Lint built target package with sbopkglint

After a target builds successfully, run sbopkglint (from
system/sbo-maintainer-tools) against the built .txz as a final
check. Host-side, target only, fail-soft: skips with a note if the
tool is absent and never changes the SUCCESS status. The one-line
result is color-coded (green clean, red findings); on findings the
full output is echoed to the screen and the package log. Verified
live on buildsystem with feh.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

3 files changed, 61 insertions, 2 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 5df16b3..139c896 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -84,7 +84,14 @@ Top-to-bottom layout:
    installpkg INSIDE the chroot non-interactively via heredoc, reads back a
    status token file, sets status maps. Logs resolved .info env up front and
    the installed file list (from /var/log/packages) after installpkg, so the
-   overlay is fully disposable.
+   overlay is fully disposable. On a successful TARGET build, runs `lint_pkg`
+   (host-side `sbopkglint` from `sbo-maintainer-tools`) against the built .txz
+   as a final check: target only, fail-soft (skips with a note if the tool is
+   absent, never changes the SUCCESS status). The one-line result is color-coded
+   (`C_GRN` clean / `C_RED` findings); on findings the full sbopkglint output is
+   echoed to the screen (indented) as well as the log, so problems are easy to
+   catch. Called while the overlay is still mounted so the host path to the .txz
+   is reachable; no cache dependency.
 9. **run_target** - fresh overlay per target, builds resolved chain in order,
    marks `BLOCKED-BY-DEP` on dependents of failures, tears down.
 10. **print_summary** - color screen recap + plain `summary.log`.
@@ -136,7 +143,12 @@ recorded separately as a reminder flag, not a status.
   `update_base` (mirror was up-to-date) and therefore the on-patch cache wipe
   firing, and the `bump: OLD -> NEW` eviction path on a real version change
   (covered by the self-check, not yet seen on hardware). Logic mirrors the
-  reference script.
+  reference script. The `sbopkglint` target lint (`lint_pkg`) WAS verified live
+  on buildsystem: a `feh` run ran `sbopkglint` against the built .txz after the
+  target build (lint: clean, full output in the package log), fired for the
+  target only (cached `imlib2` dep not linted), and left SUCCESS unaffected.
+  Pure host I/O against an external tool, no self-check stub (trivial, no branch
+  logic beyond the install check).
 
 ## Known shortcuts (ponytail: comments in source)
 
diff --git a/README.md b/README.md
index d5f70b5..b361e46 100644
--- a/README.md
+++ b/README.md
@@ -50,6 +50,10 @@ that is `/root/.config/sbo-batch-tester/config`). Override the path with the
 
 Also: run as root (overlay + chroot require it).
 
+Optional: install `system/sbo-maintainer-tools` to get `sbopkglint`. If present,
+the target's built package is linted as a final check (see below). If absent, the
+step is skipped with a one-line note.
+
 ## Populating SLACKWARE_BASE
 
 Populate from the NFS mirror with the FULL package set, not a minimal install.
@@ -150,6 +154,19 @@ Packages whose REQUIRES carry `%README%` are flagged in the summary as a
 reminder to check manual/optional configuration steps. `%README%` is not a
 package and is skipped for build ordering.
 
+## Package lint (sbopkglint)
+
+After a target builds successfully, if `sbopkglint` (from
+`system/sbo-maintainer-tools`) is on the host PATH, the harness runs it against
+the target's built `.txz` as a final verification. It catches common SBo policy
+problems that a clean build does not (ownership, doc-dir contents, slack-desc,
+etc). The check is host-side, target only (dependencies are vetted SBo packages
+and would only add noise), and fail-soft: findings are reported to the screen
+and the package log but never change the build's `SUCCESS` status, and a missing
+tool just prints a skip note. The one-line result is color-coded (green `clean`,
+red `findings`); on findings the full sbopkglint output is also printed to the
+screen, indented, with a complete copy in the per-package log.
+
 ## Logs
 
 Written outside the overlay so they survive teardown, under `LOG_ROOT`:
diff --git a/sbo-batch-test b/sbo-batch-test
index 75b8305..159827f 100755
--- a/sbo-batch-test
+++ b/sbo-batch-test
@@ -362,6 +362,32 @@ cache_path() {
   [[ "$(_cache_ver_of "$prog" "$(basename "$newest")")" == "$version" ]] && echo "$newest"
 }
 
+# lint_pkg <txz> <logf> -> run sbopkglint on a built package as a final check.
+# Host-side, target only (called from build_one's success branch while the
+# overlay is still mounted). Fail-soft: skip with a note if the tool is absent,
+# and never affect the build's SUCCESS status. Findings go to screen + the
+# package log. ponytail: no toggle flag, run iff installed.
+lint_pkg() {
+  local txz="$1" logf="$2"
+  if ! command -v sbopkglint >/dev/null 2>&1; then
+    echo "  sbopkglint not installed, skipping lint (system/sbo-maintainer-tools)"
+    return 0
+  fi
+  echo "  sbopkglint $(basename "$txz") ..."
+  echo "===== sbopkglint: $(basename "$txz") =====" >> "$logf"
+  local out rc
+  out="$(sbopkglint "$txz" 2>&1)"; rc=$?
+  printf '%s\n' "$out" >> "$logf"
+  if [[ $rc -eq 0 ]]; then
+    echo "  lint: ${C_GRN}clean${C_RST}"
+  else
+    # Findings: surface on screen too (indented), not just the log, so they are
+    # easy to catch. Full copy is in the log.
+    echo "  lint: ${C_RED}findings${C_RST} (see $(basename "$logf")):"
+    printf '%s\n' "$out" | sed 's/^/    /'
+  fi
+}
+
 # cache_store <cat> <prog> <src-txz> -> clear the prog dir, copy src in.
 cache_store() {
   local cat="$1" prog="$2" src="$3"
@@ -688,6 +714,10 @@ CHROOT_EOF
       [[ -z "$newest" || "$built" -nt "$newest" ]] && newest="$built"
     done
     [[ -n "$newest" ]] && cache_store "$cat" "$prog" "$newest"
+    # Final verification: lint the target's built package (host-side, overlay
+    # still mounted so $newest is reachable). Target only; deps are vetted SBo
+    # packages and would just add noise.
+    [[ "$is_target" == "1" && -n "$newest" ]] && lint_pkg "$newest" "$logf"
     return 0
   fi
   ST_REASON["$key"]="see $(basename "$logf")"