luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port FIM/pkgdb/rootcheck integrity engines and add go-sidecar dashboard consumer

Browse source 
Adds sidecar-only, --state-dir-gated FIM, package-DB-anchor, and rootcheck
engines to the Go migration sidecar, wired into agent.Sweep/Initialize
behind the existing baseline lifecycle. Adds a read-only, schema-checked
Python dashboard consumer (go_sidecar_state_dir, /api/go-sidecar/*, Sidecar
tab) that never starts, stops, or mutates the Go sidecar's state.

Also fixes drift found while reconciling this work: enodia_sentinel/web.py
had reinvented local schema constants instead of using the canonical
enodia_sentinel/schemas.py catalog (now registers enodia.go.sidecar.v1
there and reuses ALERT_SNAPSHOT_V1/INCIDENT_V1); docs/RULES.md had drifted
from what `rules docs` actually generates for SIDs 100069-100078 (ruleops.py
was missing metadata for four SIDs and had stale drill text for four more),
now back in sync with a regression test pinning them together.

Updates CLAUDE.md, README.md, go-agent/README.md, and docs/{ROADMAP,
GO_PORT_HANDOFF,SURICATA_ASSIMILATION,THREAT_MODEL,OPERATIONS,SCHEMAS,
COMMAND_REFERENCE}.md to reflect the landed work.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NQivSKBqQJsayz1xcYqWzZ
This commit is contained in:
Luna 2026-07-24 09:59:09 -07:00
parent 1d1dee7f6e
commit d835386381
No known key found for this signature in database
43 changed files with 3419 additions and 72 deletions
Download patch file Download diff file Expand all files Collapse all files

56
go-agent/internal/enrich/enrich.go
View file

@ -50,6 +50,22 @@ type SlowResult struct {
Integrity map[string]any
}
// IntegritySettings describes engines that are already configured by the
// sidecar. It is metadata only: CollectSlow must never start a hash scan,
// package-manager process, or rootcheck while it is enriching an alert.
//
// Durations are carried as durations here and converted to integer seconds at
// the snapshot boundary so the retained JSON stays easy to consume alongside
// Python's enrichment records.
type IntegritySettings struct {
FIMEnabled bool
FIMScanInterval time.Duration
PackageVerifyEnabled bool
PackageVerifyInterval time.Duration
RootcheckEnabled bool
RootcheckInterval time.Duration
}
func CollectSlow(processes []Process, paths []string, owner ...func(string) string) SlowResult {
result := SlowResult{Processes: map[int]map[string]any{}, Files: map[string]map[string]any{}}
packageOwner := func(string) string { return "" }
@ -71,17 +87,37 @@ func CollectSlow(processes []Process, paths []string, owner ...func(string) stri
return result
}
// IntegrityAnchors reports durable state presence without running FIM, package
// verification, or rootcheck on the alert path. Those engines stay disabled
// until their own Go parity tranches land.
func IntegrityAnchors(directory string) map[string]any {
return map[string]any{
"fim_baseline": pathStatus(filepath.Join(directory, "fim-baseline.json")),
"pkgdb_anchor": pathStatus(filepath.Join(directory, "pkgdb-anchor.json")),
"package_verify": map[string]any{"enabled": false, "sample": 0},
"rootcheck": map[string]any{"enabled": false, "interval": 0},
"go_assurance": pathStatus(filepath.Join(directory, "hash-chain.jsonl")),
// IntegrityAnchors reports durable state and configured engine cadence without
// running FIM, package verification, or rootcheck on the alert path. A caller
// can omit settings for stateless/parity uses; explicit sidecar mode supplies
// them after it has attached the bounded background managers.
func IntegrityAnchors(directory string, configured ...IntegritySettings) map[string]any {
settings := IntegritySettings{}
if len(configured) > 0 {
settings = configured[0]
}
return map[string]any{
"fim_baseline": pathStatus(filepath.Join(directory, "fim-baseline.json")),
"pkgdb_anchor": pathStatus(filepath.Join(directory, "pkgdb-anchor.json")),
// Go uses pacman -Qkk rather than Python's sampled signed-cache verifier.
// Keep sample at zero to make that distinction explicit to consumers.
"package_verify": map[string]any{
"enabled": settings.PackageVerifyEnabled, "engine": "pacman-qkk",
"interval": durationSeconds(settings.PackageVerifyInterval), "sample": 0,
},
"rootcheck": map[string]any{
"enabled": settings.RootcheckEnabled,
"interval": durationSeconds(settings.RootcheckInterval),
},
"go_assurance": pathStatus(filepath.Join(directory, "hash-chain.jsonl")),
}
}
func durationSeconds(value time.Duration) int64 {
if value <= 0 {
return 0
}
return int64(value / time.Second)
}
func pathStatus(path string) map[string]any {

12
go-agent/internal/enrich/enrich_test.go
View file

@ -6,6 +6,7 @@ import (
"os"
"path/filepath"
"testing"
"time"
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)
@ -77,9 +78,16 @@ func TestCollectSlowAddsInjectedPackageOwnership(t *testing.T) {
func TestIntegrityAnchorsAreTruthfulAndReadOnly(t *testing.T) {
directory := t.TempDir()
anchors := IntegrityAnchors(directory)
anchors := IntegrityAnchors(directory, IntegritySettings{
FIMEnabled: true, FIMScanInterval: 5 * time.Minute,
PackageVerifyEnabled: true, PackageVerifyInterval: 6 * time.Hour,
RootcheckEnabled: true, RootcheckInterval: 5 * time.Minute,
})
if anchors["fim_baseline"].(map[string]any)["status"] != "missing" ||
anchors["rootcheck"].(map[string]any)["enabled"] != false {
anchors["rootcheck"].(map[string]any)["enabled"] != true ||
anchors["rootcheck"].(map[string]any)["interval"] != int64(300) ||
anchors["package_verify"].(map[string]any)["engine"] != "pacman-qkk" ||
anchors["package_verify"].(map[string]any)["interval"] != int64(21600) {
t.Fatalf("anchors=%#v", anchors)
}
if err := os.WriteFile(filepath.Join(directory, "hash-chain.jsonl"), []byte("{}\n"), 0o600); err != nil {