diff options
| -rw-r--r-- | CLAUDE.md | 16 | ||||
| -rw-r--r-- | README.md | 17 | ||||
| -rwxr-xr-x | sbo-batch-test | 30 |
3 files changed, 61 insertions, 2 deletions
@@ -84,7 +84,14 @@ Top-to-bottom layout: installpkg INSIDE the chroot non-interactively via heredoc, reads back a status token file, sets status maps. Logs resolved .info env up front and the installed file list (from /var/log/packages) after installpkg, so the - overlay is fully disposable. + overlay is fully disposable. On a successful TARGET build, runs `lint_pkg` + (host-side `sbopkglint` from `sbo-maintainer-tools`) against the built .txz + as a final check: target only, fail-soft (skips with a note if the tool is + absent, never changes the SUCCESS status). The one-line result is color-coded + (`C_GRN` clean / `C_RED` findings); on findings the full sbopkglint output is + echoed to the screen (indented) as well as the log, so problems are easy to + catch. Called while the overlay is still mounted so the host path to the .txz + is reachable; no cache dependency. 9. **run_target** - fresh overlay per target, builds resolved chain in order, marks `BLOCKED-BY-DEP` on dependents of failures, tears down. 10. **print_summary** - color screen recap + plain `summary.log`. @@ -136,7 +143,12 @@ recorded separately as a reminder flag, not a status. `update_base` (mirror was up-to-date) and therefore the on-patch cache wipe firing, and the `bump: OLD -> NEW` eviction path on a real version change (covered by the self-check, not yet seen on hardware). Logic mirrors the - reference script. + reference script. The `sbopkglint` target lint (`lint_pkg`) WAS verified live + on buildsystem: a `feh` run ran `sbopkglint` against the built .txz after the + target build (lint: clean, full output in the package log), fired for the + target only (cached `imlib2` dep not linted), and left SUCCESS unaffected. + Pure host I/O against an external tool, no self-check stub (trivial, no branch + logic beyond the install check). ## Known shortcuts (ponytail: comments in source) @@ -50,6 +50,10 @@ that is `/root/.config/sbo-batch-tester/config`). Override the path with the Also: run as root (overlay + chroot require it). +Optional: install `system/sbo-maintainer-tools` to get `sbopkglint`. If present, +the target's built package is linted as a final check (see below). If absent, the +step is skipped with a one-line note. + ## Populating SLACKWARE_BASE Populate from the NFS mirror with the FULL package set, not a minimal install. @@ -150,6 +154,19 @@ Packages whose REQUIRES carry `%README%` are flagged in the summary as a reminder to check manual/optional configuration steps. `%README%` is not a package and is skipped for build ordering. +## Package lint (sbopkglint) + +After a target builds successfully, if `sbopkglint` (from +`system/sbo-maintainer-tools`) is on the host PATH, the harness runs it against +the target's built `.txz` as a final verification. It catches common SBo policy +problems that a clean build does not (ownership, doc-dir contents, slack-desc, +etc). The check is host-side, target only (dependencies are vetted SBo packages +and would only add noise), and fail-soft: findings are reported to the screen +and the package log but never change the build's `SUCCESS` status, and a missing +tool just prints a skip note. The one-line result is color-coded (green `clean`, +red `findings`); on findings the full sbopkglint output is also printed to the +screen, indented, with a complete copy in the per-package log. + ## Logs Written outside the overlay so they survive teardown, under `LOG_ROOT`: diff --git a/sbo-batch-test b/sbo-batch-test index 75b8305..159827f 100755 --- a/sbo-batch-test +++ b/sbo-batch-test @@ -362,6 +362,32 @@ cache_path() { [[ "$(_cache_ver_of "$prog" "$(basename "$newest")")" == "$version" ]] && echo "$newest" } +# lint_pkg <txz> <logf> -> run sbopkglint on a built package as a final check. +# Host-side, target only (called from build_one's success branch while the +# overlay is still mounted). Fail-soft: skip with a note if the tool is absent, +# and never affect the build's SUCCESS status. Findings go to screen + the +# package log. ponytail: no toggle flag, run iff installed. +lint_pkg() { + local txz="$1" logf="$2" + if ! command -v sbopkglint >/dev/null 2>&1; then + echo " sbopkglint not installed, skipping lint (system/sbo-maintainer-tools)" + return 0 + fi + echo " sbopkglint $(basename "$txz") ..." + echo "===== sbopkglint: $(basename "$txz") =====" >> "$logf" + local out rc + out="$(sbopkglint "$txz" 2>&1)"; rc=$? + printf '%s\n' "$out" >> "$logf" + if [[ $rc -eq 0 ]]; then + echo " lint: ${C_GRN}clean${C_RST}" + else + # Findings: surface on screen too (indented), not just the log, so they are + # easy to catch. Full copy is in the log. + echo " lint: ${C_RED}findings${C_RST} (see $(basename "$logf")):" + printf '%s\n' "$out" | sed 's/^/ /' + fi +} + # cache_store <cat> <prog> <src-txz> -> clear the prog dir, copy src in. cache_store() { local cat="$1" prog="$2" src="$3" @@ -688,6 +714,10 @@ CHROOT_EOF [[ -z "$newest" || "$built" -nt "$newest" ]] && newest="$built" done [[ -n "$newest" ]] && cache_store "$cat" "$prog" "$newest" + # Final verification: lint the target's built package (host-side, overlay + # still mounted so $newest is reachable). Target only; deps are vetted SBo + # packages and would just add noise. + [[ "$is_target" == "1" && -n "$newest" ]] && lint_pkg "$newest" "$logf" return 0 fi ST_REASON["$key"]="see $(basename "$logf")" |