Record trustsight reviews in the reminder

trustsight review is read-only by default, so each run compared only against the previous AUR commit instead of the last reviewed one.

PKGBUILD

@@ -3,7 +3,7 @@
 # Maintainer: Daniele Fucini <dfucini [at] gmail [dot] com>
 
 pkgname=update-notify
-pkgver=3.9
+pkgver=3.11
 pkgrel=1
 pkgdesc='Notify when updates are available'
 arch=('any')
@@ -18,7 +18,7 @@ optdepends=('aurutils: to check AUR packages in the local repo for updates'
             'trustsight: to vet AUR updates before building them')
 source=("git+$url?signed#tag=$pkgver")
 validpgpkeys=('7E12BC1FF3B6EDB2CD8053EB981A2B2A3BBF5514')
-sha256sums=('86eb0d4f2a7b4cee87b851c3c11581bfee2bbe840705215fc63c4bfa9121c4ff')
+sha256sums=('d298653e424465665d34896eee38f9e5cc6a1da6e319915011fa00106eac0a2e')
 
 package()
 {
@@ -28,8 +28,6 @@ package()
     install -Dm644 "$pkgname"-quiet.service "$pkgdir"/usr/lib/systemd/user/"$pkgname"-quiet.service
     install -Dm644 "$pkgname".timer "$pkgdir"/usr/lib/systemd/user/"$pkgname".timer
     install -Dm644 "$pkgname".path "$pkgdir"/usr/lib/systemd/user/"$pkgname".path
-    install -Dm755 "$pkgname"-refresh "$pkgdir"/usr/lib/"$pkgname"/refresh
-    install -Dm644 "$pkgname".hook "$pkgdir"/usr/share/libalpm/hooks/"$pkgname".hook
     install -Dm644 README.md "$pkgdir"/usr/share/doc/"$pkgname"/README.md
     install -Dm644 config.example "$pkgdir"/usr/share/doc/"$pkgname"/config.example
 }

README.md

@@ -43,11 +43,9 @@ systemctl --user enable --now update-notify.timer
 
 The timer runs 5 minutes after boot, then every 6 hours.
 
-A pacman hook also runs `update-notify --quiet` after every pacman transaction, for each logged-in user whose timer is active, so the status bar file is current right after an upgrade.
-
 ### Refresh after building packages
 
-Building into a local repository (`aur build`, `aur sync`) doesn't run pacman, so the hook can't catch it. To run `update-notify --quiet` whenever a repository changes, add the repository files to watch to `update-notify.path`:
+To run `update-notify --quiet` whenever a repository changes, add the repository files to watch to `update-notify.path`:
 
 ```
 systemctl --user edit update-notify.path
@@ -73,7 +71,7 @@ update-notify [-q|--quiet] [threshold]
 
 `threshold` is the minimum number of updates (repo + AUR) before update counts are shown. It overrides the `THRESHOLD` setting below for that run's notification only; the pending file keeps the configured value.
 
-`--quiet` updates the pending file without notifying. Changes to a notification already shown are recorded, so the next timer run doesn't repeat them; a new notification is left for the timer. The pacman hook and `update-notify.path` use it (through `update-notify-quiet.service`), so building or upgrading many packages doesn't notify after each one.
+`--quiet` updates the pending file without notifying. Changes to a notification already shown are recorded, so the next timer run doesn't repeat them; a new notification is left for the timer. `update-notify.path` uses it (through `update-notify-quiet.service`), so building many packages doesn't notify after each one.
 
 ## Configuration
 
@@ -105,7 +103,7 @@ aur <pkg> <newver>
 kernel <custom-pkg> <stock-ver>
 ```
 
-The file reflects the last run, which the pacman hook and `update-notify.path` keep close to current. To keep a bar current in between, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
+The file reflects the last timer or `update-notify.path` run. To keep a bar current in between, e.g. right after an upgrade, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
 
 ## License
 

update-notify

@@ -19,7 +19,7 @@ if [[ -r $config_file ]]; then
     # shellcheck source=/dev/null
     source "$config_file"
 fi
-quiet=0  # refresh the pending file without notifying (path unit and pacman hook)
+quiet=0  # refresh the pending file without notifying (path unit)
 if [[ ${1:-} == -q || ${1:-} == --quiet ]]; then
     quiet=1
     shift
@@ -193,7 +193,7 @@ if (( over_threshold )); then
 
     # Vet AUR changes before building them
     if (( aur_updates )) && command -v trustsight >/dev/null 2>&1; then
-        parts+=("Before aur sync: trustsight review --repo $AUR_REPO")
+        parts+=("Before aur sync: trustsight review --record --repo $AUR_REPO")
     fi
 
     if (( ${#reminders[@]} )); then

update-notify-refresh

@@ -1,10 +0,0 @@
-#!/bin/bash
-# Run update-notify for every logged-in user whose timer is active (called by the pacman hook as root)
-systemctl list-units --plain --no-legend --state=running 'user@*.service' |
-while read -r unit _; do
-    uid=${unit#user@}
-    uid=${uid%.service}
-    user=$(id -nu "$uid") || continue
-    systemctl --user -M "$user@" is-active --quiet update-notify.timer || continue
-    systemctl --user -M "$user@" start --no-block update-notify-quiet.service
-done

update-notify.hook

@@ -1,11 +0,0 @@
-[Trigger]
-Operation = Install
-Operation = Upgrade
-Operation = Remove
-Type = Package
-Target = *
-
-[Action]
-Description = Refreshing update-notify...
-When = PostTransaction
-Exec = /usr/lib/update-notify/refresh