Remind to run trustsight before building AUR updates

Add a pacman hook that runs update-notify for each logged-in user with the timer active, and a path unit that users can point at their local repo databases to refresh after aur build.

.gitignore

@@ -0,0 +1 @@
+CLAUDE.md

PKGBUILD

@@ -3,11 +3,11 @@
 # Maintainer: Daniele Fucini <dfucini [at] gmail [dot] com>
 
 pkgname=update-notify
-pkgver=3.2
+pkgver=3.7
 pkgrel=1
 pkgdesc='Notify when updates are available'
 arch=('any')
-url="https://git.shouldnt.work/fuxino/${pkgname}"
+url="https://git.shouldnt.work/fuxino/$pkgname"
 license=('GPL-3.0-or-later')
 depends=('pacman-contrib'
          'libnotify')
@@ -15,14 +15,19 @@ makedepends=('git')
 optdepends=('aurutils: to check AUR packages in the local repo for updates'
             'fwupd: to check for firmware updates'
             'git-monitor: to check git repos for updates')
-source=(git+${url}?signed#tag=${pkgver})
+source=("git+$url?signed#tag=$pkgver")
 validpgpkeys=('7E12BC1FF3B6EDB2CD8053EB981A2B2A3BBF5514')
-sha256sums=('a81613c3098c9af6dabe1da67f26efeee4d0753352e38ba4c0ee1d7e86f7d2d7')
+sha256sums=('89ffddcb3fc0b82fdaec61defb374127d720655c35f2157cfe0d543360df22ab')
 
 package()
 {
-    cd "${srcdir}/${pkgname}"
-    install -Dm755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
-    install -Dm644 "${pkgname}.service" "${pkgdir}/usr/lib/systemd/user/${pkgname}.service"
-    install -Dm644 "${pkgname}.timer" "${pkgdir}/usr/lib/systemd/user/${pkgname}.timer"
+    cd "$srcdir"/"$pkgname"
+    install -Dm755 "$pkgname" "$pkgdir"/usr/bin/"$pkgname"
+    install -Dm644 "$pkgname".service "$pkgdir"/usr/lib/systemd/user/"$pkgname".service
+    install -Dm644 "$pkgname".timer "$pkgdir"/usr/lib/systemd/user/"$pkgname".timer
+    install -Dm644 "$pkgname".path "$pkgdir"/usr/lib/systemd/user/"$pkgname".path
+    install -Dm755 "$pkgname"-refresh "$pkgdir"/usr/lib/"$pkgname"/refresh
+    install -Dm644 "$pkgname".hook "$pkgdir"/usr/share/libalpm/hooks/"$pkgname".hook
+    install -Dm644 README.md "$pkgdir"/usr/share/doc/"$pkgname"/README.md
+    install -Dm644 config.example "$pkgdir"/usr/share/doc/"$pkgname"/config.example
 }

README.md

@@ -0,0 +1,110 @@
+# update-notify
+
+Desktop notifications for pending updates on Arch Linux.
+
+update-notify runs on a systemd user timer and checks:
+
+- **Repo updates**, using `checkupdates` from pacman-contrib.
+- **AUR updates** for packages in a local aurutils repository (`aur repo -u`).
+- **Custom kernel rebuilds**: when a stock kernel (e.g. `linux-lts`) has a newer version than your custom build of it (e.g. `linux-lts-custom`).
+
+It sends one notification, and only when its content changes since the last one:
+
+- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed, and one to run `trustsight` before building pending AUR updates.
+- Kernel rebuild reminders are always shown, even below the threshold.
+
+## Requirements
+
+- `pacman-contrib`
+- `libnotify` and a running notification daemon
+
+Optional:
+
+- `aurutils`: check AUR packages in the local repository
+- `fwupd`: check for firmware updates
+- `git-monitor`: remind to check git packages
+- `trustsight`: remind to vet AUR updates before building them
+
+## Installation
+
+Build and install the package with the included PKGBUILD:
+
+```
+makepkg -si
+```
+
+Or, with aurutils, build it into your local repository with `aur build` and install it with pacman.
+
+Then enable the timer:
+
+```
+systemctl --user enable --now update-notify.timer
+```
+
+The timer runs 5 minutes after boot, then every 6 hours.
+
+A pacman hook also runs update-notify after every pacman transaction, for each logged-in user whose timer is active, so the notification and the status bar file are current right after an upgrade.
+
+### Refresh after building packages
+
+Building into a local repository (`aur build`, `aur sync`) doesn't run pacman, so the hook can't catch it. To run update-notify whenever a repository changes, add the repository files to watch to `update-notify.path`:
+
+```
+systemctl --user edit update-notify.path
+```
+
+```
+[Path]
+PathChanged=/home/aur-local/aur-local.db.tar.gz.sig
+PathChanged=/home/custom-pkgs/custom-pkgs.db.tar.gz.sig
+```
+
+Watch the `.db.tar.gz.sig` file for signed repositories, or `.db.tar.gz` for unsigned ones (`.db` is a symlink). Then enable it:
+
+```
+systemctl --user enable --now update-notify.path
+```
+
+## Usage
+
+```
+update-notify [threshold]
+```
+
+`threshold` is the minimum number of updates (repo + AUR) before update counts are shown. It overrides the `THRESHOLD` setting below.
+
+## Configuration
+
+Settings are read from `$XDG_CONFIG_HOME/update-notify/config` (default `~/.config/update-notify/config`), a bash file that is sourced by the script. All settings are optional:
+
+- `THRESHOLD`: minimum number of updates before update counts are shown (default 30).
+- `AUR_REPO`: name of the local aurutils repository (default `aur-local`).
+- `KERNELS`: maps each stock kernel package to its custom build (default: `linux`, `linux-lts` and `linux-zen` to `<name>-custom`). Kernels where either package isn't installed are skipped. Set `KERNELS=()` to disable the kernel check.
+
+A commented sample config is installed with the package. To start from it:
+
+```
+mkdir -p ~/.config/update-notify
+cp /usr/share/doc/update-notify/config.example ~/.config/update-notify/config
+```
+
+Kernel versions are compared without `pkgrel`, so a stock packaging-only update doesn't trigger a rebuild reminder. A custom build already in the local repository but not installed yet counts as up to date.
+
+The content of the last notification is stored in `$XDG_STATE_HOME/update-notify` (default `~/.local/state/update-notify`). Delete it to get the current notification again.
+
+## Status bars
+
+Each run also writes the pending updates to `$XDG_STATE_HOME/update-notify/pending`, whether or not the threshold is reached, for status bars such as xmobar to read:
+
+```
+threshold 30
+repo <pkg> <newver>
+aur <pkg> <newver>
+kernel <custom-pkg> <stock-ver>
+```
+
+The file reflects the last run, which the pacman hook and `update-notify.path` keep close to current. To keep a bar current in between, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
+
+## License
+
+GPL-3.0-or-later. See [LICENSE](LICENSE).

config.example

@@ -0,0 +1,19 @@
+# update-notify configuration, sourced as bash.
+# Copy to ~/.config/update-notify/config and uncomment what you want to change.
+# The values shown are the defaults.
+
+# Minimum number of updates (repo + AUR) before update counts are shown.
+# The command-line argument takes precedence.
+#THRESHOLD=30
+
+# Name of the local aurutils repository.
+#AUR_REPO="aur-local"
+
+# Stock kernel package -> your custom build of it. Replaces the whole list;
+# kernels where either package isn't installed are skipped.
+# Set KERNELS=() to disable the kernel check.
+#KERNELS=(
+#    [linux]="linux-custom"
+#    [linux-lts]="linux-lts-custom"
+#    [linux-zen]="linux-zen-custom"
+#)

update-notify

@@ -2,20 +2,27 @@
 set -u
 
 # ---------------------------------------------------------------------------
-# Config
+# Config: defaults, overridden by the config file, then by the argument
 # ---------------------------------------------------------------------------
-threshold=${1:-30}
+THRESHOLD=30
 AUR_REPO="aur-local"
-# stock kernel package -> your custom build of it. Add or remove entries freely.
+# stock kernel package -> your custom build of it
 declare -A KERNELS=(
     [linux]="linux-custom"
     [linux-lts]="linux-lts-custom"
     [linux-zen]="linux-zen-custom"
 )
+config_file="${XDG_CONFIG_HOME:-$HOME/.config}/update-notify/config"
 state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/update-notify"
 
-[[ $threshold =~ ^[0-9]+$ ]] || { echo "Threshold must be a number" >&2; exit 1; }
-threshold=$((10#$threshold))  # force base 10, so e.g. "08" isn't read as octal
+if [[ -r $config_file ]]; then
+    # shellcheck source=/dev/null
+    source "$config_file"
+fi
+THRESHOLD=${1:-$THRESHOLD}
+
+[[ $THRESHOLD =~ ^[0-9]+$ ]] || { echo "Threshold must be a number" >&2; exit 1; }
+THRESHOLD=$((10#$THRESHOLD))  # force base 10, so e.g. "08" isn't read as octal
 mkdir -p "$state_dir"
 
 # notify-send from cron/systemd needs the session bus address
@@ -86,16 +93,22 @@ if [[ -n $checkupdates_out ]]; then
 fi
 arch_updates=${#arch_list[@]}
 
-aur_updates=0
+aur_list=()
 if command -v aur >/dev/null 2>&1; then
-    aur_updates=$(aur repo -u -d "$AUR_REPO" 2>/dev/null | wc -l)
+    if aur_out=$(aur repo -u -d "$AUR_REPO"); then
+        [[ -n $aur_out ]] && mapfile -t aur_list <<< "$aur_out"
+    else
+        echo "aur repo -u failed, AUR updates not counted" >&2
+    fi
 fi
+aur_updates=${#aur_list[@]}
 updates=$((arch_updates + aur_updates))
 
 # ---------------------------------------------------------------------------
 # Kernel check: the stock kernel updated, but your custom build didn't
 # ---------------------------------------------------------------------------
 kernel_lines=()
+kernel_pending=()
 for stock_pkg in "${!KERNELS[@]}"; do
     custom_pkg=${KERNELS[$stock_pkg]}
 
@@ -109,16 +122,35 @@ for stock_pkg in "${!KERNELS[@]}"; do
     # pkgrel is ignored: a stock packaging-only bump doesn't need a rebuild.
     if (( $(vercmp "${stock_ver%-*}" "${custom_ver%-*}") > 0 )); then
         kernel_lines+=("Rebuild $custom_pkg ($stock_pkg $stock_ver)")
+        kernel_pending+=("$custom_pkg $stock_ver")
     fi
 done
 
+# ---------------------------------------------------------------------------
+# Pending list for status bars, one "<source> <pkg> <newver>" per line
+# ---------------------------------------------------------------------------
+{
+    printf 'threshold %s\n' "$THRESHOLD"
+    for item in "${arch_list[@]}"; do
+        read -r pkg _ _ new <<< "$item"
+        printf 'repo %s %s\n' "$pkg" "$new"
+    done
+    for item in "${aur_list[@]}"; do
+        read -r pkg _ _ new <<< "$item"
+        printf 'aur %s %s\n' "$pkg" "$new"
+    done
+    for item in "${kernel_pending[@]}"; do
+        printf 'kernel %s\n' "$item"
+    done
+} > "$state_dir/pending.tmp" && mv "$state_dir/pending.tmp" "$state_dir/pending"  # readers never see a partial file
+
 # ---------------------------------------------------------------------------
 # Build a single notification
 #   - kernel rebuild lines are always included
 #   - update counts and reminders only when the threshold is reached
 # ---------------------------------------------------------------------------
 over_threshold=0
-(( updates >= threshold )) && over_threshold=1
+(( updates >= THRESHOLD )) && over_threshold=1
 
 parts=()
 if (( over_threshold )); then
@@ -143,6 +175,11 @@ if (( over_threshold )); then
         fi
     fi
 
+    # Vet AUR changes before building them
+    if (( aur_updates )) && command -v trustsight >/dev/null 2>&1; then
+        parts+=("Before aur sync: trustsight review --repo $AUR_REPO")
+    fi
+
     if (( ${#reminders[@]} )); then
         printf -v list '%s, ' "${reminders[@]}"
         parts+=("Also check: ${list%, }")

update-notify-refresh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Run update-notify for every logged-in user whose timer is active (called by the pacman hook as root)
+systemctl list-units --plain --no-legend --state=running 'user@*.service' |
+while read -r unit _; do
+    uid=${unit#user@}
+    uid=${uid%.service}
+    user=$(id -nu "$uid") || continue
+    systemctl --user -M "$user@" is-active --quiet update-notify.timer || continue
+    systemctl --user -M "$user@" start --no-block update-notify.service
+done

update-notify.hook

@@ -0,0 +1,11 @@
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Refreshing update-notify...
+When = PostTransaction
+Exec = /usr/lib/update-notify/refresh

update-notify.path

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run update-notify when a local repository changes
+
+# Add the repository files to watch with: systemctl --user edit update-notify.path
+# e.g. PathChanged=/home/aur-local/aur-local.db.tar.gz.sig
+[Path]
+Unit=update-notify.service
+
+[Install]
+WantedBy=default.target

update-notify.service

@@ -2,5 +2,5 @@
 Description=Notify if updates are available
 
 [Service]
-ExecStart=/usr/bin/update-notify 30
+ExecStart=/usr/bin/update-notify
 Type=oneshot