1de5e86fed
Closes the tamper-evidence loop with two trust anchors the attacker can't forge from userland: - pkgdb Layer 2: verify on-disk files against the .MTREE in the *signed* cache package, surviving a rewritten local checksum DB. Rotating-sample cadence keeps it affordable; flags pkg_signature_mismatch (sid 100027) and SigLevel downgrades (sid 100026). Fixes parse_mtree, which required type=file on every line and so matched nothing on real pacman MTREEs (which use a /set type=file default with bare file entries). - rootcheck: anti-rootkit cross-view — hidden processes, modules, ports, and promiscuous interfaces, each caught by diffing two views of the same state (sids 100022-100025). Wired both through config, the daemon (off-loop slow cadence), and CLI (pkgdb-verify, rootcheck). 14 new tests (95 total). Docs + version bump. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
34 lines
1.1 KiB
TOML
34 lines
1.1 KiB
TOML
[build-system]
|
|
requires = ["setuptools>=61"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[project]
|
|
name = "enodia-sentinel"
|
|
version = "0.7.0"
|
|
description = "Host intrusion-detection daemon — signature-based detection of reverse shells, LD_PRELOAD rootkits, fileless malware, and persistence tampering"
|
|
readme = "README.md"
|
|
requires-python = ">=3.11"
|
|
license = { text = "GPL-3.0-or-later" }
|
|
authors = [{ name = "Enodia" }]
|
|
keywords = ["security", "ids", "hids", "detection", "linux", "forensics"]
|
|
classifiers = [
|
|
"License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)",
|
|
"Operating System :: POSIX :: Linux",
|
|
"Programming Language :: Python :: 3",
|
|
"Topic :: Security",
|
|
]
|
|
# Zero runtime dependencies — stdlib only, by design (a system security
|
|
# daemon should not pull in a dependency tree it has to trust and update).
|
|
dependencies = []
|
|
|
|
[project.scripts]
|
|
enodia-sentinel = "enodia_sentinel.cli:main"
|
|
|
|
[project.optional-dependencies]
|
|
dev = ["pytest"]
|
|
|
|
[tool.setuptools.packages.find]
|
|
include = ["enodia_sentinel*"]
|
|
|
|
[tool.setuptools.package-data]
|
|
enodia_sentinel = ["static/*.html"]
|