Fuzzyhashing

[mcutshaw]

Summary

If merged this pull request will address #149

Proposed changes

This request adds a fuzzy hash plugin using SSDEEP and TLSH. It places output in the metadata field of the main output BOM.

[nightlark]

Awesome! I'm out this upcoming week on vacation with limited internet access, so I might not be able to fully review the changes until March 11.

Initial thoughts are that overall it looks good, the main things are:

• pre-commit lint check about using a generator instead of all with a list comprehension (or restructure it to avoid creating list in order to perform the check)
• adding a brief docstring description for the fuzzy hashes hookimpl function
• the description in the pyproject.toml file looks like it may need updating
• maybe some error checks can be added to detect if there is an issue with the copy of ssdeep that was installed?

[mcutshaw]

Awesome! I'm out this upcoming week on vacation with limited internet access, so I might not be able to fully review the changes until March 11.

Initial thoughts are that overall it looks good, the main things are:

* pre-commit lint check about using a generator instead of `all` with a list comprehension (or restructure it to avoid creating list in order to perform the check)

* adding a brief docstring description for the fuzzy hashes hookimpl function

* the description in the pyproject.toml file looks like it may need updating

* maybe some error checks can be added to detect if there is an issue with the copy of `ssdeep` that was installed?

The requested changes have been made. Also I made SSDEEP its own dependency group, and check whether we can import it. If we can't we just run with TLSH, hopefully that should simplify things.

[mcutshaw]

@nightlark Would you be able to review the most recent changes?

[nightlark]

The check for SSDEEP as an optional dependency looks like a good option -- I opened an issue on the python-ssdeep repository about pre-compiled binary wheels for common platforms, and checking on the maintenance status. It seems like the python-ssdeep package likely doesn't have an active maintainer at the moment.

[nightlark]

I had some issues with ssdeep, which I think are related to the ssdeep python package itself (build errors, returned string from ssdeep.hash a string in the form b'<hash>' which looks like it is returning bytes turned into a str instead of just a str).