Add signed-package verification and anti-rootkit cross-view (v0.7)

Closes the tamper-evidence loop with two trust anchors the attacker can't
forge from userland:

- pkgdb Layer 2: verify on-disk files against the .MTREE in the *signed*
  cache package, surviving a rewritten local checksum DB. Rotating-sample
  cadence keeps it affordable; flags pkg_signature_mismatch (sid 100027)
  and SigLevel downgrades (sid 100026). Fixes parse_mtree, which required
  type=file on every line and so matched nothing on real pacman MTREEs
  (which use a /set type=file default with bare file entries).
- rootcheck: anti-rootkit cross-view — hidden processes, modules, ports,
  and promiscuous interfaces, each caught by diffing two views of the
  same state (sids 100022-100025).

Wired both through config, the daemon (off-loop slow cadence), and CLI
(pkgdb-verify, rootcheck). 14 new tests (95 total). Docs + version bump.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_tamper.py

@@ -73,6 +73,92 @@ class TestPacmanLogParse(unittest.TestCase):
         Path(path).unlink()
 
 
+class TestSigLevel(unittest.TestCase):
+    def test_insecure_tokens_detected(self):
+        self.assertTrue(pkgdb.siglevel_insecure("Never"))
+        self.assertTrue(pkgdb.siglevel_insecure("Optional TrustAll"))
+        self.assertFalse(pkgdb.siglevel_insecure("Required DatabaseOptional"))
+
+    def test_parse_global_only_reads_options_section(self):
+        conf = (
+            "[options]\n"
+            "SigLevel = Required DatabaseOptional\n"
+            "[core]\n"
+            "SigLevel = Never\n"  # a repo override must not be read as global
+        )
+        self.assertEqual(pkgdb.parse_global_siglevel(conf),
+                         "Required DatabaseOptional")
+
+    def test_parse_ignores_comments(self):
+        conf = "[options]\nSigLevel = Never  # was: Required\n"
+        self.assertEqual(pkgdb.parse_global_siglevel(conf), "Never")
+
+
+class TestMtreeParse(unittest.TestCase):
+    def test_parses_regular_files_with_sha(self):
+        # Mirrors real pacman output: a /set default + bare file entries with no
+        # explicit type=, and dirs that carry type=dir.
+        mtree = (
+            "#mtree\n"
+            "/set type=file uid=0 gid=0 mode=644\n"
+            "./usr/bin/ssh time=0.0 size=10 "
+            "sha256digest=" + "a" * 64 + "\n"
+            "./usr/lib time=0.0 type=dir\n"  # dirs are skipped
+            "./etc/x\\040y time=0.0 "
+            "sha256digest=" + "b" * 64 + "\n"
+        )
+        out = pkgdb.parse_mtree(mtree)
+        self.assertEqual(out["/usr/bin/ssh"], "a" * 64)
+        self.assertEqual(out["/etc/x y"], "b" * 64)  # \040 -> space
+        self.assertNotIn("/usr/lib", out)
+
+
+class TestSampleRotation(unittest.TestCase):
+    def test_window_wraps_and_covers_all_over_passes(self):
+        items = list(range(10))
+        seen = set()
+        for off in range(0, 10, 3):
+            seen.update(pkgdb._sample(items, 3, off))
+        self.assertEqual(seen, set(items))
+
+    def test_sample_larger_than_list_clamps(self):
+        self.assertEqual(set(pkgdb._sample([1, 2], 99, 0)), {1, 2})
+
+
+class TestVerifyAlerts(unittest.TestCase):
+    def setUp(self):
+        self.d = tempfile.TemporaryDirectory()
+        self.cfg = cfg_with_dir(Path(self.d.name))
+        self.cfg.pkgdb_pkgverify_sample = 10
+
+    def tearDown(self):
+        self.d.cleanup()
+
+    def test_mismatch_yields_critical_alert(self):
+        def fake_verify(name, version):
+            return {"pkg": f"{name}-{version}", "cached": "/c.pkg", "checked": 1,
+                    "mismatched": [("/usr/bin/ssh", "dead", "beef")]}
+        alerts = pkgdb.verify_alerts(
+            self.cfg, _installed=lambda: [("openssh", "9.0")],
+            _verify=fake_verify)
+        sigs = [a.signature for a in alerts]
+        self.assertIn("pkg_signature_mismatch", sigs)
+        a = next(x for x in alerts if x.signature == "pkg_signature_mismatch")
+        self.assertEqual(a.severity, Severity.CRITICAL)
+        self.assertEqual(a.sid, pkgdb.SID_PKGVERIFY)
+        self.assertIn("/usr/bin/ssh", a.detail)
+
+    def test_all_match_is_silent(self):
+        clean = lambda name, version: {
+            "pkg": f"{name}-{version}", "cached": "/c", "checked": 3,
+            "mismatched": []}
+        alerts = pkgdb.verify_alerts(
+            self.cfg, _installed=lambda: [("a", "1"), ("b", "2")],
+            _verify=clean)
+        self.assertEqual(
+            [a for a in alerts if a.signature == "pkg_signature_mismatch"], [])
+
+
 class TestHeartbeatWatchdog(unittest.TestCase):
     def test_heartbeat_roundtrip(self):
         with tempfile.TemporaryDirectory() as d: