debug logs contain %!w(...) instead of the error for credential helper and HTTP transport failures #1376

What is not working as expected?

Two logrus calls use %w in an Errorf format string:

• cmd/notation/internal/flag/options.go: logger.Errorf("finished executing credential helper program %s with action %s and got error %w", ...)
• internal/trace/transport.go: e.Errorf("Error in getting response: %w", err)

%w is only valid for fmt.Errorf. logrus formats with Sprintf, so with --debug the log line contains %!w(*errors.errorString=&{boom}) instead of the error message, for a failing credential helper and for a failing HTTP request. go vet does not report it because logrus is not recognized as a printf wrapper.

I found this by reading the code and checked it with two unit tests that capture the logger output, not by running the CLI.

What did you expect to happen?

The debug output shows the error message, for example ... and got error boom.

How can we reproduce it?

Run a command with --debug and a credential helper that fails or a request that fails at the transport level. The unit tests in the linked PR show the same output without the CLI.

Describe your environment

macOS, go1.26.3, notation main (9ba75db)

What is the version of your Notation CLI or Notation Library?

main (9ba75db)