Lint built target package with sbopkglint

After a target builds successfully, run sbopkglint (from
system/sbo-maintainer-tools) against the built .txz as a final
check. Host-side, target only, fail-soft: skips with a note if the
tool is absent and never changes the SUCCESS status. The one-line
result is color-coded (green clean, red findings); on findings the
full output is echoed to the screen and the package log. Verified
live on buildsystem with feh.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 30 insertions, 0 deletions

diff --git a/sbo-batch-test b/sbo-batch-test
index 75b8305..159827f 100755
--- a/sbo-batch-test
+++ b/sbo-batch-test
@@ -362,6 +362,32 @@ cache_path() {
   [[ "$(_cache_ver_of "$prog" "$(basename "$newest")")" == "$version" ]] && echo "$newest"
 }
 
+# lint_pkg <txz> <logf> -> run sbopkglint on a built package as a final check.
+# Host-side, target only (called from build_one's success branch while the
+# overlay is still mounted). Fail-soft: skip with a note if the tool is absent,
+# and never affect the build's SUCCESS status. Findings go to screen + the
+# package log. ponytail: no toggle flag, run iff installed.
+lint_pkg() {
+  local txz="$1" logf="$2"
+  if ! command -v sbopkglint >/dev/null 2>&1; then
+    echo "  sbopkglint not installed, skipping lint (system/sbo-maintainer-tools)"
+    return 0
+  fi
+  echo "  sbopkglint $(basename "$txz") ..."
+  echo "===== sbopkglint: $(basename "$txz") =====" >> "$logf"
+  local out rc
+  out="$(sbopkglint "$txz" 2>&1)"; rc=$?
+  printf '%s\n' "$out" >> "$logf"
+  if [[ $rc -eq 0 ]]; then
+    echo "  lint: ${C_GRN}clean${C_RST}"
+  else
+    # Findings: surface on screen too (indented), not just the log, so they are
+    # easy to catch. Full copy is in the log.
+    echo "  lint: ${C_RED}findings${C_RST} (see $(basename "$logf")):"
+    printf '%s\n' "$out" | sed 's/^/    /'
+  fi
+}
+
 # cache_store <cat> <prog> <src-txz> -> clear the prog dir, copy src in.
 cache_store() {
   local cat="$1" prog="$2" src="$3"
@@ -688,6 +714,10 @@ CHROOT_EOF
       [[ -z "$newest" || "$built" -nt "$newest" ]] && newest="$built"
     done
     [[ -n "$newest" ]] && cache_store "$cat" "$prog" "$newest"
+    # Final verification: lint the target's built package (host-side, overlay
+    # still mounted so $newest is reachable). Target only; deps are vetted SBo
+    # packages and would just add noise.
+    [[ "$is_target" == "1" && -n "$newest" ]] && lint_pkg "$newest" "$logf"
     return 0
   fi
   ST_REASON["$key"]="see $(basename "$logf")"