diff --git a/.golangci.yml b/.golangci.yml
index fa27f5819..e2bd21f48 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -49,6 +49,8 @@ linters:
     - misspell
     - ineffassign
     - deadcode
+    - staticcheck
+    - unused
 
 run:
   skip-dirs:
@@ -56,12 +58,12 @@ run:
 
 issues:
   exclude:
-    - can't lint
     - declaration of "err" shadows declaration at line
     - should have a package comment, unless it's in another file for this package
+    - func `CLICommand.
 # golangci.com configuration
 # https://github.com/golangci/golangci/wiki/Configuration
 service:
-  golangci-lint-version: 1.17.x # use the fixed version to not introduce new linters unexpectedly
+  golangci-lint-version: 1.18.x # use the fixed version to not introduce new linters unexpectedly
   prepare:
     - echo "here I can run custom commands, but no preparation needed for this repo"
diff --git a/command/crypto/jwe/decrypt.go b/command/crypto/jwe/decrypt.go
index f4a78db0b..33e0e516f 100644
--- a/command/crypto/jwe/decrypt.go
+++ b/command/crypto/jwe/decrypt.go
@@ -141,7 +141,7 @@ func decryptAction(ctx *cli.Context) error {
 		return errors.Wrap(err, "error decrypting data")
 	}
 
-	fmt.Printf(string(decrypted))
+	fmt.Print(string(decrypted))
 
 	return nil
 }
diff --git a/crypto/x509util/convert.go b/crypto/x509util/convert.go
index 5188c9a10..aed6adb13 100644
--- a/crypto/x509util/convert.go
+++ b/crypto/x509util/convert.go
@@ -170,7 +170,6 @@ func ToStepX509CertificateRequest(csr *x509.CertificateRequest) *stepx509.Certif
 		PublicKeyAlgorithm:       stepx509.PublicKeyAlgorithm(csr.PublicKeyAlgorithm),
 		PublicKey:                csr.PublicKey,
 		Subject:                  csr.Subject,
-		Attributes:               csr.Attributes,
 		Extensions:               csr.Extensions,
 		ExtraExtensions:          csr.ExtraExtensions,
 		DNSNames:                 csr.DNSNames,
@@ -194,7 +193,6 @@ func ToX509CertificateRequest(csr *stepx509.CertificateRequest) *x509.Certificat
 		PublicKeyAlgorithm:       x509.PublicKeyAlgorithm(csr.PublicKeyAlgorithm),
 		PublicKey:                csr.PublicKey,
 		Subject:                  csr.Subject,
-		Attributes:               csr.Attributes,
 		Extensions:               csr.Extensions,
 		ExtraExtensions:          csr.ExtraExtensions,
 		DNSNames:                 csr.DNSNames,
diff --git a/make/common.mk b/make/common.mk
index 933b63b8c..788c98b8f 100644
--- a/make/common.mk
+++ b/make/common.mk
@@ -101,10 +101,13 @@ integration: bin/$(BINNAME)
 # Linting
 #########################################
 
+fmt:
+	$Q gofmt -l -w $(SRC)
+
 lint:
 	$Q LOG_LEVEL=error golangci-lint run
 
-.PHONY: lint
+.PHONY: fmt lint
 
 #########################################
 # Install
diff --git a/pkg/x509/name_constraints_test.go b/pkg/x509/name_constraints_test.go
index e89e70d87..95d55fd76 100644
--- a/pkg/x509/name_constraints_test.go
+++ b/pkg/x509/name_constraints_test.go
@@ -1595,7 +1595,7 @@ func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.
 		NotAfter:              time.Unix(2000, 0),
 		KeyUsage:              KeyUsageCertSign,
 		BasicConstraintsValid: true,
-		IsCA: true,
+		IsCA:                  true,
 	}
 
 	if err := addConstraintsToTemplate(constraints, template); err != nil {
@@ -1633,7 +1633,7 @@ func makeConstraintsLeafCert(leaf leafSpec, key *ecdsa.PrivateKey, parent *Certi
 		NotAfter:              time.Unix(2000, 0),
 		KeyUsage:              KeyUsageDigitalSignature,
 		BasicConstraintsValid: true,
-		IsCA: false,
+		IsCA:                  false,
 	}
 
 	for _, name := range leaf.sans {
diff --git a/pkg/x509/x509_test.go b/pkg/x509/x509_test.go
index 9eb1d2045..49322da93 100644
--- a/pkg/x509/x509_test.go
+++ b/pkg/x509/x509_test.go
@@ -569,7 +569,7 @@ func TestCreateSelfSignedCertificate(t *testing.T) {
 			UnknownExtKeyUsage: testUnknownExtKeyUsage,
 
 			BasicConstraintsValid: true,
-			IsCA: true,
+			IsCA:                  true,
 
 			OCSPServer:            []string{"http://ocsp.example.com"},
 			IssuingCertificateURL: []string{"http://crt.example.com/ca1.crt"},
@@ -1474,7 +1474,7 @@ func TestMaxPathLen(t *testing.T) {
 		NotAfter:  time.Unix(100000, 0),
 
 		BasicConstraintsValid: true,
-		IsCA: true,
+		IsCA:                  true,
 	}
 
 	cert1 := serialiseAndParse(t, template)
@@ -1515,8 +1515,8 @@ func TestNoAuthorityKeyIdInSelfSignedCert(t *testing.T) {
 		NotAfter:  time.Unix(100000, 0),
 
 		BasicConstraintsValid: true,
-		IsCA:         true,
-		SubjectKeyId: []byte{1, 2, 3, 4},
+		IsCA:                  true,
+		SubjectKeyId:          []byte{1, 2, 3, 4},
 	}
 
 	if cert := serialiseAndParse(t, template); len(cert.AuthorityKeyId) != 0 {
diff --git a/usage/renderer.go b/usage/renderer.go
index 5073855a4..5fe51f79f 100644
--- a/usage/renderer.go
+++ b/usage/renderer.go
@@ -38,6 +38,7 @@ type list struct {
 	parent *list
 }
 
+/* TODO: commented because unused
 func (l *list) isUnordered() bool {
 	return !l.isOrdered() && !l.isDefinition()
 }
@@ -46,15 +47,16 @@ func (l *list) isOrdered() bool {
 	return l.flags&md.ListTypeOrdered != 0
 }
 
-func (l *list) isDefinition() bool {
-	return l.flags&md.ListTypeDefinition != 0
-}
-
 func (l *list) containsBlock() bool {
 	// TODO: Not sure if we have to check every item or if it gets
 	// automatically set on the list?
 	return l.flags&md.ListItemContainsBlock != 0
 }
+*/
+
+func (l *list) isDefinition() bool {
+	return l.flags&md.ListTypeDefinition != 0
+}
 
 type bufqueue struct {
 	w    io.Writer
@@ -105,9 +107,11 @@ func (r *Renderer) inParagraph() bool {
 	return r.inpara
 }
 
+/* TODO: commented because unused
 func (r *Renderer) inList() bool {
 	return r.list != nil
 }
+*/
 
 func (r *Renderer) renderParagraphKeepBreaks(buf *bytes.Buffer) {
 	scanner := bufio.NewScanner(buf)