Point the README installation section to the AUR

Clearer pkgdesc for the AUR release.

PKGBUILD

@@ -3,22 +3,30 @@
 # Maintainer: Daniele Fucini <dfucini [at] gmail [dot] com>
 
 pkgname=update-notify
-pkgver=3.11.1
+pkgver=3.13
-pkgrel=1
+pkgrel=2
-pkgdesc='Notify when updates are available'
+pkgdesc='Desktop notifications for pending repo and AUR updates'
 arch=('any')
 url="https://git.shouldnt.work/fuxino/$pkgname"
 license=('GPL-3.0-or-later')
 depends=('pacman-contrib'
          'libnotify')
 makedepends=('git')
+checkdepends=('bats'
+              'bats-assert'
+              'bats-support')
 optdepends=('aurutils: to check AUR packages in the local repo for updates'
             'fwupd: to check for firmware updates'
-            'git-monitor: to check git repos for updates'
+            'git-monitor: to check git repos for updates')
-            'trustsight: to vet AUR updates before building them')
 source=("git+$url?signed#tag=$pkgver")
 validpgpkeys=('7E12BC1FF3B6EDB2CD8053EB981A2B2A3BBF5514')
-sha256sums=('09fa8cbde71ae801166852add9f8f43b52fa0ee4c3fe8c94636d61c51523283e')
+sha256sums=('56bfe7f4a8f8d5c311fe6c7c07f01614111e5c899043d038ce0a1c11362b4a71')
+
+check()
+{
+    cd "$srcdir"/"$pkgname"
+    bats tests
+}
 
 package()
 {

README.md

@@ -6,12 +6,14 @@ update-notify runs on a systemd user timer and checks:
 
 - **Repo updates**, using `checkupdates` from pacman-contrib.
 - **AUR updates** for packages in a local aurutils repository (`aur repo -u`).
-- **Custom kernel rebuilds**: when a stock kernel (e.g. `linux-lts`) has a newer version than your custom build of it (e.g. `linux-lts-custom`).
+- **Custom kernel rebuilds**: when a stock kernel (e.g. `linux-lts`) has a newer version than your custom build of it (e.g. `linux-lts-custom`), for the kernels set in `KERNELS`.
+- **Maintenance**: `.pacnew`/`.pacsave` files to merge (`pacdiff -o`), and a reboot after the running kernel was upgraded.
 
 It sends one notification, and only when its content changes since the last one:
 
 - Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed.
 - Kernel rebuild reminders are always shown, even below the threshold.
+- Maintenance reminders are added to every notification. On their own, they notify only when something new appears (a new file to merge, a new kernel to reboot into), so a `.pacnew` you keep isn't repeated.
 
 ## Requirements
 
@@ -26,13 +28,7 @@ Optional:
 
 ## Installation
 
-Build and install the package with the included PKGBUILD, which builds the signed release tag set in `pkgver`:
+update-notify is available in the AUR as [update-notify](https://aur.archlinux.org/packages/update-notify). Install it with your AUR helper, e.g. `aur sync update-notify` with aurutils.
-
-```
-makepkg -si
-```
-
-Or, with aurutils, build it into a local repository with `aur build` and install it with pacman.
 
 Then enable the timer:
 
@@ -78,7 +74,9 @@ Settings are read from `$XDG_CONFIG_HOME/update-notify/config` (default `~/.conf
 
 - `THRESHOLD`: minimum number of updates before update counts are shown (default 30).
 - `AUR_REPO`: name of the local aurutils repository (default `aur-local`).
-- `KERNELS`: maps each stock kernel package to its custom build (default: `linux`, `linux-lts` and `linux-zen` to `<name>-custom`). Kernels where either package isn't installed are skipped. Set `KERNELS=()` to disable the kernel check.
+- `KERNELS`: maps each stock kernel package to its custom build, e.g. `KERNELS=([linux-lts]=linux-lts-custom)`. Empty by default, which disables the kernel check. Kernels where either package isn't installed are skipped.
+- `PACNEW_CHECK`: set to `0` to disable the `.pacnew`/`.pacsave` reminder (default `1`).
+- `REBOOT_CHECK`: set to `0` to disable the reboot reminder (default `1`). A reboot is needed when the running kernel's `/usr/lib/modules/<version>/vmlinuz` is gone.
 
 A commented sample config is installed with the package. To start from it:
 
@@ -100,9 +98,11 @@ threshold <THRESHOLD from the config, not the argument>
 repo <pkg> <newver>
 aur <pkg> <newver>
 kernel <custom-pkg> <stock-ver>
+pacnew <path>
+reboot <running kernel version>
 ```
 
-The file reflects the last timer or `update-notify.path` run. To keep a bar current in between, e.g. right after an upgrade, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
+The file reflects the last timer or `update-notify.path` run. To keep a bar current in between, e.g. right after an upgrade, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`; for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`); for `pacnew` lines, whose file is gone; for `reboot` lines, whose version is no longer `uname -r`. This only reads local data, so it's cheap to run often.
 
 ## License
 

config.example

@@ -9,11 +9,16 @@
 # Name of the local aurutils repository.
 #AUR_REPO="aur-local"
 
-# Stock kernel package -> your custom build of it. Replaces the whole list;
+# Stock kernel package -> your custom build of it, to be reminded to rebuild
-# kernels where either package isn't installed are skipped.
+# it. Empty by default (no kernel check); kernels where either package isn't
-# Set KERNELS=() to disable the kernel check.
+# installed are skipped. Example:
 #KERNELS=(
 #    [linux]="linux-custom"
 #    [linux-lts]="linux-lts-custom"
-#    [linux-zen]="linux-zen-custom"
 #)
+
+# Remind about .pacnew/.pacsave files to merge with pacdiff (0 to disable).
+#PACNEW_CHECK=1
+
+# Remind to reboot after the running kernel was upgraded (0 to disable).
+#REBOOT_CHECK=1

tests/stubs/aur

@@ -0,0 +1,8 @@
+#!/bin/bash
+# "aur repo -u -d <repo>": prints $STUB_DATA/aur, exits $AUR_RC (default 0).
+printf '%s %s\n' "${0##*/}" "$*" >> "$STUB_DATA/calls"
+[[ ${1:-} == repo ]] || exit 1
+if [[ -s $STUB_DATA/aur ]]; then
+    printf '%s\n' "$(<"$STUB_DATA/aur")"
+fi
+exit "${AUR_RC:-0}"

tests/stubs/checkupdates

@@ -0,0 +1,8 @@
+#!/bin/bash
+# Prints $STUB_DATA/checkupdates; exits $CHECKUPDATES_RC, else 0 with updates and 2 without, like the real one.
+printf '%s %s\n' "${0##*/}" "$*" >> "$STUB_DATA/calls"
+if [[ -s $STUB_DATA/checkupdates ]]; then
+    printf '%s\n' "$(<"$STUB_DATA/checkupdates")"
+    exit "${CHECKUPDATES_RC:-0}"
+fi
+exit "${CHECKUPDATES_RC:-2}"

tests/stubs/fwupdmgr

@@ -0,0 +1,4 @@
+#!/bin/bash
+# Exits $FWUPD_RC: 0 = firmware updates available, 2 (default) = none.
+printf '%s %s\n' "${0##*/}" "$*" >> "$STUB_DATA/calls"
+exit "${FWUPD_RC:-2}"

tests/stubs/git-monitor

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Only needs to exist: the script checks for it with command -v.
+exit 0

tests/stubs/notify-send

@@ -0,0 +1,4 @@
+#!/bin/bash
+# Appends the title, the body and a "--" line to $STUB_DATA/notify; exits $NOTIFY_RC (default 0).
+printf '%s\n' "$1" "$2" -- >> "$STUB_DATA/notify"
+exit "${NOTIFY_RC:-0}"

tests/stubs/pacdiff

@@ -0,0 +1,8 @@
+#!/bin/bash
+# "pacdiff -o": prints $STUB_DATA/pacdiff.
+printf '%s %s\n' "${0##*/}" "$*" >> "$STUB_DATA/calls"
+[[ ${1:-} == -o ]] || exit 1
+if [[ -s $STUB_DATA/pacdiff ]]; then
+    printf '%s\n' "$(<"$STUB_DATA/pacdiff")"
+fi
+exit 0

tests/stubs/pacman

@@ -0,0 +1,13 @@
+#!/bin/bash
+# "pacman -Q <pkg>": looks the package up in $STUB_DATA/installed ("name version" lines).
+[[ ${1:-} == -Q && $# == 2 ]] || { echo "pacman stub: unsupported arguments: $*" >&2; exit 1; }
+if [[ -f $STUB_DATA/installed ]]; then
+    while read -r name ver; do
+        if [[ $name == "$2" ]]; then
+            printf '%s %s\n' "$name" "$ver"
+            exit 0
+        fi
+    done < "$STUB_DATA/installed"
+fi
+printf "error: package '%s' was not found\n" "$2" >&2
+exit 1

tests/stubs/uname

@@ -0,0 +1,3 @@
+#!/bin/bash
+# "uname -r": prints $STUB_KERNEL.
+printf '%s\n' "$STUB_KERNEL"

tests/update-notify.bats

@@ -0,0 +1,410 @@
+#!/usr/bin/env bats
+# Black-box tests: the script runs with the stubs in tests/stubs and temp config/state folders.
+
+bats_require_minimum_version 1.5.0
+bats_load_library bats-support
+bats_load_library bats-assert
+
+SCRIPT=$BATS_TEST_DIRNAME/../update-notify
+
+setup() {
+    export STUB_DATA=$BATS_TEST_TMPDIR/data
+    export XDG_CONFIG_HOME=$BATS_TEST_TMPDIR/config
+    export XDG_STATE_HOME=$BATS_TEST_TMPDIR/state
+    # The running kernel has its vmlinuz, so the reboot check stays quiet unless a test changes STUB_KERNEL
+    export STUB_KERNEL=6.1.1-test
+    export UPDATE_NOTIFY_MODULES_DIR=$BATS_TEST_TMPDIR/modules
+    STATE=$XDG_STATE_HOME/update-notify
+    BIN=$BATS_TEST_TMPDIR/bin
+    mkdir -p "$STUB_DATA" "$XDG_CONFIG_HOME/update-notify" "$BIN" "$UPDATE_NOTIFY_MODULES_DIR/$STUB_KERNEL"
+    touch "$UPDATE_NOTIFY_MODULES_DIR/$STUB_KERNEL/vmlinuz"
+    # PATH holds only the stubs and the real tools the script needs, so a removed stub is a missing command
+    local tool
+    for tool in mkdir mv rm id timeout vercmp; do
+        ln -s "$(command -v "$tool")" "$BIN/$tool"
+    done
+    for tool in checkupdates aur pacman pacdiff uname notify-send; do
+        enable_stub "$tool"
+    done
+}
+
+enable_stub() { ln -s "$BATS_TEST_DIRNAME/stubs/$1" "$BIN/$1"; }
+disable_stub() { rm "$BIN/$1"; }
+config() { printf '%s\n' "$@" >> "$XDG_CONFIG_HOME/update-notify/config"; }
+repo_updates() { printf '%s\n' "$@" > "$STUB_DATA/checkupdates"; }
+aur_updates() { printf '%s\n' "$@" > "$STUB_DATA/aur"; }
+installed() { printf '%s\n' "$@" > "$STUB_DATA/installed"; }
+pacnew_files() { printf '%s\n' "$@" > "$STUB_DATA/pacdiff"; }
+custom_linux() { config "KERNELS=([linux]=linux-custom)"; }
+
+# Runs the script; notifications and stub calls are logged from this run only
+run_script() {
+    rm -f "$STUB_DATA/notify" "$STUB_DATA/calls"
+    run /usr/bin/env PATH="$BIN" "$SCRIPT" "$@"
+}
+
+# Args: title, then body lines
+assert_notification() {
+    local actual expected
+    actual=$(<"$STUB_DATA/notify") || fail "no notification sent"
+    printf -v expected '%s\n' "$@" --
+    assert_equal "$actual" "${expected%$'\n'}"
+}
+
+assert_no_notification() {
+    [[ ! -e $STUB_DATA/notify ]] || fail "unexpected notification: $(<"$STUB_DATA/notify")"
+}
+
+assert_pending() {
+    local expected
+    printf -v expected '%s\n' "$@"
+    assert_equal "$(<"$STATE/pending")" "${expected%$'\n'}"
+}
+
+assert_called() {
+    grep -qxF -- "$1" "$STUB_DATA/calls" || fail "not called: $1"
+}
+
+# --- Threshold and arguments ---
+
+@test "no updates: no notification, pending file has only the threshold" {
+    run_script
+    assert_success
+    assert_no_notification
+    assert_pending "threshold 30"
+}
+
+@test "below the threshold: no notification, updates listed in the pending file" {
+    repo_updates "foo 1-1 -> 2-1"
+    aur_updates "bar 1-1 -> 1.1-1"
+    run_script
+    assert_success
+    assert_no_notification
+    assert_pending "threshold 30" "repo foo 2-1" "aur bar 1.1-1"
+}
+
+@test "threshold reached: notifies the counts" {
+    config THRESHOLD=2
+    repo_updates "foo 1-1 -> 2-1"
+    aur_updates "bar 1-1 -> 1.1-1"
+    run_script
+    assert_success
+    assert_notification "Updates available" "Arch: 1, AUR: 1"
+}
+
+@test "threshold argument overrides the config, pending file keeps the config value" {
+    config THRESHOLD=5
+    repo_updates "foo 1-1 -> 2-1" "baz 1-1 -> 2-1"
+    run_script 2
+    assert_success
+    assert_notification "Updates available" "Arch: 2, AUR: 0"
+    assert_pending "threshold 5" "repo foo 2-1" "repo baz 2-1"
+}
+
+@test "threshold with a leading zero is read as decimal" {
+    repo_updates "a 1 -> 2" "b 1 -> 2" "c 1 -> 2" "d 1 -> 2" "e 1 -> 2" "f 1 -> 2" "g 1 -> 2" "h 1 -> 2" "i 1 -> 2"
+    run_script 010  # octal would be 8
+    assert_success
+    assert_no_notification
+}
+
+@test "non-numeric threshold argument fails before touching the state" {
+    run_script abc
+    assert_failure 1
+    assert_output "Threshold must be a number"
+    [[ ! -e $STATE ]]
+}
+
+@test "non-numeric threshold in the config fails" {
+    config THRESHOLD=many
+    run_script
+    assert_failure 1
+    assert_output "Threshold must be a number"
+}
+
+# --- Gathering updates ---
+
+@test "checkupdates failure exits without touching the state" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0"
+    cp -r "$STATE" "$BATS_TEST_TMPDIR/before"
+
+    repo_updates "foo 1-1 -> 2-1" "baz 1-1 -> 2-1"
+    CHECKUPDATES_RC=1 run_script
+    assert_failure 1
+    assert_output --partial "checkupdates failed"
+    assert_no_notification
+    diff -r "$BATS_TEST_TMPDIR/before" "$STATE"
+}
+
+@test "aur repo -u failure warns and counts no AUR updates" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    aur_updates "bar 1-1 -> 1.1-1"
+    AUR_RC=1 run_script
+    assert_success
+    assert_output --partial "aur repo -u failed"
+    assert_notification "Updates available" "Arch: 1, AUR: 0"
+    assert_pending "threshold 1" "repo foo 2-1"
+}
+
+@test "aur missing: AUR updates count 0 without a warning" {
+    disable_stub aur
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    assert_success
+    assert_output ""
+    assert_notification "Updates available" "Arch: 1, AUR: 0"
+}
+
+@test "aur is queried for the configured repo" {
+    config AUR_REPO=myrepo
+    run_script
+    assert_success
+    assert_called "aur repo -u -d myrepo"
+}
+
+# --- Kernel check ---
+
+@test "no kernel check by default" {
+    installed "linux 6.1.1-1" "linux-custom 6.1.1-1"
+    repo_updates "linux 6.1.1-1 -> 6.1.2-1"
+    run_script
+    assert_success
+    assert_no_notification
+    assert_pending "threshold 30" "repo linux 6.1.2-1"
+}
+
+@test "stock kernel update notifies the rebuild below the threshold" {
+    custom_linux
+    installed "linux 6.1.1-1" "linux-custom 6.1.1-1"
+    repo_updates "linux 6.1.1-1 -> 6.1.2-1"
+    run_script
+    assert_success
+    assert_notification "Kernel update available" "Rebuild linux-custom (linux 6.1.2-1)"
+    assert_pending "threshold 30" "repo linux 6.1.2-1" "kernel linux-custom 6.1.2-1"
+}
+
+@test "kernel rebuild joins the counts over the threshold" {
+    config THRESHOLD=1
+    custom_linux
+    installed "linux 6.1.2-1" "linux-custom 6.1.1-1"
+    run_script 0
+    assert_success
+    assert_notification "Updates available" "Arch: 0, AUR: 0" "Rebuild linux-custom (linux 6.1.2-1)"
+}
+
+@test "kernel check ignores pkgrel" {
+    custom_linux
+    installed "linux 6.1.1-1" "linux-custom 6.1.1-1"
+    repo_updates "linux 6.1.1-1 -> 6.1.1-2"
+    run_script
+    assert_success
+    assert_no_notification
+}
+
+@test "custom kernel already built into the repo isn't flagged" {
+    custom_linux
+    installed "linux 6.1.1-1" "linux-custom 6.1.1-1"
+    repo_updates "linux 6.1.1-1 -> 6.1.2-1" "linux-custom 6.1.1-1 -> 6.1.2-1"
+    run_script
+    assert_success
+    assert_no_notification
+}
+
+@test "kernels without a custom build installed are skipped" {
+    custom_linux
+    installed "linux 6.1.1-1"
+    repo_updates "linux 6.1.1-1 -> 6.1.2-1"
+    run_script
+    assert_success
+    assert_no_notification
+}
+
+@test "custom kernel map comes from the config" {
+    config "KERNELS=([linux-hardened]=linux-hardened-mine)"
+    installed "linux-hardened 6.1.2-1" "linux-hardened-mine 6.1.1-1"
+    run_script
+    assert_success
+    assert_notification "Kernel update available" "Rebuild linux-hardened-mine (linux-hardened 6.1.2-1)"
+}
+
+# --- Notification state ---
+
+@test "same updates don't notify again, a change does" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0"
+
+    run_script
+    assert_success
+    assert_no_notification
+
+    repo_updates "foo 1-1 -> 2-1" "baz 1-1 -> 2-1"
+    run_script
+    assert_notification "Updates available" "Arch: 2, AUR: 0"
+}
+
+@test "updates gone: the next ones notify again" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    rm "$STUB_DATA/checkupdates"
+    run_script
+    assert_no_notification
+    [[ ! -e $STATE/updates ]]
+
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0"
+}
+
+@test "failed notify-send isn't remembered, the next run retries" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    pacnew_files /etc/a.pacnew
+    NOTIFY_RC=1 run_script
+    [[ ! -e $STATE/updates && ! -e $STATE/maintenance ]]
+
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0" "Config files to merge with pacdiff: 1"
+}
+
+# --- Quiet runs (path unit) ---
+
+@test "--quiet writes the pending file but leaves a new notification to the timer" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script --quiet
+    assert_success
+    assert_no_notification
+    assert_pending "threshold 1" "repo foo 2-1"
+    [[ ! -e $STATE/updates ]]
+
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0"
+}
+
+@test "--quiet tracks changes to a shown notification, so the timer doesn't repeat them" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    repo_updates "foo 1-1 -> 2-1" "baz 1-1 -> 2-1"
+    run_script -q
+    assert_no_notification
+
+    run_script
+    assert_no_notification
+}
+
+@test "--quiet leaves new maintenance items to the timer" {
+    pacnew_files /etc/a.pacnew
+    run_script --quiet
+    assert_no_notification
+    [[ ! -e $STATE/maintenance ]]
+
+    run_script
+    assert_notification "System maintenance" "Config files to merge with pacdiff: 1"
+}
+
+@test "--quiet takes a threshold argument after it" {
+    repo_updates "foo 1-1 -> 2-1"
+    run_script --quiet 1
+    assert_success
+    assert_no_notification
+    assert_pending "threshold 30" "repo foo 2-1"
+}
+
+# --- Maintenance reminders ---
+
+@test "pacnew files notify alone only when new" {
+    pacnew_files /etc/a.pacnew /etc/b.pacsave
+    run_script
+    assert_success
+    assert_notification "System maintenance" "Config files to merge with pacdiff: 2"
+    assert_pending "threshold 30" "pacnew /etc/a.pacnew" "pacnew /etc/b.pacsave"
+
+    run_script
+    assert_no_notification
+
+    pacnew_files /etc/a.pacnew /etc/b.pacsave /etc/c.pacnew
+    run_script
+    assert_notification "System maintenance" "Config files to merge with pacdiff: 3"
+
+    rm "$STUB_DATA/pacdiff"
+    run_script
+    assert_no_notification
+    [[ ! -e $STATE/maintenance ]]
+}
+
+@test "maintenance lines join every update notification" {
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    pacnew_files /etc/a.pacnew
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0" "Config files to merge with pacdiff: 1"
+
+    repo_updates "foo 1-1 -> 2-1" "baz 1-1 -> 2-1"
+    run_script
+    assert_notification "Updates available" "Arch: 2, AUR: 0" "Config files to merge with pacdiff: 1"
+}
+
+@test "reboot reminder when the running kernel's vmlinuz is gone" {
+    STUB_KERNEL=0.0.0-gone run_script
+    assert_success
+    assert_notification "System maintenance" "Reboot to load the new kernel (running 0.0.0-gone)"
+    assert_pending "threshold 30" "reboot 0.0.0-gone"
+}
+
+@test "REBOOT_CHECK=0 disables the reboot reminder" {
+    config REBOOT_CHECK=0
+    STUB_KERNEL=0.0.0-gone run_script
+    assert_success
+    assert_no_notification
+}
+
+@test "PACNEW_CHECK=0 skips pacdiff" {
+    config PACNEW_CHECK=0
+    pacnew_files /etc/a.pacnew
+    run_script
+    assert_success
+    assert_no_notification
+    run ! grep -q '^pacdiff' "$STUB_DATA/calls"
+}
+
+# --- Reminders over the threshold ---
+
+@test "git-monitor and firmware reminders over the threshold" {
+    enable_stub git-monitor
+    enable_stub fwupdmgr
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    FWUPD_RC=0 run_script
+    assert_success
+    assert_notification "Updates available" "Arch: 1, AUR: 0" \
+        "Also check: git-monitor, fwupdmgr (firmware updates available)"
+    assert_called "fwupdmgr get-updates --no-metadata-check"
+}
+
+@test "no firmware reminder without firmware updates" {
+    enable_stub git-monitor
+    enable_stub fwupdmgr
+    config THRESHOLD=1
+    repo_updates "foo 1-1 -> 2-1"
+    run_script
+    assert_notification "Updates available" "Arch: 1, AUR: 0" "Also check: git-monitor"
+}
+
+@test "no reminders below the threshold" {
+    enable_stub git-monitor
+    enable_stub fwupdmgr
+    custom_linux
+    installed "linux 6.1.2-1" "linux-custom 6.1.1-1"
+    run_script
+    assert_notification "Kernel update available" "Rebuild linux-custom (linux 6.1.2-1)"
+    run ! grep -q '^fwupdmgr' "$STUB_DATA/calls"
+}

update-notify

@@ -6,12 +6,11 @@ set -u
 # ---------------------------------------------------------------------------
 THRESHOLD=30
 AUR_REPO="aur-local"
-# stock kernel package -> your custom build of it
+# stock kernel package -> your custom build of it; none by default.
-declare -A KERNELS=(
+# Declared here so a [stock]=custom list in the config stays associative.
-    [linux]="linux-custom"
+declare -A KERNELS=()
-    [linux-lts]="linux-lts-custom"
+PACNEW_CHECK=1  # remind about .pacnew/.pacsave files (0 to disable)
-    [linux-zen]="linux-zen-custom"
+REBOOT_CHECK=1  # remind to reboot after a kernel upgrade (0 to disable)
-)
 config_file="${XDG_CONFIG_HOME:-$HOME/.config}/update-notify/config"
 state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/update-notify"
 
@@ -42,27 +41,6 @@ export DBUS_SESSION_BUS_ADDRESS="${DBUS_SESSION_BUS_ADDRESS:-unix:path=/run/user
 # Helpers
 # ---------------------------------------------------------------------------
 
-# Send a notification only if its body changed since last time for this key.
-notify_once() {
-    local key=$1 title=$2 body=$3
-    local file="$state_dir/$key"
-    if [[ -f $file && $(<"$file") == "$body" ]]; then
-        return 0
-    fi
-    if (( quiet )); then
-        # Track changes to a shown notification, so the timer doesn't re-notify them;
-        # leave a new one for the timer to show
-        [[ -f $file ]] && printf '%s' "$body" > "$file"
-        return 0
-    fi
-    notify-send "$title" "$body" && printf '%s' "$body" > "$file"
-}
-
-# Forget a key so the next occurrence notifies again.
-clear_state() {
-    rm -f "$state_dir/$1"
-}
-
 # If $1 has a pending update, print its new version and return 0.
 # checkupdates lines look like: "pkgname oldver -> newver"
 pending_version() {
@@ -142,6 +120,27 @@ for stock_pkg in "${!KERNELS[@]}"; do
     fi
 done
 
+# ---------------------------------------------------------------------------
+# Maintenance: config files to merge, reboot after a kernel upgrade.
+# maint_items are tracked in the state and the pending file, maint_lines are shown.
+# ---------------------------------------------------------------------------
+maint_items=()
+maint_lines=()
+if [[ $PACNEW_CHECK != 0 ]]; then
+    mapfile -t pacnew_files < <(pacdiff -o 2>/dev/null)
+    if (( ${#pacnew_files[@]} )); then
+        maint_items+=("${pacnew_files[@]/#/pacnew }")
+        maint_lines+=("Config files to merge with pacdiff: ${#pacnew_files[@]}")
+    fi
+fi
+running_kernel=$(uname -r)
+modules_dir=${UPDATE_NOTIFY_MODULES_DIR:-/usr/lib/modules}  # override for tests (build chroots have no kernel)
+# vmlinuz belongs to the kernel package, while DKMS files can keep the folder around
+if [[ $REBOOT_CHECK != 0 && ! -e $modules_dir/$running_kernel/vmlinuz ]]; then
+    maint_items+=("reboot $running_kernel")
+    maint_lines+=("Reboot to load the new kernel (running $running_kernel)")
+fi
+
 # ---------------------------------------------------------------------------
 # Pending list for status bars, one "<source> <pkg> <newver>" per line
 # ---------------------------------------------------------------------------
@@ -158,6 +157,9 @@ done
     for item in "${kernel_pending[@]}"; do
         printf 'kernel %s\n' "$item"
     done
+    for item in "${maint_items[@]}"; do
+        printf '%s\n' "$item"
+    done
 } > "$state_dir/pending.tmp" && mv "$state_dir/pending.tmp" "$state_dir/pending"  # readers never see a partial file
 
 # ---------------------------------------------------------------------------
@@ -197,11 +199,66 @@ if (( over_threshold )); then
     fi
 fi
 
+# ---------------------------------------------------------------------------
+# Notify when the update part changed since the last notification (maintenance
+# lines included), or for maintenance alone when it has items not shown before
+# ---------------------------------------------------------------------------
+main_file="$state_dir/updates"
+main_body=""
+main_changed=0
 if (( ${#parts[@]} )); then
+    printf -v main_body '%s\n' "${parts[@]}"
+    main_body=${main_body%$'\n'}
+    [[ -f $main_file && $(<"$main_file") == "$main_body" ]] || main_changed=1
+else
+    rm -f "$main_file"  # so the next occurrence notifies again
+fi
+
+maint_file="$state_dir/maintenance"
+declare -A maint_seen=()
+if [[ -f $maint_file ]]; then
+    while IFS= read -r item; do
+        maint_seen["$item"]=1
+    done < "$maint_file"
+fi
+maint_new=0
+maint_kept=()  # current items already shown
+for item in "${maint_items[@]}"; do
+    if [[ -n ${maint_seen["$item"]:-} ]]; then
+        maint_kept+=("$item")
+    else
+        maint_new=1
+    fi
+done
+
+lines=()
+if (( main_changed )); then
+    lines=("${parts[@]}" "${maint_lines[@]}")
     title="Updates available"
     (( over_threshold )) || title="Kernel update available"
-    printf -v body '%s\n' "${parts[@]}"
+elif (( maint_new )); then
-    notify_once "updates" "$title" "${body%$'\n'}"
+    lines=("${maint_lines[@]}")
-else
+    title="System maintenance"
-    clear_state "updates"
+fi
+
+shown=0
+if (( ${#lines[@]} )); then
+    printf -v body '%s\n' "${lines[@]}"
+    if (( quiet )); then
+        # Track changes to a shown notification, so the timer doesn't re-notify them;
+        # leave a new one for the timer to show
+        (( main_changed )) && [[ -f $main_file ]] && printf '%s' "$main_body" > "$main_file"
+    elif notify-send "$title" "${body%$'\n'}"; then
+        shown=1
+        [[ -n $main_body ]] && printf '%s' "$main_body" > "$main_file"
+    fi
+fi
+
+# Remember the maintenance items shown: drop resolved ones, keep new ones for the next notification
+maint_save=("${maint_kept[@]}")
+(( shown )) && maint_save=("${maint_items[@]}")
+if (( ${#maint_save[@]} )); then
+    printf '%s\n' "${maint_save[@]}" > "$maint_file"
+else
+    rm -f "$maint_file"
 fi