linting: shell: fix shellcheck warnings

Fix errors brought up by the linter.

Signed-off-by: Andreas Hatziiliou <andreas.hatziiliou@savoirfairelinux.com>

Author: L-series

META.sh

@@ -15,17 +15,17 @@ META=META.yml
 # Manual extraction of metadata with basic cmd line tools
 VAL=$(cat $META |
   grep "name\|$2" |
-  grep $1 -A 1 |
-  grep $2 |
+  grep "$1" -A 1 |
+  grep "$2" |
   cut -d ":" -f 2 | tr -d ' ')
 
 # More robust extraction using yq
-if (which yq 2>&1 >/dev/null); then
+if (which yq >/dev/null 2>&1); then
   QUERY=".implementations | .[] | select(.name==\"$1\") | .\"$2\""
-  echo "cat $META | yq "$QUERY" -r"
+  echo "cat $META | yq \"$QUERY\" -r"
   VAL_JQ=$(cat $META | yq "$QUERY" -r)
 
-  if [[ $VAL_JQ != $VAL ]]; then
+  if [[ $VAL_JQ != "$VAL" ]]; then
     echo "ERROR parsing metadata file $META"
     exit 1
   fi
@@ -41,5 +41,5 @@ if [[ $INPUT != "" ]]; then
     exit 0
   fi
 else
-  echo $VAL
+  echo "$VAL"
 fi

proofs/cbmc/list_proofs.sh

@@ -6,5 +6,5 @@
 # which are those containing a *harness.c file.
 
 ROOT=$(git rev-parse --show-toplevel)
-cd $ROOT
+cd "$ROOT" || exit
 ls -1 proofs/cbmc/**/*harness.c | cut -d '/' -f 3

proofs/hol_light/aarch64/list_proofs.sh

@@ -6,5 +6,5 @@
 # we have a spec and proof in HOL-Light.
 
 ROOT=$(git rev-parse --show-toplevel)
-cd $ROOT
+cd "$ROOT" || exit
 ls -1 proofs/hol_light/aarch64/mlkem/*.S | cut -d '/' -f 5 | sed 's/\.S//'

proofs/hol_light/aarch64/proofs/build-proof.sh

@@ -34,7 +34,8 @@ output_path=$3
 output_dir=$(dirname "$output_path")
 [ -d "$output_dir" ] || mkdir -p "$output_dir"
 
-export HOLLIGHT_DIR="$(dirname ${hol_sh_cmd})"
+HOLLIGHT_DIR="$(dirname "${hol_sh_cmd}")"
+export HOLLIGHT_DIR
 if [ ! -f "${HOLLIGHT_DIR}/hol_lib.cmxa" ]; then
   echo "hol_lib.cmxa does not exist in HOLLIGHT_DIR('${HOLLIGHT_DIR}')."
   echo "Did you compile HOL Light with HOLLIGHT_USE_MODULE set to 1?"

proofs/hol_light/x86_64/list_proofs.sh

@@ -6,5 +6,5 @@
 # we have a spec and proof in HOL-Light.
 
 ROOT=$(git rev-parse --show-toplevel)
-cd $ROOT
+cd "$ROOT" || exit
 ls -1 proofs/hol_light/x86_64/mlkem/*.S | cut -d '/' -f 5 | sed 's/\.S//'

proofs/hol_light/x86_64/proofs/build-proof.sh

@@ -34,7 +34,8 @@ output_path=$3
 output_dir=$(dirname "$output_path")
 [ -d "$output_dir" ] || mkdir -p "$output_dir"
 
-export HOLLIGHT_DIR="$(dirname ${hol_sh_cmd})"
+HOLLIGHT_DIR="$(dirname "${hol_sh_cmd}")"
+export HOLLIGHT_DIR
 if [ ! -f "${HOLLIGHT_DIR}/hol_lib.cmxa" ]; then
   echo "hol_lib.cmxa does not exist in HOLLIGHT_DIR('${HOLLIGHT_DIR}')."
   echo "Did you compile HOL Light with HOLLIGHT_USE_MODULE set to 1?"

scripts/format

@@ -13,8 +13,6 @@ ROOT="$(realpath "$(dirname "$0")"/../)"
 # Standard color definitions
 GREEN="\033[32m"
 RED="\033[31m"
-BLUE="\033[94m"
-BOLD="\033[1m"
 NORMAL="\033[0m"
 
 # utility
@@ -29,15 +27,15 @@ error()
 }
 
 info "Formatting nix files"
-if ! command -v nixpkgs-fmt 2>&1 >/dev/null; then
+if ! command -v nixpkgs-fmt >/dev/null 2>&1; then
   error "nixpkgs-fmt not found. Are you running in a nix shell? See CONTRIBUTING.md."
   exit 1
 fi
 
 nixpkgs-fmt "$ROOT"
 
 info "Formatting shell scripts"
-if ! command -v shfmt 2>&1 >/dev/null; then
+if ! command -v shfmt >/dev/null 2>&1; then
   error "shfmt not found. Are you running in a nix shell? See CONTRIBUTING.md."
   exit 1
 fi
@@ -47,21 +45,21 @@ SHELL_SCRIPTS=$(git grep -l '' :/ | xargs printf "'%s' " | xargs -L 1 shfmt -f)
 echo $SHELL_SCRIPTS | xargs -L 1 shfmt -s -w -l -i 2 -ci -fn
 
 info "Formatting python scripts"
-if ! command -v black 2>&1 >/dev/null; then
+if ! command -v black >/dev/null 2>&1; then
   error "black not found. Are you running in a nix shell? See CONTRIBUTING.md."
   exit 1
 fi
 black --include "(scripts/tests|scripts/simpasm|scripts/cfify|scripts/autogen|scripts/check-namespace|\.py$)" "$ROOT"
 
 info "Formatting c files"
-if ! command -v clang-format 2>&1 >/dev/null; then
+if ! command -v clang-format >/dev/null 2>&1; then
   error "clang-format not found. Are you running in a nix shell? See CONTRIBUTING.md."
   exit 1
 fi
 
 nproc=$(getconf _NPROCESSORS_ONLN || echo 1)
 
-git ls-files -- ":/*.c" ":/*.h" | xargs -P $nproc -I {} sh -c '
+git ls-files -- ":/*.c" ":/*.h" | xargs -P "$nproc" -I {} sh -c '
   # Ignore symlinks
   if [[ ! -L {} ]]; then
     clang-format -i {}
@@ -70,7 +68,7 @@ git ls-files -- ":/*.c" ":/*.h" | xargs -P $nproc -I {} sh -c '
 info "Checking for eol"
 check-eol()
 {
-  git ls-files -- ":/" ":/!:*.png" | xargs -P $nproc -I {} sh -c '
+  git ls-files -- ":/" ":/!:*.png" | xargs -P "$nproc" -I {} sh -c '
     # Ignore symlinks
     if [[ ! -L {} && $(tail -c1 "{}" | wc -l) == 0 ]]; then
       echo "" >>"{}"

scripts/lint

@@ -20,8 +20,6 @@ fi
 # Standard color definitions
 GREEN="\033[32m"
 RED="\033[31m"
-BLUE="\033[94m"
-BOLD="\033[1m"
 NORMAL="\033[0m"
 
 info()
@@ -122,8 +120,7 @@ run-shellcheck()
 # Formatting
 SUCCESS=true
 
-# Get list of shell scripts and .c/.h files for linting
-ALL_C_FILES=$(git ls-files ":/*.c" ":/*.h")
+# Get list of shell scripts for linting
 SHELL_SCRIPTS=$(git grep -l '' :/ | xargs printf "'%s' " | xargs -L 1 shfmt -f)
 
 gh_group_start "Linting nix files with nixpkgs-fmt"
@@ -151,7 +148,16 @@ fi
 gh_group_end
 
 gh_group_start "Linting c files with clang-format"
-checkerr "Lint C" "$(clang-format $(git ls-files ":/*.c" ":/*.h") --Werror --dry-run 2>&1 | grep "error:" | cut -d ':' -f 1,2 | tr ':' ' ')"
+lint-c-files()
+{
+  for file in $(git ls-files -- ":/*.c" ":/*.h"); do
+    # Ignore symlinks
+    if [[ ! -L $file ]]; then
+      clang-format --Werror --dry-run "$file" 2>&1 | grep "error:" | cut -d ':' -f 1,2 | tr ':' ' '
+    fi
+  done
+}
+checkerr "Lint C" "$(lint-c-files)"
 gh_group_end
 
 check-eol-dry-run()
@@ -173,22 +179,22 @@ check-spdx()
   local success=true
   for file in $(git ls-files -- ":/" ":/!:*.json" ":/!:*.png" ":/!:*.patch" ":/!:*LICENSE*" ":/!:.git*" ":/!:flake.lock"); do
     # Ignore symlinks
-    if [[ ! -L $file && $(grep "SPDX-License-Identifier:" $file | wc -l) == 0 ]]; then
+    if [[ ! -L $file && $(grep "SPDX-License-Identifier:" "$file" | wc -l) == 0 ]]; then
       gh_error "$file" "${line:-1}" "Missing license header error" "$file is missing SPDX License header"
       success=false
     fi
   done
   for file in $(git ls-files -- "*.[chsS]" "*.py" "*.mk" "*.yml" "**/Makefile*" ":/!proofs/cbmc/*.py" ":/!examples/bring_your_own_fips202/custom_fips202/tiny_sha3/*" ":/!examples/custom_backend/mlkem_native/src/fips202/native/custom/src/*" ":/!:*.patch"); do
     # Ignore symlinks
-    if [[ ! -L $file && $(grep "Copyright (c) The mlkem-native project authors" $file | wc -l) == 0 ]]; then
+    if [[ ! -L $file && $(grep "Copyright (c) The mlkem-native project authors" "$file" | wc -l) == 0 ]]; then
       gh_error "$file" "${line:-1}" "Missing copyright header error" "$file is missing copyright header"
       success=false
     fi
   done
   # For source files in dev/* and mlkem/*, we enforce `Apache-2.0 OR ISC OR MIT`
   for file in $(git ls-files -- "*.[chsSi]" | grep "^dev/\|^mlkem/" | grep -v "\.patch$"); do
     # Ignore symlinks
-    if [[ ! -L $file && $(grep "SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT" $file | wc -l) == 0 ]]; then
+    if [[ ! -L $file && $(grep "SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT" "$file" | wc -l) == 0 ]]; then
       gh_error "$file" "${line:-1}" "Missing license header error" "$file is not licensed under 'Apache-2.0 OR ISC OR MIT'"
       success=false
     fi
@@ -209,7 +215,7 @@ gh_group_end
 
 check-autogenerated-files()
 {
-  if python3 $ROOT/scripts/autogen --dry-run; then
+  if python3 "$ROOT"/scripts/autogen --dry-run; then
     info "Check native auto-generated files"
     gh_summary_success "Check native auto-generated files"
   else
@@ -225,7 +231,7 @@ gh_group_end
 
 check-magic()
 {
-  if python3 $ROOT/scripts/check-magic >/dev/null; then
+  if python3 "$ROOT"/scripts/check-magic >/dev/null; then
     info "Check magic constants"
     gh_summary_success "Check magic constants"
   else
@@ -245,7 +251,7 @@ fi
 
 check-contracts()
 {
-  if python3 $ROOT/scripts/check-contracts >/dev/null; then
+  if python3 "$ROOT"/scripts/check-contracts >/dev/null; then
     info "Check contracts"
     gh_summary_success "Check contracts"
   else