refactor(misconf): use slog (#7295)

Signed-off-by: nikpivkin <[email protected]>

pkg/commands/artifact/run.go

@@ -640,7 +640,6 @@ func initMisconfScannerOption(opts flag.Options) (misconf.ScannerOption, error)
  }
 
  return misconf.ScannerOption{
- Debug: opts.Debug,
  Trace: opts.Trace,
  Namespaces: append(opts.CheckNamespaces, rego.BuiltinNamespaces()...),
  PolicyPaths: append(opts.CheckPaths, downloadedPolicyPaths...),

pkg/iac/rego/load.go

@@ -10,6 +10,8 @@ import (
  "github.com/open-policy-agent/opa/ast"
  "github.com/open-policy-agent/opa/bundle"
  "github.com/samber/lo"
+
+ "github.com/aquasecurity/trivy/pkg/log"
 )
 
 var builtinNamespaces = map[string]struct{}{
@@ -61,14 +63,14 @@ func (s *Scanner) loadEmbedded() error {
  return fmt.Errorf("failed to load embedded rego libraries: %w", err)
  }
  s.embeddedLibs = loaded
- s.debug.Log("Loaded %d embedded libraries.", len(loaded))
+ s.logger.Debug("Embedded libraries are loaded", log.Int("count", len(loaded)))
 
  loaded, err = LoadEmbeddedPolicies()
  if err != nil {
- return fmt.Errorf("failed to load embedded rego policies: %w", err)
+ return fmt.Errorf("failed to load embedded rego checks: %w", err)
  }
  s.embeddedChecks = loaded
- s.debug.Log("Loaded %d embedded policies.", len(loaded))
+ s.logger.Debug("Embedded checks are loaded", log.Int("count", len(loaded)))
 
  return nil
 }
@@ -80,7 +82,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
  }
 
  if s.policyFS != nil {
- s.debug.Log("Overriding filesystem for checks!")
+ s.logger.Debug("Overriding filesystem for checks")
  srcFS = s.policyFS
  }
 
@@ -105,7 +107,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
  for name, policy := range loaded {
  s.policies[name] = policy
  }
- s.debug.Log("Loaded %d checks from disk.", len(loaded))
+ s.logger.Debug("Checks from disk are loaded", log.Int("count", len(loaded)))
  }
 
  if len(readers) > 0 {
@@ -116,7 +118,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
  for name, policy := range loaded {
  s.policies[name] = policy
  }
- s.debug.Log("Loaded %d checks from reader(s).", len(loaded))
+ s.logger.Debug("Checks from readers are loaded", log.Int("count", len(loaded)))
  }
 
  // gather namespaces
@@ -132,7 +134,7 @@ func (s *Scanner) LoadPolicies(enableEmbeddedLibraries, enableEmbeddedPolicies b
 
  dataFS := srcFS
  if s.dataFS != nil {
- s.debug.Log("Overriding filesystem for data!")
+ s.logger.Debug("Overriding filesystem for data")
  dataFS = s.dataFS
  }
  store, err := initStore(dataFS, s.dataDirs, namespaces)
@@ -168,15 +170,19 @@ func (s *Scanner) fallbackChecks(compiler *ast.Compiler) {
  continue
  }
 
- s.debug.Log("Error occurred while parsing: %s, %s. Trying to fallback to embedded check.", loc, e.Error())
+ s.logger.Error(
+ "Error occurred while parsing. Trying to fallback to embedded check",
+ log.FilePath(loc),
+ log.Err(e),
+ )
 
  embedded := s.findMatchedEmbeddedCheck(badPolicy)
  if embedded == nil {
- s.debug.Log("Failed to find embedded check: %s", loc)
+ s.logger.Error("Failed to find embedded check, skipping", log.FilePath(loc))
  continue
  }
 
- s.debug.Log("Found embedded check: %s", embedded.Package.Location.File)
+ s.logger.Debug("Found embedded check", log.FilePath(embedded.Package.Location.File))
  delete(s.policies, loc) // remove bad check
  s.policies[embedded.Package.Location.File] = embedded
  delete(s.embeddedChecks, embedded.Package.Location.File) // avoid infinite loop if embedded check contains ref error
@@ -214,15 +220,18 @@ func (s *Scanner) findMatchedEmbeddedCheck(badPolicy *ast.Module) *ast.Module {
 
 func (s *Scanner) prunePoliciesWithError(compiler *ast.Compiler) error {
  if len(compiler.Errors) > s.regoErrorLimit {
- s.debug.Log("Error(s) occurred while loading checks")
+ s.logger.Error("Error(s) occurred while loading checks")
  return compiler.Errors
  }
 
  for _, e := range compiler.Errors {
  if e.Location == nil {
  continue
  }
- s.debug.Log("Error occurred while parsing: %s, %s", e.Location.File, e.Error())
+ s.logger.Error(
+ "Error occurred while parsing",
+ log.FilePath(e.Location.File), log.Err(e),
+ )
  delete(s.policies, e.Location.File)
  }
  return nil
@@ -282,7 +291,11 @@ func (s *Scanner) filterModules(retriever *MetadataRetriever) error {
  return err
  }
  if len(meta.InputOptions.Selectors) == 0 {
- s.debug.Log("WARNING: Module %s has no input selectors - it will be loaded for all inputs!", name)
+ s.logger.Warn(
+ "Module has no input selectors - it will be loaded for all inputs!",
+ log.FilePath(module.Package.Location.File),
+ log.String("module", name),
+ )
  filtered[name] = module
  continue
  }

pkg/iac/rego/load_test.go

@@ -5,6 +5,7 @@ import (
  "embed"
  "fmt"
  "io"
+ "log/slog"
  "strings"
  "testing"
  "testing/fstest"
@@ -17,6 +18,7 @@ import (
  "github.com/aquasecurity/trivy/pkg/iac/rego"
  "github.com/aquasecurity/trivy/pkg/iac/scanners/options"
  "github.com/aquasecurity/trivy/pkg/iac/types"
+ "github.com/aquasecurity/trivy/pkg/log"
 )
 
 //go:embed all:testdata/policies
@@ -28,10 +30,10 @@ var embeddedChecksFS embed.FS
 func Test_RegoScanning_WithSomeInvalidPolicies(t *testing.T) {
  t.Run("allow no errors", func(t *testing.T) {
  var debugBuf bytes.Buffer
+ slog.SetDefault(log.New(log.NewHandler(&debugBuf, nil)))
  scanner := rego.NewScanner(
  types.SourceDockerfile,
  options.ScannerWithRegoErrorLimits(0),
- options.ScannerWithDebug(&debugBuf),
  )
 
  err := scanner.LoadPolicies(false, false, testEmbedFS, []string{"."}, nil)
@@ -41,16 +43,16 @@ func Test_RegoScanning_WithSomeInvalidPolicies(t *testing.T) {
 
  t.Run("allow up to max 1 error", func(t *testing.T) {
  var debugBuf bytes.Buffer
+ slog.SetDefault(log.New(log.NewHandler(&debugBuf, nil)))
  scanner := rego.NewScanner(
  types.SourceDockerfile,
  options.ScannerWithRegoErrorLimits(1),
- options.ScannerWithDebug(&debugBuf),
  )
 
  err := scanner.LoadPolicies(false, false, testEmbedFS, []string{"."}, nil)
  require.NoError(t, err)
 
- assert.Contains(t, debugBuf.String(), "Error occurred while parsing: testdata/policies/invalid.rego, testdata/policies/invalid.rego:7")
+ assert.Contains(t, debugBuf.String(), "Error occurred while parsing\tfile_path=\"testdata/policies/invalid.rego\" err=\"testdata/policies/invalid.rego:7")
  })
 
  t.Run("schema does not exist", func(t *testing.T) {

pkg/iac/rego/scanner.go

@@ -15,13 +15,13 @@ import (
  "github.com/open-policy-agent/opa/storage"
  "github.com/open-policy-agent/opa/util"
 
- "github.com/aquasecurity/trivy/pkg/iac/debug"
  "github.com/aquasecurity/trivy/pkg/iac/framework"
  "github.com/aquasecurity/trivy/pkg/iac/providers"
  "github.com/aquasecurity/trivy/pkg/iac/rego/schemas"
  "github.com/aquasecurity/trivy/pkg/iac/scan"
  "github.com/aquasecurity/trivy/pkg/iac/scanners/options"
  "github.com/aquasecurity/trivy/pkg/iac/types"
+ "github.com/aquasecurity/trivy/pkg/log"
 )
 
 var checkTypesWithSubtype = map[types.Source]struct{}{
@@ -51,7 +51,7 @@ type Scanner struct {
  runtimeValues *ast.Term
  compiler *ast.Compiler
  regoErrorLimit int
- debug  debug.Logger
+ logger *log.Logger
  traceWriter io.Writer
  tracePerResult bool
  retriever *MetadataRetriever
@@ -113,10 +113,6 @@ func (s *Scanner) SetPolicyReaders(_ []io.Reader) {
  // NOTE: Policy readers option not applicable for rego, policies are loaded on-demand by other scanners.
 }
 
-func (s *Scanner) SetDebugWriter(writer io.Writer) {
- s.debug = debug.New(writer, "rego", "scanner")
-}
-
 func (s *Scanner) SetTraceWriter(writer io.Writer) {
  s.traceWriter = writer
 }
@@ -166,6 +162,7 @@ func NewScanner(source types.Source, opts ...options.ScannerOption) *Scanner {
  sourceType: source,
  ruleNamespaces: make(map[string]struct{}),
  runtimeValues: addRuntimeValues(),
+ logger: log.WithPrefix("rego"),
  customSchemas: make(map[string][]byte),
  }
 
@@ -183,10 +180,6 @@ func NewScanner(source types.Source, opts ...options.ScannerOption) *Scanner {
  return s
 }
 
-func (s *Scanner) SetParentDebugLogger(l debug.Logger) {
- s.debug = l.Extend("rego")
-}
-
 func (s *Scanner) runQuery(ctx context.Context, query string, input ast.Value, disableTracing bool) (rego.ResultSet, []string, error) {
 
  trace := (s.traceWriter != nil || s.tracePerResult) && !disableTracing
@@ -247,7 +240,7 @@ func GetInputsContents(inputs []Input) []any {
 
 func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results, error) {
 
- s.debug.Log("Scanning %d inputs...", len(inputs))
+ s.logger.Debug("Scannning inputs", "count", len(inputs))
 
  var results scan.Results
 
@@ -267,9 +260,11 @@ func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results,
 
  staticMeta, err := s.retriever.RetrieveMetadata(ctx, module, GetInputsContents(inputs)...)
  if err != nil {
- s.debug.Log(
- "Error occurred while retrieving metadata from check %q: %s",
- module.Package.Location.File, err)
+ s.logger.Error(
+ "Error occurred while retrieving metadata from check",
+ log.FilePath(module.Package.Location.File),
+ log.Err(err),
+ )
  continue
  }
 
@@ -300,9 +295,12 @@ func (s *Scanner) ScanInput(ctx context.Context, inputs ...Input) (scan.Results,
  if isEnforcedRule(ruleName) {
  ruleResults, err := s.applyRule(ctx, namespace, ruleName, inputs, staticMeta.InputOptions.Combined)
  if err != nil {
- s.debug.Log(
- "Error occurred while applying rule %q from check %q: %s",
- ruleName, module.Package.Location.File, err)
+ s.logger.Error(
+ "Error occurred while applying rule from check",
+ log.String("rule", ruleName),
+ log.FilePath(module.Package.Location.File),
+ log.Err(err),
+ )
  continue
  }
  results = append(results, s.embellishResultsWithRuleMetadata(ruleResults, *staticMeta)...)
@@ -390,7 +388,7 @@ func (s *Scanner) applyRule(ctx context.Context, namespace, rule string, inputs
  s.trace("INPUT", input)
  parsedInput, err := parseRawInput(input.Contents)
  if err != nil {
- s.debug.Log("Error occurred while parsing input: %s", err)
+ s.logger.Error("Error occurred while parsing input", log.Err(err))
  continue
  }
  if ignored, err := s.isIgnored(ctx, namespace, rule, parsedInput); err != nil {

pkg/iac/rego/scanner_test.go

@@ -998,19 +998,15 @@ deny {
  },
  }
 
- var buf bytes.Buffer
  scanner := NewScanner(
  types.SourceYAML,
- options.ScannerWithDebug(&buf),
  )
  require.NoError(
  t,
  scanner.LoadPolicies(false, false, fsys, []string{"checks"}, nil),
  )
  _, err := scanner.ScanInput(context.TODO(), Input{})
  require.NoError(t, err)
- assert.Contains(t, buf.String(),
- `Error occurred while applying rule "deny" from check "checks/bad.rego"`)
 }
 
 func Test_RegoScanning_WithDeprecatedCheck(t *testing.T) {