# Maintainer: Enodia
pkgname=enodia-sentinel
pkgver=0.3.0
pkgrel=1
pkgdesc="Host intrusion-detection daemon — signature-based detection of reverse shells, LD_PRELOAD rootkits, fileless malware, and persistence tampering"
arch=('any')
url="https://github.com/Enodia/enodia-sentinel"
license=('GPL-3.0-or-later')
depends=('python>=3.11' 'iproute2' 'procps-ng')
optdepends=('python-bpfcc: eBPF event-driven execve monitor (catches short-lived processes)'
            'bpftrace: execve tracing of short-lived processes in snapshots'
            'libnotify: desktop notifications on alert')
backup=('etc/enodia-sentinel.toml')
source=()
sha256sums=()

package() {
    cd "$startdir/.."
    # Install the stdlib-only package as a directory + launcher under /usr.
    install -d "$pkgdir/usr/lib/enodia-sentinel"
    cp -r enodia_sentinel "$pkgdir/usr/lib/enodia-sentinel/"
    install -Dm755 packaging/enodia-sentinel.wrapper "$pkgdir/usr/bin/enodia-sentinel"
    install -Dm755 src/sentinel-redteam "$pkgdir/usr/bin/sentinel-redteam"
    install -Dm644 systemd/enodia-sentinel.service "$pkgdir/usr/lib/systemd/system/enodia-sentinel.service"
    install -Dm644 config/enodia-sentinel.toml "$pkgdir/etc/enodia-sentinel.toml"
    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    install -dm750 "$pkgdir/var/log/enodia-sentinel"
}