Skip to content

fix: #161: replace prints with logs#772

Closed
ramonpetgrave64 wants to merge 3 commits intoslsa-framework:mainfrom
ramonpetgrave64:remove-print
Closed

fix: #161: replace prints with logs#772
ramonpetgrave64 wants to merge 3 commits intoslsa-framework:mainfrom
ramonpetgrave64:remove-print

Conversation

@ramonpetgrave64
Copy link
Copy Markdown
Contributor

@ramonpetgrave64 ramonpetgrave64 commented May 17, 2024

Addresses #161, and followup to #768

This PR replaces all fmt print statements with log/slog logs at appropriate levels.

for successes

2024/05/17 17:43:33 INFO Verified build using builder https://github.com/slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@refs/tags/v1.6.0 at commit b12088652ee70b25fcd64efd002aa851c6e247fe
2024/05/17 17:43:33 INFO Verifying npm package ../stuff/actions-test.tgz: PASSED

2024/05/17 17:43:33 INFO PASSED: Verified SLSA provenance

and for failures

2024/05/17 17:44:54 ERROR Verifying npm package ../stuff/actions-test.tgz: FAILED: builderID does not match provenance: expected name 'https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml', got 'https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builer_nodejs_slsa3.yml'

2024/05/17 17:44:54 ERROR FAILED: SLSA verification failed: builderID does not match provenance: expected name 'https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml', got 'https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builer_nodejs_slsa3.yml'
exit status 1

If you're using slsa-verifier as a library, you can suppress INFO logs by invoking

slog.SetLogLoggerLevel(slog.LevelError)

}

builderID = outBuilderID
fmt.Fprintf(os.Stderr, "Verifying npm package %s: PASSED\n\n", tarball)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

where does slog write the result? We need to ensure compatibility and ensure it's written to stderr when fmt.Fprintf(os.Stderr. Otherwise folks won't be able to pipe the result into jq or other tools: jq will pick not just the printed provenance, but the other messages too.

I think before changing this API we should define what the interface is for our logger. And we should provide an interface as logger, so that callers can customize how they log. Here's a fast logging library https://github.com/uber-go/zap, among others, that would need to be instantiable by callers

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I confirmed that by default slog will send to stderr. And then I removed the changes against fmt.Fprintf(os.Stdout, ... statements.

I'll look into how to best allow caller-provided loggers.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FWIW, I'm personally in favor of using the stdlib logging packages rather than including a dependency.

Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants