Skip to content

Commit bfdf5cf

Browse files
nikpivkinnikpivkin
authored
refactor(misconf): use slog (#7295)
Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
1 parent 6fe6727 commit bfdf5cf

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

61 files changed

+566
-901
lines changed

‎pkg/commands/artifact/run.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -640,7 +640,6 @@ func initMisconfScannerOption(opts flag.Options) (misconf.ScannerOption, error)
640640
}
641641

642642
return misconf.ScannerOption{
643-
Debug: opts.Debug,
644643
Trace: opts.Trace,
645644
Namespaces: append(opts.CheckNamespaces, rego.BuiltinNamespaces()...),
646645
PolicyPaths: append(opts.CheckPaths, downloadedPolicyPaths...),

‎pkg/iac/debug/debug.go

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎pkg/iac/rego/load.go

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ import (
1010
"github.com/open-policy-agent/opa/ast"
1111
"github.com/open-policy-agent/opa/bundle"
1212
"github.com/samber/lo"
13+
14+
"github.com/aquasecurity/trivy/pkg/log"
1315
)
1416

1517
var builtinNamespaces = map[string]struct{}{
@@ -61,14 +63,14 @@ func (s *Scanner) loadEmbedded() error {
6163
return fmt.Errorf("failed to load embedded rego libraries: %w", err)
6264
}
6365
s.embeddedLibs = loaded
64-
s.debug.Log("Loaded %d embedded libraries.", len(loaded))
66+
s.logger.Debug("Embedded libraries are loaded", log.Int("count", len(loaded)))
6567

6668
loaded, err = LoadEmbeddedPolicies()
6769
if err != nil {
68-
return fmt.Errorf("failed to load embedded rego policies: %w", err)
70+
return fmt.Errorf("failed to load embedded rego checks: %w", err)
6971
}
7072
s.embeddedChecks = loaded
71-
s.debug.Log("Loaded %d embedded policies.", len(loaded))
73+
s.logger.Debug("Embedded checks are loaded", log.Int("count", len(loaded)))
7274

7375
return nil
7476
}
@@ -80,7 +82,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
8082
}
8183

8284
if s.policyFS != nil {
83-
s.debug.Log("Overriding filesystem for checks!")
85+
s.logger.Debug("Overriding filesystem for checks")
8486
srcFS = s.policyFS
8587
}
8688

@@ -105,7 +107,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
105107
for name, policy := range loaded {
106108
s.policies[name] = policy
107109
}
108-
s.debug.Log("Loaded %d checks from disk.", len(loaded))
110+
s.logger.Debug("Checks from disk are loaded", log.Int("count", len(loaded)))
109111
}
110112

111113
if len(readers) > 0 {
@@ -116,7 +118,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
116118
for name, policy := range loaded {
117119
s.policies[name] = policy
118120
}
119-
s.debug.Log("Loaded %d checks from reader(s).", len(loaded))
121+
s.logger.Debug("Checks from readers are loaded", log.Int("count", len(loaded)))
120122
}
121123

122124
// gather namespaces
@@ -132,7 +134,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
132134

133135
dataFS := srcFS
134136
if s.dataFS != nil {
135-
s.debug.Log("Overriding filesystem for data!")
137+
s.logger.Debug("Overriding filesystem for data")
136138
dataFS = s.dataFS
137139
}
138140
store, err := initStore(dataFS, s.dataDirs, namespaces)
@@ -168,15 +170,19 @@ func (s *Scanner) fallbackChecks(compiler *ast.Compiler) {
168170
continue
169171
}
170172

171-
s.debug.Log("Error occurred while parsing: %s, %s. Trying to fallback to embedded check.", loc, e.Error())
173+
s.logger.Error(
174+
"Error occurred while parsing. Trying to fallback to embedded check",
175+
log.FilePath(loc),
176+
log.Err(e),
177+
)
172178

173179
embedded := s.findMatchedEmbeddedCheck(badPolicy)
174180
if embedded == nil {
175-
s.debug.Log("Failed to find embedded check: %s", loc)
181+
s.logger.Error("Failed to find embedded check, skipping", log.FilePath(loc))
176182
continue
177183
}
178184

179-
s.debug.Log("Found embedded check: %s", embedded.Package.Location.File)
185+
s.logger.Debug("Found embedded check", log.FilePath(embedded.Package.Location.File))
180186
delete(s.policies, loc) // remove bad check
181187
s.policies[embedded.Package.Location.File] = embedded
182188
delete(s.embeddedChecks, embedded.Package.Location.File) // avoid infinite loop if embedded check contains ref error
@@ -214,15 +220,18 @@ func (s *Scanner) findMatchedEmbeddedCheck(badPolicy *ast.Module) *ast.Module {
214220

215221
func (s *Scanner) prunePoliciesWithError(compiler *ast.Compiler) error {
216222
if len(compiler.Errors) > s.regoErrorLimit {
217-
s.debug.Log("Error(s) occurred while loading checks")
223+
s.logger.Error("Error(s) occurred while loading checks")
218224
return compiler.Errors
219225
}
220226

221227
for _, e := range compiler.Errors {
222228
if e.Location == nil {
223229
continue
224230
}
225-
s.debug.Log("Error occurred while parsing: %s, %s", e.Location.File, e.Error())
231+
s.logger.Error(
232+
"Error occurred while parsing",
233+
log.FilePath(e.Location.File), log.Err(e),
234+
)
226235
delete(s.policies, e.Location.File)
227236
}
228237
return nil
@@ -282,7 +291,11 @@ func (s *Scanner) filterModules(retriever *MetadataRetriever) error {
282291
return err
283292
}
284293
if len(meta.InputOptions.Selectors) == 0 {
285-
s.debug.Log("WARNING: Module %s has no input selectors - it will be loaded for all inputs!", name)
294+
s.logger.Warn(
295+
"Module has no input selectors - it will be loaded for all inputs!",
296+
log.FilePath(module.Package.Location.File),
297+
log.String("module", name),
298+
)
286299
filtered[name] = module
287300
continue
288301
}

‎pkg/iac/rego/load_test.go

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"embed"
66
"fmt"
77
"io"
8+
"log/slog"
89
"strings"
910
"testing"
1011
"testing/fstest"
@@ -17,6 +18,7 @@ import (
1718
"github.com/aquasecurity/trivy/pkg/iac/rego"
1819
"github.com/aquasecurity/trivy/pkg/iac/scanners/options"
1920
"github.com/aquasecurity/trivy/pkg/iac/types"
21+
"github.com/aquasecurity/trivy/pkg/log"
2022
)
2123

2224
//go:embed all:testdata/policies
@@ -28,10 +30,10 @@ var embeddedChecksFS embed.FS
2830
func Test_RegoScanning_WithSomeInvalidPolicies(t *testing.T) {
2931
t.Run("allow no errors", func(t *testing.T) {
3032
var debugBuf bytes.Buffer
33+
slog.SetDefault(log.New(log.NewHandler(&debugBuf, nil)))
3134
scanner := rego.NewScanner(
3235
types.SourceDockerfile,
3336
options.ScannerWithRegoErrorLimits(0),
34-
options.ScannerWithDebug(&debugBuf),
3537
)
3638

3739
err := scanner.LoadPolicies(false, false, testEmbedFS, []string{"."}, nil)
@@ -41,16 +43,16 @@ func Test_RegoScanning_WithSomeInvalidPolicies(t *testing.T) {
4143

4244
t.Run("allow up to max 1 error", func(t *testing.T) {
4345
var debugBuf bytes.Buffer
46+
slog.SetDefault(log.New(log.NewHandler(&debugBuf, nil)))
4447
scanner := rego.NewScanner(
4548
types.SourceDockerfile,
4649
options.ScannerWithRegoErrorLimits(1),
47-
options.ScannerWithDebug(&debugBuf),
4850
)
4951

5052
err := scanner.LoadPolicies(false, false, testEmbedFS, []string{"."}, nil)
5153
require.NoError(t, err)
5254

53-
assert.Contains(t, debugBuf.String(), "Error occurred while parsing: testdata/policies/invalid.rego, testdata/policies/invalid.rego:7")
55+
assert.Contains(t, debugBuf.String(), "Error occurred while parsing\tfile_path=\"testdata/policies/invalid.rego\" err=\"testdata/policies/invalid.rego:7")
5456
})
5557

5658
t.Run("schema does not exist", func(t *testing.T) {

‎pkg/iac/rego/scanner.go

Lines changed: 16 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,13 @@ import (
1515
"github.com/open-policy-agent/opa/storage"
1616
"github.com/open-policy-agent/opa/util"
1717

18-
"github.com/aquasecurity/trivy/pkg/iac/debug"
1918
"github.com/aquasecurity/trivy/pkg/iac/framework"
2019
"github.com/aquasecurity/trivy/pkg/iac/providers"
2120
"github.com/aquasecurity/trivy/pkg/iac/rego/schemas"
2221
"github.com/aquasecurity/trivy/pkg/iac/scan"
2322
"github.com/aquasecurity/trivy/pkg/iac/scanners/options"
2423
"github.com/aquasecurity/trivy/pkg/iac/types"
24+
"github.com/aquasecurity/trivy/pkg/log"
2525
)
2626

2727
var checkTypesWithSubtype = map[types.Source]struct{}{
@@ -51,7 +51,7 @@ type Scanner struct {
5151
runtimeValues *ast.Term
5252
compiler *ast.Compiler
5353
regoErrorLimit int
54-
debug debug.Logger
54+
logger *log.Logger
5555
traceWriter io.Writer
5656
tracePerResult bool
5757
retriever *MetadataRetriever
@@ -113,10 +113,6 @@ func (s *Scanner) SetPolicyReaders(_ []io.Reader) {
113113
// NOTE: Policy readers option not applicable for rego, policies are loaded on-demand by other scanners.
114114
}
115115

116-
func (s *Scanner) SetDebugWriter(writer io.Writer) {
117-
s.debug = debug.New(writer, "rego", "scanner")
118-
}
119-
120116
func (s *Scanner) SetTraceWriter(writer io.Writer) {
121117
s.traceWriter = writer
122118
}
@@ -166,6 +162,7 @@ func NewScanner(source types.Source, opts ...options.ScannerOption) *Scanner {
166162
sourceType: source,
167163
ruleNamespaces: make(map[string]struct{}),
168164
runtimeValues: addRuntimeValues(),
165+
logger: log.WithPrefix("rego"),
169166
customSchemas: make(map[string][]byte),
170167
}
171168

@@ -183,10 +180,6 @@ func NewScanner(source types.Source, opts ...options.ScannerOption) *Scanner {
183180
return s
184181
}
185182

186-
func (s *Scanner) SetParentDebugLogger(l debug.Logger) {
187-
s.debug = l.Extend("rego")
188-
}
189-
190183
func (s *Scanner) runQuery(ctx context.Context, query string, input ast.Value, disableTracing bool) (rego.ResultSet, []string, error) {
191184

192185
trace := (s.traceWriter != nil || s.tracePerResult) && !disableTracing
@@ -247,7 +240,7 @@ func GetInputsContents(inputs []Input) []any {
247240

248241
func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results, error) {
249242

250-
s.debug.Log("Scanning %d inputs...", len(inputs))
243+
s.logger.Debug("Scannning inputs", "count", len(inputs))
251244

252245
var results scan.Results
253246

@@ -267,9 +260,11 @@ func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results,
267260

268261
staticMeta, err := s.retriever.RetrieveMetadata(ctx, module, GetInputsContents(inputs)...)
269262
if err != nil {
270-
s.debug.Log(
271-
"Error occurred while retrieving metadata from check %q: %s",
272-
module.Package.Location.File, err)
263+
s.logger.Error(
264+
"Error occurred while retrieving metadata from check",
265+
log.FilePath(module.Package.Location.File),
266+
log.Err(err),
267+
)
273268
continue
274269
}
275270

@@ -300,9 +295,12 @@ func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results,
300295
if isEnforcedRule(ruleName) {
301296
ruleResults, err := s.applyRule(ctx, namespace, ruleName, inputs, staticMeta.InputOptions.Combined)
302297
if err != nil {
303-
s.debug.Log(
304-
"Error occurred while applying rule %q from check %q: %s",
305-
ruleName, module.Package.Location.File, err)
298+
s.logger.Error(
299+
"Error occurred while applying rule from check",
300+
log.String("rule", ruleName),
301+
log.FilePath(module.Package.Location.File),
302+
log.Err(err),
303+
)
306304
continue
307305
}
308306
results = append(results, s.embellishResultsWithRuleMetadata(ruleResults, *staticMeta)...)
@@ -390,7 +388,7 @@ func (s *Scanner) applyRule(ctx context.Context, namespace, rule string, inputs
390388
s.trace("INPUT", input)
391389
parsedInput, err := parseRawInput(input.Contents)
392390
if err != nil {
393-
s.debug.Log("Error occurred while parsing input: %s", err)
391+
s.logger.Error("Error occurred while parsing input", log.Err(err))
394392
continue
395393
}
396394
if ignored, err := s.isIgnored(ctx, namespace, rule, parsedInput); err != nil {

‎pkg/iac/rego/scanner_test.go

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -998,19 +998,15 @@ deny {
998998
},
999999
}
10001000

1001-
var buf bytes.Buffer
10021001
scanner := NewScanner(
10031002
types.SourceYAML,
1004-
options.ScannerWithDebug(&buf),
10051003
)
10061004
require.NoError(
10071005
t,
10081006
scanner.LoadPolicies(false, false, fsys, []string{"checks"}, nil),
10091007
)
10101008
_, err := scanner.ScanInput(context.TODO(), Input{})
10111009
require.NoError(t, err)
1012-
assert.Contains(t, buf.String(),
1013-
`Error occurred while applying rule "deny" from check "checks/bad.rego"`)
10141010
}
10151011

10161012
func Test_RegoScanning_WithDeprecatedCheck(t *testing.T) {

0 commit comments

Comments
 (0)