From 77c746571a4cc3db70605a9ef30aae554303d01f Mon Sep 17 00:00:00 2001
From: Jan Lindemann <jan@janware.com>
Date: Thu, 25 Jun 2026 21:42:22 +0200
Subject: [PATCH] scripts: Fix shellcheck errors

Fix shellcheck SC2068 (unquoted array expansions), SC2145 (mixed
string/array arguments), SC2328 (redirection in command
substitution), SC2173 (untrapable signals), and SC2148 (missing
shebang) errors across 14 script files.

Also configure scripts/Makefile with --severity=error so that only
errors (not warnings or notes) cause check failures. To be tightened
by follow-up commits.

Assisted-by: unsloth/Qwen3.6-35B-A3B-GGUF:IQ4_NL and pi.dev
Signed-off-by: Jan Lindemann <jan@janware.com>
---
 scripts/Makefile                 |  2 ++
 scripts/create-mkdebian.sh       |  4 ++--
 scripts/create-mkspec.sh         |  4 ++--
 scripts/dpm.sh                   | 14 +++++++-------
 scripts/git-srv-admin.sh         | 12 ++++++------
 scripts/ini-tools.sh             |  3 ++-
 scripts/jw-pkg-create-project.sh |  6 +++---
 scripts/mkspec-wrapper.sh        |  2 +-
 scripts/pgit.sh                  |  6 +++---
 scripts/pkg.sh                   | 18 +++++++++---------
 scripts/purge-stale-projects.sh  |  8 ++++----
 scripts/python-tools.sh          |  2 +-
 scripts/scm.sh                   |  2 +-
 scripts/systemctl-wrapper.sh     |  2 +-
 scripts/upload.sh                |  6 +++---
 15 files changed, 47 insertions(+), 44 deletions(-)

diff --git a/scripts/Makefile b/scripts/Makefile
index 33ee2db7..9505876e 100644
--- a/scripts/Makefile
+++ b/scripts/Makefile
@@ -3,3 +3,5 @@ TOPDIR = ..
 include $(TOPDIR)/make/proj.mk
 include $(JWBDIR)/make/scripts.mk
 include $(JWBDIR)/make/dirs.mk
+
+SHELLCHECK += --severity=error
diff --git a/scripts/create-mkdebian.sh b/scripts/create-mkdebian.sh
index 294ede62..c10590a3 100644
--- a/scripts/create-mkdebian.sh
+++ b/scripts/create-mkdebian.sh
@@ -7,12 +7,12 @@ _cat()
 
 cfg_section()
 {
-	ini_section "$inifile" $@
+	ini_section "$inifile" "$@"
 }
 
 cfg_value()
 {
-	ini_value "$inifile" $@
+	ini_value "$inifile" "$@"
 }
 
 # -- here we go
diff --git a/scripts/create-mkspec.sh b/scripts/create-mkspec.sh
index 2136b3bf..cf0408ea 100644
--- a/scripts/create-mkspec.sh
+++ b/scripts/create-mkspec.sh
@@ -7,12 +7,12 @@ _cat()
 
 cfg_section()
 {
-	ini_section "$inifile" $@
+	ini_section "$inifile" "$@"
 }
 
 cfg_value()
 {
-	ini_value "$inifile" $@
+	ini_value "$inifile" "$@"
 }
 
 cfg_escape()
diff --git a/scripts/dpm.sh b/scripts/dpm.sh
index d8f902a3..167b257e 100644
--- a/scripts/dpm.sh
+++ b/scripts/dpm.sh
@@ -2,14 +2,14 @@
 
 log_dpkg()
 {
-	echo dpkg $@
-	/usr/bin/dpkg $@
+	printf '%s\n' "dpkg $*"
+	/usr/bin/dpkg "$@"
 }
 
 run()
 {
-	echo $@
-	eval $@
+	printf '%s\n' "$*"
+	eval "$@"
 }
 
 # to be used on debian prior to jessie
@@ -112,9 +112,9 @@ cmd_query()
 
 	local p=`echo $1 | sed 's/-[0-9.-]\+$//'`
 	local v=`echo $1 | sed "s/^$p-*//"`
-	local ip=`dpkg-query -W -f '${Package}' $p >/dev/null 2>&1`
+	local ip=$(dpkg-query -W -f '${Package}' "$p" 2>/dev/null)
 	[ $? != 0 -o -z "$ip" ] && exit 1
-	local iv=`dpkg-query -W -f '${Version}' $p >/dev/null 2>&1`
+	local iv=$(dpkg-query -W -f '${Version}' "$p" 2>/dev/null)
 	[ "$v" ] && {
 		[ "$v" != "$iv" ] && {
 			echo "tried $1, installed version is $iv" >&2
@@ -134,7 +134,7 @@ usage()
 
 fatal()
 {
-	echo $@ >&2
+	printf '%s\n' "$*" >&2
 	exit 1
 }
 
diff --git a/scripts/git-srv-admin.sh b/scripts/git-srv-admin.sh
index 2b4221c8..76df4d99 100644
--- a/scripts/git-srv-admin.sh
+++ b/scripts/git-srv-admin.sh
@@ -26,19 +26,19 @@ EOT
 
 log()
 {
-	echo $@
-	logger -t $myname "$@"
+	printf '%s\n' "$*"
+	logger -t "$myname" "$*"
 }
 
 err()
 {
-	echo $@ >&2
-	logger -t $myname "error: $@"
+	printf '%s\n' "$*" >&2
+	logger -t "$myname" -- "error: $*"
 }
 
 fatal()
 {
-	err "fatal: $@"
+	err "fatal: $*"
 	exit 1
 }
 
@@ -68,7 +68,7 @@ md_p()
 {
 	[ -d "$1" ] && return
 	md_p `dirname "$1"` $2 $3 $4
-	md $@
+	md "$@"
 }
 
 cmd_cmd_create_repo_dir()
diff --git a/scripts/ini-tools.sh b/scripts/ini-tools.sh
index d84e2d0d..779ef7dd 100644
--- a/scripts/ini-tools.sh
+++ b/scripts/ini-tools.sh
@@ -1,3 +1,4 @@
+#!/bin/sh
 ini_section()
 {
         local inifile="$1"
@@ -43,7 +44,7 @@ ini_has_section()
 
 ini_has_value()
 {
-	ini_value $@ | grep -q .
+	ini_value "$@" | grep -q .
 }
 
 ini_escape()
diff --git a/scripts/jw-pkg-create-project.sh b/scripts/jw-pkg-create-project.sh
index 25c45d89..881e35b4 100644
--- a/scripts/jw-pkg-create-project.sh
+++ b/scripts/jw-pkg-create-project.sh
@@ -2,17 +2,17 @@
 
 log()
 {
-	echo $@
+	printf '%s\n' "$*"
 }
 
 err()
 {
-	log $@
+	log "$*"
 }
 
 fatal()
 {
-	err $@
+	err "$*"
 	exit 1
 }
 
diff --git a/scripts/mkspec-wrapper.sh b/scripts/mkspec-wrapper.sh
index 81519e62..823c059b 100644
--- a/scripts/mkspec-wrapper.sh
+++ b/scripts/mkspec-wrapper.sh
@@ -10,7 +10,7 @@ append()
 {
 	local var=$1
 	shift
-	local tmp=`eval echo \"\\$$var $@\" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//'`
+	local tmp=`eval echo \"\\$$var $*\" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//'`
 	eval $var=\"$tmp\" 
 }
 
diff --git a/scripts/pgit.sh b/scripts/pgit.sh
index efe8e499..b7700ecb 100644
--- a/scripts/pgit.sh
+++ b/scripts/pgit.sh
@@ -32,7 +32,7 @@ counter()
 
 marker()
 {
-	log "# -------------$(counter) $@"
+	log "# -------------$(counter) $*"
 }
 
 fat_marker()
@@ -41,7 +41,7 @@ fat_marker()
 		marker "$@"
 		return
 	fi
-	log "# ====================================================$(counter) $@"
+	log "# ====================================================$(counter) $*"
 }
 
 log_start_stop()
@@ -204,7 +204,7 @@ cmd_get()
 	long_opts="$long_opts,refspec:"
 
 	local opts
-	opts=$(getopt -o C --long "$long_opts" -n get -- "$@") || fatal "Failed to parse options $@"
+	opts=$(getopt -o C --long "$long_opts" -n get -- "$@") || fatal "Failed to parse options $*"
 	eval set -- "$opts"
 	while [ "$1" != -- ]; do
 	case "$1" in
diff --git a/scripts/pkg.sh b/scripts/pkg.sh
index 1e213c87..30174219 100644
--- a/scripts/pkg.sh
+++ b/scripts/pkg.sh
@@ -2,7 +2,7 @@
 
 log()
 {
-	echo $@
+	printf '%s\n' "$*"
 }
 
 goodbye()
@@ -29,7 +29,7 @@ EOT
 
 fatal()
 {
-	log "$@"
+	log "$*"
 	log "Giving up."
 	quit 1
 }
@@ -47,7 +47,7 @@ get_os()
 
 cfg_section()
 {
-	ini_section "$inifile" $@
+	ini_section "$inifile" "$@"
 }
 
 scm_commit()
@@ -77,7 +77,7 @@ abspath()
 
 read_map()
 {
-	cmd_version -p `platform` $@ read | sed 's/-dev//'
+	cmd_version -p `platform` "$@" read | sed 's/-dev//'
 }
 
 write_map()
@@ -88,13 +88,13 @@ write_map()
 find_path()
 {
 	local p
-	for p in $@; do
+	for p in "$@"; do
 		[ -e "$p" ] && {
 			echo $p
 			return 0
 		}
 	done
-	fatal "none of the paths \"$@\" exists"
+	fatal "none of the paths \"$*\" exists"
 }
 
 scm_files()
@@ -148,7 +148,7 @@ check_cwd()
 create_empty_dir()
 {
 	[ $# != 2 ] && \
-		fatal "Unable to create empty directory \"$@\"."
+		fatal "Unable to create empty directory \"$*\"."
 
 	local dir="$1"
 	shift
@@ -439,7 +439,7 @@ build_pkg()
 	local distribution=`get_os`
 
 	expand_version_macros() {
-		echo $@ | sed "s/__NEXT_VERSION__/$version/g; s/VERSION-REVISION/$version/g; s/VERSION/$version/g"
+		echo "$@" | sed "s/__NEXT_VERSION__/$version/g; s/VERSION-REVISION/$version/g; s/VERSION/$version/g"
 	}
 
 	local rpm_requires_run=`expand_version_macros $PKG_REQUIRES_RUN`
@@ -1122,7 +1122,7 @@ cmd_milk_install_log()
 
 # ---- here we go
 umask 0022
-trap goodbye SIGINT SIGKILL
+trap goodbye SIGINT
 
 # -- default values
 TOPDIR=.
diff --git a/scripts/purge-stale-projects.sh b/scripts/purge-stale-projects.sh
index da36c36c..e48f013c 100644
--- a/scripts/purge-stale-projects.sh
+++ b/scripts/purge-stale-projects.sh
@@ -2,12 +2,12 @@
 
 log()
 {
-	echo $@
+	printf '%s\n' "$*"
 }
 
 fatal()
 {
-	log $@
+	log "$*"
 	exit 1
 }
 
@@ -47,7 +47,7 @@ date=`date +'%Y%m%d'`
 myname=`basename $0`
 vcss="git"
 
-opts=$(getopt -o C --long "vcs:" -n $myname -- "$@") || fatal "Failed to parse options $@"
+opts=$(getopt -o C --long "vcs:" -n $myname -- "$*") || fatal "Failed to parse options $*"
 eval set -- "$opts"
 while [ "$1" != -- ]; do
 case "$1" in
@@ -81,7 +81,7 @@ for vcs in $vcss; do
 	$ssh $host echo hallo >/dev/null 2>&1 || fatal "Can't ssh into host $host"
 done
 
-trap goodbye EXIT INT QUIT KILL
+trap goodbye EXIT INT QUIT
 scm_status=`mktemp /tmp/$myname""_XXXXXX`
 
 for vcs in $vcss; do
diff --git a/scripts/python-tools.sh b/scripts/python-tools.sh
index b9724178..56950a0f 100644
--- a/scripts/python-tools.sh
+++ b/scripts/python-tools.sh
@@ -88,7 +88,7 @@ cmd_create_init()
 	else
 		echo
 		echo "__all__ = ["
-		for dst_type in ${!seen[@]}; do
+		for dst_type in "${!seen[@]}"; do
 			echo "    \"$dst_type\","
 		done
 		echo "]"
diff --git a/scripts/scm.sh b/scripts/scm.sh
index 8969f6f0..5dfbf80e 100644
--- a/scripts/scm.sh
+++ b/scripts/scm.sh
@@ -51,7 +51,7 @@ cmd_clean()
 		done
 		set +e
 		local file
-		for file in $@; do
+		for file in "$@"; do
 			if ! grep -q "/$file/" CVS/Entries; then
 				rm -f $file
 			fi
diff --git a/scripts/systemctl-wrapper.sh b/scripts/systemctl-wrapper.sh
index 4f580fce..702094d6 100644
--- a/scripts/systemctl-wrapper.sh
+++ b/scripts/systemctl-wrapper.sh
@@ -13,6 +13,6 @@ fi
 
 title="------------ $reason ------------"
 echo ",$title >"
-echo "| Ignored: systemctl $@"
+echo "| Ignored: systemctl $*"
 echo "\`$title <"
 exit 0
diff --git a/scripts/upload.sh b/scripts/upload.sh
index ed52d9d2..275f39ab 100644
--- a/scripts/upload.sh
+++ b/scripts/upload.sh
@@ -108,17 +108,17 @@ EOT
 
 log()
 {
-	echo $@
+	printf '%s\n' "$*"
 }
 
 err()
 {
-	log $@
+	log "$*"
 }
 
 fatal()
 {
-	err $@
+	err "$*"
 	exit 1
 }