luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): enrich snapshots with package ownership

Browse source
This commit is contained in:
Luna 2026-07-22 03:50:55 -07:00
parent 6355fb403d
commit 88d7a6e3b8
No known key found for this signature in database
8 changed files with 149 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

9
go-agent/README.md
View file

@ -116,10 +116,11 @@ the configured `incident_tracking`, `incident_window`, and
and one snapshot name idempotently. Hot-path enrichment derives bounded
process/parent context, lineage, remote-IP classification, and candidate paths
from already-captured data without new I/O. A 16-job asynchronous worker then
adds streamed SHA-256 values for regular executables up to 8 MiB and file
metadata; saturation leaves fields unknown rather than delaying alerts. Package
ownership, richer integrity anchors, and notifications remain future parity
work. Snapshot text/JSON revisions append synchronized `enodia.hash_chain.v1`
adds streamed SHA-256 values for regular executables up to 8 MiB, file metadata,
and pacman/dpkg/rpm package-owner strings with a two-second query bound;
saturation leaves fields unknown rather than delaying alerts. Richer integrity
anchors and notifications remain future parity work. Snapshot text/JSON
revisions append synchronized `enodia.hash_chain.v1`
records to a private local `hash-chain.jsonl`.
After every successfully emitted status record, the service atomically updates