fix: logger initialization before flags parsing

[DmitriyLewen]

Description

We need to init logger before flags parsing to avoid wrong log messages format.

before:

➜  trivy -d image alpine -c config.yaml --vuln-type os 
2024/08/22 14:09:16 WARN '--vuln-type' is deprecated. Use '--pkg-types' instead.
2024/08/22 14:09:16 INFO Loaded file_path=config.yaml
2024-08-22T14:09:16+06:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
...

➜ trivy -q image alpine -c config.yaml --vuln-type os  
2024/08/22 16:22:17 WARN '--vuln-type' is deprecated. Use '--pkg-types' instead.
2024/08/22 16:22:17 INFO Loaded file_path=config.yaml

alpine (alpine 3.20.2)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

after

➜  trivy -d image alpine -c config.yaml --vuln-type os
2024-08-22T14:08:58+06:00       WARN    '--vuln-type' is deprecated. Use '--pkg-types' instead.
2024-08-22T14:08:58+06:00       INFO    Loaded  file_path="config.yaml"
2024-08-22T14:08:58+06:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
...

➜ trivy -q image alpine -c config.yaml --vuln-type os

alpine (alpine 3.20.2)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Related issues

• Close bug(log): incorrect log format for flag messages #7124

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

I simply added init logger before parsing flags.
But there is a problem logs from app and flags packages:
if the --quiet flag is used - we still show the logs or don't show debug logs:

➜  ./trivy -q image alpine -c config.yaml --vuln-type os
2024-08-22T16:17:11+06:00       WARN    '--vuln-type' is deprecated. Use '--pkg-types' instead.
2024-08-22T16:17:11+06:00       INFO    Loaded  file_path="config.yaml"

alpine (alpine 3.20.2)

As another way - I added DeferredLogger to save log messages and print them on command (in our case after logger initialization)
See 6ad1098

With this solution:

➜  ./trivy -q image alpine -c config.yaml --vuln-type os

alpine (alpine 3.20.2)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

@knqyf263 Can you take a look, when you have time, please?

[DmitriyLewen]

We can add this into:

trivy/pkg/log/logger.go

Lines 38 to 42 in 6ad1098

	func InitLogger(debug, disable bool) {
	level := lo.Ternary(debug, slog.LevelDebug, slog.LevelInfo)
	out := lo.Ternary(disable, io.Discard, io.Writer(os.Stderr))
	slog.SetDefault(New(NewHandler(out, &Options{Level: level})))
	}

But perhaps it won't be entirely obvious

[knqyf263]

I like the idea of DeferredLogger, but the current implementation allows us to miss log emissions before logger initialization. For example, although LoadAll() is called before parsing CLI flags, we forgot to replace it with log.DeferredLogger.

trivy/pkg/plugin/manager.go

Line 281 in 88ba460

m.logger.WarnContext(ctx, "Plugin load error", log.Err(err))

Thus, I think we should replace the default logger or handler.

Also, we need to handle WithPrefix and WithAttrs, but the current implementation doesn't work with them.

trivy/pkg/plugin/manager.go

Line 65 in 88ba460

logger: log.WithPrefix("plugin"),

To resolve these problems, I implemented DeferredHandler. PTAL, @DmitriyLewen.

[DmitriyLewen]

Nice upgrade of my idea!
Looks good.