Fix shellcheck lints in bash scripts

android/docs/diagrams/update_graphs.sh

@@ -2,4 +2,4 @@
 
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
-plantuml $SCRIPT_DIR/*.puml
+plantuml "$SCRIPT_DIR"/*.puml

android/fdroid-build/env.sh

@@ -1,6 +1,8 @@
+#!/usr/bin/env bash
 # Sourcing this file prepares the environment for building inside the F-Droid build server
 
 # Ensure Cargo tools are accessible
+# shellcheck source=/dev/null
 source "$HOME/.cargo/env"
 
 # Ensure Go compiler is accessible

android/fdroid-build/init.sh

@@ -5,12 +5,12 @@ set -eux
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 REPO_DIR="$SCRIPT_DIR/../../"
-TOOLCHAINS_DIR="$HOME/android-ndk-toolchains"
 
 # Install Rust
 curl -sf -L https://sh.rustup.rs > /tmp/rustup.sh
 chmod +x /tmp/rustup.sh
 /tmp/rustup.sh -y
+# shellcheck source=/dev/null
 source "$HOME/.cargo/env"
 rustup set profile minimal
 rustup target add \

android/scripts/generate-pngs.sh

@@ -46,11 +46,12 @@ function convert_image() {
 
     local source_image="$1"
     local dpi_config="$2"
+    local destination_image
 
     if (( $# >= 3 )); then
-        local destination_image="$3"
+        destination_image="$3"
     else
-        local destination_image="$(basename "$source_image" .svg | sed -e 's/-/_/g')"
+        destination_image="$(basename "$source_image" .svg | sed -e 's/-/_/g')"
     fi
 
     if (( $# >= 4 )); then
@@ -59,8 +60,10 @@ function convert_image() {
         local destination_dir="drawable"
     fi
 
-    local dpi="$(echo "$dpi_config" | cut -f1 -d'-')"
-    local size="$(echo "$dpi_config" | cut -f2 -d'-')"
+    local dpi
+    dpi="$(echo "$dpi_config" | cut -f1 -d'-')"
+    local size
+    size="$(echo "$dpi_config" | cut -f2 -d'-')"
 
     local dpi_dir="../lib/resource/src/main/res/${destination_dir}-${dpi}"
 

android/scripts/run-instrumented-tests-locally.sh

@@ -4,7 +4,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
-cd $SCRIPT_DIR/..
+cd "$SCRIPT_DIR"/..
 ./gradlew assembleOssProdAndroidTest
 ./gradlew app:assembleOssProdDebug
-$SCRIPT_DIR/run-instrumented-tests.sh app
+"$SCRIPT_DIR"/run-instrumented-tests.sh app

android/scripts/run-instrumented-tests.sh

@@ -23,7 +23,7 @@ INVALID_TEST_ACCOUNT_TOKEN="${INVALID_TEST_ACCOUNT_TOKEN:-}"
 while [[ "$#" -gt 0 ]]; do
     case $1 in
         --test-type)
-            if [[ ! -z ${2-} && "$2" =~ ^(app|mockapi|e2e)$ ]]; then
+            if [[ -n "${2-}" && "$2" =~ ^(app|mockapi|e2e)$ ]]; then
                 TEST_TYPE="$2"
             else
                 echo "Error: Bad or missing test type. Must be one of: app, mockapi, e2e"
@@ -32,7 +32,7 @@ while [[ "$#" -gt 0 ]]; do
             shift 2
             ;;
         --infra-flavor)
-            if [[ ! -z ${2-} && "$2" =~ ^(prod|stagemole)$ ]]; then
+            if [[ -n "${2-}" && "$2" =~ ^(prod|stagemole)$ ]]; then
                 INFRA_FLAVOR="$2"
             else
                 echo "Error: Bad or missing infra flavor. Must be one of: prod, stagemole"
@@ -41,7 +41,7 @@ while [[ "$#" -gt 0 ]]; do
             shift 2
             ;;
         --billing-flavor)
-            if [[ ! -z ${2-} && "$2" =~ ^(oss|play)$ ]]; then
+            if [[ -n "${2-}" && "$2" =~ ^(oss|play)$ ]]; then
                 BILLING_FLAVOR="$2"
             else
                 echo "Error: Bad or missing billing flavor. Must be one of: oss, play"

build-apk.sh

@@ -21,7 +21,7 @@ BUILD_BUNDLE="no"
 CARGO_TARGET_DIR=${CARGO_TARGET_DIR:-"target"}
 SKIP_STRIPPING=${SKIP_STRIPPING:-"no"}
 
-while [ ! -z "${1:-""}" ]; do
+while [ -n "${1:-""}" ]; do
     if [[ "${1:-""}" == "--dev-build" ]]; then
         BUILD_TYPE="debug"
         GRADLE_BUILD_TYPE="debug"
@@ -103,7 +103,7 @@ for ARCHITECTURE in ${ARCHITECTURES:-aarch64 armv7 x86_64 i686}; do
     esac
 
     echo "Building mullvad-daemon for $TARGET"
-    cargo build $CARGO_ARGS --target "$TARGET" --package mullvad-jni
+    cargo build "$CARGO_ARGS" --target "$TARGET" --package mullvad-jni
 
     STRIP_TOOL="${NDK_TOOLCHAIN_DIR}/llvm-strip"
     TARGET_LIB_PATH="$SCRIPT_DIR/android/app/build/extraJni/$ABI/libmullvad_jni.so"
@@ -117,7 +117,7 @@ for ARCHITECTURE in ${ARCHITECTURES:-aarch64 armv7 x86_64 i686}; do
 done
 
 echo "Updating relays.json..."
-cargo run --bin relay_list $CARGO_ARGS > build/relays.json
+cargo run --bin relay_list "$CARGO_ARGS" > build/relays.json
 
 cd "$SCRIPT_DIR/android"
 $GRADLE_CMD --console plain "${GRADLE_TASKS[@]}"

building/build-and-publish-container-image.sh

@@ -53,7 +53,7 @@ trap 'delete_tmp_signature_dir' EXIT
 
 log_header "Pushing $full_container_name:latest"
 podman push "$full_container_name:latest" \
-    --sign-by $CONTAINER_SIGNING_KEY_FINGERPRINT \
+    --sign-by "$CONTAINER_SIGNING_KEY_FINGERPRINT" \
     --digestfile "$tmp_signature_dir/digest_latest"
 
 digest=$(cat "$tmp_signature_dir/digest_latest")
@@ -68,7 +68,7 @@ cp "$signature_dir/signature-1" "$tmp_signature_dir/signature-2"
 
 log_header "Pushing $full_container_name:$tag"
 podman push "$full_container_name:$tag" \
-    --sign-by $CONTAINER_SIGNING_KEY_FINGERPRINT \
+    --sign-by "$CONTAINER_SIGNING_KEY_FINGERPRINT" \
     --digestfile "$tmp_signature_dir/digest_$tag"
 
 if ! cmp -s "$tmp_signature_dir/digest_latest" "$tmp_signature_dir/digest_$tag"; then

ci/buildserver-build.sh

@@ -20,6 +20,7 @@ LAST_BUILT_DIR="$SCRIPT_DIR/last-built"
 
 BRANCHES_TO_BUILD=("origin/main")
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 # Ask for the passphrase to the signing keys

ci/buildserver-upload.sh

@@ -7,6 +7,7 @@ CODE_SIGNING_KEY_FINGERPRINT="A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF"
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 cd "$UPLOAD_DIR"

ci/ios/build-app.sh

@@ -17,7 +17,7 @@ cd ~/build/ios
 rm -r Build
 
 # Instantiate Xcconfig templates.
-for file in ./Configurations/*.template ; do cp $file ${file//.template/} ; done
+for file in ./Configurations/*.template ; do cp "$file" "${file//.template/}" ; done
 
 IOS_PROVISIONING_PROFILES_DIR=~/provisioning-profiles \
     PATH=/usr/local/go/bin:$PATH \

ci/ios/buildserver-build-ios.sh

@@ -14,7 +14,7 @@ export GIT_DIR="$GIT_WORK_TREE/.git"
 function run_git {
     # `git submodule` needs more info than just $GIT_DIR and $GIT_WORK_TREE.
     # But -C makes it work.
-    git -C $GIT_WORK_TREE $@
+    git -C "$GIT_WORK_TREE" "$@"
 }
 
 
@@ -43,7 +43,7 @@ function build_ref() {
     fi
 
     run_git reset --hard
-    run_git checkout $tag
+    run_git checkout "$tag"
     run_git submodule update
     run_git clean -df
 
@@ -92,7 +92,8 @@ function run_build_loop() {
         run_git tag | xargs git tag -d > /dev/null
 
         run_git fetch --prune --tags 2> /dev/null || continue
-        local tags=( $(run_git tag | grep "$TAG_PATTERN_TO_BUILD") )
+        local tags
+        tags=( $(run_git tag | grep "$TAG_PATTERN_TO_BUILD") )
 
         for tag in "${tags[@]}"; do
           build_ref "refs/tags/$tag"

ci/ios/run-build-and-upload.sh

@@ -10,7 +10,7 @@
 set -eu -o pipefail
 
 # Add SSH key for iOS build VMs to be able to SSH into them without user interaction
-eval $(ssh-agent)
+eval "$(ssh-agent)"
 ssh-add ~/.ssh/ios-vm-key
 
 # This single path really screws with XCode and wireguard-go's makefiles, which

ci/ios/run-in-vm.sh

@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 # This takes the following positional arguments 
 # 1. tart VM name
 # 2. Script to execute in the VM
@@ -23,7 +24,7 @@ sleep 10
 
 # apparently, there's a difference between piping into zsh like this and doing
 # a <(echo $SCRIPT).
-cat "$SCRIPT" | ssh admin@$(tart ip "$VM_NAME") bash /dev/stdin
+cat "$SCRIPT" | ssh admin@"$(tart ip "$VM_NAME")" bash /dev/stdin
 script_status=$?
 
 kill $vm_pid

ci/ios/upload-app.sh

@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
+set -eu
 # Upload script to run in `ios-upload` VM to upload a newly built IPA to TestFlight
 
 VM_UPLOAD_IPA_PATH="/Volumes/My Shared Files/build-output/MullvadVPN.ipa"
 API_KEY_PATH="$HOME/ci/app-store-connect-key.json"
 cd ci/
+# shellcheck source=/dev/null
 source ~/.bash_profile
 bundle exec fastlane pilot upload --api-key-path "${API_KEY_PATH}" --ipa "${VM_UPLOAD_IPA_PATH}"

ci/prepare-apt-repository.sh

@@ -9,6 +9,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 artifact_dir=$1

ci/prepare-rpm-repository.sh

@@ -9,6 +9,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 artifact_dir=$1

ci/publish-linux-repositories.sh

@@ -9,6 +9,7 @@ set -eu
 
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+# shellcheck source=ci/buildserver-config.sh
 source "$SCRIPT_DIR/buildserver-config.sh"
 
 while [ "$#" -gt 0 ]; do

ci/verify-locked-down-signatures.sh

@@ -2,7 +2,8 @@
 set -eu
 shopt -s nullglob
 
-readonly SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+readonly SCRIPT_DIR
 readonly REPO_DIR="$SCRIPT_DIR/.."
 
 # In the CI environment we would like to import trusted public keys from a file,
@@ -76,7 +77,7 @@ for locked_path in $locked_down_paths; do
 
     # Check if important file has been removed.
     if [[ ! -e "$REPO_DIR/$locked_path" ]]; then
-        echo "$locked_path was removed. If this was intentional, remove it from `verify-locked-down-signatures.yml`."
+        echo "$locked_path was removed. If this was intentional, remove it from 'verify-locked-down-signatures.yml'"
         important_file_was_removed=1
     fi
 done

gui/scripts/build-logo-icons.sh

@@ -46,8 +46,8 @@ TMP_DIR=$(mktemp -d)
 TMP_ICO_DIR="$TMP_DIR/ico"
 TMP_ICONSET_DIR="$TMP_DIR/icon.iconset"
 
-mkdir $TMP_ICONSET_DIR
-mkdir $TMP_ICO_DIR
+mkdir "$TMP_ICONSET_DIR"
+mkdir "$TMP_ICO_DIR"
 
 COMPRESSION_OPTIONS="-define png:compression-filter=5 -define png:compression-level=9 \
     -define png:compression-strategy=1 -define png:exclude-chunk=all -strip"
@@ -62,36 +62,36 @@ rm "$TMP_ICONSET_DIR"/*
 
 # Linux .icns icon
 for size in 16 32 128 256 512; do
-    double_size=$[$size * 2]
-    rsvg-convert -o $TMP_ICONSET_DIR/icon-$size.png -w $size -h $size $SVG_SOURCE_PATH
-    rsvg-convert -o $TMP_ICONSET_DIR/icon-$size@2x.png -w $double_size -h $double_size \
+    double_size="$((size * 2))"
+    rsvg-convert -o "$TMP_ICONSET_DIR"/icon-$size.png -w $size -h $size $SVG_SOURCE_PATH
+    rsvg-convert -o "$TMP_ICONSET_DIR"/icon-$size@2x.png -w "$double_size" -h "$double_size" \
         $SVG_SOURCE_PATH
 done
-iconutil --convert icns --output $DIST_ASSETS_DIR/icon.icns $TMP_ICONSET_DIR
-rm -rf $TMP_ICONSET_DIR
+iconutil --convert icns --output $DIST_ASSETS_DIR/icon.icns "$TMP_ICONSET_DIR"
+rm -rf "$TMP_ICONSET_DIR"
 
 # Windows .ico icon
 for size in 16 20 24 30 32 36 40 48 60 64 72 80 96 256 512; do
-    rsvg-convert -o $TMP_ICO_DIR/$size.png -w $size -h $size $SVG_SOURCE_PATH
+    rsvg-convert -o "$TMP_ICO_DIR"/$size.png -w $size -h $size $SVG_SOURCE_PATH
 done
-convert $TMP_ICO_DIR/* $COMPRESSION_OPTIONS $DIST_ASSETS_DIR/icon.ico
-rm -rf $TMP_ICO_DIR
+convert "$TMP_ICO_DIR"/* "$COMPRESSION_OPTIONS" $DIST_ASSETS_DIR/icon.ico
+rm -rf "$TMP_ICO_DIR"
 
 # Windows installer sidebar
 # "bmp3" specifies the Windows 3.x format which is required for the image to be displayed
 sidebar_path="$TMP_DIR/sidebar.png"
 sidebar_logo_size=234
-rsvg-convert -o $sidebar_path -w $sidebar_logo_size -h $sidebar_logo_size $SVG_SOURCE_PATH
-convert -background "#294D73" $sidebar_path \
+rsvg-convert -o "$sidebar_path" -w $sidebar_logo_size -h $sidebar_logo_size $SVG_SOURCE_PATH
+convert -background "#294D73" "$sidebar_path" \
     -gravity center -extent ${sidebar_logo_size}x314 \
     -gravity west -crop 164x314+10+0 bmp3:$DIST_ASSETS_DIR/windows/installersidebar.bmp
-rm $sidebar_path
+rm "$sidebar_path"
 
 # GUI notification icon
 rsvg-convert -o ../assets/images/icon-notification.png -w 128 -h 128 $SVG_SOURCE_PATH
 
 # GUI in app icon
 cp "$SVG_SOURCE_PATH" ../assets/images/logo-icon.svg
 
-rmdir $TMP_DIR
+rmdir "$TMP_DIR"
 

gui/scripts/build-proto.sh

@@ -24,8 +24,8 @@ mkdir -p $TYPES_DESTINATION_DIR
 
 if [[ "$PLATFORM" == "Linux" && ("${ARCH,,}" == "arm64" || "${ARCH,,}" == "aarch64") ]]; then
     if [[ -n "${MANAGEMENT_INTERFACE_PROTO_BUILD_DIR}" ]]; then
-      cp $MANAGEMENT_INTERFACE_PROTO_BUILD_DIR/*.js $DESTINATION_DIR
-      cp $MANAGEMENT_INTERFACE_PROTO_BUILD_DIR/*.ts $TYPES_DESTINATION_DIR
+      cp "$MANAGEMENT_INTERFACE_PROTO_BUILD_DIR"/*.js $DESTINATION_DIR
+      cp "$MANAGEMENT_INTERFACE_PROTO_BUILD_DIR"/*.ts $TYPES_DESTINATION_DIR
     else
       >&2 echo "Building management interface proto files on aarch64 is not supported"
       >&2 echo "(see https://github.com/grpc/grpc-node/issues/1497)."
@@ -41,7 +41,7 @@ else
       $PROTO_DIR/$PROTO_FILENAME
 
   "$NODE_MODULES_DIR/grpc_tools_node_protoc" \
-      --plugin=protoc-gen-ts=$TS_PROTOC_PLUGIN \
+      --plugin=protoc-gen-ts="$TS_PROTOC_PLUGIN" \
       --ts_out=grpc_js:$TYPES_DESTINATION_DIR \
       --proto_path=$PROTO_DIR \
       $PROTO_DIR/$PROTO_FILENAME

gui/scripts/crowdin.sh

@@ -3,7 +3,7 @@ set -e
 
 BASE_URL=https://api.crowdin.com/api/project/mullvad-app
 SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-ROOT_DIR=$( dirname $SCRIPT_DIR )
+ROOT_DIR=$( dirname "$SCRIPT_DIR" )
 LOCALE_DIR="$ROOT_DIR/locales"
 
 if [ $# -ne 1 ]; then
@@ -32,9 +32,9 @@ function download_translations {
     wget \
         --content-disposition \
         $BASE_URL/download/all.zip?key="$CROWDIN_API_KEY"
-    unzip -o all.zip -d $LOCALE_DIR
-    find $LOCALE_DIR -type d -exec chmod 755 {} \;
-    find $LOCALE_DIR -type f -exec chmod 644 {} \;
+    unzip -o all.zip -d "$LOCALE_DIR"
+    find "$LOCALE_DIR" -type d -exec chmod 755 {} \;
+    find "$LOCALE_DIR" -type f -exec chmod 644 {} \;
     rm all.zip
 }
 

ios/build-rust-library.sh

@@ -43,18 +43,18 @@ for arch in $ARCHS; do
 
       # Intel iOS simulator
       export CFLAGS_x86_64_apple_ios="-target x86_64-apple-ios"
-      $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib $RELFLAG --target x86_64-apple-ios
-      $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib --target x86_64-apple-ios
+      "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib "$RELFLAG" --target x86_64-apple-ios
+      "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib --target x86_64-apple-ios
       ;;
 
     arm64)
       if [ $IS_SIMULATOR -eq 0 ]; then
         # Hardware iOS targets
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib $RELFLAG --target aarch64-apple-ios
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib --target aarch64-apple-ios
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib "$RELFLAG" --target aarch64-apple-ios
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib --target aarch64-apple-ios
       else
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib $RELFLAG --target aarch64-apple-ios-sim
-        $HOME/.cargo/bin/cargo build -p $FFI_TARGET --lib --target aarch64-apple-ios-sim
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib "$RELFLAG" --target aarch64-apple-ios-sim
+        "$HOME"/.cargo/bin/cargo build -p "$FFI_TARGET" --lib --target aarch64-apple-ios-sim
       fi
   esac
 done