[PR PATCH] make changes suggested by shellharden

[PR PATCH] make changes suggested by shellharden

[ishaanbhimwal]

[-- Attachment #1: Type: text/plain, Size: 1256 bytes --]

There is a new pull request by ishaanbhimwal against master on the void-packages repository

https://github.com/ishaanbhimwal/void-packages xbps-src
https://github.com/void-linux/void-packages/pull/38340

make changes suggested by shellharden
<!-- Uncomment relevant sections and delete options which are not applicable -->

#### Testing the changes
- I tested the changes in this PR: **YES**

<!--
#### New package
- This new package conforms to the [quality requirements](https://github.com/void-linux/void-packages/blob/master/Manual.md#quality-requirements): **YES**|**NO**
-->

<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
<!--
#### Local build testing
- I built this PR locally for my native architecture, (ARCH-LIBC)
- I built this PR locally for these architectures (if supported. mark crossbuilds):
  - aarch64-musl
  - armv7l
  - armv6l-musl
-->


A patch file from https://github.com/void-linux/void-packages/pull/38340.patch is attached

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: github-pr-xbps-src-38340.patch --]
[-- Type: text/x-diff, Size: 23991 bytes --]

From e14dd25693b936ae140a51a82b01bb727b20f2e2 Mon Sep 17 00:00:00 2001
From: Ishaan Bhimwal <ishaanbhimwal@protonmail.com>
Date: Thu, 28 Jul 2022 23:30:34 +0530
Subject: [PATCH] make changes suggested by shellharden

---
 xbps-src | 250 +++++++++++++++++++++++++++----------------------------
 1 file changed, 125 insertions(+), 125 deletions(-)

diff --git a/xbps-src b/xbps-src
index 4e8349091708..af0c762690d3 100755
--- a/xbps-src
+++ b/xbps-src
@@ -237,18 +237,18 @@ check_reqhost_utils() {
 
     [ "$IN_CHROOT" ] && return 0
 
-    for f in ${REQHOST_UTILS}; do
-        if ! command -v ${f} &>/dev/null; then
-            echo "${f} is missing in your system, can't continue!" 1>&2
+    for f in "$REQHOST_UTILS"; do
+        if ! command -v "$f" &>/dev/null; then
+            echo "$f is missing in your system, can't continue!" 1>&2
             broken=1
         fi
     done
     [ "$broken" ] && exit 1
-    [ -z "$1" ] && return 0
+    [ "$1" = "" ] && return 0
 
-    for f in ${REQHOST_UTILS_BOOTSTRAP}; do
-        if ! command -v ${f} &>/dev/null; then
-            echo "${f} is missing in your system, can't continue!" 1>&2
+    for f in "$REQHOST_UTILS_BOOTSTRAP"; do
+        if ! command -v "$f" &>/dev/null; then
+            echo "$f is missing in your system, can't continue!" 1>&2
             broken=1
         fi
     done
@@ -262,10 +262,10 @@ check_build_requirements() {
         *bootstrap*) found=1;;
         *) ;;
     esac
-    if [ -z "$found" ]; then
+    if [ "$found" = "" ]; then
         xbps-uhelper cmpver "$XBPS_VERSION" "$XBPS_VERSION_REQ"
         if [ $? -eq 255 ]; then
-            echo "ERROR: requires xbps>=${XBPS_VERSION_REQ}" 1>&2
+            echo "ERROR: requires xbps>=$XBPS_VERSION_REQ" 1>&2
             echo "Bootstrap packages must be updated with 'xbps-src bootstrap-update'" 1>&2
             exit 1
         fi
@@ -273,15 +273,15 @@ check_build_requirements() {
 }
 
 chroot_check() {
-    if [ -f $XBPS_MASTERDIR/.xbps_chroot_init -o "$XBPS_CHROOT_CMD" = "ethereal" ]; then
+    if [ -f "$XBPS_MASTERDIR"/.xbps_chroot_init -o "$XBPS_CHROOT_CMD" = "ethereal" ]; then
         export CHROOT_READY=1
     fi
 }
 
 check_native_arch() {
     if [ "$CHROOT_READY" ]; then
-        if [ -s $XBPS_MASTERDIR/.xbps_chroot_init ]; then
-            export XBPS_ARCH=$(<$XBPS_MASTERDIR/.xbps_chroot_init)
+        if [ -s "$XBPS_MASTERDIR"/.xbps_chroot_init ]; then
+            export XBPS_ARCH=$(<"$XBPS_MASTERDIR"/.xbps_chroot_init)
         else
             export XBPS_ARCH=$(xbps-uhelper arch)
         fi
@@ -305,17 +305,17 @@ masterdir_zap() {
 exit_func() {
     wait
     if [ "$sourcepkg" ]; then
-        remove_pkg $XBPS_CROSS_BUILD
+        remove_pkg "$XBPS_CROSS_BUILD"
     fi
-    if [ -z "$IN_CHROOT" ]; then
+    if [ "$IN_CHROOT" = "" ]; then
         msg_red "xbps-src: a failure has occurred! exiting...\n"
     fi
     exit 2
 }
 
 read_pkg() {
-    if [ -z "${XBPS_TARGET_PKG}" ]; then
-        [ ! -r ./template ] && msg_error "xbps-src: missing build template in $(pwd).\n"
+    if [ "$XBPS_TARGET_PKG" = "" ]; then
+        [ ! -r ./template ] && msg_error "xbps-src: missing build template in $PWD.\n"
         XBPS_TARGET_PKG=${PWD##*/}
     fi
     setup_pkg "$XBPS_TARGET_PKG" "$XBPS_CROSS_BUILD" "$1"
@@ -325,7 +325,7 @@ setup_distfiles_mirror() {
     local mirror scheme path
 
     # Scheme file:// mirror locations only work with uchroot
-    for mirror in $XBPS_DISTFILES_MIRROR; do
+    for mirror in "${XBPS_DISTFILES_MIRROR[@]}"; do
         scheme="file"
         if [[ "$mirror" == *://* ]]; then
             scheme="${mirror%%://*}"
@@ -345,7 +345,7 @@ setup_distfiles_mirror() {
             case "$XBPS_TARGET" in
                 fetch|extract|patch|configure|build|check|install|pkg|bootstrap|bootstrap-update|update-sys)
                     msg_warn "xbps-src: File URLs ($mirror) don't work with '$XBPS_CHROOT_CMD'\n"
-            esac
+            ;; esac
         fi
     done
 }
@@ -365,7 +365,7 @@ XBPS_OPTIONS=
 XBPS_OPTSTRING="1a:bc:CEfgGhH:iIj:Lm:No:p:qsQKr:tV"
 
 # Preprocess arguments in order to allow options before and after XBPS_TARGET.
-eval set -- $(getopt "$XBPS_OPTSTRING" "$@");
+eval set -- "$(getopt "$XBPS_OPTSTRING" "$@")";
 
 # Options are saved as XBPS_ARG_FOO instead of XBPS_FOO for now; this is
 # because configuration files may override those and we want arguments to
@@ -438,51 +438,51 @@ if [ "$IN_CHROOT" ]; then
     readonly XBPS_MASTERDIR=/
     readonly XBPS_HOSTDIR=/host
 else
-    _distdir="$(readlink -f ${0%/*})"
-    if [ "${_distdir}" = "." ]; then
+    _distdir="$(readlink -f "${0%/*}")"
+    if [ "$_distdir" = "." ]; then
         readonly XBPS_DISTDIR="$(pwd -P)"
     else
-        readonly XBPS_DISTDIR="${_distdir}"
+        readonly XBPS_DISTDIR="$_distdir"
     fi
     # Read defaults and then the local configuration file
-    if [ -f $XBPS_DISTDIR/etc/defaults.conf ]; then
-        . $XBPS_DISTDIR/etc/defaults.conf
+    if [ -f "$XBPS_DISTDIR"/etc/defaults.conf ]; then
+        . "$XBPS_DISTDIR"/etc/defaults.conf
     fi
-    if [ -n "$XBPS_ARG_CONFIG" -a -s $XBPS_DISTDIR/etc/conf.$XBPS_ARG_CONFIG ]; then
+    if [ "$XBPS_ARG_CONFIG" != "" -a -s "$XBPS_DISTDIR/etc/conf.$XBPS_ARG_CONFIG" ]; then
         # If specified, read custom user configuration...
         readonly XBPS_CONFIG_FILE=$XBPS_DISTDIR/etc/conf.$XBPS_ARG_CONFIG
-    elif [ -s $XBPS_DISTDIR/etc/conf ]; then
+    elif [ -s "$XBPS_DISTDIR"/etc/conf ]; then
         # ... otherwise read generic user configuration...
         readonly XBPS_CONFIG_FILE=$XBPS_DISTDIR/etc/conf
-    elif [ -s ${XDG_CONFIG_HOME:-$HOME/.config}/xbps-src.conf ]; then
+    elif [ -s "${XDG_CONFIG_HOME:-$HOME/.config}"/xbps-src.conf ]; then
         readonly XBPS_CONFIG_FILE=${XDG_CONFIG_HOME:-$HOME/.config}/xbps-src.conf
-    elif [ -s $HOME/.xbps-src.conf ]; then
+    elif [ -s "$HOME"/.xbps-src.conf ]; then
         # ... fallback to ~/.xbps-src.conf otherwise.
         readonly XBPS_CONFIG_FILE=$HOME/.xbps-src.conf
     fi
 fi
 # Read settings from config file
-[ -s "$XBPS_CONFIG_FILE" ] && . $XBPS_CONFIG_FILE &>/dev/null
+[ -s "$XBPS_CONFIG_FILE" ] && . "$XBPS_CONFIG_FILE" &>/dev/null
 
 # Set options passed on command line, after configuration files have been read
-[ -n "$XBPS_ARG_BUILD_ONLY_ONE_PKG" ] && XBPS_BUILD_ONLY_ONE_PKG=yes
-[ -n "$XBPS_ARG_IGNORE_BROKENNESS" ] && XBPS_IGNORE_BROKENNESS=1
-[ -n "$XBPS_ARG_SKIP_REMOTEREPOS" ] && XBPS_SKIP_REMOTEREPOS=1
-[ -n "$XBPS_ARG_BUILD_FORCEMODE" ] && XBPS_BUILD_FORCEMODE=1
-[ -n "$XBPS_ARG_INFORMATIVE_RUN" ] && XBPS_INFORMATIVE_RUN=1
-[ -n "$XBPS_ARG_TEMP_MASTERDIR" ] && XBPS_TEMP_MASTERDIR=1
-[ -n "$XBPS_ARG_BINPKG_EXISTS" ] && XBPS_BINPKG_EXISTS=1
-[ -n "$XBPS_ARG_USE_GIT_REVS" ] && XBPS_USE_GIT_REVS=1
-[ -n "$XBPS_ARG_DEBUG_PKGS" ] && XBPS_DEBUG_PKGS=1
-[ -n "$XBPS_ARG_SKIP_DEPS" ] && XBPS_SKIP_DEPS=1
-[ -n "$XBPS_ARG_KEEP_ALL" ] && XBPS_KEEP_ALL=1
-[ -n "$XBPS_ARG_QUIET" ] && XBPS_QUIET=1
-[ -n "$XBPS_ARG_PRINT_VARIABLES" ] && XBPS_PRINT_VARIABLES="$XBPS_ARG_PRINT_VARIABLES"
-[ -n "$XBPS_ARG_ALT_REPOSITORY" ] && XBPS_ALT_REPOSITORY="$XBPS_ARG_ALT_REPOSITORY"
-[ -n "$XBPS_ARG_STRICT" ] && XBPS_STRICT="$XBPS_ARG_STRICT"
-[ -n "$XBPS_ARG_CROSS_BUILD" ] && XBPS_CROSS_BUILD="$XBPS_ARG_CROSS_BUILD"
-[ -n "$XBPS_ARG_CHECK_PKGS" ] && XBPS_CHECK_PKGS="$XBPS_ARG_CHECK_PKGS"
-[ -n "$XBPS_ARG_MAKEJOBS" ] && XBPS_MAKEJOBS="$XBPS_ARG_MAKEJOBS"
+[ "$XBPS_ARG_BUILD_ONLY_ONE_PKG" != "" ] && XBPS_BUILD_ONLY_ONE_PKG=yes
+[ "$XBPS_ARG_IGNORE_BROKENNESS" != "" ] && XBPS_IGNORE_BROKENNESS=1
+[ "$XBPS_ARG_SKIP_REMOTEREPOS" != "" ] && XBPS_SKIP_REMOTEREPOS=1
+[ "$XBPS_ARG_BUILD_FORCEMODE" != "" ] && XBPS_BUILD_FORCEMODE=1
+[ "$XBPS_ARG_INFORMATIVE_RUN" != "" ] && XBPS_INFORMATIVE_RUN=1
+[ "$XBPS_ARG_TEMP_MASTERDIR" != "" ] && XBPS_TEMP_MASTERDIR=1
+[ "$XBPS_ARG_BINPKG_EXISTS" != "" ] && XBPS_BINPKG_EXISTS=1
+[ "$XBPS_ARG_USE_GIT_REVS" != "" ] && XBPS_USE_GIT_REVS=1
+[ "$XBPS_ARG_DEBUG_PKGS" != "" ] && XBPS_DEBUG_PKGS=1
+[ "$XBPS_ARG_SKIP_DEPS" != "" ] && XBPS_SKIP_DEPS=1
+[ "$XBPS_ARG_KEEP_ALL" != "" ] && XBPS_KEEP_ALL=1
+[ "$XBPS_ARG_QUIET" != "" ] && XBPS_QUIET=1
+[ "$XBPS_ARG_PRINT_VARIABLES" != "" ] && XBPS_PRINT_VARIABLES="$XBPS_ARG_PRINT_VARIABLES"
+[ "$XBPS_ARG_ALT_REPOSITORY" != "" ] && XBPS_ALT_REPOSITORY="$XBPS_ARG_ALT_REPOSITORY"
+[ "$XBPS_ARG_STRICT" != "" ] && XBPS_STRICT="$XBPS_ARG_STRICT"
+[ "$XBPS_ARG_CROSS_BUILD" != "" ] && XBPS_CROSS_BUILD="$XBPS_ARG_CROSS_BUILD"
+[ "$XBPS_ARG_CHECK_PKGS" != "" ] && XBPS_CHECK_PKGS="$XBPS_ARG_CHECK_PKGS"
+[ "$XBPS_ARG_MAKEJOBS" != "" ] && XBPS_MAKEJOBS="$XBPS_ARG_MAKEJOBS"
 
 export XBPS_BUILD_ONLY_ONE_PKG XBPS_SKIP_REMOTEREPOS XBPS_BUILD_FORCEMODE \
        XBPS_INFORMATIVE_RUN XBPS_TEMP_MASTERDIR XBPS_BINPKG_EXISTS \
@@ -491,29 +491,29 @@ export XBPS_BUILD_ONLY_ONE_PKG XBPS_SKIP_REMOTEREPOS XBPS_BUILD_FORCEMODE \
        XBPS_MAKEJOBS XBPS_PRINT_VARIABLES XBPS_IGNORE_BROKENNESS
 
 # The masterdir/hostdir variables are forced and readonly in chroot
-if [ -z "$IN_CHROOT" ]; then
-    [ -n "$XBPS_ARG_MASTERDIR" ] && XBPS_MASTERDIR="$XBPS_ARG_MASTERDIR"
-    [ -n "$XBPS_ARG_HOSTDIR" ] && XBPS_HOSTDIR="$XBPS_ARG_HOSTDIR"
+if [ "$IN_CHROOT" = "" ]; then
+    [ "$XBPS_ARG_MASTERDIR" != "" ] && XBPS_MASTERDIR="$XBPS_ARG_MASTERDIR"
+    [ "$XBPS_ARG_HOSTDIR" != "" ] && XBPS_HOSTDIR="$XBPS_ARG_HOSTDIR"
 
     # Sanitize masterdir/hostdir once set for real (resolve links)
-    export XBPS_MASTERDIR="$(readlink -f $XBPS_MASTERDIR 2>/dev/null)"
-    export XBPS_HOSTDIR="$(readlink -f $XBPS_HOSTDIR 2>/dev/null)"
+    export XBPS_MASTERDIR="$(readlink -f "$XBPS_MASTERDIR" 2>/dev/null)"
+    export XBPS_HOSTDIR="$(readlink -f "$XBPS_HOSTDIR" 2>/dev/null)"
 fi
 
 # Forbid root unless XBPS_ALLOW_CHROOT_BREAKOUT is set
 # (for CI).
-if [ -z "$IN_CHROOT" -a "$UID" -eq 0 -a -z "$XBPS_ALLOW_CHROOT_BREAKOUT" ]; then
+if [ "$IN_CHROOT" = "" -a "$UID" -eq 0 -a -z "$XBPS_ALLOW_CHROOT_BREAKOUT" ]; then
     echo "ERROR: xbps-src cannot be used as root." 1>&2
     exit 1
 fi
 
 # if XBPS_MASTERDIR unset, defaults to $XBPS_DISTDIR/masterdir.
-: ${XBPS_MASTERDIR:=$XBPS_DISTDIR/masterdir}
-[ ! -d $XBPS_MASTERDIR ] &&  mkdir -p $XBPS_MASTERDIR
+: "${XBPS_MASTERDIR:=$XBPS_DISTDIR/masterdir}"
+[ ! -d "$XBPS_MASTERDIR" ] &&  mkdir -p "$XBPS_MASTERDIR"
 
 # if XBPS_HOSTDIR unset, defaults to $XBPS_DISTDIR/hostdir.
-: ${XBPS_HOSTDIR:=$XBPS_DISTDIR/hostdir}
-[ ! -d $XBPS_HOSTDIR ] && mkdir -p $XBPS_HOSTDIR
+: "${XBPS_HOSTDIR:=$XBPS_DISTDIR/hostdir}"
+[ ! -d "$XBPS_HOSTDIR" ] && mkdir -p "$XBPS_HOSTDIR"
 
 if [ -d "$XBPS_MASTERDIR" -a ! -w "$XBPS_MASTERDIR" ]; then
     echo "ERROR: can't write to masterdir $XBPS_MASTERDIR." 1>&2
@@ -525,12 +525,12 @@ if command -v chroot-git &>/dev/null; then
     export XBPS_GIT_CMD=$(command -v chroot-git)
 elif command -v git &>/dev/null; then
     export XBPS_GIT_CMD=$(command -v git)
-elif [ -z "$XBPS_USE_BUILD_MTIME" ] || [ "$XBPS_USE_GIT_REVS" ]; then
+elif [ "$XBPS_USE_BUILD_MTIME" = "" ] || [ "$XBPS_USE_GIT_REVS" ]; then
     echo "neither chroot-git or git are available in your system!" 1>&2
     exit 1
 fi
 
-if [ -n "$XBPS_HOSTDIR" ]; then
+if [ "$XBPS_HOSTDIR" != "" ]; then
     export XBPS_REPOSITORY=$XBPS_HOSTDIR/binpkgs
     readonly XBPS_SRCDISTDIR=$XBPS_HOSTDIR/sources
 else
@@ -539,17 +539,17 @@ else
 fi
 
 # Set XBPS_REPOSITORY to our current branch.
-if [ -z "$XBPS_ALT_REPOSITORY" ]; then
+if [ "$XBPS_ALT_REPOSITORY" = "" ]; then
     pushd "$PWD" &>/dev/null
-    cd $XBPS_DISTDIR
-    _gitbranch="$($XBPS_GIT_CMD symbolic-ref --short HEAD 2>/dev/null)"
-    if [ "${_gitbranch}" -a "${_gitbranch}" != "master" ]; then
-        export XBPS_ALT_REPOSITORY="${_gitbranch}"
-        export XBPS_REPOSITORY="${XBPS_REPOSITORY}/${_gitbranch}"
+    cd "$XBPS_DISTDIR"
+    _gitbranch="$("$XBPS_GIT_CMD" symbolic-ref --short HEAD 2>/dev/null)"
+    if [ "$_gitbranch" -a "$_gitbranch" != "master" ]; then
+        export XBPS_ALT_REPOSITORY="$_gitbranch"
+        export XBPS_REPOSITORY="$XBPS_REPOSITORY/$_gitbranch"
      fi
      popd &>/dev/null
 else
-    export XBPS_REPOSITORY="${XBPS_REPOSITORY}/${XBPS_ALT_REPOSITORY}"
+    export XBPS_REPOSITORY="$XBPS_REPOSITORY/$XBPS_ALT_REPOSITORY"
 fi
 
 readonly XBPS_SRCPKGDIR=$XBPS_DISTDIR/srcpkgs
@@ -590,14 +590,14 @@ linux32_check() {
 }
 
 # Reconfigure pkgs for 32bit on 64-bit systems and reexec itself.
-if [ -z "$XBPS_REINIT" -a -s $XBPS_MASTERDIR/.xbps_chroot_init ]; then
+if [ "$XBPS_REINIT" = "" -a -s "$XBPS_MASTERDIR"/.xbps_chroot_init ]; then
     export XBPS_ARCH=${XBPS_ARCH:-$(<$XBPS_MASTERDIR/.xbps_chroot_init)}
     if linux32_check "$XBPS_MACHINE" "$XBPS_ARCH"; then
         # reconfigure pkgs via linux32
-        linux32 xbps-reconfigure -r ${XBPS_MASTERDIR} -a &>/dev/null
+        linux32 xbps-reconfigure -r "$XBPS_MASTERDIR" -a &>/dev/null
         # reexec itself via linux32
         export XBPS_REINIT=1
-        exec linux32 $0 ${XBPS_OPTIONS} $@
+        exec linux32 "$0" "$XBPS_OPTIONS" "$@"
     fi
 fi
 if [ "$XBPS_ARCH" ]; then
@@ -605,7 +605,7 @@ if [ "$XBPS_ARCH" ]; then
 fi
 # At this point if XBPS_TARGET_MACHINE isn't defined we assume
 # it's a native build.
-if [ -z "$XBPS_TARGET_MACHINE" ]; then
+if [ "$XBPS_TARGET_MACHINE" = "" ]; then
         export XBPS_TARGET_MACHINE=$XBPS_MACHINE
 fi
 
@@ -653,21 +653,21 @@ export XBPS_SHUTILSDIR XBPS_CROSSPFDIR XBPS_TRIGGERSDIR \
 for i in REPOSITORY DESTDIR BUILDDIR SRCDISTDIR; do
     eval val="\$XBPS_$i"
     if [ ! -d "$val" ]; then
-        mkdir -p $val
+        mkdir -p "$val"
     fi
     unset val
 done
 
 # A temporary masterdir requires xbps-uchroot(1) and -O to use overlayfs
 # on tmpfs (available with xbps-0.45).
-if [ -z "$IN_CHROOT" -a -n "$XBPS_TEMP_MASTERDIR" ]; then
+if [ "$IN_CHROOT" = "" -a -n "$XBPS_TEMP_MASTERDIR" ]; then
     export XBPS_CHROOT_CMD="uchroot"
     export XBPS_CHROOT_CMD_ARGS+=" -O"
 fi
 #
 # Sanitize PATH.
 #
-if [ -z "$IN_CHROOT" ]; then
+if [ "$IN_CHROOT" = "" ]; then
     # In non chroot case always prefer host tools.
     export PATH="$PATH:$XBPS_MASTERDIR/usr/bin"
 fi
@@ -682,7 +682,7 @@ if [ "$XBPS_CCACHE" ]; then
     # changes when e.g. bootstrapping
     export CCACHE_COMPILERCHECK=content CCACHE_COMPRESS=1
     export PATH="$CCACHEPATH:$PATH"
-    mkdir -p $CCACHE_DIR
+    mkdir -p "$CCACHE_DIR"
 fi
 
 #
@@ -697,7 +697,7 @@ if [ "$XBPS_DISTCC" ]; then
     fi
     export DISTCC_DIR="$XBPS_HOSTDIR/distcc-${XBPS_CROSS_BUILD:-${XBPS_MACHINE}}"
     export DISTCC_HOSTS="$XBPS_DISTCC_HOSTS"
-    mkdir -p $DISTCC_DIR
+    mkdir -p "$DISTCC_DIR"
 fi
 
 check_build_requirements
@@ -705,13 +705,13 @@ check_build_requirements
 #
 # Read funcs from helpers
 #
-for f in ${XBPS_SHUTILSDIR}/*.sh; do
-    [ -r "$f" ] && . $f
+for f in "$XBPS_SHUTILSDIR"/*.sh; do
+    [ -r "$f" ] && . "$f"
 done
 
-if [ -z "$IN_CHROOT" ]; then
+if [ "$IN_CHROOT" = "" ]; then
     trap 'exit_func' INT TERM
-    if [ -n "$XBPS_DISTFILES_MIRROR" ]; then
+    if [ "$XBPS_DISTFILES_MIRROR" != "" ]; then
         setup_distfiles_mirror
     fi
 fi
@@ -723,10 +723,10 @@ reconfigure_base_chroot
 #
 case "$XBPS_TARGET" in
     binary-bootstrap)
-        install_base_chroot ${XBPS_TARGET_PKG:=$XBPS_MACHINE}
+        install_base_chroot "${XBPS_TARGET_PKG:=$XBPS_MACHINE}"
         ;;
     bootstrap)
-        if [ -n "$XBPS_CHECK_PKGS" ]; then
+        if [ "$XBPS_CHECK_PKGS" != "" ]; then
             msg_error "xbps-src: disable tests for bootstrap\n"
             exit 1
         fi
@@ -737,14 +737,14 @@ case "$XBPS_TARGET" in
             export XBPS_ARCH=$XBPS_MACHINE
             export XBPS_SKIP_REMOTEREPOS=1
             chroot_sync_repodata
-            $XBPS_LIBEXECDIR/build.sh \
-                base-chroot base-chroot $XBPS_TARGET || exit 1
+            "$XBPS_LIBEXECDIR"/build.sh \
+                base-chroot base-chroot "$XBPS_TARGET" || exit 1
         ) || exit 1
-        [ -d $XBPS_MASTERDIR ] && rm -rf $XBPS_MASTERDIR
-        install_base_chroot ${XBPS_TARGET_PKG:=$XBPS_MACHINE}
+        [ -d "$XBPS_MASTERDIR" ] && rm -rf "$XBPS_MASTERDIR"
+        install_base_chroot "${XBPS_TARGET_PKG:=$XBPS_MACHINE}"
         ;;
     bootstrap-update)
-        if [ -n "$CHROOT_READY" -a -z "$IN_CHROOT" ]; then
+        if [ "$CHROOT_READY" != "" -a -z "$IN_CHROOT" ]; then
             chroot_handler bootstrap-update
         else
             chroot_sync_repodata
@@ -756,24 +756,24 @@ case "$XBPS_TARGET" in
         chroot_handler chroot dummy
         ;;
     clean)
-        if [ -z "$XBPS_TARGET_PKG" ]; then
-            if [ -n "$CHROOT_READY" -a -z "$IN_CHROOT" ]; then
+        if [ "$XBPS_TARGET_PKG" = "" ]; then
+            if [ "$CHROOT_READY" != "" -a -z "$IN_CHROOT" ]; then
                 chroot_handler remove-autodeps
             else
                 remove_pkg_autodeps
             fi
             msg_normal "xbps-src: cleaning up masterdir...\n"
             # Needed to remove Go Modules
-            [ -d "$XBPS_BUILDDIR" ] && chmod -R +wX $XBPS_BUILDDIR
+            [ -d "$XBPS_BUILDDIR" ] && chmod -R +wX "$XBPS_BUILDDIR"
             rm -rf \
-                $XBPS_BUILDDIR \
-                $XBPS_DESTDIR
-            rm -rf $XBPS_MASTERDIR/tmp
-            mkdir -p $XBPS_MASTERDIR/tmp
+                "$XBPS_BUILDDIR" \
+                "$XBPS_DESTDIR"
+            rm -rf "$XBPS_MASTERDIR"/tmp
+            mkdir -p "$XBPS_MASTERDIR"/tmp
         else
             read_pkg
-            if [ -n "$CHROOT_READY" -a -z "$IN_CHROOT" ]; then
-                chroot_handler $XBPS_TARGET $XBPS_TARGET_PKG || exit $?
+            if [ "$CHROOT_READY" != "" -a -z "$IN_CHROOT" ]; then
+                chroot_handler "$XBPS_TARGET" "$XBPS_TARGET_PKG" || exit $?
             else
                 if declare -f do_clean >/dev/null; then
                     run_func do_clean
@@ -781,52 +781,52 @@ case "$XBPS_TARGET" in
                 remove_pkg_wrksrc
                 remove_pkg_statedir
             fi
-            remove_pkg $XBPS_CROSS_BUILD
+            remove_pkg "$XBPS_CROSS_BUILD"
         fi
         ;;
     clean-repocache)
         export XBPS_TARGET_ARCH="${XBPS_CROSS_BUILD:-$XBPS_TARGET_MACHINE}"
-        $XBPS_REMOVE_CMD -C /dev/null -c $XBPS_HOSTDIR/repocache-${XBPS_TARGET_ARCH} -O
+        "$XBPS_REMOVE_CMD" -C /dev/null -c "$XBPS_HOSTDIR/repocache-$XBPS_TARGET_ARCH" -O
         ;;
     consistency-check)
         consistency_check
         ;;
     remove-autodeps)
-        if [ -n "$CHROOT_READY" -a -z "$IN_CHROOT" ]; then
+        if [ "$CHROOT_READY" != "" -a -z "$IN_CHROOT" ]; then
             chroot_handler remove-autodeps
         else
             remove_pkg_autodeps
         fi
         ;;
     fetch|extract|patch|configure|build|check|install|pkg)
-        if [ "$XBPS_TARGET" = "check" ] && [ -z "$XBPS_CHECK_PKGS" ]; then
+        if [ "$XBPS_TARGET" = "check" ] && [ "$XBPS_CHECK_PKGS" = "" ]; then
             export XBPS_CHECK_PKGS=full
         fi
         read_pkg
-        if [ -n "$CHROOT_READY" -a -z "$IN_CHROOT" ]; then
-            chroot_handler $XBPS_TARGET $XBPS_TARGET_PKG
+        if [ "$CHROOT_READY" != "" -a -z "$IN_CHROOT" ]; then
+            chroot_handler "$XBPS_TARGET" "$XBPS_TARGET_PKG"
         else
             check_existing_pkg
             chroot_sync_repodata
             # prevent update_base_chroot from removing the builddir/destdir
             update_base_chroot keep-all-force
-            $XBPS_LIBEXECDIR/build.sh $XBPS_TARGET_PKG $XBPS_TARGET_PKG \
-                $XBPS_TARGET $XBPS_CROSS_BUILD || exit $?
+            "$XBPS_LIBEXECDIR"/build.sh "$XBPS_TARGET_PKG" "$XBPS_TARGET_PKG" \
+                "$XBPS_TARGET" "$XBPS_CROSS_BUILD" || exit $?
         fi
         ;;
     remove|remove-destdir)
         read_pkg
-        remove_pkg $XBPS_CROSS_BUILD
+        remove_pkg "$XBPS_CROSS_BUILD"
         ;;
     list)
-        $XBPS_QUERY_CMD -l
+        "$XBPS_QUERY_CMD" -l
         ;;
     purge-distfiles)
         purge_distfiles
         ;;
     show)
         read_pkg ignore-problems
-        show_pkg $XBPS_PRINT_VARIABLES
+        show_pkg "$XBPS_PRINT_VARIABLES"
         ;;
     show-avail)
         read_pkg &>/dev/null
@@ -854,10 +854,10 @@ case "$XBPS_TARGET" in
         ;;
     show-pkg-var-dump)
         read_pkg ignore-problems
-        for sub_name in $subpackages; do
-            if [ $sub_name = $XBPS_TARGET_PKG ]; then
-                . ${XBPS_COMMONDIR}/environment/setup-subpkg/subpkg.sh
-                ${sub_name}_package
+        for sub_name in "${subpackages[@]}"; do
+            if [ "$sub_name" = "$XBPS_TARGET_PKG" ]; then
+                . "$XBPS_COMMONDIR"/environment/setup-subpkg/subpkg.sh
+                "${sub_name}"_package
             fi
         done
         printf "archs: %s\n\n" "$archs"
@@ -878,15 +878,15 @@ case "$XBPS_TARGET" in
         ;;
     show-pkg-var)
         read_pkg ignore-problems
-        for sub_name in $subpackages; do
-            if [ $sub_name = $XBPS_TARGET_PKG ]; then
-                . ${XBPS_COMMONDIR}/environment/setup-subpkg/subpkg.sh
-                ${sub_name}_package
+        for sub_name in "${subpackages[@]}"; do
+            if [ "$sub_name" = "$XBPS_TARGET_PKG" ]; then
+                . "$XBPS_COMMONDIR"/environment/setup-subpkg/subpkg.sh
+                "${sub_name}"_package
             fi
         done
         while IFS= read -r pkg_var; do
                 print_var=
-                case "${pkg_var}" in
+                case "$pkg_var" in
                     archs) print_var="$archs ";;
                     bootstrap) print_var="$bootstrap ";;
                     broken) print_var="$broken ";;
@@ -903,7 +903,7 @@ case "$XBPS_TARGET" in
                     lib32disabled) print_var="$lib32disabled ";;
                     nodebug) print_var="$nodebug ";;
                 esac # the space at the end of each is essential for unset vars
-                if [ -n "$print_var" ]; then
+                if [ "$print_var" != "" ]; then
                         printf "%s\n" "$(printf "${print_var% }" | tr -t '\n\r' ' ')"
                 fi # The trailing space gets stripped before printing anyway
         done
@@ -924,14 +924,14 @@ case "$XBPS_TARGET" in
                 printf ' %s\n' "${arr[@]}"
             fi
         done
-        _cleandeps=$(setup_pkg_depends "" 1 1 | { grep -vF "$(printf "%s\n" $pkgname $subpackages)" || :; } | sort -u) || exit 1
+        _cleandeps=$(setup_pkg_depends "" 1 1 | { grep -vF "$(printf "%s\n" "$pkgname" "$subpackages")" || :; } | sort -u) || exit 1
         if [[ $_cleandeps ]]; then
                 printf 'depends:\n'
-                printf ' %s\n' $_cleandeps
+                printf ' %s\n' "$_cleandeps"
         fi
         if [[ $subpackages ]]; then
             printf 'subpackages:\n'
-            printf ' %s\n' $subpackages
+            printf ' %s\n' "$subpackages"
         fi
         ;;
     show-options)
@@ -947,16 +947,16 @@ case "$XBPS_TARGET" in
         show_pkg_shlib_requires
         ;;
     show-var)
-        for f in ${XBPS_COMMONDIR}/environment/setup/*.sh; do
-            source $f
+        for f in "$XBPS_COMMONDIR"/environment/setup/*.sh; do
+            source "$f"
         done
         if [ "$XBPS_CROSS_BUILD" ]; then
-            source ${XBPS_COMMONDIR}/cross-profiles/${XBPS_CROSS_BUILD}.sh
+            source "$XBPS_COMMONDIR/cross-profiles/$XBPS_CROSS_BUILD".sh
         else
-            source ${XBPS_COMMONDIR}/build-profiles/${XBPS_MACHINE}.sh
+            source "$XBPS_COMMONDIR/build-profiles/$XBPS_MACHINE".sh
         fi
         eval value="\${$XBPS_TARGET_PKG}"
-        echo $value
+        echo "$value"
         ;;
     show-repo-updates)
         bulk_build
@@ -965,7 +965,7 @@ case "$XBPS_TARGET" in
         bulk_build -I
         ;;
     sort-dependencies)
-        bulk_sortdeps ${@/$XBPS_TARGET/}
+        bulk_sortdeps "${@/$XBPS_TARGET/}"
         ;;
     update-bulk)
         bulk_update

Re: xbps-src: make changes suggested by shellharden

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 226 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/pull/38340#issuecomment-1198468123

Comment:
most of these changes either do nothing for functionality or are outright wrong

Re: xbps-src: make changes suggested by shellharden

[ishaanbhimwal]

[-- Attachment #1: Type: text/plain, Size: 326 bytes --]

New comment by ishaanbhimwal on void-packages repository

https://github.com/void-linux/void-packages/pull/38340#issuecomment-1198470815

Comment:
yes this doesn't intend to change the functionality of the existing script but just implement the correct syntax and correct bash syntax. also what are the "outright wrong" part?

Re: [PR REVIEW] xbps-src: make changes suggested by shellharden

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 290 bytes --]

New review comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/pull/38340#discussion_r932537190

Comment:
this, for example, will run the loop only once with the entire value of REQHOST_UTILS, not once per whitespace-separated item in the value

Re: xbps-src: make changes suggested by shellharden

[ishaanbhimwal]

[-- Attachment #1: Type: text/plain, Size: 307 bytes --]

New comment by ishaanbhimwal on void-packages repository

https://github.com/void-linux/void-packages/pull/38340#issuecomment-1198470815

Comment:
yes this doesn't intend to change the functionality of the existing script but just implement the correct bash syntax. also what are the "outright wrong" part?

Re: xbps-src: make changes suggested by shellharden

[classabbyamp]

[-- Attachment #1: Type: text/plain, Size: 282 bytes --]

New comment by classabbyamp on void-packages repository

https://github.com/void-linux/void-packages/pull/38340#issuecomment-1198475746

Comment:
> just implement the correct bash syntax

`-z` in test is perfectly fine bash and POSIX sh syntax, it is not less correct than `= ""`

Re: [PR REVIEW] xbps-src: make changes suggested by shellharden

[Duncaen]

[-- Attachment #1: Type: text/plain, Size: 168 bytes --]

New review comment by Duncaen on void-packages repository

https://github.com/void-linux/void-packages/pull/38340#discussion_r932539574

Comment:
This is not an array.

Re: [PR PATCH] [Closed]: xbps-src: make changes suggested by shellharden

[ishaanbhimwal]

[-- Attachment #1: Type: text/plain, Size: 1102 bytes --]

There's a closed pull request on the void-packages repository

xbps-src: make changes suggested by shellharden
https://github.com/void-linux/void-packages/pull/38340

Description:
<!-- Uncomment relevant sections and delete options which are not applicable -->

#### Testing the changes
- I tested the changes in this PR: **YES**

<!--
#### New package
- This new package conforms to the [quality requirements](https://github.com/void-linux/void-packages/blob/master/Manual.md#quality-requirements): **YES**|**NO**
-->

<!-- Note: If the build is likely to take more than 2 hours, please add ci skip tag as described in
https://github.com/void-linux/void-packages/blob/master/CONTRIBUTING.md#continuous-integration
and test at least one native build and, if supported, at least one cross build.
Ignore this section if this PR is not skipping CI.
-->
<!--
#### Local build testing
- I built this PR locally for my native architecture, (ARCH-LIBC)
- I built this PR locally for these architectures (if supported. mark crossbuilds):
  - aarch64-musl
  - armv7l
  - armv6l-musl
-->