The script masked the exit codes of every command substitution it ran. `local` and `export` are commands
themselves, so their own return value overwrites the one of the substitution and `set -e` never sees a failure.
This was not only cosmetic: when `gitea generate secret` failed, the init container happily continued and exported
an empty `INTERNAL_TOKEN`, `SECRET_KEY`, `JWT_SECRET` and `LFS_JWT_SECRET`. Declaration and assignment are now
separated, which lets `set -e` abort instead of writing an app.ini with empty secrets. (SC2155)
`env2ini::log` passed its argument as the format string of `printf`. Settings names and section names are read from
user supplied configuration and are logged verbatim, so a value containing a `%` directive made `printf` consume
non-existing arguments. The message is passed as data now. `%b` instead of `%s` keeps the `\n` escapes of the
existing call sites working. (SC2059)
The remaining changes quote the file name variables and add `-r` to the `read` of the `find -print0` loop, where an
unquoted path or a backslash in a mount point would have been mangled. (SC2086, SC2162)
Co-authored-by: Copilot <copilot@github.com>
volker.raschekandCopilot
9f7064724e