test-build: fix container stdin and move lint in-container

Two bugs surfaced by the first real end-to-end run:

1. docker run lacked -i, so bash -s got no stdin and the heredoc build script
   was silently discarded (0s BUILD-FAILED, empty log). Add -i.

2. sbopkglint ran host-side, where it shells out to sudo to installpkg the
   package for inspection; Slackware has no configured sudo, so lint errored
   (lxsudo not found / password required). Move the lint into the build
   container (target only, gated on IS_TARGET), where it runs as root with the
   baked-in tool and needs no sudo. The host now just reads the LINT-CLEAN /
   LINT-FINDINGS marker from the log for its summary. Drop the dead host-side
   lint_pkg function.

Verified: feroxbuster builds and lints clean end-to-end against
sbo-testbuild:current in 72s.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 23 insertions, 23 deletions

diff --git a/.extras/test-build b/.extras/test-build
index 90d45ac..0a655c1 100755
--- a/.extras/test-build
+++ b/.extras/test-build
@@ -428,27 +428,6 @@ depends_on_failed() {
   return 1
 }
 
-# lint_pkg <txz> <logf> -> run sbopkglint on a built package. Host-side, target
-# only, fail-soft (skip if absent, never change SUCCESS).
-lint_pkg() {
-  local txz="$1" logf="$2"
-  if ! command -v sbopkglint >/dev/null 2>&1; then
-    echo "  sbopkglint not installed on host, skipping lint"
-    return 0
-  fi
-  echo "  sbopkglint $(basename "$txz") ..."
-  echo "===== sbopkglint: $(basename "$txz") =====" >> "$logf"
-  local out rc
-  out="$(sbopkglint "$txz" 2>&1)"; rc=$?
-  printf '%s\n' "$out" >> "$logf"
-  if [[ $rc -eq 0 ]]; then
-    echo "  lint: ${C_GRN}clean${C_RST}"
-  else
-    echo "  lint: ${C_RED}findings${C_RST} (see $(basename "$logf")):"
-    printf '%s\n' "$out" | sed 's/^/    /'
-  fi
-}
-
 # build_one <slackbuild-dir> <is_target 0|1> [container-name]
 # Runs the build in a throwaway container. Sets ST_STATUS/ST_REASON/ST_TIME.
 # Successful builds copy their package to a host workdir; deps are cached and
@@ -494,12 +473,15 @@ build_one() {
   local fp
   for fp in "${!FETCH_DEPS[@]}"; do fetch_list+="$fp "; done
 
-  docker run --rm \
+  # -i is required: without it docker does not attach stdin, so `bash -s` reads
+  # nothing and the heredoc script is silently discarded (exit 0, empty log).
+  docker run --rm -i \
     -v "$dir":/sbo/pkg:ro \
     -v "$DEPS_DIR":/sbo/deps \
     -v "$BUILD_OUT":/sbo/out \
     -e PROG="$prog" \
     -e FETCH_LIST="$fetch_list" \
+    -e IS_TARGET="$is_target" \
     "$ACTIVE_IMAGE" /bin/bash -s >>"$logf" 2>&1 <<'CONTAINER_EOF'
 set -uo pipefail
 prog="$PROG"
@@ -569,6 +551,18 @@ echo "===== installed files: $(basename "$pkg") ====="
 pkgname="$(basename "$pkg")"; pkgname="${pkgname%.t?z}"
 cat "/var/log/packages/$pkgname" 2>/dev/null || echo "(package db entry not found)"
 echo "================================="
+
+# lint the target here in the container: sbopkglint is baked into the image and
+# runs as root, so it needs no host sudo. Fail-soft: findings never fail the build.
+if [ "${IS_TARGET:-0}" = "1" ] && command -v sbopkglint >/dev/null 2>&1; then
+  echo "===== sbopkglint: $(basename "$pkg") ====="
+  if sbopkglint "$pkg"; then
+    echo "LINT-CLEAN"
+  else
+    echo "LINT-FINDINGS"
+  fi
+  echo "================================="
+fi
 echo SUCCESS > "$statf"
 CONTAINER_EOF
 
@@ -590,7 +584,13 @@ CONTAINER_EOF
         # make the dep available to later builds in this run
         cp -a "$newest" "$DEPS_DIR/"
       else
-        lint_pkg "$newest" "$logf"
+        # lint ran in-container (see IS_TARGET block); surface its verdict from
+        # the log so the host summary can show clean/findings.
+        if grep -q '^LINT-FINDINGS$' "$logf" 2>/dev/null; then
+          echo "  lint: ${C_RED}findings${C_RST} (see $(basename "$logf"))"
+        elif grep -q '^LINT-CLEAN$' "$logf" 2>/dev/null; then
+          echo "  lint: ${C_GRN}clean${C_RST}"
+        fi
       fi
     fi
     return 0