makepkg-with-sleuthing

#!/bin/sh

# makepkg-with-sleuthing - makepkg wrapper that checks the package with aur-sleuth
# before building.

# Skip the audit only for makepkg actions that run no maintainer-authored code.
# The trap: -o/--nobuild is not one of them. It extracts the sources and runs
# prepare() and pkgver() before exiting, so it must be audited -- it is the
# first invocation that executes the maintainer's code, and both yay
# (--nobuild -f) and paru (-ofA -C) call it that way. --verifysource and
# -g/--geninteg do exit before extraction.
skip=false
for arg in "$@"; do
    case "$arg" in
        --verifysource|--geninteg|--packagelist|--printsrcinfo|--help|-h|--version|-V|-g)
            skip=yes
            ;;
        --*)
            # Any other long option is a build-related one; audit it.
            ;;
        -?*)
            # A cluster of short flags, which is how both helpers spell their
            # phases, so g must be matched inside a cluster as well as bare.
            rest="${arg#-}"
            # -p (build script) and -D (directory) take an argument that
            # consumes the rest of the cluster -- getopt reads -Dg as -D with
            # the argument "g", a real build -- so only the characters before
            # the first p or D are flags. makepkg's OPT_SHORT is
            # AcCdD:efFghiLmop:rRsSV; D: and p: are the only two taking one.
            case "$rest" in
                *[pD]*) rest="${rest%%[pD]*}" ;;
            esac
            case "$rest" in
                *g*) skip=yes ;;
            esac
            ;;
    esac
done

if [[ "$skip" = yes ]]; then
    exec /usr/bin/makepkg "$@"
fi

# Run audit against the current working directory's PKGBUILD and sources.
"${AUR_SLEUTH_BIN:-aur-sleuth}" --pkgdir "${PWD}"
status=$?

# Non-zero means audit failed and is fatal under current settings inside aur-sleuth.
# If AUDIT_FAILURE_FATAL=false, aur-sleuth returns 0 here and we proceed.
if [ $status -ne 0 ]; then
    exit $status
fi

exec /usr/bin/makepkg "$@"