shellcheck, better automated upgrades

diff --git a/.gitconfig b/.gitconfig
index 186dac41f0b3da86b764880bb9414b6085c007de..89d01716ccd0afc9a8ce190af0379d57a6e67c7e 100644 (file)
--- a/.gitconfig
+++ b/.gitconfig
@@ -27,7 +27,8 @@ helper = cache
 ignoreSubmodules = dirty
 tool = meld
 # gitinspector complained
-renamelimit = 5000
+#renamelimit = 5000
+renames = copy
 
 [gitreview]
 username = iank

diff --git a/brc b/brc
index 1d6e833471c67ee4eb472a2f24957d215504aeb3..55efac12039265d516bcac23b0ee91b756b2a289 100644 (file)
--- a/brc
+++ b/brc
@@ -26,9 +26,7 @@ unalias -a
 shopt -s extglob
 # include .files when globbing, but ignore files name . and ..
 # setting this also sets dotglob.
-# Note, this doesnt work in bash 4.4 anymore, for paths with
-# more than 1 directory, like a/b/.foo, since * is fixed to not match /
-export GLOBIGNORE=*/.:*/..
+export GLOBIGNORE="*/.:*/.."
 
 # broken with bash_completion package. Saw a bug for this once. dont anymore.
 # still broken in wheezy
@@ -1637,12 +1635,17 @@ sgo() { # service go
   fi
 }
 
+sgu() {
+  systemctl list-unit-files | rg "$@"
+}
 
-shellck() {
+sk() {
   # 2086 = unquoted $var
   # 2046 = unquoted $(cmd)
+  # 2068: Double quote array expansions to avoid re-splitting elements.
   # i had -x as an arg, but debian testing(stretch) doesn\'t support it
-  shellcheck -e 2086,2046,2068,2006,2119 "$@"
+  shellcheck -x -e 2086,2046,2068 "$@"
+  # had this before. not sure what it is 2119
 }
 
 skaraoke() {

diff --git a/btrbk-run b/btrbk-run
index 7dad03a5c270284b455397c1c76726d2786ce3ed..48550db1a4b2793418501cbfa32a1b234d538994 100644 (file)
--- a/btrbk-run
+++ b/btrbk-run
@@ -17,7 +17,7 @@
 # todo: if we cancel in the middle of a btrfs send, then run again immediately, the received subvolume doesn't get a Received UUID: field, and we won't mount it. Need to figure out a solution that will fix this.
 
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 source /usr/local/lib/err
 

diff --git a/btrfsmaint b/btrfsmaint
index 22cd4c695e23e37d675e96ae1817740833a6294c..c410b7b3503359309ab6938f5c233f7193cd6a3e 100755 (executable)
--- a/btrfsmaint
+++ b/btrfsmaint
@@ -84,7 +84,7 @@ for x in $($fnd --output "SOURCE" --nofsroot | sort -u); do
         # the wiki recommends 30 days or so, but
         # it makes the comp lag like shit for a day,
         # so I'm going with 90 days.
-        if (( $date > `date +%s` - 60*60*24*30 )); then
+        if (( date > $(date +%s) - 60*60*24*30 )); then
             echo "cron: skiping scrub of $mnt"
             continue
         fi

diff --git a/certbot-renew-hook b/certbot-renew-hook
index 70aa41893f38f4991cd5fea659e50aabc99ab623..9725594f814955f9762fe533b8269844dd060b46 100755 (executable)
--- a/certbot-renew-hook
+++ b/certbot-renew-hook
@@ -26,7 +26,7 @@ for ((i=0; i<${#domain_user[@]}; i+=2)); do
     user=${domain_user[i+1]}
 
     d=/etc/letsencrypt/live/$domain
-    if [[ $RENEWED_LINEAGE == $d ]]; then
+    if [[ $RENEWED_LINEAGE == "$d" ]]; then
         install -m 640 -g $user $d/{privkey.pem,fullchain.pem} $(eval echo ~$user)
         exit 0
     fi

diff --git a/check-subvol-stale b/check-subvol-stale
index 8d9ac786c6b71644df4708f58b2f88f112caf692..07926ef49e3af16535a2d62c915f37cd88552426 100644 (file)
--- a/check-subvol-stale
+++ b/check-subvol-stale
@@ -14,7 +14,7 @@
 # limitations under the License.
 
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
@@ -57,7 +57,7 @@ while true; do
   esac
 done
 
-if [[ ! $@ ]]; then
+if [[ ! $1 ]]; then
   echo "$0: error: expected mountpoint argument"
 fi
 
@@ -104,7 +104,7 @@ for d; do
   d "svp=$svp # subvolume path"
 
   snaps=($root_dir/btrbk/$subvol_dir.20*) # Assumes we are in the 21st century.
-  if [[ ! ${snaps[@]} ]]; then
+  if [[ ! ${snaps[*]} ]]; then
     # no snapshots yet
     echo "$0: warning: no snapshots found at $root_dir/btrbk/$subvol_dir.20*. this is expected for a brand new volume"
     continue

diff --git a/conflink b/conflink
index 5f38a596ab113943664db9dbc3805489704acfe6..bb5d480d4ee04d7c235ba25fd7dff78dfa70374e 100755 (executable)
--- a/conflink
+++ b/conflink
@@ -26,12 +26,14 @@ subdir-link-r() {
     targets=( "$2"/!(.git|..|.) )
   else
     for f in "$1"/!(.git|..|.); do
-      [[ -d $f ]] && targets+=("$f") ||:
+      if [[ -d $f ]]; then targets+=("$f"); fi
     done
   fi
-  local below="$( readlink -f "$root/..")"
+  local below
+  below="$( readlink -f "$root/..")"
   for path in "${targets[@]}"; do
-    local fullpath="$(readlink -f "$path")"
+    local fullpath
+    fullpath="$(readlink -f "$path")"
     #e $fullpath $below # debug
     if [[ -f $path || $(dirname $(readlink -f "$fullpath")) == "$below" ]]; then
       m lnf -T "$path" "$HOME/${path#$root/}"
@@ -44,7 +46,7 @@ subdir-link-r() {
 
 
 common-file-setup() {
-  local dir fs x bdir f dst
+  local dir fs x f
   for dir in "$@"; do
     fs=$dir/filesystem
     if [[ -e $fs && $user =~ ^iank?$ ]]; then
@@ -77,7 +79,7 @@ case $user in
            /p/c/filesystem/etc/openvpn/easy-rsa/keys/*.key
            /p/c/machine_specific/kw/filesystem/etc/openvpn/client/*.key
           )
-    if [[ -e $files ]]; then
+    if [[ -e ${files[0]} ]]; then
       chmod 600 ${files[@]}
     fi
     # p needs to go first so .ssh link is created, then config link inside it
@@ -113,7 +115,7 @@ case $user in
 
     sudo bash -c 'shopt -s nullglob; cd /etc/openvpn; for f in client/* server/*; do ln -sf $f .; done'
 
-    m sudo -H -u user2 "$BASH_SOURCE"
+    m sudo -H -u user2 "${BASH_SOURCE[0]}"
     ;;
   user2)
     m common-file-setup ${c_dirs[@]}

diff --git a/demohost-mount b/demohost-mount
index 8dc062012b4cd45d63eb2c22563cb0c30c2d7a90..706a516540d6d9f4b39946fb195229d4c08463b3 100755 (executable)
--- a/demohost-mount
+++ b/demohost-mount
@@ -3,7 +3,7 @@ set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 
 

diff --git a/desktop-20-autostart.sh b/desktop-20-autostart.sh
index 842dab48bc37a4450f7a7c94a7ce0fef289ecce5..03be1c58356cb5c0d063977214a6b8bc2c871560 100755 (executable)
--- a/desktop-20-autostart.sh
+++ b/desktop-20-autostart.sh
@@ -24,7 +24,7 @@ fi
 
 xout="$(xrandr)"
 xe() { echo "$xout"; }
-x=$(xe | grep -E '^(DisplayPort-[0123]|DVI-0|DP-[1234]|DVI-I-1) connected' | wc -l)
+x=$(xe | grep -Ec '^(DisplayPort-[0123]|DVI-0|DP-[1234]|DVI-I-1) connected')
 if (( x > 2 )); then
     left=$(xe | sed -rn 's/^(DVI[^ ]+) connected .*/\1/p')
     dps=( $(xe | sed -rn 's/^(DP-[01234]|DisplayPort-[01234]) connected .*/\1/p') )

diff --git a/small-backup b/disabled/small-backup
similarity index 100%
rename from small-backup
rename to disabled/small-backup

diff --git a/distro-begin b/distro-begin
index ec39e9d1160a610c10fa07ffd9ece72b38e62410..0601ff4cef1adba21cb558a04c2f7e72b88f0914 100755 (executable)
--- a/distro-begin
+++ b/distro-begin
@@ -65,7 +65,8 @@ fi
 
 
 ##### variables/env setup
-script_dir="$(readlink -f "$BASH_SOURCE")"; script_dir=${script_dir%/*}
+script_dir="$(readlink -f "${BASH_SOURCE[@]}")"; script_dir=${script_dir%/*}
+# shellcheck source=./pkgs
 source $script_dir/pkgs
 set +x
 source /a/bin/distro-functions/src/identify-distros
@@ -138,7 +139,7 @@ EOF
   sudo systemctl start keyscriptoff.service
 
   # from /usr/share/doc/dropbear-initramfs/README.initramfs.gz
-  while read m _; do /sbin/modinfo -F filename "$m"; done </proc/modules | \
+  while read -r m _; do /sbin/modinfo -F filename "$m"; done </proc/modules | \
     sed -nr "s@^/lib/modules/`uname -r`/kernel/drivers/net(/.*)?/([^/]+)\.ko\$@\2@p" \
     | sudo dd of=/etc/initramfs-tools/modules
   sudo apt-get -y install initramfs-tools-core
@@ -448,7 +449,7 @@ if has_btrfs || home_network; then
   pi nfs-common
   s dd of=/root/imount <<'EOF'
 #!/bin/bash
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 for dir in /i /mnt/iroot /k /kr /w; do

diff --git a/distro-end b/distro-end
index 84566b89fa4299468c147d69bd2e60ee97911166..14cc2f52ddca1ff5d0ea158f9d7d55e7734ba47f 100755 (executable)
--- a/distro-end
+++ b/distro-end
@@ -15,8 +15,9 @@
 
 ### setup
 source /a/bin/errhandle/err
-src="$(readlink -f -- "$BASH_SOURCE")"; src=${src%/*} # directory of this file
+src="$(readlink -f -- "${BASH_SOURCE[0]}")"; src=${src%/*} # directory of this file
 
+# shellcheck source=./pkgs
 source $src/pkgs
 
 set -x
@@ -35,6 +36,7 @@ spa() { # simple package add
   simple_packages+=($@)
 }
 distro=$(distro-name)
+codename=$(debian-codename)
 codename_compat=$(debian-codename-compat)
 pending_reboot=false
 sed="sed --follow-symlinks"
@@ -184,15 +186,38 @@ sgo certbotmail.timer
 pi ${p1[@]}
 
 ##### begin automatic upgrades ####
-# this makes it so we upgrade everything
-s debconf-set-selections <<'EOF'
-unattended-upgrades unattended-upgrades/origins_pattern string "codename=${distro_codename}";
+
+s dd of=/etc/apt/apt.conf.d/10periodic <<'EOF'
+# this file was mostly just comments.
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+EOF
+
+s dd of=/etc/apt/apt.conf.d/50unattended-upgrades  <<EOF
+# fyi: default file has comments about available options,
+# you may want to read that.
+Unattended-Upgrade::Mail "root";
+Unattended-Upgrade::MailOnlyOnError "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Origins-Pattern {
+       # default is just security updates.
+       "origin=*";
+};
 EOF
-s dpkg-reconfigure -u -fnoninteractive unattended-upgrades
 
-# Setup daily reboots, so all unattended upgrades go into affect
-# unattended upgrades happen at 6 am + rand(60 min).
-echo '20 7 * * * root /usr/local/bin/zelous-unattended-reboot' | s dd of=/etc/cron.d/unattended-upgrade-reboot
+# Setup reboots when running outdated stuff, unattended upgrades happen
+# at 6 am + rand(60 min).
+/usr/local/bin/log-once checkrestart
+
+# old names, too verbose
+s rm -f /etc/cron.d/unattended-upgrade-reboot /usr/local/bin/zelous-unattended-reboot
+
+s dd of=/etc/cron.d/myupgrade <<'EOF'
+20 7 * * * root /usr/local/bin/myupgrade | /usr/local/bin/log-once -1 myupgrade
+0 * * * * root /usr/local/bin/mycheckrestart | /usr/local/bin/log-once -1 mycheckrestart
+EOF
 ##### end automatic upgrades ####
 
 # office is not exposed to internet yet
@@ -434,7 +459,7 @@ EOF
     # s reboot now
     # when running docker-compose run, kernel stack traces are printed to the journal.
     # things seem to succeed, google says nothing, so ignoring them.
-    curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-`uname -s`-`uname -m` | s dd of=/usr/local/bin/docker-compose
+    curl -L https://github.com/docker/compose/releases/download/1.18.0/docker-compose-$(uname -s)-$(uname -m) | s dd of=/usr/local/bin/docker-compose
     s chmod +x /usr/local/bin/docker-compose
 
 
@@ -476,7 +501,7 @@ EOF
       printf "%s=%s\n" $key "$(docker-compose run --rm web rake secret|dos2unix|tail -n1)" >>.env.production
     done
     found=false
-    while read -r domain port pass; do
+    while read -r domain _ pass; do
       if [[ $domain == mail.iankelling.org ]]; then
         found=true
         # remove the username part
@@ -759,6 +784,21 @@ EOF
     # newer version needed for false positive in checkrestart
     p install -y --allow-unauthenticated debian-goodies
 
+    s dd of=/etc/apt/preferences.d/shellcheck <<EOF
+Package: shellcheck
+Pin: release a=etiona
+Pin-Priority: 1005
+
+Package: shellcheck
+Pin: release a=etiona-updates
+Pin-Priority: 1005
+
+Package: shellcheck
+Pin: release a=etiona-security
+Pin-Priority: 1005
+EOF
+
+
     ;;
 esac
 
@@ -981,7 +1021,7 @@ if [[ $HOSTNAME == frodo ]]; then
         # https://apt.syncthing.net/
         curl -s https://syncthing.net/release-key.txt | sudo apt-key add -
         s="deb http://apt.syncthing.net/ syncthing release"
-        if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != $s ]]; then
+        if [[ $(cat /etc/apt/sources.list.d/syncthing.list) != "$s" ]]; then
           echo "$s" | s dd of=/etc/apt/sources.list.d/syncthing.list
           p update
         fi
@@ -1042,6 +1082,13 @@ fi
 
 ####### begin misc packages ###########
 
+case $codename in
+  flidas)
+
+    ;;
+esac
+
+
 # sakura config is owned by ian
 reset-sakura
 reset-konsole
@@ -1072,13 +1119,13 @@ wget -O $t http://mirror.fsf.org/fsfsys-trisquel/fsfsys-trisquel/pool/main/s/spd
 s dpkg -i $t
 rm $t
 # this guesses at the appropriate directory, adjust if needed
-x=(/usr/lib/x86_64-linux-gnu/perl/5.*)
-sudo ln -sf ../../../perl/5.18.2/SPD/ $x
+perldir=(/usr/lib/x86_64-linux-gnu/perl/5.*)
+sudo ln -sf ../../../perl/5.18.2/SPD/ ${perldir[0]}
 # newer distro had gpg2 as default, older one, flidas, need to make it that way
-x=$(which gpg2)
+gpgpath=$(which gpg2)
 if [[ $x ]]; then
   s mkdir -p /usr/local/spdhackfix
-  s lnf -T $x /usr/local/spdhackfix/gpg
+  s lnf -T $gpgpath /usr/local/spdhackfix/gpg
 fi
 ### end spd install
 
@@ -1646,7 +1693,7 @@ dbus-launch gsettings set org.gnome.desktop.media-handling automount-open false
 # on grub upgrade, we get prompts unless we do this
 devs=()
 for dev in $(s btrfs fil show /boot | sed -nr 's#.*path\s+(\S+)$#\1#p'); do
-  devs+=($(devbyid $dev),)
+  devs+=("$(devbyid $dev),")
 done
 devs[-1]=${devs[-1]%,} # jonied by commas
 s debconf-set-selections <<EOF

diff --git a/distro-pkgs b/distro-pkgs
index aded66a91c88a7b2ca8274f8dcdc3af1db48bcc4..d72e4ecf4cd9ea033e657ee369d03587892b7ac9 100755 (executable)
--- a/distro-pkgs
+++ b/distro-pkgs
@@ -199,12 +199,6 @@ case $distro in
     ;;
 esac
 
-case $distro in
-  fedora) cabal install shellcheck ;;
-  *) e shellcheck ;;
-  # unknown for older ubuntu
-esac
-
 case $distro in
   arch|debian|trisquel|ubuntu) e pumpa ;;
   # others unknown. do have a buildscript:

diff --git a/filesystem/etc/X11/Xsession.d/98iank b/filesystem/etc/X11/Xsession.d/98iank
index 506e9bc3355f3315e44b0bf720637fef814a327a..efbdd98ba6daf38557831399eaab0c3d0d0353bd 100644 (file)
--- a/filesystem/etc/X11/Xsession.d/98iank
+++ b/filesystem/etc/X11/Xsession.d/98iank
@@ -5,6 +5,6 @@ if [[ $HOSTNAME != frodo ]]; then
   /usr/share/xscreensaver/xscreensaver-wrapper.sh &
 fi
 
-if [[ $HOSTNAME == $MAIL_HOST ]]; then
-  arbtt-capture --sample-rate=10 &
-fi
+# if [[ $HOSTNAME == $MAIL_HOST ]]; then
+#   arbtt-capture --sample-rate=10 &
+# fi

diff --git a/filesystem/usr/local/bin/mailtest-check b/filesystem/usr/local/bin/mailtest-check
index 7fb1cbce051b6233ce93624ac1b02a661fecb65a..c48fae99b4e0a702540384be262c578a53a09d09 100755 (executable)
--- a/filesystem/usr/local/bin/mailtest-check
+++ b/filesystem/usr/local/bin/mailtest-check
@@ -13,7 +13,7 @@ shopt -s nullglob
 # we run this cronjob along with sending the test email every 10
 # minutes, so give it 2 minutes to arrive, then if there is an email at
 # least 23 minutes old, the last 2 test emails have failed.
-if [[ ! $@ && $- != *i* ]]; then
+if [[ ! $1 && $- != *i* ]]; then
   sleep 120
 fi
 
@@ -38,4 +38,4 @@ else
   rm -f /nocow/user/mailtest-failure
 fi
 
-find -type f -mtime +1 -delete
+find . -type f -mtime +1 -delete

diff --git a/filesystem/usr/local/bin/mycheckrestart b/filesystem/usr/local/bin/mycheckrestart
new file mode 100755 (executable)
index 0000000..64363b8
--- /dev/null
+++ b/filesystem/usr/local/bin/mycheckrestart
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Copyright (C) 2019 Ian Kelling
+# SPDX-License-Identifier: AGPL-3.0-or-later
+if [ -z "$BASH_VERSION" ]; then echo "error: shell is not bash" >&2; exit 1; fi
+
+if [[ $EUID != 0 ]]; then s=sudo; fi
+
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+
+hn=$(hostname -f)
+source /a/bin/bash_unpublished/source-state
+if [[ $HOSTNAME != "$MAIL_HOST" && $hn != li.b8.nz && ! $DISPLAY ]]; then
+  exit 0
+fi
+
+$s checkrestart | sed '/^Found 0 processes using old versions of upgraded files$/d'

diff --git a/filesystem/usr/local/bin/zelous-unattended-reboot b/filesystem/usr/local/bin/myupgrade
similarity index 56%
rename from filesystem/usr/local/bin/zelous-unattended-reboot
rename to filesystem/usr/local/bin/myupgrade
index a4672f38b9e6f1034f0157f46fbf5fdfd9f5b786..3df5f0e12211b67707eb8616ed27bbd687254c65 100755 (executable)
--- a/filesystem/usr/local/bin/zelous-unattended-reboot
+++ b/filesystem/usr/local/bin/myupgrade
@@ -1,4 +1,18 @@
 #!/bin/bash
+# Copyright (C) 2019 Ian Kelling
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+if [ -z "$BASH_VERSION" ]; then echo "error: shell is not bash" >&2; exit 1; fi
+
+set -eE -o pipefail
+trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
+
+hn=$(hostname -f)
+source /a/bin/bash_unpublished/source-state
+if [[ $HOSTNAME == "$MAIL_HOST" || $hn == li.b8.nz ]]; then
+  exit 0
+fi
+
 if [[ $(/usr/sbin/checkrestart | wc -l) != 1 ]]; then
   for x in {30..1}; do
     echo "pid $PID. unattended upgrade, rebooting in $((x*10)) seconds" | wall -n

diff --git a/i3-sway/gen b/i3-sway/gen
index bf24f81597206d92a7255c2c8f909d8e3f2fe38e..22a4e476bfc4ff477e404711a94bc8cdbbc2b816 100755 (executable)
--- a/i3-sway/gen
+++ b/i3-sway/gen
@@ -3,7 +3,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-x="$(readlink -f -- "$BASH_SOURCE")"; cd ${x%/*} # directory of this file
+x="$(readlink -f -- "${BASH_SOURCE[0]}")"; cd ${x%/*} # directory of this file
 
 cat common.conf sway.conf > /a/bin/distro-setup/subdir_files/.config/sway/config
 cat common.conf i3.conf > /a/bin/distro-setup/subdir_files/.config/i3/config

diff --git a/install-my-scripts b/install-my-scripts
index fc6123970693d388161980e2354dc44f5287d28f..0e36a4f86ec8f91db051b49f9c34cc115fc50a37 100755 (executable)
--- a/install-my-scripts
+++ b/install-my-scripts
@@ -23,9 +23,9 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
-x="$(readlink -f "$BASH_SOURCE")"; cd ${x%/*}
+x="$(readlink -f -- "${BASH_SOURCE[0]}")"; cd ${x%/*} # directory of this file
 
 
 # scripts that would interfere with unmounting /a, put them elsewhere

diff --git a/keyscript-off b/keyscript-off
index bb63cb211a206b1b2029dbfaf7976496faaee0f8..b26ed9d60961288b4de4ae22449572449d0b4fcb 100755 (executable)
--- a/keyscript-off
+++ b/keyscript-off
@@ -16,7 +16,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
 
-[[ $EUID == 0 ]] || exec sudo "${BASH_SOURCE}" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 if [[ $- != *i* ]]; then
     exec &>/var/log/keyscript-off.log
     echo "$0: starting. $(date)"

diff --git a/keyscript-on b/keyscript-on
index 7950ebe9b9ca0e49f64e8154fba85faa77452ad9..e62c7ed63c14d4b6f1a9b50965a0511773d4aebf 100755 (executable)
--- a/keyscript-on
+++ b/keyscript-on
@@ -16,7 +16,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?"' ERR
 
-[[ $EUID == 0 ]] || exec sudo "${BASH_SOURCE}" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 if [[ $- != *i* ]]; then
     exec &>>/var/log/keyscript-on.log
     echo "$0: starting. $(date)"

diff --git a/machine_specific/kd/filesystem/etc/cron.d/kd b/machine_specific/kd/filesystem/etc/cron.d/kd
deleted file mode 100755 (executable)
index fccd071..0000000
--- a/machine_specific/kd/filesystem/etc/cron.d/kd
+++ /dev/null
@@ -1,12 +0,0 @@
-# disabled for various reasons
-# */5 * * * * /a/bin/offlineimap_cronjob
-# */1 * * * * unison ~/.mpv ssh://htpc/.mpv
-# small-backpup:
-# runs every 10 minutes, every day 4 am, every sunday at 3 am
-# stored for 3 days, 2 months, and unlimited respectively
-SHELL=/bin/bash
-0    4 * * * ian x=$(/usr/local/bin/logq /a/exe/small-backup --retry daily 2M); [[ $? != 0 ]] && echo "$x"
-0    3 * * sun ian echo weekly backup results:; /a/exe/small-backup --retry weekly
-*/10 * * * *   ian /a/exe/small-backup 10minutes 3D 2>&1 | /usr/local/bin/log-once small-backup-10min
-# put things we don't want to send mail about below this:
-# MAILTO=""

diff --git a/mail-route b/mail-route
index 1dea430b1bb22288d93b95b570bee19102e241a5..52f4651becd9c8afc758c2fd791157f9224e9784 100755 (executable)
--- a/mail-route
+++ b/mail-route
@@ -13,7 +13,7 @@ set -x
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 source /a/bin/errhandle/err
 

diff --git a/mail-setup b/mail-setup
index b97f3b929a5fd4f1f16105d9c8bcadf8c66951e5..93d09c739402f2c4b8c78c7b79aa22641b228f5b 100755 (executable)
--- a/mail-setup
+++ b/mail-setup
@@ -21,7 +21,7 @@ set -x
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 if [[ ! $SUDO_USER ]]; then
   echo "$0: error: requires running as nonroot or sudo"
   exit 1
@@ -345,7 +345,7 @@ cat >$f <<'EOF'
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 f=/a/bin/bash_unpublished/source-state
 if [[ -e $f ]]; then
@@ -398,11 +398,6 @@ systemctl start mailcert
 systemctl restart mailcert.timer
 systemctl enable mailcert.timer
 
-# This symlink is only here to so I can use the
-# fsf mailman ansible role and trick its cert script
-# into doing nothing.
-/a/exe/lnf -T /etc/exim4/exim.crt /etc/letsencrypt/live/$(hostname -f)/fullchain.pem
-
 ##### end mailcert setup #####
 
 # comon stuff

diff --git a/mymimes b/mymimes
index 2130c3776b7432ac61d2333782be20d324f9a08b..31779080ecf753c92054bba9cbf2636c9476f183 100755 (executable)
--- a/mymimes
+++ b/mymimes
@@ -3,7 +3,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 shopt -s extglob nullglob
 

diff --git a/path_add-function b/path_add-function
index 540306ca03f0d8aed9af772b7840696f38973fce..f2f4299ea4c3399741022303d5b5f4ad4f853e3a 100644 (file)
--- a/path_add-function
+++ b/path_add-function
@@ -22,7 +22,7 @@ path_add() {
 --help:     print this
 --end:      adds to end of path, which will give it lowest priority
 --ifexists: add to path only if directory exists"
-    local found x y z ifexists end loop newpath
+    local found x y ifexists end loop newpath
     ifexists=false
     end=false
     loop=true

diff --git a/pkgs b/pkgs
index eae95c34e87e89640c4085151208607028eef144..d8acab13c182fa4a17f5310e9e5c02883d3f08aa 100644 (file)
--- a/pkgs
+++ b/pkgs
@@ -167,6 +167,7 @@ p4=(
   rng-tools
   sakura
   schroot
+  shellcheck
   sig2dot
   sipcalc
   sqlite3-doc

diff --git a/primary-setup b/primary-setup
index 30c4222a7bc9c3cdfb6885546a147c4b8225438f..d6c0ed9ec4cf8ea43d64d2312fe0f50a46b23532 100755 (executable)
--- a/primary-setup
+++ b/primary-setup
@@ -7,7 +7,7 @@ set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 
-if [[ ! $SUDO_USER || $EUID == 0 ]]; then
+if [[ $EUID == 0 && ! $SUDO_USER ]]; then
   echo "$0: error: requires running as nonroot or sudo"
   exit 1
 fi
@@ -18,7 +18,7 @@ if [[ $1 ]]; then
   source /a/bin/bash_unpublished/source-state
 fi
 
-if [[ $HOSTNAME == $MAIL_HOST ]]; then
+if [[ $HOSTNAME == "$MAIL_HOST" ]]; then
   # arbtt disabled for now
   #DISPLAY=:0 arbtt-capture --sample-rate=10 &
   sudo systemctl start rss2email.timer

diff --git a/radicale-setup b/radicale-setup
index 3cfaa8225a2b424aed0d33d6f0f54845a401482b..cb43a477fd2399b64486a423c47070d98f10dd35 100755 (executable)
--- a/radicale-setup
+++ b/radicale-setup
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 if [[ -e /b/errhandle/err ]]; then
   source /b/errhandle/err
@@ -49,8 +49,8 @@ systemctl daemon-reload # not sure this is needed
 pi-nostart radicale
 
 # use persistent uid/gid
-IFS=:; read _ _ uid _ < <(getent passwd radicale ); unset IFS
-IFS=:; read _ _ gid _ < <(getent group radicale ); unset IFS
+IFS=:; read -r _ _ uid _ < <(getent passwd radicale ); unset IFS
+IFS=:; read -r _ _ gid _ < <(getent group radicale ); unset IFS
 if [[ $uid != 609 ]]; then
     systemctl stop radicale ||:
     usermod -u 609 radicale

diff --git a/rootsshsync b/rootsshsync
index 90928c669d922f72abc55562d5d7a1e943def725..c55014921b8af67fd2c8d4f3554feb64bfadb218 100755 (executable)
--- a/rootsshsync
+++ b/rootsshsync
@@ -16,7 +16,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 dest=/root/.ssh
 

diff --git a/schrootupdate b/schrootupdate
index 280095d0bbd23554a534959ba2792a4f11b17653..832b0157def6d9bd9bc5d75df59a2308befb264a 100755 (executable)
--- a/schrootupdate
+++ b/schrootupdate
@@ -3,7 +3,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 for n in stretch jessie; do
     if [[ -e /etc/schroot/chroot.d/$n.conf ]]; then

diff --git a/switch-mail-host b/switch-mail-host
index 10fcd9f12d82c580e1ee3536c2ac51ed08e9c969..f26b945bea1a1b139a1232e08942fe8192f7a1af 100644 (file)
--- a/switch-mail-host
+++ b/switch-mail-host
@@ -59,8 +59,8 @@ old_host=$1
 new_host=$2
 source /a/bin/bash_unpublished/source-state
 
-if [[ $old_host != $MAIL_HOST ]]; then
-  read -p "warning: \$old_host != \$MAIL_HOST: $old_host != $MAIL_HOST, proceed? y/N "
+if [[ $old_host != "$MAIL_HOST" ]]; then
+  read -r -p "warning: \$old_host != \$MAIL_HOST: $old_host != $MAIL_HOST, proceed? y/N "
   if [[ $REPLY != [yY] ]]; then
     exit 1
   fi

diff --git a/system-status b/system-status
index c92bc9a9656583b253d5619f8d97b9ddeffe6260..49f734a63243aee83d33f3a641583e5b53231d8c 100755 (executable)
--- a/system-status
+++ b/system-status
@@ -18,16 +18,16 @@ write-status() {
   chars=()
 
   glob=(/nocow/btrfs-stale/*)
-  if [[ -e $glob ]] ; then
+  if [[ -e ${glob[0]} ]]; then
     chars+=("STALE!")
   fi
   glob=(/m/md/bounces/new/*)
-  if [[ -e $glob ]]; then
+  if [[ -e ${glob[0]} ]]; then
     chars+=("BOUNCE!")
     lo -1 bounce "message in /m/md/bounces/new"
   fi
   glob=(/m/md/alerts/new/* /m/md/alerts/cur/*)
-  if [[ -e $glob ]]; then
+  if [[ -e ${glob[0]} ]]; then
     chars+=("ALERT!")
   fi
   if [[ -e /nocow/user/mailtest-failure ]]; then
@@ -39,7 +39,7 @@ write-status() {
   fi
 
   source /a/bin/bash_unpublished/source-state
-  if [[ $MAIL_HOST == $HOSTNAME ]]; then
+  if [[ $MAIL_HOST == "$HOSTNAME" ]]; then
     if [[ $(systemctl is-active btrbk.timer) != active ]]; then
       chars+=("BTRBK.TIMER!")
       lo -60 btrbk.timer "btrbk.timer not enabled"
@@ -65,13 +65,13 @@ write-status() {
 
   cat /a/bin/bash_unpublished/source-state >$status_file
 
-  if [[ $chars ]]; then
+  if [[ ${chars[*]} ]]; then
     echo "ps_char=\"${chars[*]} \$ps_char\"" >>$status_file
   fi
 
 }
 write-status
-if [[ $@ ]]; then
+if [[ $1 ]]; then
   cat $status_file
   exit 0
 fi

diff --git a/trusted-network b/trusted-network
index ea1d9f496d8dc30eeeb7d41f76bfcce252291032..d227137732b56c148ee2cd4f15284a731b4f53dc 100755 (executable)
--- a/trusted-network
+++ b/trusted-network
@@ -3,7 +3,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 # Usage: run when switching from an untrusted network like public wifi
 # to a trusted one.

diff --git a/untrusted-network b/untrusted-network
index c9a43db3670acd75851ecee874545602cbb2dad4..3d8ac97d668cf3ebe7a530f9096a6c543161f90c 100755 (executable)
--- a/untrusted-network
+++ b/untrusted-network
@@ -3,7 +3,7 @@
 set -eE -o pipefail
 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
-[[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
+[[ $EUID == 0 ]] || exec sudo -E "${BASH_SOURCE[0]}" "$@"
 
 # Usage: use when switching from a trusted network to an untrusted one,
 # like public wifi.