Add man page groff warning test

The manual page sources were not covered by make check, so groff syntax regressions could land unnoticed. Two existing pages already emitted warnings: one used an undefined lowercase .b macro and another used a font escape that groff could not select through man.

The fix adds a doc/check-manpages.sh Automake test that renders every local man page source with man --warnings under a stable UTF-8 locale and treats any formatter stderr as a failure. The existing warnings were fixed by using the proper .B macro and normal man-page bold formatting for the command example.

The new test is run from the doc make check target and also covers the optional fapolicyd-perf-test.8 source by including it in the distributed doc files.

Author: stevegrubb

doc/Makefile.am

@@ -20,7 +20,11 @@
 #   Steve Grubb <sgrubb@redhat.com>
 #
 
-EXTRA_DIST = $(man_MANS)
+EXTRA_DIST = $(man_MANS) fapolicyd-perf-test.8 check-manpages.sh
+
+TEST_EXTENSIONS = .sh
+SH_LOG_COMPILER = $(SHELL)
+TESTS = check-manpages.sh
 
 man_MANS = \
 	fapolicyd.8 \

doc/check-manpages.sh

@@ -0,0 +1,68 @@
+#!/bin/sh
+#
+# Check every manual page source in this directory with groff warnings enabled.
+# man exits successfully for formatter warnings, so stderr is treated as a
+# test failure.
+
+set -u
+
+: "${MAN:=man}"
+: "${srcdir:=.}"
+
+if test "$srcdir" = "."; then
+	case "$0" in
+	*/*)
+		srcdir=${0%/*}
+		;;
+	esac
+fi
+
+if ! command -v "$MAN" >/dev/null 2>&1; then
+	echo "SKIP: man command not found"
+	exit 77
+fi
+
+if command -v locale >/dev/null 2>&1; then
+	if ! LC_ALL=C.UTF-8 locale charmap >/dev/null 2>&1; then
+		echo "SKIP: C.UTF-8 locale not available"
+		exit 77
+	fi
+fi
+
+if ! "$MAN" --help 2>&1 | grep -- "--warnings" >/dev/null 2>&1; then
+	echo "SKIP: man command does not support --warnings"
+	exit 77
+fi
+
+failed=0
+found=0
+
+for page in "$srcdir"/*.[0-9]; do
+	test -e "$page" || continue
+	found=1
+
+	output=$(
+		LC_ALL=C.UTF-8 MANROFFSEQ='' MANWIDTH=80 \
+			"$MAN" --warnings -E UTF-8 -l -Tutf8 -Z "$page" \
+			2>&1 >/dev/null
+	)
+	status=$?
+
+	if test $status -ne 0 || test -n "$output"; then
+		failed=1
+		echo "$page:"
+		if test -n "$output"; then
+			printf '%s\n' "$output"
+		fi
+		if test $status -ne 0; then
+			echo "man exited with status $status"
+		fi
+	fi
+done
+
+if test $found -eq 0; then
+	echo "No manual pages found"
+	exit 1
+fi
+
+exit $failed

doc/fapolicyd.conf.5

@@ -225,9 +225,7 @@ Ensure each mount is truly \fIdata\-only\fR and is mounted with \fBnoexec\fR.
 .IP \[bu]
 Run the advisory check:
 .nf
-\f[C]
-fapolicyd-cli --check-ignore_mounts[=MOUNT]
-\f[R]
+.B fapolicyd-cli \-\-check-ignore_mounts[=MOUNT]
 .fi
 to verify the mount exists, confirm \fBnoexec\fR, and scan for executable
 regular files, ELF/shared objects, archives/JARs/ZIPs, bytecode caches,

doc/fapolicyd.rules.5

@@ -157,7 +157,7 @@ Set is a named group of values of the same type. Fapolicyd internally distinguis
 .SS SETS EXAMPLES
 .nf
 .B # definition
-.b # string set
+.B # string set
 .B %python=/usr/bin/python2.7,/usr/bin/python3.6
 .B allow exe=%python : all trust=1
 .B #