hound-verify — cross-distro verification for Hound Antivirus
============================================================

What this is
------------
The Hound test suite, compiled. It is READ-ONLY: it installs nothing,
starts no daemon, needs no root, and does not modify system state. It
reads /usr/bin, /bin, /usr/sbin, /proc and dpkg's package index.

Requirements
------------
x86_64, glibc 2.39 or newer — Ubuntu 24.04 and up. (The floor comes from
Rust's standard library, not from Hound.) Check with: ldd --version

How to run
----------
    chmod +x hound-verify

    # The two checks that matter, together:
    ./hound-verify rootkit rules

    # Or everything (~30s, mostly the goodware scan):
    ./hound-verify

What is actually being verified
-------------------------------
1. rootkit::tests::unowned_setuid_does_not_fire_on_a_healthy_system

   Hound flags setuid binaries that no installed package claims. It asks
   dpkg. Ubuntu's merged-/usr layout means every binary has two names
   (/bin/sudo and /usr/bin/sudo), and dpkg records some packages under
   one and some under the other. Getting this wrong makes Hound alarm on
   a clean machine.

   FAILURE OUTPUT names each binary it wrongly flagged. That is the
   useful part — please paste it.

2. rules::tests::no_false_positives_on_system_binaries

   Every Hound detection rule is scanned against every binary in
   /usr/bin, /bin and /usr/sbin. A single hit fails the build. Ubuntu
   ships binaries Linux Mint does not, so this is genuinely new ground.

   FAILURE OUTPUT names the binary and the rule. A hit means I delete
   that rule rather than tune it — a rule that flags a system binary is
   worse than no rule.

3. Everything else in the suite comes along for the ride and is a bonus
   signal: the fanotify policy tests, the capability arithmetic, the
   supply-chain detectors.

What to send back
-----------------
Either "all passed" (which is a real result — it closes the last open
criterion on the rootkit rewrite), or the assertion text of anything
that failed. The messages are written to be self-explanatory.

Thanks — Hound