Relicense under GPL-3.0-or-later

Replace MIT with the full GNU GPLv3 text, update license metadata in
pyproject.toml (+ trove classifiers) and PKGBUILD, and add
SPDX-License-Identifier headers to all Python modules and shell scripts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/detectors/__init__.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """Detector registry.
 
 Each detector is a ``Detector`` with a ``name`` and a ``detect(state, cfg)``

enodia_sentinel/detectors/deleted_exe.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """deleted_exe — a process running from a deleted or memfd-backed binary.
 
 Fileless malware unlinks its dropper (or runs straight from ``memfd``) so there

enodia_sentinel/detectors/egress.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """egress — an interpreter holding an outbound connection to a public IP.
 
 C2 beacons and exfil phone home. A scripting interpreter (bash/python/perl/nc…)

enodia_sentinel/detectors/ld_preload.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """ld_preload — userland rootkit / library-injection indicators.
 
 Two signatures:

enodia_sentinel/detectors/new_listener.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """new_listener — a listening socket absent from the startup baseline.
 
 Bind shells and backdoors have to listen somewhere. We diff the current set of

enodia_sentinel/detectors/new_suid.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """new_suid — a SUID/SGID binary that wasn't in the baseline.
 
 A new setuid binary is a privilege-escalation persistence trick; one in a

enodia_sentinel/detectors/persistence.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """persistence — modification of a watched persistence-relevant file.
 
 Persistence has to land somewhere that survives a reboot: cron, systemd units,

enodia_sentinel/detectors/reverse_shell.py

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
 """reverse_shell — an interpreter with a network socket on its stdio.
 
 A real reverse shell dups a TCP/UDP socket onto fd 0/1/2 (``nc -e /bin/bash``,