sarif: initial implementation of csdiff fingerprints

[kdudka]

csdiff/v0 fingerprints

It hashes the data that csdiff uses in its matching algorithm.

From the updated tests it is obvious that these hashes already
have numerous collisions on the existing test data.

csdiff/v1 fingerprints

It hashes the data that csdiff uses in its matching algorithm
and the line content without spaces. For this fingerprint to
be computed, the results need to include the line content for
the key event in the format produced by csgrep --embed-context.

Related: https://issues.redhat.com/browse/OSH-9
Resolves: #98

[jamacku]

Great example when codeql fingerprints work:

• Fix curl Argument list too long by using a payload.json file redhat-plumbers-in-action/differential-shellcheck#376

✋ Defects, NEEDS INSPECTION
Error: SHELLCHECK_WARNING:
./src/functions.sh:309:46: warning[SC2154]: GITHUB_REF is referenced but not assigned.
#  306|   uploadSARIF () {
#  307|     is_debug && local verbose=--verbose
#  308|   
#  309|->   echo '{"commit_oid":"'"${HEAD}"'","ref":"'"${GITHUB_REF//merge/head}"'","analysis_key":"differential-shellcheck","sarif":"'"$(gzip -c output.sarif | base64 -w0)"'","tool_names":["differential-shellcheck"]}' > payload.json
#  310|   
#  311|     local curl_args=(
#  312|       "${verbose:---silent}"

Error: SHELLCHECK_WARNING:
./src/functions.sh:331:24: info[SC2312]: Consider invoking this command separately to avoid masking its return value (or use '|| true' to ignore).
#  328|   
#  329|   get_shellcheck_version () {
#  330|     local shellcheck_version
#  331|->   shellcheck_version=$(shellcheck --version | grep -w "version:" | cut -s -d ' ' -f 2)
#  332|   
#  333|     echo "${shellcheck_version}"
#  334|   }

Error: SHELLCHECK_WARNING:
./src/functions.sh:331:47: info[SC2312]: Consider invoking this command separately to avoid masking its return value (or use '|| true' to ignore).
#  328|   
#  329|   get_shellcheck_version () {
#  330|     local shellcheck_version
#  331|->   shellcheck_version=$(shellcheck --version | grep -w "version:" | cut -s -d ' ' -f 2)
#  332|   
#  333|     echo "${shellcheck_version}"
#  334|   }

The code hasn't changed for the last two defects, but they were still reported by csdiff.

I'll try to check if csdiff fingerprints would give the same results as codeql.

[jamacku]

Here is the csgrep output from before the change and after:

• before.json
• after.json

You should be able to reproduce the above situation form:

• Fix curl Argument list too long by using a payload.json file redhat-plumbers-in-action/differential-shellcheck#376

[kdudka]

@jamacku Nice! I have added it as a regression test in 95e35d3. It passes with ca7f32a but not without it.

[jamacku]

Thank you @kdudka

[lzaoral]

Somehow, the comment I've just written is not here. Reposting:

[lzaoral]

It's up to you if you want to use a move or copy constructor for the elements of the map. Otherwise, LGTM.

[kdudka]

@jamacku @lzaoral Thank you both for review!