assocaite signature warnings with the dependency that caused them (#6314)

motivation: better UX for warnings

changes: add metadata with the package information to the warnings emitted when checking package signatures

Author: tomerd

Sources/PackageRegistry/SignatureValidation.swift

@@ -148,21 +148,24 @@ struct SignatureValidation {
                 observabilityScope: observabilityScope,
                 completion: completion
             )
-        } catch RegistryError.sourceArchiveNotSigned(let registry, let package, let version) {
-            observabilityScope.emit(info: "\(package) \(version) from \(registry) is unsigned")
+        } catch RegistryError.sourceArchiveNotSigned {
+            observabilityScope.emit(
+                info: "\(package) \(version) from \(registry) is unsigned",
+                metadata: .registryPackageMetadata(identity: package)
+            )
             guard let onUnsigned = configuration.onUnsigned else {
                 return completion(.failure(RegistryError.missingConfiguration(details: "security.signing.onUnsigned")))
             }
 
             let sourceArchiveNotSignedError = RegistryError.sourceArchiveNotSigned(
                 registry: registry,
-                package: package,
+                package: package.underlying,
                 version: version
             )
 
             switch onUnsigned {
             case .prompt:
-                self.delegate.onUnsigned(registry: registry, package: package, version: version) { `continue` in
+                self.delegate.onUnsigned(registry: registry, package: package.underlying, version: version) { `continue` in
                     if `continue` {
                         completion(.success(.none))
                     } else {
@@ -172,7 +175,10 @@ struct SignatureValidation {
             case .error:
                 completion(.failure(sourceArchiveNotSignedError))
             case .warn:
-                observabilityScope.emit(warning: "\(sourceArchiveNotSignedError)")
+                observabilityScope.emit(
+                    warning: "\(sourceArchiveNotSignedError)",
+                    metadata: .registryPackageMetadata(identity: package)
+                )
                 completion(.success(.none))
             case .silentAllow:
                 // Continue without logging
@@ -283,21 +289,24 @@ struct SignatureValidation {
             )
         } catch ManifestSignatureParser.Error.malformedManifestSignature {
             completion(.failure(RegistryError.invalidSignature(reason: "manifest signature is malformed")))
-        } catch RegistryError.sourceArchiveNotSigned(let registry, let package, let version) {
-            observabilityScope.emit(info: "\(package) \(version) from \(registry) is unsigned")
+        } catch RegistryError.sourceArchiveNotSigned {
+            observabilityScope.emit(
+                info: "\(package) \(version) from \(registry) is unsigned",
+                metadata: .registryPackageMetadata(identity: package)
+            )
             guard let onUnsigned = configuration.onUnsigned else {
                 return completion(.failure(RegistryError.missingConfiguration(details: "security.signing.onUnsigned")))
             }
 
             let sourceArchiveNotSignedError = RegistryError.sourceArchiveNotSigned(
                 registry: registry,
-                package: package,
+                package: package.underlying,
                 version: version
             )
 
             switch onUnsigned {
             case .prompt:
-                self.delegate.onUnsigned(registry: registry, package: package, version: version) { `continue` in
+                self.delegate.onUnsigned(registry: registry, package: package.underlying, version: version) { `continue` in
                     if `continue` {
                         completion(.success(.none))
                     } else {
@@ -307,7 +316,10 @@ struct SignatureValidation {
             case .error:
                 completion(.failure(sourceArchiveNotSignedError))
             case .warn:
-                observabilityScope.emit(warning: "\(sourceArchiveNotSignedError)")
+                observabilityScope.emit(
+                    warning: "\(sourceArchiveNotSignedError)",
+                    metadata: .registryPackageMetadata(identity: package)
+                )
                 completion(.success(.none))
             case .silentAllow:
                 // Continue without logging
@@ -394,7 +406,10 @@ struct SignatureValidation {
                     case .error:
                         completion(.failure(signerNotTrustedError))
                     case .warn:
-                        observabilityScope.emit(warning: "\(signerNotTrustedError)")
+                        observabilityScope.emit(
+                            warning: "\(signerNotTrustedError)",
+                            metadata: .registryPackageMetadata(identity: package)
+                        )
                         completion(.success(.none))
                     case .silentAllow:
                         // Continue without logging
@@ -470,3 +485,12 @@ extension VerifierConfiguration {
         return verifierConfiguration
     }
 }
+
+extension ObservabilityMetadata {
+    public static func registryPackageMetadata(identity: PackageIdentity.RegistryIdentity) -> Self {
+        var metadata = ObservabilityMetadata()
+        metadata.packageIdentity = identity.underlying
+        metadata.packageKind = .registry(identity.underlying)
+        return metadata
+    }
+}

Tests/PackageRegistryTests/SignatureValidationTests.swift

@@ -161,7 +161,8 @@ final class SignatureValidationTests: XCTestCase {
         )
 
         testDiagnostics(observability.diagnostics) { result in
-            result.check(diagnostic: .contains("is not signed"), severity: .warning)
+            let diagnostics = result.check(diagnostic: .contains("is not signed"), severity: .warning)
+            XCTAssertEqual(diagnostics?.metadata?.packageIdentity, package.underlying)
         }
     }
 
@@ -446,7 +447,8 @@ final class SignatureValidationTests: XCTestCase {
         )
 
         testDiagnostics(observability.diagnostics) { result in
-            result.check(diagnostic: .contains("is not signed"), severity: .warning)
+            let diagnostics = result.check(diagnostic: .contains("is not signed"), severity: .warning)
+            XCTAssertEqual(diagnostics?.metadata?.packageIdentity, package.underlying)
         }
     }
 
@@ -1335,7 +1337,8 @@ final class SignatureValidationTests: XCTestCase {
         )
 
         testDiagnostics(observability.diagnostics) { result in
-            result.check(diagnostic: .contains("not trusted"), severity: .warning)
+            let diagnostics = result.check(diagnostic: .contains("not trusted"), severity: .warning)
+            XCTAssertEqual(diagnostics?.metadata?.packageIdentity, package.underlying)
         }
     }
 
@@ -1897,7 +1900,8 @@ final class SignatureValidationTests: XCTestCase {
         )
 
         testDiagnostics(observability.diagnostics) { result in
-            result.check(diagnostic: .contains("not trusted"), severity: .warning)
+            let diagnostics = result.check(diagnostic: .contains("not trusted"), severity: .warning)
+            XCTAssertEqual(diagnostics?.metadata?.packageIdentity, package.underlying)
         }
     }
     #endif