Remind to run trustsight before building AUR updates

Add a pacman hook that runs update-notify for each logged-in user with the timer active, and a path unit that users can point at their local repo databases to refresh after aur build.

PKGBUILD

@@ -3,7 +3,7 @@
 # Maintainer: Daniele Fucini <dfucini [at] gmail [dot] com>
 
 pkgname=update-notify
-pkgver=3.5
+pkgver=3.7
 pkgrel=1
 pkgdesc='Notify when updates are available'
 arch=('any')
@@ -17,7 +17,7 @@ optdepends=('aurutils: to check AUR packages in the local repo for updates'
             'git-monitor: to check git repos for updates')
 source=("git+$url?signed#tag=$pkgver")
 validpgpkeys=('7E12BC1FF3B6EDB2CD8053EB981A2B2A3BBF5514')
-sha256sums=('6620f528f9114b0e17723322558c7ba484c236ba9a7ece8b754f25ade84883ff')
+sha256sums=('89ffddcb3fc0b82fdaec61defb374127d720655c35f2157cfe0d543360df22ab')
 
 package()
 {
@@ -25,6 +25,9 @@ package()
     install -Dm755 "$pkgname" "$pkgdir"/usr/bin/"$pkgname"
     install -Dm644 "$pkgname".service "$pkgdir"/usr/lib/systemd/user/"$pkgname".service
     install -Dm644 "$pkgname".timer "$pkgdir"/usr/lib/systemd/user/"$pkgname".timer
+    install -Dm644 "$pkgname".path "$pkgdir"/usr/lib/systemd/user/"$pkgname".path
+    install -Dm755 "$pkgname"-refresh "$pkgdir"/usr/lib/"$pkgname"/refresh
+    install -Dm644 "$pkgname".hook "$pkgdir"/usr/share/libalpm/hooks/"$pkgname".hook
     install -Dm644 README.md "$pkgdir"/usr/share/doc/"$pkgname"/README.md
     install -Dm644 config.example "$pkgdir"/usr/share/doc/"$pkgname"/config.example
 }

README.md

@@ -10,7 +10,7 @@ update-notify runs on a systemd user timer and checks:
 
 It sends one notification, and only when its content changes since the last one:
 
-- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed.
+- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed, and one to run `trustsight` before building pending AUR updates.
 - Kernel rebuild reminders are always shown, even below the threshold.
 
 ## Requirements
@@ -23,6 +23,7 @@ Optional:
 - `aurutils`: check AUR packages in the local repository
 - `fwupd`: check for firmware updates
 - `git-monitor`: remind to check git packages
+- `trustsight`: remind to vet AUR updates before building them
 
 ## Installation
 
@@ -42,6 +43,28 @@ systemctl --user enable --now update-notify.timer
 
 The timer runs 5 minutes after boot, then every 6 hours.
 
+A pacman hook also runs update-notify after every pacman transaction, for each logged-in user whose timer is active, so the notification and the status bar file are current right after an upgrade.
+
+### Refresh after building packages
+
+Building into a local repository (`aur build`, `aur sync`) doesn't run pacman, so the hook can't catch it. To run update-notify whenever a repository changes, add the repository files to watch to `update-notify.path`:
+
+```
+systemctl --user edit update-notify.path
+```
+
+```
+[Path]
+PathChanged=/home/aur-local/aur-local.db.tar.gz.sig
+PathChanged=/home/custom-pkgs/custom-pkgs.db.tar.gz.sig
+```
+
+Watch the `.db.tar.gz.sig` file for signed repositories, or `.db.tar.gz` for unsigned ones (`.db` is a symlink). Then enable it:
+
+```
+systemctl --user enable --now update-notify.path
+```
+
 ## Usage
 
 ```
@@ -80,7 +103,7 @@ aur <pkg> <newver>
 kernel <custom-pkg> <stock-ver>
 ```
 
-The file reflects the last run. To keep a bar current after an upgrade, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
+The file reflects the last run, which the pacman hook and `update-notify.path` keep close to current. To keep a bar current in between, drop entries whose installed version (`pacman -Q`) is no longer older than `newver`, or, for `kernel` lines, whose custom build has caught up with `stock-ver` (ignoring `pkgrel`). This only reads local data, so it's cheap to run often.
 
 ## License
 

update-notify

@@ -175,6 +175,11 @@ if (( over_threshold )); then
         fi
     fi
 
+    # Vet AUR changes before building them
+    if (( aur_updates )) && command -v trustsight >/dev/null 2>&1; then
+        parts+=("Before aur sync: trustsight review --repo $AUR_REPO")
+    fi
+
     if (( ${#reminders[@]} )); then
         printf -v list '%s, ' "${reminders[@]}"
         parts+=("Also check: ${list%, }")

update-notify-refresh

@@ -0,0 +1,10 @@
+#!/bin/bash
+# Run update-notify for every logged-in user whose timer is active (called by the pacman hook as root)
+systemctl list-units --plain --no-legend --state=running 'user@*.service' |
+while read -r unit _; do
+    uid=${unit#user@}
+    uid=${uid%.service}
+    user=$(id -nu "$uid") || continue
+    systemctl --user -M "$user@" is-active --quiet update-notify.timer || continue
+    systemctl --user -M "$user@" start --no-block update-notify.service
+done

update-notify.hook

@@ -0,0 +1,11 @@
+[Trigger]
+Operation = Install
+Operation = Upgrade
+Operation = Remove
+Type = Package
+Target = *
+
+[Action]
+Description = Refreshing update-notify...
+When = PostTransaction
+Exec = /usr/lib/update-notify/refresh

update-notify.path

@@ -0,0 +1,10 @@
+[Unit]
+Description=Run update-notify when a local repository changes
+
+# Add the repository files to watch with: systemctl --user edit update-notify.path
+# e.g. PathChanged=/home/aur-local/aur-local.db.tar.gz.sig
+[Path]
+Unit=update-notify.service
+
+[Install]
+WantedBy=default.target