From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from simark.ca by simark.ca with LMTP id r+RsKNQmNWoPOQ8AWB0awg (envelope-from ) for ; Fri, 19 Jun 2026 07:24:04 -0400 Authentication-Results: simark.ca; dkim=pass (1024-bit key; unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=Qu+oWG1q; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=NWdwYB31; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=QQsq7Lyc; dkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=Qy5gqK+s; dkim-atps=neutral Received: by simark.ca (Postfix, from userid 112) id 930631E098; Fri, 19 Jun 2026 07:24:04 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on simark.ca X-Spam-Level: X-Spam-Status: No, score=-5.4 required=5.0 tests=ARC_SIGNED,ARC_VALID,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham autolearn_force=no version=4.0.1 Received: from vm01.sourceware.org (vm01.sourceware.org [IPv6:2620:52:6:3111::32]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by simark.ca (Postfix) with ESMTPS id CEDB41E024 for ; Fri, 19 Jun 2026 07:24:03 -0400 (EDT) Received: from vm01.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 1DE744B9DB72 for ; Fri, 19 Jun 2026 11:23:56 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 1DE744B9DB72 Authentication-Results: sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=Qu+oWG1q; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=NWdwYB31; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=QQsq7Lyc; dkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=Qy5gqK+s Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.223.130]) by sourceware.org (Postfix) with ESMTPS id E6B624BAD179 for ; Fri, 19 Jun 2026 11:23:08 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org E6B624BAD179 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=suse.de Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=suse.de ARC-Filter: OpenARC Filter v1.0.0 sourceware.org E6B624BAD179 Authentication-Results: sourceware.org; arc=none smtp.remote-ip=195.135.223.130 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1781868189; cv=none; b=wXFayz4EerQoUf/T49mMvHIE/3I9AqX7LCSyT5aoGTDyaj5BU2nuIN1BQyws86jfgiEDq6M0qOmDFn1MDK0Cd7QiFVHeHU+0GZfehXGlUDNS3A/pNrcu4mmtlLeYl/DAkA2OeyS8e21xOfRq2EhnWK5Nkm/dr16lTDmhL4QOqEM= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1781868189; c=relaxed/simple; bh=Ls0E8lXidcX5etXdZ4yXJJDAHbQfOZvsn41uc13D3Zw=; h=DKIM-Signature:DKIM-Signature:DKIM-Signature:DKIM-Signature:From: To:Subject:Date:Message-ID:MIME-Version; b=gCoCzAQf8Z2wx37KmWC5lUD3Cz//uUPmWqN+7Z/Pc63qBZoSwFmMVUkTJLnN0t2viTtVY+rrgTQe1/IbKmeBdzrGS80HsZBXmLpM/J+Krf7ayvhVj4is0IxAifI+oPsXzuYCm2FrYtvsrdWeawyl/Q0Kw0cgOESRuC2gwOyf4kM= ARC-Authentication-Results: i=1; sourceware.org; dkim=pass (1024-bit key, unprotected) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=Qu+oWG1q; dkim=pass header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=NWdwYB31; dkim=pass (1024-bit key) header.d=suse.de header.i=@suse.de header.a=rsa-sha256 header.s=susede2_rsa header.b=QQsq7Lyc; dkim=neutral header.d=suse.de header.i=@suse.de header.a=ed25519-sha256 header.s=susede2_ed25519 header.b=Qy5gqK+s DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org E6B624BAD179 Received: from imap1.dmz-prg2.suse.org (imap1.dmz-prg2.suse.org [IPv6:2a07:de40:b281:104:10:150:64:97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id E16FC6DA67 for ; Fri, 19 Jun 2026 11:23:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1781868188; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=q//f4FDWUsc5GPyh67cFXdlHvWNOuKhryTM4osc8gvM=; b=Qu+oWG1qU5zlHSx4KMIr1XUwUgrM6IVGT08AVUiDlqABJVhEERRFMxtxfadvSbjtoODA/u s9/vdizvys5wiZnBeyWcJcL1EpSr5i6y9jsAHvHZzhmQWcc9uMpSGWV+ajvqQJNOgXusKm r7EmsPqHdkEyKpgf2wAr5mtuJb4gcak= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1781868188; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=q//f4FDWUsc5GPyh67cFXdlHvWNOuKhryTM4osc8gvM=; b=NWdwYB31vtmbEfhB3yVElanwL012ojlbhFClLAeKj/X4/PMcmHhgL4O+9xSxZS5iiOIzf0 z6UxM74GNLpN2JCA== Authentication-Results: smtp-out1.suse.de; dkim=pass header.d=suse.de header.s=susede2_rsa header.b=QQsq7Lyc; dkim=pass header.d=suse.de header.s=susede2_ed25519 header.b=Qy5gqK+s DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa; t=1781868187; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=q//f4FDWUsc5GPyh67cFXdlHvWNOuKhryTM4osc8gvM=; b=QQsq7LycaZT85CXy7AHi6ZrjMyh90rko0FETwWh04q+FETJc3o35ZhIWAtY/hGN8cpi6sP WmoLSgHl+MVwX1HTgq3Dn8W0b3V/oQaCpcaWUi2JuRWITeFJxTwgrLjNdJYkzNbxS0s9wO fQSBHHP73puVQzwulb2NEGtwdbYF7q8= DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_ed25519; t=1781868187; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=q//f4FDWUsc5GPyh67cFXdlHvWNOuKhryTM4osc8gvM=; b=Qy5gqK+sMN9og810+1lkl9X0y1syQrSu267Q8FZlz+vqNI7o2/6uKKEnarTplWwNM3Sk5A KgSpl/+Cu7MMPZDQ== Received: from imap1.dmz-prg2.suse.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by imap1.dmz-prg2.suse.org (Postfix) with ESMTPS id CD8D6779A8 for ; Fri, 19 Jun 2026 11:23:07 +0000 (UTC) Received: from dovecot-director2.suse.de ([2a07:de40:b281:106:10:150:64:167]) by imap1.dmz-prg2.suse.org with ESMTPSA id zZ7/MJsmNWpCYwAAD6G6ig (envelope-from ) for ; Fri, 19 Jun 2026 11:23:07 +0000 From: Tom de Vries To: gdb-patches@sourceware.org Subject: [PATCH v2] [pre-commit] Add shellcheck Date: Fri, 19 Jun 2026 13:23:07 +0200 Message-ID: <20260619112307.138647-1-tdevries@suse.de> X-Mailer: git-send-email 2.51.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Rspamd-Action: no action X-Rspamd-Queue-Id: E16FC6DA67 X-Spamd-Result: default: False [-3.01 / 50.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; R_MISSING_CHARSET(0.50)[]; R_DKIM_ALLOW(-0.20)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; NEURAL_HAM_SHORT(-0.20)[-1.000]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.01)[]; TO_MATCH_ENVRCPT_ALL(0.00)[]; RCPT_COUNT_ONE(0.00)[1]; ARC_NA(0.00)[]; FUZZY_RATELIMITED(0.00)[rspamd.com]; MIME_TRACE(0.00)[0:+]; RBL_SPAMHAUS_BLOCKED_OPENRESOLVER(0.00)[2a07:de40:b281:104:10:150:64:97:from]; DKIM_SIGNED(0.00)[suse.de:s=susede2_rsa,suse.de:s=susede2_ed25519]; RCVD_TLS_ALL(0.00)[]; DKIM_TRACE(0.00)[suse.de:+]; RCVD_COUNT_TWO(0.00)[2]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; SPAMHAUS_XBL(0.00)[2a07:de40:b281:104:10:150:64:97:from]; TO_DN_NONE(0.00)[]; PREVIOUSLY_DELIVERED(0.00)[gdb-patches@sourceware.org]; DNSWL_BLOCKED(0.00)[2a07:de40:b281:104:10:150:64:97:from,2a07:de40:b281:106:10:150:64:167:received]; RCVD_VIA_SMTP_AUTH(0.00)[]; RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER(0.00)[2a07:de40:b281:106:10:150:64:167:received]; DBL_BLOCKED_OPENRESOLVER(0.00)[suse.de:mid, suse.de:dkim, imap1.dmz-prg2.suse.org:rdns, imap1.dmz-prg2.suse.org:helo, pypi.org:url, sourceware.org:url] X-Rspamd-Server: rspamd1.dmz-prg2.suse.org X-BeenThere: gdb-patches@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Gdb-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: gdb-patches-bounces~public-inbox=simark.ca@sourceware.org I found a pure python implementation of shellcheck [1][2]. It's not an exact copy, but close enough. One notable difference is the absence of data flow analysis [3], so basically it's got a hardcoded --extended-analysis=false. I've done a security audit using Claude Sonnet 4.5 with the prompts: ... /security-review Please do the security review for the source code. ... and that seemed fine. Use it to check scripts in the repo. Exclude any scripts that are not currently clean. As an example, gdb/testsuite/make-check-all.sh is shellcheck clean, but not with --extended-analysis=false: ... $ shellcheck --extended-analysis=true make-check-all.sh >/dev/null; echo $? 0 $ shellcheck --extended-analysis=false make-check-all.sh >/dev/null; echo $? 1 ... so it's also excluded. Running it seems reasonably fast: ... $ pre-commit run pureshellcheck --all-files -v pureshellcheck..........................................................Passed - hook id: pureshellcheck - duration: 0.06s ... For information on other solutions, see this RFC [4]. Changes in v2: - mention hardcoded --extended-analysis=false - mention security audit - use commit hash to pin down version, for now via a clone (as we've done before with tclint) because the official source doesn't contain a .pre-commit-hooks.yaml file Versions: - v1 https://sourceware.org/pipermail/gdb-patches/2026-June/228118.html [1] https://pypi.org/project/pureshellcheck/0.2.2/ [2] https://github.com/adam2go/pureshellcheck [3] https://github.com/adam2go/pureshellcheck/issues/1 [4] https://sourceware.org/pipermail/gdb-patches/2024-November/213400.html --- .pre-commit-config.yaml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 9910bbb82f2..af2fd6403e0 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -94,6 +94,21 @@ repos: args: [--trust-plugins] files: '^gdb/testsuite/.*\.(exp|tcl)$' + # Pureshellcheck hooks. The repo is a clone of pureshellcheck + # ( https://github.com/adam2go/pureshellcheck ), with a + # .pre-commit-hooks.yaml file added. Use a commit hash rather than a tag to + # guard against supply chain attacks. + - repo: https://github.com/vries/pureshellcheck + # The commit hash corresponds to v0.2.2, that is: + # $ git diff --stat v0.2.2 + # .pre-commit-hooks.yaml | 5 +++++ + rev: a41d65d3a941325e6cb901e60b0a7e7975d1fb64 + hooks: + - id: pureshellcheck + files: '^(gdb|gdbsupport|gdbserver)/' + types: ['shell'] + exclude: '^(gdb/config/djgpp/(djcheck.sh|djconfig.sh)|gdb/contrib/ari/(create-web-ari-in-src.sh|gdb_ari.sh|update-web-ari.sh)|gdb/contrib/(cc-with-tweaks.sh|expect-read1.sh|gdb-add-index.sh|license-check-new-files.sh)|gdb/gdb_buildall.sh|gdb/gdb_mbuild.sh|gdb/regformats/regdat.sh|gdb/syscalls/update-linux-from-src.sh|gdb/testsuite/make-check-all.sh|gdb/gcore-1.in|gdb/po/gdbtext|gdb/testsuite/lib/pdtrace.in)$|/configure$' + # Local hooks. - repo: local hooks: base-commit: fd3cf86c638b7fdc0ccb64e178ec43ccd7e9d3f9 -- 2.51.0