fix(agentcompat): validate evidence modes by platform

Co-authored-by: naiba/CloudCode <hi+cloudcode@nai.ba>

integration/agentcompat/internal/evidence/directory_permissions_other.go

@@ -0,0 +1,23 @@
+//go:build !aix && !darwin && !dragonfly && !freebsd && !linux && !netbsd && !openbsd && !solaris && !windows
+
+package evidence
+
+import (
+	"errors"
+	"fmt"
+	"os"
+)
+
+func validateEvidenceDirectoryMode(info os.FileInfo) error {
+	if info.Mode().Perm() != 0o700 {
+		return errors.New("evidence directory must use mode 0700")
+	}
+	return nil
+}
+
+func validateEvidenceFileMode(info os.FileInfo, relative string) error {
+	if info.Mode().Perm() != 0o600 {
+		return fmt.Errorf("evidence file must use mode 0600: %s", relative)
+	}
+	return nil
+}

integration/agentcompat/internal/evidence/directory_permissions_unix.go

@@ -0,0 +1,23 @@
+//go:build aix || darwin || dragonfly || freebsd || linux || netbsd || openbsd || solaris
+
+package evidence
+
+import (
+	"errors"
+	"fmt"
+	"os"
+)
+
+func validateEvidenceDirectoryMode(info os.FileInfo) error {
+	if info.Mode().Perm() != 0o700 {
+		return errors.New("evidence directory must use mode 0700")
+	}
+	return nil
+}
+
+func validateEvidenceFileMode(info os.FileInfo, relative string) error {
+	if info.Mode().Perm() != 0o600 {
+		return fmt.Errorf("evidence file must use mode 0600: %s", relative)
+	}
+	return nil
+}

integration/agentcompat/internal/evidence/directory_permissions_windows.go

@@ -0,0 +1,13 @@
+//go:build windows
+
+package evidence
+
+import "os"
+
+func validateEvidenceDirectoryMode(os.FileInfo) error {
+	return nil
+}
+
+func validateEvidenceFileMode(os.FileInfo, string) error {
+	return nil
+}

integration/agentcompat/internal/evidence/directory_scan.go

@@ -26,8 +26,8 @@ func scanDirectory(resultsDir string) (map[string]os.FileInfo, error) {
 	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
 		return nil, errors.New("evidence path must be a directory")
 	}
-	if info.Mode().Perm() != 0o700 {
+	if err := validateEvidenceDirectoryMode(info); err != nil {
-		return nil, errors.New("evidence directory must use mode 0700")
+		return nil, err
 	}
 	seen := make(map[string]os.FileInfo)
 	var totalBytes int64
@@ -65,8 +65,8 @@ func scanDirectory(resultsDir string) (map[string]os.FileInfo, error) {
 		if !allowedEvidencePath(relative) {
 			return fmt.Errorf("evidence path is not allowed: %s", relative)
 		}
-		if fileInfo.Mode().Perm() != 0o600 {
+		if err := validateEvidenceFileMode(fileInfo, relative); err != nil {
-			return fmt.Errorf("evidence file must use mode 0600: %s", relative)
+			return err
 		}
 		seen[relative] = fileInfo
 		if len(seen) > maxEvidenceFiles {