Add package lint tool

[raisjn]

it would be nice to lint packages for correctness.

things like:

• are you installing binaries into /opt?
• are you installing any files into / that are more than X in size?

[fenollp]

Sounds like this needs a configuration language, not an effectfull programming language.

I'm not sure what the constraints of toltec are but if you want to stay with shell, maybe shellcheck should at least be part of the linting. Maybe it can even be tuned to verify new things you need? My 2 cents.

[Eeems]

Sounds like this needs a configuration language, not an effectfull programming language.

I'm not sure what the constraints of toltec are but if you want to stay with shell, maybe shellcheck should at least be part of the linting. Maybe it can even be tuned to verify new things you need? My 2 cents.

We do actually have shellcheck running in the linting right now, but it can't lint the non-shell specific stuff we have in the package definition itself. That requires context of the system that shellcheck doesn't have.

[matteodelabre]

Sounds like this needs a configuration language, not an effectfull programming language.

The good side of this choice is that we can use the metadata fields inside the recipe functions, e.g. to parameterize sources with the version number. This is the model that Arch Linux uses. But of course we can transition to something else if it is warranted.

I'm not sure what the constraints of toltec are but if you want to stay with shell, maybe shellcheck should at least be part of the linting. Maybe it can even be tuned to verify new things you need? My 2 cents.

shfmt has a -tojson flag which exports the internal AST. We could repurpose that to check project-specific syntax constraints.

[matteodelabre]

Check that:

• All custom fields start with _ (see restream: Fix wrong hook name (postinstall → configure) toltec#217)
• Dependencies are satisfiable (see Fix rot version toltec#228)
• Sources from remote servers always have checksums
• Recipes with changes have an increased version number
• Recipes use the latest image version that is available

[matteodelabre]

• Packages do not install conflicting files.
• Increases in upstream version numbers implies increased timestamp