Simon Marchi writes: > On 2026-06-18 11:19, Tom de Vries wrote: >> I found a pure python implementation of shellcheck [1]. >> >> Use it to run shellcheck on scripts in the repo. >> >> Exclude any scripts that are not currently clean. >> >> Running it seems reasonably fast: >> ... >> $ pre-commit run shellcheck --all-files -v >> shellcheck...............................................................Passed >> - hook id: shellcheck >> - duration: 0.06s >> ... >> >> For information on other solutions, see this RFC [2]. >> >> [1] https://pypi.org/project/pureshellcheck/0.2.2/ >> [2] https://sourceware.org/pipermail/gdb-patches/2024-November/213400.html > > While I'm sympathetic to the use of pre-commit (I added the first > hooks), I'm starting to get a bit worried that we kind of blindly pull > hooks from random places without paying much attention. This is going > to get executed on the machines of many GDB devs, and probably some CI > too. > > I had this thought because this one has the "random project on github > vibes" (it appears to be a vibe coded project started a week ago). More > established projects (like black) are not immune to being compromised, > but they are easier to trust I guess. I have the same kind of concern, but I'm more paranoid. As a general principle I prefer to install distro packages rather than language-specific packages (such as the ones from PyPI), on the assumption that distros tend to be more careful about incorporating packages and updating them (it's a weak assumption though). Because of that, in order to run the pre-commit checks I created a script (attached) that parses .pre-commit-config.yaml and runs the hooks with the tools that are already installed on the system. It doesn't try to download anything. Today I added support for running each hook in an isolated container with access only to the binutils-gdb repo, and in read-only mode at that. It uses Guix to set up the containers so when Guix isn't installed you need to pass the --no-container option. Also when using containers the script can only use the tools packaged in Guix, which currently doesn't have some of the tools referenced by our .pre-commit-config.yaml, or has older versions of them. Another bad news is that the script is in Scheme. :) But you get the idea. :) -- Thiago (he/him)