr/typehandler.go
@@ -52,7 +52,10 @@ func (o *Object) GetKind() string {
 }
 
 func (o *Object) IsNode() *common.NameVersion {
-	blob, _ := o.Artifact.Blob()
+	blob, err := o.Artifact.Blob()
+	if err != nil {
+		return nil
+	}
 	nv := common.NewNameVersion("", blob.Digest().String())
 	return &nv
 }
@@ -73,7 +76,11 @@ func (o *Object) AsManifest() interface{} {
 }
 
 func (o *Object) String() string {
-	blob, _ := o.Artifact.Blob()
+	blob, err := o.Artifact.Blob()
+	if err != nil {
+		return ""
+	}
+
 	dig := blob.Digest()
 	tag := "-"
 	if o.Spec.Tag != nil {
@@ -90,9 +97,13 @@ type Manifest struct {
 
 ////////////////////////////////////////////////////////////////////////////////
 
-func Key(a oci.ArtifactAccess) common.NameVersion {
-	blob, _ := a.Blob()
-	return common.NewNameVersion("", blob.Digest().String())
+func Key(a oci.ArtifactAccess) (common.NameVersion, error) {
+	blob, err := a.Blob()
+	if err != nil {
+		return common.NameVersion{}, fmt.Errorf("unable to determine blob name: %w", err)
+	}
+
+	return common.NewNameVersion("", blob.Digest().String()), nil
 }
 
 type TypeHandler struct {
@@ -165,8 +176,13 @@ func (h *TypeHandler) get(repo oci.Repository, elemspec utils.ElemSpec) ([]outpu
 		spec = evaluated.Ref
 		namespace = evaluated.Namespace
 		if evaluated.Artifact != nil {
+			key, err := Key(evaluated.Artifact)
+			if err != nil {
+				return nil, fmt.Errorf("unable to determine key for artifact %q: %w", name, err)
+			}
+
 			obj := &Object{
-				Key:       Key(evaluated.Artifact),
+				Key:       key,
 				Spec:      spec,
 				Namespace: namespace,
 				Artifact:  evaluated.Artifact,
@@ -198,8 +214,12 @@ func (h *TypeHandler) get(repo oci.Repository, elemspec utils.ElemSpec) ([]outpu
 			return nil, err
 		}
 		h.session.AddCloser(a)
+		key, err := Key(a)
+		if err != nil {
+			return nil, fmt.Errorf("unable to determine key for artifact %q: %w", name, err)
+		}
 		obj := &Object{
-			Key:       Key(a),
+			Key:       key,
 			Spec:      spec,
 			Namespace: namespace,
 			Artifact:  a,
@@ -219,8 +239,13 @@ func (h *TypeHandler) get(repo oci.Repository, elemspec utils.ElemSpec) ([]outpu
 			t := tag
 			s := spec
 			s.Tag = &t
+			key, err := Key(a)
+			if err != nil {
+				return nil, fmt.Errorf("unable to determine key for artifact %q: %w", name, err)
+			}
+
 			result = append(result, &Object{
-				Key:       Key(a),
+				Key:       key,
 				Spec:      s,
 				Namespace: namespace,
 				Artifact:  a,
diff --git a/cmds/ocm/commands/ocmcmds/common/addconfig.go b/cmds/ocm/commands/ocmcmds/common/addconfig.go
index 8116125ad3..5be1a34f3c 100644
--- a/cmds/ocm/commands/ocmcmds/common/addconfig.go
+++ b/cmds/ocm/commands/ocmcmds/common/addconfig.go
@@ -111,23 +111,27 @@ func (o *ResourceConfigAdderCommand) ProcessResourceDescriptions(h ResourceSpecH
 	listkey := utils.Plural(h.Key(), 0)
 
 	var current string
-	configFile, _ := utils2.ResolvePath(o.ConfigFile)
-	if ok, err := vfs.FileExists(fs, configFile); ok {
+	configFile, err := utils2.ResolvePath(o.ConfigFile)
+	if err != nil {
+		return errors.Wrapf(err, "failed to resolve config file %s", o.ConfigFile)
+	}
+
+	ok, err := vfs.FileExists(fs, configFile)
+	if err != nil {
+		return errors.Wrapf(err, "cannot read %s config file %q", listkey, o.ConfigFile)
+	}
+
+	if ok {
 		fi, err := fs.Stat(configFile)
 		if err != nil {
 			return errors.Wrapf(err, "cannot stat %s config file %q", listkey, o.ConfigFile)
 		}
 		mode = fi.Mode().Perm()
-		if err != nil {
-			return err
-		}
 		data, err := vfs.ReadFile(fs, configFile)
 		if err != nil {
 			return errors.Wrapf(err, "cannot read %s config file %q", listkey, o.ConfigFile)
 		}
 		current = string(data)
-	} else if err != nil {
-		return errors.Wrapf(err, "cannot read %s config file %q", listkey, o.ConfigFile)
 	}
 
 	for _, source := range o.Resources {
diff --git a/cmds/ocm/commands/ocmcmds/common/handlers/comphdlr/typehandler.go b/cmds/ocm/commands/ocmcmds/common/handlers/comphdlr/typehandler.go
index ce22fbf778..6d47e6f968 100644
--- a/cmds/ocm/commands/ocmcmds/common/handlers/comphdlr/typehandler.go
+++ b/cmds/ocm/commands/ocmcmds/common/handlers/comphdlr/typehandler.go
@@ -131,11 +131,14 @@ func (h *TypeHandler) Get(elemspec utils.ElemSpec) ([]output.Object, error) {
 	return h.get(h.repobase, elemspec)
 }
 
-func (h *TypeHandler) filterVersions(vers []string) []string {
+func (h *TypeHandler) filterVersions(vers []string) ([]string, error) {
 	if len(h.constraints) == 0 && !h.latest {
-		return vers
+		return vers, nil
+	}
+	versions, err := semverutils.MatchVersionStrings(vers, h.constraints...)
+	if err != nil {
+		return nil, fmt.Errorf("invalid constraints: %v", err)
 	}
-	versions, _ := semverutils.MatchVersionStrings(vers, h.constraints...)
 	if h.latest && len(versions) > 1 {
 		versions = versions[len(versions)-1:]
 	}
@@ -143,7 +146,7 @@ func (h *TypeHandler) filterVersions(vers []string) []string {
 	for _, v := range versions {
 		vers = append(vers, v.Original())
 	}
-	return vers
+	return vers, nil
 }
 
 func (h *TypeHandler) get(repo ocm.Repository, elemspec utils.ElemSpec) ([]output.Object, error) {
@@ -228,7 +231,10 @@ func (h *TypeHandler) get(repo ocm.Repository, elemspec utils.ElemSpec) ([]outpu
 			if err != nil {
 				return nil, err
 			}
-			versions = h.filterVersions(versions)
+			versions, err = h.filterVersions(versions)
+			if err != nil {
+				return nil, err
+			}
 
 			for _, vers := range versions {
 				v, err := h.session.GetComponentVersion(component, vers)
diff --git a/cmds/ocm/commands/ocmcmds/common/handlers/vershdlr/typehandler.go b/cmds/ocm/commands/ocmcmds/common/handlers/vershdlr/typehandler.go
index b3ec2de9ba..23aaf66bcb 100644
--- a/cmds/ocm/commands/ocmcmds/common/handlers/vershdlr/typehandler.go
+++ b/cmds/ocm/commands/ocmcmds/common/handlers/vershdlr/typehandler.go
@@ -111,11 +111,14 @@ func (h *TypeHandler) Get(elemspec utils.ElemSpec) ([]output.Object, error) {
 	return h.get(h.repobase, elemspec)
 }
 
-func (h *TypeHandler) filterVersions(vers []string) []string {
+func (h *TypeHandler) filterVersions(vers []string) ([]string, error) {
 	if len(h.constraints) == 0 && !h.latest {
-		return vers
+		return vers, nil
+	}
+	versions, err := semverutils.MatchVersionStrings(vers, h.constraints...)
+	if err != nil {
+		return nil, err
 	}
-	versions, _ := semverutils.MatchVersionStrings(vers, h.constraints...)
 	if h.latest && len(versions) > 1 {
 		versions = versions[len(versions)-1:]
 	}
@@ -123,7 +126,7 @@ func (h *TypeHandler) filterVersions(vers []string) []string {
 	for _, v := range versions {
 		vers = append(vers, v.Original())
 	}
-	return vers
+	return vers, nil
 }
 
 func (h *TypeHandler) get(repo ocm.Repository, elemspec utils.ElemSpec) ([]output.Object, error) {
@@ -215,7 +218,10 @@ func (h *TypeHandler) get(repo ocm.Repository, elemspec utils.ElemSpec) ([]outpu
 			if err != nil {
 				return nil, err
 			}
-			versions = h.filterVersions(versions)
+			versions, err = h.filterVersions(versions)
+			if err != nil {
+				return nil, err
+			}
 
 			for _, vers := range versions {
 				t := vers
diff --git a/cmds/ocm/commands/ocmcmds/common/options/fileoption/option.go b/cmds/ocm/commands/ocmcmds/common/options/fileoption/option.go
index fc2d817fc7..896ec3f513 100644
--- a/cmds/ocm/commands/ocmcmds/common/options/fileoption/option.go
+++ b/cmds/ocm/commands/ocmcmds/common/options/fileoption/option.go
@@ -62,6 +62,7 @@ func (o *Option) GetPath(args []string, fss ...vfs.FileSystem) (string, []string
 	if ok, err := vfs.Exists(fs, args[0]); !ok || err != nil {
 		return o.Path, args
 	}
+	// ignored: I can't rewrite this whole segment.
 	if ok, _ := vfs.IsDir(fs, args[0]); ok {
 		return args[0], args[1:]
 	}
diff --git a/cmds/ocm/commands/ocmcmds/common/resources.go b/cmds/ocm/commands/ocmcmds/common/resources.go
index ffe97068a5..a3be5aa9cd 100644
--- a/cmds/ocm/commands/ocmcmds/common/resources.go
+++ b/cmds/ocm/commands/ocmcmds/common/resources.go
@@ -358,7 +358,7 @@ func (a *ContentResourceSpecificationsProvider) Get() (string, error) {
 	}
 
 	//nolint:errchkjson // We don't care about this error.
-	r, _ := json.Marshal(data)
+	r, err := json.Marshal(data)
 	return string(r), nil
 }
 
diff --git a/cmds/ocm/commands/ocmcmds/plugins/describe/describe.go b/cmds/ocm/commands/ocmcmds/plugins/describe/describe.go
index b43f55cfe9..322b2094c3 100644
--- a/cmds/ocm/commands/ocmcmds/plugins/describe/describe.go
+++ b/cmds/ocm/commands/ocmcmds/plugins/describe/describe.go
@@ -30,7 +30,12 @@ func DescribePlugin(p plugin.Plugin, out common.Printer) {
 		out.Printf("  Version:         %s\n", src.Version)
 		out.Printf("  Resource:        %s\n", src.Resource)
 		u := src.Repository.AsUniformSpec(p.Context())
-		data, _ := json.Marshal(src.Repository)
+		data, err := json.Marshal(src.Repository)
+		if err != nil {
+			out.Printf("Status:           %s\n", err)
+
+			return
+		}
 		out.Printf("  Repository:      %s\n", u.String())
 		out.Printf("    Specification: %s\n", string(data))
 	} else {
diff --git a/cmds/ocm/commands/toicmds/package/bootstrap/cmd.go b/cmds/ocm/commands/toicmds/package/bootstrap/cmd.go
index 6af818daf6..3f5c83c0d0 100644
--- a/cmds/ocm/commands/toicmds/package/bootstrap/cmd.go
+++ b/cmds/ocm/commands/toicmds/package/bootstrap/cmd.go
@@ -189,7 +189,12 @@ func (o *Command) Complete(args []string) error {
 		return errors.Wrapf(err, "bootstrap resource identity pattern")
 	}
 	if len(o.CredentialsFile) == 0 {
-		if ok, _ := vfs.FileExists(o.FileSystem(), DEFAULT_CREDENTIALS_FILE); ok {
+		ok, err := vfs.FileExists(o.FileSystem(), DEFAULT_CREDENTIALS_FILE)
+		if err != nil {
+			return err
+		}
+
+		if ok {
 			o.CredentialsFile = DEFAULT_CREDENTIALS_FILE
 		}
 	}
diff --git a/cmds/ocm/topics/common/attributes/topic.go b/cmds/ocm/topics/common/attributes/topic.go
index b6974506eb..0e71b2dd2d 100644
--- a/cmds/ocm/topics/common/attributes/topic.go
+++ b/cmds/ocm/topics/common/attributes/topic.go
@@ -34,7 +34,11 @@ func Attributes() string {
 	s := ""
 	sep := ""
 	for _, a := range datacontext.DefaultAttributeScheme.KnownTypeNames() {
-		t, _ := datacontext.DefaultAttributeScheme.GetType(a)
+		t, err := datacontext.DefaultAttributeScheme.GetType(a)
+		if err != nil {
+			continue
+		}
+
 		desc := t.Description()
 		if !strings.Contains(desc, "not via command line") {
 			for strings.HasPrefix(desc, "\n") {
diff --git a/pkg/contexts/oci/artdesc/artifact.go b/pkg/contexts/oci/artdesc/artifact.go
index b9151d0e92..3310239358 100644
--- a/pkg/contexts/oci/artdesc/artifact.go
+++ b/pkg/contexts/oci/artdesc/artifact.go
@@ -235,7 +235,10 @@ func (d *Artifact) ToBlobAccess() (blobaccess.BlobAccess, error) {
 
 func (d *Artifact) GetBlobDescriptor(digest digest.Digest) *Descriptor {
 	if d.IsManifest() {
-		m, _ := d.Manifest()
+		m, err := d.Manifest()
+		if err != nil {
+			return nil
+		}
 		return m.GetBlobDescriptor(digest)
 	}
 	if d.IsIndex() {
diff --git a/pkg/contexts/ocm/accessmethods/npm/method.go b/pkg/contexts/ocm/accessmethods/npm/method.go
index 7698cd9920..d54b5579b2 100644
--- a/pkg/contexts/ocm/accessmethods/npm/method.go
+++ b/pkg/contexts/ocm/accessmethods/npm/method.go
@@ -88,7 +88,10 @@ func (a *AccessSpec) AccessMethod(c accspeccpi.ComponentVersionAccess) (accspecc
 }
 
 func (a *AccessSpec) GetInexpensiveContentVersionIdentity(access accspeccpi.ComponentVersionAccess) string {
-	meta, _ := a.getPackageMeta(access.GetContext())
+	meta, err := a.getPackageMeta(access.GetContext())
+	if err != nil {
+		return ""
+	}
 	if meta != nil {
 		return meta.Dist.Shasum
 	}
diff --git a/pkg/contexts/ocm/attrs/ociuploadattr/attr.go b/pkg/contexts/ocm/attrs/ociuploadattr/attr.go
index e6523f1f9c..1d93d6e850 100644
--- a/pkg/contexts/ocm/attrs/ociuploadattr/attr.go
+++ b/pkg/contexts/ocm/attrs/ociuploadattr/attr.go
@@ -127,7 +127,10 @@ func (a *Attribute) GetInfo(ctx cpi.Context) (oci.Repository, *oci.UniformReposi
 }
 
 func (a *Attribute) getBySpec(ctx cpi.Context) (oci.Repository, *oci.UniformRepositorySpec, string, error) {
-	data, _ := a.Repository.MarshalJSON()
+	data, err := a.Repository.MarshalJSON()
+	if err != nil {
+		return nil, nil, "", errors.Wrap(err, a.ref.String())
+	}
 
 	spec, err := a.Repository.Evaluate(ctx.OCIContext())
 	if err != nil {
diff --git a/pkg/contexts/ocm/attrs/plugindirattr/attr.go b/pkg/contexts/ocm/attrs/plugindirattr/attr.go
index d33a758993..1b2615fa89 100644
--- a/pkg/contexts/ocm/attrs/plugindirattr/attr.go
+++ b/pkg/contexts/ocm/attrs/plugindirattr/attr.go
@@ -26,7 +26,11 @@ func init() {
 }
 
 func DefaultDir(fs vfs.FileSystem) string {
-	home, _ := os.UserHomeDir()
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return ""
+	}
+
 	if home != "" {
 		dir := filepath.Join(home, DEFAULT_PLUGIN_DIR)
 		if ok, err := vfs.DirExists(fs, dir); ok && err == nil {
diff --git a/pkg/contexts/ocm/blobhandler/handlers/generic/npm/publish.go b/pkg/contexts/ocm/blobhandler/handlers/generic/npm/publish.go
index cb5058e662..75f7a7b3fe 100644
--- a/pkg/contexts/ocm/blobhandler/handlers/generic/npm/publish.go
+++ b/pkg/contexts/ocm/blobhandler/handlers/generic/npm/publish.go
@@ -89,8 +89,7 @@ func login(registry string, username string, password string, email string) (str
 	var token struct {
 		Token string `json:"token"`
 	}
-	err = json.NewDecoder(resp.Body).Decode(&token)
-	if err != nil {
+	if err := json.NewDecoder(resp.Body).Decode(&token); err != nil {
 		return "", err
 	}
 	return token.Token, nil
diff --git a/pkg/contexts/ocm/plugin/cache/plugindir.go b/pkg/contexts/ocm/plugin/cache/plugindir.go
index e3d341b47d..ec74289e1b 100644
--- a/pkg/contexts/ocm/plugin/cache/plugindir.go
+++ b/pkg/contexts/ocm/plugin/cache/plugindir.go
@@ -58,7 +58,12 @@ func (c *pluginDirImpl) Get(name string) Plugin {
 func (c *pluginDirImpl) add(name string, desc *descriptor.Descriptor, path string, errmsg string, list *errors.ErrorList) {
 	c.plugins[name] = NewPlugin(name, path, desc, errmsg)
 	if path != "" {
-		src, _ := ReadPluginSource(filepath.Dir(path), filepath.Base(path))
+		src, err := ReadPluginSource(filepath.Dir(path), filepath.Base(path))
+		if err != nil && list != nil {
+			list.Add(fmt.Errorf("%s: %s", name, err.Error()))
+			return
+		}
+
 		c.plugins[name].source = src
 	}
 	if errmsg != "" && list != nil {
diff --git a/pkg/contexts/ocm/plugin/cache/updater.go b/pkg/contexts/ocm/plugin/cache/updater.go
index 198970187a..e196517d30 100644
--- a/pkg/contexts/ocm/plugin/cache/updater.go
+++ b/pkg/contexts/ocm/plugin/cache/updater.go
@@ -161,7 +161,10 @@ func (o *PluginUpdater) downloadLatest(session ocm.Session, comp ocm.ComponentAc
 		return errors.Wrapf(err, "no versions found for component %s", comp.GetName())
 	}
 
-	versions, _ := semverutils.MatchVersionStrings(vers, o.Constraints...)
+	versions, err := semverutils.MatchVersionStrings(vers, o.Constraints...)
+	if err != nil {
+		return fmt.Errorf("failed to match version strings for component %s: %w", comp.GetName(), err)
+	}
 	if len(versions) == 0 {
 		return fmt.Errorf("no versions for component %s match the constraints", comp.GetName())
 	}
diff --git a/pkg/contexts/ocm/repositories/comparch/componentarchive.go b/pkg/contexts/ocm/repositories/comparch/componentarchive.go
index 42eaa96fa0..56f0f5aa23 100644
--- a/pkg/contexts/ocm/repositories/comparch/componentarchive.go
+++ b/pkg/contexts/ocm/repositories/comparch/componentarchive.go
@@ -217,7 +217,10 @@ func (c *componentArchiveContainer) GetInexpensiveContentVersionIdentity(a cpi.A
 			return ""
 		}
 		defer m.Close()
-		digest, _ := blobaccess.Digest(m)
+		digest, err := blobaccess.Digest(m)
+		if err != nil {
+			return ""
+		}
 		return digest.String()
 	}
 	return ""
diff --git a/pkg/contexts/ocm/repositories/comparch/repository.go b/pkg/contexts/ocm/repositories/comparch/repository.go
index c99c9c0d98..5dc9262c4d 100644
--- a/pkg/contexts/ocm/repositories/comparch/repository.go
+++ b/pkg/contexts/ocm/repositories/comparch/repository.go
@@ -326,7 +326,10 @@ func (c *ComponentVersionContainer) GetInexpensiveContentVersionIdentity(a cpi.A
 			return ""
 		}
 		defer m.Close()
-		digest, _ := blobaccess.Digest(m)
+		digest, err := blobaccess.Digest(m)
+		if err != nil {
+			return ""
+		}
 		return digest.String()
 	}
 	return ""
diff --git a/pkg/contexts/ocm/repositories/genericocireg/componentversion.go b/pkg/contexts/ocm/repositories/genericocireg/componentversion.go
index 322b8726b9..394e3041b2 100644
--- a/pkg/contexts/ocm/repositories/genericocireg/componentversion.go
+++ b/pkg/contexts/ocm/repositories/genericocireg/componentversion.go
@@ -151,13 +151,15 @@ func (c *ComponentVersionContainer) GetInexpensiveContentVersionIdentity(a cpi.A
 	}
 
 	switch a.GetKind() {
-	case localblob.Type:
-		return accessSpec.(*localblob.AccessSpec).LocalReference
-	case localociblob.Type:
-		return accessSpec.(*localblob.AccessSpec).LocalReference
+	case localblob.Type, localociblob.Type:
+		if spec, ok := accessSpec.(*localblob.AccessSpec); ok {
+			return spec.LocalReference
+		}
 	case relativeociref.Type:
-		d, _ := accessSpec.(*relativeociref.AccessSpec).GetDigest()
-		return d
+		if spec, ok := accessSpec.(*relativeociref.AccessSpec); ok {
+			d, _ := spec.GetDigest()
+			return d
+		}
 	}
 
 	return ""
diff --git a/pkg/mimeutils/type.go b/pkg/mimeutils/type.go
index cbd4c8bad1..080e7f1aab 100644
--- a/pkg/mimeutils/type.go
+++ b/pkg/mimeutils/type.go
@@ -140,8 +140,7 @@ func TypeByExtension(ext string) string {
 		if c >= utf8RuneSelf {
 			// Slow path.
 			si, _ := mimeTypesLower.Load(strings.ToLower(ext))
-			s, _ := si.(string)
-			return s
+			return si.(string)
 		}
 		if 'A' <= c && c <= 'Z' {
 			lower = append(lower, c+('a'-'A'))
@@ -150,8 +149,7 @@ func TypeByExtension(ext string) string {
 		}
 	}
 	si, _ := mimeTypesLower.Load(string(lower))
-	s, _ := si.(string)
-	return s
+	return si.(string)
 }
 
 // ExtensionsByType returns the extensions known to be associated with the MIME
diff --git a/pkg/toi/support/support.go b/pkg/toi/support/support.go
index df2bb2ad16..57cad73f35 100644
--- a/pkg/toi/support/support.go
+++ b/pkg/toi/support/support.go
@@ -99,7 +99,10 @@ func (o *ExecutorOptions) Complete() error {
 	}
 
 	if o.OCMConfig == "" {
-		cfg, _ := utils2.ResolvePath(o.Inputs + "/" + install.InputOCMConfig)
+		cfg, err := utils2.ResolvePath(o.Inputs + "/" + install.InputOCMConfig)
+		if err != nil {
+			return errors.Wrapf(err, "cannot resolve OCM config %q", o.Inputs)
+		}
 		if ok, err := vfs.FileExists(o.FileSystem(), cfg); ok && err == nil {
 			o.OCMConfig = cfg
 		}
@@ -111,7 +114,10 @@ func (o *ExecutorOptions) Complete() error {
 	}
 
 	if o.Parameters == "" {
-		p, _ := utils2.ResolvePath(o.Inputs + "/" + install.InputParameters)
+		p, err := utils2.ResolvePath(o.Inputs + "/" + install.InputParameters)
+		if err != nil {
+			return errors.Wrapf(err, "cannot resolve path %q", o.Inputs)
+		}
 		if ok, err := vfs.FileExists(o.FileSystem(), p); ok && err == nil {
 			o.Parameters = p
 		}