Shellcheck fixes and error silencing

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion

boards/librem_mini/initrd/bin/board-init.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 set -o pipefail
 
+# shellcheck disable=SC1091
 . /tmp/config
 
 # If CONFIG_AUTOMATIC_POWERON is set, always set the EC BRAM setting during

boards/librem_mini_v2/initrd/bin/board-init.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 set -o pipefail
 
+# shellcheck disable=SC1091
 . /tmp/config
 
 # If CONFIG_AUTOMATIC_POWERON is set, always set the EC BRAM setting during

initrd/bin/basic-autoboot.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 set -o pipefail
 
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
 
 BOOT_MENU_OPTIONS=/tmp/basic-autoboot-options

initrd/bin/cbfs-init.sh

@@ -1,5 +1,6 @@
 #!/bin/bash
 set -e -o pipefail
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
 
 # CBFS extraction and measurement
@@ -16,24 +17,32 @@ if [ -z "$CONFIG_PCR" ]; then
 	CONFIG_PCR=7
 fi
 
+DEBUG "CONFIG_CBFS_VIA_FLASHPROG='$CONFIG_CBFS_VIA_FLASHPROG'"
+
 if [ "$CONFIG_CBFS_VIA_FLASHPROG" = "y" ]; then
 	# Use flashrom directly, because we don't have /tmp/config with params for flash.sh yet
 	/bin/flashprog -p internal --fmap -i COREBOOT -i FMAP -r /tmp/cbfs-init.rom \
-		&& CBFS_ARG=" -o /tmp/cbfs-init.rom" \
+		&& CBFS_ARG="-o /tmp/cbfs-init.rom" \
 		|| echo "Failed reading Heads configuration from flash! Some features may not be available."
 fi
 
+DEBUG "CBFS_ARG='$CBFS_ARG'"
+
 # Load individual files
-cbfsfiles=`cbfs -t 50 -l $CBFS_ARG 2>/dev/null | grep "^heads/initrd/"`
+# shellcheck disable=SC2086
+cbfsfiles=$(cbfs -t 50 $CBFS_ARG -l 2>/dev/null | grep "^heads/initrd/")
+DEBUG "cbfsfiles='$cbfsfiles'"
 
-for cbfsname in `echo $cbfsfiles`; do
+for cbfsname in $cbfsfiles; do
 	filename=${cbfsname:12}
-	if [ ! -z "$filename" ]; then
-		mkdir -p `dirname $filename` \
+	if [ -n "$filename" ]; then
+		mkdir -p "$(dirname "$filename")" \
 		|| die "$filename: mkdir failed"
 		INFO "Extracting CBFS file $cbfsname into $filename"
-		cbfs -t 50 $CBFS_ARG -r $cbfsname > "$filename" \
+		# shellcheck disable=SC2086
+		cbfs -t 50 $CBFS_ARG -r "$cbfsname" > "$filename" \
 		|| die "$filename: cbfs file read failed"
+		DEBUG "Extracted $cbfsname to $filename"
 		if [ "$CONFIG_TPM" = "y" ]; then
 			TRACE_FUNC
 			INFO "TPM: Extending PCR[$CONFIG_PCR] with filename $filename and then its content"

initrd/bin/cbfs.sh

@@ -1,12 +1,15 @@
 #!/bin/bash
 set -e -o pipefail
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
+# /tmp/config is generated at runtime and cannot be followed by shellcheck
+# shellcheck disable=SC1091
 . /tmp/config
 
 TRACE_FUNC
 
 if pnor "$2" -r HBI > /tmp/pnor.part 2>/dev/null; then
-    cbfs "$@" -o /tmp/pnor.part && pnor "$2" -w HBI < /tmp/pnor.part
+	cbfs "$@" -o /tmp/pnor.part && pnor "$2" -w HBI < /tmp/pnor.part
 else
-    cbfs "$@"
+	cbfs "$@"
 fi

initrd/bin/change-time.sh

@@ -70,4 +70,4 @@ echo
 
 echo "Press Enter to return to the menu"
 echo
-read -r nothing
+read -r

initrd/bin/config-gui.sh

@@ -1,8 +1,12 @@
 #!/bin/bash
 #
 set -e -o pipefail
+
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
+# shellcheck source=initrd/etc/gui_functions.sh
 . /etc/gui_functions.sh
+# shellcheck disable=SC1091
 . /tmp/config
 
 TRACE_FUNC
@@ -22,12 +26,13 @@ read_rom() {
 }
 
 while true; do
-	if [ ! -z "$param" ]; then
+	if [ -n "$param" ]; then
 		# use first char from parameter
 		menu_choice=${param::1}
 		unset param
 	else
 		# Re-source config because we change it when an option is toggled
+		# shellcheck disable=SC1091
 		. /tmp/config
 
 		dynamic_config_options=(
@@ -100,6 +105,7 @@ while true; do
 		)
 
 		unset menu_choice
+		# shellcheck disable=SC2086
 		whiptail_type $BG_COLOR_MAIN_MENU --title "Config Management Menu" \
 			--menu "This menu lets you change settings for the current BIOS session.\n\nAll changes will revert after a reboot,\n\nunless you also save them to the running BIOS." 0 80 10 \
 			"${dynamic_config_options[@]}" \
@@ -113,6 +119,7 @@ while true; do
 		unset CONFIG_FINALIZE_PLATFORM_LOCKING
 		replace_config /etc/config.user "CONFIG_FINALIZE_PLATFORM_LOCKING" "n"
 		combine_configs
+		# shellcheck disable=SC1091
 		. /tmp/config
 		;;
 	"x")
@@ -126,16 +133,16 @@ while true; do
 			exit 1
 		fi
 		# filter out extraneous options
-		>/tmp/boot_device_list.txt
-		for i in $(cat /tmp/disklist.txt); do
+		: >/tmp/boot_device_list.txt
+		while read -r i; do
 			# remove block device from list if numeric partitions exist, since not bootable
-			DEV_NUM_PARTITIONS=$(($(ls -1 $i* | wc -l) - 1))
+			DEV_NUM_PARTITIONS=$(($(find "$i"* | wc -l) - 1))
 			if [ ${DEV_NUM_PARTITIONS} -eq 0 ]; then
-				echo $i >>/tmp/boot_device_list.txt
+				echo "$i" >>/tmp/boot_device_list.txt
 			else
-				ls $i* | tail -${DEV_NUM_PARTITIONS} >>/tmp/boot_device_list.txt
+				find "$i"* | tail -${DEV_NUM_PARTITIONS} >>/tmp/boot_device_list.txt
 			fi
-		done
+		done < /tmp/disklist.txt
 		file_selector "/tmp/boot_device_list.txt" \
 			"Choose the default /boot device.\n\n${CURRENT_OPTION:+\n\nCurrently set to }$CURRENT_OPTION." \
 			"Boot Device Selection"
@@ -150,7 +157,7 @@ while true; do
 			umount /boot 2>/dev/null
 		fi
 		# mount newly selected /boot device
-		if ! mount -o ro $SELECTED_FILE /boot 2>/tmp/error; then
+		if ! mount -o ro "$SELECTED_FILE" /boot 2>/tmp/error; then
 			ERROR=$(cat /tmp/error)
 			whiptail_error --title 'ERROR: unable to mount /boot' \
 				--msgbox "    $ERROR\n\n" 0 80
@@ -197,14 +204,14 @@ while true; do
 
 			# clear GPG keys and user settings
 			for i in $(cbfs.sh -o /tmp/config-gui.rom -l | grep -e "heads/"); do
-				cbfs.sh -o /tmp/config-gui.rom -d $i
+				cbfs.sh -o /tmp/config-gui.rom -d "$i"
 			done
 			# flash cleared ROM
 			/bin/flash.sh -c /tmp/config-gui.rom
 
 			# reset TPM if present
 			if [ "$CONFIG_TPM" = "y" ]; then
-				   /bin/tpm-reset.sh
+				/bin/tpm-reset.sh
 			fi
 			whiptail --title 'Configuration Reset Updated Successfully' \
 				--msgbox "Configuration reset and BIOS updated successfully.\n\nPress Enter to reboot" 0 80
@@ -216,17 +223,19 @@ while true; do
 	"R")
 		CURRENT_OPTION="$(load_config_value CONFIG_ROOT_DEV)"
 		fdisk -l 2>/dev/null | grep "Disk /dev/" | cut -f2 -d " " | cut -f1 -d ":" >/tmp/disklist.txt
+		INFO "DEBUG disklist: $(cat /tmp/disklist.txt)"
 		# filter out extraneous options
-		>/tmp/root_device_list.txt
-		for i in $(cat /tmp/disklist.txt); do
+		true > /tmp/root_device_list.txt
+		while read -r i; do
 			# remove block device from list if numeric partitions exist, since not bootable
-			DEV_NUM_PARTITIONS=$(($(ls -1 $i* | wc -l) - 1))
+			DEV_NUM_PARTITIONS=$(($(find "$i"* | wc -l) - 1))
 			if [ ${DEV_NUM_PARTITIONS} -eq 0 ]; then
-				echo $i >>/tmp/root_device_list.txt
+				echo "$i" >>/tmp/root_device_list.txt
 			else
-				ls $i* | tail -${DEV_NUM_PARTITIONS} >>/tmp/root_device_list.txt
+				find "$i"* | tail -${DEV_NUM_PARTITIONS} >>/tmp/root_device_list.txt
 			fi
-		done
+		done < /tmp/disklist.txt
+		INFO "DEBUG root_device_list: $(cat /tmp/root_device_list.txt)"
 		file_selector "/tmp/root_device_list.txt" \
 			"Choose the default root device.${CURRENT_OPTION:+\n\nCurrently set to }$CURRENT_OPTION." \
 			"Root Device Selection"
@@ -256,7 +265,7 @@ while true; do
 		read -r NEW_CONFIG_ROOT_DIRLIST
 
 		# strip any leading forward slashes
-		NEW_CONFIG_ROOT_DIRLIST=$(echo $NEW_CONFIG_ROOT_DIRLIST | sed -e 's/^\///;s/ \// /g')
+		NEW_CONFIG_ROOT_DIRLIST=$(echo "$NEW_CONFIG_ROOT_DIRLIST" | sed -e 's/^\///;s/ \// /g')
 
 		#check if list empty
 		if [ -z "$NEW_CONFIG_ROOT_DIRLIST" ]; then
@@ -618,7 +627,7 @@ while true; do
 					echo "You can now test your keyboard layout in this shell."
 					echo "Press Enter when done testing to continue..."
 					echo "------------------------------------------------------------"
-					read -p $'\nTest your keymap now. Press Enter to continue:\n' dummy
+					read -r -p $'\nTest your keymap now. Press Enter to continue:\n' _
 					if whiptail --title "Keep this keymap?" \
 						--yesno "Do you want to use this keymap?\n\n$SELECTED_KEYMAP" 0 70; then
 						set_user_config "CONFIG_KEYBOARD_KEYMAP" "$SELECTED_KEYMAP"
@@ -632,6 +641,7 @@ while true; do
 		;;
 	"Z")
 		unset output_choice
+		# shellcheck disable=SC2086
 		whiptail_type $BG_COLOR_MAIN_MENU --title "Informational / Debug Output" \
 			--menu "$CONFIG_BRAND_NAME can display informational or debug output.\n\nChoose the output level:" 0 80 10 \
 			0 'None - Show no extra output' \

initrd/bin/flash-gui.sh

@@ -1,9 +1,12 @@
 #!/bin/bash
 #
 set -e -o pipefail
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
+# shellcheck source=initrd/etc/gui_functions.sh
 . /etc/gui_functions.sh
-. /tmp/config
+# shellcheck disable=SC1091
+ . /tmp/config
 
 TRACE_FUNC
 
@@ -42,6 +45,7 @@ single_glob() {
 
 while true; do
   unset menu_choice
+  # shellcheck disable=SC2086
   whiptail_type $BG_COLOR_MAIN_MENU --title "Firmware Management Menu" \
     --menu "Select the firmware function to perform\n\nRetaining settings copies existing settings to the new firmware:\n* Keeps your GPG keyring\n* Keeps changes to the default /boot device\n\nErasing settings uses the new firmware as-is:\n* Erases any existing GPG keyring\n* Restores firmware to default factory settings\n* Clears out /boot signatures\n\nIf you are just updating your firmware, you probably want to retain\nyour settings." 0 80 10 \
     'f' ' Flash the firmware with a new ROM, retain settings' \

initrd/bin/flash.sh

@@ -3,7 +3,9 @@
 # NOTE: This script is used on legacy-flash boards and runs with busybox ash,
 # not bash
 set -e -o pipefail
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
+# shellcheck disable=SC1091
 . /tmp/config
 
 echo
@@ -26,29 +28,29 @@ flash_rom() {
     $CONFIG_FLASH_OPTIONS -r "${ROM}" \
     || recovery "Backup to $ROM failed"
   else
-    cp "$ROM" /tmp/${CONFIG_BOARD}.rom
-    sha256sum /tmp/${CONFIG_BOARD}.rom
+    cp "$ROM" /tmp/"${CONFIG_BOARD}".rom
+    sha256sum /tmp/"${CONFIG_BOARD}".rom
     if [ "$CLEAN" -eq 0 ]; then
-      preserve_rom /tmp/${CONFIG_BOARD}.rom \
+      preserve_rom /tmp/"${CONFIG_BOARD}".rom \
       || recovery "$ROM: Config preservation failed"
     fi
     # persist serial number from CBFS
     if cbfs.sh -r serial_number > /tmp/serial 2>/dev/null; then
       echo "Persisting system serial"
-      cbfs.sh -o /tmp/${CONFIG_BOARD}.rom -d serial_number 2>/dev/null || true
-      cbfs.sh -o /tmp/${CONFIG_BOARD}.rom -a serial_number -f /tmp/serial
+      cbfs.sh -o /tmp/"${CONFIG_BOARD}".rom -d serial_number 2>/dev/null || true
+      cbfs.sh -o /tmp/"${CONFIG_BOARD}".rom -a serial_number -f /tmp/serial
     fi
     # persist PCHSTRP9 from flash descriptor
     if [ "$CONFIG_BOARD" = "librem_l1um" ]; then
       echo "Persisting PCHSTRP9"
       $CONFIG_FLASH_OPTIONS -r /tmp/ifd.bin --ifd -i fd >/dev/null 2>&1 \
       || die "Failed to read flash descriptor"
       dd if=/tmp/ifd.bin bs=1 count=4 skip=292 of=/tmp/pchstrp9.bin >/dev/null 2>&1
-      dd if=/tmp/pchstrp9.bin bs=1 count=4 seek=292 of=/tmp/${CONFIG_BOARD}.rom conv=notrunc >/dev/null 2>&1
+      dd if=/tmp/pchstrp9.bin bs=1 count=4 seek=292 of=/tmp/"${CONFIG_BOARD}".rom conv=notrunc >/dev/null 2>&1
     fi
 
     warn "Do not power off computer.  Updating firmware, this will take a few minutes"
-    $CONFIG_FLASH_OPTIONS -w /tmp/${CONFIG_BOARD}.rom 2>&1 \
+    $CONFIG_FLASH_OPTIONS -w /tmp/"${CONFIG_BOARD}".rom 2>&1 \
       || recovery "$ROM: Flash failed"
   fi
 }
@@ -61,7 +63,7 @@ elif [ "$1" == "-r" ]; then
   CLEAN=0
   READ=1
   ROM="$2"
-  touch $ROM
+  touch "$ROM"
 else
   CLEAN=0
   READ=0
@@ -77,7 +79,7 @@ if [ "$READ" -eq 0 ] && [ "${ROM##*.}" = tgz ]; then
         rm -rf /tmp/verified_rom
         mkdir /tmp/verified_rom
 
-        tar -C /tmp/verified_rom -xf $ROM || die "Rom archive $ROM could not be extracted"
+        tar -C /tmp/verified_rom -xf "$ROM" || die "Rom archive $ROM could not be extracted"
     if ! (cd /tmp/verified_rom/ && sha256sum -cs sha256sum.txt); then
             die "Provided tgz image did not pass hash verification"
         fi
@@ -90,9 +92,9 @@ if [ "$READ" -eq 0 ] && [ "${ROM##*.}" = tgz ]; then
         bootblock=$(echo /tmp/verified_rom/*.bootblock)
         rom=$(echo /tmp/verified_rom/*.rom)
         kernel=$(echo /tmp/verified_rom/*-zImage.bundled)
-        pnor /tmp/flash.sh.bak -aw HBB < $bootblock
-        pnor /tmp/flash.sh.bak -aw HBI < $rom
-        pnor /tmp/flash.sh.bak -aw BOOTKERNEL < $kernel
+        pnor /tmp/flash.sh.bak -aw HBB < "$bootblock"
+        pnor /tmp/flash.sh.bak -aw HBI < "$rom"
+        pnor /tmp/flash.sh.bak -aw BOOTKERNEL < "$kernel"
         rm -rf /tmp/verified_rom
 
         ROM=/tmp/flash.sh.bak
@@ -101,7 +103,7 @@ if [ "$READ" -eq 0 ] && [ "${ROM##*.}" = tgz ]; then
     fi
 fi
 
-flash_rom $ROM
+flash_rom "$ROM"
 
 # don't leave temporary files lying around
 rm -f /tmp/flash.sh.bak

initrd/bin/flashprog-kgpe-d16-openbmc.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# shellcheck source=initrd/etc/functions.sh
 . /etc/functions.sh
 
 TRACE_FUNC