gocsaf / csaf

Tools to download or provide CSAF (Common Security Advisory Framework) documents.
https://csaf.io
40 stars 23 forks source link

Improve output when PMD is invalid #385

Open tschmidtb51 opened 1 year ago

tschmidtb51 commented 1 year ago

Currently, we need to find a valid PMD to run the checks. However, that does not help the user, if he made a mistake in creating the PMD. We should provide more insights (JSON parse, JSON schema validation, etc.) what went wrong to support the users.

tschmidtb51 commented 1 year ago

Out of scope for 2.2.0

oxisto commented 7 months ago

We were discussing about this internally... Are you referring to the details that are gathered internally, for example here: https://github.com/csaf-poc/csaf_distribution/blob/d909e9de151d5845fe0c0d5b9db2152f9db25e90/cmd/csaf_checker/processor.go#L501-L509

or here

https://github.com/csaf-poc/csaf_distribution/blob/d909e9de151d5845fe0c0d5b9db2152f9db25e90/cmd/csaf_checker/processor.go#L525-L527

The latter already includes all error message related to JSON parsing and validation and publishes it to the "badProviderMetadata" feed.

Currently, it seems that this is already gathered in the topics, but there is no way to actually output the error message. Instead, only Could not parse the Provider-Metadata.json of is printed. Would it make sense to tie-in the structured logging into the "topics" and then provide error/warn/info log output based on the contents of the topic. If you are interested, my colleague @lebogg can have a look at this.

lebogg commented 7 months ago

As @oxisto already mentioned, a possible and trivial solution would be to add logging to the topicMessages' methods:

@@ -127,16 +127,22 @@ func (m *topicMessages) add(typ MessageType, format string, args ...any) {
 // error adds an error message to this topic.
 func (m *topicMessages) error(format string, args ...any) {
        m.add(ErrorType, format, args...)
+       // Print messages to notify user what went wrong
+       slog.Error(format, args)
 }

 // warn adds a warning message to this topic.
 func (m *topicMessages) warn(format string, args ...any) {
        m.add(WarnType, format, args...)
+       // Log message to warn user what maybe went wrong
+       slog.Warn(format, args)
 }

 // info adds an info message to this topic.
 func (m *topicMessages) info(format string, args ...any) {
        m.add(InfoType, format, args...)
+       // Log message to notify user what happened
+       slog.Info(format, args)
 }

 // use signals that we going to use this topic.

Or did you have something else in mind?

bernhardreiter commented 2 months ago

Sounds good to allow the details of failed JSON parsing or schema check to be communicated to the user. This is for the PMD, but we should also do it for the documents itself, see sister issue #572.

We should check if the downloader and aggregator should also get that diagnostic messages (so they can enable it) or if they could get a message like: Use the checker to see more.