Fix shellcheck

bin/build-on-aws

@@ -10,7 +10,7 @@ echo "ONE STATE MACHINE TO RULE THEM ALL"
 echo "Runs any subset of build steps for any combination of versions + distros."
 echo
 
-if [ -z "$1" -o "$1" == "--help" ]; then
+if [ -z "$1" ] || [ "$1" == "--help" ]; then
   echo "Usage: $0 [--skip-ec2|--fake-ec2] <versions> <distros> <steps>"
   echo
   echo "Each version will be built for each specified distro that it supports."
@@ -22,6 +22,7 @@ if [ -z "$1" -o "$1" == "--help" ]; then
   echo " --fake-ec2  launched EC2 instances will succeed without doing anything"
   echo
   echo "Available steps:"
+  #shellcheck disable=SC2038
   find "$(dirname "$0")/../" -name activities.py \
     | xargs grep '^class [a-zA-Z]*.Activity.:$' \
     | grep -o ' [a-zA-Z]*'

bin/deploy-lambda

@@ -8,7 +8,7 @@
 
 set -e
 
-ROOT="$(realpath "$(dirname $0)/..")"
+ROOT="$(realpath "$(dirname "$0")/..")"
 
 LAMBDA="$1"
 if [ -z "$LAMBDA" ]; then
@@ -21,17 +21,17 @@ if [ ! -d "$LAMBDA_ROOT" ]; then
   echo "Usage: $0 LAMBDA"
   exit 1
 fi
-cd $LAMBDA_ROOT
+cd "$LAMBDA_ROOT"
 
-INPUTS=index.js
+INPUTS=(index.js)
 if [ -e package.json ]; then
   yarn
   if [ -e .babelrc ]; then
     yarn build
-    INPUTS=build-out/index.js
+    INPUTS+=(build-out/index.js)
   fi
-  INPUTS="$INPUTS node_modules"
+  INPUTS+=(node_modules)
 fi
 rm -f lambda.zip
-zip -r lambda.zip $INPUTS
+zip -r lambda.zip "${INPUTS[@]}"
 aws lambda update-function-code --function-name "$LAMBDA" --zip-file "fileb://$(pwd)/lambda.zip" --publish --region us-west-2

bin/fetch-build-log

@@ -13,7 +13,6 @@ if [ -z "${STREAM}" ]; then
   echo "Usage: $0 LOG_NAME"
   exit 1
 fi
-LIMIT="${2:-100}"
 
 aws logs get-log-events \
   --log-group-name hhvm-binary-package-builds/cloud-init-output.log \

bin/hhvm-tag-and-push

@@ -32,7 +32,7 @@ if [ -z "$VERSION" ]; then
   VERSION="${INFERRED_VERSION}"
   echo "It looks like you want to tag >>> $VERSION <<<"
   echo "Hit ^C to cancel, or enter to continue"
-  read
+  read -r
 elif [ "$VERSION" != "${INFERRED_VERSION}" ]; then
   echo "Requested version ($VERSION) does not match expected ($INFERRED_VERSION)."
   exit 1
@@ -45,15 +45,16 @@ if [ "$(< .git/HEAD)" != "ref: refs/heads/HHVM-$(echo "$VERSION" | cut -f1-2 -d.
 fi
 
 SED=$(if [ "$(uname -s)" == "Darwin" ]; then echo gsed; else echo sed; fi)
-
-NEXT="$(echo "$VERSION" | $SED -E 's/(^.+\.)([0-9]+)$/echo "\1$((\2 + 1))"/e')"
+#shellcheck disable=SC2016
+NEXT="$(echo "$VERSION" | "$SED" -E 's/(^.+\.)([0-9]+)$/echo "\1$((\2 + 1))"/e')"
 
 $SED -i 's/HHVM_VERSION_SUFFIX "-dev"$/HHVM_VERSION_SUFFIX ""/' \
   hphp/runtime/version.h
 git commit hphp/runtime/version.h -m "Releasing $VERSION"
-git tag HHVM-$VERSION
+git tag "HHVM-$VERSION"
 $SED -i 's/HHVM_VERSION_SUFFIX ""$/HHVM_VERSION_SUFFIX "-dev"/' \
   hphp/runtime/version.h
+#shellcheck disable=SC2016
 $SED -i -E 's/^(.+HHVM_VERSION_PATCH )([0-9]+)$/echo "\1$((\2+1))"/e' \
   hphp/runtime/version.h
 git commit hphp/runtime/version.h -m "Targetting $NEXT"

bin/list-build-images

@@ -19,7 +19,7 @@ function dump_builds() {
     --query 'imageDetails[*].[imagePushedAt,imageTags[0]]' \
     --output text \
     | sort -r \
-    | awk '{ print "\t"$1"\t'${IMAGE_NAME}':"$2 }'
+    | awk '{ print "\t"$1"\t'"${IMAGE_NAME}"':"$2 }'
 }
 
 echo "Failed builds:"
@@ -39,6 +39,7 @@ echo "$SUCCEEDED" | grep :backup || true
 
 echo "To use an image:"
 
+#shellcheck disable=SC2016
 echo '  $(aws ecr get-login --no-include-email)'
 echo '  docker pull IMAGE_NAME'
 echo '  docker run -it IMAGE_NAME /bin/bash -l'

bin/make-debianish-package

@@ -9,7 +9,8 @@
 set -ex
 
 export DEBIAN_FRONTEND=noninteractive
-export DEB_BUILD_OPTIONS="parallel=$(egrep -c '^processor' /proc/cpuinfo)"
+DEB_BUILD_OPTIONS="parallel=$(grep -E -c '^processor' /proc/cpuinfo)"
+export DEB_BUILD_OPTIONS
 
 if $IS_NIGHTLY; then
   PKGBASE="hhvm-nightly"
@@ -34,23 +35,23 @@ apt-get clean
 apt-get install -y devscripts equivs
 
 # Source extraction
-cp /var/out/${PKGBASE}-$VERSION.tar.gz ${PKGBASE}_$VERSION.orig.tar.gz
-tar zxf ${PKGBASE}_$VERSION.orig.tar.gz
-cd ${PKGBASE}-$VERSION
-cp -R $DISTRO_ROOT/debian/ debian/
+cp "/var/out/${PKGBASE}-$VERSION.tar.gz" "${PKGBASE}_$VERSION.orig.tar.gz"
+tar zxf "${PKGBASE}_$VERSION.orig.tar.gz"
+cd "${PKGBASE}-$VERSION"
+cp -R "$DISTRO_ROOT/debian/" debian/
 cp -R /opt/hhvm-packaging/skeleton/ debian/skeleton
 
 if ! $IS_NIGHTLY; then
   sed -i '/^Conflicts: hhvm$/d' debian/control
   sed -i 's/hhvm-nightly/hhvm/' debian/control
   sed -i 's/hhvm-nightly/hhvm/' debian/rules
   for file in debian/hhvm-nightly*; do
-    mv "$file" "$(echo $file | sed 's/hhvm-nightly/hhvm/')"
+    mv "$file" "${$file//hhvm-nightly/hhvm}"
   done
 fi
 
 # Add debian changelog entry
-dch --create -v $VERSION-$PKGVER --package ${PKGBASE} --controlmaint --distribution "$DISTRIBUTION" --force-distribution --empty
+dch --create -v "$VERSION-$PKGVER" --package ${PKGBASE} --controlmaint --distribution "$DISTRIBUTION" --force-distribution --empty
 
 # Build debian package that depends on build-depends, and install it
 mk-build-deps
@@ -61,15 +62,18 @@ mv "$BUILD_DEPS_NEW" "$OUT" || rm "$BUILD_DEPS_OLD"
 # Build the actual debian packages
 PREBUILD="$DISTRO_ROOT/make-package.prebuild"
 if [ -x "$PREBUILD" ]; then
+  #shellcheck disable=SC1090
   source $PREBUILD
 fi
 debuild -us -uc
 cd ..
-FILES=$(awk '/^Files:/ { files=1; next } /^[^ ]/ { files=0; next } files==1 { print $NF }' *.changes)
+FILES=$(awk '/^Files:/ { files=1; next } /^[^ ]/ { files=0; next } files==1 { print $NF }' ./*.changes)
 if [ -z "$FILES" ]; then
   echo "Failed to identify neccessary files"
   exit 1
 fi
-cp *.changes $FILES "$OUT"
+# FILES is one-per-line, but SC2086 wants to disable that expansion
+#shellcheck disable=SC2086
+cp ./*.changes $FILES "$OUT"
 set +ex
 echo "Build tree: $TEMP"

bin/make-interactive-container

@@ -6,7 +6,7 @@
 # This source code is licensed under the MIT license found in the
 # LICENSE file in the root directory of this source tree.
 
-ROOT="$(realpath "$(dirname $0)/..")"
+ROOT="$(realpath "$(dirname "$0")/..")"
 OUT="$ROOT/out/"
 NODIST="$ROOT/nodist/"
 DISTRO=${1:-"debian-8-jessie"}

bin/make-multiple-releases-on-azure

@@ -8,8 +8,6 @@
 
 set -e
 
-ROOT="$(realpath "$(dirname $0)/..")"
-
 VERSION=$1
 if [ -z "$VERSION" ]; then
   echo "Usage: $0 [-r|--rebuild REBUILD_NUM] VERSION1 [VERSION2 [VERSION3 ...]]"
@@ -39,7 +37,7 @@ echo "Rebuild number: $REBUILD_NUM"
 echo "Version(s): ${VERSIONS[*]}"
 echo
 
-if ! which az >/dev/null; then
+if ! command -v az >/dev/null; then
   echo "Install 'az' (usually from the 'azure-cli' package) and try again."
   exit 1
 fi

bin/make-source-tarball

@@ -8,7 +8,7 @@
 
 set -ex
 
-ROOT="$(realpath "$(dirname $0)/..")"
+ROOT="$(realpath "$(dirname "$0")/..")"
 if [ "$ROOT" == "/opt/hhvm-packaging" ]; then
   OUT=/var/out
 else
@@ -22,13 +22,15 @@ TAR=${TAR:-tar}
 cd "$TEMPDIR"
 
 if "${IS_AWS:-false}"; then
+  # Intentionally doing unsafe (and potentially multiple) things with this eval
+  #shellcheck disable=SC2046
   eval $(ssh-agent)
   KEYFILE=$(mktemp)
   aws kms decrypt \
     --region us-west-2 \
     --ciphertext-blob "fileb://${ROOT}/aws/staging-repo-key.kms-ciphertext" \
     --query Plaintext --output text \
-    | base64 --decode > $KEYFILE
+    | base64 --decode > "$KEYFILE"
   ssh-add "$KEYFILE"
 
   echo "github.com,192.30.253.113 ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" >> ~/.ssh/known_hosts
@@ -44,9 +46,9 @@ else
   HEAD=HHVM-${VERSION}
 fi
 
-git clone ${REPO} ${PREFIX}-${VERSION}
-cd ${PREFIX}-$VERSION
-git checkout $HEAD
+git clone ${REPO} "${PREFIX}-${VERSION}"
+cd "${PREFIX}-$VERSION"
+git checkout "$HEAD"
 if "${IS_AWS:-false}" && $IS_NIGHTLY; then
   TAG="nightly-${VERSION}"
   # Tag may already exist from previous failed runs.

bin/promote-nightly-to-release

@@ -95,7 +95,7 @@ fi
 NIGHTLY="${POSITIONAL_ARGUMENTS[0]}"
 VERSION="${POSITIONAL_ARGUMENTS[1]}"
 
-if [ -z "$NIGHTLY" -o -z "$VERSION" ]; then
+if [ -z "$NIGHTLY" ] || [ -z "$VERSION" ]; then
   echo "Missing nightly $NIGHTLY or version $VERSION"
   show_help
   exit 1
@@ -171,7 +171,7 @@ fi
 
 SED=$(if [ "$(uname -s)" == "Darwin" ]; then echo gsed; else echo sed; fi)
 
-if ! which "$SED" >/dev/null; then
+if ! command -v "$SED" >/dev/null; then
   echo "'$SED' is required."
   if [ "$SED" == "gsed" ]; then
     echo "Try: brew install gnu-sed"

bin/prune-source-tree

@@ -14,7 +14,7 @@ if [ -z "$1" ] || [ ! -d "$1" ]; then
   exit 1
 fi
 
-pushd "$1"
+pushd "$1" || exit
 
 find . -name .git -print0 | xargs -0 rm -rf
 # ~ 1100mb here
@@ -24,4 +24,4 @@ rm -rf hphp/test/{slow,quick,zend,zend7}
 # ~ 200mb here
 rm -rf third-party/boost/boost/libs/*/{doc,test}
 
-popd
+popd || exit

bin/update-debianish-repo

@@ -5,7 +5,7 @@
 # This source code is licensed under the MIT license found in the
 # LICENSE file in the root directory of this source tree.
 
-if [ "$1" != "debian" -a "$1" != "ubuntu" ]; then
+if [ "$1" != "debian" ] && [ "$1" != "ubuntu" ]; then
   echo "USAGE: $0 debian|ubuntu"
   exit 1
 fi
@@ -38,7 +38,7 @@ for DISTRO_DIR in "$INCOMING_DIR/$DISTRO_BASE-"*; do
   DISTRO="$(<"/opt/hhvm-packaging/$(basename "$DISTRO_DIR")/DISTRIBUTION")"
   (
     cd "$REPO_DIR"
-    for REPREPRO_DISTRO in $(sed "s/DISTRO/$DISTRO/" /opt/hhvm-packaging/DEBIAN_REPOSITORIES); do
+    sed "s/DISTRO/$DISTRO/" /opt/hhvm-packaging/DEBIAN_REPOSITORIES | while read -r REPREPRO_DISTRO; do
       reprepro --keepunreferencedfiles --keepunusednewfiles --ignore=wrongdistribution include "$REPREPRO_DISTRO" "$DISTRO_DIR"/*.changes
     done
   )
@@ -56,5 +56,5 @@ for DISTRO_DIR in "$INCOMING_DIR/$DISTRO_BASE-"*; do
     continue;
   fi
   DISTRO=$(basename "$DISTRO_DIR")
-  aws s3 rm --recursive s3://hhvm-scratch/$VERSION/$DISTRO
+  aws s3 rm --recursive "s3://hhvm-scratch/$VERSION/$DISTRO"
 done