Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Print traces and debug messages from OPA #1139

Merged
merged 2 commits into from
Nov 3, 2023

Conversation

zregvart
Copy link
Member

When running at trace log level the execution trace and debug messages will be printed to the log (stderr by default), and when running at the debug log level the execution traces will be omited.

For example:

$ ec validate image --policy $POLICY --image $IMAGE --trace
...
ime="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | | Redo true" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2965__ = data.lib.tasks_from_pipelinerun" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2708__ = [{\"annotations\": {\"custom\": {\"collections\": [\"redhat\"], \"depends_on\": [\"attestation_type.known_attestation_type\"], \"failure_msg\": \"Pipeline task '%s' uses an out of date task bundle '%s'\", \"short_name\": \"task_ref_bundles_current\", \"solution\": \"A task bundle used is not the most recent. The most recent task bundles are defined as in xref:acceptable_bundles.adoc#_task_bundles[acceptable bundles] list.\"}, \"description\": \"For each Task in the SLSA Provenance attestation, check if the Tekton Bundle used is the most recent xref:acceptable_bundles.adoc#_task_bundles[acceptable bundle].\", \"scope\": \"rule\", \"title\": \"Task bundles are latest versions\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\", \"warn\"]}, {\"annotations\": {\"description\": \"To be able to reproduce and audit builds accurately it's important to know exactly what happened during the build. To do this Enterprise Contract requires that all tasks are defined in a set of known and trusted task bundles. This package includes rules to confirm that the tasks that built the image were defined in task bundles, and that the task bundles used are from the list of known and trusted bundles.\", \"scope\": \"package\", \"title\": \"Task bundle checks\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\"]}]" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Unify set() = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Exit data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
$ ec validate image --policy $POLICY --image $IMAGE --debug
...
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"

@codecov
Copy link

codecov bot commented Oct 31, 2023

Codecov Report

Merging #1139 (8ac2d13) into main (abf42bb) will increase coverage by 0.62%.
Report is 1 commits behind head on main.
The diff coverage is 100.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #1139      +/-   ##
==========================================
+ Coverage   84.24%   84.86%   +0.62%     
==========================================
  Files          64       64              
  Lines        5097     5109      +12     
==========================================
+ Hits         4294     4336      +42     
+ Misses        803      773      -30     
Flag Coverage Δ
acceptance 70.18% <100.00%> (+0.82%) ⬆️
generative 4.50% <ø> (ø)
integration 18.91% <ø> (ø)
unit 76.75% <50.00%> (-0.16%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files Coverage Δ
internal/evaluator/conftest_evaluator.go 85.71% <100.00%> (+0.27%) ⬆️
internal/logging/logging.go 80.89% <100.00%> (+33.70%) ⬆️

When running at trace log level the execution trace and debug messages
will be printed to the log (stderr by default), and when running at the
debug log level the execution traces will be omited.

For example:
```
$ ec validate image --policy $POLICY --image $IMAGE --trace
...
ime="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | | Redo true" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2965__ = data.lib.tasks_from_pipelinerun" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2708__ = [{\"annotations\": {\"custom\": {\"collections\": [\"redhat\"], \"depends_on\": [\"attestation_type.known_attestation_type\"], \"failure_msg\": \"Pipeline task '%s' uses an out of date task bundle '%s'\", \"short_name\": \"task_ref_bundles_current\", \"solution\": \"A task bundle used is not the most recent. The most recent task bundles are defined as in xref:acceptable_bundles.adoc#_task_bundles[acceptable bundles] list.\"}, \"description\": \"For each Task in the SLSA Provenance attestation, check if the Tekton Bundle used is the most recent xref:acceptable_bundles.adoc#_task_bundles[acceptable bundle].\", \"scope\": \"rule\", \"title\": \"Task bundles are latest versions\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\", \"warn\"]}, {\"annotations\": {\"description\": \"To be able to reproduce and audit builds accurately it's important to know exactly what happened during the build. To do this Enterprise Contract requires that all tasks are defined in a set of known and trusted task bundles. This package includes rules to confirm that the tasks that built the image were defined in task bundles, and that the task bundles used are from the list of known and trusted bundles.\", \"scope\": \"package\", \"title\": \"Task bundle checks\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\"]}]" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Unify set() = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Exit data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
```

```
$ ec validate image --policy $POLICY --image $IMAGE --debug
...
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
```
@zregvart zregvart force-pushed the pr/trace-print branch 2 times, most recently from 20d4ab0 to eb7c3c4 Compare November 2, 2023 13:17
When running at trace log level the execution trace and debug messages
will be printed to the log (stderr by default), and when running at the
debug log level the execution traces will be omited.

For example:
```
$ ec validate image --policy $POLICY --image $IMAGE --trace
...
ime="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | | Redo true" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2965__ = data.lib.tasks_from_pipelinerun" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | | Redo __local2708__ = [{\"annotations\": {\"custom\": {\"collections\": [\"redhat\"], \"depends_on\": [\"attestation_type.known_attestation_type\"], \"failure_msg\": \"Pipeline task '%s' uses an out of date task bundle '%s'\", \"short_name\": \"task_ref_bundles_current\", \"solution\": \"A task bundle used is not the most recent. The most recent task bundles are defined as in xref:acceptable_bundles.adoc#_task_bundles[acceptable bundles] list.\"}, \"description\": \"For each Task in the SLSA Provenance attestation, check if the Tekton Bundle used is the most recent xref:acceptable_bundles.adoc#_task_bundles[acceptable bundle].\", \"scope\": \"rule\", \"title\": \"Task bundles are latest versions\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\", \"warn\"]}, {\"annotations\": {\"description\": \"To be able to reproduce and audit builds accurately it's important to know exactly what happened during the build. To do this Enterprise Contract requires that all tasks are defined in a set of known and trusted task bundles. This package includes rules to confirm that the tasks that built the image were defined in task bundles, and that the task bundles used are from the list of known and trusted bundles.\", \"scope\": \"package\", \"title\": \"Task bundle checks\"}, \"path\": [\"policy\", \"release\", \"attestation_task_bundle\"]}]" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Unify set() = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Exit data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=trace msg="[data.policy.release.attestation_task_bundle.warn] | Redo data.policy.release.attestation_task_bundle.warn = _" func=Run file=" conftest_evaluator.go:180"
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
```

```
$ ec validate image --policy $POLICY --image $IMAGE --debug
...
time="2023-10-31T12:56:37+01:00" level=debug msg="[data.policy.release.attestation_task_bundle.warn] /tmp/ec-work-321015487/policy/9af95111f/bundles.rego:31: HELLO\n" func=Run file=" conftest_evaluator.go:187"
```
"""
And the standard error should contain
"""
level=debug msg="\[data.main.deny\] .*/main.rego:13: here we are
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎉

@zregvart zregvart merged commit 3314714 into enterprise-contract:main Nov 3, 2023
10 checks passed
@zregvart zregvart deleted the pr/trace-print branch November 3, 2023 14:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants