ed3a5af7
logging: the instance's slog policy, without the handler
middleware.RecoverPanics reports panics through slog's default logger, so ecore already depends on every service installing a compatible handler and had no way to say so. A service that forgets slog.SetDefault prints its panic reports in Go's plain format, unlevelled and unmasked, into a journal where everything else is tinted. Six services (compare, spec, dolt, cover, bench, tokens) had each written the same level parser, the same os.Stderr.Stat colour probe, the same -d scan of os.Args, and their own copy of the credential mask list. The copies had drifted into three key sets and four patterns: only spec masked the config private keys, only tokens-migrate knew a DSN carries a password, and only dolt masked pubkey and credential. What is redacted — the unified-login cookie, tokens.sr.ht working tokens, the Authorization header they ride in — is a fact about the instance, so it is maintained once. Defaults() resolves the policy and Install() sets the default logger; the handler stays with the caller, because ecore is a small SourceHut library and auxilia is a large general one, and a service that wants a JSON handler for a log shipper should not link a tinting one to share a mask list. Options.ReplaceAttr applies the same masking through stdlib slog alone, so the split costs a non-scribe service nothing. tokens.sr.ht's partial mask is exported but not defaulted: six characters of a live working token is still six characters of a live working token. Level: -d, then $LOG_LEVEL, then [section]log-level, then info; an unreadable value falls through to the next source rather than refusing to boot.
Eugene Blikh <bigbes@gmail.com> — 2026-08-08 21:00:03 UTC
Commit ed3a5af7c35ef37e83608e9fb214412730535ce4 —
view raw patch
Parent(s):
66c00770
| File | Status | + | − |
|---|---|---|---|
logging/logging.go
|
A | +399 | |
logging/logging_test.go
|
A | +359 |