--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit f46e70249c407897bc3d43952fe0a8b401afe630
Parents : be4fc38
Author : Ivan <e46112d44649266d71fe2193e00a4710>
Signature : T66BB85Valid, signed by author
Date : 2026-07-24T06:19:27-05:00
refactor: update wheel and APK handling in build scripts by replacing glob patterns with array expansions and find commands.
Changes
32 files changed, 64 insertions(+), 59 deletions(-)
Diff
diff --git a/meshchatx.rsm b/meshchatx.rsm
index 523462e5..10934b12 100644
Binary files a/meshchatx.rsm and b/meshchatx.rsm differ
diff --git a/scripts/android/sync-codec2-jni-libs.sh b/scripts/android/sync-codec2-jni-libs.sh
index 774fd377..e981f678 100755
--- a/scripts/android/sync-codec2-jni-libs.sh
+++ b/scripts/android/sync-codec2-jni-libs.sh
@@ -23,7 +23,7 @@ fi
for abi in ${ABI_LIST//,/ }; do
tag="$(abi_to_tag "${abi}")"
- lib_wheel="$(ls "${VENDOR_DIR}"/chaquopy_libcodec2-*-android_*_"${tag}".whl 2>/dev/null | tail -n 1 || true)"
+ lib_wheel="$(find "${VENDOR_DIR}" -maxdepth 1 -type f -name "chaquopy_libcodec2-*-android_*_${tag}.whl" 2>/dev/null | sort | tail -n 1 || true)"
if [[ -z "${lib_wheel}" ]]; then
echo "No chaquopy_libcodec2 wheel for ${abi} under ${VENDOR_DIR}" >&2
exit 1
diff --git a/scripts/build-android-wheels-local.sh b/scripts/build-android-wheels-local.sh
index e323756d..184d186c 100755
--- a/scripts/build-android-wheels-local.sh
+++ b/scripts/build-android-wheels-local.sh
@@ -320,14 +320,14 @@ VENV_DIR="${PYPIDIR}/.venv-local"
rm -rf "${VENV_DIR}"
"${PYTHON_BIN}" -m venv "${VENV_DIR}"
# Some Python images only provide python3/python3.X in venv bin, while the
-# script below invokes `${VENV_DIR}/bin/python`.
+# script below invokes the venv bin/python entrypoint.
if [[ ! -e "${VENV_DIR}/bin/python" && -e "${VENV_DIR}/bin/python3" ]]; then
ln -sf python3 "${VENV_DIR}/bin/python"
fi
"${VENV_DIR}/bin/pip" install --upgrade pip
"${VENV_DIR}/bin/pip" install -r "${PYPIDIR}/requirements.txt"
"${VENV_DIR}/bin/pip" install "numpy==${NUMPY_VERSION}"
-# Chaquopy build-wheel.py shells out to `wheel pack`, so ensure the venv scripts are first on PATH.
+# Chaquopy build-wheel.py shells out to wheel pack, so ensure the venv scripts are first on PATH.
export PATH="${VENV_DIR}/bin:${PATH}"
if ! command -v wheel >/dev/null 2>&1; then
echo "Missing required wheel CLI in virtualenv at ${VENV_DIR}" >&2
@@ -677,8 +677,12 @@ done
popd >/dev/null
mkdir -p "${OUT_DIR}"
-cp -f "${PYPIDIR}/dist/chaquopy-libcodec2"/chaquopy_libcodec2-"${LIBCODEC2_VERSION}"-*.whl "${OUT_DIR}/"
-cp -f "${PYPIDIR}/dist/pycodec2"/pycodec2-"${PYCODEC2_VERSION}"-*.whl "${OUT_DIR}/"
+shopt -s nullglob
+_codec2_wheels=("${PYPIDIR}/dist/chaquopy-libcodec2/chaquopy_libcodec2-${LIBCODEC2_VERSION}-"*.whl)
+_pycodec2_wheels=("${PYPIDIR}/dist/pycodec2/pycodec2-${PYCODEC2_VERSION}-"*.whl)
+shopt -u nullglob
+cp -f "${_codec2_wheels[@]}" "${OUT_DIR}/"
+cp -f "${_pycodec2_wheels[@]}" "${OUT_DIR}/"
echo "Bundling libcodec2.so into pycodec2 wheels (Android dlopen)"
"${VENV_DIR}/bin/python" "${ROOT_DIR}/scripts/repack-android-pycodec2-wheels.py" --vendor-dir "${OUT_DIR}"
@@ -1080,12 +1084,14 @@ PY
--abi "${abi}" \
"${RECIPE_DST}"
- WHEEL_GLOB="${PYPIDIR}/dist/${PACKAGE_NAME}"/*android_"${API_LEVEL}"_"${abi_tag}".whl
- if ! ls ${WHEEL_GLOB} >/dev/null 2>&1; then
+ shopt -s nullglob
+ wheels=("${PYPIDIR}/dist/${PACKAGE_NAME}/"*android_"${API_LEVEL}_${abi_tag}".whl)
+ shopt -u nullglob
+ if [[ ${#wheels[@]} -eq 0 ]]; then
echo "Missing wheel output for ${PACKAGE_NAME} ${PACKAGE_VERSION} ${abi}" >&2
exit 1
fi
- for built_wheel in ${WHEEL_GLOB}; do
+ for built_wheel in "${wheels[@]}"; do
cp -f "${built_wheel}" "${OUT_DIR}/"
fix_wheel_libpython_needed "${OUT_DIR}/$(basename "${built_wheel}")" "libpython${PYTHON_MINOR}.so"
done
@@ -1116,4 +1122,4 @@ fi
echo "Done."
echo "Built wheels in: ${OUT_DIR}"
-ls -1 "${OUT_DIR}" | sort
+find "${OUT_DIR}" -mindepth 1 -maxdepth 1 -printf '%f\n' | sort
diff --git a/scripts/build-macos-universal.sh b/scripts/build-macos-universal.sh
index 7a45744f..1af5c9bf 100644
--- a/scripts/build-macos-universal.sh
+++ b/scripts/build-macos-universal.sh
@@ -17,7 +17,7 @@ cd "$ROOT"
# @electron/universal merges x64 and arm64 app bundles and requires every non-binary
# file present in both trees to have identical bytes. Per-arch backend-manifest.json
-# contents always differ, so skip embedding it here; electron/main.js treats a missing
+# contents always differ, so skip embedding it here. electron/main.js treats a missing
# manifest as "skip integrity check" (see verifyBackendIntegrity).
export MESHCHATX_SKIP_BACKEND_MANIFEST=1
diff --git a/scripts/build/fetch_repository_wheels.py b/scripts/build/fetch_repository_wheels.py
index 80633141..4093fa8b 100644
--- a/scripts/build/fetch_repository_wheels.py
+++ b/scripts/build/fetch_repository_wheels.py
@@ -8,7 +8,7 @@ copies any missing *.whl files from that directory into each identity's
repository-server/bundled folder (no network required).
The PyPI/sdist wheel intentionally omits this tree (see MANIFEST.in and
-tool.setuptools.exclude-package-data); use this script for desktop or
+tool.setuptools.exclude-package-data). Use this script for desktop or
Android builds, or refresh bundled wheels when online. If
dist/reticulum_meshchatx-*.whl exists at the project root, it is copied into
the bundled directory after PyPI downloads so the shipped wheel matches this
diff --git a/scripts/ci/android-emulator-smoke.sh b/scripts/ci/android-emulator-smoke.sh
index b472335c..9ed4bffb 100755
--- a/scripts/ci/android-emulator-smoke.sh
+++ b/scripts/ci/android-emulator-smoke.sh
@@ -68,7 +68,7 @@ fail_with_logs() {
probe_status_ok() {
# Probe from inside the emulator (server binds 127.0.0.1 on-device).
- # Prefer toybox wget (API 30+ images); fall back to python if present.
+ # Prefer toybox wget (API 30+ images). Fall back to python if present.
local body=""
if adb shell "command -v wget >/dev/null 2>&1" >/dev/null 2>&1; then
body="$(adb shell "wget -qO- --no-check-certificate https://127.0.0.1:8000${STATUS_PATH}" 2>/dev/null | tr -d '\r' || true)"
diff --git a/scripts/ci/attest-release-assets.sh b/scripts/ci/attest-release-assets.sh
index aef66668..caaf3e87 100755
--- a/scripts/ci/attest-release-assets.sh
+++ b/scripts/ci/attest-release-assets.sh
@@ -1,8 +1,8 @@
#!/bin/sh
# Create SLSA v1 cosign bundle attestations next to each release binary under DIR.
-# Requires: cosign on PATH; COSIGN_KEY_PATH to cosign private key PEM; COSIGN_PASSWORD
+# Requires: cosign on PATH, COSIGN_KEY_PATH to cosign private key PEM, and COSIGN_PASSWORD
# if the key is encrypted. Run from repository root so scripts/ci/slsa-predicate.py resolves.
-# Cosign v3+: uses cosign-signing-config-no-rekor.json (no Rekor upload); verify with
+# Cosign v3+: uses cosign-signing-config-no-rekor.json (no Rekor upload). Verify with
# cosign verify-blob-attestation --insecure-ignore-tlog=true when using the repo public key.
#
# Usage: attest-release-assets.sh <directory>
@@ -10,7 +10,7 @@ set -eu
DIR="${1:?directory}"
KEY="${COSIGN_KEY_PATH:?set COSIGN_KEY_PATH}"
-SCI_DIR="$(CDPATH= cd -- "$(dirname "$0")" && pwd)"
+SCI_DIR="$(CDPATH='' cd -- "$(dirname "$0")" && pwd)"
SIGNCFG="${SCI_DIR}/cosign-signing-config-no-rekor.json"
if [ ! -f "$KEY" ]; then
diff --git a/scripts/ci/ci-node-path.sh b/scripts/ci/ci-node-path.sh
index ffbddbb6..68eafa16 100755
--- a/scripts/ci/ci-node-path.sh
+++ b/scripts/ci/ci-node-path.sh
@@ -1,6 +1,6 @@
#!/bin/sh
# Ensure /usr/local/bin (go-task, etc.) is on PATH without shadowing actions/setup-node.
-# ARM64 GitHub-hosted images may ship Node 20 in /usr/local/bin; prepending it breaks pnpm 11.
+# ARM64 GitHub-hosted images may ship Node 20 in /usr/local/bin. Prepending it breaks pnpm 11.
case ":${PATH}:" in
*:/usr/local/bin:*) ;;
*) PATH="${PATH}:/usr/local/bin" ;;
diff --git a/scripts/ci/docker-tags.sh b/scripts/ci/docker-tags.sh
index 68b8e408..2161079d 100755
--- a/scripts/ci/docker-tags.sh
+++ b/scripts/ci/docker-tags.sh
@@ -4,8 +4,8 @@
# Usage: docker-tags.sh <image_name> [output_file]
# Environment: GITEA_REF / GITHUB_REF, GITEA_REF_NAME / GITHUB_REF_NAME, TAG_SUFFIX
#
-# The output file contains one `-t registry/image:tag` per line,
-# suitable for passing directly to `docker buildx build`.
+# The output file contains one -t registry/image:tag per line,
+# suitable for passing directly to docker buildx build.
set -eu
IMAGE="$1"
@@ -14,11 +14,10 @@ SUFFIX="${TAG_SUFFIX:-}"
: > "$OUTPUT"
_suffix_tag() {
- local tag="$1"
if [ -n "$SUFFIX" ]; then
- printf '%s' "${tag}${SUFFIX}"
+ printf '%s' "${1}${SUFFIX}"
else
- printf '%s' "$tag"
+ printf '%s' "$1"
fi
}
diff --git a/scripts/ci/exec-priv.sh b/scripts/ci/exec-priv.sh
index 7d6a59d8..b4867ce6 100755
--- a/scripts/ci/exec-priv.sh
+++ b/scripts/ci/exec-priv.sh
@@ -3,5 +3,6 @@
# Usage: sh scripts/ci/exec-priv.sh apt-get update
set -eu
+# shellcheck source=priv.sh disable=SC1091
. "$(dirname "$0")/priv.sh"
run_priv "$@"
diff --git a/scripts/ci/github-apt-linux-packaging.sh b/scripts/ci/github-apt-linux-packaging.sh
index e022aa3d..1192de67 100755
--- a/scripts/ci/github-apt-linux-packaging.sh
+++ b/scripts/ci/github-apt-linux-packaging.sh
@@ -2,7 +2,7 @@
# APT packages needed for Linux Electron packaging (AppImage, deb, rpm) on Debian/Ubuntu or in Dockerfile.build (root).
set -euo pipefail
-# shellcheck source=scripts/ci/priv.sh
+# shellcheck source=priv.sh disable=SC1091
. "$(dirname "$0")/priv.sh"
_HOST_ARCH="$(uname -m)"
@@ -11,8 +11,8 @@ if [ "$_HOST_ARCH" = "x86_64" ]; then
fi
run_priv apt-get update -y
-_PKGS="patchelf libopusfile0 espeak-ng zip rpm elfutils fakeroot file"
+_PKGS=(patchelf libopusfile0 espeak-ng zip rpm elfutils fakeroot file)
if [ "$_HOST_ARCH" = "x86_64" ]; then
- _PKGS="$_PKGS libc6:i386 libstdc++6:i386"
+ _PKGS+=("libc6:i386" "libstdc++6:i386")
fi
-run_priv apt-get install -y --no-install-recommends $_PKGS
+run_priv apt-get install -y --no-install-recommends "${_PKGS[@]}"
diff --git a/scripts/ci/github-build-macos.sh b/scripts/ci/github-build-macos.sh
index a7feb5a1..7968b20c 100755
--- a/scripts/ci/github-build-macos.sh
+++ b/scripts/ci/github-build-macos.sh
@@ -1,5 +1,5 @@
#!/usr/bin/env bash
-# Build macOS universal (x64 + arm64) DMG via electron-builder. Unsigned CI build; signing is disabled.
+# Build macOS universal (x64 + arm64) DMG via electron-builder. Unsigned CI build. Signing is disabled.
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
diff --git a/scripts/ci/github-draft-release-upload-assets.sh b/scripts/ci/github-draft-release-upload-assets.sh
index d3111b62..7179da46 100755
--- a/scripts/ci/github-draft-release-upload-assets.sh
+++ b/scripts/ci/github-draft-release-upload-assets.sh
@@ -48,7 +48,6 @@ skip_noise() {
library.zip | library.zip.cosign.bundle) return 0 ;;
*__library.zip | *__library.zip.cosign.bundle) return 0 ;;
*.so.yml | *.so.yml.cosign.bundle) return 0 ;;
- *__*.so.yml | *__*.so.yml.cosign.bundle) return 0 ;;
esac
return 1
}
@@ -118,7 +117,7 @@ mapfile -t files < <(find "$STAGE" -type f)
for f in "${files[@]}"; do
b=$(basename "$f")
hash=$(sha256sum "$f" | awk '{print $1}')
- printf '| %s | `%s` |\n' "$b" "$hash"
+ printf "| %s | \`%s\` |\n" "$b" "$hash"
done
echo
echo "## Verification"
diff --git a/scripts/ci/github-ensure-macos-x86-64-homebrew.sh b/scripts/ci/github-ensure-macos-x86-64-homebrew.sh
index c458d747..32d711ff 100755
--- a/scripts/ci/github-ensure-macos-x86-64-homebrew.sh
+++ b/scripts/ci/github-ensure-macos-x86-64-homebrew.sh
@@ -1,6 +1,6 @@
#!/usr/bin/env bash
# Ensure an x86_64 (Rosetta) Homebrew exists at /usr/local/bin/brew.
-# GitHub-hosted Apple Silicon runners ship /opt/homebrew only; cx_Freeze universal
+# GitHub-hosted Apple Silicon runners ship /opt/homebrew only. cx_Freeze universal
# x64 slices need x86_64 libraries from /usr/local (see codec2, libyaml steps).
set -euo pipefail
diff --git a/scripts/ci/github-install-macos-x64-python-deps.sh b/scripts/ci/github-install-macos-x64-python-deps.sh
index 59eea3cb..d6d672b6 100755
--- a/scripts/ci/github-install-macos-x64-python-deps.sh
+++ b/scripts/ci/github-install-macos-x64-python-deps.sh
@@ -1,6 +1,6 @@
#!/usr/bin/env bash
# Install locked Python deps for the darwin-x64 cx_Freeze slice on Apple Silicon CI.
-# The arm64 slice uses uv sync into .venv; this script mirrors that with .venv-x64 so
+# The arm64 slice uses uv sync into .venv. This script mirrors that with .venv-x64 so
# NumPy/LXST native wheels match the lockfile instead of unpinned pip -e . resolution.
set -euo pipefail
@@ -66,7 +66,7 @@ if [[ -z "$_NUMPY_VERSION" || -z "$_PYCODEC2_VERSION" ]]; then
exit 1
fi
-# Host is arm64; without --python-platform uv still resolves macOS wheels for aarch64.
+# Host is arm64. Without --python-platform uv still resolves macOS wheels for aarch64.
# pycodec2 has no cp314 macOS x86_64 wheel, so uv would build it from sdist and pull
# numpy into an isolated cross build (meson: "Can not run test applications").
uv sync --frozen --group dev \
@@ -90,7 +90,7 @@ uv pip install --python "$_PY" \
# native extension is installed as x86_64-only, so the arm64-loaded interpreter
# fails to dlopen it ("incompatible architecture"). Building the wheel ourselves
# lets us force x86_64 on the one interpreter invocation that runs native code
-# (via `arch -x86_64`), then hand uv a finished wheel to install, which is a
+# (via arch -x86_64), then hand uv a finished wheel to install, which is a
# plain file copy where uv's own architecture no longer matters.
_lock_sdist_url() {
awk -v pkg="$1" '
@@ -128,8 +128,8 @@ uv pip install --python "$_PY" \
--python-platform x86_64-apple-darwin \
"$_pycodec2_wheel"
-# Cython/wheel are build-time-only tools for the pycodec2 sdist compile above;
-# the finished wheel's .so no longer needs them at runtime. uv.lock does not
+# Cython/wheel are build-time-only tools for the pycodec2 sdist compile above.
+# The finished wheel's .so no longer needs them at runtime. uv.lock does not
# pin either, so leaving them installed would make this venv's site-packages
# diverge from .venv's (arm64, which never builds pycodec2 from source and
# never needs them) -- cx_Freeze's module finder bundles whatever is actually
diff --git a/scripts/ci/install-git-hooks.sh b/scripts/ci/install-git-hooks.sh
index 43493fcd..54d432f8 100755
--- a/scripts/ci/install-git-hooks.sh
+++ b/scripts/ci/install-git-hooks.sh
@@ -2,7 +2,7 @@
# Point this clone at .githooks/ (tracked git hooks).
set -eu
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
git config core.hooksPath .githooks
diff --git a/scripts/ci/macos-normalize-pycodec2-dylib.sh b/scripts/ci/macos-normalize-pycodec2-dylib.sh
index d9b9eda3..ffe1d952 100755
--- a/scripts/ci/macos-normalize-pycodec2-dylib.sh
+++ b/scripts/ci/macos-normalize-pycodec2-dylib.sh
@@ -2,7 +2,7 @@
# Normalize the installed pycodec2 package's bundled libcodec2 into a fixed,
# arch-independent relative layout:
#
-# pycodec2/pycodec2*.so (extension module; @loader_path/libcodec2.dylib)
+# pycodec2/pycodec2*.so (extension module, @loader_path/libcodec2.dylib)
# pycodec2/libcodec2.dylib (single canonical name, no .dylibs/ subfolder)
#
# Published macOS wheels bundle libcodec2 under pycodec2/.dylibs/libcodec2.<ver>.dylib
diff --git a/scripts/ci/setup-cosign.sh b/scripts/ci/setup-cosign.sh
index 484746cd..bba3fc3d 100755
--- a/scripts/ci/setup-cosign.sh
+++ b/scripts/ci/setup-cosign.sh
@@ -3,6 +3,7 @@
# Usage: setup-cosign.sh [version]
set -eu
+# shellcheck source=priv.sh disable=SC1091
. "$(dirname "$0")/priv.sh"
COSIGN_VERSION="${1:-3.0.6}"
diff --git a/scripts/ci/setup-task.sh b/scripts/ci/setup-task.sh
index bdafb9aa..69303283 100755
--- a/scripts/ci/setup-task.sh
+++ b/scripts/ci/setup-task.sh
@@ -4,6 +4,7 @@
# Usage: setup-task.sh [version]
set -eu
+# shellcheck source=priv.sh disable=SC1091
. "$(dirname "$0")/priv.sh"
TASK_VERSION="${1:-3.49.1}"
diff --git a/scripts/ci/sign-tree-rsm.sh b/scripts/ci/sign-tree-rsm.sh
index 165714cf..6d2ec872 100755
--- a/scripts/ci/sign-tree-rsm.sh
+++ b/scripts/ci/sign-tree-rsm.sh
@@ -12,7 +12,7 @@
# RNS_ID_PATH=~/.local/share/reticulum-go/reticulum-go-release.rid sh scripts/ci/sign-tree-rsm.sh
set -eu
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
ID_PATH="${RNS_ID_PATH:-}"
diff --git a/scripts/ci/tree-manifest.sh b/scripts/ci/tree-manifest.sh
index 395c53b4..45765258 100755
--- a/scripts/ci/tree-manifest.sh
+++ b/scripts/ci/tree-manifest.sh
@@ -18,7 +18,7 @@
# tree-manifest.sh verify-tracked [inv] also fail if tracked files are missing from inv
set -eu
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
MANIFEST_HEADER="# meshchatx tree manifest v1"
diff --git a/scripts/ci/trivy-fs-scan.sh b/scripts/ci/trivy-fs-scan.sh
index 45eba086..64feaac5 100755
--- a/scripts/ci/trivy-fs-scan.sh
+++ b/scripts/ci/trivy-fs-scan.sh
@@ -4,7 +4,7 @@
set -eu
# MeshChatX runtime Python deps come from uv.lock (and pip-audit). Vendored trees may
-# ship upstream poetry.lock files for standalone development only; skip them here.
+# ship upstream poetry.lock files for standalone development only. Skip them here.
exec trivy fs --exit-code 1 --severity HIGH,CRITICAL \
--skip-dirs .pnpm-store,.venv,temp-tests \
--skip-files vendor/lxmfy/poetry.lock,vendor/lxmfy/docs/poetry.lock \
diff --git a/scripts/ci/verify-package-contents-smoke.sh b/scripts/ci/verify-package-contents-smoke.sh
index 6e128448..7c3151a4 100755
--- a/scripts/ci/verify-package-contents-smoke.sh
+++ b/scripts/ci/verify-package-contents-smoke.sh
@@ -2,7 +2,7 @@
# Smoke tests for verify-package-contents.sh (no full freeze required).
set -euo pipefail
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
SCRIPT="$ROOT/scripts/ci/verify-package-contents.sh"
tmp="$(mktemp -d "${TMPDIR:-/tmp}/pkg-bloat-test.XXXXXX")"
trap 'rm -rf "$tmp"' EXIT INT
diff --git a/scripts/ci/verify-package-contents.sh b/scripts/ci/verify-package-contents.sh
index 8bb3f66b..ebadbde1 100755
--- a/scripts/ci/verify-package-contents.sh
+++ b/scripts/ci/verify-package-contents.sh
@@ -15,7 +15,7 @@
# PACKAGE_BLOAT_MAX_HITS stop after N hits (default 40)
set -euo pipefail
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
MODE="${1:-}"
TARGET="${2:-}"
MAX_HITS="${PACKAGE_BLOAT_MAX_HITS:-40}"
@@ -113,7 +113,7 @@ scan_directory_tree() {
deny_re="$2"
# Process substitution keeps scan_path_list in this shell (hits accumulate).
scan_path_list "$deny_re" < <(
- CDPATH= cd -- "$root" || exit 1
+ CDPATH='' cd -- "$root" || exit 1
find . -print 2>/dev/null | sed 's|^\./||'
)
}
@@ -149,7 +149,7 @@ scan_dir() {
scan_wheel() {
whl="${TARGET:-}"
if [ -z "$whl" ]; then
- whl="$(ls -1 "$ROOT"/python-dist/*.whl 2>/dev/null | head -n 1 || true)"
+ whl="$(find "$ROOT/python-dist" -maxdepth 1 -type f -name '*.whl' -print 2>/dev/null | head -n 1 || true)"
fi
[ -n "$whl" ] && [ -f "$whl" ] || {
echo "verify-package-contents.sh: wheel not found" >&2
@@ -193,7 +193,7 @@ scan_appimage() {
echo "verify-package-contents.sh: extracting AppImage $ai"
chmod +x "$ai" || true
(
- CDPATH= cd -- "$tmp"
+ CDPATH='' cd -- "$tmp"
"$ai" --appimage-extract >/dev/null
)
scan_directory_tree "$tmp/squashfs-root" "$FROZEN_DENY_RE"
diff --git a/scripts/ci/verify-tree-rsm.sh b/scripts/ci/verify-tree-rsm.sh
index 5baa3a27..3f8fa5cb 100755
--- a/scripts/ci/verify-tree-rsm.sh
+++ b/scripts/ci/verify-tree-rsm.sh
@@ -15,7 +15,7 @@
# sh scripts/ci/verify-tree-rsm.sh
set -eu
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
SIGNER="${RNS_REQUIRED_SIGNER:-e46112d44649266d71fe2193e00a4710}"
diff --git a/scripts/ci/verify-workspace-clean.sh b/scripts/ci/verify-workspace-clean.sh
index 093fa0ef..d422f8d6 100755
--- a/scripts/ci/verify-workspace-clean.sh
+++ b/scripts/ci/verify-workspace-clean.sh
@@ -13,7 +13,7 @@
# RNS_TREE_VERIFY_STRICT if 1, fail the process on verify errors
set -eu
-ROOT="$(CDPATH= cd -- "$(dirname "$0")/../.." && pwd)"
+ROOT="$(CDPATH='' cd -- "$(dirname "$0")/../.." && pwd)"
cd "$ROOT"
STRICT="${RNS_TREE_VERIFY_STRICT:-0}"
diff --git a/scripts/docker-bake-lxst-filterlib-musl.py b/scripts/docker-bake-lxst-filterlib-musl.py
index 2813533f..96b0a46f 100644
--- a/scripts/docker-bake-lxst-filterlib-musl.py
+++ b/scripts/docker-bake-lxst-filterlib-musl.py
@@ -3,13 +3,13 @@
"""Alpine/musl Docker: copy cffi-built filter shared library to LXST.filterlib name.
-LXST ships glibc-tagged filterlib*.so wheels; musl ignores them and cffi
+LXST ships glibc-tagged filterlib*.so wheels. On musl, those are ignored and cffi
verify() drops the musl artifact under LXST/__pycache__/_cffi__*.so.
Without this step, a fresh process cannot resolve LXST.filterlib for
ffi.dlopen() and would try to compile again at runtime (no gcc).
The cffi artifact is a plain shared library (loaded via dlopen), not a Python
-extension module (no PyInit_filterlib); do not import LXST.filterlib.
+extension module (no PyInit_filterlib). Do not import LXST.filterlib.
"""
from __future__ import annotations
diff --git a/scripts/ensure-flatpak-flathub-remote.sh b/scripts/ensure-flatpak-flathub-remote.sh
index 23a10d9a..63d139e3 100644
--- a/scripts/ensure-flatpak-flathub-remote.sh
+++ b/scripts/ensure-flatpak-flathub-remote.sh
@@ -1,5 +1,5 @@
#!/usr/bin/env bash
-# flatpak-bundler installs runtimes with flatpak --user and a bare ref; that only works
+# flatpak-bundler installs runtimes with flatpak --user and a bare ref. That only works
# once the Flathub remote exists (see @malept/flatpak-bundler ensureRef).
set -euo pipefail
diff --git a/scripts/rpi/install_meshchatx.sh b/scripts/rpi/install_meshchatx.sh
index 206c856c..bc8fd788 100755
--- a/scripts/rpi/install_meshchatx.sh
+++ b/scripts/rpi/install_meshchatx.sh
@@ -5,7 +5,7 @@ set -euo pipefail
# MESHCHATX_RELEASES_RSS Release feed (default: .../MeshChatX/releases.rss)
# MESHCHATX_REPO_BASE Repo root for synthesized wheel URLs if RSS has no
# .whl link in descriptions (default: derived from RSS URL)
-# Cosign: Sigstore attestation verify needs the real cosign binary; this script can
+# Cosign: Sigstore attestation verify needs the real cosign binary. This script can
# download a checksum-verified release from GitHub to /tmp if none is on PATH.
# MESHCHATX_COSIGN_VERSION (default: 3.0.6)
# MESHCHATX_COSIGN_PUB_URL (default: raw cosign.pub from master in this repo)
diff --git a/scripts/setup_wine_env.sh b/scripts/setup_wine_env.sh
index febf3b7d..c23d15bc 100755
--- a/scripts/setup_wine_env.sh
+++ b/scripts/setup_wine_env.sh
@@ -29,7 +29,7 @@ echo "Downloading Windows Python and Git..."
wget -q "$PYTHON_URL"
wget -q "$GIT_URL"
-chmod +x *.exe
+chmod +x ./*.exe
echo "Initializing Wine prefix in $WINEPREFIX..."
wine_wrap wine wineboot --init
diff --git a/scripts/sign-android-apks.sh b/scripts/sign-android-apks.sh
index 485a6209..a009ff96 100755
--- a/scripts/sign-android-apks.sh
+++ b/scripts/sign-android-apks.sh
@@ -70,7 +70,7 @@ if [[ -z "${ANDROID_HOME}" ]]; then
exit 1
fi
-BT_DIR="$(ls -d "${ANDROID_HOME}"/build-tools/* 2>/dev/null | sort -V | tail -n 1)"
+BT_DIR="$(find "${ANDROID_HOME}/build-tools" -mindepth 1 -maxdepth 1 -type d 2>/dev/null | sort -V | tail -n 1)"
if [[ -z "${BT_DIR}" ]]; then
echo "No Android build-tools found under ${ANDROID_HOME}/build-tools." >&2
exit 1
@@ -81,9 +81,7 @@ if [[ ! -x "${BT_DIR}/zipalign" || ! -x "${BT_DIR}/apksigner" ]]; then
fi
APK_GLOB="${APK_GLOB:-android/app/build/outputs/apk/release/*-unsigned.apk}"
-shopt -s nullglob
-APKS=( ${APK_GLOB} )
-shopt -u nullglob
+mapfile -t APKS < <(compgen -G "${APK_GLOB}" || true)
if [[ ${#APKS[@]} -eq 0 ]]; then
echo "No unsigned APKs matched: ${APK_GLOB}" >&2
exit 1
diff --git a/scripts/unify-backend-plain-files.sh b/scripts/unify-backend-plain-files.sh
index 89b16f01..364887f0 100755
--- a/scripts/unify-backend-plain-files.sh
+++ b/scripts/unify-backend-plain-files.sh
@@ -5,8 +5,8 @@
# 1. Every file must exist in BOTH trees (no unique-to-one-arch files).
# 2. Every non-Mach-O file must be byte-identical across trees.
#
-# Python bytecode (.pyc inside library.zip) is architecture-independent;
-# only timestamps and zip metadata cause SHA differences.
+# Python bytecode (.pyc inside library.zip) is architecture-independent.
+# Only timestamps and zip metadata cause SHA differences.
set -euo pipefail
@@ -82,14 +82,14 @@ while IFS= read -r -d '' rel; do
unified=$((unified + 1))
continue
fi
- # cx_Freeze bundles pure-Python modules into lib/library.zip; native
+ # cx_Freeze bundles pure-Python modules into lib/library.zip. Native
# extensions are always written to the filesystem separately (they
# can't be dlopen'd from inside a zip), so this archive's *contents*
# are pure CPython bytecode just like loose .pyc files. Its raw bytes
# almost always differ across two independent builds (each entry's
# own PEP 552 header + the zip's own per-entry timestamps), so only
# trust a blind copy once we've confirmed both slices bundled the
- # same set of modules; a differing member list would mean the two
+ # same set of modules. A differing member list would mean the two
# Python environments actually resolved different dependencies.
if [[ "$(basename "$rel")" == "library.zip" ]]; then
# Exclude *.dist-info provenance files that record *how* a package
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────