initial commit

17 files changed, 3254 insertions, 0 deletions

diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..05b4e3c
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,41 @@
+PROJ=sbo-maintainer-tools
+VERSION=0.4
+
+PREFIX=/usr/local
+DESTDIR=
+
+SHAREDIR=$(PREFIX)/share
+TESTDIR=$(SHAREDIR)/$(PROJ)/sbopkglint.d
+BINDIR=$(PREFIX)/bin
+MANDIR=$(PREFIX)/man
+MAN1DIR=$(MANDIR)/man1
+DOCDIR=$(PREFIX)/doc/$(PROJ)-$(VERSION)
+
+DOCS=README
+SCRIPTS=sbopkglint sbolint
+
+all:
+	@echo "Use 'make install PREFIX=<path>' to install $(PROJ)."
+
+install: man
+	install -d -oroot -groot -m0755 \
+		$(DESTDIR)$(TESTDIR) \
+		$(DESTDIR)$(BINDIR) \
+		$(DESTDIR)$(MAN1DIR) \
+		$(DESTDIR)$(DOCDIR)
+	install -oroot -groot -m0755 $(SCRIPTS) $(DESTDIR)$(BINDIR)/
+	install -oroot -groot -m0644 sbopkglint.d/* $(DESTDIR)$(TESTDIR)/
+	install -oroot -groot -m0644 $(DOCS) $(DESTDIR)$(DOCDIR)/
+	gzip -9c < sbolint.1 > $(DESTDIR)$(MAN1DIR)/sbolint.1.gz
+	gzip -9c < sbopkglint.1 > $(DESTDIR)$(MAN1DIR)/sbopkglint.1.gz
+
+clean:
+	rm -f sbopkglint.1 sbolint.1
+
+man: sbopkglint.1 sbolint.1
+
+sbolint.1: sbolint
+	./sbolint --man > sbolint.1
+
+sbopkglint.1: sbopkglint
+	./sbopkglint --man > sbopkglint.1
diff --git a/README b/README
new file mode 100644
index 0000000..7c06d83
--- /dev/null
+++ b/README
@@ -0,0 +1,40 @@
+sbo-maintainer-tools
+--------------------
+
+These are "lint" tools to make life easier for SlackBuilds.org
+maintainers and admins.
+
+Included tools:
+
+- sbolint: checks your SlackBuild, README, .info file, and slack-desc.
+  Also there's a git pre-commit hook you should use, that automatically
+  calls sbolint and stops you from committing bad code.
+
+- sbopkglint: checks your package, after it's built.
+
+Note that the SBo admins use these tools as part of the approval
+process, when you submit an update. Failure to pass the lint checks
+is a valid reason for rejecting your submission, so you should either
+make sure your scripts and packages pass the tests, or give a good
+explanation why a failure isn't relevant to your build (because the
+tests aren't perfect, of course).
+
+Installation:
+
+The best way to install sbo-maintainer-tools is to install them from
+SBo (system/sbo-maintainer-tools).
+
+If you prefer, you can install them with "make install" (defaults to
+/usr/local; add 'PREFIX=/usr' if you'd rather). You can also run them
+directly from the source directory, if you can think of a reason for
+that (e.g. if you're hacking on the tests).
+
+To use the git hook, copy pre-commit-sbolint to .git/hooks/pre-commit
+in your git work tree (wherever you cloned the SBo repository),
+and make sure it's executable (chmod +x). If you already have a
+pre-commit hook, you can copy/paste the code, or (possibly) just
+append pre-commit-sbolint to your existing hook (if it doesn't end
+with "exit 0").
+
+For more information, see the sbolint and sbopkglint man pages (or run
+the scripts with --doc; it's the same thing).
diff --git a/TODO b/TODO
new file mode 100644
index 0000000..45d013a
--- /dev/null
+++ b/TODO
@@ -0,0 +1,44 @@
+Future options:
+
+-e  Only log errors, not warnings (right now, everything is a warning).
+
+Future test ideas:
+
+- extract the doinst.sh separately and check it. If we e.g. have
+  an icon cache or desktop file cache in $PKG, but no
+  gtk-update-icon-cache or update-desktop-database command in the
+  doinst.sh, that's definitely an error.
+
+- more forbidden files. for fonts.{dir|scale}, we need the doinst.sh
+  test (doinst can and should create these; they should *not* just be
+  files in the package).
+
+- noarch could recommend a package be made noarch, if it contains no
+  ELF files and doesn't use lib or lib64 dirs. Should this just
+  be a recommendation, or should it count as a failed test?
+
+- static libraries? some packages ship these because upstream doesn't
+  support shared libs, though. maybe only complain if libfoo.so.* and
+  libfoo.a both exist (if we have a shared lib, we shouldn't also have
+  a static one). Maybe this should be a disable-able warning?
+
+- icons. Make sure they are what their filename says (I've run into .png
+  files named .svg, and .gif files named .png, etc). If they're in
+  /usr/share/icons/<size>x<size>/, make sure they actually are the correct
+  size (or that they're SVG, if they're in scalable/). Really large icons
+  in /usr/share/pixmaps are probably useless (most stuff that uses the
+  old-style icons expects them to be 48x48 or 64x64). Icons must be
+  readable by everyone, non-executable, and owned by root:root.
+
+- duplicate files, maybe the error message could suggest a "ln -s" command
+  to use if the file really does need to appear in multiple dirs.
+
+- fonts. make sure they are what their filename says, and are installed to
+  the correct /usr/share/fonts/* or /usr/share/kbd/consolefonts dir.
+
+Other ideas:
+
+When linting multiple packages, print a summary: 100 packages checked,
+10 failed, 90 passed. Maybe with percentages too.
+
+Clean up the output. Make it easier to grep.
diff --git a/pre-commit-sbolint b/pre-commit-sbolint
new file mode 100644
index 0000000..06cb7a5
--- /dev/null
+++ b/pre-commit-sbolint
@@ -0,0 +1,63 @@
+#!/bin/bash
+
+# 20220315 bkw: SBo pre-commit hook, wrapper for sbolint.
+
+# Installation:
+
+# Copy this to <gitdir>/.git/hooks, mode 0755 (or anyway, make it
+# executable). Also get sbolint and install it somewhere on $PATH,
+# like /usr/local/bin. sbolint comes from:
+
+# https://slackware.uk/~urchlay/repos/sbostuff/plain/sbolint
+
+# That's a wgettable URL. You can also clone the sbostuff
+# repo from https://slackware.uk/~urchlay/repos/sbostuff if you want.
+
+# Usage:
+
+# Just do your usual "git commit". When you do, sbolint will run on
+# the build you're updating. If it finds any issues, it will cause the
+# commit to abort, so you can fix whatever's wrong and try the commit
+# again.
+
+# Since sbolint isn't perfect, you can skip the check for any commit
+# by running e.g:
+
+#  SBOLINT=no git commit <arguments>
+
+# You can also run sbolint by itself, and read its documentation with
+# "sbolint --docs".
+
+set -e
+exec 1>&2
+
+# There should normally only be one changed build per commit, but this
+# rule may get broken when the repo's frozen pending a new Slackware
+# release. So use a loop.
+
+# The weird-looking "< <(command)" syntax is why this script must
+# have a #!/bin/bash at the top: it won't work with #!/bin/sh, even if
+# /bin/sh is a symlink to bash.
+
+if [ "${SBOLINT:-yes}" = "yes" ]; then
+	sbolintfailed=""
+	if ! which sbolint &>/dev/null; then
+		echo "WARNING: can't find sbolint in PATH, no linting will be done"
+	else
+		while read build; do
+			# if there's no slack-desc or README, assume the build has been removed.
+			# the directory still might exist after a "git rm -rf" because it
+			# might contain untracked files (e.g. the source tarball).
+			if [ -e "$build/slack-desc" -o -e "$build/README" ]; then
+				sbolint "$build" || sbolintfailed=1
+			fi
+		done < <(git diff --cached --name-only | cut -d/ -f1,2 | sort -u)
+	fi
+	if [ -n "$sbolintfailed" ]; then
+		echo "*** sbolint failed, fix the errors or set SBOLINT=no"
+		echo "*** in the environment to commit anyway."
+		exit 1
+	fi
+fi
+
+exit 0
diff --git a/sbolint b/sbolint
new file mode 100755
index 0000000..788489f
--- /dev/null
+++ b/sbolint
@@ -0,0 +1,1408 @@
+#!/usr/bin/perl -w
+
+# ChangeLog:
+
+# 0.4 20220314 bkw: add -a option to check all builds in the git repo.
+
+# 0.3 20200420 bkw:
+# - Check github URLs for validity.
+
+# 0.2 20200103 bkw:
+# - Use "git rev-parse" to decide if we're in a git repo, because
+#   "git status" traverses the whole repo looking for untracked files.
+#   It does this even if you use -uno (it won't *print* the untracked
+#   files, but it still searches for them). Thanks to alienBOB for cluing
+#   me in to using rev-parse for this.
+# - Skip the junkfiles check when we're in a git repo. It's more
+#   annoying than it is useful.
+# - Allow possible -e/-u arguments in the shebang.
+# - Avoid false positives when the script does a "cd $PKG" and then
+#   uses relative paths for install/*.
+# - Require VERSION= to appear within the first 10 non-comment/non-blank
+#   lines, and don't check it anywhere else in the script.
+# - Allow scripts to skip lint checks via ###sbolint on/off comments.
+
+# 0.1 20141114 bkw, Initial release.
+
+$VERSION="0.4";
+
+# This script is meant to be fairly self-contained, prefer not to
+# require a huge pile of perl module dependencies. In some cases this
+# means using system() or backticks or such (e.g. to run tar, instead of
+# using Archive::Tar). Please don't "improve" the script by using a ton
+# of modules. The POSIX module ships with perl, not afraid of using that.
+
+# future options:
+# -l list packages with errs/warnings, don't give details
+# possibly some way to selectively disable the checks (does anyone
+# really need this?)
+
+# future ideas for checks:
+# - REQUIRES= packages have to exist? annoying if you're working on a batch
+#   of stuff to be submitted together.
+# - Validate images, e.g. icon.png or .xpm or such. ImageMagick's identify
+#   command can tell a non-image or a wrong-format image (a .jpg filename
+#   that's actually a PNG image), but it doesn't detect truncated images.
+#   Also we have to parse its stdout/stderr, it returns 0.
+
+=pod
+
+=head1 NAME
+
+sbolint - check SlackBuild directories or tarballs for common errors.
+
+=head1 SYNOPSIS
+
+B<sbolint> [-a] [-g] [-q] [-u] [-n] [build [build ...]]
+
+=head1 DESCRIPTION
+
+sbolint checks for common errors in SlackBuilds.org scripts. It's
+intended for slackbuild authors and maintainers, and can cut down on
+"There was a problem with your upload" errors from the submission form.
+
+The [build] arguments must be either directories or tarballs, each
+containing a SlackBuild script, slack-desc, README, and .info file.
+With no [build] arguments, the current directory is checked.
+
+sbolint will flag errors for problems that would prevent the build from
+being accepted by the upload form (or by the SBo admins, if if passes
+the upload checks). There may also be warnings, which are things that
+(probably) won't stop your build from being accepted, but may cause the
+SBo admins extra work.
+
+sbolint was not written by the SlackBuilds.org team, and shares no code
+with the upload form's submission checker. Lack of errors/warnings from
+sbolint does not guarantee that your build will be accepted!
+
+sbolint doesn't check built packages, and never executes the build
+script. If you want a lint tool for binary Slackware packages, try
+pprkut's B<lintpkg>.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-a>
+
+Check all builds in the git repository. This must be run from within a
+git tree (e.g. one made with "git clone").
+
+=item B<-q>
+
+Quiet. Suppresses 'xxx checks out OK' and the total errors/warnings summary.
+
+=item B<-u>
+
+URL check. Uses B<curl> to make HTTP HEAD requests for the B<HOMEPAGE>,
+B<DOWNLOAD>, and B<DOWNLOAD_x86_64> links. This won't guarantee that
+the links are good, but some kinds of failure (e.g. site down, 404)
+means they're definitely bad. Unfortunately a lot of sites have stopped
+responding to HEAD requests in the name of "security", so your mileage
+man vary.
+
+=item B<-n>
+
+Suppress warnings. Only errors will be listed. This also affects the
+exit status (see below).
+
+=back
+
+=head1 CHECKS
+
+For tar files only:
+
+=over 4
+
+=item -
+
+File size must not be bigger than the upload form's limit (currently one
+megabyte).
+
+=item -
+
+File must be a tar archive, possibly compressed with gzip, bzip2, or xz,
+extractable by the B<tar>(1) command.
+
+=item -
+
+Filename extension must match compression type.
+
+=item -
+
+Archive must contain a directory with the same name as the archive's base name,
+e.g. I<foo.tar.gz> must contain I<foo/>. Everything else in the archive must be
+inside this directory.
+
+=item -
+
+Archive must contain I<dirname/Idirname.SlackBuild>.
+
+=back
+
+For all builds:
+
+=over 4
+
+=item -
+
+The SlackBuild, .info, README files must have Unix \n line endings (not
+DOS \r\n), and the last line of each must have a \n.
+
+=item -
+
+The SlackBuild script must exist, with mode 0755 (or 0644, if in a git repo),
+and be a I<#!/bin/bash> script.
+
+=item -
+
+The script must contain the standard variable assignments for PRGNAM,
+VERSION, BUILD, and TAG. BUILD must be numeric.
+
+=item -
+
+I<PRGNAM> in the script must match I<PRGNAM> in the .info file. Both must
+match the script name (I<PRGNAM.SlackBuild>) and the directory name.
+
+=item -
+
+I<VERSION> must match the I<VERSION> in the .info file.
+
+=item -
+
+TAG=${TAG:-_SBo} must occur in the script.
+
+=item -
+
+The I<VERSION>, I<BUILD>, and I<TAG> variables must respect the environment.
+
+=item -
+
+The script must install the slack-desc in I<$PKG/install>.
+
+=item -
+
+If there is a doinst.sh script, the SlackBuild must install it to I<$PKG/install>.
+
+=item -
+
+Template boilerplate comments should be removed, e.g. I<"REMOVE THIS ENTIRE BLOCK OF TEXT">
+or I<"Automatically determine the architecture we're building on">.
+
+=item -
+
+Script must contain exactly one B<makepkg> command.
+
+=item -
+
+README must exist, have mode 0644, its character encoding must be
+either ASCII or UTF-8 without BOM, and it may not contain tab characters.
+
+=item -
+
+slack-desc must exist, have mode 0644, its character encoding must be ASCII,
+and it may not contain tab characters.
+
+=item -
+
+slack-desc contents must match the SBo template, including the "handy-ruler",
+comments, and correct spacing/indentation.
+
+=item -
+
+.info file must exist, have mode 0644, and match the SBo template.
+
+=item -
+
+.info file URLs must be valid URLs (for a very loose definition of "valid": they
+must begin with B<ftp://>, B<http://>, or B<https://>).
+
+=item -
+
+Optionally, .info file URLs can be checked for existence with an HTTP HEAD
+request (see the B<-u> option).
+
+=back
+
+The following tests are only done when sbolint's starting directory
+was NOT in a git repo:
+
+=over 4
+
+=item -
+
+Any files other than the .SlackBuild, .info, slack-desc, and README are
+checked for permissions (should be 0644) and excessive size.
+
+=item -
+
+The source archive(s) must not exist. Also sbolint attempts to detect
+extracted source trees (but isn't all that good at it).
+
+=item -
+
+Files named 'build.log' or 'strace.out*' must not exist. The B<sbrun>
+tool creates these.
+
+=back
+
+The rationale for skipping the above tests when in a git repo is that
+maintainers will be using git to track files and push changes, so we
+don't need to check them here.
+
+=head1 EXIT STATUS
+
+Exit status from sbolint will normally be 0 (success) if there were no
+errors or warnings in any of the builds checked. With the B<-n> option,
+exit status will be 0 if there are no errors.
+
+Exit status 1 indicates there was at least one warning or error (or, with
+B<-n>, at least one error).
+
+Any other exit status means sbolint itself failed somehow (e.g. called
+with nonexistent filename).
+
+=head1 BUGS
+
+Probably quite a few. Watch this space for details.
+
+=head1 AUTHOR
+
+B. Watson (yalhcru at gmail dot com, or Urchlay on Libera IRC)
+
+=head1 SEE ALSO
+
+B<sbofixinfo>(1), B<sbosearch>(1)
+
+=cut
+
+use POSIX qw/getcwd/;
+
+@boilerplate = (
+	qr/#\s*REMOVE THIS ENTIRE BLOCK OF TEXT/,
+	qr/#\s*replace with (?:version:name) of program/,
+	qr/#\s*the "_SBo" is required/,
+	qr/#\s*Automatically determine the architecture we're building on/,
+	qr/#\s*Unless \$ARCH is already set,/,
+	qr/#\s*For consistency's sake, use this/,
+	qr/#\s*Drop the package in \/tmp/,
+	qr/#\s*Exit on most errors/,
+	qr/#\s*If you prefer to do selective error checking with/,
+	qr/#\s*Your application will probably need/,
+	qr/#\s*Compile the application and install it into the/,
+	qr/#\s*Strip binaries and libraries - this can be done with/,
+	qr/#\s*Compress man pages$/,
+	qr/#\s*Compress info pages and remove the/,
+	qr/#\s*Copy program documentation into the package/,
+	qr/#\s*Copy the slack-desc \(and a custom doinst\.sh if necessary\)/,
+	qr/#\s*Make the package; be sure to leave it in/,
+);
+
+# this was scraped from the HTML source for the upload form:
+$MAX_TARBALL_SIZE = 1048576;
+
+($SELF = $0) =~ s,.*/,,;
+
+$buildname = $build = "";
+$g_warncount = 0;
+$g_errcount = 0;
+$warncount = 0;
+$errcount = 0;
+
+$tempdir = 0;
+
+our %info = (); # has to be global, check_info sets it, check_script needs it
+
+# main() {
+#check_github_url("testing", $_) for @ARGV;
+#exit 0;
+
+while(@ARGV && ($ARGV[0] =~ /^-/)) {
+	my $opt = shift;
+	$opt =~ /^-a/ && do { $recursive_git = 1; next; };
+	$opt =~ /^-u/ && do { $url_head = 1; next; };
+	$opt =~ /^-d/ && do { $url_download = 1; next; };
+	$opt =~ /^--?q(uiet)?/ && do { $quiet = 1; next; };
+	$opt =~ /^-$/ && do { $stdin = 1; next; };
+	$opt =~ /^--?h(elp)?/ && do { usage(); exit 0; };
+	$opt =~ /^-n$/ && do { $nowarn = 1; next; };
+	$opt =~ /^-r$/ && do { $suppress_readme_len = 1; next; };
+	$opt =~ /^--doc$/ && do { exec("perldoc $0"); };
+	$opt =~ /^--man$/ && do { exec("pod2man --stderr -s1 -cSBoStuff -r$VERSION $0"); };
+	die_usage("Unrecognized option '$opt'");
+}
+
+if($url_head && $url_download) {
+	die_usage("-u and -d options are mutually exclusive");
+}
+
+if($url_head || $url_download) {
+	if(system("curl --version > /dev/null") != 0) {
+		die "$SELF: -u and -d options require curl, can't find it in your \$PATH.\n";
+	}
+}
+
+if($stdin) {
+	@ARGV = <STDIN>;
+	chomp for @ARGV;
+}
+
+if($recursive_git) {
+	@ARGV=();
+	my $pwd;
+
+	# find root of the SBo git repo, if we're somewhere inside it.
+	while(! -d ".git" && ! -d "system") {
+		chdir("..");
+		chomp($pwd = `pwd`);
+		die "$SELF: -a option only works if you run $SELF from a git worktree\n" if $pwd eq "/";
+	}
+
+	chomp($pwd = `pwd`);
+
+	for(`git ls-files '*/*/*.SlackBuild' | cut -d/ -f1,2`) {
+		chomp;
+		push @ARGV, $_;
+	}
+
+	warn "$SELF: linting " . scalar(@ARGV) . " builds from git repo at $pwd\n" unless $quiet;
+	$quiet = 1;
+}
+
+push @ARGV, "." unless @ARGV;
+
+# are we in a git repo? build scripts are mode 0644 there, plus
+# the junkfile check is skipped.
+$in_git_repo = system("git rev-parse >/dev/null 2>/dev/null") == 0;
+
+for(@ARGV) {
+	run_checks($_);
+	$g_errcount += $errcount;
+	$g_warncount += $warncount;
+
+	if(!$quiet) {
+		if($errcount == 0 and $warncount == 0) {
+			print "$SELF: $buildname checks out OK\n";
+		} else {
+			print "$SELF: $buildname: errors $errcount, warnings $warncount\n";
+		}
+	}
+}
+
+# print total errs/warns only if >1 build checked
+if(!$quiet && @ARGV > 1) {
+	print "$SELF: Total errors: $g_errcount\n";
+	print "$SELF: Total warnings: $g_warncount\n" unless $nowarn;
+}
+
+exit ($g_errcount > 0 || (!$nowarn && $g_warncount > 0));
+# }
+
+sub dequote {
+	my $a = shift;
+	#warn "dequote arg: $a\n";
+	$a =~ s/^("|')(\S+)(\1)$/$2/;
+	#warn "dequote ret: $a\n";
+	return $a;
+}
+
+sub logmsg {
+	my $severity = shift;
+	my $format = shift;
+	printf("$buildname: $severity: $format\n", @_);
+}
+
+sub log_error {
+	logmsg("ERR", @_);
+	$errcount++;
+}
+
+sub log_warning {
+	return if $nowarn;
+	logmsg("WARN", @_);
+	$warncount++;
+}
+
+sub usage {
+	if(@_) {
+		warn "$SELF: $_\n" for @_;
+	}
+
+	warn <<EOF;
+
+$SELF - check SlackBuilds.org scripts for common problems.
+
+Usage: $SELF [-q] [-u] [-n] [-r] <build <build ...>>
+Usage: $SELF --help | --man
+
+builds may be directories or tarballs. If no build arguments given,
+. (current directory) is assumed. Use - to read a list of tarballs/dirs
+from stdin.
+
+Options:
+
+-a  Lint all builds in the git repo.
+-q  Quiet: only emit errors/warnings, no 'checks out OK' or totals.
+-u  URL Check: use HTTP HEAD request to verify download/homepage URLs exist.
+-n  Suppress warnings, log only errors.
+-r  Suppress warning about README lines being too long.
+--doc   See the full documentation, in your pager.
+--man   Convert the full documentation to a man page, on stdout.
+
+Do not bundle options (say "-q -r", not "-qr").
+
+See the full documentation for more details.
+EOF
+# not yet:
+#-d  URL Download: as -u, plus download & check md5sums of download URLs.
+}
+
+sub die_usage {
+	usage(@_);
+	exit 1;
+}
+
+sub chdir_or_die {
+	chdir($_[0]) or die "$SELF: chdir($_[0]): $!\n";
+}
+
+sub make_temp_dir {
+	return if $tempdir;
+	my $tmp = $ENV{TMP} || "/tmp";
+	$tempdir = "$tmp/$SELF." . int(rand(2**32-1));
+	system("rm -rf $tempdir");
+	system("mkdir -p $tempdir");
+	if(! -d $tempdir) {
+		die "$SELF: can't create temp dir $tempdir\n";
+	}
+}
+
+sub rm_temp_dir {
+	if($tempdir && (-d $tempdir)) {
+		system("rm -rf $tempdir");
+		$tempdir = 0;
+	}
+}
+
+sub check_tarball_mime {
+	my $file = shift;
+
+	### This stuff is a little pedantic. It also relies on having a recent-ish
+	### version of GNU file (the one in Slack 14.1 works fine).
+	my %types = (
+			'tar' => 'application/x-tar',
+			'tar.gz' => 'application/x-gzip',
+			'tar.bz2' => 'application/x-bzip2',
+			'tar.xz' => 'application/x-xz',
+	);
+
+	(my $basename = $file) =~ s,.*/,,;
+	my (undef, $ext) = split /\./, $basename, 2;
+	my $mime = `file --brief --mime-type $file`;
+	chomp $mime;
+
+	if(!grep { $_ eq $mime } values %types) {
+		log_error("$file is not a tarball (mime type is '$mime')");
+	} elsif(!$ext) {
+		log_error("$file: filename has no extension (will be rejected by upload form)");
+	} elsif($types{$ext} ne $mime) {
+		log_error("$file mime type '$mime' doesn't match filename (should be $types{$ext})");
+	} elsif($ext ne 'tar') {
+		my $realmime = `file -z --brief --mime-type $file`;
+		chomp $realmime;
+		if($realmime ne 'application/x-tar') {
+			log_error("$file doesn't contain a tar archive (content mime type is $realmime, should be application/x-tar)");
+		}
+	}
+}
+
+sub check_tarball {
+	my $file = shift;
+
+	### First, mime type checks. None of this will be fatal (no return 0 on error).
+	check_tarball_mime($file);
+
+	### one more pre-extraction check:
+	if(-s "$file" > $MAX_TARBALL_SIZE) {
+		log_warning("$file is larger than $MAX_TARBALL_SIZE bytes, upload may be rejected");
+	}
+
+	### now call tar to list the contents, and start returning 0 on failure.
+	my @list = split "\n", `tar tf $file`;
+	if($?) {
+		log_error("$file: tar failed to list contents");
+		return 0;
+	}
+
+	if(!@list) {
+		log_error("$file is empty archive?");
+		return 0;
+	}
+
+	if($list[0] ne "$buildname/") {
+		log_error("$file not a SBo-compliant tarball, first element should be '$buildname/', not '$list[0]'");
+		return 0;
+	}
+
+	my $foundsb = 0;
+	shift @list; # 1st element is dirname/, we already checked it
+	for(@list) {
+		my $bn = quotemeta($buildname); # some builds have + in the name
+		if(not /^$bn\//) {
+			log_error("$file not a SBo-compliant tarball, contains extra junk '$_'");
+			return 0;
+		}
+
+		if(/^$bn\/$bn.SlackBuild$/) {
+			$foundsb = 1;
+		}
+	}
+
+	if(not $foundsb) {
+		log_error("$file not a SBo-compliant tarball, doesn't contain '$buildname/$buildname.SlackBuild'");
+		return 0;
+	}
+
+	return 1;
+}
+
+sub extract_tarball {
+	my $file = shift;
+	$file = `readlink -n -e $file`;
+	make_temp_dir();
+	chdir_or_die($tempdir);
+	system("tar xf $file");
+	return "$tempdir/$buildname";
+}
+
+# run_checks will extract its argument (then cd to it) if it's a tarball,
+# otherwise cd to its argument if it's a dir, otherwise error.
+sub run_checks {
+	$build = shift;
+	my $oldcwd = getcwd();
+
+	$errcount = $warncount = 0;
+
+	if(-f $build || -l $build) {
+		($buildname = $build) =~ s,\.tar(\..*)?$,,;
+		$buildname =~ s,.*/,,;
+		if(check_tarball($build)) {
+			chdir_or_die(extract_tarball($build));
+		} else {
+			return 0;
+		}
+	} elsif(-d $build) {
+		chdir_or_die($build);
+	} else {
+		die_usage "'$build' not a file or a directory.";
+	}
+
+	# last component of directory is the build name
+	$buildname = `readlink -n -e .`;
+	$buildname =~ s,.*/,,;
+
+	my @checks = (
+		\&check_readme,
+		\&check_slackdesc,
+		\&check_info,
+		\&check_script,
+		\&check_images,
+	);
+
+	# if we're in a git repo, it's assumed we're going to track extra
+	# files with git, and use git to update the build, not tar it up
+	# and use the web form.
+	push @checks, \&check_junkfiles unless $in_git_repo;
+	for(@checks) {
+		$_->($build);
+	}
+
+	chdir_or_die($oldcwd);
+	rm_temp_dir();
+}
+
+sub check_mode {
+	my ($file, $wantmode) = @_;
+	if(! -e $file) {
+		log_error("$file does not exist");
+		return 0;
+	}
+
+	my $gotmode = 07777 & ((stat($file))[2]);
+	if($wantmode != $gotmode) {
+		log_error("$file should be mode %04o, not %04o", $wantmode, $gotmode);
+		return 0;
+	}
+
+	return 1;
+}
+
+sub check_crlf {
+	my $file = shift;
+	for(@_) {
+		if(/\r/) {
+			log_error("$file has DOS-style CRLF line endings");
+			return 0;
+		}
+	}
+	return 1;
+}
+
+sub check_and_read {
+	my ($file, $mode) = @_;
+
+	my $crlf_err;
+	my @lines;
+	my $lastline_nonl;
+
+	check_mode($file, $mode);
+
+	if(open my $fh, "<$file") {
+		while(<$fh>) {
+			$lastline_nonl = 1 unless /\n$/;
+			chomp;
+			$crlf_err = 1 if s/\r$//;
+			push @lines, $_;
+		}
+		if(scalar @lines == 0) {
+			log_error("$file exists but is empty");
+		}
+	}
+
+	log_error("$file has DOS-style CRLF line endings") if $crlf_err;
+	log_error("$file has no newline at EOF") if $lastline_nonl;
+	return @lines;
+}
+
+# 20220315 bkw: warn if a file isn't ASCII or UTF-8 without BOM.
+# Used for README and slack-desc...
+sub check_encoding {
+	my $file = shift;
+	my $ascii_only = shift;
+	my $ftype;
+
+	# 20220314 bkw: the -e options make file faster and turn off checks
+	# we don't need, ones that sometimes cause false detection too.
+	chomp($ftype = `file -b -e cdf -e compress -e csv -e elf -e json -e soft -e tar $file`);
+
+	if($ascii_only && ($ftype !~ /ASCII text/)) {
+		log_warning("$file must be ASCII text, not $ftype");
+	}
+
+	if($ftype =~ /ASCII text/ || $ftype =~ /UTF-8/) {
+		# encoding is OK, but:
+		if($ftype =~ /BOM/) {
+			log_warning("$file has BOM, remove with:  LANG=C sed -i '1s/^\\xEF\\xBB\\xBF//' $file");
+		}
+	} elsif($ftype =~ /ISO-8859/) {
+		log_warning("$file has ISO-8859 encoding, fix with:  mv $file $file.old; iconv -f iso-8859-1 -t utf-8 $file.old > $file; rm $file.old");
+	} else {
+		log_warning("$file isn't ASCII or UTF-8, file(1) says it's '$ftype'");
+	}
+}
+
+sub check_readme {
+	my $maxlen = $ENV{'SBOLINT_README_MAX'} || 72;
+	my @lines = check_and_read("README", 0644);
+	return unless @lines;
+
+	check_encoding("README", 0);
+
+	if(grep { /\t/ } @lines) {
+		log_warning("README has tabs, these should be replaced with spaces");
+	}
+
+	return if $suppress_readme_len;
+
+	# 20220205 bkw: don't complain about long lines if they're URLs,
+	# not much we can do about them.
+	if(grep { !/^\s*(ftp|https?):\/\// && length > $maxlen } @lines) {
+		log_warning("README has lines >$maxlen characters");
+	}
+}
+
+# the slack-desc checking code offends me (the author), on the one hand it's
+# overly complex, and on the other hand it assumes the slack-desc is at
+# least close to being right...
+sub check_slackdesc {
+	my @lines = check_and_read("slack-desc", 0644);
+	return unless scalar @lines;
+
+	check_encoding("slack-desc", 1);
+
+	if(grep { /\t/ } @lines) {
+		log_warning("slack-desc has tabs, these should be replaced with spaces");
+	}
+
+	my $lineno = 1;
+
+	if($lines[0] =~ /^# HOW TO EDIT THIS FILE:$/) {
+		shift @lines;
+		$lineno++;
+	} else {
+		log_warning("slack-desc doesn't start with how-to-edit comment");
+	}
+
+	my $count = 0;
+	while($lines[0] =~ /^#/) {
+		$count++;
+		$lineno++;
+		shift @lines;
+	}
+
+	if($count != 5) {
+		log_warning("slack-desc doesn't have standard how-to-edit stanza");
+	}
+
+	$count = 0;
+	while($lines[0] eq "") {
+		$count++;
+		$lineno++;
+		shift @lines;
+	}
+
+	if($count == 0) {
+		log_warning("slack-desc missing blank line before handy-ruler");
+	} elsif($count > 1) {
+		log_warning("slack-desc has extra blank lines before handy-ruler");
+	}
+
+	if($lines[0] =~ /handy-ruler/) {
+		my $ruler = shift @lines;
+		$lineno++;
+		my ($spaces, $prefix, $hr, $suffix, $junk) = ($ruler =~ /^( *)(\|-+)(handy-ruler)(-+\|)(.*)$/);
+
+		if(length($spaces) != length($buildname)) {
+			log_error("slack-desc:$lineno: handy-ruler has wrong number of indent spaces (%d, should be %d)",
+					length($spaces),
+					length($buildname));
+		}
+
+		if(length($junk) > 0) {
+			log_error("slack-desc:$lineno: handy-ruler has %d characters of trailing junk after last |", length($junk));
+		}
+
+		my $rlen = length($prefix . $hr . $suffix);
+		if($rlen != 72) {
+			log_error("slack-desc:$lineno: handy-ruler must be 72 characters, not %d", $rlen);
+		} elsif(length($prefix) != 6) {
+			log_error("slack-desc:$lineno: handy-ruler malformed, has '$prefix' instead of '|-----'");
+		}
+	} else {
+		log_error("slack-desc missing handy-ruler");
+	}
+
+	$count = 0;
+	for(@lines) {
+		$count++;
+		if(my ($prefix, $text) = /^([^\s]+:)(.*)/) {
+			if($prefix ne "$buildname:") {
+				log_error("slack-desc:$lineno: wrong prefix '$prefix', should be '$buildname:'");
+			} elsif($text =~ /^\s+$/) {
+				log_error("slack-desc:$lineno: trailing whitespace after colon, on otherwise-blank line");
+			} elsif(length($text) > 72) {
+				log_error("slack-desc:$lineno: text too long, %d characters, should be <= 72", length($text));
+			} elsif(length($text) && $text !~ /^ /) {
+				log_error("slack-desc:$lineno: missing whitespace after colon, on non-blank line");
+			}
+
+			my $bn = quotemeta($buildname); # some builds have + in the name
+			if(($count == 1) && ($text !~ /^ $bn \(.+\)$/)) {
+				log_warning("slack-desc:$lineno: first description line should be '$buildname: $buildname (short desc)'");
+			}
+		} else {
+			log_error("slack-desc:$lineno: malformed line in description section");
+		}
+
+		$lineno++;
+	}
+
+	if($count < 11) {
+		log_error("slack-desc only has $count description lines, should be 11 (add some empties)");
+	} elsif($count > 11) {
+		log_error("slack-desc has too many description lines ($count, should be 11)");
+	}
+}
+
+# This is a damn mess. Needs refactoring badly.
+sub check_info {
+	my $file = $buildname . ".info";
+	my @lines = check_and_read($file, 0644);
+	return unless scalar @lines;
+
+	my $lineno = 0;
+	my $file_lineno = 0;
+	my @expected = qw/PRGNAM VERSION HOMEPAGE
+	                  DOWNLOAD MD5SUM
+	                  DOWNLOAD_x86_64 MD5SUM_x86_64
+	                  REQUIRES MAINTAINER EMAIL/;
+	my $next_exp = 0;
+	my @keys;
+	my $continuation = 0;
+
+	# parse and bitch about bad syntax...
+	for(@lines) {
+		$file_lineno++;
+		if($continuation) {
+			s/^\s*//;
+			$_ = "$continuation $_";
+			$continuation = 0;
+			$lineno = $file_lineno - 1;
+		} else {
+			$lineno = $file_lineno;
+		}
+
+		if(s/\s*\\$//) {
+			$continuation = $_;
+			next;
+		}
+
+		if(/^\s*$/) {
+			log_error("$file:$lineno: blank line (get rid of it)");
+			next;
+		}
+
+		unless(/=/) {
+			log_error("$file:$lineno: malformed line (no = sign, missing \\ on prev line?)");
+			next;
+		}
+
+		if(s/^\s+//) {
+			log_error("$file:$lineno: leading whitespace before key");
+		}
+
+		if(s/\s+$//) {
+			log_error("$file:$lineno: trailing whitespace at EOL");
+		}
+
+		if(my ($k, $s1, $s2, $q1, $val, $q2) = /^(\w+)(\s*)=(\s*)("?)(.*?)("?)$/) {
+			if(!grep { $k eq $_ } @expected) {
+				log_error("$file:$lineno: invalid key '$k'");
+			} else {
+				if($k ne $expected[$next_exp]) {
+					log_warning("$file:$lineno: out of order, expected $expected[$next_exp], got $k");
+				}
+				$next_exp++;
+			}
+
+			if(not $q1) {
+				log_error("$file:$lineno: missing opening double-quote");
+			}
+
+			if(not $q2) {
+				log_error("$file:$lineno: missing closing double-quote");
+			}
+
+			if(length($s1) || length($s2)) {
+				log_error("$file:$lineno: no spaces allowed before/after = sign");
+			}
+
+			my $oldval = $val;
+			if($val =~ s/^\s+//) {
+				log_error("$file:$lineno: leading space in value: \"$oldval\"");
+			}
+
+			if($val =~ s/\s+$//) {
+				log_error("$file:$lineno: trailing space in value: \"$oldval\"");
+			}
+
+			$info{$k} = $val;
+		} else {
+			log_error("$file:$lineno: malformed line");
+		}
+	}
+
+	# parsing done, now for semantic checks
+
+	my @missing;
+	for(@expected) {
+		if(not exists($info{$_})) {
+			push @missing, $_;
+		}
+	}
+
+	log_error("$file: missing required key(s): " . (join ", ", @missing)) if @missing;
+
+	# init this to avoid checking undef values below
+	$info{$_} ||= "" for @expected;
+
+	if($info{PRGNAM} && ($info{PRGNAM} ne $buildname)) {
+		log_error("$file: PRGNAM is '$info{PRGNAM}', should be '$buildname'");
+	}
+
+	if($info{VERSION} =~ /-/) {
+		log_error("$file: VERSION may not contain - (dash) characters");
+	}
+
+	if(!check_url($info{HOMEPAGE})) {
+		log_error("$file: HOMEPAGE=\"$info{HOMEPAGE}\" doesn't look like a valid URL (http, https, or ftp)");
+	}
+
+	# use a HEAD request for homepage, even if downloading other files
+	if($url_head || $url_download) {
+		curl_head_request($file, $info{HOMEPAGE}) || do {
+			log_warning("$file: HOMEPAGE URL broken?");
+		};
+	}
+
+	if($info{MD5SUM} =~ /^\s*$/) {
+		log_error("$file: MD5SUM is missing or blank") unless $info{DOWNLOAD} eq 'UNSUPPORTED';
+	} else {
+		check_dl_and_md5($file, "");
+	}
+
+	my $dl64 = $info{DOWNLOAD_x86_64};
+	if($dl64 =~ /^(?:|UNSUPPORTED|UNTESTED)$/) {
+		if($info{MD5SUM_x86_64} ne "") {
+			log_error("$file: MD5SUM_x86_64 must be blank if DOWNLOAD_x86_64 is not set");
+		}
+	} elsif($info{MD5SUM_x86_64} eq "") {
+		log_error("$file: MD5SUM_x86_64 may not be blank if DOWNLOAD_x86_64 is set");
+	} else {
+		check_dl_and_md5($file, "_x86_64");
+	}
+}
+
+sub check_dl_and_md5 {
+	my($file, $suffix) = @_;
+	my $md5key = "MD5SUM" . $suffix;
+	my $dlkey = "DOWNLOAD" . $suffix;
+
+	my @dlurls = split /\s+/, $info{$dlkey};
+	my @md5s = split /\s+/, $info{$md5key};
+
+	if(@md5s != @dlurls) {
+		log_error("$file: we have " . @dlurls . " $dlkey URLs but " . @md5s . " $md5key" . " values");
+	}
+
+	for my $u (@dlurls) {
+		if(!check_url($u)) {
+			log_error("$file: $dlkey URL '$u' doesn't look like a valid URL (http, https, or ftp)");
+			next;
+		}
+
+		#check_github_url($file, $u);
+
+		if($url_head) {
+			curl_head_request($file, $u) || do {
+				warn '$u is '. $u;
+				log_warning("$file: $dlkey URL '$u' broken?");
+			};
+		} elsif($url_download) {
+			warn "$SELF: -d option not yet implemented\n";
+		}
+	}
+
+	for(@md5s) {
+		unless(/^[0-9a-f]{32}$/) {
+			log_error("$file: $md5key '$_' is invalid (must be 32 hex digits)");
+		}
+	}
+
+	# TODO: maybe actually download and check md5sums.
+}
+
+sub check_url {
+	# url is bad if:
+	return 0 if $_[0] =~ /\s/;  #  ...it contains a space,
+	return 0 if $_[0] !~ /\./;  #  ...it has no dots, or
+	return 0 if $_[0] !~ /\//;  #  ...it has no slashes, or
+	return ($_[0] =~ /^(?:ftp|https?):\/\//); # ...it doesn't have a known protocol,
+	# ...which doesn't necessarily mean it's a good URL either.
+}
+
+sub curl_head_request {
+	#return !system("curl --head --location --silent --fail $_[0] >/dev/null");
+	#warn $_[1];
+	my $file = $_[0];
+	my $client_filename = $_[1];
+  	$client_filename =~ s,.*/,,;
+	my $curlcmd = "curl -m20 --head --location --silent --fail $_[1]";
+	open my $pipe, "$curlcmd|";
+	#warn "$curlcmd";
+	while(<$pipe>) {
+		chomp;
+		s/\r//;
+		if(/^content-disposition:\s+attachment;\s+filename=["']?(.*?)["']?$/i) {
+			#warn $1;
+			if(defined($client_filename) && ($client_filename ne $1)) {
+				log_warning("$file: download filename varies based on content disposition: '$1' vs. '$client_filename'");
+			}
+		}
+	}
+	return close($pipe);
+}
+
+# WIP, maybe no longer needed
+## sub check_github_url {
+## 	my $file = shift;
+## 	my $url = shift;
+## 	return unless $url =~ m{(https?:)//github\.com};
+## 
+## 	if($1 eq "http:") {
+## 		log_warning("$file: github URL $url should be https");
+## 	}
+## 
+## 	(my $expect_filename = $url) =~ s,.*/,,;
+## 	my(undef, undef, undef, $user, $prog, $archive, $ver, $filename) = split /\//, $url;
+## 	warn "user $user, prog $prog, archive $archive, ver $ver, filename $filename, expect_filename $expect_filename\n";
+## 
+## 	# assume these are correct, for now
+## 	return if $user eq 'downloads';
+## 	return if $archive eq 'releases';
+## 
+## 	# TODO: work out what to do about /raw/
+## 	return if $archive eq 'raw';
+## 
+## 	if($archive ne 'archive') {
+## 		log_warning("$file: unknown github URL type: $url");
+## 		return;
+## 	}
+## 
+## 	# OK, good URLs look like this:
+## 	# https://github.com/jeetsukumaran/DendroPy/archive/v4.4.0/DendroPy-4.4.0.tar.gz
+## 	# ...and bad ones look like this:
+## 	# https://github.com/haiwen/seafile-client/archive/v4.4.2.tar.gz
+## 	# Corrected version of the bad one would be:
+## 	# https://github.com/haiwen/seafile-client/archive/v4.4.2/seafile-client-4.4.2.tar.gz
+## 	# Notice the "v" isn't part of the version number. It's not always there,
+## 	# and sometimes it's a different letter (r, or g, or capital V, etc).
+## }
+
+# NOT going to police the script too much. Would end up rewriting most of
+# the shell, in perl. Plus, it'd become a straitjacket. Here's what I'll
+# implement:
+# - #!/bin/bash on line 1
+# - PRGNAM must match $buildname
+# - VERSION must match the .info VERSION
+# - BUILD line must be present
+# - TAG line must be present
+# - If VERSION, BUILD, TAG don't respect the env, it's a warning
+# - Check for strings like slack-desc, $PKG/install, makepkg, stuff
+#   that's standard for SBo. Don't be too specific here.
+# - If there's a doinst.sh, it must mentioned in the script. If not,
+#   it better not be mentioned.
+# - Check for leftover boilerplate
+# - cp -a <documentation> is an error
+
+sub check_script {
+	my $file = $buildname . ".SlackBuild";
+	my $wantmode = $in_git_repo ? 0644 : 0755;
+
+	my @lines = check_and_read($file, $wantmode);
+	return unless scalar @lines;
+
+	if($lines[0] !~ /^#!/) {
+		log_error("$file:1: missing or invalid shebang line (should be '#!/bin/bash')");
+	} elsif($lines[0] !~ m,#!/bin/bash(?: (?:-e|-eu|-ue|-e -u|-u -e))?$,) {
+		log_warning("$file:1: shebang line should be #!/bin/bash (possibly with -e/-u arg(s)), not '$lines[0]'");
+	}
+
+	my $lineno = 0;
+	my ($prgnam, $version, $build, $tag, $need_doinst, $slackdesc, $makepkg, $install);
+	my ($cdpkg, $codestart, $lint_enabled, $print_pkg_name);
+	$lint_enabled = 1;
+
+	for(@lines) {
+		$lineno++;
+
+		if(/^\s*[^#]/ && !defined($codestart)) {
+			$codestart = $lineno;
+		}
+
+		if(/^###sbolint\s*(\S+)/) {
+			my $arg = $1;
+			if(lc($arg) eq "on") {
+				$lint_enabled = 1;
+			} elsif(lc($arg) eq "off") {
+				$lint_enabled = 0;
+			} else {
+				log_warning("$file:$lineno: unknown ###sbolint argument '$arg' (should be 'on' or 'off')");
+			}
+		}
+
+		next unless $lint_enabled;
+
+		# TODO: cp without -a (or -p, or a couple other flags) is OK.
+##		if(/^[^#]*cp\s+(?:-\w+\s+)*[\"\$\{]*CWD/) {
+##			log_error("$file:$lineno: copying files from CWD with cp (use cat instead)");
+##		}
+
+		if(/^PRGNAM=(\S+)/) {
+			if($prgnam) {
+				log_error("$file:$lineno: PRGNAM redefined");
+			}
+			$prgnam = dequote($1);
+			if($prgnam ne $buildname) {
+				log_error("$file:$lineno: PRGNAM doesn't match dir name ($prgnam != $buildname)");
+			}
+		} elsif(/^VERSION=(\S+)/ && ($lineno <= $codestart + 10)) {
+			$version = dequote($1);
+			if(not ($version =~ s/\$\{VERSION:-([^}]+)\}/$1/)) {
+				log_warning("$file:$lineno: VERSION ignores environment, try VERSION=\${VERSION:-$version}");
+			}
+			$version = dequote($1);
+			if($version ne $info{VERSION}) {
+				log_error("$file:$lineno: VERSION ($version) doesn't match VERSION in the .info file ($info{VERSION})");
+			}
+		} elsif(/^BUILD=(\S+)/) {
+			$build = dequote($1);
+			if(not ($build =~ /\d/)) {
+				log_error("$file:$lineno: BUILD is non-numeric");
+			} elsif(not ($build =~ /\$\{BUILD:-\d+}/)) {
+				log_warning("$file:$lineno: BUILD ignores environment (try BUILD=\${BUILD:-$build}");
+			}
+		} elsif(/^TAG=(\S+)/) {
+			$tag = dequote($1);
+			if($tag !~ /\$\{TAG:-(?:_SBo|("|')_SBo(\1))\}/) {
+				log_error("$file:$lineno: TAG=\${TAG:-_SBo} is required");
+			}
+		} elsif(/^[^#]*\$\{?CWD\}?\/doinst\.sh/) {
+			# 20220205 bkw: some scripts don't have a doinst.sh in the
+			# script dir, but they create one with >> (the jack rt audio stuff
+			# does this).
+			$need_doinst = $lineno;
+		} elsif(/^[^#]*slack-desc/) {
+			$slackdesc = $lineno;
+			$install = $lineno if m,install/,; # assume OK
+		} elsif(/^[^#]*?cd\s+[{\$"]*PKG[}"]*/) {
+			$cdpkg = $lineno;
+		} elsif(/^[^#]*?["{\$]+PKG[}"]*\/install/) {
+			$install = $lineno;
+		} elsif($cdpkg && /^[^#]*mkdir[^#]*install/) {
+			$install = $lineno;
+		} elsif(/^[^#]*makepkg/) {
+			if($makepkg) {
+				log_error("$file:$lineno: makepkg called twice (here and line $makepkg");
+			}
+			$makepkg = $lineno;
+		}
+
+		if(/^[^#]*<documentation>/) {
+			log_error("$file:$lineno: copy actual documentation, not <documentation>");
+		}
+
+		my $line = $_;
+		if(grep { $line =~ /$_/ } @boilerplate) {
+			log_warning("$file:$lineno: template comment should be removed");
+		}
+
+		# special case here: don't complain about this comment if it's a perl-* build
+		if($file !~ /^perl-/) {
+			if($line =~ /#\s*Remove perllocal.pod and other special files/) {
+				log_warning("$file:$lineno: template comment should be removed");
+			}
+		}
+
+		# 20220312 bkw: 15.0 template
+		if(/^[^#]*\$.*PRINT_PACKAGE_NAME/) {
+			$print_pkg_name = 1;
+		}
+	}
+
+	if(not defined($prgnam)) {
+		log_error("$file: no PRGNAM= line");
+	}
+
+	if(not defined($version)) {
+		log_error("$file: no VERSION= line");
+	}
+
+	if(not defined($build)) {
+		log_error("$file: no BUILD= line");
+	}
+
+	if(not defined($tag)) {
+		log_error("$file: no TAG= line");
+	}
+
+	if(not defined($slackdesc)) {
+		log_error("$file: doesn't seem to install slack-desc in \$PKG/install");
+	}
+
+	if(not defined($makepkg)) {
+		log_error("$file: no makepkg command found");
+	}
+
+	if(not defined($print_pkg_name)) {
+		log_error("$file: missing PRINT_PACKAGE_NAME stanza (Slackware >= 15.0)");
+	}
+
+	if(not defined($install)) {
+		log_error("$file: nothing gets installed in \$PKG/install");
+	}
+
+	my $have_doinst = (-f "doinst.sh");
+	if($have_doinst) {
+		check_and_read("doinst.sh", 0644);
+	}
+	if($need_doinst && !$have_doinst) {
+		log_error("$file:$need_doinst: script installs doinst.sh, but it doesn't exist");
+	} elsif($have_doinst && !$need_doinst) {
+		log_error("$file: doinst.sh exists, but the script doesn't install it");
+	}
+}
+
+# stuff like editor backups and dangling symlinks.
+# maybe *any* symlinks?
+# ELF objects are bad, too.
+# Big-ass files...
+# directories are OK, but hidden dirs are not.
+sub check_junkfiles {
+	my @sources = split(/\s+/, $info{DOWNLOAD} . " " . $info{DOWNLOAD_x86_64});
+	s,.*/,, for @sources;
+	@sources = grep { $_ !~ /^(?:\s*|UNTESTED|UNSUPPORTED)$/ } @sources;
+	if(!grep { $_ =~ /^v$info{VERSION}\./ } @sources) {
+		push @sources, "v$info{VERSION}.$_" for qw /zip tar.gz tar.bz2 tar.xz/;
+	}
+
+	open my $fh, "-|", "find . ! -type d -print0 | xargs -0 file --mime-type";
+	FILE: while(<$fh>) {
+		chomp;
+		my ($file, $type) = split /: */, $_, 2;
+		$file =~ s,\./,,;
+
+		# skip the files caught by other checks
+		next if $file eq "$buildname.SlackBuild";
+		next if $file eq "$buildname.info";
+		next if $file eq "README";
+		next if $file eq "slack-desc";
+		next if $file =~ /(?:diff|patch)$/;
+
+		check_mode($file, 0644);
+
+		if(grep { $_ eq $file } @sources) {
+			log_error("source archive found: $file");
+			next FILE;
+		}
+
+		for($file) {
+			(/\.swp\w*$/ || /#/ || /~/ ) && do {
+				log_error("editor backup found: $file");
+				next FILE;
+			};
+			/^\./ && do {
+				log_error("hidden file found: $file");
+				next FILE;
+			};
+			/\.(?:orig|bak|old)[^.]*$/ && do {
+				log_warning("$file looks like sort some of backup file");
+				next FILE;
+			};
+			/^(?:build.log|strace.out)/ && do {
+				log_warning("$file is a build log");
+				next FILE;
+			};
+			/\.desktop$/ && do {
+				system("desktop-file-validate $file");
+				if($? != 0) {
+					log_warning("$file fails desktop-file-validate");
+					next FILE;
+				}
+			}
+		}
+
+		for($type) {
+			($_ eq "inode/x-empty") && do {
+				log_error("$file is empty (0 bytes long)");
+				next FILE;
+			};
+			($_ =~ /^inode/) && do {
+				log_error("$file is $type, not a regular file or directory");
+				next FILE;
+			};
+			($_ =~ m,application/x-(?:executable|dosexec|object|coredump),) && do {
+				log_error("$file is object code ($type)");
+				next FILE;
+			};
+		}
+
+		my $size = -s $file;
+		if($size > 1024 * 100) {
+			log_warning("$file is large ($size bytes), may be rejected by submission form");
+		}
+	}
+	close $fh;
+
+	open $fh, "-|", "find . -type d -mindepth 1";
+	while(<$fh>) {
+		chomp;
+		s,\./,,;
+
+		if(/^\./) {
+			log_error("found hidden directory: $_");
+			next;
+		}
+
+		if(glob("$_/*.o")) {
+			log_error("$_ contains compiled object files (leftover source tree?)");
+			next;
+		}
+
+		for my $badfile (qw/Makefile configure CmakeLists.txt makefile.pl SConstruct/) {
+			if(-f "$_/$badfile") {
+				log_error("$_ looks like extracted source tree (contains $badfile)");
+			}
+		}
+	}
+	close $fh;
+
+#	# this won't always catch everything (e.g. PRGNAM=foo VERSION=1, but the
+#	# extracted dir is foo1 or foo_1 or foo-source-1).
+#	if(-d "$buildname-$version") {
+#		log_warning("$buildname-$version/ looks like extracted source dir");
+#	}
+}
+
+# if anything *.diff or *.patch contains \r, warn the
+# user about git stripping the \r's (better gzip it).
+sub check_patches {
+	for(<*.diff>,<*.patch>) {
+		check_and_read($_, 0644);
+	}
+}
+
+# checking an image is a bit of a PITA. "file" can tell us if it's
+# not an image, or has the wrong extension.
+# ImageMagick's "identify" command won't detect truncated images.
+# "convert" will, but it always returns 0/success, so we have to
+# parse its output.
+sub im_check_img {
+	our %ext2mime;
+	my $mime;
+	my $ok = 1;
+
+	%ext2mime = (
+			png => 'image/png',
+			jpg => 'image/jpeg',
+			xpm => 'image/x-xpm',
+			gif => 'image/gif',
+	) unless %ext2mime;
+
+	my $img = shift;
+	my $ext = $img;
+	$ext =~ s,.*\.,,;
+	$ext = lc $ext;
+
+	chomp($mime = `file -L --brief --mime "$img"`);
+	if($mime !~ /$ext2mime{$ext}/) {
+		log_error("$img has wrong extension $ext (MIME type is $mime)");
+		return;
+	}
+
+	open my $im, "convert \"$img\" png:/dev/null 2>&1 |";
+	while(<$im>) {
+		$ok = 0 if /premature|corrupt/i;
+	}
+	close $im;
+
+	log_error("$img appears to be corrupt") unless $ok;
+}
+
+sub check_images {
+	my $images = `find . \\( -iname '*.jpg' -o -iname '*.png' -o -iname '*.xpm' -o -iname '*.gif' \\) -print0`;
+	for(split /\x00/, $images) {
+		check_mode($_, 0644);
+		im_check_img($_);
+	}
+}
diff --git a/sbolint.1 b/sbolint.1
new file mode 100644
index 0000000..8ee2499
--- /dev/null
+++ b/sbolint.1
@@ -0,0 +1,288 @@
+.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
+.\"
+.\" Standard preamble:
+.\" ========================================================================
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Vb \" Begin verbatim text
+.ft CW
+.nf
+.ne \\$1
+..
+.de Ve \" End verbatim text
+.ft R
+.fi
+..
+.\" Set up some character translations and predefined strings.  \*(-- will
+.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
+.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
+.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
+.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
+.\" nothing in troff, for use with C<>.
+.tr \(*W-
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.ie n \{\
+.    ds -- \(*W-
+.    ds PI pi
+.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
+.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
+.    ds L" ""
+.    ds R" ""
+.    ds C` ""
+.    ds C' ""
+'br\}
+.el\{\
+.    ds -- \|\(em\|
+.    ds PI \(*p
+.    ds L" ``
+.    ds R" ''
+.    ds C`
+.    ds C'
+'br\}
+.\"
+.\" Escape single quotes in literal strings from groff's Unicode transform.
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\"
+.\" If the F register is >0, we'll generate index entries on stderr for
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
+.\" entries marked with X<> in POD.  Of course, you'll have to process the
+.\" output yourself in some meaningful fashion.
+.\"
+.\" Avoid warning from groff about undefined register 'F'.
+.de IX
+..
+.nr rF 0
+.if \n(.g .if rF .nr rF 1
+.if (\n(rF:(\n(.g==0)) \{\
+.    if \nF \{\
+.        de IX
+.        tm Index:\\$1\t\\n%\t"\\$2"
+..
+.        if !\nF==2 \{\
+.            nr % 0
+.            nr F 2
+.        \}
+.    \}
+.\}
+.rr rF
+.\"
+.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
+.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
+.    \" fudge factors for nroff and troff
+.if n \{\
+.    ds #H 0
+.    ds #V .8m
+.    ds #F .3m
+.    ds #[ \f1
+.    ds #] \fP
+.\}
+.if t \{\
+.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
+.    ds #V .6m
+.    ds #F 0
+.    ds #[ \&
+.    ds #] \&
+.\}
+.    \" simple accents for nroff and troff
+.if n \{\
+.    ds ' \&
+.    ds ` \&
+.    ds ^ \&
+.    ds , \&
+.    ds ~ ~
+.    ds /
+.\}
+.if t \{\
+.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
+.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
+.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
+.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
+.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
+.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
+.\}
+.    \" troff and (daisy-wheel) nroff accents
+.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
+.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
+.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
+.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
+.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
+.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
+.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
+.ds ae a\h'-(\w'a'u*4/10)'e
+.ds Ae A\h'-(\w'A'u*4/10)'E
+.    \" corrections for vroff
+.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
+.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
+.    \" for low resolution devices (crt and lpr)
+.if \n(.H>23 .if \n(.V>19 \
+\{\
+.    ds : e
+.    ds 8 ss
+.    ds o a
+.    ds d- d\h'-1'\(ga
+.    ds D- D\h'-1'\(hy
+.    ds th \o'bp'
+.    ds Th \o'LP'
+.    ds ae ae
+.    ds Ae AE
+.\}
+.rm #[ #] #H #V #F C
+.\" ========================================================================
+.\"
+.IX Title "SBOLINT 1"
+.TH SBOLINT 1 "2022-04-03" "0.4" "SBoStuff"
+.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
+.\" way too many mistakes in technical documents.
+.if n .ad l
+.nh
+.SH "NAME"
+sbolint \- check SlackBuild directories or tarballs for common errors.
+.SH "SYNOPSIS"
+.IX Header "SYNOPSIS"
+\&\fBsbolint\fR [\-a] [\-g] [\-q] [\-u] [\-n] [build [build ...]]
+.SH "DESCRIPTION"
+.IX Header "DESCRIPTION"
+sbolint checks for common errors in SlackBuilds.org scripts. It's
+intended for slackbuild authors and maintainers, and can cut down on
+\&\*(L"There was a problem with your upload\*(R" errors from the submission form.
+.PP
+The [build] arguments must be either directories or tarballs, each
+containing a SlackBuild script, slack-desc, \s-1README,\s0 and .info file.
+With no [build] arguments, the current directory is checked.
+.PP
+sbolint will flag errors for problems that would prevent the build from
+being accepted by the upload form (or by the SBo admins, if if passes
+the upload checks). There may also be warnings, which are things that
+(probably) won't stop your build from being accepted, but may cause the
+SBo admins extra work.
+.PP
+sbolint was not written by the SlackBuilds.org team, and shares no code
+with the upload form's submission checker. Lack of errors/warnings from
+sbolint does not guarantee that your build will be accepted!
+.PP
+sbolint doesn't check built packages, and never executes the build
+script. If you want a lint tool for binary Slackware packages, try
+pprkut's \fBlintpkg\fR.
+.SH "OPTIONS"
+.IX Header "OPTIONS"
+.IP "\fB\-a\fR" 4
+.IX Item "-a"
+Check all builds in the git repository. This must be run from within a
+git tree (e.g. one made with \*(L"git clone\*(R").
+.IP "\fB\-q\fR" 4
+.IX Item "-q"
+Quiet. Suppresses 'xxx checks out \s-1OK\s0' and the total errors/warnings summary.
+.IP "\fB\-u\fR" 4
+.IX Item "-u"
+\&\s-1URL\s0 check. Uses \fBcurl\fR to make \s-1HTTP HEAD\s0 requests for the \fB\s-1HOMEPAGE\s0\fR,
+\&\fB\s-1DOWNLOAD\s0\fR, and \fBDOWNLOAD_x86_64\fR links. This won't guarantee that
+the links are good, but some kinds of failure (e.g. site down, 404)
+means they're definitely bad. Unfortunately a lot of sites have stopped
+responding to \s-1HEAD\s0 requests in the name of \*(L"security\*(R", so your mileage
+man vary.
+.IP "\fB\-n\fR" 4
+.IX Item "-n"
+Suppress warnings. Only errors will be listed. This also affects the
+exit status (see below).
+.SH "CHECKS"
+.IX Header "CHECKS"
+For tar files only:
+.IP "\-" 4
+File size must not be bigger than the upload form's limit (currently one
+megabyte).
+.IP "\-" 4
+File must be a tar archive, possibly compressed with gzip, bzip2, or xz,
+extractable by the \fBtar\fR(1) command.
+.IP "\-" 4
+Filename extension must match compression type.
+.IP "\-" 4
+Archive must contain a directory with the same name as the archive's base name,
+e.g. \fIfoo.tar.gz\fR must contain \fIfoo/\fR. Everything else in the archive must be
+inside this directory.
+.IP "\-" 4
+Archive must contain \fIdirname/Idirname.SlackBuild\fR.
+.PP
+For all builds:
+.IP "\-" 4
+The SlackBuild, .info, \s-1README\s0 files must have Unix \en line endings (not
+\&\s-1DOS\s0 \er\en), and the last line of each must have a \en.
+.IP "\-" 4
+The SlackBuild script must exist, with mode 0755 (or 0644, if in a git repo),
+and be a \fI#!/bin/bash\fR script.
+.IP "\-" 4
+The script must contain the standard variable assignments for \s-1PRGNAM,
+VERSION, BUILD,\s0 and \s-1TAG. BUILD\s0 must be numeric.
+.IP "\-" 4
+\&\fI\s-1PRGNAM\s0\fR in the script must match \fI\s-1PRGNAM\s0\fR in the .info file. Both must
+match the script name (\fI\s-1PRGNAM\s0.SlackBuild\fR) and the directory name.
+.IP "\-" 4
+\&\fI\s-1VERSION\s0\fR must match the \fI\s-1VERSION\s0\fR in the .info file.
+.IP "\-" 4
+TAG=${TAG:\-_SBo} must occur in the script.
+.IP "\-" 4
+The \fI\s-1VERSION\s0\fR, \fI\s-1BUILD\s0\fR, and \fI\s-1TAG\s0\fR variables must respect the environment.
+.IP "\-" 4
+The script must install the slack-desc in \fI\f(CI$PKG\fI/install\fR.
+.IP "\-" 4
+If there is a doinst.sh script, the SlackBuild must install it to \fI\f(CI$PKG\fI/install\fR.
+.IP "\-" 4
+Template boilerplate comments should be removed, e.g. \fI\*(L"\s-1REMOVE THIS ENTIRE BLOCK OF TEXT\*(R"\s0\fR
+or \fI\*(L"Automatically determine the architecture we're building on\*(R"\fR.
+.IP "\-" 4
+Script must contain exactly one \fBmakepkg\fR command.
+.IP "\-" 4
+\&\s-1README\s0 must exist, have mode 0644, its character encoding must be
+either \s-1ASCII\s0 or \s-1UTF\-8\s0 without \s-1BOM,\s0 and it may not contain tab characters.
+.IP "\-" 4
+slack-desc must exist, have mode 0644, its character encoding must be \s-1ASCII,\s0
+and it may not contain tab characters.
+.IP "\-" 4
+slack-desc contents must match the SBo template, including the \*(L"handy-ruler\*(R",
+comments, and correct spacing/indentation.
+.IP "\-" 4
+\&.info file must exist, have mode 0644, and match the SBo template.
+.IP "\-" 4
+\&.info file URLs must be valid URLs (for a very loose definition of \*(L"valid\*(R": they
+must begin with \fBftp://\fR, \fBhttp://\fR, or \fBhttps://\fR).
+.IP "\-" 4
+Optionally, .info file URLs can be checked for existence with an \s-1HTTP HEAD\s0
+request (see the \fB\-u\fR option).
+.PP
+The following tests are only done when sbolint's starting directory
+was \s-1NOT\s0 in a git repo:
+.IP "\-" 4
+Any files other than the .SlackBuild, .info, slack-desc, and \s-1README\s0 are
+checked for permissions (should be 0644) and excessive size.
+.IP "\-" 4
+The source archive(s) must not exist. Also sbolint attempts to detect
+extracted source trees (but isn't all that good at it).
+.IP "\-" 4
+Files named 'build.log' or 'strace.out*' must not exist. The \fBsbrun\fR
+tool creates these.
+.PP
+The rationale for skipping the above tests when in a git repo is that
+maintainers will be using git to track files and push changes, so we
+don't need to check them here.
+.SH "EXIT STATUS"
+.IX Header "EXIT STATUS"
+Exit status from sbolint will normally be 0 (success) if there were no
+errors or warnings in any of the builds checked. With the \fB\-n\fR option,
+exit status will be 0 if there are no errors.
+.PP
+Exit status 1 indicates there was at least one warning or error (or, with
+\&\fB\-n\fR, at least one error).
+.PP
+Any other exit status means sbolint itself failed somehow (e.g. called
+with nonexistent filename).
+.SH "BUGS"
+.IX Header "BUGS"
+Probably quite a few. Watch this space for details.
+.SH "AUTHOR"
+.IX Header "AUTHOR"
+B. Watson (yalhcru at gmail dot com, or Urchlay on Libera \s-1IRC\s0)
+.SH "SEE ALSO"
+.IX Header "SEE ALSO"
+\&\fBsbofixinfo\fR(1), \fBsbosearch\fR(1)
diff --git a/sbopkglint b/sbopkglint
new file mode 100755
index 0000000..c7f88f7
--- /dev/null
+++ b/sbopkglint
@@ -0,0 +1,490 @@
+#!/bin/bash
+
+: <<EOF
+=pod
+
+=head1 NAME
+
+sbopkglint - check Slackware binary packages for common errrors.
+
+=head1 SYNOPSIS
+
+B<sbopkglint> [-k] [-i] [package.t?z ...]
+
+=head1 DESCRIPTION
+
+B<sbopkglint> installs a Slackware package to a temporary directory, then
+examines the contents. It finds lots of common problems that aren't
+always noticed by SBo script maintainers or the admins.
+
+This is for built packages. If you want to lint your build scripts,
+use B<sbolint>(1) instead.
+
+With no package arguments, it looks for a SlackBuild in the current
+directory, extracts the PRINT_PACKAGE_NAME information, and tries
+to find a package in $OUTPUT (/tmp by default). If found, it checks
+that package. It's up to you to know whether the package needs to be
+rebuilt (e.g. if you've edited the SlackBuild since the package was
+built).
+
+With arguments, it checks the given packages. These must be
+supported Slackware package files (.tgz, .txz, .tlz, etc). There's no
+requirement that these have to be SBo packages, but a couple of the
+tests (e.g. the check for $PRGNAM.SlackBuild in the doc dir) might not
+apply to non-SBo builds.
+
+Diagnostics will be logged to stdout and stderr. Exit status will
+be 0 if all tests passed, non-zero otherwise.
+
+This script must run as root. If you run it as a normal user, it tries
+to re-execute itself via sudo(8).
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-k>
+
+Keep the temporary package install directory instead of deleting it on exit.
+
+=item B<-i>
+
+Disable the "useless-looking install instructions" test. This is
+intended for SBo admins mass-linting a ton of packages. INSTALL in
+the doc dir is something that exists in thousands of existing builds,
+and it's not a major problem. New builds and updates should be linted
+without this option, however.
+
+=item B<--help>
+
+Show the short built-in help.
+
+=item B<--doc>
+
+View this documentation using perldoc(1), which generally uses your
+pager (e.g. less(1) or more(1)) to display it.
+
+=item B<--man>
+
+Convert this documentation to a man page, on stdout.
+
+=back
+
+=head1 EXIT STATUS
+
+0 (success) if all tests passed for all packages, non-zero if there
+were any test failures (or if installpkg failed for some reason).
+
+=head1 FILES
+
+=over 4
+
+=item B<sbolint.d/*.t.sh>
+
+These are the actual tests. They're installed to
+I<PREFIX>/share/sbo-maintainer-tools, and they're sourced by
+B<sbopkglint> at runtime. Each test script begins with (hopefully)
+useful comments that go into more detail than the documentation here.
+
+=back
+
+=head1 TESTS
+
+=head2 basic-sanity
+
+=over 4
+
+=item B<->
+
+Top-level directories inside the package must be recognized ones,
+such as /bin /etc /usr /opt. Packages shouldn't be installing files
+in /tmp, /dev, or /home... and they really shouldn't be inventing
+new top-level directories.
+
+=item B<->
+
+The documentation directory must exist and be correctly named, as
+/usr/doc/$PRGNAM-$VERSION. It must contain $PRGNAM.SlackBuild, too.
+
+=item B<->
+
+The directories /usr/local, /usr/share/doc, /usr/share/man, /usr/etc
+are not allowed in SBo packages.
+
+=item B<->
+
+Some directories (e.g. /usr/bin) may not contain subdirectories.
+
+=item B<->
+
+Some directories (e.g. /usr/share) must *only* contain subdirectories.
+
+=item B<->
+
+Some directories (e.g. /usr/man, /usr/share/applications) must not
+contain files with executable permissions. /usr/doc is not in this
+list; neither is /etc (too many existing packages install +x files
+there).
+
+=item B<->
+
+Broken symlinks may not exist.
+
+=item B<->
+
+Absolute symlinks may not exist (they should be converted to
+relative symlinks). This may seem like nitpicking, but packages
+may be installed somewhere besides / (the root dir) with the
+-root option to installpkg. If /usr/bin/foo is a link to /usr/bin/bar,
+it should be a link to just bar.
+
+=back
+
+=head2 docs
+
+=over 4
+
+=item B<->
+
+Documentation must be installed to /usr/doc/$PRGNAM-$VERSION. If
+there's any other directory under /usr/doc, it's incorrect. Some
+builds use mis-named doc directories (if it hasn't been fixed by
+now, an example is gcc5, which installs docs to /usr/doc/gcc-$VERSION
+when it should be gcc5-$VERSION).
+
+=item B<->
+
+Documentation files must be readable by everyone, and owned by root:root.
+
+=item B<->
+
+Doc dir shouldn't contain empty files (0 bytes in length).
+
+=item B<->
+
+Doc dir shouldn't contain install instructions. Specifically, files
+named INSTALL, INSTALL.*, or install.txt are flagged (it's impossible
+to make this test 100% perfect).
+
+=back
+
+=head2 noarch
+
+=over 4
+
+=item B<->
+
+If a package has its architecture set to "noarch", it must not contain
+any ELF binaries/libraries.
+
+=back
+
+=head2 arch
+
+=over 4
+
+=item B<->
+
+If a package has its architecture set to i?86 or x86_64, all ELF
+binaries/libraries must be for the correct arch (no 32-bit code in
+64-bit packages, and vice versa).
+
+=item B<->
+
+If a package is i?86, it must not contain /usr/lib64.
+
+=item B<->
+
+If a package is x86_64 and contains shared libraries, they must be
+in /lib64 or /usr/lib64 (not /lib or /usr/lib).
+
+=back
+
+=head2 lafiles
+
+=over 4
+
+=item B<->
+
+Packages are no longer allowed to contain libtool archive files (.la)
+in /lib, /lib64, /usr/lib, or /usr/lib64. However, subdirectories
+such as /usr/lib64/someprogram/ are not checked, since some applications
+which use plugins actually use the .la files.
+
+=back
+
+=head2 manpages
+
+=over 4
+
+=item B<->
+
+All man pages must be readable by everyone, and owned by root:root.
+
+=item B<->
+
+All man pages must be gzipped.
+
+=item B<->
+
+All man pages must be in /usr/man/man[1-9n] or /usr/man/<lang>/man[1-9n].
+
+=item B<->
+
+Man page directories must be mode 755, owned by root:root.
+
+=item B<->
+
+The section numbers in man page filenames must match the section number
+in the directory name (e.g. /usr/man/man1/ls.1.gz is OK,
+/usr/man/man1/tetris.6.gz is an error).
+
+=item B<->
+
+Man pages must actually be man pages (troff markup).
+
+=back
+
+=head2 desktop
+
+=over 4
+
+=item B<->
+
+If there are .desktop files, doinst.sh must run update-desktop-database.
+
+=item B<->
+
+.desktop files must be mode 644, owned by root:root. Slackware's KDE
+packages actually break this rule (they install executable .desktop
+files), but SBo packages are not allowed to.
+
+=item B<->
+
+Only .desktop files are allowed in /usr/share/applications.
+
+=item B<->
+
+.desktop files must be valid, according to the desktop-file-validate
+command. Only actual errors count; warnings don't cause this test to
+fail.
+
+=back
+
+=head2 newconfig
+
+=over 4
+
+=item B<->
+
+Any files (outside of /usr/doc) with names ending in .new are flagged.
+This might be a bit too restrictive (possibly only check /etc and
+/usr/share?)
+
+=back
+
+=head2 doinst
+
+=over 4
+
+=item B<->
+
+If there are icons in /usr/share/icons, .desktop files in /usr/share/applications,
+or glib2 schemas in /usr/share/glib-2.0/schemas, there must be a doinst.sh
+with appropriate command(s), e.g. update-desktop-database, gtk-update-icon-cache,
+glib-compile-schemas.
+
+=back
+
+=head1 BUGS
+
+Probably many. This is still a work in progress.
+
+One known problem is that the same file can fail multiple tests. E.g.
+if you have a man page that's installed executable, it will fail both
+the basic-sanity test and the manpages test. This isn't really a huge
+problem, so it might not be fixed any time soon.
+
+=head1 AUTHOR
+
+B. Watson <urchlay@slackware.uk>, AKA Urchlay on Libera IRC.
+
+=head1 SEE ALSO
+
+B<sbolint>(1)
+
+=cut
+EOF
+
+# lint a binary Slackware package. primarily intended for use with
+# SBo packages, but could be used for any Slack pkg.
+
+# this must be run as root, as it installs the package in a temp dir,
+# with "installpkg -root". if it's not running as root, it tries to
+# run itself via sudo.
+
+SELF="$( basename $0 )"
+
+usage() {
+	cat 1>&2 <<EOF
+$SELF - check SBo binary packages for various problems
+
+Usage:
+  $0 [-k] [-i] [/path/to/package-file] [...]
+  $0 --doc | --man
+
+Options:
+-k      Keep (don't delete) the package install directory at exit.
+-i      Do not check for INSTALL in the doc dir.
+--doc   See the full documentation in your pager.
+--man   Convert the full documentation to a man page, on stdout.
+
+With no package arguments, it looks for a SlackBuild in the current
+directory, extracts the PRINT_PACKAGE_NAME information, and tries to
+find a package in \$OUTPUT (/tmp by default).
+
+With arguments, it checks the given packages. These must be supported
+Slackware package files (.tgz, .txz, .tlz, etc).
+
+Diagnostics will be logged to stdout and stderr. Exit status will
+be 0 if all tests passed, non-zero otherwise.
+
+This script must run as root. If you run it as a normal user, it tries
+to re-execute itself via sudo(8).
+EOF
+}
+
+while true; do
+	case "$1" in
+		--doc) exec perldoc "$0" ;;
+		--man) exec pod2man --stderr -s1 -csbo-maintainer-tools -r0.4 "$0" ;;
+		-k) KEEP=1 ; shift ;;
+		-i) INSTALL_DOCS_OK=1 ; shift;;
+		-h*|--h*) usage; exit 0 ;;
+		-*) echo "$SELF: invalid option '$1', try '$SELF --help'" ; exit 1 ;;
+		*) break ;;
+	esac
+done
+
+# where the test scripts live, space-separated list.
+SBOPKGLINT_PATH=${SBOPKGLINT_PATH:-"./sbopkglint.d /usr/share/sbo-maintainer-tools/sbopkglint.d /usr/local/share/sbo-maintainer-tools/sbopkglint.d"}
+
+if [ "$(id -u)" != "0" ]; then
+	exec sudo \
+		TMP="$TMP" \
+		OUTPUT="$OUTPUT" \
+		INSTALL_DOCS_OK="$INSTALL_DOCS_OK" \
+		KEEP="$KEEP" \
+		SBOPKGLINT_PATH="$SBOPKGLINT_PATH" \
+		"$0" "$@"
+fi
+
+warn() {
+	[ "$warncount" = "0" ] && echo
+	: $(( warncount ++ ))
+   echo "--- $@" 1>&2
+}
+
+die() {
+	warn "$@"
+	exit 1
+}
+
+TMP=${TMP:-/tmp}
+OUTPUT=${OUTPUT:-$TMP}
+
+exit_status=0
+
+if [ -n "$1" ]; then
+	packages="$@"
+else
+	cnt="$( /bin/ls *.SlackBuild | wc -l )"
+	case "$cnt" in
+		0) die "No argument given and no SlackBuild script in current dir" ;;
+		1) ;; # OK
+		*) die "Multiple SlackBuild scripts in current dir" ;;
+	esac
+	script="$( /bin/ls *.SlackBuild )"
+	if ! grep -q PRINT_PACKAGE_NAME $script; then
+		die "$script doesn't support PRINT_PACKAGE_NAME"
+	fi
+	filename="$( PRINT_PACKAGE_NAME=1 sh $script )"
+	packages="$OUTPUT/$filename"
+	if [ ! -e "$packages" ]; then
+		die "Can't find $packages"
+	fi
+fi
+
+for testdir in $SBOPKGLINT_PATH; do
+	[ -d $testdir ] || continue
+	testdir="$( realpath $testdir )"
+	break
+done
+[ -z "$testdir" -o "$testdir/*.t.sh" = '*.t.sh' ] && \
+	die "Can't find any tests to run, looked in: $SBOPKGLINT_PATH"
+
+echo "Using tests from $testdir"
+
+for package in $packages; do
+	filename="$( basename $package )"
+
+	ARCH="$(    echo $filename | rev | cut -d- -f2  | rev )"
+	PRGNAM="$(  echo $filename | rev | cut -d- -f4- | rev )"
+	VERSION="$( echo $filename | rev | cut -d- -f3  | rev )"
+	PKG="$( mktemp -d $TMP/sbopkglint.XXXXXX )"
+
+	echo -n "Installing $package to $PKG..."
+	/sbin/installpkg -root "$PKG" "$package" &> $PKG/.tmp.$$
+	S="$?"
+
+	if [ "$S" != "0" ]; then
+		echo "FAILED"
+		cat $PKG/.tmp.$$
+		echo "installpkg exited with status $S"
+		[ "$KEEP" = "" ] && rm -rf $PKG
+		exit_status=1
+		continue
+	fi
+
+	echo "OK"
+	rm -f $PKG/.tmp.$$
+
+	cd "$PKG"
+
+	totalwarns=0
+	foundtests=0
+	for testscript in $testdir/*.t.sh; do
+		foundtests=1
+		(
+			warncount=0
+			echo -n "Running test: $( basename $testscript .t.sh )..."
+			source "$testscript"
+			if [ "$warncount" = "0" ]; then
+				echo "OK"
+			else
+				echo "FAILED"
+				echo "$warncount" > .tmp.warncount
+			fi
+		)
+		if [ -e .tmp.warncount ]; then
+			warns="$( cat .tmp.warncount )"
+			: $(( totalwarns += warns ))
+		fi
+		rm -f .tmp.warncount
+	done
+
+	[ "$KEEP" = "" ] && rm -rf "$PKG"
+
+	if [ "$foundtests" = "0" ]; then
+		die "!!! can't find any tests to run in $testdir."
+	fi
+
+	if [ "$totalwarns" = "0" ]; then
+		echo "=== $filename: All tests passed"
+	else
+		exit_status=1
+		echo "!!! $filename: $totalwarns failures"
+	fi
+done
+
+exit $exit_status
diff --git a/sbopkglint.1 b/sbopkglint.1
new file mode 100644
index 0000000..274cfe2
--- /dev/null
+++ b/sbopkglint.1
@@ -0,0 +1,363 @@
+.\" Automatically generated by Pod::Man 4.14 (Pod::Simple 3.42)
+.\"
+.\" Standard preamble:
+.\" ========================================================================
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Vb \" Begin verbatim text
+.ft CW
+.nf
+.ne \\$1
+..
+.de Ve \" End verbatim text
+.ft R
+.fi
+..
+.\" Set up some character translations and predefined strings.  \*(-- will
+.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
+.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
+.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
+.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
+.\" nothing in troff, for use with C<>.
+.tr \(*W-
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.ie n \{\
+.    ds -- \(*W-
+.    ds PI pi
+.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
+.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
+.    ds L" ""
+.    ds R" ""
+.    ds C` ""
+.    ds C' ""
+'br\}
+.el\{\
+.    ds -- \|\(em\|
+.    ds PI \(*p
+.    ds L" ``
+.    ds R" ''
+.    ds C`
+.    ds C'
+'br\}
+.\"
+.\" Escape single quotes in literal strings from groff's Unicode transform.
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\"
+.\" If the F register is >0, we'll generate index entries on stderr for
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
+.\" entries marked with X<> in POD.  Of course, you'll have to process the
+.\" output yourself in some meaningful fashion.
+.\"
+.\" Avoid warning from groff about undefined register 'F'.
+.de IX
+..
+.nr rF 0
+.if \n(.g .if rF .nr rF 1
+.if (\n(rF:(\n(.g==0)) \{\
+.    if \nF \{\
+.        de IX
+.        tm Index:\\$1\t\\n%\t"\\$2"
+..
+.        if !\nF==2 \{\
+.            nr % 0
+.            nr F 2
+.        \}
+.    \}
+.\}
+.rr rF
+.\"
+.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
+.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
+.    \" fudge factors for nroff and troff
+.if n \{\
+.    ds #H 0
+.    ds #V .8m
+.    ds #F .3m
+.    ds #[ \f1
+.    ds #] \fP
+.\}
+.if t \{\
+.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
+.    ds #V .6m
+.    ds #F 0
+.    ds #[ \&
+.    ds #] \&
+.\}
+.    \" simple accents for nroff and troff
+.if n \{\
+.    ds ' \&
+.    ds ` \&
+.    ds ^ \&
+.    ds , \&
+.    ds ~ ~
+.    ds /
+.\}
+.if t \{\
+.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
+.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
+.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
+.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
+.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
+.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
+.\}
+.    \" troff and (daisy-wheel) nroff accents
+.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
+.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
+.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
+.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
+.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
+.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
+.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
+.ds ae a\h'-(\w'a'u*4/10)'e
+.ds Ae A\h'-(\w'A'u*4/10)'E
+.    \" corrections for vroff
+.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
+.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
+.    \" for low resolution devices (crt and lpr)
+.if \n(.H>23 .if \n(.V>19 \
+\{\
+.    ds : e
+.    ds 8 ss
+.    ds o a
+.    ds d- d\h'-1'\(ga
+.    ds D- D\h'-1'\(hy
+.    ds th \o'bp'
+.    ds Th \o'LP'
+.    ds ae ae
+.    ds Ae AE
+.\}
+.rm #[ #] #H #V #F C
+.\" ========================================================================
+.\"
+.IX Title "SBOPKGLINT 1"
+.TH SBOPKGLINT 1 "2022-04-04" "0.4" "sbo-maintainer-tools"
+.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
+.\" way too many mistakes in technical documents.
+.if n .ad l
+.nh
+.SH "NAME"
+sbopkglint \- check Slackware binary packages for common errrors.
+.SH "SYNOPSIS"
+.IX Header "SYNOPSIS"
+\&\fBsbopkglint\fR [\-k] [\-i] [package.t?z ...]
+.SH "DESCRIPTION"
+.IX Header "DESCRIPTION"
+\&\fBsbopkglint\fR installs a Slackware package to a temporary directory, then
+examines the contents. It finds lots of common problems that aren't
+always noticed by SBo script maintainers or the admins.
+.PP
+This is for built packages. If you want to lint your build scripts,
+use \fBsbolint\fR(1) instead.
+.PP
+With no package arguments, it looks for a SlackBuild in the current
+directory, extracts the \s-1PRINT_PACKAGE_NAME\s0 information, and tries
+to find a package in \f(CW$OUTPUT\fR (/tmp by default). If found, it checks
+that package. It's up to you to know whether the package needs to be
+rebuilt (e.g. if you've edited the SlackBuild since the package was
+built).
+.PP
+With arguments, it checks the given packages. These must be
+supported Slackware package files (.tgz, .txz, .tlz, etc). There's no
+requirement that these have to be SBo packages, but a couple of the
+tests (e.g. the check for \f(CW$PRGNAM\fR.SlackBuild in the doc dir) might not
+apply to non-SBo builds.
+.PP
+Diagnostics will be logged to stdout and stderr. Exit status will
+be 0 if all tests passed, non-zero otherwise.
+.PP
+This script must run as root. If you run it as a normal user, it tries
+to re-execute itself via \fBsudo\fR\|(8).
+.SH "OPTIONS"
+.IX Header "OPTIONS"
+.IP "\fB\-k\fR" 4
+.IX Item "-k"
+Keep the temporary package install directory instead of deleting it on exit.
+.IP "\fB\-i\fR" 4
+.IX Item "-i"
+Disable the \*(L"useless-looking install instructions\*(R" test. This is
+intended for SBo admins mass-linting a ton of packages. \s-1INSTALL\s0 in
+the doc dir is something that exists in thousands of existing builds,
+and it's not a major problem. New builds and updates should be linted
+without this option, however.
+.IP "\fB\-\-help\fR" 4
+.IX Item "--help"
+Show the short built-in help.
+.IP "\fB\-\-doc\fR" 4
+.IX Item "--doc"
+View this documentation using \fBperldoc\fR\|(1), which generally uses your
+pager (e.g. \fBless\fR\|(1) or \fBmore\fR\|(1)) to display it.
+.IP "\fB\-\-man\fR" 4
+.IX Item "--man"
+Convert this documentation to a man page, on stdout.
+.SH "EXIT STATUS"
+.IX Header "EXIT STATUS"
+0 (success) if all tests passed for all packages, non-zero if there
+were any test failures (or if installpkg failed for some reason).
+.SH "FILES"
+.IX Header "FILES"
+.IP "\fBsbolint.d/*.t.sh\fR" 4
+.IX Item "sbolint.d/*.t.sh"
+These are the actual tests. They're installed to
+\&\fI\s-1PREFIX\s0\fR/share/sbo\-maintainer\-tools, and they're sourced by
+\&\fBsbopkglint\fR at runtime. Each test script begins with (hopefully)
+useful comments that go into more detail than the documentation here.
+.SH "TESTS"
+.IX Header "TESTS"
+.SS "basic-sanity"
+.IX Subsection "basic-sanity"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Top-level directories inside the package must be recognized ones,
+such as /bin /etc /usr /opt. Packages shouldn't be installing files
+in /tmp, /dev, or /home... and they really shouldn't be inventing
+new top-level directories.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+The documentation directory must exist and be correctly named, as
+/usr/doc/$PRGNAM\-$VERSION. It must contain \f(CW$PRGNAM\fR.SlackBuild, too.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+The directories /usr/local, /usr/share/doc, /usr/share/man, /usr/etc
+are not allowed in SBo packages.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Some directories (e.g. /usr/bin) may not contain subdirectories.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Some directories (e.g. /usr/share) must *only* contain subdirectories.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Some directories (e.g. /usr/man, /usr/share/applications) must not
+contain files with executable permissions. /usr/doc is not in this
+list; neither is /etc (too many existing packages install +x files
+there).
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Broken symlinks may not exist.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Absolute symlinks may not exist (they should be converted to
+relative symlinks). This may seem like nitpicking, but packages
+may be installed somewhere besides / (the root dir) with the
+\&\-root option to installpkg. If /usr/bin/foo is a link to /usr/bin/bar,
+it should be a link to just bar.
+.SS "docs"
+.IX Subsection "docs"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Documentation must be installed to /usr/doc/$PRGNAM\-$VERSION. If
+there's any other directory under /usr/doc, it's incorrect. Some
+builds use mis-named doc directories (if it hasn't been fixed by
+now, an example is gcc5, which installs docs to /usr/doc/gcc\-$VERSION
+when it should be gcc5\-$VERSION).
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Documentation files must be readable by everyone, and owned by root:root.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Doc dir shouldn't contain empty files (0 bytes in length).
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Doc dir shouldn't contain install instructions. Specifically, files
+named \s-1INSTALL, INSTALL\s0.*, or install.txt are flagged (it's impossible
+to make this test 100% perfect).
+.SS "noarch"
+.IX Subsection "noarch"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+If a package has its architecture set to \*(L"noarch\*(R", it must not contain
+any \s-1ELF\s0 binaries/libraries.
+.SS "arch"
+.IX Subsection "arch"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+If a package has its architecture set to i?86 or x86_64, all \s-1ELF\s0
+binaries/libraries must be for the correct arch (no 32\-bit code in
+64\-bit packages, and vice versa).
+.IP "\fB\-\fR" 4
+.IX Item "-"
+If a package is i?86, it must not contain /usr/lib64.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+If a package is x86_64 and contains shared libraries, they must be
+in /lib64 or /usr/lib64 (not /lib or /usr/lib).
+.SS "lafiles"
+.IX Subsection "lafiles"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Packages are no longer allowed to contain libtool archive files (.la)
+in /lib, /lib64, /usr/lib, or /usr/lib64. However, subdirectories
+such as /usr/lib64/someprogram/ are not checked, since some applications
+which use plugins actually use the .la files.
+.SS "manpages"
+.IX Subsection "manpages"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+All man pages must be readable by everyone, and owned by root:root.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+All man pages must be gzipped.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+All man pages must be in /usr/man/man[1\-9n] or /usr/man/<lang>/man[1\-9n].
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Man page directories must be mode 755, owned by root:root.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+The section numbers in man page filenames must match the section number
+in the directory name (e.g. /usr/man/man1/ls.1.gz is \s-1OK,\s0
+/usr/man/man1/tetris.6.gz is an error).
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Man pages must actually be man pages (troff markup).
+.SS "desktop"
+.IX Subsection "desktop"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+If there are .desktop files, doinst.sh must run update-desktop-database.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+\&.desktop files must be mode 644, owned by root:root. Slackware's \s-1KDE\s0
+packages actually break this rule (they install executable .desktop
+files), but SBo packages are not allowed to.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Only .desktop files are allowed in /usr/share/applications.
+.IP "\fB\-\fR" 4
+.IX Item "-"
+\&.desktop files must be valid, according to the desktop-file-validate
+command. Only actual errors count; warnings don't cause this test to
+fail.
+.SS "newconfig"
+.IX Subsection "newconfig"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+Any files (outside of /usr/doc) with names ending in .new are flagged.
+This might be a bit too restrictive (possibly only check /etc and
+/usr/share?)
+.SS "doinst"
+.IX Subsection "doinst"
+.IP "\fB\-\fR" 4
+.IX Item "-"
+If there are icons in /usr/share/icons, .desktop files in /usr/share/applications,
+or glib2 schemas in /usr/share/glib\-2.0/schemas, there must be a doinst.sh
+with appropriate command(s), e.g. update-desktop-database, gtk-update-icon-cache,
+glib-compile-schemas.
+.SH "BUGS"
+.IX Header "BUGS"
+Probably many. This is still a work in progress.
+.PP
+One known problem is that the same file can fail multiple tests. E.g.
+if you have a man page that's installed executable, it will fail both
+the basic-sanity test and the manpages test. This isn't really a huge
+problem, so it might not be fixed any time soon.
+.SH "AUTHOR"
+.IX Header "AUTHOR"
+B. Watson <urchlay@slackware.uk>, \s-1AKA\s0 Urchlay on Libera \s-1IRC.\s0
+.SH "SEE ALSO"
+.IX Header "SEE ALSO"
+\&\fBsbolint\fR(1)
diff --git a/sbopkglint.d/05-basic-sanity.t.sh b/sbopkglint.d/05-basic-sanity.t.sh
new file mode 100644
index 0000000..6709203
--- /dev/null
+++ b/sbopkglint.d/05-basic-sanity.t.sh
@@ -0,0 +1,152 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+#######################################################################
+# these directories are allowed to exist in the package, but they
+# must be mode 0755 and owned by root:root. if a dir from this list
+# exists but is empty, that's an error. if a top-level directory
+# exists that's *not* in this list (such as /dev), that's an error.
+topleveldirs="bin boot etc lib lib64 opt sbin srv usr var run"
+
+# these directories are *required* to exist, and must be mode 0755, root:root.
+# if a dir from this list exists but is empty, that's an error. note
+# that the install/ dir no longer exists by the time we run (installpkg
+# deleted it already).
+requireddirs="usr/doc/$PRGNAM-$VERSION"
+
+# these directories *must not* exist. no need to list top-level dirs here,
+# the topleveldirs check already catches those.
+baddirs="usr/local usr/share/doc usr/share/man usr/etc usr/share/info usr/X11 usr/X11R6"
+
+# these directories may exist, but must contain only files or symlinks,
+# and must be mode 0755, root:root. I thought usr/share/pixmaps
+# belonged here, but quite a few packages create subdirs there for
+# images required at runtime that aren't the app icon.
+fileonlydirs="bin usr/bin sbin usr/sbin"
+
+# these directories may exist, but must contain only subdirectories
+# (no files, symlinks, devices, etc). "." (the top-level package dir)
+# doesn't need to be included here; it's checked separately.
+nofiledirs="usr usr/doc usr/share usr/man"
+
+# these directories may exist but must not have executable files
+# anywhere under them. I would put usr/doc and etc here, but too many
+# packages break that rule. usr/share/applications is listed here,
+# even though Slackware's KDE packages (erroneously) install .desktop
+# files +x.
+noexecdirs="usr/man usr/share/pixmaps usr/share/icons usr/share/applications usr/share/appdata usr/share/mime usr/share/mime-info usr/share/glib-2.0"
+
+# these files must exist.
+requiredfiles="usr/doc/$PRGNAM-$VERSION/$PRGNAM.SlackBuild"
+
+# these files must not exist.
+badfiles="\
+usr/info/dir \
+usr/info/dir.gz \
+usr/lib64/perl5/perllocal.pod \
+usr/lib/perl5/perllocal.pod \
+usr/share/perl5/perllocal.pod \
+usr/share/perl5/vendor_perl/perllocal.pod \
+etc/passwd \
+etc/passwd.new \
+etc/shadow \
+etc/shadow.new \
+etc/group \
+etc/group.new \
+etc/gshadow \
+etc/gshadow.new \
+etc/ld.so.conf"
+
+#######################################################################
+
+# include 'hidden' files/dirs in * wildcard expansion.
+shopt -s dotglob
+
+dir_ok() {
+	[ -d "$1" ] && \
+		[ "$( stat -c '%A %U %G' "$1" )" = "drwxr-xr-x root root" ]
+}
+
+dir_empty() {
+	[ "$( find "$1" -mindepth 1 -maxdepth 1 )" = "" ]
+}
+
+warn_badperms() {
+	warn "bad permissions/owner (should be 0755 root:root): $1"
+}
+
+for i in *; do
+	if [ ! -d "$i" ]; then
+		warn "package root dir contains non-directory: $i"
+	elif ! echo "$topleveldirs" | grep -q "\\<$i\\>"; then
+		warn "package root dir contains non-standard directory: $i"
+	elif ! dir_ok "$i"; then
+		warn_badperms "$i"
+	elif dir_empty "$i"; then
+		warn "package contains empty top-level directory: $i"
+	fi
+done
+
+for i in $requireddirs; do
+	if [ ! -d "$i" ]; then
+		warn "missing required directory: $i"
+	elif ! dir_ok "$i"; then
+		warn_badperms "$i"
+	fi
+done
+
+for i in $baddirs; do
+	if [ -d "$i" ]; then
+		warn "forbidden directory exists: $i"
+	elif [ -e "$i" ]; then
+		warn "forbidden directory exists as a non-directory: $i"
+	fi
+done
+
+for i in $fileonlydirs; do
+	[ -d "$i" ] || continue
+	dir_ok "$i" || warn_badperms "$i"
+	badstuff="$( find -L "$i" -mindepth 1 -maxdepth 1 \! -type f )"
+	[ -n "$badstuff" ] && warn "$i should only contain files, not:" && ls -ld $badstuff
+done
+
+for i in $nofiledirs; do
+	[ -d "$i" ] || continue
+	dir_ok "$i" || warn_badperms "$i"
+	badstuff="$( find -L "$i" -mindepth 1 -maxdepth 1 \! -type d )"
+	[ -n "$badstuff" ] && warn "$i should only contain directories, not:" && ls -ld $badstuff
+done
+
+for i in $requiredfiles; do
+	[ -f "$i" ] || warn "missing required file: $i"
+done
+
+for i in $noexecdirs; do
+	[ -d "$i" ] || continue
+	found="$( find "$i" -type f -a -perm /0111 )"
+	if [ -n "$found" ]; then
+		warn "$i should not contain files with executable permission:"
+		ls -l $found
+	fi
+done
+
+for i in $badfiles; do
+	[ -e "$i" ] && warn "forbidden file: $i"
+done
+
+badlinks="$( find -L . -type l )"
+[ -n "$badlinks" ] && for i in $badlinks; do
+	target="$( readlink "$i" )"
+	case "$target" in
+		/*) abslinks+="$i " ;;
+		*) brokenlinks+="$i " ;;
+	esac
+done
+
+[ -n "$abslinks" ] && warn "package contains absolute symlinks (should be relative):" && ls -ld $abslinks
+[ -n "$brokenlinks" ] && warn "package contains broken symlinks:" && ls -ld $brokenlinks
+
diff --git a/sbopkglint.d/10-docs.t.sh b/sbopkglint.d/10-docs.t.sh
new file mode 100644
index 0000000..e1bb8d8
--- /dev/null
+++ b/sbopkglint.d/10-docs.t.sh
@@ -0,0 +1,40 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+########################################################################
+# checks file permissions and ownership in the package doc dir. files
+# should all be mode 644, directories should be 755. everything should
+# be owned by root:root. also checks for empty files or (possibly)
+# install instructions.
+
+
+# ideally, we'd require all files under the doc dir to be mode 0644.
+# however, too many existing packages (including core Slackware ones)
+# break that rule. so check for the minimum set of desired permissions:
+# a doc file should be readable by all users (at least 444).
+
+DOCDIR=usr/doc/$PRGNAM-$VERSION
+
+# existence of the doc dir was already checked by a previous test,
+# so just don't do anything if it's missing.
+
+if [ -d "$DOCDIR" ]; then
+	badpermfiles="$( find $DOCDIR -mindepth 1 -type f -a \! -perm -444 )"
+	 badpermdirs="$( find $DOCDIR -mindepth 1 -type d -a \! -perm 0755 )"
+	   badowners="$( find $DOCDIR -mindepth 1 -user root -a -group root -o -print )"
+	       empty="$( find $DOCDIR -mindepth 1 -empty )"
+	       bogus="$( find $DOCDIR -mindepth 1 -maxdepth 1 -type f -a \( -name INSTALL -o -name INSTALL.\* \) )"
+
+	[ -n "$badpermfiles" ] && warn "bad file perms (should be 644, or at least 444) in doc dir:" && ls -l $badpermfiles
+	[ -n "$badpermdirs"  ] && warn "bad directory perms (should be 755) in doc dir:" && ls -ld $badpermdirs
+	[ -n "$badowners"  ]   && warn "bad ownership (should be root:root) in doc dir:" && ls -ld $badowners
+	[ -n "$empty"      ]   && warn "empty files/dirs in doc dir: $empty"
+	[ -n "$bogus"      ]   && [ -z "$INSTALL_DOCS_OK" ] && warn "useless-looking install instructions in doc dir: $bogus"
+fi
+
+baddocs="$( find usr/doc -mindepth 1 -maxdepth 1 \! -name $PRGNAM-$VERSION )"
+[ -n "$baddocs" ]  && warn "docs outside of $DOCDIR:" && ls -ld $baddocs
diff --git a/sbopkglint.d/15-noarch.t.sh b/sbopkglint.d/15-noarch.t.sh
new file mode 100644
index 0000000..55c17f6
--- /dev/null
+++ b/sbopkglint.d/15-noarch.t.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+########################################################################
+# makes sure "noarch" packages really are noarch.
+
+if [ "$ARCH" = "noarch" ]; then
+	elfbins="$( find * -type f -print0 | xargs -0 file -m /etc/file/magic/elf | grep ELF | cut -d: -f1 )"
+	[ -n "$elfbins" ] && warn "package claims to be noarch, but contains ELF binaries:" && ls -l $elfbins
+fi
diff --git a/sbopkglint.d/20-arch.t.sh b/sbopkglint.d/20-arch.t.sh
new file mode 100644
index 0000000..81a91a4
--- /dev/null
+++ b/sbopkglint.d/20-arch.t.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+########################################################################
+# for noarch packages, do nothing.
+# for everything else, make sure any ELF binaries/libraries match the
+# ARCH, and that libs are in the correct directory (lib vs. lib64).
+
+# warnings:
+# if an i?86 package has any 64-bit ELF objects (libs or bins)
+# if an x86_64 package has any 32-bit ELF objects (libs or bins)
+# if an i?86 package has lib64 or usr/lib64 at all
+# if an x86_64 package has 64-bit libs in lib or usr/lib
+
+# note: sometimes files in /lib/firmware are ELF, and would cause
+# false "wrong directory" warnings, so we exclude that dir from the
+# search.
+
+case "$ARCH" in
+	noarch) ;; # ok, do nothing.
+	i?86) WRONGDIR="lib64"; CPU="80386" ;;
+	x86_64) WRONGDIR="lib"; CPU="x86-64" ;;
+	*) warn "ARCH isn't noarch, i?86, or x86_64. don't know how to check binaries." ;;
+esac
+
+INWRONGDIR=""
+WRONGARCH=""
+NOTSTRIPPED=""
+if [ -n "$WRONGDIR" ]; then
+	find * -type f -print0 | \
+		xargs -0 file -m /etc/file/magic/elf | \
+		grep 'ELF.*\(executable\|shared object\)' > .tmp.$$
+
+		while read line; do
+			file="$( echo $line | cut -d: -f1 )"
+			filetype="$( echo $line | cut -d: -f2 )"
+			case "$file" in
+				lib/firmware/*) continue ;;
+				$WRONGDIR/*|usr/$WRONGDIR/*)
+					INWRONGDIR+="$file " ;;
+			esac
+
+			# 64-bit packages can contain 2 types of 32-bit binaries:
+			# - statically linked.
+			# - statified. very few of these exist, and we can't make
+			#   them on 15.0 (statifier can't handle modern kernel/glibc
+			#   and the author hasn't updated it).
+			if [ "$ARCH" = "x86_64" ]; then
+				echo "$filetype" | grep -q 'statically linked' && continue
+				grep -q DL_RO_DYN_TEMP_CNT "$file" && continue
+			fi
+
+			if ! echo "$filetype" | grep -q "$CPU"; then
+				WRONGARCH+="$file "
+			fi
+			if echo "$filetype" | grep -q "not stripped"; then
+				NOTSTRIPPED+="$file "
+			fi
+		done < .tmp.$$
+		rm -f .tmp.$$
+fi
+
+[ -n "$INWRONGDIR" ] && warn "shared lib(s) in wrong dir for ARCH:" && ls -l $INWRONGDIR
+[ -n "$WRONGARCH" ] && warn "ELF object(s) with wrong arch (should be $CPU):" && ls -l $WRONGARCH
+[ -n "$NOTSTRIPPED" ] && warn "ELF object(s) not stripped:" && ls -l $NOTSTRIPPED
diff --git a/sbopkglint.d/25-lafiles.t.sh b/sbopkglint.d/25-lafiles.t.sh
new file mode 100644
index 0000000..d4c56f7
--- /dev/null
+++ b/sbopkglint.d/25-lafiles.t.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+########################################################################
+# check for .la files, according to the Slackware 15.0 guidelines.
+# they're not allowed directly in /lib /lib64 /usr/lib /usr/lib64, but
+# they're OK in subdirectories (e.g. /usr/lib64/appname/plugins/foo.la).
+
+for i in lib lib64 usr/lib usr/lib64; do
+	[ -d "$i" ] || continue
+	found="$( find $i -maxdepth 1 -name '*.la' )"
+	[ -n "$found" ] && LAFILES+="$found "
+done
+
+if [ -n "$LAFILES" ]; then
+	warn "package contains .la files:"
+	ls -l $LAFILES
+fi
diff --git a/sbopkglint.d/30-manpages.t.sh b/sbopkglint.d/30-manpages.t.sh
new file mode 100644
index 0000000..e0978b3
--- /dev/null
+++ b/sbopkglint.d/30-manpages.t.sh
@@ -0,0 +1,110 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+#######################################################################
+# if the package contains the usr/man dir, make sure that:
+# all the dirs match usr/man/man[1-9n] or usr/man/<locale>/man[1-9n].
+# all the files under /usr/man are gzipped and end in <section>.gz.
+# all the files under /usr/man have mode 0644. executable man pages
+# don't make sense, and man pages that aren't world-readable are
+# annoying and wrong.
+# all the filenames match the sections (e.g. usr/man/man1/foo.1.gz
+# matches, usr/man/man1/bar.2.gz doesn't).
+# all the gzipped files look like they contain *roff.
+
+BADPERMS=""
+BADDIRPERMS=""
+BADDIRS=""
+BADNAMES=""
+NOTGZIPPED=""
+NONTROFF=""
+WRONGSECT=""
+
+check_gzipped_page() {
+	local f="$1"
+	local d="$( dirname $f )"
+	local s="$( stat -c '%a %U %G' "$f" )"
+
+	if [ "$s" = "444 root root" ]; then
+		: # we could warn here someday
+	elif [ "$s" != "644 root root" ]; then
+		BADPERMS+="$f "
+	fi
+
+	if [ "$( file -L -b --mime-type "$f" )" != "application/gzip" ]; then
+		NOTGZIPPED+="$f "
+	fi
+
+	# I have ~42,000 man pages on my dev box, file(1) fails to identify
+	# 12 of them as troff, but adding the check for .T catches them all.
+	if [ "$( file -z -m /etc/file/magic/troff -L -b --mime-type "$f" )" != "text/troff" ]; then
+		if ! zgrep -q '^\.T' "$f"; then
+			NONTROFF+="$f "
+		fi
+	fi
+
+	# checking the section is tricky because e.g. /usr/man/man1 may contain
+	# files with with names like .1.gz, .1x.gz, .1.pm.gz.
+
+	# if the section in the directory name is bad, don't complain here, it
+	# was already reported.
+	dir_s="$( echo "$d" | sed -n 's,.*man\([0-9n]\)$,\1,p' )"
+	if [ "$dir_s" = "" ]; then
+		return
+	fi
+
+	s="$( basename "$f" | sed -n 's,.*\.\([0-9n]\)[^.]*\.gz,\1,p' )"
+	if [ "$s" = "" ]; then
+		BADNAMES+="$f "
+	elif [ "$s" != "$dir_s" ]; then
+		WRONGSECT+="$f "
+	fi
+}
+
+# called for paths like /usr/man/de. right now, it accepts names like
+# xx_XX or xx.UTF-8, or actually anything whose first 2 characters match
+# one of the dirs in /usr/share/locale. could use some refining. I don't
+# even know if the *.UTF-8 or *.ISO8859-1 dirs get searched by man-db.
+# Note that slackware's own libcdio-paranoia install man pages in
+# /usr/man/jp, which is invalid.
+check_locale_dir() {
+	l="$( echo "$1" | sed 's,^.*/\(..\).*$,\1,' )"
+	[ -e /usr/share/locale/"$l" ] || warn "bad locale dir in /usr/man: $l"
+}
+
+if [ -d usr/man ]; then
+	find usr/man -type f > .manpages.$$
+	find usr/man -mindepth 1 -type d > .mandirs.$$
+
+	while read d; do
+		case "$d" in
+			usr/man/man[1-9n]|usr/man/*/man[1-9n])
+				[ "$( stat -c '%a %U %G' "$d" )" != "755 root root" ] && BADDIRPERMS+="$d "
+				;;
+			usr/man/??*) check_locale_dir "$d" ;;
+			*) BADDIRS+="$d " ;;
+		esac
+	done < .mandirs.$$
+
+	while read f; do
+		case "$f" in
+			*.gz) check_gzipped_page "$f" ;;
+			*) BADNAMES+="$f " ;;
+		esac
+	done < .manpages.$$
+
+	rm -f .manpages.$$ .mandirs.$$
+
+	[ -n "$BADPERMS" ] && warn "bad man page owner/permissions (should be 0644, root:root)" && ls -ld $BADPERMS
+	[ -n "$BADDIRPERMS" ] && warn "bad man directory owner/permissions (should be 0755, root:root)" && ls -ld $BADDIRPERMS
+	[ -n "$BADDIRS" ] && warn "bad directory names in /usr/man:" && ls -ld $BADDIRS
+	[ -n "$BADNAMES" ] && warn "bad man page names (not *.gz):" && ls -ld $BADNAMES
+	[ -n "$NOTGZIPPED" ] && warn "non-gzip (but named *.gz) man pages:" && ls -ld $NOTGZIPPED
+	[ -n "$NONTROFF" ] && warn "invalid man pages (not troff):" && ls -ld $NONTROFF
+	[ -n "$WRONGSECT" ] && warn "man pages in wrong section:" && ls -ld $WRONGSECT
+fi
+
diff --git a/sbopkglint.d/35-desktop.t.sh b/sbopkglint.d/35-desktop.t.sh
new file mode 100644
index 0000000..9650ef4
--- /dev/null
+++ b/sbopkglint.d/35-desktop.t.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+#######################################################################
+# if the package contains any files in /usr/share/applications/, they
+# must be named *.desktop, must pass desktop-file-validate, and must
+# be mode 644, owner root:root.
+
+BADPERMS=""
+BADDESKTOP=""
+NONDESKTOP=""
+if [ -d usr/share/applications ]; then
+	# doinst.sh creates this, don't check here now that we have a doinst test.
+	#[ -e "usr/share/applications/mimeinfo.cache" ] || warn "doinst.sh is missing update-desktop-database"
+
+	for f in usr/share/applications/*; do
+		[ -e "$f" ] || continue
+
+		[ "$f" = "usr/share/applications/mimeinfo.cache" ] && continue
+
+		[ "$( stat -Lc '%a %U %G' "$f" )" = "644 root root" ] || BADPERMS+="$f "
+		case "$f" in
+			*.desktop) desktop-file-validate "$f" || BADDESKTOP+="$f " ;;
+			*) NONDESKTOP+="$f " ;;
+		esac
+	done
+
+	[ -n "$BADPERMS" ] && warn "bad permissions/owner on .desktop files (should be 0644 root:root):" && ls -ld $BADPERMS
+	[ -n "$BADDESKTOP" ] && warn ".desktop files fail to validate:" && ls -ld $BADDESKTOP
+	[ -n "$NONDESKTOP" ] && warn "unknown file (not .desktop) in desktop dir:" && ls -ld $NONDESKTOP
+fi
diff --git a/sbopkglint.d/40-newconfig.t.sh b/sbopkglint.d/40-newconfig.t.sh
new file mode 100644
index 0000000..ee0aec5
--- /dev/null
+++ b/sbopkglint.d/40-newconfig.t.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree.
+
+#######################################################################
+# check for .new config files. there shouldn't be any, because when
+# sbopkglint installed the package, it ran the doinst.sh, which
+# should have renamed them.
+
+NEWFILES=""
+for f in "$( find -type f -name \*.new )"; do
+	[ -z "$f" ] && continue
+	case "$f" in
+		./usr/doc/*) continue ;;
+	esac
+	NEWFILES+="$f "
+done
+
+[ -n "$NEWFILES" ] && warn "doinst.sh doesn't handle .new config files:" && ls -l $NEWFILES
diff --git a/sbopkglint.d/45-doinst.t.sh b/sbopkglint.d/45-doinst.t.sh
new file mode 100644
index 0000000..ae47c72
--- /dev/null
+++ b/sbopkglint.d/45-doinst.t.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# sbopkglint test, must be sourced by sbopkglint (not run standalone).
+
+# PKG, PRGNAM, VERSION, ARCH are set by sbopkglint. also the current
+# directory is the root of the installed package tree. This test
+# also uses the filename variable.
+
+#######################################################################
+# check the doinst.sh. its job is to generate various files by running
+# e.g. update-desktop-database, which creates a cache file. if the
+# cache file exists, and doinst.sh either doesn't exist, or doesn't
+# contain an update-desktop-database, that's very bad: it means
+# the cache file is actually included in the package. which means,
+# installing such a package would overwrite the user's local cache,
+# breaking his desktop, until he fixes it (either manually or giving
+# up and logging out or rebooting).
+
+doinst=var/lib/pkgtools/scripts/"$( echo $filename | sed 's,\.[^.]*$,,' )"
+
+have_doinst() {
+	[ -e "$doinst" ]
+	return $?
+}
+
+grep_doinst() {
+	have_doinst && grep -q "$@" $doinst
+	return $?
+}
+
+doinst_warn() {
+	local msg="doinst.sh is missing, package needs one, with"
+	have_doinst && msg="doinst.sh exists, but is missing"
+	warn "$msg $@"
+}
+
+doinst_chk_command() {
+	local cmd="$1"
+	grep_doinst "$cmd" || doinst_warn "$cmd"
+}
+
+[ "$( find -L usr/share/icons -type f 2>/dev/null )" != "" ] && \
+	doinst_chk_command "gtk-update-icon-cache"
+
+[ "$( find -L usr/share/applications -type f 2>/dev/null )" != "" ] && \
+	doinst_chk_command "update-desktop-database"
+
+[ "$( find -L usr/share/glib-2.0/schemas -type f 2>/dev/null )" != "" ] && \
+	doinst_chk_command "glib-compile-schemas"
+
+[ "$( find -L usr/share/fonts -type f 2>/dev/null )" != "" ] && \
+	doinst_chk_command "fc-cache"
+