KNEL/PFVCluster
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: enforce shellcheck across the repo

Browse Source 
Establish shellcheck as a mandatory pre-commit quality gate and bring all 93
shell scripts to a clean state.

- tests/shellcheck.sh: wrapper that runs koalaman/shellcheck:stable via Docker
  (no native binary needed), skips vendored + upstream librenms-agent scripts.
- .shellcheckrc: documents intentional codebase-wide disables (dynamic source
  paths SC1090/SC1091, client-side ssh expansion SC2029).
- AGENTS.md: new Git Policy rule mandating clean shellcheck for every shell
  script before commit.

Fixes applied (real bugs + quality): missing quote in netinfra/gather-configs.sh
(caused cascading parse errors), unquoted expansions, declare-and-assign masking,
egrep -> grep -E, $FUNCNAME array indexing, unused variable removal, cd || exit.
Intentional patterns (sourced config, sysfs/ps diagnostics, ssh heredocs that
expand local config) get justified targeted disables.

💘 Generated with Crush

Assisted-by: Crush:glm-5.2
This commit is contained in:
mrcharles
2026-07-30 08:56:31 -05:00
parent 54e9927167
commit 0fa0692c37
37 changed files with 226 additions and 89 deletions
Download Patch File Download Diff File Expand all files Collapse all files
provisioning/Dell/Server/fixeth.sh
+7 -6
View File
@@ -5,17 +5,18 @@
#magic to detect main int
echo "Determining management interface..."
#export MAIN_INT=$(brctl show $(netstat -rn|grep 0.0.0.0|head -n1|awk '{print $NF}') | awk '{print $NF}'|tail -1|awk -F '.' '{print $1}')
export MAIN_INT=$(brctl show|grep vmbr0|awk '{print $NF}'|awk -F '.' '{print $1}')
MAIN_INT=$(brctl show|grep vmbr0|awk '{print $NF}'|awk -F '.' '{print $1}')
export MAIN_INT
echo "Management interface is: $MAIN_INT"
#fix the issue
echo "Fixing management interface..."
ethtool -K $MAIN_INT tso off
ethtool -K $MAIN_INT gro off
ethtool -K $MAIN_INT gso off
ethtool -K $MAIN_INT tx off
ethtool -K $MAIN_INT rx off
ethtool -K "$MAIN_INT" tso off
ethtool -K "$MAIN_INT" gro off
ethtool -K "$MAIN_INT" gso off
ethtool -K "$MAIN_INT" tx off
ethtool -K "$MAIN_INT" rx off
#https://forum.proxmox.com/threads/e1000-driver-hang.58284/
#https://serverfault.com/questions/616485/e1000e-reset-adapter-unexpectedly-detected-hardware-unit-hang
provisioning/Modules/Auth/auth-cloudron-ldap.sh
+4
View File
@@ -0,0 +1,4 @@
#!/usr/bin/env bash
# auth-cloudron-ldap.sh — placeholder module (Cloudron LDAP auth integration).
# Intentionally empty; populated when the auth stack is deployed.
true
provisioning/Modules/RandD/sslStackFromSource.sh
+13 -12
View File
@@ -1,4 +1,5 @@
#!/bin/bash
# shellcheck disable=SC2103 # legacy R&D build script; cd/cd- sequence is intentional
#Made from instructions at https://www.tunetheweb.com/performance/http2/
@@ -24,17 +25,17 @@ CURL_FILE="curl-7.60.0.tar.gz"
#Download and install latest version of openssl
wget $OPENSSL_URL_BASE/$OPENSSL_FILE
tar xzf $OPENSSL_FILE
cd openssl-1.1.0h
cd openssl-1.1.0h || exit
./config enable-weak-ssl-ciphers shared zlib-dynamic -DOPENSSL_TLS_SECURITY_LEVEL=0 --prefix=/usr/local/custom-ssl/openssl-1.1.0h ; make ; make install
ln -s /usr/local/custom-ssl/openssl-1.1.0h /usr/local/openssl
cd -
cd - || exit
#Download and install nghttp2 (needed for mod_http2).
wget $NGHTTP_URL_BASE/$NGHTTP_FILE
tar xzf $NGHTTP_FILE
cd nghttp2-1.31.0
cd nghttp2-1.31.0 || exit
./configure --prefix=/usr/local/custom-ssl/nghttp ; make ; make install
cd -
cd - || exit
#Updated ldconfig so curl build
@@ -48,34 +49,34 @@ ldconfig
#Download and install curl
wget $CURL_URL_BASE/$CURL_FILE
tar xzf curl-7.60.0.tar.gz
cd curl-7.60.0
cd curl-7.60.0 || exit
./configure --prefix=/usr/local/custom-ssl/curl --with-nghttp2=/usr/local/custom-ssl/nghttp/ --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ ; make ; make install
cd -
cd - || exit
#Download and install latest apr
wget $APR_URL_BASE/$APR_FILE
tar xzf $APR_FILE
cd apr-1.6.3
cd apr-1.6.3 || exit
./configure --prefix=/usr/local/custom-ssl/apr ; make ; make install
cd -
cd - || exit
#Download and install latest apr-util
wget $APR_UTIL_URL_BASE/$APR_UTIL_FILE
tar xzf apr-util-1.6.1.tar.gz
cd apr-util-1.6.1
cd apr-util-1.6.1 || exit
./configure --prefix=/usr/local/custom-ssl/apr-util --with-apr=/usr/local/custom-ssl/apr ; make; make install
cd -
cd - || exit
#Download and install apache
wget $APACHE_URL_BASE/$APACHE_FILE
tar xzf httpd-2.4.33.tar.gz
cd httpd-2.4.33
cd httpd-2.4.33 || exit
cp -r ../apr-1.6.3 srclib/apr
cp -r ../apr-util-1.6.1 srclib/apr-util
./configure --prefix=/usr/local/custom-ssl/apache --with-ssl=/usr/local/custom-ssl/openssl-1.1.0h/ --with-pcre=/usr/bin/pcre-config --enable-unique-id --enable-ssl --enable-so --with-included-apr --enable-http2 --with-nghttp2=/usr/local/custom-ssl/nghttp/
make
make install
ln -s /usr/local/custom-ssl/apache /usr/local/apache
cd -
cd - || exit
provisioning/Modules/Security/secharden-ssh.sh
+1 -1
View File
@@ -79,7 +79,7 @@ if [ "$SUBODEV_CHECK" = 1 ]; then
fi
export DEV_WORKSTATION_CHECK
DEV_WORKSTATION_CHECK="$(hostname | egrep -c 'subopi-dev|CharlesDevServer' || true)"
DEV_WORKSTATION_CHECK="$(hostname | grep -Ec 'subopi-dev|CharlesDevServer' || true)"
if [ "$DEV_WORKSTATION_CHECK" -eq 0 ]; then
provisioning/Project-Includes/PreflightCheck.sh
+1 -1
View File
@@ -9,7 +9,7 @@ export user_check
user_check="$(echo "$curr_user" | grep -c root)"
if [ $user_check -ne 1 ]; then
if [ "$user_check" -ne 1 ]; then
print_error "Must run as root."
error_out
fi
provisioning/Project-Includes/pi-detect.sh
+3 -3
View File
@@ -1,7 +1,7 @@
# shellcheck shell=bash disable=SC2148 # sourced function file (no shebang by design)
function pi-detect()
{
print_info Now running "$FUNCNAME"....
print_info Now running "${FUNCNAME[0]}"....
if [ -f /sys/firmware/devicetree/base/model ] ; then
export IS_RASPI="1"
fi
@@ -9,5 +9,5 @@ fi
if [ ! -f /sys/firmware/devicetree/base/model ] ; then
export IS_RASPI="0"
fi
print_info Completed running "$FUNCNAME"
print_info Completed running "${FUNCNAME[0]}"
}
provisioning/SetupNewSystem.sh
+26 -26
View File
@@ -60,18 +60,18 @@ LOCALUSER_CHECK="$(getent passwd | grep -c localuser || true)"
#######################
function global-oam() {
print_info "Now running $FUNCNAME...."
print_info "Now running ${FUNCNAME[0]}...."
cat "$SCRIPTS_PATH/up2date.sh" >/usr/local/bin/up2date.sh && chmod +x /usr/local/bin/up2date.sh
bash "$MODULES_PATH/OAM/oam-librenms.sh"
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function global-systemServiceConfigurationFiles() {
print_info "Now running $FUNCNAME...."
print_info "Now running ${FUNCNAME[0]}...."
cat "$CONFIGFILES_PATH/ZSH/tsys-zshrc" >/etc/zshrc
cat "$CONFIGFILES_PATH/SMTP/aliases" >/etc/aliases
@@ -79,11 +79,11 @@ function global-systemServiceConfigurationFiles() {
newaliases
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function global-installPackages() {
print_info "Now running $FUNCNAME...."
print_info "Now running ${FUNCNAME[0]}...."
# Setup webmin repo, used for RBAC/2fa PAM
@@ -195,7 +195,7 @@ function global-installPackages() {
VIRT_TYPE="$(virt-what)"
export IS_VIRT_GUEST
IS_VIRT_GUEST="$(echo "$VIRT_TYPE" | egrep -c 'hyperv|kvm' || true)"
IS_VIRT_GUEST="$(echo "$VIRT_TYPE" | grep -Ec 'hyperv|kvm' || true)"
export IS_KVM_GUEST
IS_KVM_GUEST="$(echo "$VIRT_TYPE" | grep -c 'kvm' || true)"
@@ -227,12 +227,12 @@ function global-installPackages() {
# vault cli
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function global-postPackageConfiguration() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
systemctl --now enable auditd
@@ -253,7 +253,7 @@ function global-postPackageConfiguration() {
#This is under test/dev and may fail
echo "hi from root to root" | mail -s "hi directly to root from $(hostname)" root
chsh -s $(which zsh) root
chsh -s "$(which zsh)" root
if [ "$LOCALUSER_CHECK" -gt 0 ]; then
chsh -s "$(which zsh)" localuser
@@ -312,7 +312,7 @@ function global-postPackageConfiguration() {
fi
export NTP_SERVER_CHECK
NTP_SERVER_CHECK="$(hostname | egrep -c 'pfv-netboot|pfvsvrpi|pfv-netinfra' || true)"
NTP_SERVER_CHECK="$(hostname | grep -Ec 'pfv-netboot|pfvsvrpi|pfv-netinfra' || true)"
if [ "$NTP_SERVER_CHECK" -eq 0 ]; then
@@ -341,7 +341,7 @@ function global-postPackageConfiguration() {
tuned-adm profile virtual-guest
fi
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
####################################################################################################
@@ -355,41 +355,41 @@ function global-postPackageConfiguration() {
# SSH
function secharden-ssh() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
bash "$MODULES_PATH/Security/secharden-ssh.sh"
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function secharden-wazuh() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
bash "$MODULES_PATH/Security/secharden-wazuh.sh"
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function secharden-2fa() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
bash "$MODULES_PATH/Security/secharden-2fa.sh"
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function secharden-scap-stig() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
bash "$MODULES_PATH/Security/secharden-scap-stig.sh"
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function secharden-agents() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
bash "$MODULES_PATH/Security/secharden-audit-agents.sh"
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
function secharden-auto-upgrades() {
print_info "Now running $FUNCNAME"
print_info "Now running ${FUNCNAME[0]}"
#curl --silent ${DL_ROOT}/Modules/Security/secharden-ssh.sh|$(which bash)
print_info "Completed running $FUNCNAME"
print_info "Completed running ${FUNCNAME[0]}"
}
@@ -400,16 +400,16 @@ function secharden-auto-upgrades() {
####################################################################################################
function auth-cloudron-ldap() {
print_info "Now running "$FUNCNAME""
print_info "Now running ${FUNCNAME[0]}"
#curl --silent ${DL_ROOT}/Modules/Auth/auth-cloudron-ldap.sh|$(which bash)
print_info "Completed running "$FUNCNAME""
print_info "Completed running ${FUNCNAME[0]}"
}
####################################################################################################
# RUn the various functions in the correct order
####################################################################################################
echo >$LOGFILENAME
echo >"$LOGFILENAME"
print_info "Execution starting at $CURRENT_TIMESTAMP..."
provisioning/legacy/profiled-tmux.sh
+1
View File
@@ -1,3 +1,4 @@
# shellcheck shell=bash disable=SC2148 # sourced .bashrc profile fragment
if command -v tmux &> /dev/null && [ -n "$PS1" ] && [[ ! "$TERM" =~ screen ]] && [[ ! "$TERM" =~ tmux ]] && [ -z "$TMUX" ]; then
tmux a -t default || exec tmux new -s default && exit;
fi
provisioning/legacy/profiled-tsys-shell.sh
+1
View File
@@ -1 +1,2 @@
# shellcheck shell=bash disable=SC2148 # sourced .bashrc profile fragment
export HISTTIMEFORMAT="%m/%d/%Y %T "