feat(go): enrich snapshots with package ownership

go-agent/internal/enrich/enrich.go

@@ -47,17 +47,23 @@ type SlowResult struct {
 	Files     map[string]map[string]any
 }
 
-func CollectSlow(processes []Process, paths []string) SlowResult {
+func CollectSlow(processes []Process, paths []string, owner ...func(string) string) SlowResult {
 	result := SlowResult{Processes: map[int]map[string]any{}, Files: map[string]map[string]any{}}
+	packageOwner := func(string) string { return "" }
+	if len(owner) > 0 && owner[0] != nil {
+		packageOwner = owner[0]
+	}
 	for _, process := range processes {
 		exe := cleanPath(process.Exe)
 		if exe == "" {
 			continue
 		}
-		result.Processes[process.PID] = map[string]any{"exe_sha256": boundedHash(exe)}
+		result.Processes[process.PID] = map[string]any{"exe_sha256": boundedHash(exe), "package_owner": packageOwner(exe)}
 	}
 	for _, path := range paths {
-		result.Files[path] = fileMetadata(path)
+		metadata := fileMetadata(path)
+		metadata["package_owner"] = packageOwner(path)
+		result.Files[path] = metadata
 	}
 	return result
 }

go-agent/internal/enrich/enrich_test.go

@@ -3,6 +3,8 @@
 package enrich
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
@@ -54,3 +56,21 @@ func TestBuildCapsAttackerControlledIndicators(t *testing.T) {
 		t.Fatal("indicator caps were not applied")
 	}
 }
+
+func TestCollectSlowAddsInjectedPackageOwnership(t *testing.T) {
+	directory := t.TempDir()
+	exe := filepath.Join(directory, "payload")
+	if err := os.WriteFile(exe, []byte("payload"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	result := CollectSlow([]Process{{PID: 42, Exe: exe}}, []string{exe}, func(path string) string {
+		if path == exe {
+			return "example-package 1.0-1"
+		}
+		return ""
+	})
+	if result.Processes[42]["package_owner"] != "example-package 1.0-1" ||
+		result.Files[exe]["package_owner"] != "example-package 1.0-1" {
+		t.Fatalf("result=%#v", result)
+	}
+}