Adding Google Magika Tastes

[phutelmyer]

Describe the change
This change is still in draft, but the idea was to add another form of file tasting: Google Magika

Describe testing procedures
Built and tested against files - no known issues with file tasting outside perhaps misattribution (no errors)

The only error comes with import "magic" inside taste.yara and any yara that uses magic. A conflict?

Sample output

{
  "magika": [
    "iso"
  ],
  "mime": [
    "application/octet-stream"
  ],
  "yara": [
    "onenote_file"
  ]
}

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of and tested my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

[ryanohoro]

The following types output by Magika on the Strelka test fixtures but are missing from backend.yml include the following. We should look at each and consider including them by default in their scanners (even disabled ones like ScanElf)

• application/javascript
• application/octet-stream
• application/vnd.debian.binary-package
• application/vnd.tcpdump.pcap
• application/x-apple-diskimage
• application/x-executable-elf
• application/x-mach-o
• application/x-ms-shortcut
• application/x-pem-file
• application/x-plist
• application/x-powershell (likely a false-positive type)
• application/x-yaml
• image/bmp
• text/csv
• text/vbscript
• video/mp4 (likely a false-positive type)

[ryanohoro]

Instead of using new types introduced by Magika, I'd suggest using MIME type output so that existing definitions can be used, but (hopefully) better covered by Magika analysis.

[ryanohoro]

At this point, I'd make typing with libmime, yara, and Magika clearly and independently configurable so that users have more control over how files get typed.

[ryanohoro]

Magika offers extra features that we should probably expose. For example, the PredictionMode should be user configurable (defaults to High). We could output the confidence score as well so analysts can get context for odd files.