From 9f7064724e0ed045db27750910e329e480bf6614 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Sat, 3 Oct 2026 20:31:02 +0200
Subject: [PATCH] fix(scripts): resolve the shellcheck findings of
 config_environment.sh

The script masked the exit codes of every command substitution it ran. `local` and `export` are commands
themselves, so their own return value overwrites the one of the substitution and `set -e` never sees a failure.
This was not only cosmetic: when `gitea generate secret` failed, the init container happily continued and exported
an empty `INTERNAL_TOKEN`, `SECRET_KEY`, `JWT_SECRET` and `LFS_JWT_SECRET`. Declaration and assignment are now
separated, which lets `set -e` abort instead of writing an app.ini with empty secrets. (SC2155)

`env2ini::log` passed its argument as the format string of `printf`. Settings names and section names are read from
user supplied configuration and are logged verbatim, so a value containing a `%` directive made `printf` consume
non-existing arguments. The message is passed as data now. `%b` instead of `%s` keeps the `\n` escapes of the
existing call sites working. (SC2059)

The remaining changes quote the file name variables and add `-r` to the `read` of the `find -print0` loop, where an
unquoted path or a backslash in a mount point would have been mangled. (SC2086, SC2162)

Co-authored-by: Copilot <copilot@github.com>
---
 .../config/config_environment.sh              | 32 ++++++++++++-------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/scripts/init-containers/config/config_environment.sh b/scripts/init-containers/config/config_environment.sh
index 3e58d39..ccd725a 100755
--- a/scripts/init-containers/config/config_environment.sh
+++ b/scripts/init-containers/config/config_environment.sh
@@ -2,7 +2,8 @@
 set -euo pipefail
 
 function env2ini::log() {
-  printf "${1}\n"
+  # '%b' expands the \n escapes of the callers without treating the message itself as a format string
+  printf '%b\n' "${1}"
 }
 
 function env2ini::read_config_to_env() {
@@ -15,7 +16,8 @@ function env2ini::read_config_to_env() {
   fi
 
   # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-  local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
+  local setting
+  setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
 
   if [[ -z "${setting}" ]]; then
     env2ini::log '  ! invalid setting'
@@ -54,7 +56,8 @@ function env2ini::reload_preset_envs() {
     fi
 
     # 'xargs echo -n' trims all leading/trailing whitespaces and a trailing new line
-    local setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
+    local setting
+    setting="$(awk -F '=' '{print $1}' <<< "${line}" | xargs echo -n)"
 
     if [[ -z "${setting}" ]]; then
       env2ini::log '  ! invalid setting'
@@ -75,12 +78,13 @@ function env2ini::reload_preset_envs() {
     export "${setting^^}=${value}"                           # '^^' makes the variable content uppercase
   done < "$TMP_EXISTING_ENVS_FILE"
 
-  rm $TMP_EXISTING_ENVS_FILE
+  rm "$TMP_EXISTING_ENVS_FILE"
 }
 
 function env2ini::process_config_file() {
   local config_file="${1}"
-  local section="$(basename "${config_file}")"
+  local section
+  section="$(basename "${config_file}")"
 
   if [[ $section == '_generals_' ]]; then
     env2ini::log "  [ini root]"
@@ -100,7 +104,7 @@ function env2ini::load_config_sources() {
   if [[ -d "${path}" ]]; then
     env2ini::log "Processing $(basename "${path}")..."
 
-    while read -d '' configFile; do
+    while read -r -d '' configFile; do
       env2ini::process_config_file "${configFile}"
     done < <(find "${path}" -type l -not -name '..data' -print0)
 
@@ -114,16 +118,20 @@ function env2ini::generate_initial_secrets() {
   #   - initially used to set up Gitea
   # Anyway, they won't harm existing app.ini files
 
-  export GITEA__SECURITY__INTERNAL_TOKEN=$(gitea generate secret INTERNAL_TOKEN)
-  export GITEA__SECURITY__SECRET_KEY=$(gitea generate secret SECRET_KEY)
-  export GITEA__OAUTH2__JWT_SECRET=$(gitea generate secret JWT_SECRET)
-  export GITEA__SERVER__LFS_JWT_SECRET=$(gitea generate secret LFS_JWT_SECRET)
+  GITEA__SECURITY__INTERNAL_TOKEN="$(gitea generate secret INTERNAL_TOKEN)"
+  GITEA__SECURITY__SECRET_KEY="$(gitea generate secret SECRET_KEY)"
+  GITEA__OAUTH2__JWT_SECRET="$(gitea generate secret JWT_SECRET)"
+  GITEA__SERVER__LFS_JWT_SECRET="$(gitea generate secret LFS_JWT_SECRET)"
+  export GITEA__SECURITY__INTERNAL_TOKEN \
+         GITEA__SECURITY__SECRET_KEY \
+         GITEA__OAUTH2__JWT_SECRET \
+         GITEA__SERVER__LFS_JWT_SECRET
 
   env2ini::log "...Initial secrets generated\n"
 }
 
 # save existing envs prior to script execution. Necessary to keep order of preexisting and custom envs
-env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > $TMP_EXISTING_ENVS_FILE
+env | (grep -e '^GITEA__' || [[ $? == 1 ]]) > "$TMP_EXISTING_ENVS_FILE"
 
 # MUST BE CALLED BEFORE OTHER CONFIGURATION
 env2ini::generate_initial_secrets
@@ -137,7 +145,7 @@ env2ini::reload_preset_envs
 env2ini::log "=== All configuration sources loaded ===\n"
 
 # safety to prevent rewrite of secret keys if an app.ini already exists
-if [ -f ${GITEA_APP_INI} ]; then
+if [ -f "${GITEA_APP_INI}" ]; then
   env2ini::log 'An app.ini file already exists. To prevent overwriting secret keys, these settings are dropped and remain unchanged:'
   env2ini::log '  - security.INTERNAL_TOKEN'
   env2ini::log '  - security.SECRET_KEY'