feat(go): enrich snapshots with package ownership

go-agent/internal/enrich/enrich_test.go

@@ -3,6 +3,8 @@
 package enrich
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
 
 	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
@@ -54,3 +56,21 @@ func TestBuildCapsAttackerControlledIndicators(t *testing.T) {
 		t.Fatal("indicator caps were not applied")
 	}
 }
+
+func TestCollectSlowAddsInjectedPackageOwnership(t *testing.T) {
+	directory := t.TempDir()
+	exe := filepath.Join(directory, "payload")
+	if err := os.WriteFile(exe, []byte("payload"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	result := CollectSlow([]Process{{PID: 42, Exe: exe}}, []string{exe}, func(path string) string {
+		if path == exe {
+			return "example-package 1.0-1"
+		}
+		return ""
+	})
+	if result.Processes[42]["package_owner"] != "example-package 1.0-1" ||
+		result.Files[exe]["package_owner"] != "example-package 1.0-1" {
+		t.Fatalf("result=%#v", result)
+	}
+}