DO NOT MERGE: Shellcheck script files in initrd

.circleci/config.yml

@@ -1,4 +1,5 @@
 version: 2
+
 jobs:
   build:
     docker:
@@ -8,7 +9,7 @@ jobs:
           name: Install dependencies
           command: |
             apt update
-            apt install -y build-essential zlib1g-dev uuid-dev libdigest-sha-perl libelf-dev bc bzip2 bison flex git gnupg iasl m4 nasm patch python wget gnat cpio ccache pkg-config cmake libusb-1.0-0-dev autoconf texinfo ncurses-dev doxygen graphviz udev libudev1 libudev-dev automake libtool rsync
+            apt install -y build-essential zlib1g-dev uuid-dev libdigest-sha-perl libelf-dev bc bzip2 bison flex git gnupg iasl m4 nasm patch python wget gnat cpio ccache pkg-config cmake libusb-1.0-0-dev autoconf texinfo ncurses-dev doxygen graphviz udev libudev1 libudev-dev automake libtool rsync shellcheck
       - checkout
 
       - run:
@@ -26,7 +27,10 @@ jobs:
           command: |
             find modules/musl-cross* -type f | sort -h | xargs sha256sum > /tmp/musl-cross_module_and_patches.sha256sums \
 
-
+      - run:
+          name: Check scripts in ./initrd with Shellcheck
+          command: |
+            make check-scripts
       - restore_cache:
           keys:
             #Restore existing cache for modules checksums validated to be exactly the same as in github current commit

Makefile

@@ -681,3 +681,7 @@ $(HEADS_MAKE): $(build)/$(make_dir)/.configured
 		$(VERBOSE_REDIRECT)
 
 endif
+
+check-scripts:
+	# Chech shell scripts under initrd/
+	shellcheck -x -e SC1091,SC1117 $(shell find ./initrd/ -iname "*.sh" && find ./initrd/ -name "init")

boards/kgpe-d16/kgpe-d16.config

@@ -23,8 +23,8 @@ CONFIG_DROPBEAR=y
 CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
-export CONFIG_BOOTSCRIPT=/bin/generic-init
-#export CONFIG_BOOTSCRIPT_NETWORK=/bin/network-init-recovery
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
+#export CONFIG_BOOTSCRIPT_NETWORK=/bin/network-init-recovery.sh
 
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n

boards/leopard/leopard.config

@@ -37,11 +37,10 @@ CONFIG_LINUX_USB=y
 #CONFIG_LINUX_E1000E=y
 #CONFIG_LINUX_NVME=y
 
-export CONFIG_BOOTSCRIPT=/bin/generic-init
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
 export CONFIG_TPM=n
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_DEV="/dev/sda1"
 
 $(build)/$(BOARD)/linuxboot.rom: linuxboot.intermediate
-

boards/librem_13v2/librem_13v2.config

@@ -29,7 +29,7 @@ CONFIG_LINUX_USB=y
 
 export CONFIG_TPM=y
 export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on"

boards/librem_13v4/librem_13v4.config

@@ -29,7 +29,7 @@ CONFIG_LINUX_USB=y
 
 export CONFIG_TPM=y
 export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on"

boards/librem_15v3/librem_15v3.config

@@ -29,7 +29,7 @@ CONFIG_LINUX_USB=y
 
 export CONFIG_TPM=y
 export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on"

boards/librem_15v4/librem_15v4.config

@@ -29,7 +29,7 @@ CONFIG_LINUX_USB=y
 
 export CONFIG_TPM=y
 export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on"

boards/librem_l1um/librem_l1um.config

@@ -29,7 +29,7 @@ CONFIG_LINUX_USB=y
 export CONFIG_TPM=y
 export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
 
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on"

boards/librem_mini/librem_mini.config

@@ -29,7 +29,7 @@ CONFIG_LINUX_USB=y
 export CONFIG_TPM=n
 export CONFIG_TPM_NO_LUKS_DISK_UNLOCK=y
 
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on"

boards/qemu-coreboot-fbwhiptail/qemu-coreboot-fbwhiptail.config

@@ -38,7 +38,7 @@ CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000=y
 
 #Whiptail-based init (text-based or FBWhiptail)
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 
 export CONFIG_TPM=n
 

boards/qemu-coreboot/qemu-coreboot.config

@@ -44,10 +44,10 @@ CONFIG_LINUX_E1000=y
 
 #Uncomment only one BOOTSCRIPT:
 #Whiptail-based init (text-based or FBWhiptail)
-#export CONFIG_BOOTSCRIPT=/bin/gui-init
+#export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 #
 #text-based original init:
-export CONFIG_BOOTSCRIPT=/bin/generic-init
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
 
 export CONFIG_TPM=n
 

boards/qemu-linuxboot/qemu-linuxboot.config

@@ -32,8 +32,8 @@ CONFIG_LINUX_SCSI_GDTH=y
 CONFIG_LINUX_ATA=y
 CONFIG_LINUX_AHCI=y
 
-export CONFIG_BOOTSCRIPT=/bin/generic-init
-export CONFIG_BOOTSCRIPT_NETWORK=/bin/network-init-recovery
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
+export CONFIG_BOOTSCRIPT_NETWORK=/bin/network-init-recovery.sh
 
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
@@ -54,4 +54,3 @@ run:
 		--serial $(or $(SERIAL),/dev/tty) \
 		-drive if=pflash,format=raw,unit=0,file=$(build)/$(BOARD)/linuxboot.rom
 	stty sane
-

boards/r630/r630.config

@@ -25,7 +25,7 @@ CONFIG_LINUX_IGB=y
 CONFIG_LINUX_MEGARAID=y
 CONFIG_LINUX_E1000E=y
 
-export CONFIG_BOOTSCRIPT=/bin/generic-init
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
 
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n

boards/s2600wf/s2600wf.config

@@ -38,7 +38,7 @@ CONFIG_LINUX_ATA=y
 CONFIG_LINUX_AHCI=y
 
 export CONFIG_TPM=n
-export CONFIG_BOOTSCRIPT=/bin/generic-init
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_DEV="/dev/sda1"

boards/t420/t420.config

@@ -27,7 +27,7 @@ CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
 export CONFIG_TPM=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"

boards/t430-flash/t430-flash.config

@@ -13,7 +13,7 @@ CONFIG_LINUX_CONFIG=config/linux-x230-flash.config
 CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
-export CONFIG_BOOTSCRIPT=/bin/t430-flash.init
+export CONFIG_BOOTSCRIPT=/bin/t430-flash.init.sh
 export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
 
 # This board is "special" in that we only want the top 4 MB of the ROM

boards/t430/t430.config

@@ -40,7 +40,7 @@ CONFIG_DROPBEAR=n
 CONFIG_LINUX_E1000E=n
 
 export CONFIG_TPM=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"

boards/tioga/tioga.config

@@ -40,11 +40,10 @@ CONFIG_LINUX_USB=y
 CONFIG_LINUX_NVME=y
 CONFIG_LINUX_BCM=y
 
-export CONFIG_BOOTSCRIPT=/bin/generic-init
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
 export CONFIG_TPM=n
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_DEV="/dev/sda1"
 
 $(build)/$(BOARD)/linuxboot.rom: linuxboot.intermediate
-

boards/winterfell/winterfell.config

@@ -39,7 +39,7 @@ CONFIG_LINUX_AHCI=y
 CONFIG_LINUX_E1000E=y
 CONFIG_LINUX_NVME=y
 
-export CONFIG_BOOTSCRIPT=/bin/generic-init
+export CONFIG_BOOTSCRIPT=/bin/generic-init.sh
 export CONFIG_TPM=n
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n

boards/x220/x220.config

@@ -27,7 +27,7 @@ CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
 export CONFIG_TPM=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"

boards/x230-flash/x230-flash.config

@@ -18,7 +18,7 @@ CONFIG_LINUX_CONFIG=config/linux-x230-flash.config
 CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=y
 
-export CONFIG_BOOTSCRIPT=/bin/x230-flash.init
+export CONFIG_BOOTSCRIPT=/bin/x230-flash.init.sh
 export CONFIG_FLASHROM_OPTIONS="--force --noverify-all -p internal --ifd --image bios"
 
 # This board is "special" in that we only want the top 4 MB of the ROM

boards/x230-hotp-verification/x230-hotp-verification.config

@@ -1,4 +1,4 @@
-# Configuration for a x230-hotp-verification (Nitrokey/Purism USB Security dongle enabled HOTP support) 
+# Configuration for a x230-hotp-verification (Nitrokey/Purism USB Security dongle enabled HOTP support)
 # running Qubes and other OSes.
 #
 # Deactivated to fit in coreboot's CONFIG_CBFS_SIZE=0x700000 :
@@ -41,7 +41,7 @@ CONFIG_DROPBEAR=n
 CONFIG_LINUX_E1000E=n
 
 export CONFIG_TPM=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"

boards/x230-nkstorecli/x230-nkstorecli.config

@@ -1,4 +1,4 @@
-# Configuration for a x230-nkstorecli (Nitrokey Storage client + HOTP support) 
+# Configuration for a x230-nkstorecli (Nitrokey Storage client + HOTP support)
 # running Qubes and other OSes
 # Note that CBFS region is too small. So e1000e (ethernet) and dropbear (ssh client/server) has been disabled.
 export CONFIG_COREBOOT=y
@@ -33,7 +33,7 @@ CONFIG_LINUX_USB=y
 CONFIG_LINUX_E1000E=n
 
 export CONFIG_TPM=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"

boards/x230/x230.config

@@ -37,7 +37,7 @@ CONFIG_DROPBEAR=n
 CONFIG_LINUX_E1000E=n
 
 export CONFIG_TPM=y
-export CONFIG_BOOTSCRIPT=/bin/gui-init
+export CONFIG_BOOTSCRIPT=/bin/gui-init.sh
 export CONFIG_BOOT_REQ_HASH=n
 export CONFIG_BOOT_REQ_ROLLBACK=n
 export CONFIG_BOOT_KERNEL_ADD="intel_iommu=on intel_iommu=igfx_off"

config/busybox.config

@@ -1063,7 +1063,7 @@ CONFIG_SV_DEFAULT_SERVICE_DIR=""
 CONFIG_SH_IS_ASH=y
 # CONFIG_SH_IS_HUSH is not set
 # CONFIG_SH_IS_NONE is not set
-# CONFIG_BASH_IS_ASH is not set
+CONFIG_BASH_IS_ASH=y
 # CONFIG_BASH_IS_HUSH is not set
 CONFIG_BASH_IS_NONE=y
 CONFIG_ASH=y

config/coreboot-qemu-fbwhiptail.config

@@ -1,6 +1,6 @@
 CONFIG_ANY_TOOLCHAIN=y
 # CONFIG_INCLUDE_CONFIG_FILE is not set
-CONFIG_CBFS_SIZE=0x700000
+CONFIG_CBFS_SIZE=0x710000
 # CONFIG_POST_IO is not set
 CONFIG_BOARD_EMULATION_QEMU_X86_Q35=y
 # CONFIG_POST_DEVICE is not set

initrd/bin/cbfs-init → initrd/bin/cbfs-init.sh

@@ -1,27 +1,28 @@
-#!/bin/ash
+#!/bin/bash
+#
 set -e -o pipefail
-. /etc/functions
+. /etc/functions.sh
 
 # Update initrd with CBFS files
 if [ -z "$CONFIG_PCR" ]; then
 	CONFIG_PCR=7
 fi
 
 # Load individual files
-cbfsfiles=`cbfs -t 50 -l 2>/dev/null | grep "^heads/initrd/"`
+cbfsfiles=$(cbfs -t 50 -l 2>/dev/null | grep "^heads/initrd/")
 
-for cbfsname in `echo $cbfsfiles`; do
+for cbfsname in $cbfsfiles; do
 	filename=${cbfsname:12}
-	if [ ! -z "$filename" ]; then
+	if [ -n "$filename" ]; then
 		echo "Loading $filename from CBFS"
-		mkdir -p `dirname $filename` \
-		|| die "$filename: mkdir failed"
-		cbfs -t 50 -r $cbfsname > "$filename" \
+		DIRNAME=$(dirname "$filename")
+		mkdir -p "$DIRNAME" || die "$filename: mkdir failed"
+		cbfs -t 50 -r "$cbfsname" > "$filename" \
 		|| die "$filename: cbfs file read failed"
 		if [ "$CONFIG_TPM" = "y" ]; then
 			TMPFILE=/tmp/cbfs.$$
 			echo "$filename" > $TMPFILE
-			cat $filename >> $TMPFILE
+			cat "$filename" >> $TMPFILE
 			tpm extend -ix "$CONFIG_PCR" -if $TMPFILE \
 			|| die "$filename: tpm extend failed"
 		fi