sonatype-nexus-community / cargo-pants

Apache License 2.0
28 stars 9 forks source link

Replace log4rs with tracing #60

Closed amy-keibler closed 2 years ago

amy-keibler commented 2 years ago

log4rs has a transitive dependency on traitobject that has a vulnerability. There hasn't been a release of log4rs in 11 months, so the vulnerability will not likely be addressed in the near future.

tracing is a logging/tracing framework from the Tokio project that is compatible with the output of the log crate, but provides additional constructs such as spans to make debugging easier compared to correlating lines of output.

This change should be approximately equivalent to the previous solution. An added benefit is that five verbose arguments (-vvvvv) cause us to read the RUST_LOG environment variable for a tracing directive (documentation). This directive can be used to target a specific subsection of the program or a dependency, without turning up the logging level for everything (e.g. RUST_LOG=debug,reqwest=trace to investigate a network issue).

Additionally, this change includes some code cleanup changes such as removing the old crate macro import syntax for serde and removing a ternary macro.

Fixes #59

amy-keibler commented 2 years ago

Yay, finally passing CI ✅

amy-keibler commented 2 years ago

Good question! I think leaving the empty .pants-ignore ignore list is probably best, so I added that to these changes.