Feat/logging btp (#51)

* feat: logging on BTP

* fix: owasp checks

owasp/suppressions.xml

@@ -24,4 +24,8 @@
     <cve>CVE-2018-1272</cve>
     <cve>CVE-2020-5421</cve>
   </suppress>
+  <suppress>
+    <!--  Vulnerability impacts WebFlux apps only and can be ignored here.  -->
+    <cve>CVE-2021-22118</cve>
+  </suppress>
 </suppressions>

pom.xml

@@ -38,7 +38,7 @@
     <bcpkix.version>1.68</bcpkix.version>
     <okhttp.version>4.9.1</okhttp.version>
     <shedlock.version>4.23.0</shedlock.version>
-    <dgc.lib.version>0.4.5</dgc.lib.version>
+    <dgc.lib.version>0.5.0</dgc.lib.version>
     <!-- plugins -->
     <plugin.checkstyle.version>3.1.2</plugin.checkstyle.version>
     <plugin.sonar.version>3.6.1.1688</plugin.sonar.version>
@@ -256,6 +256,10 @@
       <groupId>com.sap.cloud.sdk.cloudplatform</groupId>
       <artifactId>scp-cf</artifactId>
     </dependency>
+    <dependency>
+      <groupId>com.sap.hcp.cf.logging</groupId>
+      <artifactId>cf-java-logging-support-logback</artifactId>
+    </dependency>
   </dependencies>
 
   <build>

src/main/java/eu/europa/ec/dgc/verifier/service/SignerCertificateDownloadBtpServiceImpl.java

@@ -197,7 +197,7 @@ private boolean trustListItemSignedByCa(TrustListItemDto certificate, X509Certif
         try {
             return dcs.isSignatureValid(verifier);
         } catch (RuntimeOperatorException | CertException e) {
-            log.debug("Could not verify that certificate was issued by ca. Certificate: {}, CA: {}",
+            log.trace("Could not verify that certificate was issued by ca. Certificate: {}, CA: {}",
                 dcs.getSubject().toString(), ca.getSubject().toString());
             return false;
         }

src/main/resources/logback-spring.xml

@@ -0,0 +1,25 @@
+<configuration debug="false" scan="false">
+
+  <springProfile name="!btp">
+    <include resource="org/springframework/boot/logging/logback/defaults.xml"/>
+    <include resource="org/springframework/boot/logging/logback/console-appender.xml"/>
+
+    <logger name="eu.europa.ec" level="DEBUG"/>
+    <root level="INFO">
+      <appender-ref ref="CONSOLE"/>
+    </root>
+  </springProfile>
+
+  <springProfile name="btp">
+    <appender name="STDOUT-JSON" class="ch.qos.logback.core.ConsoleAppender">
+      <encoder class="com.sap.hcp.cf.logback.encoder.JsonEncoder"/>
+    </appender>
+
+    <root level="${LOG_ROOT_LEVEL:-WARN}">
+      <appender-ref ref="STDOUT-JSON"/>
+    </root>
+
+    <logger name="eu.europa.ec" level="DEBUG"/>
+  </springProfile>
+
+</configuration>