Record trustsight reviews in the reminder

trustsight review is read-only by default, so each run compared only against the previous AUR commit instead of the last reviewed one.

PKGBUILD

@@ -3,27 +3,31 @@
 # Maintainer: Daniele Fucini <dfucini [at] gmail [dot] com>
 
 pkgname=update-notify
-pkgver=3.4
+pkgver=3.11
 pkgrel=1
 pkgdesc='Notify when updates are available'
 arch=('any')
-url="https://git.shouldnt.work/fuxino/${pkgname}"
+url="https://git.shouldnt.work/fuxino/$pkgname"
 license=('GPL-3.0-or-later')
 depends=('pacman-contrib'
          'libnotify')
 makedepends=('git')
 optdepends=('aurutils: to check AUR packages in the local repo for updates'
             'fwupd: to check for firmware updates'
-            'git-monitor: to check git repos for updates')
-source=("git+${url}?signed#tag=${pkgver}")
+            'git-monitor: to check git repos for updates'
+            'trustsight: to vet AUR updates before building them')
+source=("git+$url?signed#tag=$pkgver")
 validpgpkeys=('7E12BC1FF3B6EDB2CD8053EB981A2B2A3BBF5514')
-sha256sums=('12a68498d50871264f4a0ed082ff29a361676cf134c43520f98ee3f287e45509')
+sha256sums=('d298653e424465665d34896eee38f9e5cc6a1da6e319915011fa00106eac0a2e')
 
 package()
 {
-    cd "${srcdir}/${pkgname}"
-    install -Dm755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
-    install -Dm644 "${pkgname}.service" "${pkgdir}/usr/lib/systemd/user/${pkgname}.service"
-    install -Dm644 "${pkgname}.timer" "${pkgdir}/usr/lib/systemd/user/${pkgname}.timer"
-    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
+    cd "$srcdir"/"$pkgname"
+    install -Dm755 "$pkgname" "$pkgdir"/usr/bin/"$pkgname"
+    install -Dm644 "$pkgname".service "$pkgdir"/usr/lib/systemd/user/"$pkgname".service
+    install -Dm644 "$pkgname"-quiet.service "$pkgdir"/usr/lib/systemd/user/"$pkgname"-quiet.service
+    install -Dm644 "$pkgname".timer "$pkgdir"/usr/lib/systemd/user/"$pkgname".timer
+    install -Dm644 "$pkgname".path "$pkgdir"/usr/lib/systemd/user/"$pkgname".path
+    install -Dm644 README.md "$pkgdir"/usr/share/doc/"$pkgname"/README.md
+    install -Dm644 config.example "$pkgdir"/usr/share/doc/"$pkgname"/config.example
 }

README.md

@@ -10,7 +10,7 @@ update-notify runs on a systemd user timer and checks:
 
 It sends one notification, and only when its content changes since the last one:
 
-- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed.
+- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed, and one to run `trustsight` before building pending AUR updates.
 - Kernel rebuild reminders are always shown, even below the threshold.
 
 ## Requirements
@@ -23,6 +23,7 @@ Optional:
 - `aurutils`: check AUR packages in the local repository
 - `fwupd`: check for firmware updates
 - `git-monitor`: remind to check git packages
+- `trustsight`: remind to vet AUR updates before building them
 
 ## Installation
 
@@ -42,13 +43,35 @@ systemctl --user enable --now update-notify.timer
 
 The timer runs 5 minutes after boot, then every 6 hours.
 
+### Refresh after building packages
+
+To run `update-notify --quiet` whenever a repository changes, add the repository files to watch to `update-notify.path`:
+
+```
+systemctl --user edit update-notify.path
+```
+
+```
+[Path]
+PathChanged=/home/aur-local/aur-local.db.tar.gz.sig
+PathChanged=/home/custom-pkgs/custom-pkgs.db.tar.gz.sig
+```
+
+Watch the `.db.tar.gz.sig` file for signed repositories, or `.db.tar.gz` for unsigned ones (`.db` is a symlink). Then enable it:
+
+```
+systemctl --user enable --now update-notify.path
+```
+
 ## Usage
 
 ```
-update-notify [threshold]
+update-notify [-q|--quiet] [threshold]
 ```
 
-`threshold` is the minimum number of updates (repo + AUR) before update counts are shown. It overrides the `THRESHOLD` setting below.
+`threshold` is the minimum number of updates (repo + AUR) before update counts are shown. It overrides the `THRESHOLD` setting below for that run's notification only; the pending file keeps the configured value.
+
+`--quiet` updates the pending file without notifying. Changes to a notification already shown are recorded, so the next timer run doesn't repeat them; a new notification is left for the timer. `update-notify.path` uses it (through `update-notify-quiet.service`), so building many packages doesn't notify after each one.
 
 ## Configuration
 
@@ -69,6 +92,19 @@ Kernel versions are compared without `pkgrel`, so a stock packaging-only update
 
 The content of the last notification is stored in `$XDG_STATE_HOME/update-notify` (default `~/.local/state/update-notify`). Delete it to get the current notification again.
 
+## Status bars
+
+Each run also writes the pending updates to `$XDG_STATE_HOME/update-notify/pending`, whether or not the threshold is reached, for status bars such as xmobar to read:
+
+```
+threshold <THRESHOLD from the config, not the argument>
+repo <pkg> <newver>
+aur <pkg> <newver>
+kernel <custom-pkg> <stock-ver>
+```
+
+The file reflects the last timer or `update-notify.path` run. To keep a bar current in between, e.g. right after an upgrade, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
+
 ## License
 
 GPL-3.0-or-later. See [LICENSE](LICENSE).

update-notify

@@ -19,10 +19,20 @@ if [[ -r $config_file ]]; then
     # shellcheck source=/dev/null
     source "$config_file"
 fi
+quiet=0  # refresh the pending file without notifying (path unit)
+if [[ ${1:-} == -q || ${1:-} == --quiet ]]; then
+    quiet=1
+    shift
+fi
+config_threshold=$THRESHOLD  # written to the pending file, so a one-off argument doesn't change status bars
 THRESHOLD=${1:-$THRESHOLD}
 
-[[ $THRESHOLD =~ ^[0-9]+$ ]] || { echo "Threshold must be a number" >&2; exit 1; }
-THRESHOLD=$((10#$THRESHOLD))  # force base 10, so e.g. "08" isn't read as octal
+for t in "$config_threshold" "$THRESHOLD"; do
+    [[ $t =~ ^[0-9]+$ ]] || { echo "Threshold must be a number" >&2; exit 1; }
+done
+# force base 10, so e.g. "08" isn't read as octal
+config_threshold=$((10#$config_threshold))
+THRESHOLD=$((10#$THRESHOLD))
 mkdir -p "$state_dir"
 
 # notify-send from cron/systemd needs the session bus address
@@ -39,6 +49,12 @@ notify_once() {
     if [[ -f $file && $(<"$file") == "$body" ]]; then
         return 0
     fi
+    if (( quiet )); then
+        # Track changes to a shown notification, so the timer doesn't re-notify them;
+        # leave a new one for the timer to show
+        [[ -f $file ]] && printf '%s' "$body" > "$file"
+        return 0
+    fi
     notify-send "$title" "$body" && printf '%s' "$body" > "$file"
 }
 
@@ -93,20 +109,22 @@ if [[ -n $checkupdates_out ]]; then
 fi
 arch_updates=${#arch_list[@]}
 
-aur_updates=0
+aur_list=()
 if command -v aur >/dev/null 2>&1; then
     if aur_out=$(aur repo -u -d "$AUR_REPO"); then
-        [[ -n $aur_out ]] && aur_updates=$(wc -l <<< "$aur_out")
+        [[ -n $aur_out ]] && mapfile -t aur_list <<< "$aur_out"
     else
         echo "aur repo -u failed, AUR updates not counted" >&2
     fi
 fi
+aur_updates=${#aur_list[@]}
 updates=$((arch_updates + aur_updates))
 
 # ---------------------------------------------------------------------------
 # Kernel check: the stock kernel updated, but your custom build didn't
 # ---------------------------------------------------------------------------
 kernel_lines=()
+kernel_pending=()
 for stock_pkg in "${!KERNELS[@]}"; do
     custom_pkg=${KERNELS[$stock_pkg]}
 
@@ -120,9 +138,28 @@ for stock_pkg in "${!KERNELS[@]}"; do
     # pkgrel is ignored: a stock packaging-only bump doesn't need a rebuild.
     if (( $(vercmp "${stock_ver%-*}" "${custom_ver%-*}") > 0 )); then
         kernel_lines+=("Rebuild $custom_pkg ($stock_pkg $stock_ver)")
+        kernel_pending+=("$custom_pkg $stock_ver")
     fi
 done
 
+# ---------------------------------------------------------------------------
+# Pending list for status bars, one "<source> <pkg> <newver>" per line
+# ---------------------------------------------------------------------------
+{
+    printf 'threshold %s\n' "$config_threshold"
+    for item in "${arch_list[@]}"; do
+        read -r pkg _ _ new <<< "$item"
+        printf 'repo %s %s\n' "$pkg" "$new"
+    done
+    for item in "${aur_list[@]}"; do
+        read -r pkg _ _ new <<< "$item"
+        printf 'aur %s %s\n' "$pkg" "$new"
+    done
+    for item in "${kernel_pending[@]}"; do
+        printf 'kernel %s\n' "$item"
+    done
+} > "$state_dir/pending.tmp" && mv "$state_dir/pending.tmp" "$state_dir/pending"  # readers never see a partial file
+
 # ---------------------------------------------------------------------------
 # Build a single notification
 #   - kernel rebuild lines are always included
@@ -154,6 +191,11 @@ if (( over_threshold )); then
         fi
     fi
 
+    # Vet AUR changes before building them
+    if (( aur_updates )) && command -v trustsight >/dev/null 2>&1; then
+        parts+=("Before aur sync: trustsight review --record --repo $AUR_REPO")
+    fi
+
     if (( ${#reminders[@]} )); then
         printf -v list '%s, ' "${reminders[@]}"
         parts+=("Also check: ${list%, }")

update-notify-quiet.service

@@ -0,0 +1,6 @@
+[Unit]
+Description=Refresh the update-notify pending file without notifying
+
+[Service]
+ExecStart=/usr/bin/update-notify --quiet
+Type=oneshot

update-notify.path

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run update-notify when a local repository changes
+
+# Add the repository files to watch with: systemctl --user edit update-notify.path
+# e.g. PathChanged=/home/aur-local/aur-local.db.tar.gz.sig
+[Path]
+Unit=update-notify-quiet.service
+
+[Install]
+WantedBy=default.target