add sha256 checksum to json

[arlimus]

Fixes #1658

Signed-off-by: Dominik Richter dominik.richter@gmail.com

[alexpop]

Nicely done Dom, works as expected:

$ bundle exec inspec exec ~/git/mycompliance-profile/mylinux.tar.gz https://github.com/dev-sec/apache-baseline/archive/master.zip --format json | jq . | grep sha256
      "sha256": "ddee0a628a81c947edd6ffec146a2fb1e2fe1b3e556ff4e6122b5d7ca92e9657"
      "sha256": "3e1310b071dc4d706263e9d07083e10a92b4b69e4a36cffa1eda7eaecc09969a"

$ bundle exec inspec json ~/git/mycompliance-profile/mylinux/ | jq . | grep sha256
  "sha256": "ddee0a628a81c947edd6ffec146a2fb1e2fe1b3e556ff4e6122b5d7ca92e9657"

$ echo ' ' >> ~/git/mycompliance-profile/mylinux/inspec.yml

$ bundle exec inspec json ~/git/mycompliance-profile/mylinux/ | jq . | grep sha256
  "sha256": "479b196e121dd93ba767d7019647f0c48fbbbf099c4301cbc57fb5034acdf207"

Shouldn't json-min contain this field as well?

[arlimus]

@alexpop you are spot on about json-min 😁 I wanted to do this step first and let json-min come in another PR.

[chris-rock]

Great addition @arlimus

[adamleff]

Before we merge, any chance we can add a test with an existing dummy profile that checks to ensure we return the correct checksum for the contents? I don't see any tests for the sha256 method.

Otherwise, this is awesome.

[arlimus]

@adamleff I had a test in the functional bits: https://github.com/chef/inspec/pull/1796/files#diff-ce23f8753648cc3a9d77312e123c452cR61

I will add the unit test as well, thank you for the suggestion @adamleff !