From 5a4baddcdb6ece4ba07a9abc840a5a6d33c2deb5 Mon Sep 17 00:00:00 2001
From: Daniele Fucini <dfucini@gmail.com>
Date: Sat, 17 Oct 2026 10:56:57 +0200
Subject: [PATCH] Remind to run trustsight before building AUR updates

---
 README.md     | 3 ++-
 update-notify | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 943ec2d..b987847 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ update-notify runs on a systemd user timer and checks:
 
 It sends one notification, and only when its content changes since the last one:
 
-- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed.
+- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed, and one to run `trustsight` before building pending AUR updates.
 - Kernel rebuild reminders are always shown, even below the threshold.
 
 ## Requirements
@@ -23,6 +23,7 @@ Optional:
 - `aurutils`: check AUR packages in the local repository
 - `fwupd`: check for firmware updates
 - `git-monitor`: remind to check git packages
+- `trustsight`: remind to vet AUR updates before building them
 
 ## Installation
 
diff --git a/update-notify b/update-notify
index cd9fb4e..31b2f39 100755
--- a/update-notify
+++ b/update-notify
@@ -175,6 +175,11 @@ if (( over_threshold )); then
         fi
     fi
 
+    # Vet AUR changes before building them
+    if (( aur_updates )) && command -v trustsight >/dev/null 2>&1; then
+        parts+=("Before aur sync: trustsight review --repo $AUR_REPO")
+    fi
+
     if (( ${#reminders[@]} )); then
         printf -v list '%s, ' "${reminders[@]}"
         parts+=("Also check: ${list%, }")