feat(go): advance validation sidecar toward production

tests/test_go_sidecar_packaging.py

@@ -0,0 +1,53 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+"""Regression checks for the opt-in Go validation service."""
+
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+UNIT = ROOT / "systemd" / "enodia-sentinel-go-sidecar.service"
+
+
+class GoSidecarPackagingTests(unittest.TestCase):
+    def test_unit_is_isolated_and_opt_in(self) -> None:
+        text = UNIT.read_text(encoding="utf-8")
+        self.assertIn("ExecStart=/usr/bin/env enodia-sentinel-go ", text)
+        self.assertIn("--state-dir /var/lib/enodia-sentinel-go", text)
+        self.assertIn("--event-log /var/lib/enodia-sentinel-go/events.jsonl", text)
+        self.assertIn("--event-log-max-bytes 67108864", text)
+        self.assertIn("--snapshot-dir /var/lib/enodia-sentinel-go", text)
+        self.assertIn("--ebpf-exec --ebpf-syscall", text)
+        self.assertIn("StandardOutput=journal", text)
+        self.assertIn("InaccessiblePaths=-/var/log/enodia-sentinel", text)
+        self.assertNotIn("Alias=enodia-sentinel.service", text)
+
+    def test_unit_keeps_required_hardening(self) -> None:
+        text = UNIT.read_text(encoding="utf-8")
+        for directive in (
+            "ProtectSystem=strict",
+            "ProtectHome=read-only",
+            "NoNewPrivileges=yes",
+            "MemoryDenyWriteExecute=yes",
+            "StateDirectory=enodia-sentinel-go",
+            "LimitMEMLOCK=infinity",
+            "Type=notify",
+            "NotifyAccess=main",
+            "PrivateDevices=yes",
+            "RestrictAddressFamilies=AF_UNIX AF_NETLINK",
+            "SystemCallArchitectures=native",
+        ):
+            with self.subTest(directive=directive):
+                self.assertIn(directive, text)
+
+    def test_install_requires_explicit_go_target(self) -> None:
+        makefile = (ROOT / "Makefile").read_text(encoding="utf-8")
+        default_install = makefile.split("\ninstall-go:", 1)[0]
+        self.assertNotIn("enodia-sentinel-go-sidecar.service", default_install)
+        self.assertIn("install-go: build-go", makefile)
+        self.assertIn("enable-go:", makefile)
+
+
+if __name__ == "__main__":
+    unittest.main()