ci: format shellscripts

Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>

.github/actions/constellation_create/aws-logs.sh

@@ -2,42 +2,42 @@
 
 # Usage: ./aws-logs.sh <region>
 
-controlAutoscalingGroup=$(\
-    terraform show -json | \
+controlAutoscalingGroup=$(
+  terraform show -json |
     jq -r .'values.root_module.child_modules[] |
         select(.address == "module.instance_group_control_plane") |
-        .resources[0].values.name' \
+        .resources[0].values.name'
 )
-workerAutoscalingGroup=$(\
-    terraform show -json | \
+workerAutoscalingGroup=$(
+  terraform show -json |
     jq -r .'values.root_module.child_modules[] |
         select(.address == "module.instance_group_worker_nodes") |
-        .resources[0].values.name' \
+        .resources[0].values.name'
 )
 
-controlInstances=$(\
+controlInstances=$(
   aws autoscaling describe-auto-scaling-groups \
     --region "${1}" \
     --no-paginate \
     --output json \
-        --auto-scaling-group-names "${controlAutoscalingGroup}" | \
-    jq -r '.AutoScalingGroups[0].Instances[].InstanceId' \
+    --auto-scaling-group-names "${controlAutoscalingGroup}" |
+    jq -r '.AutoScalingGroups[0].Instances[].InstanceId'
 )
-workerInstances=$(\
+workerInstances=$(
   aws autoscaling describe-auto-scaling-groups \
     --region "${1}" \
     --no-paginate \
     --output json \
-        --auto-scaling-group-names "${workerAutoscalingGroup}" | \
-    jq -r '.AutoScalingGroups[0].Instances[].InstanceId' \
+    --auto-scaling-group-names "${workerAutoscalingGroup}" |
+    jq -r '.AutoScalingGroups[0].Instances[].InstanceId'
 )
 
 echo "Fetching logs from control planes: ${controlInstances}"
 
 for instance in ${controlInstances}; do
   printf "Fetching for %s\n" "${instance}"
-    aws ec2 get-console-output --region "${1}" --instance-id "${instance}" | \
-        jq -r .'Output' | \
+  aws ec2 get-console-output --region "${1}" --instance-id "${instance}" |
+    jq -r .'Output' |
     tail -n +2 > control-plane-"${instance}".log
 done
 
@@ -45,7 +45,7 @@ echo "Fetching logs from worker nodes: ${workerInstances}"
 
 for instance in ${workerInstances}; do
   printf "Fetching for %s\n" "${instance}"
-    aws ec2 get-console-output --region "${1}" --instance-id "${instance}" | \
-        jq -r .'Output' | \
+  aws ec2 get-console-output --region "${1}" --instance-id "${instance}" |
+    jq -r .'Output' |
     tail -n +2 > worker-"${instance}".log
 done

.github/actions/constellation_create/az-logs.sh

@@ -13,10 +13,21 @@ subscription=$(az account  show | jq -r .id)
 printf "Checking scalesets %s\n" "${scalesetslist}"
 
 for scaleset in ${scalesetslist}; do
-    instanceids=$(az vmss list-instances --resource-group "${1}" --name "${scaleset}" -o json | jq -r '.[] | .instanceId')
+  instanceids=$(
+    az vmss list-instances \
+      --resource-group "${1}" \
+      --name "${scaleset}" \
+      -o json |
+      jq -r '.[] | .instanceId'
+  )
   printf "Checking instance IDs %s\n" "${instanceids}"
   for instanceid in ${instanceids}; do
-        bloburi=$(az rest --method post --url https://management.azure.com/subscriptions/"${subscription}"/resourceGroups/"${1}"/providers/Microsoft.Compute/virtualMachineScaleSets/"${scaleset}"/virtualmachines/"${instanceid}"/retrieveBootDiagnosticsData?api-version=2022-03-01 | jq '.serialConsoleLogBlobUri' -r)
+    bloburi=$(
+      az rest \
+        --method post \
+        --url https://management.azure.com/subscriptions/"${subscription}"/resourceGroups/"${1}"/providers/Microsoft.Compute/virtualMachineScaleSets/"${scaleset}"/virtualmachines/"${instanceid}"/retrieveBootDiagnosticsData?api-version=2022-03-01 |
+        jq '.serialConsoleLogBlobUri' -r
+    )
     sleep 4
     curl -sL -o "./${scaleset}-${instanceid}.log" "${bloburi}"
     realpath "./${scaleset}-${instanceid}.log"

hack/azure-jump-host/jump-host-create

@@ -3,7 +3,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-SCRIPTDIR="$(dirname --  "$(realpath "${BASH_SOURCE[0]}")"; )";
+SCRIPTDIR="$(dirname -- "$(realpath "${BASH_SOURCE[0]}")")"
 RG=$(jq -r .azureresourcegroup constellation-state.json)
 SUBNET=$(jq -r .azuresubnet constellation-state.json)
 VNET=${SUBNET%"/subnets/nodeNetwork"}
@@ -21,7 +21,13 @@ az deployment group create \
   --parameters "{ \"subnetRef\": { \"value\": \"${SUBNET}\" } }" \
   --parameters "{ \"adminPublicKey\": { \"value\": \"${PUBKEY}\" } }"
 az deployment group wait --created --name "${DEPLOYMENT_NAME}" --resource-group "${RG}"
-PUBIP=$(az vm list-ip-addresses  --resource-group "${RG}" --name "${VM_NAME}" --query "[].virtualMachine.network.publicIpAddresses[0].ipAddress" --output tsv)
+PUBIP=$(
+  az vm list-ip-addresses \
+    --resource-group "${RG}" \
+    --name "${VM_NAME}" \
+    --query "[].virtualMachine.network.publicIpAddresses[0].ipAddress" \
+    --output tsv
+)
 echo "Jump host created. Cleanup by deleteing the resource group."
 echo "Connect to the jump host with the following command:"
 echo -e "ssh azureuser@${PUBIP}\n"

hack/check-licenses.sh

@@ -19,17 +19,17 @@ while read -r line; do
     lic=${line##*,}
 
     case ${lic} in
-    Apache-2.0|BSD-2-Clause|BSD-3-Clause|ISC|MIT)
-      ;;
+    Apache-2.0 | BSD-2-Clause | BSD-3-Clause | ISC | MIT) ;;
 
+    \
       MPL-2.0)
       case ${pkg} in
-        github.com/talos-systems/talos/pkg/machinery/config/encoder)
-          ;;
-        github.com/letsencrypt/boulder)
-          ;;
-        github.com/hashicorp/*)
-          ;;
+      github.com/talos-systems/talos/pkg/machinery/config/encoder) ;;
+
+      github.com/letsencrypt/boulder) ;;
+
+      github.com/hashicorp/*) ;;
+
       *)
         not_allowed
         ;;
@@ -38,8 +38,8 @@ while read -r line; do
 
     AGPL-3.0)
       case ${pkg} in
-        github.com/edgelesssys/constellation/v2)
-          ;;
+      github.com/edgelesssys/constellation/v2) ;;
+
       *)
         not_allowed
         ;;

hack/fetch-broken-e2e/fetch.sh

@@ -3,20 +3,36 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-LATEST_AZURE_RUNS=$(gh run list -R edgelesssys/constellation -w 'e2e Test Azure' --json databaseId  -q '.[].databaseId')
+LATEST_AZURE_RUNS=$(
+  gh run list \
+    -R edgelesssys/constellation \
+    -w 'e2e Test Azure' \
+    --json databaseId \
+    -q '.[].databaseId'
+)
 echo "${LATEST_AZURE_RUNS}"
-for RUN_ID in ${LATEST_AZURE_RUNS}
-do
+for RUN_ID in ${LATEST_AZURE_RUNS}; do
   # Might fail, because no state was written, because e2e pipeline failed early
   # Or, because state was downloaded by earlier run of this script
-    gh run download "${RUN_ID}" -R edgelesssys/constellation -n constellation-state.json -D azure/"${RUN_ID}" || true
+  gh run download "${RUN_ID}" \
+    -R edgelesssys/constellation \
+    -n constellation-state.json \
+    -D azure/"${RUN_ID}" || true
 done
 
-LATEST_GCP_RUNS=$(gh run list -R edgelesssys/constellation -w 'e2e Test GCP' --json databaseId  -q '.[].databaseId')
+LATEST_GCP_RUNS=$(
+  gh run list \
+    -R edgelesssys/constellation \
+    -w 'e2e Test GCP' \
+    --json databaseId \
+    -q '.[].databaseId'
+)
 echo "${LATEST_GCP_RUNS}"
-for RUN_ID in ${LATEST_GCP_RUNS}
-do
+for RUN_ID in ${LATEST_GCP_RUNS}; do
   # Might fail, because no state was written, because e2e pipeline failed early
   # Or, because state was downloaded by earlier run of this script
-    gh run download "${RUN_ID}" -R edgelesssys/constellation -n constellation-state.json -D gcp/"${RUN_ID}" || true
+  gh run download "${RUN_ID}" \
+    -R edgelesssys/constellation \
+    -n constellation-state.json \
+    -D gcp/"${RUN_ID}" || true
 done

hack/fetch-broken-e2e/find.sh

@@ -4,8 +4,7 @@ set -euo pipefail
 shopt -s inherit_errexit
 
 TO_DELETE=$(grep -lr "\"uid\": \"${1}\"" . || true)
-if [[ -z "${TO_DELETE}" ]]
-then
+if [[ -z ${TO_DELETE} ]]; then
   printf "Unable to find '%s'\n" "${1}"
 else
   printf "Statefile found. You should run:\n\n"

hack/importAzure.sh

@@ -18,20 +18,17 @@ set -euo pipefail
 shopt -s inherit_errexit
 
 # Required tools
-if ! command -v az &> /dev/null
-then
+if ! command -v az &> /dev/null; then
   echo "az CLI could not be found"
   echo "Please instal it from: https://docs.microsoft.com/en-us/cli/azure/install-azure-cli"
   exit
 fi
-if ! command -v azcopy &> /dev/null
-then
+if ! command -v azcopy &> /dev/null; then
   echo "azcopy could not be found"
   echo "Please instal it from: https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10"
   exit
 fi
-if ! command -v jq &> /dev/null
-then
+if ! command -v jq &> /dev/null; then
   echo "jq could not be found"
   echo "Please instal it from: https://github.com/stedolan/jq"
   exit
@@ -47,17 +44,16 @@ AZURE_IMAGE_DEFINITION="${AZURE_IMAGE_DEFINITION:-constellation}"
 AZURE_SKU="${AZURE_SKU:-constellation}"
 AZURE_SECURITY_TYPE="${AZURE_SECURITY_TYPE:-TrustedLaunch}"
 
-if [[ -z "${AZURE_RESOURCE_GROUP_NAME}" ]]; then
+if [[ -z ${AZURE_RESOURCE_GROUP_NAME} ]]; then
   echo "Please provide a value for AZURE_RESOURCE_GROUP_NAME."
   exit 1
 fi
 
-if [[ -z "${AZURE_IMAGE_VERSION}" ]]; then
+if [[ -z ${AZURE_IMAGE_VERSION} ]]; then
   echo "Please provide a value for AZURE_IMAGE_VERSION of pattern <major>.<minor>.<patch>"
   exit 1
 fi
 
-
 echo "Using following settings:"
 echo "AZURE_REGION=${AZURE_REGION}"
 echo "AZURE_RESOURCE_GROUP_NAME=${AZURE_RESOURCE_GROUP_NAME}"
@@ -75,8 +71,14 @@ echo ""
 read -r -p "Continue (y/n)?" choice
 case "${choice}" in
 y | Y) echo "Starting import..." ;;
-  n|N ) echo "Abort!"; exit 1;;
-  * ) echo "invalid"; exit 1;;
+n | N)
+  echo "Abort!"
+  exit 1
+  ;;
+*)
+  echo "invalid"
+  exit 1
+  ;;
 esac
 
 echo "Preparing to upload '${AZURE_IMAGE_FILE} to Azure."
@@ -97,20 +99,22 @@ az disk create \
 echo "Waiting for disk to be created."
 az disk wait --created -n "${AZURE_IMAGE_NAME}" -g "${AZURE_RESOURCE_GROUP_NAME}"
 echo "Retrieving disk ID."
-AZURE_DISK_ID=$(az disk list \
+AZURE_DISK_ID=$(
+  az disk list \
     --query "[?name == '${AZURE_IMAGE_NAME}' && resourceGroup == '${AZURE_RESOURCE_GROUP_NAME^^}'] | [0].id" \
-    --output json \
-    | jq -r \
+    --output json |
+    jq -r
 )
 echo "Disk ID is ${AZURE_DISK_ID}"
 
 echo "Generating SAS URL for authorized upload."
-AZURE_SAS_URL=$(az disk grant-access \
+AZURE_SAS_URL=$(
+  az disk grant-access \
     -n "${AZURE_IMAGE_NAME}" \
     -g "${AZURE_RESOURCE_GROUP_NAME}" \
     --access-level Write \
-    --duration-in-seconds 86400 \
-    | jq -r .accessSas \
+    --duration-in-seconds 86400 |
+    jq -r .accessSas
 )
 echo "Uploading image file to Azure disk."
 azcopy copy "${AZURE_IMAGE_FILE}" "${AZURE_SAS_URL}" --blob-type PageBlob
@@ -143,9 +147,10 @@ az sig image-definition create \
   --hyper-v-generation V2 \
   --features SecurityType="${AZURE_SECURITY_TYPE}"
 echo "Retrieving temporary image ID."
-AZURE_IMAGE_ID=$(az image list \
+AZURE_IMAGE_ID=$(
+  az image list \
     --query "[?name == '${AZURE_IMAGE_NAME}' && resourceGroup == '${AZURE_RESOURCE_GROUP_NAME^^}'] | [0].id" \
-    --output json | jq -r \
+    --output json | jq -r
 )
 
 echo "Creating final image version."
@@ -163,13 +168,14 @@ echo "Cleaning up ephemeral resources."
 az image delete --ids "${AZURE_IMAGE_ID}"
 az disk delete -y --ids "${AZURE_DISK_ID}"
 
-IMAGE_VERSION=$(az sig image-version show \
+IMAGE_VERSION=$(
+  az sig image-version show \
     --resource-group "${AZURE_RESOURCE_GROUP_NAME}" \
     --gallery-name "${AZURE_GALLERY_NAME}" \
     --gallery-image-definition "${AZURE_IMAGE_DEFINITION}" \
     --gallery-image-version "${AZURE_IMAGE_VERSION}" \
     -o tsv \
-  --query id \
+    --query id
 )
 echo "Image ID is ${IMAGE_VERSION}"
 

image/measured-boot/measure_util.sh

@@ -12,7 +12,10 @@ pcr_extend() {
   local CURRENT_PCR="$1"
   local EXTEND_WITH="$2"
   local HASH_FUNCTION="$3"
-    ( echo -n "${CURRENT_PCR}" | xxd -r -p ; echo -n "${EXTEND_WITH}" | xxd -r -p; ) | ${HASH_FUNCTION} | cut -d " " -f 1
+  (
+    echo -n "${CURRENT_PCR}" | xxd -r -p
+    echo -n "${EXTEND_WITH}" | xxd -r -p
+  ) | ${HASH_FUNCTION} | cut -d " " -f 1
 }
 
 extract() {

image/measured-boot/precalculate_pcr_4.sh

@@ -63,9 +63,9 @@ expected_pcr_4=$(pcr_extend "${expected_pcr_4}" "${sd_boot_authentihash}" "sha25
 expected_pcr_4=$(pcr_extend "${expected_pcr_4}" "${uki_authentihash}" "sha256sum")
 
 echo "Authentihashes:"
-echo "Stage 1 – shim:                       ${shim_authentihash}"
-echo "Stage 2 – sd-boot:                    ${sd_boot_authentihash}"
-echo "Stage 3 – Unified Kernel Image (UKI): ${uki_authentihash}"
+echo "Stage 1 - shim:                       ${shim_authentihash}"
+echo "Stage 2 - sd-boot:                    ${sd_boot_authentihash}"
+echo "Stage 3 - Unified Kernel Image (UKI): ${uki_authentihash}"
 echo ""
 echo "Expected PCR[4]:                      ${expected_pcr_4}"
 echo ""

image/measured-boot/precalculate_pcr_8.sh

@@ -58,7 +58,7 @@ cleanup "${DIR}"
 
 expected_pcr_8=0000000000000000000000000000000000000000000000000000000000000000
 expected_pcr_8=$(pcr_extend "${expected_pcr_8}" "${cmdline_hash}" "sha256sum")
-if [[ "${CSP}" == "azure" ]]; then
+if [[ ${CSP} == "azure" ]]; then
   # Azure displays the boot menu
   # triggering an extra measurement of the kernel command line.
   expected_pcr_8=$(pcr_extend "${expected_pcr_8}" "${cmdline_hash}" "sha256sum")

image/measured-boot/precalculate_pcr_9.sh

@@ -23,7 +23,6 @@ initrd_measure () {
   sha256sum "${path}" | cut -d " " -f 1
 }
 
-
 write_output() {
   local out="$1"
   cat > "${out}" << EOF

image/mkosi.skeleton/usr/lib/dracut/modules.d/38azure-provision/azure-provisioning.sh

@@ -5,15 +5,13 @@ set -euo pipefail
 shopt -s inherit_errexit
 
 attempts=1
-until [[ "${attempts}" -gt 5 ]]
-do
+until [[ ${attempts} -gt 5 ]]; do
   echo "obtaining goal state - attempt ${attempts}"
   goalstate=$(curl --fail -v -X 'GET' -H "x-ms-agent-name: azure-vm-register" \
     -H "Content-Type: text/xml;charset=utf-8" \
     -H "x-ms-version: 2012-11-30" \
     "http://168.63.129.16/machine/?comp=goalstate")
-    if [[ $? -eq 0 ]]
-    then
+  if [[ $? -eq 0 ]]; then
     echo "successfully retrieved goal state"
     retrieved_goal_state=true
     break
@@ -22,8 +20,7 @@ do
   attempts=$((attempts + 1))
 done
 
-if [[ "${retrieved_goal_state}" != "true" ]]
-then
+if [[ ${retrieved_goal_state} != "true" ]]; then
   echo "failed to obtain goal state - cannot register this VM"
   exit 1
 fi
@@ -31,7 +28,8 @@ fi
 container_id=$(grep ContainerId <<< "${goalstate}" | sed 's/\s*<\/*ContainerId>//g' | sed 's/\r$//')
 instance_id=$(grep InstanceId <<< "${goalstate}" | sed 's/\s*<\/*InstanceId>//g' | sed 's/\r$//')
 
-ready_doc=$(cat << EOF
+ready_doc=$(
+  cat << EOF
 <?xml version="1.0" encoding="utf-8"?>
 <Health xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
   <GoalStateIncarnation>1</GoalStateIncarnation>
@@ -51,16 +49,14 @@ EOF
 )
 
 attempts=1
-until [[ "${attempts}" -gt 5 ]]
-do
+until [[ ${attempts} -gt 5 ]]; do
   echo "registering with Azure - attempt ${attempts}"
   curl --fail -v -X 'POST' -H "x-ms-agent-name: azure-vm-register" \
     -H "Content-Type: text/xml;charset=utf-8" \
     -H "x-ms-version: 2012-11-30" \
     -d "${ready_doc}" \
     "http://168.63.129.16/machine?comp=health"
-    if [[ $? -eq 0 ]]
-    then
+  if [[ $? -eq 0 ]]; then
     echo "successfully register with Azure"
     break
   fi

image/mkosi.skeleton/usr/lib/dracut/modules.d/38azure-provision/module-setup.sh

@@ -11,8 +11,10 @@ depends() {
 }
 
 install_and_enable_unit() {
-    unit="$1"; shift
-    target="$1"; shift
+  unit="$1"
+  shift
+  target="$1"
+  shift
   inst_simple "${moddir:?}/${unit}" "${systemdsystemunitdir:?}/${unit}"
   mkdir -p "${initdir:?}${systemdsystemconfdir:?}/${target}.wants"
   ln_r "${systemdsystemunitdir}/${unit}" \

image/mkosi.skeleton/usr/lib/dracut/modules.d/39constellation-mount/aws-nvme-disk.sh

@@ -10,16 +10,14 @@ AWS_STATE_DISK_DEVICENAME="sdb"
 AWS_STATE_DISK_SYMLINK="/dev/${AWS_STATE_DISK_DEVICENAME}"
 
 # hack: aws nvme udev rules are never executed. Create symlinks for the nvme devices manually.
-while [[ ! -L "${AWS_STATE_DISK_SYMLINK}" ]]
-do
-    for nvmedisk in /dev/nvme*n1
-    do
+while [[ ! -L ${AWS_STATE_DISK_SYMLINK} ]]; do
+  for nvmedisk in /dev/nvme*n1; do
     linkname=$(nvme amzn id-ctrl -b "${nvmedisk}" | tail -c +3072 | tr -d ' ') || true
-        if [[ -n "${linkname}" ]] && [[ "${linkname}" == "${AWS_STATE_DISK_DEVICENAME}" ]]; then
+    if [[ -n ${linkname} ]] && [[ ${linkname} == "${AWS_STATE_DISK_DEVICENAME}" ]]; then
       ln -s "${nvmedisk}" "${AWS_STATE_DISK_SYMLINK}"
     fi
   done
-    if [[ -L "${AWS_STATE_DISK_SYMLINK}" ]]; then
+  if [[ -L ${AWS_STATE_DISK_SYMLINK} ]]; then
     break
   fi
   echo "Waiting for state disk to appear.."

image/mkosi.skeleton/usr/lib/dracut/modules.d/39constellation-mount/module-setup.sh

@@ -9,8 +9,10 @@ depends() {
 }
 
 install_and_enable_unit() {
-    unit="$1"; shift
-    target="$1"; shift
+  unit="$1"
+  shift
+  target="$1"
+  shift
   inst_simple "${moddir:?}/${unit}" "${systemdsystemunitdir:?}/${unit}"
   mkdir -p "${initdir:?}${systemdsystemconfdir:?}/${target}.wants"
   ln_r "${systemdsystemunitdir}/${unit}" \
@@ -18,7 +20,8 @@ install_and_enable_unit() {
 }
 
 install_path() {
-    local dir="$1"; shift
+  local dir="$1"
+  shift
   mkdir -p "${initdir}/${dir}"
 }
 

image/mkosi.skeleton/usr/lib/udev/google_nvme_id

@@ -59,7 +59,7 @@ function get_namespace_device_name() {
     return 1
   fi
 
-  if [[ -z "${nvme_json}" ]]; then
+  if [[ -z ${nvme_json} ]]; then
     err "NVMe Vendor Extension disk information not present"
     return 1
   fi
@@ -68,7 +68,7 @@ function get_namespace_device_name() {
   device_name="$(echo "${nvme_json}" | grep device_name | sed -e 's/.*"device_name":[  \t]*"\([a-zA-Z0-9_-]\+\)".*/\1/')"
 
   # Error if our device name is empty
-  if [[ -z "${device_name}" ]]; then
+  if [[ -z ${device_name} ]]; then
     err "Empty name"
     return 1
   fi
@@ -91,7 +91,7 @@ function get_namespace_device_name() {
 function get_namespace_number() {
   local dev_path="$1"
   local namespace_number
-  if [[ "${dev_path}" =~ ${NAMESPACE_NUMBER_REGEX} ]]; then
+  if [[ ${dev_path} =~ ${NAMESPACE_NUMBER_REGEX} ]]; then
     namespace_number="${BASH_REMATCH[1]}"
   else
     return 1
@@ -114,7 +114,7 @@ function get_namespace_number() {
 function get_partition_number() {
   local dev_path="$1"
   local partition_number
-  if [[ "${dev_path}" =~ ${PARTITION_NUMBER_REGEX} ]]; then
+  if [[ ${dev_path} =~ ${PARTITION_NUMBER_REGEX} ]]; then
     partition_number="${BASH_REMATCH[1]}"
     echo "${partition_number}"
   else
@@ -136,7 +136,7 @@ function gen_symlink() {
   local partition_number
   partition_number="$(get_partition_number "${dev_path}")"
 
-  if [[ -n "${partition_number}" ]]; then
+  if [[ -n ${partition_number} ]]; then
     ln -s "${dev_path}" /dev/disk/by-id/google-"${ID_SERIAL_SHORT}"-part"${partition_number}" > /dev/null 2>&1
   else
     ln -s "${dev_path}" /dev/disk/by-id/google-"${ID_SERIAL_SHORT}" > /dev/null 2>&1
@@ -184,17 +184,19 @@ function main() {
     case "${flag}" in
     d) device_path="${OPTARG}" ;;
     s) opt_gen_symlink='true' ;;
-      h) print_help_message
+    h)
+      print_help_message
       return 0
       ;;
-      :) echo "Invalid option: ${OPTARG} requires an argument" 1>&2
+    :)
+      echo "Invalid option: ${OPTARG} requires an argument" 1>&2
       return 1
       ;;
-      *) return 1
+    *) return 1 ;;
     esac
   done
 
-  if [[ -z "${device_path}" ]]; then
+  if [[ -z ${device_path} ]]; then
     echo "Device path (-d) argument required. Use -h for full usage." 1>&2
     exit 1
   fi
@@ -218,7 +220,7 @@ script as root/with sudo)."
   # Detect the type of attached nvme device
   local controller_id
   controller_id=$("${nvme_cli_bin}" id-ctrl "${device_path}")
-  if [[ ! "${controller_id}" =~ nvme_card-pd ]] ; then
+  if [[ ! ${controller_id} =~ nvme_card-pd ]]; then
     err "Device is not a PD-NVMe device"
     return 1
   fi
@@ -231,7 +233,7 @@ script as root/with sudo)."
   fi
 
   # Gen symlinks or print out the globals set by the identify command
-  if [[ "${opt_gen_symlink}" == 'true' ]]; then
+  if [[ ${opt_gen_symlink} == 'true' ]]; then
     gen_symlink "${device_path}"
   else
     # These will be consumed by udev

image/secure-boot/azure/delete.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if [[ -z "${CONFIG_FILE-}" ]] && [[ -f "${CONFIG_FILE-}" ]]; then
+if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
   # shellcheck source=/dev/null
   . "${CONFIG_FILE}"
 fi
@@ -38,7 +38,6 @@ SUBNET=$(echo "${NIC_INFO}" | jq -r '.ipConfigurations[0].subnet.id')
 VNET=${SUBNET//\/subnets\/.*/}
 DISK=$(echo "${AZ_VM_INFO}" | jq -r '.storageProfile.osDisk.managedDisk.id')
 
-
 delete_vm() {
   az vm delete -y --name "${AZURE_VM_NAME}" \
     --resource-group "${AZURE_RESOURCE_GROUP_NAME}" || true

image/secure-boot/azure/extract_vmgs.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if [[ -z "${CONFIG_FILE-}" ]] && [[ -f "${CONFIG_FILE-}" ]]; then
+if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
   # shellcheck source=/dev/null
   . "${CONFIG_FILE}"
 fi

image/secure-boot/azure/launch.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if [[ -z "${CONFIG_FILE-}" ]] && [[ -f "${CONFIG_FILE-}" ]]; then
+if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
   # shellcheck source=/dev/null
   . "${CONFIG_FILE}"
 fi
@@ -47,9 +47,9 @@ done
 
 set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
 
-if [[ "${AZURE_SECURITY_TYPE}" == "ConfidentialVM" ]]; then
+if [[ ${AZURE_SECURITY_TYPE} == "ConfidentialVM" ]]; then
   VMSIZE="Standard_DC2as_v5"
-elif [[ "${AZURE_SECURITY_TYPE}" == "TrustedLaunch" ]]; then
+elif [[ ${AZURE_SECURITY_TYPE} == "TrustedLaunch" ]]; then
   VMSIZE="standard_D2as_v5"
 else
   echo "Unknown security type: ${AZURE_SECURITY_TYPE}"
@@ -94,7 +94,7 @@ create_vm_from_sig () {
     --no-wait
 }
 
-if [[ "${CREATE_FROM_GALLERY}" = "YES" ]]; then
+if [[ ${CREATE_FROM_GALLERY} == "YES" ]]; then
   create_vm_from_sig
 else
   create_vm_from_disk

image/secure-boot/generate_nvram_vars.sh

@@ -10,7 +10,7 @@ SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 BASE_DIR=$(realpath "${SCRIPT_DIR}/..")
 
 # Set to qemu+tcp://localhost:16599/system for dockerized libvirt setup
-if [[ -z "${LIBVIRT_SOCK}" ]]; then
+if [[ -z ${LIBVIRT_SOCK} ]]; then
   LIBVIRT_SOCK=qemu:///system
 fi
 

image/secure-boot/genkeys.sh

@@ -15,10 +15,10 @@ shopt -s inherit_errexit
 SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &> /dev/null && pwd)
 TEMPLATES=${SCRIPT_DIR}/templates
 BASE_DIR=$(realpath "${SCRIPT_DIR}/..")
-if [[ -z "${PKI}" ]]; then
+if [[ -z ${PKI} ]]; then
   PKI=${BASE_DIR}/pki
 fi
-if [[ -z "${PKI_SET}" ]]; then
+if [[ -z ${PKI_SET} ]]; then
   PKI_SET=dev
 fi
 
@@ -26,8 +26,7 @@ gen_pki () {
   # Only use for non-production images.
   # Use real PKI for production images instead.
   count=$(find "${PKI}" -maxdepth 1 \( -name '*.key' -o -name '*.crt' -o -name '*.cer' -o -name '*.esl' -o -name '*.auth' \) 2> /dev/null | wc -l)
-    if [[ "${count}" != 0 ]]
-    then
+  if [[ ${count} != 0 ]]; then
     echo PKI files "$(ls -1 "$(realpath "--relative-to=$(pwd)" "${PKI}")"/*.{key,crt,cer,esl,auth})" already exist
     return
   fi

image/secure-boot/signed-shim.sh

@@ -8,8 +8,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if (( $# != 1 ))
-then
+if (($# != 1)); then
   echo "Usage: $0 <image.raw>"
   exit 1
 fi

image/upload/pack.sh

@@ -8,8 +8,7 @@ shopt -s inherit_errexit
 
 # Show progress on pipes if `pv` is installed
 # Otherwise use plain cat
-if ! command -v pv &> /dev/null
-then
+if ! command -v pv &> /dev/null; then
   PV="cat"
 else
   PV="pv"

image/upload/upload_aws.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if [[ -z "${CONFIG_FILE-}" ]] && [[ -f "${CONFIG_FILE-}" ]]; then
+if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
   # shellcheck source=/dev/null
   . "${CONFIG_FILE}"
 fi
@@ -88,7 +88,7 @@ tag_ami_with_backing_snapshot() {
 make_ami_public() {
   local ami_id=$1
   local region=$2
-    if [ "${AWS_PUBLISH-}" != "true" ]; then
+  if [[ ${AWS_PUBLISH-} != "true" ]]; then
     return
   fi
   aws ec2 modify-image-attribute \
@@ -117,7 +117,8 @@ create_ami_from_raw_disk() {
   echo "Deleting raw disk image from S3"
   aws s3 rm "s3://${AWS_BUCKET}/${AWS_IMAGE_FILENAME}"
   rm "${CONTAINERS_JSON}"
-    REGISTER_OUT=$(aws ec2 register-image \
+  REGISTER_OUT=$(
+    aws ec2 register-image \
       --region "${AWS_REGION}" \
       --name "${AWS_IMAGE_NAME}" \
       --boot-mode uefi \
@@ -126,7 +127,7 @@ create_ami_from_raw_disk() {
       --block-device-mappings "DeviceName=/dev/xvda,Ebs={SnapshotId=${AWS_SNAPSHOT}}" \
       --ena-support \
       --tpm-support v2.0 \
-        --uefi-data "$(cat "${AWS_EFIVARS_PATH}")" \
+      --uefi-data "$(cat "${AWS_EFIVARS_PATH}")"
   )
   IMAGE_ID=$(echo "${REGISTER_OUT}" | jq -r '.ImageId')
   AMI_FOR_REGION=(["${AWS_REGION}"]="${IMAGE_ID}")
@@ -149,8 +150,6 @@ replicate_ami() {
   echo "Replicated AMI as ${replicated_image_id} in ${target_region}"
 }
 
-
-
 create_ami_from_raw_disk
 # replicate in parallel
 for region in ${AWS_REPLICATION_REGIONS}; do

image/upload/upload_azure.sh

@@ -6,12 +6,11 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if [[ -z "${CONFIG_FILE-}" ]] && [[ -f "${CONFIG_FILE-}" ]]; then
+if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
   # shellcheck source=/dev/null
   . "${CONFIG_FILE}"
 fi
 
-
 CREATE_SIG_VERSION=NO
 POSITIONAL_ARGS=()
 
@@ -39,12 +38,12 @@ done
 
 set -- "${POSITIONAL_ARGS[@]}" # restore positional parameters
 
-if [[ "${AZURE_SECURITY_TYPE}" == "ConfidentialVM" ]]; then
+if [[ ${AZURE_SECURITY_TYPE} == "ConfidentialVM" ]]; then
   AZURE_DISK_SECURITY_TYPE=ConfidentialVM_VMGuestStateOnlyEncryptedWithPlatformKey
   AZURE_SIG_VERSION_ENCRYPTION_TYPE=EncryptedVMGuestStateOnlyWithPmk
-elif [[ "${AZURE_SECURITY_TYPE}" == "ConfidentialVMSupported" ]]; then
+elif [[ ${AZURE_SECURITY_TYPE} == "ConfidentialVMSupported" ]]; then
   AZURE_DISK_SECURITY_TYPE=""
-elif [[ "${AZURE_SECURITY_TYPE}" == "TrustedLaunch" ]]; then
+elif [[ ${AZURE_SECURITY_TYPE} == "TrustedLaunch" ]]; then
   AZURE_DISK_SECURITY_TYPE=TrustedLaunch
 else
   echo "Unknown security type: ${AZURE_SECURITY_TYPE}"
@@ -52,7 +51,7 @@ else
 fi
 
 AZURE_CVM_ENCRYPTION_ARGS=""
-if [[ -n "${AZURE_SIG_VERSION_ENCRYPTION_TYPE-}" ]]; then
+if [[ -n ${AZURE_SIG_VERSION_ENCRYPTION_TYPE-} ]]; then
   AZURE_CVM_ENCRYPTION_ARGS=" --target-region-cvm-encryption "
   for _ in ${AZURE_REPLICATION_REGIONS}; do
     AZURE_CVM_ENCRYPTION_ARGS=" ${AZURE_CVM_ENCRYPTION_ARGS} ${AZURE_SIG_VERSION_ENCRYPTION_TYPE}, "
@@ -61,10 +60,10 @@ fi
 echo "Replicating image in ${AZURE_REPLICATION_REGIONS}"
 
 AZURE_VMGS_PATH=$1
-if [[ -z "${AZURE_VMGS_PATH}" ]] && [[ "${AZURE_SECURITY_TYPE}" == "ConfidentialVM"  ]]; then
+if [[ -z ${AZURE_VMGS_PATH} ]] && [[ ${AZURE_SECURITY_TYPE} == "ConfidentialVM" ]]; then
   echo "No VMGS path provided - using default ConfidentialVM VMGS"
   AZURE_VMGS_PATH="${BLOBS_DIR}/cvm-vmgs.vhd"
-elif [[ -z "${AZURE_VMGS_PATH}" ]] && [[ "${AZURE_SECURITY_TYPE}" == "TrustedLaunch"  ]]; then
+elif [[ -z ${AZURE_VMGS_PATH} ]] && [[ ${AZURE_SECURITY_TYPE} == "TrustedLaunch" ]]; then
   echo "No VMGS path provided - using default TrsutedLaunch VMGS"
   AZURE_VMGS_PATH="${BLOBS_DIR}/trusted-launch-vmgs.vhd"
 fi
@@ -90,7 +89,7 @@ create_disk_with_vmgs () {
   azcopy copy "${AZURE_IMAGE_PATH}" \
     "$(echo "${DISK_SAS}" | jq -r .accessSas)" \
     --blob-type PageBlob
-    if [[ -z "${AZURE_VMGS_PATH}" ]]; then
+  if [[ -z ${AZURE_VMGS_PATH} ]]; then
     echo "No VMGS path provided - skipping VMGS upload"
   else
     azcopy copy "${AZURE_VMGS_PATH}" \
@@ -121,7 +120,7 @@ create_disk_without_vmgs () {
 }
 
 create_disk() {
-    if [[ -z "${AZURE_VMGS_PATH}" ]]; then
+  if [[ -z ${AZURE_VMGS_PATH} ]]; then
     create_disk_without_vmgs
   else
     create_disk_with_vmgs
@@ -133,7 +132,7 @@ delete_disk () {
 }
 
 create_image() {
-    if [[ -n "${AZURE_VMGS_PATH}" ]]; then
+  if [[ -n ${AZURE_VMGS_PATH} ]]; then
     return
   fi
   az image create \
@@ -146,14 +145,14 @@ create_image () {
 }
 
 delete_image() {
-    if [[ -n "${AZURE_VMGS_PATH}" ]]; then
+  if [[ -n ${AZURE_VMGS_PATH} ]]; then
     return
   fi
   az image delete -n "${AZURE_DISK_NAME}" -g "${AZURE_RESOURCE_GROUP_NAME}"
 }
 
 create_sig_version() {
-    if [[ -n "${AZURE_VMGS_PATH}" ]]; then
+  if [[ -n ${AZURE_VMGS_PATH} ]]; then
     local DISK
     DISK="$(az disk list --query "[?name == '${AZURE_DISK_NAME}' && resourceGroup == '${AZURE_RESOURCE_GROUP_NAME^^}'] | [0].id" --output tsv)"
     local SOURCE="--os-snapshot ${DISK}"
@@ -190,7 +189,7 @@ create_sig_version () {
 
 create_disk
 
-if [[ "${CREATE_SIG_VERSION}" = "YES" ]]; then
+if [[ ${CREATE_SIG_VERSION} == "YES" ]]; then
   create_image
   create_sig_version
   delete_image

image/upload/upload_gcp.sh

@@ -6,7 +6,7 @@
 set -euo pipefail
 shopt -s inherit_errexit
 
-if [[ -z "${CONFIG_FILE-}" ]] && [[ -f "${CONFIG_FILE-}" ]]; then
+if [[ -z ${CONFIG_FILE-} ]] && [[ -f ${CONFIG_FILE-} ]]; then
   # shellcheck source=/dev/null
   . "${CONFIG_FILE}"
 fi