lint: add shellcheck/shfmt rules to AGENTS.md, format compile.sh and pullsrc.sh

2026-09-20 08:03:38 +08:00 · 2026-08-16 11:21:01 +08:00
parent 277ccf7ec4
commit cbb519644d
3 changed files with 205 additions and 178 deletions
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,6 +51,25 @@ docker run --rm -v .:/data elssh:el8
 - `.github/workflows/build-images.yml` — manually triggered (`workflow_dispatch`), builds Docker images for each EL version and pushes to `ghcr.io`.
 - `.github/workflows/build-rpm.yml` — runs on `v*` tags, builds RPMs inside Docker containers and creates a GitHub release.

+## Linting & formatting
+
+All shell scripts (`*.sh`) must pass `shellcheck` and `shfmt` before committing:
+
+```bash
+# Lint (warnings are errors)
+shellcheck -S warning compile.sh pullsrc.sh
+
+# Format check (must produce no diff)
+shfmt -d -i 0 -bn -ci compile.sh pullsrc.sh
+
+# Auto-fix formatting in-place
+shfmt -w -i 0 -bn -ci compile.sh pullsrc.sh
+```
+
+- **shellcheck** `-S warning`: treat warnings as failures; informational/style notes may be suppressed inline with `# shellcheck disable=SCxxxx`.
+- **shfmt** `-i 0 -bn -ci`: tabs for indentation (no extra indent), binary operators (`&&`, `||`, `|`) at start of next line, case body indented.
+- Both tools must exit 0 before any commit touching `*.sh` files.
+
 ## Gitignore

 `*-local*` is gitignored — version-local.env, editor swap files, etc. `*.tar.gz` is gitignored everywhere, including `downloads/`. Generated RPMs go to `output/` (also gitignored).
--- a/compile.sh
+++ b/compile.sh
@@ -11,7 +11,7 @@ trap 'echo -e "Aborted, error $? in command: $BASH_COMMAND"; trap ERR; exit 1' E
 # Set magic variables for current file & dir
 __dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 __file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
-__base="$(basename ${__file} .sh)"
+__base="$(basename "${__file}" .sh)"
 __root="$(cd "$(dirname "${__dir}")" && pwd)" # <-- change this as it depends on your app

 arg1="${1:-}"
@@ -30,14 +30,14 @@ CHECKEXISTS() {
 	fi
 }

-
 GUESS_DIST() {
 	# will not work if rpm cmd not exists
 	if ! type -p rpm >/dev/null; then
 		echo 'unknown' && return 0
 	fi

-    local dist=$(rpm --eval '%{?dist}' | tr -d '.')
+	local dist
+	dist=$(rpm --eval '%{?dist}' | tr -d '.')

 	# fallback to el7
 	[[ $dist == "el9" ]] && dist="el7"
@@ -48,7 +48,8 @@ GUESS_DIST() {

 	[[ -n $dist ]] && echo $dist && return 0

-    local glibcver=$(ldd --version | head -n1 | grep -Eo '[0-9]+' | tr -d '\n')
+	local glibcver
+	glibcver=$(ldd --version | head -n1 | grep -Eo '[0-9]+' | tr -d '\n')

 	# centos 5 uses glibc 2.5
 	[[ $glibcver -eq 25 ]] && echo 'el5' && return 0
@@ -67,12 +68,14 @@ GUESS_DIST() {
 }

 TOPDIR_SELECT() {
-    local DISTVER=$(GUESS_DIST)
+	local DISTVER
+	DISTVER=$(GUESS_DIST)
 	case $DISTVER in
 		el7)
 			rpmtopdir=el7
 			if [[ -z ${WITH_OPENSSL+x} ]]; then
-                local opensslver=$(rpm -q openssl --qf "%{VERSION}" 2>/dev/null | cut -d. -f1)
+				local opensslver
+				opensslver=$(rpm -q openssl --qf "%{VERSION}" 2>/dev/null | cut -d. -f1)
 				[[ $opensslver -ge 3 ]] && WITH_OPENSSL=1 || WITH_OPENSSL=2
 			fi
 			;;
@@ -98,12 +101,14 @@ TOPDIR_SELECT() {

 BUILD_RPM() {

+	# shellcheck disable=SC1091
 	source version.env
+	# shellcheck disable=SC1091
 	[[ -f version-local.env ]] && source version-local.env

-    local SOURCES=( $OPENSSHSRC \
-          $OPENSSLSRC \
-          $ASKPASSSRC \
+	local SOURCES=("$OPENSSHSRC"
+		"$OPENSSLSRC"
+		"$ASKPASSSRC"
 	)
 	# UOS20 build: prefix PKGREL with "uos20." so the resulting RPMs are
 	# distinguishable from the standard build (e.g. PKGREL `1` becomes
@@ -115,39 +120,39 @@ BUILD_RPM() {
 	if [[ ${UOS20:-0} == 1 ]]; then
 		_pkgrel="uos20.${_pkgrel}"
 	fi
-    local RPMBUILDOPTS=( \
-        --define "with_openssl ${WITH_OPENSSL:-2}" \
-        --define "opensslver ${OPENSSLVER}" \
-        --define "opensshver ${OPENSSHVER}" \
-        --define "opensshpkgrel ${_pkgrel}" \
-        --define 'debug_package %{nil}' \
-        --define 'no_gtk2 1' \
-        --define 'skip_gnome_askpass 1' \
-        --define 'skip_x11_askpass 1' \
+	local RPMBUILDOPTS=(
+		--define "with_openssl ${WITH_OPENSSL:-2}"
+		--define "opensslver ${OPENSSLVER}"
+		--define "opensshver ${OPENSSHVER}"
+		--define "opensshpkgrel ${_pkgrel}"
+		--define 'debug_package %{nil}'
+		--define 'no_gtk2 1'
+		--define 'skip_gnome_askpass 1'
+		--define 'skip_x11_askpass 1'
 	)
 	[[ ${UOS20:-0} == 1 ]] && RPMBUILDOPTS+=('--define' 'uos20 1')

 	# EL5 dist fixes
 	if [[ $rpmtopdir == *el5 ]]; then
-        SOURCES+=($PERLSRC)
+		SOURCES+=("$PERLSRC")

 		# Hack: fake the perl src when perl is ready already(docker images)
-        [[ $(perl -e 'print $] >= 5.010 ? 1 : 0') -eq 1 ]] && \
-    	    touch ./downloads/$PERLSRC
+		[[ $(perl -e 'print $] >= 5.010 ? 1 : 0') -eq 1 ]] \
+			&& touch ./downloads/"$PERLSRC"

 		RPMBUILDOPTS+=('--define' "perlver ${PERLVER}" '--define' 'dist .el5')
 		export CC=gcc44
 	fi

 	# add dist variable if not defined
-    [[ $rpmtopdir == *el7 ]] && [[ -z $(rpm --eval '%{?dist}') ]] && \
-         RPMBUILDOPTS+=('--define' "dist .$(rpm -q glibc | rev | cut -d. -f2 | rev)")
+	[[ $rpmtopdir == *el7 ]] && [[ -z $(rpm --eval '%{?dist}') ]] \
+		&& RPMBUILDOPTS+=('--define' "dist .$(rpm -q glibc | rev | cut -d. -f2 | rev)")

 	pushd $rpmtopdir
 	RPMBUILDOPTS+=('--define' "_topdir $PWD")
-    for fn in ${SOURCES[@]}; do
-      CHECKEXISTS $fn && \
-        install -v -m666 $__dir/downloads/$fn ./SOURCES/
+	for fn in "${SOURCES[@]}"; do
+		CHECKEXISTS "$fn" \
+			&& install -v -m666 "$__dir"/downloads/"$fn" ./SOURCES/
 	done

 	if [[ ${M32:-0} != 0 ]]; then
@@ -156,27 +161,26 @@ BUILD_RPM() {
 		export CFLAGS="${CFLAGS:-} -m32" LDFLAGS="${LDFLAGS:-} -m32"
 	fi

-    ${SETARCH:-} \
-    rpmbuild -bb ./SPECS/${SPECFILE:-openssh.spec} "${RPMBUILDOPTS[@]}"
-    
-    if [[ $? -ne 0 ]]; then
+	if ! ${SETARCH:-} rpmbuild -bb ./SPECS/"${SPECFILE:-openssh.spec}" "${RPMBUILDOPTS[@]}"; then
 		echo "Error: rpmbuild failed with exit code $?"
 		exit 1
 	fi

-    mkdir -p $__dir/output
-    find ./RPMS -type f -name '*.rpm' -exec install -v -m644 {} $__dir/output/ \;
+	mkdir -p "$__dir"/output
+	find ./RPMS -type f -name '*.rpm' -exec install -v -m644 {} "$__dir"/output/ \;
 	popd
 }

 LIST_RPMDIR() {
-    local RPMDIR=$__dir/${rpmtopdir}/RPMS/$(rpm --eval '%{_arch}')
-    [[ -d $RPMDIR ]] && echo $RPMDIR
+	local RPMDIR
+	RPMDIR=$__dir/${rpmtopdir}/RPMS/$(rpm --eval '%{_arch}')
+	[[ -d $RPMDIR ]] && echo "$RPMDIR"
 }

 LIST_RPMS() {
-    local RPMDIR=$(LIST_RPMDIR)
-    [[ -d $RPMDIR ]] && find $RPMDIR -type f -name '*.rpm'
+	local RPMDIR
+	RPMDIR=$(LIST_RPMDIR)
+	[[ -d $RPMDIR ]] && find "$RPMDIR" -type f -name '*.rpm'
 }

 # sub cmds
--- a/pullsrc.sh
+++ b/pullsrc.sh
@@ -11,7 +11,7 @@ trap 'echo -e "Aborted, error $? in command: $BASH_COMMAND"; trap ERR; exit 1' E
 # Set magic variables for current file & dir
 __dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 __file="${__dir}/$(basename "${BASH_SOURCE[0]}")"
-__base="$(basename ${__file} .sh)"
+__base="$(basename "${__file}" .sh)"
 __root="$(cd "$(dirname "${__dir}")" && pwd)" # <-- change this as it depends on your app

 arg1="${1:-}"
@@ -20,24 +20,28 @@ arg1="${1:-}"
 # allow command fail:
 # fail_command || true

+# shellcheck disable=SC1091
 source version.env
+# shellcheck disable=SC1091
 [[ -f version-local.env ]] && source version-local.env

 OPENSSHMIR=https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable
 OPENSSLMIR=https://www.openssl.org/source/
+# shellcheck disable=SC2153
 OPENSSLMIR=${GH_PROXY:-}https://github.com/openssl/openssl/releases/download/openssl-${OPENSSLVER}/
 ASKPASSMIR=https://src.fedoraproject.org/repo/pkgs/openssh/x11-ssh-askpass-1.2.4.1.tar.gz/8f2e41f3f7eaa8543a2440454637f3c3
 PERLMIR=https://www.cpan.org/src/5.0

 LATEST_OPENSSH() {
-    curl -s "$OPENSSHMIR/" 2>/dev/null | \
-        grep -o 'openssh-[0-9.]*p[0-9]*\.tar\.gz' | \
-        sed 's/openssh-//; s/\.tar\.gz//' | \
-        sort -Vu | tail -1 || true
+	curl -s "$OPENSSHMIR/" 2>/dev/null \
+		| grep -o 'openssh-[0-9.]*p[0-9]*\.tar\.gz' \
+		| sed 's/openssh-//; s/\.tar\.gz//' \
+		| sort -Vu | tail -1 || true
 }

 if [[ $arg1 == "--latest" ]]; then
 	latest=$(LATEST_OPENSSH)
+	# shellcheck disable=SC2153
 	current="${OPENSSHVER}"
 	echo "Current version: $current"
 	echo "Latest  version: $latest"
@@ -52,25 +56,25 @@ fi
 mkdir -p downloads
 pushd downloads
 if [[ ! -f $OPENSSLSRC && ${DOCKERBUILD:-0} == 0 ]]; then
-  echo "Get:" $OPENSSLMIR/$OPENSSLSRC
-  wget --no-check-certificate $OPENSSLMIR/$OPENSSLSRC || \
-	  echo "!!! Please download $OPENSSLSRC in $PWD by yourself."
+	echo "Get:" "$OPENSSLMIR"/"$OPENSSLSRC"
+	wget --no-check-certificate "$OPENSSLMIR"/"$OPENSSLSRC" \
+		|| echo "!!! Please download $OPENSSLSRC in $PWD by yourself."
 fi

 if [[ ! -f $OPENSSHSRC && ${DOCKERBUILD:-0} == 0 ]]; then
-  echo Get: $OPENSSHMIR/$OPENSSHSRC
-  wget --no-check-certificate $OPENSSHMIR/$OPENSSHSRC || \
-	  echo "!!! Please download $OPENSSHSRC in $PWD by yourself."
+	echo Get: "$OPENSSHMIR"/"$OPENSSHSRC"
+	wget --no-check-certificate "$OPENSSHMIR"/"$OPENSSHSRC" \
+		|| echo "!!! Please download $OPENSSHSRC in $PWD by yourself."
 fi

 if [[ ! -f $ASKPASSSRC && ${DOCKERBUILD:-0} == 0 ]]; then
-  echo Get: $ASKPASSMIR/$ASKPASSSRC
-  wget --no-check-certificate $ASKPASSMIR/$ASKPASSSRC || \
-	  echo "!!! Please download $ASKPASSSRC in $PWD by yourself."
+	echo Get: "$ASKPASSMIR"/"$ASKPASSSRC"
+	wget --no-check-certificate "$ASKPASSMIR"/"$ASKPASSSRC" \
+		|| echo "!!! Please download $ASKPASSSRC in $PWD by yourself."
 fi

-if [[ $($__dir/compile.sh GETEL) == "el5" && ${DOCKERBUILD:-0} == 1 && ! -f $PERLSRC ]]; then
-  echo Get: $PERLMIR/$PERLSRC
-  wget --no-check-certificate $PERLMIR/$PERLSRC || \
-	  echo "!!! Please download $PERLSRC in $PWD by yourself."
+if [[ $("$__dir"/compile.sh GETEL) == "el5" && ${DOCKERBUILD:-0} == 1 && ! -f $PERLSRC ]]; then
+	echo Get: "$PERLMIR"/"$PERLSRC"
+	wget --no-check-certificate "$PERLMIR"/"$PERLSRC" \
+		|| echo "!!! Please download $PERLSRC in $PWD by yourself."
 fi