making shellcheck happy with some of the code again

diff --git a/letsencrypt.sh b/letsencrypt.sh
index 7973709822143cc40d10566c34ffdd59f8efe0f9..0a304fa62af76d7c772149ff1e51e4412856a896 100755 (executable)
--- a/letsencrypt.sh
+++ b/letsencrypt.sh
@@ -92,6 +92,7 @@ load_config() {
         break
       elif [[ -f "${check_config_d}" ]] && [[ -r "${check_config_d}" ]]; then
         echo "# INFO: Using additional config file ${check_config_d}"
+        # shellcheck disable=SC1090
         . "${check_config_d}"
       else
         _exiterr "Specified additional config ${check_config_d} is not readable or not a file at all." >&2
@@ -160,7 +161,7 @@ init_system() {
   openssl rsa -in "${PRIVATE_KEY}" -check 2>/dev/null > /dev/null || _exiterr "Private key is not valid, can not continue."
 
   # Get public components from private key and calculate thumbprint
-  pubExponent64="$(printf '%x' $(openssl rsa -in "${PRIVATE_KEY}" -noout -text | awk '/publicExponent/ {print $2}') | hex2bin | urlbase64)"
+  pubExponent64="$(printf '%x' "$(openssl rsa -in "${PRIVATE_KEY}" -noout -text | awk '/publicExponent/ {print $2}')" | hex2bin | urlbase64)"
   pubMod64="$(openssl rsa -in "${PRIVATE_KEY}" -noout -modulus | cut -d'=' -f2 | hex2bin | urlbase64)"
 
   thumbprint="$(printf '{"e":"%s","kty":"RSA","n":"%s"}' "${pubExponent64}" "${pubMod64}" | openssl dgst -sha256 -binary | urlbase64)"
@@ -211,8 +212,9 @@ hex2bin() {
 
 # Get string value from json dictionary
 get_json_string_value() {
-  local filter=$(printf 's/.*"%s": *"\([^"]*\)".*/\\1/p' "$1")
-  sed -n "$filter"
+  local filter
+  filter=$(printf 's/.*"%s": *"\([^"]*\)".*/\\1/p' "$1")
+  sed -n "${filter}"
 }
 
 # OpenSSL writes to stderr/stdout even when there are no errors. So just
@@ -315,9 +317,10 @@ extract_altnames() {
     # SANs used, extract these
     altnames="$( <<<"${reqtext}" grep -A1 '^[[:space:]]*X509v3 Subject Alternative Name:[[:space:]]*$' | tail -n1 )"
     # split to one per line:
+    # shellcheck disable=SC1003
     altnames="$( <<<"${altnames}" _sed -e 's/^[[:space:]]*//; s/, /\'$'\n''/g' )"
     # we can only get DNS: ones signed
-    if [ -n "$( <<<"${altnames}" grep -v '^DNS:' )" ]; then
+    if grep -qv '^DNS:' <<<"${altnames}"; then
       _exiterr "Certificate signing request contains non-DNS Subject Alternative Names"
     fi
     # strip away the DNS: prefix
@@ -399,6 +402,7 @@ sign_csr() {
   done
 
   # Wait for hook script to deploy the challenges if used
+  # shellcheck disable=SC2068
   [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" = "yes" ]] && "${HOOK}" "deploy_challenge" ${deploy_args[@]}
 
   # Respond to challenges
@@ -408,6 +412,7 @@ sign_csr() {
     keyauth="${keyauths[${idx}]}"
 
     # Wait for hook script to deploy the challenge if used
+    # shellcheck disable=SC2086
     [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" != "yes" ]] && "${HOOK}" "deploy_challenge" ${deploy_args[${idx}]}
 
     # Ask the acme-server to verify our challenge and wait until it is no longer pending
@@ -426,6 +431,7 @@ sign_csr() {
 
     # Wait for hook script to clean the challenge if used
     if [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" != "yes" ]] && [[ -n "${challenge_token}" ]]; then
+      # shellcheck disable=SC2086
       "${HOOK}" "clean_challenge" ${deploy_args[${idx}]}
     fi
     idx=$((idx+1))
@@ -438,6 +444,7 @@ sign_csr() {
   done
 
   # Wait for hook script to clean the challenges if used
+  # shellcheck disable=SC2068
   [[ -n "${HOOK}" ]] && [[ "${HOOK_CHAIN}" = "yes" ]] && "${HOOK}" "clean_challenge" ${deploy_args[@]}
 
   if [[ "${reqstatus}" != "valid" ]]; then
@@ -511,6 +518,7 @@ sign_domain() {
   rm -f "${tmp_openssl_cnf}"
 
   crt_path="${BASEDIR}/certs/${domain}/cert-${timestamp}.pem"
+  # shellcheck disable=SC2086
   sign_csr "$(< "${BASEDIR}/certs/${domain}/cert-${timestamp}.csr" )" ${altnames} 3>"${crt_path}"
 
   # Create fullchain.pem
@@ -554,7 +562,7 @@ command_sign_domains() {
   # Generate certificates for all domains found in domains.txt. Check if existing certificate are about to expire
   ORIGIFS="${IFS}"
   IFS=$'\n'
-  for line in $(cat "${DOMAINS_TXT}" | tr -d '\r' | _sed -e 's/^[[:space:]]*//g' -e 's/[[:space:]]*$//g' -e 's/[[:space:]]+/ /g' | (grep -vE '^(#|$)' || true)); do
+  for line in $(<"${DOMAINS_TXT}" tr -d '\r' | _sed -e 's/^[[:space:]]*//g' -e 's/[[:space:]]*$//g' -e 's/[[:space:]]+/ /g' | (grep -vE '^(#|$)' || true)); do
     IFS="${ORIGIFS}"
     domain="$(printf '%s\n' "${line}" | cut -d' ' -f1)"
     morenames="$(printf '%s\n' "${line}" | cut -s -d' ' -f2-)"
@@ -696,7 +704,7 @@ command_cleanup() {
       [[ -r "${certdir}/${filetype}" ]] || continue
 
       # Look up current file in use
-      current="$(basename $(readlink "${certdir}/${filetype}"))"
+      current="$(basename "$(readlink "${certdir}/${filetype}")")"
 
       # Split filetype into name and extension
       filebase="$(echo "${filetype}" | cut -d. -f1)"
@@ -710,7 +718,7 @@ command_cleanup() {
         # Check if current file is in use, if unused move to archive directory
         filename="$(basename "${file}")"
         if [[ ! "${filename}" = "${current}" ]]; then
-          echo "Moving unused file to archive directory: ${certname}/$filename"
+          echo "Moving unused file to archive directory: ${certname}/${filename}"
           mv "${certdir}/${filename}" "${archivedir}/${filename}"
         fi
       done