chore: shellcheck fixes

build/build

@@ -7,7 +7,8 @@ main() {
   # Set minimal locale.
   export LC_ALL=C
   # Set source date. This is honored by `asciidoctor` and other tools.
-  export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)
+  SOURCE_DATE_EPOCH="$(git log -1 --pretty=%ct)"
+  export SOURCE_DATE_EPOCH
 
   if ! command -v rad > /dev/null; then
     echo "fatal: rad is not installed" >&2 ; exit 1
@@ -21,7 +22,7 @@ main() {
     echo "fatal: sha256sum is not installed" >&2 ; exit 1
   fi
 
-  rev="$(git rev-parse --short HEAD)"
+  rev="$(git rev-parse HEAD)"
   gitarchive="build/heartwood-$rev.tar.gz"
   keypath="$(rad path)/keys/radicle.pub"
   version="$(build/version)"
@@ -42,38 +43,39 @@ main() {
     --build-arg SOURCE_DATE_EPOCH \
     --build-arg TZ \
     --build-arg LC_ALL \
-    --build-arg RADICLE_VERSION=$version \
+    --build-arg "RADICLE_VERSION=$version" \
-    --build-arg GIT_HEAD=$rev \
+    --build-arg "GIT_HEAD=$rev" \
-    --arch amd64 --tag $image -f ./build/Dockerfile - < $gitarchive
+    --arch amd64 --tag "$image" -f ./build/Dockerfile - < "$gitarchive"
 
   echo "Creating container (radicle-build-container).."
-  podman --cgroup-manager=cgroupfs create --ulimit=host --replace --name radicle-build-container $image
+  podman --cgroup-manager=cgroupfs create --ulimit=host --replace --name radicle-build-container "$image"
 
   # Copy build artifacts to output folder.
   outdir=build/artifacts
   mkdir -p $outdir
   podman cp --overwrite radicle-build-container:/builds/. $outdir/
 
-  for target in $(cat build/TARGETS); do
+  while IFS= read -r target
+  do
     echo "Signing artifacts for $target.."
 
     filename="radicle-$version-$target.tar.xz"
     filepath="$outdir/$filename"
 
     # Output SHA256 digest of archive.
-    checksum="$(cd $outdir && sha256sum $filename)"
+    checksum="$(cd $outdir && sha256sum "$filename")"
     echo "Checksum of $filepath is $(echo "$checksum" | cut -d' ' -f1)"
-    echo "$checksum" > $filepath.sha256
+    echo "$checksum" > "${filepath}.sha256"
 
     # Sign archive and verify archive.
-    rm -f $filepath.sig # Delete existing signature
+    rm -f "${filepath}.sig" # Delete existing signature
-    ssh-keygen -Y sign -n file -f $keypath $filepath
+    ssh-keygen -Y sign -n file -f "$keypath" "$filepath"
-    ssh-keygen -Y check-novalidate -n file -s $filepath.sig < $filepath
+    ssh-keygen -Y check-novalidate -n file -s "$filepath.sig" < "$filepath"
-  done
+  done < build/TARGETS
 
   # Remove build artifacts that aren't needed anymore.
   podman rm radicle-build-container > /dev/null
-  podman rmi --ignore localhost/$image
+  podman rmi --ignore "localhost/$image"
 }
 
 # Run build.

build/release

@@ -23,12 +23,12 @@ main() {
   fi
 
   printf "Releasing Radicle %s? [y/N] " "$version"
-  read confirmation
+  read -r confirmation
 
   case "$confirmation" in
     [Yy]*)
       echo "Creating 'latest' symlink.."
-      ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf /mnt/radicle/files/releases/$version /mnt/radicle/files/releases/latest ;;
+      ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "/mnt/radicle/files/releases/$version" /mnt/radicle/files/releases/latest ;;
     *)
       echo "Operation aborted."
       exit 1 ;;

build/tag

@@ -19,8 +19,8 @@ if [ "$signing_key" != "$(rad self --ssh-key)" ]; then
 fi
 
 printf "\n"
-printf "Tag the above commit with \033[35m$tag\033[0m, using \033[35m$(rad self --did)\033[0m? [y/N] "
+printf "Tag the above commit with \033[35m%s\033[0m, using \033[35m$(rad self --did)\033[0m? [y/N] " "$tag"
-read confirmation
+read -r confirmation
 rad auth
 
 case "$confirmation" in

build/upload

@@ -17,22 +17,23 @@ main() {
   destination="/mnt/radicle/files/releases/$version"
 
   # Create remote folder.
-  ssh -i $SSH_KEY $SSH_ADDRESS mkdir -p $destination
+  ssh -i "$SSH_KEY" "$SSH_ADDRESS" mkdir -p "$destination"
   # Copy files over.
-  scp -i $SSH_KEY build/artifacts/radicle-$version* $SSH_ADDRESS:$destination
+  scp -i "$SSH_KEY" "build/artifacts/radicle-$version"* "$SSH_ADDRESS:$destination"
-  scp -i $SSH_KEY build/artifacts/radicle.json $SSH_ADDRESS:$destination
+  scp -i "$SSH_KEY" build/artifacts/radicle.json "$SSH_ADDRESS:$destination"
-  scp -i $SSH_KEY build/heartwood-$version.tar.gz $SSH_ADDRESS:$destination
+  scp -i "$SSH_KEY" "build/heartwood-$version.tar.gz" "$SSH_ADDRESS:$destination"
 
-  for target in $(cat build/TARGETS); do
+  while IFS= read -r target
+  do
     archive=$destination/radicle-$version-$target.tar.xz
     symlink=$destination/radicle-$target.tar.xz
 
     echo "Creating symlinks for $target.."
 
-    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive $symlink
+    ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "$archive" "$symlink"
-    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive.sig $symlink.sig
+    ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "$archive.sig" "$symlink.sig"
-    ssh -i $SSH_KEY $SSH_ADDRESS ln -snf $archive.sha256 $symlink.sha256
+    ssh -i "$SSH_KEY" "$SSH_ADDRESS" ln -snf "$archive.sha256" "$symlink.sha256"
-  done
+  done < build/TARGETS
 
   # TODO(cloudhead): Don't pass `--tags` when we have canonical refs.
   echo "Pushing tags.."

build/version

@@ -6,4 +6,4 @@ fi
 # Remove `v` prefix from version.
 version=${version#v}
 
-echo $version
+echo "$version"

debian/build-deb

@@ -10,6 +10,7 @@ name="$(dpkg-parsechangelog -SSource)"
 version="$(dpkg-parsechangelog -SVersion)"
 
 # Get upstream version: everything before the last dash.
+# shellcheck disable=SC2001
 uv="$(echo "$version" | sed 's/-[^-]*$//')"
 orig="${name}_${uv}.orig.tar.xz"
 

scripts/changelog

@@ -24,7 +24,7 @@ done
 
 # Current/latest tag.
 current=$(git describe --tags --match='v*' --abbrev=0)
-version=$(echo $current | sed 's/^v//')
+version=$(echo "$current" | sed 's/^v//')
 
 if [ -z "$from" ]; then
   previous="$(git describe --abbrev=0 HEAD^)"
@@ -53,14 +53,16 @@ echo "* This update is recommended for everyone. No manual intervention is requi
 echo
 echo "## Changelog"
 
-ncommits=$(git rev-list --count $previous..$current)
+range="${previous}..${current}"
-ncontribs=$(git log $previous..$current --format='%ae' | sort -u | wc -l)
+ncommits=$(git rev-list --count "$range")
+ncontribs=$(git log "$range" --format='%ae' | sort -u | wc -l)
 
 echo
 echo "This release contains $ncommits commit(s) by $ncontribs contributor(s)."
 echo
 
-git log --pretty=format:'* `%h` **%s** *<%ae>*' $previous..$current
+# shellcheck disable=SC2016
+git log --pretty=format:'* `%h` **%s** *<%ae>*' "$range"
 
 echo
 echo "## Checksums"

scripts/clear-refs-db.sh

@@ -5,8 +5,8 @@ DB="$(rad path)/node/node.db"
 
 if command -v sqlite3 >/dev/null 2>&1; then
   if [ -f "$DB" ]; then
-    echo -n "Clearing 'refs' table from $DB.. "
+    printf "Clearing 'refs' table from %s.. " "$DB"
-    sqlite3 $DB "DELETE FROM refs;"
+    sqlite3 "$DB" "DELETE FROM refs;"
     echo "done."
   else
     echo "fatal: database file does not exist"

scripts/create-env.sh

@@ -6,12 +6,12 @@ unset SSH_AGENT_PID
 
 tmp="$(mktemp -d)"
 
-export RAD_HOME=$tmp/.radicle
+export RAD_HOME="$tmp/.radicle"
 export RAD_PASSPHRASE=
 
 set -x
-mkdir $tmp/acme
+mkdir "$tmp/acme"
-cd $tmp/acme
+cd "$tmp/acme"
 echo "ACME" > README
 echo "Copyright (c) 1978-1986 ACME Corp." > COPY
 

scripts/delete-remote-branches.sh

@@ -20,7 +20,7 @@ for branch in $(git branch -r --format "%(refname:short)"); do
   # Extract the branch name without the "$remote/" prefix.
   branch=${branch#"$remote/"}
   # Never delete the master branch.
-  if [ "$branch" == "master" ]; then
+  if [ "$branch" = "master" ]; then
     continue
   fi
 

scripts/delete-remote-refs.sh

@@ -16,14 +16,14 @@ if [ "$REMOTE" = "$(rad self --nid)" ]; then
   exit 1
 fi
 
-cd $RAD_HOME/storage/$REPO
+cd "$RAD_HOME/storage/$REPO"
 
 refs=$(git for-each-ref --format="%(refname)")
 pattern="refs/namespaces/$2/refs/*"
 
 for ref in $refs; do
   case "$ref" in
-    $pattern)
+    "$pattern" )
       git update-ref -d "$ref"
       printf 'Deleted %s\n' "$ref"
       ;;

scripts/import-issue.sh

@@ -25,9 +25,12 @@ if ! command -v sed > /dev/null; then
 fi
 
 function removeImgTags {
-  local html="$(cat)"
+  local html
-  local imgTags="$(echo "$html" | pcregrep -M '<img [^>]*>')"
+  html="$(cat)"
+  local imgTags
+  imgTags="$(echo "$html" | pcregrep -M '<img [^>]*>')"
 
+  # shellcheck disable=SC2066
   for imgTag in "$imgTags"; do
     html="$(echo "$html" | sed -z "s@$imgTag@@")"
   done

scripts/patch-rebase.sh

@@ -6,7 +6,7 @@ if [ "$#" -lt 1 ]; then
   exit 1
 fi
 
-rad patch checkout $1
+rad patch checkout "$1"
 git rebase master --autosquash
-rad patch update $1 --message "Rebased on master"
+rad patch update "$1" --message "Rebased on master"
 git checkout master

scripts/show-sigrefs.sh

@@ -7,16 +7,18 @@ if [ "$#" -lt 2 ]; then
 fi
 
 RAD_HOME=${RAD_HOME:-"$HOME/.radicle"}
+# shellcheck disable=SC2001
 REPO=$(echo "$1" | sed 's/^rad://')
 REMOTE=$2
 
-cd $RAD_HOME/storage/$REPO
+cd "$RAD_HOME/storage/$REPO"
 
 sigrefs=$(git rev-parse "refs/namespaces/$REMOTE/refs/rad/sigrefs")
 signed=$(git show "$sigrefs:refs")
 actual=$(git for-each-ref "refs/namespaces/$REMOTE/refs/**" --format="%(objectname) %(refname)")
 
 # Strip namespace prefix.
+# shellcheck disable=SC2001
 actual=$(echo "$actual" | sed "s@refs/namespaces/$REMOTE/@@")
 # Remove `sigrefs` itself.
 actual=$(echo "$actual" | grep -v "refs/rad/sigrefs$")