More clang-tidy fixes

48 files changed, 281 insertions, 185 deletions

diff --git a/src/cli/cli.cpp b/src/cli/cli.cpp
index 6f945a9e7..942806868 100644
--- a/src/cli/cli.cpp
+++ b/src/cli/cli.cpp
@@ -215,9 +215,10 @@ void Command::read_file(const std::string& input_file,
       }
    }
 
+//static
 void Command::do_read_file(std::istream& in,
                            const std::function<void (uint8_t[], size_t)>& consumer_fn,
-                           size_t buf_size) const
+                           size_t buf_size)
    {
    // Avoid an infinite loop on --buf-size=0
    std::vector<uint8_t> buf(buf_size == 0 ? 4096 : buf_size);
diff --git a/src/cli/cli.h b/src/cli/cli.h
index 69ba3d48f..d7fe5013f 100644
--- a/src/cli/cli.h
+++ b/src/cli/cli.h
@@ -171,9 +171,9 @@ class Command
                      size_t buf_size = 0) const;
 
 
-      void do_read_file(std::istream& in,
-                        const std::function<void (uint8_t[], size_t)>& consumer_fn,
-                        size_t buf_size = 0) const;
+      static void do_read_file(std::istream& in,
+                               const std::function<void (uint8_t[], size_t)>& consumer_fn,
+                               size_t buf_size = 0);
 
       template<typename Alloc>
       void write_output(const std::vector<uint8_t, Alloc>& vec)
diff --git a/src/cli/timing_tests.cpp b/src/cli/timing_tests.cpp
index a7d71ab69..8c8c6e6ed 100644
--- a/src/cli/timing_tests.cpp
+++ b/src/cli/timing_tests.cpp
@@ -75,6 +75,11 @@ class Timing_Test
 
       virtual ~Timing_Test() = default;
 
+      Timing_Test(const Timing_Test& other) = delete;
+      Timing_Test(Timing_Test&& other) = delete;
+      Timing_Test& operator=(const Timing_Test& other) = delete;
+      Timing_Test& operator=(Timing_Test&& other) = delete;
+
       std::vector<std::vector<ticks>> execute_evaluation(
                                       const std::vector<std::string>& inputs,
                                       size_t warmup_runs,
@@ -109,7 +114,7 @@ class Timing_Test
 class Bleichenbacker_Timing_Test final : public Timing_Test
    {
    public:
-      Bleichenbacker_Timing_Test(size_t keysize)
+      explicit Bleichenbacker_Timing_Test(size_t keysize)
          : m_privkey(timing_test_rng(), keysize)
          , m_pubkey(m_privkey)
          , m_enc(m_pubkey, timing_test_rng(), "Raw")
@@ -152,7 +157,7 @@ class Bleichenbacker_Timing_Test final : public Timing_Test
 class Manger_Timing_Test final : public Timing_Test
    {
    public:
-      Manger_Timing_Test(size_t keysize)
+      explicit Manger_Timing_Test(size_t keysize)
          : m_privkey(timing_test_rng(), keysize)
          , m_pubkey(m_privkey)
          , m_enc(m_pubkey, timing_test_rng(), m_encrypt_padding)
@@ -260,7 +265,7 @@ ticks Lucky13_Timing_Test::measure_critical_function(const std::vector<uint8_t>&
 class ECDSA_Timing_Test final : public Timing_Test
    {
    public:
-      ECDSA_Timing_Test(const std::string& ecgroup);
+      explicit ECDSA_Timing_Test(const std::string& ecgroup);
 
       ticks measure_critical_function(const std::vector<uint8_t>& input) override;
 
@@ -315,7 +320,7 @@ ticks ECDSA_Timing_Test::measure_critical_function(const std::vector<uint8_t>& i
 class ECC_Mul_Timing_Test final : public Timing_Test
    {
    public:
-      ECC_Mul_Timing_Test(const std::string& ecgroup) :
+      explicit ECC_Mul_Timing_Test(const std::string& ecgroup) :
          m_group(ecgroup)
          {}
 
@@ -346,7 +351,7 @@ ticks ECC_Mul_Timing_Test::measure_critical_function(const std::vector<uint8_t>&
 class Powmod_Timing_Test final : public Timing_Test
    {
    public:
-      Powmod_Timing_Test(const std::string& dl_group) : m_group(dl_group)
+      explicit Powmod_Timing_Test(const std::string& dl_group) : m_group(dl_group)
          {
          }
 
@@ -376,7 +381,7 @@ ticks Powmod_Timing_Test::measure_critical_function(const std::vector<uint8_t>&
 class Invmod_Timing_Test final : public Timing_Test
    {
    public:
-      Invmod_Timing_Test(size_t p_bits)
+      explicit Invmod_Timing_Test(size_t p_bits)
          {
          m_p = Botan::random_prime(timing_test_rng(), p_bits);
          }
diff --git a/src/cli/tls_client.cpp b/src/cli/tls_client.cpp
index ef355fb74..74c9837ef 100644
--- a/src/cli/tls_client.cpp
+++ b/src/cli/tls_client.cpp
@@ -40,11 +40,16 @@ class TLS_Client final : public Command, public Botan::TLS::Callbacks
          init_sockets();
          }
 
-      ~TLS_Client()
+      ~TLS_Client() override
          {
          stop_sockets();
          }
 
+      TLS_Client(const TLS_Client& other) = delete;
+      TLS_Client(TLS_Client&& other) = delete;
+      TLS_Client& operator=(const TLS_Client& other) = delete;
+      TLS_Client& operator=(TLS_Client&& other) = delete;
+
       std::string group() const override
          {
          return "tls";
diff --git a/src/cli/tls_server.cpp b/src/cli/tls_server.cpp
index 6f02723ac..7277b96f2 100644
--- a/src/cli/tls_server.cpp
+++ b/src/cli/tls_server.cpp
@@ -52,11 +52,16 @@ class TLS_Server final : public Command, public Botan::TLS::Callbacks
          init_sockets();
          }
 
-      ~TLS_Server()
+      ~TLS_Server() override
          {
          stop_sockets();
          }
 
+      TLS_Server(const TLS_Server& other) = delete;
+      TLS_Server(TLS_Server&& other) = delete;
+      TLS_Server& operator=(const TLS_Server& other) = delete;
+      TLS_Server& operator=(TLS_Server&& other) = delete;
+
       std::string group() const override
          {
          return "tls";
diff --git a/src/cli/zfec.cpp b/src/cli/zfec.cpp
index ad37d95d0..582a9692c 100644
--- a/src/cli/zfec.cpp
+++ b/src/cli/zfec.cpp
@@ -19,7 +19,7 @@ namespace Botan_CLI {
 #if defined(BOTAN_HAS_ZFEC) && defined(BOTAN_HAS_SHA2_64)
 
 static const uint32_t FEC_MAGIC = 0xFECC0DEC;
-const char* FEC_SHARE_HASH = "SHA-512-256";
+const char* const FEC_SHARE_HASH = "SHA-512-256";
 
 class FEC_Share final
    {
diff --git a/src/lib/block/gost_28147/gost_28147.cpp b/src/lib/block/gost_28147/gost_28147.cpp
index 6b4bc24f7..86e59d256 100644
--- a/src/lib/block/gost_28147/gost_28147.cpp
+++ b/src/lib/block/gost_28147/gost_28147.cpp
@@ -58,7 +58,9 @@ GOST_28147_89_Params::GOST_28147_89_Params(const std::string& n) : m_name(n)
 /*
 * GOST Constructor
 */
-GOST_28147_89::GOST_28147_89(const GOST_28147_89_Params& param) : m_SBOX(1024)
+GOST_28147_89::GOST_28147_89(const GOST_28147_89_Params& param) :
+   m_SBOX(1024),
+   m_name("GOST-28147-89(" + param.param_name() + ")")
    {
    // Convert the parallel 4x4 sboxes into larger word-based sboxes
 
@@ -73,21 +75,7 @@ GOST_28147_89::GOST_28147_89(const GOST_28147_89_Params& param) : m_SBOX(1024)
 
 std::string GOST_28147_89::name() const
    {
-   /*
-   'Guess' the right name for the sbox on the basis of the values.
-   This would need to be updated if support for other sbox parameters
-   is added. Preferably, we would just store the string value in the
-   constructor, but can't break binary compat.
-   */
-   std::string sbox_name = "";
-   if(m_SBOX[0] == 0x00072000)
-      sbox_name = "R3411_94_TestParam";
-   else if(m_SBOX[0] == 0x0002D000)
-      sbox_name = "R3411_CryptoPro";
-   else
-      throw Internal_Error("GOST-28147 unrecognized sbox value");
-
-   return "GOST-28147-89(" + sbox_name + ")";
+   return m_name;
    }
 
 namespace {
diff --git a/src/lib/block/gost_28147/gost_28147.h b/src/lib/block/gost_28147/gost_28147.h
index 12f1ab8a6..fcb4a890f 100644
--- a/src/lib/block/gost_28147/gost_28147.h
+++ b/src/lib/block/gost_28147/gost_28147.h
@@ -64,7 +64,10 @@ class GOST_28147_89 final : public Block_Cipher_Fixed_Params<8, 32>
       void clear() override;
 
       std::string name() const override;
-      std::unique_ptr<BlockCipher> new_object() const override { return std::make_unique<GOST_28147_89>(m_SBOX); }
+      std::unique_ptr<BlockCipher> new_object() const override
+         {
+         return std::make_unique<GOST_28147_89>(m_SBOX, m_name);
+         }
 
       /**
       * @param params the sbox parameters to use
@@ -74,8 +77,9 @@ class GOST_28147_89 final : public Block_Cipher_Fixed_Params<8, 32>
       explicit GOST_28147_89(const std::string& param_name) :
          GOST_28147_89(GOST_28147_89_Params(param_name)) {}
 
-      explicit GOST_28147_89(const std::vector<uint32_t>& other_SBOX) :
-         m_SBOX(other_SBOX), m_EK(8) {}
+      explicit GOST_28147_89(const std::vector<uint32_t>& other_SBOX,
+                             const std::string& name) :
+         m_SBOX(other_SBOX), m_EK(8), m_name(name) {}
 
    private:
       void key_schedule(const uint8_t[], size_t) override;
@@ -85,8 +89,8 @@ class GOST_28147_89 final : public Block_Cipher_Fixed_Params<8, 32>
       * which we generate at runtime for faster execution
       */
       std::vector<uint32_t> m_SBOX;
-
       secure_vector<uint32_t> m_EK;
+      std::string m_name;
    };
 
 }
diff --git a/src/lib/ffi/ffi_rng.cpp b/src/lib/ffi/ffi_rng.cpp
index aaf718aee..4a1cb52c7 100644
--- a/src/lib/ffi/ffi_rng.cpp
+++ b/src/lib/ffi/ffi_rng.cpp
@@ -14,7 +14,7 @@
 #include <functional>
 
 #if defined(BOTAN_HAS_PROCESSOR_RNG)
-   #include <botan/processor_rng.h>
+#include <botan/processor_rng.h>
 #endif
 
 extern "C" {
@@ -24,48 +24,48 @@ using namespace Botan_FFI;
 int botan_rng_init(botan_rng_t* rng_out, const char* rng_type)
    {
    return ffi_guard_thunk(__func__, [=]() -> int {
-      if(rng_out == nullptr)
-         return BOTAN_FFI_ERROR_NULL_POINTER;
-
-      const std::string rng_type_s(rng_type ? rng_type : "system");
-
-      std::unique_ptr<Botan::RandomNumberGenerator> rng;
-
-      if(rng_type_s == "system")
-         {
-         rng.reset(new Botan::System_RNG);
-         }
-      else if(rng_type_s == "user" || rng_type_s == "user-threadsafe")
-         {
-         rng.reset(new Botan::AutoSeeded_RNG);
-         }
-      else if(rng_type_s == "null")
-         {
-         rng.reset(new Botan::Null_RNG);
-         }
+   if(rng_out == nullptr)
+      return BOTAN_FFI_ERROR_NULL_POINTER;
+
+   const std::string rng_type_s(rng_type ? rng_type : "system");
+
+   std::unique_ptr<Botan::RandomNumberGenerator> rng;
+
+   if(rng_type_s == "system")
+      {
+      rng.reset(new Botan::System_RNG);
+      }
+   else if(rng_type_s == "user" || rng_type_s == "user-threadsafe")
+      {
+      rng.reset(new Botan::AutoSeeded_RNG);
+      }
+   else if(rng_type_s == "null")
+      {
+      rng.reset(new Botan::Null_RNG);
+      }
 #if defined(BOTAN_HAS_PROCESSOR_RNG)
-      else if((rng_type_s == "rdrand" || rng_type_s == "hwrng") && Botan::Processor_RNG::available())
-         {
-         rng.reset(new Botan::Processor_RNG);
-         }
+   else if((rng_type_s == "rdrand" || rng_type_s == "hwrng") && Botan::Processor_RNG::available())
+      {
+      rng.reset(new Botan::Processor_RNG);
+      }
 #endif
 
-      if(!rng)
-         {
-         return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
-         }
+   if(!rng)
+      {
+      return BOTAN_FFI_ERROR_NOT_IMPLEMENTED;
+      }
 
-      *rng_out = new botan_rng_struct(std::move(rng));
-      return BOTAN_FFI_SUCCESS;
-      });
+   *rng_out = new botan_rng_struct(std::move(rng));
+   return BOTAN_FFI_SUCCESS;
+   });
    }
 
 int botan_rng_init_custom(botan_rng_t* rng_out, const char* rng_name, void* context,
                           int(* get_cb)(void* context, uint8_t* out, size_t out_len),
                           int(* add_entropy_cb)(void* context, const uint8_t input[], size_t length),
                           void(* destroy_cb)(void* context))
-{
-return ffi_guard_thunk(__func__,[=]() -> int {
+   {
+   return ffi_guard_thunk(__func__,[=]() -> int {
    if(rng_out == nullptr)
       return BOTAN_FFI_ERROR_NULL_POINTER;
 
@@ -84,61 +84,66 @@ return ffi_guard_thunk(__func__,[=]() -> int {
                     void(* destroy_cb)(void* context)) :
             m_name(name)
             {
-               m_context = context;
-               m_get_cb = get_cb;
-               m_add_entropy_cb = add_entropy_cb;
-               m_destroy_cb = destroy_cb;
+            m_context = context;
+            m_get_cb = get_cb;
+            m_add_entropy_cb = add_entropy_cb;
+            m_destroy_cb = destroy_cb;
             }
 
-         ~Custom_RNG()
-         {
-            if(m_destroy_cb)
+         ~Custom_RNG() override
             {
+            if(m_destroy_cb)
+               {
                m_destroy_cb(m_context);
+               }
             }
-         }
+
+         Custom_RNG(const Custom_RNG& other) = delete;
+         Custom_RNG(Custom_RNG&& other) = delete;
+         Custom_RNG& operator=(const Custom_RNG& other) = delete;
+         Custom_RNG& operator=(Custom_RNG&& other) = delete;
 
          void randomize(uint8_t output[], size_t length) override
-         {
+            {
             int rc = m_get_cb(m_context, output, length);
             if(rc)
-            {
+               {
                throw Botan::Invalid_State("Failed to get random from C callback, rc=" + std::to_string(rc));
+               }
             }
-         }
 
          bool accepts_input() const override
-         {
+            {
             return m_add_entropy_cb != nullptr;
-         }
+            }
 
          void add_entropy(const uint8_t input[], size_t length) override
-         {
-            if(m_add_entropy_cb == nullptr)
             {
+            if(m_add_entropy_cb == nullptr)
+               {
                return;
-            }
+               }
 
             int rc = m_add_entropy_cb(m_context, input, length);
             if(rc)
-            {
+               {
                throw Botan::Invalid_State("Failed to add entropy via C callback, rc=" + std::to_string(rc));
+               }
             }
-         }
 
          std::string name() const override
-         {
+            {
             return m_name;
-         }
+            }
 
          void clear() override
-         {
-         }
+            {
+            }
 
          bool is_seeded() const override
-         {
+            {
             return true;
-         }
+            }
 
       private:
          std::string m_name;
@@ -146,14 +151,14 @@ return ffi_guard_thunk(__func__,[=]() -> int {
          std::function<int(void* context, uint8_t* out, size_t out_len)> m_get_cb;
          std::function<int(void* context, const uint8_t input[], size_t length)> m_add_entropy_cb;
          std::function<void(void* context)> m_destroy_cb;
-   };
+      };
 
    std::unique_ptr<Botan::RandomNumberGenerator> rng(new Custom_RNG(rng_name, context, get_cb, add_entropy_cb, destroy_cb));
 
    *rng_out = new botan_rng_struct(std::move(rng));
    return BOTAN_FFI_SUCCESS;
    });
-}
+   }
 
 int botan_rng_destroy(botan_rng_t rng)
    {
diff --git a/src/lib/filters/pipe.h b/src/lib/filters/pipe.h
index a187d2929..9e467f21f 100644
--- a/src/lib/filters/pipe.h
+++ b/src/lib/filters/pipe.h
@@ -231,7 +231,7 @@ class BOTAN_PUBLIC_API(2,0) Pipe final : public DataSource
       size_t get_bytes_read(message_id msg) const;
 
       bool check_available(size_t n) override;
-      bool check_available_msg(size_t n, message_id msg);
+      bool check_available_msg(size_t n, message_id msg) const;
 
       /**
       * @return currently set default message
diff --git a/src/lib/filters/pipe_rw.cpp b/src/lib/filters/pipe_rw.cpp
index dc7b97372..6135d5401 100644
--- a/src/lib/filters/pipe_rw.cpp
+++ b/src/lib/filters/pipe_rw.cpp
@@ -173,7 +173,7 @@ bool Pipe::check_available(size_t n)
    return (n <= remaining(default_msg()));
    }
 
-bool Pipe::check_available_msg(size_t n, message_id msg)
+bool Pipe::check_available_msg(size_t n, message_id msg) const
    {
    return (n <= remaining(msg));
    }
diff --git a/src/lib/filters/secqueue.cpp b/src/lib/filters/secqueue.cpp
index 10fbff20f..d12c6bbfe 100644
--- a/src/lib/filters/secqueue.cpp
+++ b/src/lib/filters/secqueue.cpp
@@ -22,6 +22,11 @@ class SecureQueueNode final
 
       ~SecureQueueNode() { m_next = nullptr; m_start = m_end = 0; }
 
+      SecureQueueNode(const SecureQueueNode& other) = delete;
+      SecureQueueNode(SecureQueueNode&& other) = delete;
+      SecureQueueNode& operator=(const SecureQueueNode& other) = delete;
+      SecureQueueNode& operator=(SecureQueueNode&& other) = delete;
+
       size_t write(const uint8_t input[], size_t length)
          {
          size_t copied = std::min<size_t>(length, m_buffer.size() - m_end);
diff --git a/src/lib/filters/secqueue.h b/src/lib/filters/secqueue.h
index 2046ec1e7..4feb0e267 100644
--- a/src/lib/filters/secqueue.h
+++ b/src/lib/filters/secqueue.h
@@ -47,6 +47,9 @@ class BOTAN_TEST_API SecureQueue final : public Fanout_Filter, public DataSource
       */
       SecureQueue& operator=(const SecureQueue& other);
 
+      SecureQueue& operator=(SecureQueue&& other) = delete;
+      SecureQueue(SecureQueue&& other) = delete;
+
       /**
       * SecureQueue default constructor (creates empty queue)
       */
diff --git a/src/lib/hash/blake2/blake2b.cpp b/src/lib/hash/blake2/blake2b.cpp
index 6a68936f1..939238196 100644
--- a/src/lib/hash/blake2/blake2b.cpp
+++ b/src/lib/hash/blake2/blake2b.cpp
@@ -36,6 +36,8 @@ BLAKE2b::BLAKE2b(size_t output_bits) :
    m_buffer(BLAKE2B_BLOCKBYTES),
    m_bufpos(0),
    m_H(BLAKE2B_IVU64COUNT),
+   m_T(),
+   m_F(),
    m_key_size(0)
    {
    if(output_bits == 0 || output_bits > 512 || output_bits % 8 != 0)
diff --git a/src/lib/misc/zfec/zfec.cpp b/src/lib/misc/zfec/zfec.cpp
index 9e1a623a2..2160d7214 100644
--- a/src/lib/misc/zfec/zfec.cpp
+++ b/src/lib/misc/zfec/zfec.cpp
@@ -148,7 +148,7 @@ void invert_matrix(uint8_t matrix[], size_t K)
    class pivot_searcher
       {
       public:
-         pivot_searcher(size_t K) : m_ipiv(K) {}
+         explicit pivot_searcher(size_t K) : m_ipiv(K) {}
 
          std::pair<size_t, size_t> operator()(size_t col, const uint8_t matrix[])
             {
diff --git a/src/lib/prov/pkcs11/p11.cpp b/src/lib/prov/pkcs11/p11.cpp
index 2347d2f9f..477ff6a55 100644
--- a/src/lib/prov/pkcs11/p11.cpp
+++ b/src/lib/prov/pkcs11/p11.cpp
@@ -513,22 +513,25 @@ bool LowLevel::C_SignInit(SessionHandle session,
    }
 
 bool LowLevel::C_Sign(SessionHandle session,
-                      Byte* data_ptr,
+                      const Byte* data_ptr,
                       Ulong data_len,
                       Byte* signature_ptr,
                       Ulong* signature_len_ptr,
                       ReturnValue* return_value) const
    {
-   return handle_return_value(m_func_list_ptr->C_Sign(session, data_ptr, data_len, signature_ptr, signature_len_ptr),
-                              return_value);
+   return handle_return_value(
+      m_func_list_ptr->C_Sign(session, const_cast<Byte*>(data_ptr), data_len, signature_ptr, signature_len_ptr),
+      return_value);
    }
 
 bool LowLevel::C_SignUpdate(SessionHandle session,
-                            Byte* part_ptr,
+                            const Byte* part_ptr,
                             Ulong part_len,
                             ReturnValue* return_value) const
    {
-   return handle_return_value(m_func_list_ptr->C_SignUpdate(session, part_ptr, part_len), return_value);
+   return handle_return_value(
+      m_func_list_ptr->C_SignUpdate(session, const_cast<Byte*>(part_ptr), part_len),
+      return_value);
    }
 
 bool LowLevel::C_SignFinal(SessionHandle session,
@@ -569,30 +572,36 @@ bool LowLevel::C_VerifyInit(SessionHandle session,
    }
 
 bool LowLevel::C_Verify(SessionHandle session,
-                        Byte* data_ptr,
+                        const Byte* data_ptr,
                         Ulong data_len,
-                        Byte* signature_ptr,
+                        const Byte* signature_ptr,
                         Ulong signature_len,
                         ReturnValue* return_value) const
    {
-   return handle_return_value(m_func_list_ptr->C_Verify(session, data_ptr, data_len, signature_ptr, signature_len),
-                              return_value);
+   return handle_return_value(
+      m_func_list_ptr->C_Verify(session, const_cast<Byte*>(data_ptr), data_len,
+                                const_cast<Byte*>(signature_ptr), signature_len),
+      return_value);
    }
 
 bool LowLevel::C_VerifyUpdate(SessionHandle session,
-                              Byte* part_ptr,
+                              const Byte* part_ptr,
                               Ulong part_len,
                               ReturnValue* return_value) const
    {
-   return handle_return_value(m_func_list_ptr->C_VerifyUpdate(session, part_ptr, part_len), return_value);
+   return handle_return_value(
+      m_func_list_ptr->C_VerifyUpdate(session, const_cast<Byte*>(part_ptr), part_len),
+      return_value);
    }
 
 bool LowLevel::C_VerifyFinal(SessionHandle session,
-                             Byte* signature_ptr,
+                             const Byte* signature_ptr,
                              Ulong signature_len,
                              ReturnValue* return_value) const
    {
-   return handle_return_value(m_func_list_ptr->C_VerifyFinal(session, signature_ptr, signature_len), return_value);
+   return handle_return_value(
+      m_func_list_ptr->C_VerifyFinal(session, const_cast<Byte*>(signature_ptr), signature_len),
+      return_value);
    }
 
 bool LowLevel::C_VerifyRecoverInit(SessionHandle session,
@@ -730,11 +739,13 @@ bool LowLevel::C_DeriveKey(SessionHandle session,
 /****************************** Random number generation functions ******************************/
 
 bool LowLevel::C_SeedRandom(SessionHandle session,
-                            Byte* seed_ptr,
+                            const Byte* seed_ptr,
                             Ulong seed_len,
                             ReturnValue* return_value) const
    {
-   return handle_return_value(m_func_list_ptr->C_SeedRandom(session, seed_ptr, seed_len), return_value);
+   return handle_return_value(
+      m_func_list_ptr->C_SeedRandom(session, const_cast<Byte*>(seed_ptr), seed_len),
+      return_value);
    }
 
 bool LowLevel::C_GenerateRandom(SessionHandle session,
diff --git a/src/lib/prov/pkcs11/p11.h b/src/lib/prov/pkcs11/p11.h
index edf48bac3..dca3d558b 100644
--- a/src/lib/prov/pkcs11/p11.h
+++ b/src/lib/prov/pkcs11/p11.h
@@ -959,7 +959,8 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       *     \li HostMemory \li OK
       * @return true on success, false otherwise
       */
-      static bool C_GetFunctionList(Dynamically_Loaded_Library& pkcs11_module, FunctionListPtr* function_list_ptr_ptr,
+      static bool C_GetFunctionList(Dynamically_Loaded_Library& pkcs11_module,
+                                    FunctionListPtr* function_list_ptr_ptr,
                                     ReturnValue* return_value = ThrowException);
 
       /****************************** Slot and token management functions ******************************/
@@ -2161,7 +2162,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       * @return true on success, false otherwise
       */
       bool C_Sign(SessionHandle session,
-                  Byte* data_ptr,
+                  const Byte* data_ptr,
                   Ulong data_len,
                   Byte* signature_ptr,
                   Ulong* signature_len_ptr,
@@ -2191,7 +2192,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
          {
          Ulong signature_size = 0;
          if(!C_Sign(session,
-                    const_cast<Byte*>((data.data())),
+                    data.data(),
                     static_cast<Ulong>(data.size()),
                     nullptr,
                     &signature_size,
@@ -2202,11 +2203,11 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
 
          signature.resize(signature_size);
          if (!C_Sign(session,
-                       const_cast<Byte*>(data.data()),
-                       static_cast<Ulong>(data.size()),
-                       signature.data(),
-                       &signature_size,
-                       return_value))
+                     data.data(),
+                     static_cast<Ulong>(data.size()),
+                     signature.data(),
+                     &signature_size,
+                     return_value))
             {
             return false;
             }
@@ -2230,7 +2231,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       * @return true on success, false otherwise
       */
       bool C_SignUpdate(SessionHandle session,
-                        Byte* part_ptr,
+                        const Byte* part_ptr,
                         Ulong part_len,
                         ReturnValue* return_value = ThrowException) const;
 
@@ -2254,7 +2255,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
                         ReturnValue* return_value = ThrowException) const
          {
          return C_SignUpdate(session,
-                             const_cast<Byte*>(part.data()),
+                             part.data(),
                              static_cast<Ulong>(part.size()),
                              return_value);
          }
@@ -2405,9 +2406,9 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       * @return true on success, false otherwise
       */
       bool C_Verify(SessionHandle session,
-                    Byte* data_ptr,
+                    const Byte* data_ptr,
                     Ulong data_len,
-                    Byte* signature_ptr,
+                    const Byte* signature_ptr,
                     Ulong signature_len,
                     ReturnValue* return_value = ThrowException) const;
 
@@ -2434,7 +2435,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
                     ReturnValue* return_value = ThrowException) const
          {
          return C_Verify(session,
-                         const_cast<Byte*>(data.data()),
+                         data.data(),
                          static_cast<Ulong>(data.size()),
                          signature.data(),
                          static_cast<Ulong>(signature.size()),
@@ -2457,7 +2458,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       * @return true on success, false otherwise
       */
       bool C_VerifyUpdate(SessionHandle session,
-                          Byte* part_ptr,
+                          const Byte* part_ptr,
                           Ulong part_len,
                           ReturnValue* return_value = ThrowException) const;
 
@@ -2500,7 +2501,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       * @return true on success, false otherwise
       */
       bool C_VerifyFinal(SessionHandle session,
-                         Byte* signature_ptr,
+                         const Byte* signature_ptr,
                          Ulong signature_len,
                          ReturnValue* return_value = ThrowException) const;
 
@@ -2832,7 +2833,7 @@ class BOTAN_PUBLIC_API(2,0) LowLevel
       * @return true on success, false otherwise
       */
       bool C_SeedRandom(SessionHandle session,
-                        Byte* seed_ptr,
+                        const Byte* seed_ptr,
                         Ulong seed_len,
                         ReturnValue* return_value = ThrowException) const;
 
diff --git a/src/lib/prov/pkcs11/p11_ecdsa.cpp b/src/lib/prov/pkcs11/p11_ecdsa.cpp
index 196bba242..2d95893f6 100644
--- a/src/lib/prov/pkcs11/p11_ecdsa.cpp
+++ b/src/lib/prov/pkcs11/p11_ecdsa.cpp
@@ -83,7 +83,7 @@ class PKCS11_ECDSA_Signature_Operation final : public PK_Ops::Signature
             m_first_message.clear();
             }
 
-         m_key.module()->C_SignUpdate(m_key.session().handle(), const_cast<Byte*>(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_SignUpdate(m_key.session().handle(), msg, static_cast<Ulong>(msg_len));
          }
 
       secure_vector<uint8_t> sign(RandomNumberGenerator& /*rng*/) override
@@ -140,7 +140,7 @@ class PKCS11_ECDSA_Verification_Operation final : public PK_Ops::Verification
             m_first_message.clear();
             }
 
-         m_key.module()->C_VerifyUpdate(m_key.session().handle(), const_cast<Byte*>(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_VerifyUpdate(m_key.session().handle(), msg, static_cast<Ulong>(msg_len));
          }
 
       bool is_valid_signature(const uint8_t sig[], size_t sig_len) override
@@ -151,14 +151,16 @@ class PKCS11_ECDSA_Verification_Operation final : public PK_Ops::Verification
             // single call to update: perform single-part operation
             m_key.module()->C_Verify(m_key.session().handle(),
                                      m_first_message.data(), static_cast<Ulong>(m_first_message.size()),
-                                     const_cast<Byte*>(sig), static_cast<Ulong>(sig_len),
+                                     sig, static_cast<Ulong>(sig_len),
                                      &return_value);
             m_first_message.clear();
             }
          else
             {
             // multiple calls to update (or none): finish multiple-part operation
-            m_key.module()->C_VerifyFinal(m_key.session().handle(), const_cast<Byte*>(sig), static_cast<Ulong>(sig_len), &return_value);
+            m_key.module()->C_VerifyFinal(m_key.session().handle(),
+                                          sig,
+                                          static_cast<Ulong>(sig_len), &return_value);
             }
          m_initialized = false;
          if(return_value != ReturnValue::OK && return_value != ReturnValue::SignatureInvalid)
diff --git a/src/lib/prov/pkcs11/p11_mechanism.cpp b/src/lib/prov/pkcs11/p11_mechanism.cpp
index a6c161852..70f5df3f6 100644
--- a/src/lib/prov/pkcs11/p11_mechanism.cpp
+++ b/src/lib/prov/pkcs11/p11_mechanism.cpp
@@ -35,8 +35,12 @@ struct MechanismData
       : type(_type)
       {}
 
-   MechanismData(MechanismData const&) = default;
-   MechanismData& operator=(MechanismData const&) = default;
+   MechanismData(const MechanismData& other) = default;
+   MechanismData(MechanismData&& other) = default;
+
+   MechanismData& operator=(const MechanismData& other) = default;
+   MechanismData& operator=(MechanismData&& other) = default;
+
    virtual ~MechanismData() = default;
 
    // the mechanism to perform
diff --git a/src/lib/prov/pkcs11/p11_object.cpp b/src/lib/prov/pkcs11/p11_object.cpp
index ebf15c60f..7e21ee17b 100644
--- a/src/lib/prov/pkcs11/p11_object.cpp
+++ b/src/lib/prov/pkcs11/p11_object.cpp
@@ -67,7 +67,7 @@ void AttributeContainer::add_attribute(AttributeType attribute, const uint8_t* v
             return data.data() == existing_attribute.pValue;
             }), m_vectors.end());
 
-         existing_attribute.pValue = const_cast< uint8_t* >(value);
+         existing_attribute.pValue = const_cast<uint8_t*>(value);
          existing_attribute.ulValueLen = size;
          exists = true;
          break;
@@ -76,7 +76,12 @@ void AttributeContainer::add_attribute(AttributeType attribute, const uint8_t* v
 
    if(!exists)
       {
-      m_attributes.push_back(Attribute{ static_cast< CK_ATTRIBUTE_TYPE >(attribute), const_cast< uint8_t* >(value), size });
+      m_attributes.push_back(
+         Attribute {
+            static_cast<CK_ATTRIBUTE_TYPE>(attribute),
+            const_cast<uint8_t*>(value),
+            size }
+         );
       }
    }
 
diff --git a/src/lib/prov/pkcs11/p11_rsa.cpp b/src/lib/prov/pkcs11/p11_rsa.cpp
index a0509bdeb..6ad9d93aa 100644
--- a/src/lib/prov/pkcs11/p11_rsa.cpp
+++ b/src/lib/prov/pkcs11/p11_rsa.cpp
@@ -234,7 +234,7 @@ class PKCS11_RSA_Signature_Operation final : public PK_Ops::Signature
             m_first_message.clear();
             }
 
-         m_key.module()->C_SignUpdate(m_key.session().handle(), const_cast< Byte* >(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_SignUpdate(m_key.session().handle(), msg, static_cast<Ulong>(msg_len));
          }
 
       secure_vector<uint8_t> sign(RandomNumberGenerator& /*rng*/) override
@@ -289,7 +289,7 @@ class PKCS11_RSA_Verification_Operation final : public PK_Ops::Verification
             m_first_message.clear();
             }
 
-         m_key.module()->C_VerifyUpdate(m_key.session().handle(), const_cast< Byte* >(msg), static_cast<Ulong>(msg_len));
+         m_key.module()->C_VerifyUpdate(m_key.session().handle(), msg, static_cast<Ulong>(msg_len));
          }
 
       bool is_valid_signature(const uint8_t sig[], size_t sig_len) override
@@ -300,13 +300,13 @@ class PKCS11_RSA_Verification_Operation final : public PK_Ops::Verification
             // single call to update: perform single-part operation
             m_key.module()->C_Verify(m_key.session().handle(),
                                      m_first_message.data(), static_cast<Ulong>(m_first_message.size()),
-                                     const_cast< Byte* >(sig), static_cast<Ulong>(sig_len), &return_value);
+                                     sig, static_cast<Ulong>(sig_len), &return_value);
             m_first_message.clear();
             }
          else
             {
             // multiple calls to update (or none): finish multiple-part operation
-            m_key.module()->C_VerifyFinal(m_key.session().handle(), const_cast< Byte* >(sig), static_cast<Ulong>(sig_len), &return_value);
+            m_key.module()->C_VerifyFinal(m_key.session().handle(), sig, static_cast<Ulong>(sig_len), &return_value);
             }
          m_initialized = false;
          if(return_value != ReturnValue::OK && return_value != ReturnValue::SignatureInvalid)
diff --git a/src/lib/prov/pkcs11/p11_session.cpp b/src/lib/prov/pkcs11/p11_session.cpp
index 1b0ad38fa..c2aea6ac7 100644
--- a/src/lib/prov/pkcs11/p11_session.cpp
+++ b/src/lib/prov/pkcs11/p11_session.cpp
@@ -81,7 +81,7 @@ SessionInfo Session::get_info() const
    return info;
    }
 
-void Session::set_pin(const secure_string& old_pin, const secure_string& new_pin) const
+void Session::set_pin(const secure_string& old_pin, const secure_string& new_pin)
    {
    module()->C_SetPIN(m_handle, old_pin, new_pin);
    }
diff --git a/src/lib/prov/pkcs11/p11_types.h b/src/lib/prov/pkcs11/p11_types.h
index bd445da3c..bff7d110e 100644
--- a/src/lib/prov/pkcs11/p11_types.h
+++ b/src/lib/prov/pkcs11/p11_types.h
@@ -192,7 +192,7 @@ class BOTAN_PUBLIC_API(2,0) Session final
       SessionInfo get_info() const;
 
       /// Calls `C_SetPIN` to change the PIN using the old PIN (requires a logged in session)
-      void set_pin(const secure_string& old_pin, const secure_string& new_pin) const;
+      void set_pin(const secure_string& old_pin, const secure_string& new_pin);
 
       /// Calls `C_InitPIN` to change or initialize the PIN using the SO_PIN (requires a logged in session)
       void init_pin(const secure_string& new_pin);
diff --git a/src/lib/pubkey/dl_group/dl_group.cpp b/src/lib/pubkey/dl_group/dl_group.cpp
index 288000b53..38c4ebd59 100644
--- a/src/lib/pubkey/dl_group/dl_group.cpp
+++ b/src/lib/pubkey/dl_group/dl_group.cpp
@@ -39,7 +39,9 @@ class DL_Group_Data final
       ~DL_Group_Data() = default;
 
       DL_Group_Data(const DL_Group_Data& other) = delete;
+      DL_Group_Data(DL_Group_Data&& other) = delete;
       DL_Group_Data& operator=(const DL_Group_Data& other) = delete;
+      DL_Group_Data& operator=(DL_Group_Data&& other) = delete;
 
       const BigInt& p() const { return m_p; }
       const BigInt& q() const { return m_q; }
diff --git a/src/lib/pubkey/ed25519/ed25519_key.cpp b/src/lib/pubkey/ed25519/ed25519_key.cpp
index 0d20199bc..5db8edc21 100644
--- a/src/lib/pubkey/ed25519/ed25519_key.cpp
+++ b/src/lib/pubkey/ed25519/ed25519_key.cpp
@@ -145,7 +145,7 @@ namespace {
 class Ed25519_Pure_Verify_Operation final : public PK_Ops::Verification
    {
    public:
-      Ed25519_Pure_Verify_Operation(const Ed25519_PublicKey& key) : m_key(key)
+      explicit Ed25519_Pure_Verify_Operation(const Ed25519_PublicKey& key) : m_key(key)
          {
          }
 
@@ -220,7 +220,7 @@ class Ed25519_Hashed_Verify_Operation final : public PK_Ops::Verification
 class Ed25519_Pure_Sign_Operation final : public PK_Ops::Signature
    {
    public:
-      Ed25519_Pure_Sign_Operation(const Ed25519_PrivateKey& key) : m_key(key)
+      explicit Ed25519_Pure_Sign_Operation(const Ed25519_PrivateKey& key) : m_key(key)
          {
          }
 
diff --git a/src/lib/pubkey/ed25519/ge.cpp b/src/lib/pubkey/ed25519/ge.cpp
index 0645746b4..e98e1f50c 100644
--- a/src/lib/pubkey/ed25519/ge.cpp
+++ b/src/lib/pubkey/ed25519/ge.cpp
@@ -9,7 +9,6 @@
 */
 
 #include <botan/internal/ed25519_internal.h>
-#include <assert.h>
 
 namespace Botan {
 
diff --git a/src/lib/pubkey/kyber/kyber_common/kyber.cpp b/src/lib/pubkey/kyber/kyber_common/kyber.cpp
index e76d029ea..215afc6d2 100644
--- a/src/lib/pubkey/kyber/kyber_common/kyber.cpp
+++ b/src/lib/pubkey/kyber/kyber_common/kyber.cpp
@@ -149,15 +149,19 @@ class KyberConstants
 
          if(!m_symmetric_primitives)
             {
-            throw Not_Implemented("requested kyber mode is not enabled in this build");
+            throw Not_Implemented("requested Kyber mode is not enabled in this build");
             }
          }
 
+      ~KyberConstants() = default;
+
       KyberConstants(const KyberConstants& other) : KyberConstants(other.m_mode)
          {
          }
 
       KyberConstants(KyberConstants&& other) = default;
+      KyberConstants& operator=(const KyberConstants& other) = delete;
+      KyberConstants& operator=(KyberConstants&& other) = default;
 
       std::string algo_name() const
          {
@@ -1040,7 +1044,8 @@ class Kyber_PublicKeyInternal
    {
    public:
       Kyber_PublicKeyInternal(KyberConstants mode, std::vector<uint8_t> polynomials, std::vector<uint8_t> seed)
-         : m_mode(std::move(mode)), m_polynomials(PolynomialVector::from_bytes(polynomials, mode)),
+         : m_mode(std::move(mode)),
+           m_polynomials(PolynomialVector::from_bytes(polynomials, m_mode)),
            m_seed(std::move(seed))
          {
          }
diff --git a/src/lib/pubkey/mce/gf2m_small_m.cpp b/src/lib/pubkey/mce/gf2m_small_m.cpp
index b67d807c5..f97cb20b0 100644
--- a/src/lib/pubkey/mce/gf2m_small_m.cpp
+++ b/src/lib/pubkey/mce/gf2m_small_m.cpp
@@ -18,7 +18,7 @@ namespace Botan {
 
 namespace {
 
-gf2m prim_poly[MAX_EXT_DEG + 1] = {
+const gf2m prim_poly[MAX_EXT_DEG + 1] = {
    01,       /* extension degree 0 (!) never used */
    03,       /* extension degree 1 (!) never used */
    07,       /* extension degree 2 */
diff --git a/src/lib/pubkey/xmss/xmss_wots.h b/src/lib/pubkey/xmss/xmss_wots.h
index dc1c2ba78..1726e8c09 100644
--- a/src/lib/pubkey/xmss/xmss_wots.h
+++ b/src/lib/pubkey/xmss/xmss_wots.h
@@ -57,7 +57,7 @@ class XMSS_WOTS_Parameters final
 
       secure_vector<uint8_t> base_w(size_t value) const;
 
-      void append_checksum(secure_vector<uint8_t>& data);
+      void append_checksum(secure_vector<uint8_t>& data) const;
 
       /**
        * @return XMSS WOTS registry name for the chosen parameter set.
diff --git a/src/lib/pubkey/xmss/xmss_wots_parameters.cpp b/src/lib/pubkey/xmss/xmss_wots_parameters.cpp
index ef89c081c..a47b14636 100644
--- a/src/lib/pubkey/xmss/xmss_wots_parameters.cpp
+++ b/src/lib/pubkey/xmss/xmss_wots_parameters.cpp
@@ -121,7 +121,7 @@ XMSS_WOTS_Parameters::base_w(size_t value) const
    }
 
 void
-XMSS_WOTS_Parameters::append_checksum(secure_vector<uint8_t>& data)
+XMSS_WOTS_Parameters::append_checksum(secure_vector<uint8_t>& data) const
    {
    size_t csum = 0;
 
diff --git a/src/lib/rng/system_rng/system_rng.cpp b/src/lib/rng/system_rng/system_rng.cpp
index 7d961c49d..8126eea30 100644
--- a/src/lib/rng/system_rng/system_rng.cpp
+++ b/src/lib/rng/system_rng/system_rng.cpp
@@ -50,6 +50,11 @@ class System_RNG_Impl final : public RandomNumberGenerator
          m_rtlgenrandom = m_advapi.resolve<RtlGenRandom_fptr>("SystemFunction036");
          }
 
+      System_RNG_Impl(const System_RNG_Impl& other) = delete;
+      System_RNG_Impl(System_RNG_Impl&& other) = delete;
+      System_RNG_Impl& operator=(const System_RNG_Impl& other) = delete;
+      System_RNG_Impl& operator=(System_RNG_Impl&& other) = delete;
+
       void randomize(uint8_t buf[], size_t len) override
          {
          const size_t limit = std::numeric_limits<ULONG>::max();
@@ -98,7 +103,12 @@ class System_RNG_Impl final : public RandomNumberGenerator
             throw System_Error("System_RNG failed to acquire crypto provider", ret);
          }
 
-      ~System_RNG_Impl()
+      System_RNG_Impl(const System_RNG_Impl& other) = delete;
+      System_RNG_Impl(System_RNG_Impl&& other) = delete;
+      System_RNG_Impl& operator=(const System_RNG_Impl& other) = delete;
+      System_RNG_Impl& operator=(System_RNG_Impl&& other) = delete;
+
+      ~System_RNG_Impl() override
          {
          ::BCryptCloseAlgorithmProvider(m_prov, 0);
          }
@@ -268,7 +278,12 @@ class System_RNG_Impl final : public RandomNumberGenerator
             throw System_Error("System_RNG failed to open RNG device", errno);
          }
 
-      ~System_RNG_Impl()
+      System_RNG_Impl(const System_RNG_Impl& other) = delete;
+      System_RNG_Impl(System_RNG_Impl&& other) = delete;
+      System_RNG_Impl& operator=(const System_RNG_Impl& other) = delete;
+      System_RNG_Impl& operator=(System_RNG_Impl&& other) = delete;
+
+      ~System_RNG_Impl() override
          {
          ::close(m_fd);
          m_fd = -1;
diff --git a/src/lib/stream/chacha/chacha.h b/src/lib/stream/chacha/chacha.h
index d27ff605c..c042dda8a 100644
--- a/src/lib/stream/chacha/chacha.h
+++ b/src/lib/stream/chacha/chacha.h
@@ -58,7 +58,7 @@ class ChaCha final : public StreamCipher
 
       void initialize_state();
 
-      void chacha_x8(uint8_t output[64*8], uint32_t state[16], size_t rounds);
+      static void chacha_x8(uint8_t output[64*8], uint32_t state[16], size_t rounds);
 
 #if defined(BOTAN_HAS_CHACHA_SIMD32)
       static void chacha_simd32_x4(uint8_t output[64*4], uint32_t state[16], size_t rounds);
diff --git a/src/lib/tls/tls_handshake_io.cpp b/src/lib/tls/tls_handshake_io.cpp
index 867f8f9a6..5678fcecf 100644
--- a/src/lib/tls/tls_handshake_io.cpp
+++ b/src/lib/tls/tls_handshake_io.cpp
@@ -127,7 +127,7 @@ std::vector<uint8_t> Stream_Handshake_IO::send(const Handshake_Message& msg)
       return std::vector<uint8_t>(); // not included in handshake hashes
       }
 
-   const std::vector<uint8_t> buf = format(msg_bits, msg.type());
+   auto buf = format(msg_bits, msg.type());
    m_send_hs(HANDSHAKE, buf);
    return buf;
    }
@@ -432,8 +432,7 @@ std::vector<uint8_t> Datagram_Handshake_IO::send_message(uint16_t msg_seq,
    {
    const size_t DTLS_HANDSHAKE_HEADER_LEN = 12;
 
-   const std::vector<uint8_t> no_fragment =
-      format_w_seq(msg_bits, msg_type, msg_seq);
+   auto no_fragment = format_w_seq(msg_bits, msg_type, msg_seq);
 
    if(no_fragment.size() + DTLS_HEADER_SIZE <= m_mtu)
       {
diff --git a/src/lib/utils/calendar.cpp b/src/lib/utils/calendar.cpp
index 9e0650fb7..d05e101e6 100644
--- a/src/lib/utils/calendar.cpp
+++ b/src/lib/utils/calendar.cpp
@@ -11,7 +11,6 @@
 #include <ctime>
 #include <sstream>
 #include <iomanip>
-#include <stdlib.h>
 
 namespace Botan {
 
diff --git a/src/lib/utils/cpuid/cpuid_x86.cpp b/src/lib/utils/cpuid/cpuid_x86.cpp
index 6bc42fa69..bca49cdba 100644
--- a/src/lib/utils/cpuid/cpuid_x86.cpp
+++ b/src/lib/utils/cpuid/cpuid_x86.cpp
@@ -71,7 +71,7 @@ uint64_t CPUID::CPUID_Data::detect_cpu_features(size_t* cache_line_size)
    {
    uint64_t features_detected = 0;
    uint32_t cpuid[4] = { 0 };
-   bool has_avx = 0;
+   bool has_avx = false;
 
    // CPUID 0: vendor identification, max sublevel
    invoke_cpuid(0, cpuid);
@@ -120,7 +120,7 @@ uint64_t CPUID::CPUID_Data::detect_cpu_features(size_t* cache_line_size)
          features_detected |= CPUID::CPUID_RDRAND_BIT;
       if((flags0 & x86_CPUID_1_bits::AVX) &&
          (flags0 & x86_CPUID_1_bits::OSXSAVE))
-         has_avx = 1;
+         has_avx = true;
       }
 
    if(is_intel)
diff --git a/src/lib/utils/mem_pool/mem_pool.cpp b/src/lib/utils/mem_pool/mem_pool.cpp
index bd34bf719..dcef18eac 100644
--- a/src/lib/utils/mem_pool/mem_pool.cpp
+++ b/src/lib/utils/mem_pool/mem_pool.cpp
@@ -146,7 +146,7 @@ size_t find_set_bit(T b)
 class BitMap final
    {
    public:
-      BitMap(size_t bits) : m_len(bits)
+      explicit BitMap(size_t bits) : m_len(bits)
          {
          m_bits.resize((bits + BITMASK_BITS - 1) / BITMASK_BITS);
          m_main_mask = static_cast<bitmask_type>(~0);
diff --git a/src/lib/utils/os_utils.cpp b/src/lib/utils/os_utils.cpp
index 443091764..403f7ac0c 100644
--- a/src/lib/utils/os_utils.cpp
+++ b/src/lib/utils/os_utils.cpp
@@ -742,7 +742,7 @@ std::unique_ptr<OS::Echo_Suppression> OS::suppress_echo_on_terminal()
                }
             }
 
-         ~POSIX_Echo_Suppression()
+         ~POSIX_Echo_Suppression() override
             {
             try
                {
@@ -753,6 +753,11 @@ std::unique_ptr<OS::Echo_Suppression> OS::suppress_echo_on_terminal()
                }
             }
 
+         POSIX_Echo_Suppression(const POSIX_Echo_Suppression& other) = delete;
+         POSIX_Echo_Suppression(POSIX_Echo_Suppression&& other) = delete;
+         POSIX_Echo_Suppression& operator=(const POSIX_Echo_Suppression& other) = delete;
+         POSIX_Echo_Suppression& operator=(POSIX_Echo_Suppression&& other) = delete;
+
       private:
          int m_stdin_fd;
          struct termios m_old_termios;
@@ -786,7 +791,7 @@ std::unique_ptr<OS::Echo_Suppression> OS::suppress_echo_on_terminal()
                }
             }
 
-         ~Win32_Echo_Suppression()
+         ~Win32_Echo_Suppression() override
             {
             try
                {
@@ -797,6 +802,11 @@ std::unique_ptr<OS::Echo_Suppression> OS::suppress_echo_on_terminal()
                }
             }
 
+         Win32_Echo_Suppression(const Win32_Echo_Suppression& other) = delete;
+         Win32_Echo_Suppression(Win32_Echo_Suppression&& other) = delete;
+         Win32_Echo_Suppression& operator=(const Win32_Echo_Suppression& other) = delete;
+         Win32_Echo_Suppression& operator=(Win32_Echo_Suppression&& other) = delete;
+
       private:
          HANDLE m_input_handle;
          DWORD m_console_state;
diff --git a/src/lib/utils/socket/socket.cpp b/src/lib/utils/socket/socket.cpp
index 917b75605..664a08b80 100644
--- a/src/lib/utils/socket/socket.cpp
+++ b/src/lib/utils/socket/socket.cpp
@@ -280,13 +280,18 @@ class BSD_Socket final : public OS::Socket
             }
          }
 
-      ~BSD_Socket()
+      ~BSD_Socket() override
          {
          close_socket(m_socket);
          m_socket = invalid_socket();
          socket_fini();
          }
 
+      BSD_Socket(const BSD_Socket& other) = delete;
+      BSD_Socket(BSD_Socket&& other) = delete;
+      BSD_Socket& operator=(const BSD_Socket& other) = delete;
+      BSD_Socket& operator=(BSD_Socket&& other) = delete;
+
       void write(const uint8_t buf[], size_t len) override
          {
          fd_set write_set;
diff --git a/src/lib/utils/socket/socket_udp.cpp b/src/lib/utils/socket/socket_udp.cpp
index 2e3f28f0f..0635cbb50 100644
--- a/src/lib/utils/socket/socket_udp.cpp
+++ b/src/lib/utils/socket/socket_udp.cpp
@@ -187,13 +187,18 @@ class BSD_SocketUDP final : public OS::SocketUDP
             }
          }
 
-      ~BSD_SocketUDP()
+      ~BSD_SocketUDP() override
          {
          close_socket(m_socket);
          m_socket = invalid_socket();
          socket_fini();
          }
 
+      BSD_SocketUDP(const BSD_SocketUDP& other) = delete;
+      BSD_SocketUDP(BSD_SocketUDP&& other) = delete;
+      BSD_SocketUDP& operator=(const BSD_SocketUDP& other) = delete;
+      BSD_SocketUDP& operator=(BSD_SocketUDP&& other) = delete;
+
       void write(const uint8_t buf[], size_t len) override
          {
          fd_set write_set;
diff --git a/src/scripts/run_clang_tidy.py b/src/scripts/run_clang_tidy.py
index 39f8e65d9..049e569f1 100755
--- a/src/scripts/run_clang_tidy.py
+++ b/src/scripts/run_clang_tidy.py
@@ -18,13 +18,12 @@ enabled_checks = [
     'portability-*',
     'readability-container-size-empty',
     'readability-static-definition-in-anonymous-namespace',
+    'hicpp-special-member-functions'
 
-    'cppcoreguidelines-*',
-    'hicpp-*',
-    'modernize-*',
-    'readability-*',
-    #'modernize-make-unique',
-    'readability-inconsistent-declaration-parameter-name',
+#    'cppcoreguidelines-*',
+#    'hicpp-*',
+#    'modernize-*',
+#    'readability-*',
 ]
 
 # these might be worth being clean for
@@ -60,21 +59,26 @@ disabled_not_interested = [
     '*-magic-numbers', # can't stop the magic
     '*-no-array-decay',
     '*-use-auto', # not universally a good idea
-    'bugprone-branch-clone', # doesn't interact well with feature macros
+    '*-use-emplace', # often less clear
+    '-*deprecated-headers', # wrong for system headers like stdlib.h
     'bugprone-argument-comment',
+    'bugprone-branch-clone', # doesn't interact well with feature macros
     'cert-err58-cpp',
     'cppcoreguidelines-no-malloc',
     'cppcoreguidelines-pro-bounds-constant-array-index',
     'cppcoreguidelines-pro-type-cstyle-cast', # system headers
     'cppcoreguidelines-pro-type-reinterpret-cast', # not possible thanks though
+    'cppcoreguidelines-pro-type-vararg', # idiocy
     'hicpp-no-assembler',
     'hicpp-no-malloc',
+    'hicpp-vararg', # idiocy
     'modernize-loop-convert', # sometimes very ugly
     'modernize-raw-string-literal',
     'modernize-return-braced-init-list', # thanks I hate it
     'modernize-use-using', # fine not great
     'portability-simd-intrinsics',
     'readability-function-cognitive-complexity',
+    'readability-use-anyofallof', # not more readable
 ]
 
 disabled_checks = disabled_needs_work + disabled_not_interested
@@ -118,6 +122,7 @@ def run_clang_tidy(compile_commands_file,
         print(source_file)
     if stdout != "":
         print(stdout)
+        sys.stdout.flush()
 
 def file_matches(file, args):
     if args is None or len(args) == 0:
diff --git a/src/tests/test_newhope.cpp b/src/tests/test_newhope.cpp
index 14e4a0190..310cf5653 100644
--- a/src/tests/test_newhope.cpp
+++ b/src/tests/test_newhope.cpp
@@ -78,7 +78,7 @@ class NEWHOPE_RNG final : public Botan::RandomNumberGenerator
          /* ignored */
          }
 
-      NEWHOPE_RNG(const std::vector<uint8_t>& seed)
+      explicit NEWHOPE_RNG(const std::vector<uint8_t>& seed)
          {
          m_chacha = Botan::StreamCipher::create_or_throw("ChaCha20");
 
diff --git a/src/tests/test_ocb.cpp b/src/tests/test_ocb.cpp
index 6c13e851e..c55ec6c0b 100644
--- a/src/tests/test_ocb.cpp
+++ b/src/tests/test_ocb.cpp
@@ -24,7 +24,7 @@ namespace {
 class OCB_Wide_Test_Block_Cipher final : public Botan::BlockCipher
    {
    public:
-      OCB_Wide_Test_Block_Cipher(size_t bs) : m_bs(bs) {}
+      explicit OCB_Wide_Test_Block_Cipher(size_t bs) : m_bs(bs) {}
 
       std::string name() const override { return "OCB_ToyCipher"; }
       size_t block_size() const override { return m_bs; }
diff --git a/src/tests/test_pkcs11_low_level.cpp b/src/tests/test_pkcs11_low_level.cpp
index bbf3816d8..2e147de5b 100644
--- a/src/tests/test_pkcs11_low_level.cpp
+++ b/src/tests/test_pkcs11_low_level.cpp
@@ -44,6 +44,7 @@ class RAII_LowLevel
 
          m_low_level->C_Initialize(&init_args);
          }
+
       ~RAII_LowLevel() noexcept
          {
          try
@@ -65,6 +66,11 @@ class RAII_LowLevel
             }
          }
 
+      RAII_LowLevel(const RAII_LowLevel& other) = delete;
+      RAII_LowLevel(RAII_LowLevel&& other) = delete;
+      RAII_LowLevel& operator=(const RAII_LowLevel& other) = delete;
+      RAII_LowLevel& operator=(RAII_LowLevel&& other) = delete;
+
       std::vector<SlotId> get_slots(bool token_present) const
          {
          std::vector<SlotId> slots;
@@ -606,16 +612,16 @@ Test::Result test_c_set_pin()
    }
 
 // Simple data object
-ObjectClass object_class = ObjectClass::Data;
-std::string label = "A data object";
-std::string data = "Sample data";
-Bbool btrue = True;
+const ObjectClass object_class = ObjectClass::Data;
+const std::string label = "A data object";
+const std::string data = "Sample data";
+const Bbool btrue = True;
 
 std::array<Attribute, 4> dtemplate =
    {
       {
-         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Class), &object_class, sizeof(object_class) },
-         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Token), &btrue, sizeof(btrue) },
+         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Class), const_cast<ObjectClass*>(&object_class), sizeof(object_class) },
+         { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Token), const_cast<Bbool*>(&btrue), sizeof(btrue) },
          { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Label), const_cast<char*>(label.c_str()), static_cast<CK_ULONG>(label.size()) },
          { static_cast<CK_ATTRIBUTE_TYPE>(AttributeType::Value), const_cast<char*>(data.c_str()), static_cast<CK_ULONG>(data.size()) }
       }
diff --git a/src/tests/test_psk_db.cpp b/src/tests/test_psk_db.cpp
index 2ec1b66b2..21f9011ab 100644
--- a/src/tests/test_psk_db.cpp
+++ b/src/tests/test_psk_db.cpp
@@ -21,7 +21,7 @@ namespace {
 class Test_Map_PSK_Db : public Botan::Encrypted_PSK_Database
    {
    public:
-      Test_Map_PSK_Db(const Botan::secure_vector<uint8_t>& master_key) :
+      explicit Test_Map_PSK_Db(const Botan::secure_vector<uint8_t>& master_key) :
          Botan::Encrypted_PSK_Database(master_key)
          {}
 
diff --git a/src/tests/test_tls.cpp b/src/tests/test_tls.cpp
index 750dacafe..b460f84fd 100644
--- a/src/tests/test_tls.cpp
+++ b/src/tests/test_tls.cpp
@@ -136,7 +136,7 @@ class TLS_CBC_Tests final : public Text_Based_Test
       class ZeroMac : public Botan::MessageAuthenticationCode
          {
          public:
-            ZeroMac(size_t mac_len) : m_mac_len(mac_len) {}
+            explicit ZeroMac(size_t mac_len) : m_mac_len(mac_len) {}
 
             void clear() override {}
 
@@ -156,7 +156,7 @@ class TLS_CBC_Tests final : public Text_Based_Test
                return Botan::Key_Length_Specification(0, 0, 1);
                }
 
-            virtual std::unique_ptr<MessageAuthenticationCode> new_object() const override
+            std::unique_ptr<MessageAuthenticationCode> new_object() const override
                {
                return std::make_unique<ZeroMac>(m_mac_len);
                }
@@ -170,7 +170,7 @@ class TLS_CBC_Tests final : public Text_Based_Test
       class Noop_Block_Cipher : public Botan::BlockCipher
          {
          public:
-            Noop_Block_Cipher(size_t bs) : m_bs(bs) {}
+            explicit Noop_Block_Cipher(size_t bs) : m_bs(bs) {}
 
             void encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const override
                {
diff --git a/src/tests/test_utils.cpp b/src/tests/test_utils.cpp
index cb0ab23f5..11becee12 100644
--- a/src/tests/test_utils.cpp
+++ b/src/tests/test_utils.cpp
@@ -739,7 +739,7 @@ class UUID_Tests : public Test
          class AllSame_RNG : public Botan::RandomNumberGenerator
             {
             public:
-               AllSame_RNG(uint8_t b) : m_val(b) {}
+               explicit AllSame_RNG(uint8_t b) : m_val(b) {}
 
                void randomize(uint8_t out[], size_t len) override
                   {
diff --git a/src/tests/unit_tls.cpp b/src/tests/unit_tls.cpp
index 7e0339451..2885db3ec 100644
--- a/src/tests/unit_tls.cpp
+++ b/src/tests/unit_tls.cpp
@@ -282,7 +282,7 @@ class TLS_Handshake_Test final
 
             bool empty() const override { return false; }
 
-            Test_Extension(Botan::TLS::Connection_Side side)
+            explicit Test_Extension(Botan::TLS::Connection_Side side)
                {
                const uint8_t client_extn[6] = { 'c', 'l', 'i', 'e', 'n', 't' };
                const uint8_t server_extn[6] = { 's', 'e', 'r', 'v', 'e', 'r' };
@@ -396,7 +396,7 @@ class TLS_Handshake_Test final
                return "test/3";
                }
 
-            virtual std::string tls_decode_group_param(Botan::TLS::Group_Params group_param) override
+            std::string tls_decode_group_param(Botan::TLS::Group_Params group_param) override
                {
                if(static_cast<uint16_t>(group_param) == 0xFEE1)
                   return "secp112r1";
diff --git a/src/tests/unit_x509.cpp b/src/tests/unit_x509.cpp
index acfd5c154..5e8254b91 100644
--- a/src/tests/unit_x509.cpp
+++ b/src/tests/unit_x509.cpp
@@ -1366,7 +1366,7 @@ class String_Extension final : public Botan::Certificate_Extension
    {
    public:
       String_Extension() = default;
-      String_Extension(const std::string& val) : m_contents(val) {}
+      explicit String_Extension(const std::string& val) : m_contents(val) {}
 
       std::string value() const
          {