feat: Add macOS Unified Logging receiver implementation (#44434)

<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->
#### Description
Second PR for the `macosunifiedloggingreceiver`, adds the actual
receiver implementation and unit tests.

<!-- Issue number (e.g. #1234) or full URL to issue, if applicable. -->
#### Link to tracking issue
#44089

<!--Describe what testing was performed and which tests were added.-->
#### Testing
Added unit tests from downstream - confirmed all passing.
Temporarily added the receiver to `builder-config.yaml`, confirmed the
collector built and the receiver ran successfully.

<!--Please delete paragraphs that you did not use before submitting.-->

Author: Caleb-Hurshman

.chloggen/feat_macosunifiedloggingreceiver-implementation.yaml

@@ -0,0 +1,27 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: new_component
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/filelog)
+component: receiver/macosunifiedlogging
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Implementation of the macOS Unified Logging Receiver.
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [44089]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]

receiver/macosunifiedloggingreceiver/config_common.go

@@ -18,7 +18,8 @@ type Config struct {
 	// resolvedArchivePaths stores the expanded archive paths after glob resolution
 	// This is populated during Validate() and not exposed to users
 	// Only used on darwin platform (see config.go)
-	//nolint:unused
+	//
+	//nolint:unused // only used on darwin platform
 	resolvedArchivePaths []string
 
 	// Predicate is a filter predicate to pass to the log command

receiver/macosunifiedloggingreceiver/config_test.go

@@ -6,7 +6,6 @@
 package macosunifiedloggingreceiver
 
 import (
-	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -19,108 +18,201 @@ import (
 func TestConfigValidate(t *testing.T) {
 	testCases := []struct {
 		desc        string
-		cfg         *Config
-		expectedErr error
+		makeCfg     func(t *testing.T) *Config
+		expectedErr string
 	}{
 		{
 			desc: "valid config - live mode",
-			cfg: &Config{
-				MaxPollInterval: 50 * time.Second,
-				MaxLogAge:       12 * time.Hour,
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					MaxPollInterval: 50 * time.Second,
+					MaxLogAge:       12 * time.Hour,
+				}
 			},
-			expectedErr: nil,
 		},
 		{
 			desc: "invalid archive path - does not exist",
-			cfg: &Config{
-				ArchivePath: "/tmp/test/invalid",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					ArchivePath: filepath.Join(t.TempDir(), "missing", "logs.logarchive"),
+				}
 			},
-			expectedErr: errors.New("no such file or directory"),
+			expectedErr: "no such file or directory",
 		},
 		{
 			desc: "invalid archive path - not a directory",
-			cfg: &Config{
-				ArchivePath: "./README.md",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					ArchivePath: "./README.md",
+				}
+			},
+			expectedErr: "must be a directory",
+		},
+		{
+			desc: "archive glob requires at least one match",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					ArchivePath: filepath.Join(t.TempDir(), "*.logarchive"),
+				}
+			},
+			expectedErr: "no archive paths matched the provided pattern",
+		},
+		{
+			desc: "end time requires archive path",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					EndTime: "2024-01-02 00:00:00",
+				}
 			},
-			expectedErr: errors.New("must be a directory"),
+			expectedErr: "end_time can only be used with archive_path",
 		},
 		{
 			desc: "valid predicate with AND",
-			cfg: &Config{
-				Predicate: "subsystem == 'com.apple.example' AND messageType == 'Error'",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == 'com.apple.example' AND messageType == 'Error'",
+				}
 			},
-			expectedErr: nil,
 		},
 		{
 			desc: "valid predicate with && (normalized to AND)",
-			cfg: &Config{
-				Predicate: "subsystem == 'com.apple.example' && messageType == 'Error'",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == 'com.apple.example' && messageType == 'Error'",
+				}
 			},
-			expectedErr: nil,
 		},
 		{
 			desc: "valid predicate with || (normalized to OR)",
-			cfg: &Config{
-				Predicate: "subsystem == 'com.apple.example' || messageType == 'Error'",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == 'com.apple.example' || messageType == 'Error'",
+				}
 			},
-			expectedErr: nil,
 		},
 		{
 			desc: "valid predicate with comparison operators",
-			cfg: &Config{
-				Predicate: "processID > 100 && processID < 1000",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "processID > 100 && processID < 1000",
+				}
 			},
-			expectedErr: nil,
 		},
 		{
 			desc: "valid predicate with > comparison and spaces",
-			cfg: &Config{
-				Predicate: "processID >100",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "processID >100",
+				}
 			},
-			expectedErr: nil,
 		},
 		{
 			desc: "invalid predicate - semicolon",
-			cfg: &Config{
-				Predicate: "subsystem == 'test'; curl http://evil.com",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == 'test'; curl http://evil.com",
+				}
 			},
-			expectedErr: errors.New("predicate contains invalid character"),
+			expectedErr: "predicate contains invalid character",
 		},
 		{
 			desc: "invalid predicate - pipe",
-			cfg: &Config{
-				Predicate: "subsystem == 'test' | sh",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == 'test' | sh",
+				}
 			},
-			expectedErr: errors.New("predicate contains invalid character"),
+			expectedErr: "predicate contains invalid character",
 		},
 		{
 			desc: "invalid predicate - dollar sign",
-			cfg: &Config{
-				Predicate: "subsystem == '$HOME'",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == '$HOME'",
+				}
 			},
-			expectedErr: errors.New("predicate contains invalid character"),
+			expectedErr: "predicate contains invalid character",
 		},
 		{
 			desc: "invalid predicate - backtick",
-			cfg: &Config{
-				Predicate: "subsystem == '`whoami`'",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == '`whoami`'",
+				}
 			},
-			expectedErr: errors.New("predicate contains invalid character"),
+			expectedErr: "predicate contains invalid character",
 		},
 		{
 			desc: "invalid predicate - append redirect",
-			cfg: &Config{
-				Predicate: "subsystem == 'test' >> /tmp/output",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem == 'test' >> /tmp/output",
+				}
+			},
+			expectedErr: "predicate contains invalid character",
+		},
+		{
+			desc: "predicate must contain valid field name",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "unknownField == 'value'",
+				}
+			},
+			expectedErr: "predicate must contain at least one valid field name",
+		},
+		{
+			desc: "predicate must contain operator",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "subsystem 'com.apple'",
+				}
+			},
+			expectedErr: "predicate must contain at least one valid operator",
+		},
+		{
+			desc: "predicate must contain valid event type when type is referenced",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "type == 'invalidEvent'",
+				}
+			},
+			expectedErr: "predicate must contain at least one valid event type",
+		},
+		{
+			desc: "predicate must contain valid log type when logType is referenced",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "logType == 'invalid'",
+				}
+			},
+			expectedErr: "predicate must contain at least one valid log type",
+		},
+		{
+			desc: "predicate must contain valid signpost scope when signpostScope is referenced",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "signpostScope == 'invalid'",
+				}
+			},
+			expectedErr: "predicate must contain at least one valid signpost scope",
+		},
+		{
+			desc: "predicate must contain valid signpost type when signpostType is referenced",
+			makeCfg: func(t *testing.T) *Config {
+				return &Config{
+					Predicate: "signpostType == 'invalid'",
+				}
 			},
-			expectedErr: errors.New("predicate contains invalid character"),
+			expectedErr: "predicate must contain at least one valid signpost type",
 		},
 	}
 
 	for _, tc := range testCases {
 		t.Run(tc.desc, func(t *testing.T) {
-			err := tc.cfg.Validate()
-			if tc.expectedErr != nil {
-				require.ErrorContains(t, err, tc.expectedErr.Error())
+			cfg := tc.makeCfg(t)
+			err := cfg.Validate()
+			if tc.expectedErr != "" {
+				require.ErrorContains(t, err, tc.expectedErr)
 			} else {
 				require.NoError(t, err)
 			}

receiver/macosunifiedloggingreceiver/go.mod

@@ -18,6 +18,7 @@ require (
 )
 
 require (
+	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect