fix(attest): don't preserve file ownership when packaging attachments

[mbevc1]

Passing two or more evidence paths to kosli attest staged each path into a temp dir before tarring, and asked github.com/otiai10/copy to preserve uid and gid. That is implemented with Lchown, which a non-root process cannot use to chown a file to a foreign uid, so the command aborted with

chown /tmp/1800768837/reports/rubocop/junit.xml: operation not permitted

whenever any attachment had been written by a docker container rather than by the CLI user. Lint, test and coverage output produced in a container is the common case, so adding a second --attachments broke commands that were green the day before.

The copy is only a staging area for the tarball that gets uploaded, and nothing downstream reads uid or gid. The single-path branch never copies and so never chowned, which is why it kept working. Dropping PreserveOwner makes the multi-path branch agree with it.

Also wrap the copy error with the evidence path the user passed, so a genuine failure names their own input rather than only a temp directory they never created.

Fixes #1075

Checklist

• Docs are autogenerated from CLI help — make sure the help text reflects your changes
• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed

[claude]

Claude finished @mbevc1's task in 1m 10s —— View job

---

Review

I re-reviewed after the latest push. The fix is correct, minimal, and well-tested. Both points from the earlier review are now resolved.

Static analysis

• ✅ go build ./... — passes
• ✅ go vet ./cmd/kosli/ — clean

Correctness of the fix

• Dropping PreserveOwner from the multi-path cp.Copy is the right call. The temp dir at cli_utils.go:667 is only a staging area for the tarball, and nothing downstream reads uid/gid — the tarball is what's uploaded. This makes the multi-path branch agree with the single-path branch (cli_utils.go:636), which never copied and so never chowned. PreserveTimes: true is retained, which is harmless.
• The error wrap now uses %w (cli_utils.go:671), so os.ErrNotExist and friends stay inspectable via errors.Is/errors.As — exactly what the earlier suggestion asked for, and the new test asserts it.

Tests — thorough and thoughtfully written:

• TestGetPathOfEvidenceFileToUploadMultiplePaths proves all files from all paths land in the tarball (the behaviour that must not regress).
• TestGetPathOfEvidenceFileToUploadDoesNotPreserveOwnership — nice handling of the reproduction asymmetry: only root can create a foreign-owned fixture, only non-root hits EPERM. Inverting the assertion (as root, prove the copy is owned by the packaging user, not the source owner) is a clever way to guard the regression. The Geteuid() != 0 skip keeps it green for ordinary local/CI runs.
• TestGetPathOfEvidenceFileToUploadNamesTheFailingPath covers both the friendlier message and the %w unwrap via require.ErrorIs(..., os.ErrNotExist).
• The helper doc comment on evidenceFixture now matches its (dir, file) signature — the earlier nit is fixed.

Minor observations (non-blocking)

• The two headers-based tests both build a full gzip+tar reader; readTarHeaders nicely factors that out. No duplication concerns.
• TestGetPathOfEvidenceFileToUploadDoesNotPreserveOwnership will simply skip in CI unless it runs as root — worth being aware the ownership assertion only actually executes in a root context (e.g. the Docker-based test setup). That's inherent to the constraint, not a defect.

Nice work — the commit messages and the in-code comment (cli_utils.go:663-666) explain why rather than what, which makes the ownership decision self-documenting for the next reader. The regression test docblock pointing at #1075 is excellent context.

LGTM. 👍