oracle
feat: add local artifact command line argument
Summary
This PR adds a new command line argument for passing local artefacts to Macaron. These artefacts can be used in places where they would otherwise be downloaded. Primarily this is useful for GitHub attestation discovery, which requires the hash of an artefact in order to be used.
Description of changes
Local Artefact Changes
When retrieving hashes for GitHub attestation, any passed local artefact will be checked first. To better handle this new use case, the local artefact functions have been adjusted to make a distinction between directories and individual files. Therefore, when passing a local artefact argument, the directory lookup step is skipped allowing the file to be examined directly.
Database Recording
If an artefact hash is correctly retrieved as part of the analysis, details of the artefact and its hash will now be stored in the database under the ReleaseArtifact and HashDIgest tables respectively. This creates a record of the artefact that can be referenced even if the local file goes missing. The same has been applied for remote artefacts. It should be noted that the name field of the artefact table has been somewhat overloaded, with the local path or remote URL being used for that purpose. This may suggest that the table should needs adjustment.
__main__ Refactoring
As part of this PR, the creation steps of the various parser arguments in the __main__ script have been moved to relevant functions instead of all being in a single long function. Unfortunately, the Any type must be used for the parsers being passed to these functions, as the add_subparsers function reportedly returns an internal type.
Related issues
Closes #498
