Improve Fix memory usage

Fix build with ghc 8.6.1

.ghci

@@ -1 +1 @@
-:set -idist/build/autogen
+:set -idist/build/autogen -isrc

.github/ISSUE_TEMPLATE.md

@@ -1,8 +1,8 @@
 #### For bugs
 - Rule Id (if any, e.g. SC1000): 
 - My shellcheck version (`shellcheck --version` or "online"): 
+- [ ] I read the issue's wiki page, e.g. https://github.com/koalaman/shellcheck/wiki/SC2086
 - [ ] I tried on shellcheck.net and verified that this is still a problem on the latest commit
-- [ ] It's not reproducible on shellcheck.net, but I think that's because it's an OS, configuration or encoding issue
 
 #### For new checks and feature suggestions
 - [ ] shellcheck.net (i.e. the latest commit) currently gives no useful warnings about this

.gitignore

@@ -1,4 +1,4 @@
-# Created by http://www.gitignore.io
+# Created by https://www.gitignore.io
 
 ### Haskell ###
 dist
@@ -13,3 +13,10 @@ cabal-dev
 cabal.sandbox.config
 cabal.config
 .stack-work
+
+### Snap ###
+/snap/.snapcraft/
+/stage/
+/parts/
+/prime/
+*.snap

.prepare_deploy

@@ -0,0 +1,50 @@
+#!/bin/bash
+# This script packages up Travis compiled binaries
+set -ex
+shopt -s nullglob
+cd deploy
+
+cp ../LICENSE LICENSE.txt
+sed -e $'s/$/\r/' > README.txt << END
+This is a precompiled ShellCheck binary.
+      https://www.shellcheck.net/
+
+ShellCheck is a static analysis tool for shell scripts.
+It's licensed under the GNU General Public License v3.0.
+Information and source code is available on the website.
+
+This binary was compiled on $(date -u).
+
+
+
+      ====== Latest commits ======
+
+$(git log -n 3)
+END
+
+for file in ./*.exe
+do
+  zip "${file%.*}.zip" README.txt LICENSE.txt "$file"
+done
+
+for file in *.linux-x86_64
+do
+  base="${file%.*}"
+  cp "$file" "shellcheck"
+  tar -cJf "$base.linux.x86_64.tar.xz" --transform="s:^:$base/:" README.txt LICENSE.txt shellcheck
+  rm "shellcheck"
+done
+
+for file in *.linux-armv6hf
+do
+  base="${file%.*}"
+  cp "$file" "shellcheck"
+  tar -cJf "$base.linux.armv6hf.tar.xz" --transform="s:^:$base/:" README.txt LICENSE.txt shellcheck
+  rm "shellcheck"
+done
+
+for file in ./*
+do
+  sha512sum "$file" > "$file.sha512sum"
+done
+

.travis.yml

@@ -6,16 +6,75 @@ services:
   - docker
 
 before_install:
-  - export DOCKER_REPO=koalaman/shellcheck
-  - |-
-    export TAG=$([ "$TRAVIS_BRANCH" == "master" ] && echo "latest" || ([ -n "$TRAVIS_TAG" ] && echo "$TRAVIS_TAG") || echo "$TRAVIS_BRANCH")
+  - DOCKER_BASE="$DOCKER_USERNAME/shellcheck"
+  - DOCKER_BUILDS=""
+  - TAGS=""
+  - test "$TRAVIS_BRANCH" = master && TAGS="$TAGS latest" || true
+  - test -n "$TRAVIS_TAG"          && TAGS="$TAGS stable $TRAVIS_TAG" || true
+  - echo "Tags are $TAGS"
 
 script:
-  - docker build -t builder -f Dockerfile_builder .
-  - docker run --rm -it -v $(pwd):/mnt builder
-  - docker build -t $DOCKER_REPO:$TAG .
+  - mkdir deploy
+  # Remove all tests to reduce binary size
+  - ./striptests
+  # Linux Docker image
+  - name="$DOCKER_BASE"
+  - DOCKER_BUILDS="$DOCKER_BUILDS $name"
+  - docker build -t "$name:current" .
+  - docker run "$name:current" --version
+  - printf '%s\n' "#!/bin/sh" "echo 'hello world'" > myscript
+  - docker run -v "$PWD:/mnt" "$name:current" myscript
+  # Copy static executable from docker image
+  - id=$(docker create "$name:current")
+  - docker cp "$id:/bin/shellcheck" "shellcheck"
+  - docker rm "$id"
+  - ls -l shellcheck
+  - ./shellcheck myscript
+  - for tag in $TAGS; do cp "shellcheck" "deploy/shellcheck-$tag.linux-x86_64"; done
+  # Linux Alpine based Docker image
+  - name="$DOCKER_BASE-alpine"
+  - DOCKER_BUILDS="$DOCKER_BUILDS $name"
+  - sed -e '/DELETE-MARKER/,$d' Dockerfile > Dockerfile.alpine
+  - docker build -f Dockerfile.alpine -t "$name:current" .
+  - docker run "$name:current" sh -c 'shellcheck --version'
+  # Linux armv6hf static executable
+  - docker run -v "$PWD:/mnt" koalaman/armv6hf-builder -c 'compile-shellcheck'
+  - for tag in $TAGS; do cp "shellcheck" "deploy/shellcheck-$tag.linux-armv6hf"; done
+  - rm -f shellcheck || true
+  # Windows .exe
+  - docker run --user="$UID" -v "$PWD:/appdata" koalaman/winghc cuib
+  - for tag in $TAGS; do cp "dist/build/ShellCheck/shellcheck.exe" "deploy/shellcheck-$tag.exe"; done
+  - rm -rf dist shellcheck || true
+  # Misc packaging
+  - ./.prepare_deploy
 
 after_success:
-  - docker login -e="$DOCKER_EMAIL" -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"
-  - |-
-    ([ "$TRAVIS_BRANCH" == "master" ] || [ -n "$TRAVIS_TAG" ]) && docker push "$DOCKER_REPO:$TAG"
+  - docker login -u="$DOCKER_USERNAME" -p="$DOCKER_PASSWORD"
+  - for repo in $DOCKER_BUILDS;
+    do
+      for tag in $TAGS;
+      do
+        echo "Deploying $repo:current as $repo:$tag...";
+        docker tag "$repo:current" "$repo:$tag" || exit 1;
+        docker push "$repo:$tag" || exit 1;
+      done;
+    done;
+
+after_failure:
+  - id
+  - pwd
+  - df -h
+  - find . -name '*.log' -type f -exec grep "" /dev/null {} +
+  - find . -ls
+
+deploy:
+  provider: gcs
+  skip_cleanup: true
+  access_key_id: GOOG7MDN7WEH6IIGBDCA
+  secret_access_key:
+    secure: Bcx2cT0/E2ikj7sdamVq52xlLZF9dz9ojGPtoKfPyQhkkZa+McVI4xgUSuyyoSxyKj77sofx2y8m6PJYYumT4g5hREV1tfeUkl0J2DQFMbGDYEt7kxVkXCxojNvhHwTzLFv0ezstrxWWxQm81BfQQ4U9lggRXtndAP4czZnOeHPINPSiue1QNwRAEw05r5UoIUJXy/5xyUrjIxn381pAs+gJqP2COeN9kTKYH53nS/AAws29RprfZFnPlo7xxWmcjRcdS5KPdGXI/c6tQp5zl2iTh510VC1PN2w1Wvnn/oNWhiNdqPyVDsojIX5+sS3nejzJA+KFMxXSBlyXIY3wPpS/MdscU79X6Q5f9ivsFfsm7gNBmxHUPNn0HAvU4ROT/CCE9j6jSbs5PC7QBo3CK4++jxAwE/pd9HUc2rs3k0ofx3rgveJ7txpy5yPKfwIIBi98kVKlC4w7dLvNTOfjW1Imt2yH87XTfsE0UIG9st1WII6s4l/WgBx2GuwKdt6+3QUYiAlCFckkxWi+fAvpHZUEL43Qxub5fN+ZV7Zib1n7opchH4QKGBb6/y0WaDCmtCfu0lppoe/TH6saOTjDFj67NJSElK6ZDxGZ3uw4R+ret2gm6WRKT2Oeub8J33VzSa7VkmFpMPrAAfPa9N1Z4ewBLoTmvxSg2A0dDrCdJio=
+  bucket: shellcheck
+  local-dir: deploy
+  on:
+    repo: koalaman/shellcheck
+    all_branches: true

CHANGELOG.md

@@ -0,0 +1,351 @@
+## ???
+### Added
+- Command line option --severity/-S for filtering by minimum severity
+- Command line option --wiki-link-count/-W for showing wiki links
+- SC2236/SC2237: Suggest -n/-z instead of ! -z/-n
+- SC2238: Warn when redirecting to a known command name, e.g. ls > rm
+- SC2239: Warn if the shebang is not an absolute path, e.g. #!bin/sh
+- SC1133: Better diagnostics when starting a line with |/||/&&
+### Changed
+- Most warnings now have useful end positions
+- SC1117 about unknown double-quoted escape sequences has been retired
+### Fixed
+- SC2021 no longer triggers for equivalence classes like '[=e=]'
+- SC2221/SC2222 no longer mistriggers on fall-through case branches
+
+## v0.5.0 - 2018-05-31
+### Added
+- SC2233/SC2234/SC2235: Suggest removing or replacing (..) around tests
+- SC2232: Warn about invalid arguments to sudo
+- SC2231: Suggest quoting expansions in for loop globs
+- SC2229: Warn about 'read $var'
+- SC2227: Warn about redirections in the middle of 'find' commands
+- SC2224/SC2225/SC2226: Warn when using mv/cp/ln without a destination
+- SC2223: Quote warning specific to `: ${var=value}`
+- SC1131: Warn when using `elseif` or `elsif`
+- SC1128: Warn about blanks/comments before shebang
+- SC1127: Warn about C-style comments
+
+### Fixed
+- Annotations intended for a command's here documents now work
+- Escaped characters inside groups in =~ regexes now parse
+- Associative arrays are now respected in arithmetic contexts
+- SC1087 about `$var[@]` now correctly triggers on any index
+- Bad expansions in here documents are no longer ignored
+- FD move operations like {fd}>1- now parse correctly
+
+### Changed
+- Here docs are now terminated as per spec, rather than by presumed intent
+- SC1073: 'else if' is now parsed correctly and not like 'elif'
+- SC2163: 'export $name' can now be silenced with 'export ${name?}'
+- SC2183: Now warns when printf arg count is not a multiple of format count
+
+## v0.4.7 - 2017-12-08
+### Added
+- Statically linked binaries for Linux and Windows (see README.md)!
+- `-a` flag to also include warnings in `source`d files
+- SC2221/SC2222: Warn about overridden case branches
+- SC2220: Warn about unhandled error cases in getopt loops
+- SC2218: Warn when using functions before they're defined
+- SC2216/SC2217: Warn when piping/redirecting to mv/cp and other non-readers
+- SC2215: Warn about commands starting with leading dash
+- SC2214: Warn about superfluous getopt flags
+- SC2213: Warn about unhandled getopt flags
+- SC2212: Suggest `false` over `[ ]`
+- SC2211: Warn when using a glob as a command name
+- SC2210: Warn when redirecting to an integer, e.g. `foo 1>2`
+- SC2206/SC2207: Suggest alternatives when using word splitting in arrays
+- SC1117: Warn about double quoted, undefined backslash sequences
+- SC1113/SC1114/SC1115: Recognized more malformed shebangs
+
+### Fixed
+- `[ -v foo ]` no longer warns if `foo` is undefined
+- SC2037 is now suppressed by quotes, e.g. `PAGER="cat" man foo`
+- Ksh nested array declarations now parse correctly
+- Parameter Expansion without colons are now recognized, e.g. `${foo+bar}`
+- The `lastpipe` option is now respected with regard to subshell warnings
+- `\(` is now respected for grouping in `[`
+- Leading `\` is now ignored for commands, to allow alias suppression
+- Comments are now allowed after directives to e.g. explain 'disable'
+
+
+## v0.4.6 - 2017-03-26
+### Added
+- SC2204/SC2205: Warn about `( -z foo )` and `( foo -eq bar )`
+- SC2200/SC2201: Warn about brace expansion in [/[[
+- SC2198/SC2199: Warn about arrays in [/[[
+- SC2196/SC2197: Warn about deprected egrep/fgrep
+- SC2195: Warn about unmatchable case branches
+- SC2194: Warn about constant 'case' statements
+- SC2193: Warn about `[[ file.png == *.mp3 ]]` and other unmatchables
+- SC2188/SC2189: Warn about redirections without commands
+- SC2186: Warn about deprecated `tempfile`
+- SC1109: Warn when finding `&`/`>`/`<` unquoted
+- SC1108: Warn about missing spaces in `[ var= foo ]`
+
+### Changed
+- All files are now read as UTF-8 with lenient latin1 fallback, ignoring locale
+- Unicode quotes are no longer considered syntactic quotes
+- `ash` scripts will now be checked as `dash` with a warning
+
+### Fixed
+- `-c` no longer suggested when using `grep -o | wc`
+- Comments and whitespace are now allowed before filewide directives
+- Here doc delimters with esoteric quoting like `foo""` are now handled
+- SC2095 about `ssh` in while read loops is now suppressed when using `-n`
+- `%(%Y%M%D)T` now recognized as a single formatter in `printf` checks
+- `grep -F` now suppresses regex related suggestions
+- Command name checks now recognize busybox applet names
+
+
+## v0.4.5 - 2016-10-21
+### Added
+- A Docker build (thanks, kpankonen!)
+- SC2185: Suggest explicitly adding path for `find`
+- SC2184: Warn about unsetting globs (e.g. `unset foo[1]`)
+- SC2183: Warn about `printf` with more formatters than variables
+- SC2182: Warn about ignored arguments with `printf` 
+- SC2181: Suggest using command directly instead of `if [ $? -eq 0 ]`
+- SC1106: Warn when using `test` operators in `(( 1 -eq 2 ))`
+
+### Changed
+- Unrecognized directives now causes a warning rather than parse failure.
+
+### Fixed
+- Indices in associative arrays are now parsed correctly
+- Missing shebang warning squashed when specifying with a directive
+- Ksh multidimensional arrays are now supported
+- Variables in substring ${a:x:y} expansions now count as referenced
+- SC1102 now also handles ambiguous `$((`
+- Using `$(seq ..)` will no longer suggest quoting
+- SC2148 (missing shebang) is now suppressed when using shell directives
+- `[ a '>' b ]` is now recognized as being correctly escaped
+
+
+## v0.4.4 - 2016-05-15
+### Added
+- Haskell Stack support (thanks,  Arguggi!)
+- SC2179/SC2178: Warn when assigning/appending strings to arrays
+- SC1102: Warn about ambiguous `$(((`
+- SC1101: Warn when \\ linebreaks have trailing spaces
+
+### Changed
+- Directives directly after the shebang now apply to the entire file
+
+### Fixed
+- `{$i..10}` is now flagged similar to `{1..$i}`
+
+
+## v0.4.3 - 2016-01-13
+### Fixed
+- Build now works on GHC 7.6.3 as found on Debian Stable/Ubuntu LTS
+
+
+## v0.4.2 - 2016-01-09
+### Added
+- First class support for the `dash` shell
+- The `--color` flag similar to ls/grep's (thanks, haguenau!)
+- SC2174: Warn about unexpected behavior of `mkdir -pm` (thanks, eatnumber1!)
+- SC2172: Warn about non-portable use of signal numbers in `trap`
+- SC2171: Warn about `]]` without leading `[[`
+- SC2168: Warn about `local` outside functions
+
+### Fixed
+- Warnings about unchecked `cd` will no longer trigger with `set -e`
+- `[ a -nt/-ot/-ef b ]` no longer warns about being constant
+- Quoted test operators like `[ foo "<" bar ]` now parse
+- Escaped quotes in backticks now parse correctly
+
+
+## v0.4.1 - 2015-09-05
+### Fixed
+- Added missing files to Cabal, fixing the build
+
+
+## v0.4.0 - 2015-09-05
+### Added
+- Support for following `source`d files
+- Support for setting default flags in `SHELLCHECK_OPTS`
+- An `--external-sources` flag for following arbitrary `source`d files
+- A `source` directive to override the filename to `source`
+- SC2166: Suggest using `[ p ] && [ q ]` over `[ p -a q ]`
+- SC2165: Warn when nested `for` loops use the same variable name
+- SC2164: Warn when using `cd` without checking that it succeeds
+- SC2163: Warn about `export $var`
+- SC2162: Warn when using `read` without `-r`
+- SC2157: Warn about `[ "$var " ]` and similar never-empty string matches
+
+### Fixed
+- `cat -vnE file` and similar will no longer flag as UUOC
+- Nested trinary operators in `(( ))` now parse correctly
+- Ksh `${ ..; }` command expansions now parse
+
+
+## v0.3.8 - 2015-06-20
+### Changed
+- ShellCheck's license has changed from AGPLv3 to GPLv3.
+
+### Added
+- SC2156: Warn about injecting filenames in `find -exec sh -c "{}" \;`
+
+### Fixed
+- Variables and command substitutions in brace expansions are now parsed
+- ANSI colors are now disabled on Windows
+- Empty scripts now parse
+
+
+## v0.3.7 - 2015-04-16
+### Fixed
+- Build now works on GHC 7.10
+- Use `regex-tdfa` over `regex-compat` since the latter crashes on OS X.
+
+## v0.3.6 - 2015-03-28
+### Added
+- SC2155: Warn about masked return values in `export foo=$(exit 1)`
+- SC2154: Warn when a lowercase variable is referenced but not assigned
+- SC2152/SC2151: Warn about bad `return` values like `1234` and `"foo"`
+- SC2150: Warn about `find -exec "shell command" \;`
+
+### Fixed
+- `coproc` is now supported
+- Trinary operator now recognized in `((..))`
+
+### Removed
+- Zsh support has been removed
+
+
+## v0.3.5 - 2014-11-09
+### Added
+- SC2148: Warn when not including a shebang
+- SC2147: Warn about literal ~ in PATH
+- SC1086: Warn about `$` in for loop variables, e.g. `for $i in ..`
+- SC1084: Warn when the shebang uses `!#` instead of `#!`
+
+### Fixed
+- Empty and comment-only backtick expansions now parse
+- Variables used in PS1/PROMPT\_COMMAND/trap now count as referenced
+- ShellCheck now skips unreadable files and directories
+- `-f gcc` on empty files no longer crashes
+- Variables in $".." are now considered quoted
+- Warnings about expansions in single quotes now include backticks
+
+
+## v0.3.4 - 2014-07-08
+### Added
+- SC2146: Warn about precedence when combining `find -o` with actions
+- SC2145: Warn when concatenating arrays and strings
+
+### Fixed
+- Case statements now support `;&` and `;;&`
+- Indices in array declarations now parse correctly
+- `let` expressions now parsed as arithmetic expressions
+- Escaping is now respected in here documents
+
+### Changed
+- Completely drop Makefile in favor of Cabal (thanks rodrigosetti!)
+
+
+## v0.3.3 - 2014-05-29
+### Added
+- SC2144: Warn when using globs in `[/[[`
+- SC2143: Suggesting using `grep -q` over `[ "$(.. | grep)" ]`
+- SC2142: Warn when referencing positional parameters in aliases
+- SC2141: Warn about suspicious IFS assignments like `IFS="\n"`
+- SC2140: Warn about bad embedded quotes like `echo "var="value""`
+- SC2130: Warn when using `-eq` on strings
+- SC2139: Warn about define time expansions in alias definitions
+- SC2129: Suggest command grouping over `a >> log; b >> log; c >> log`
+- SC2128: Warn when expanding arrays without an index
+- SC2126: Suggest `grep -c` over `grep|wc`
+- SC2123: Warn about accidentally overriding `$PATH`, e.g. `PATH=/my/dir`
+- SC1083: Warn about literal `{/}` outside of quotes
+- SC1082: Warn about UTF-8 BOMs
+
+### Fixed
+- SC2051 no longer triggers for `{1,$n}`, only `{1..$n}`
+- Improved detection of single quoted `sed` variables, e.g. `sed '$s///'`
+- Stop warning about single quoted variables in `PS1` and similar
+- Support for Zsh short form loops, `=(..)`
+
+### Removed
+- SC1000 about unescaped lonely `$`, e.g. `grep "^foo$"`
+
+
+## v0.3.2 - 2014-03-22
+### Added
+- SC2121: Warn about trying to `set` variables, e.g. `set var = value`
+- SC2120/SC2119: Warn when a function uses `$1..` if none are ever passed
+- SC2117: Warn when using `su` in interactive mode, e.g. `su foo; whoami` 
+- SC2116: Detect useless use of echo, e.g. `for i in $(echo $var)`
+- SC2115/SC2114: Detect some catastrophic `rm -r "$empty/"` mistakes
+- SC1081: Warn when capitalizing keywords like `While`
+- SC1077: Warn when using acute accents instead of backticks
+
+### Fixed
+- Shells are now properly recognized in shebangs containing flags
+- Stop warning about math on decimals in ksh/zsh
+- Stop warning about decimal comparisons with `=`, e.g. `[ $version = 1.2 ]`
+- Parsing of `|&`
+- `${a[x]}` not counting as a reference of `x`
+- `(( x[0] ))` not counting as a reference of `x`
+
+
+## v0.3.1 - 2014-02-03
+### Added
+- The `-s` flag to specify shell dialect
+- SC2105/SC2104: Warn about `break/continue` outside loops
+- SC1076: Detect invalid `[/[[` arithmetic like `[ 1 + 2 = 3 ]`
+- SC1075: Suggest using `elif` over `else if`
+
+### Fixed
+- Don't warn when comma separating elements in brace expansions
+- Improved detection of single quoted `sed` variables, e.g. `sed '$d'`
+- Parsing of arithmetic for loops using `{..}` instead of `do..done`
+- Don't treat the last pipeline stage as a subshell in ksh/zsh
+
+
+## v0.3.0 - 2014-01-19
+### Added
+- A man page (thanks Dridi!)
+- GCC compatible error reporting (`shellcheck -f gcc`)
+- CheckStyle compatible XML error reporting (`shellcheck -f checkstyle`)
+- Error codes for each warning, e.g. SC1234
+- Allow disabling warnings with `# shellcheck disable=SC1234`
+- Allow disabling warnings with `--exclude`
+- SC2103: Suggest using subshells over `cd foo; bar; cd ..`
+- SC2102: Warn about duplicates in char ranges, e.g. `[10-15]`
+- SC2101: Warn about named classes not inside a char range, e.g. `[:digit:]`
+- SC2100/SC2099: Warn about bad math expressions like `i=i+5`
+- SC2098/SC2097: Warn about `foo=bar echo $foo`
+- SC2095: Warn when using `ssh`/`ffmpeg` in `while read` loops
+- Better warnings for missing here doc tokens
+
+### Fixed
+- Don't warn when single quoting variables with `ssh/perl/eval`
+- `${!var}` is now counted as a variable reference
+
+### Removed
+- Suggestions about using parameter expansion over basename
+- The `jsoncheck` binary. Use `shellcheck -f json` instead. 
+
+
+## v0.2.0 - 2013-10-27
+### Added
+- Suggest `./*` instead of `*` when passing globs to commands
+- Suggest `pgrep` over `ps | grep`
+- Warn about unicode quotes
+- Warn about assigned but unused variables
+- Inform about client side expansion when using `ssh`
+
+### Fixed
+- CLI tool now uses exit codes and stderr canonically
+- Parsing of extglobs containing empty patterns
+- Parsing of bash style `eval foo=(bar)`
+- Parsing of expansions in here documents
+- Parsing of function names containing :+-
+- Don't warn about `find|xargs` when using `-print0`
+
+
+## v0.1.0 - 2013-07-23
+### Added
+- First release

Dockerfile

@@ -1,11 +1,36 @@
+# Build-only image
+FROM ubuntu:17.10 AS build
+USER root
+WORKDIR /opt/shellCheck
+
+# Install OS deps
+RUN apt-get update && apt-get install -y ghc cabal-install
+
+# Install Haskell deps
+# (This is a separate copy/run so that source changes don't require rebuilding)
+COPY ShellCheck.cabal ./
+RUN cabal update && cabal install --dependencies-only --ghc-options="-optlo-Os -split-sections"
+
+# Copy source and build it
+COPY LICENSE Setup.hs shellcheck.hs ./
+COPY src src
+RUN cabal build Paths_ShellCheck && \
+  ghc -optl-static -optl-pthread -isrc -idist/build/autogen --make shellcheck -split-sections -optc-Wl,--gc-sections -optlo-Os && \
+  strip --strip-all shellcheck
+
+RUN mkdir -p /out/bin && \
+  cp shellcheck  /out/bin/
+
+# Resulting Alpine image
 FROM alpine:latest
+LABEL maintainer="Vidar Holen <vidar@vidarholen.net>"
+COPY --from=build /out /
 
-MAINTAINER Nikyle Nguyen <NLKNguyen@MSN.com>
-
-COPY package/bin/shellcheck /usr/local/bin/
-COPY package/lib/           /usr/local/lib/
-
-RUN ldconfig /usr/local/lib
+# DELETE-MARKER (Remove everything below to keep the alpine image)
 
+# Resulting ShellCheck image
+FROM scratch
+LABEL maintainer="Vidar Holen <vidar@vidarholen.net>"
 WORKDIR /mnt
-ENTRYPOINT ["shellcheck"]
+COPY --from=build /out /
+ENTRYPOINT ["/bin/shellcheck"]

Dockerfile_builder

@@ -1,54 +0,0 @@
-FROM mitchty/alpine-ghc:latest
-
-MAINTAINER Nikyle Nguyen <NLKNguyen@MSN.com>
-
-RUN apk add --no-cache build-base
-
-RUN mkdir -p /usr/src/shellcheck
-WORKDIR /usr/src/shellcheck
-
-# # ------------------------------------------------------------
-# # Build & Test
-# # ------------------------------------------------------------
-
-# Obtain the dependencies first, which are less likely to change, in order to reduce
-# subsequent build time by leveraging image cache. This benefits developers when they
-# build their code with this image locally. In case of Travis CI, this doesn't help
-# reduce building time because Travis CI doesn't use cache.
-COPY ShellCheck.cabal .
-RUN cabal update && cabal install --only-dependencies
-
-# Copy the rest of the source files, including ShellCheck.cabal again but doesn't matter
-COPY . .
-
-# Build
-RUN cabal install
-
-# Test
-RUN cabal test
-
-# # ------------------------------------------------------------
-# # Set PATH
-# # ------------------------------------------------------------
-
-# Add runtime path to easily reach the executable file. This only exists during build.
-ENV PATH "/root/.cabal/bin:$PATH"
-
-# Make it permanent for someone who login to the container of this image
-RUN echo "export PATH=${PATH}" >>  /etc/profile
-
-# # ------------------------------------------------------------
-# # Extract Binaries
-# # ------------------------------------------------------------
-
-# Get shellcheck binary
-RUN mkdir -p /package/bin/
-RUN cp $(which shellcheck) /package/bin/
-
-# Get shared libraries using magic
-RUN mkdir -p /package/lib/
-RUN ldd $(which shellcheck) | grep "=> /" | awk '{print $3}' | xargs -I '{}' cp -v '{}' /package/lib/
-
-
-# Copy shellcheck package out to mounted directory
-CMD ["cp", "-avr", "/package", "/mnt/"]

LICENSE

@@ -1,7 +1,17 @@
+Employer mandated disclaimer:
+
+  I am providing code in the repository to you under an open source license.
+  Because this is my personal repository, the license you receive to my code is
+  from me and other individual contributors, and not my employer (Facebook).
+
+  - Vidar "koala_man" Holen
+
+----
+
                     GNU GENERAL PUBLIC LICENSE
                        Version 3, 29 June 2007
 
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -645,7 +655,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
@@ -664,11 +674,11 @@ might be different; for a GUI interface, you would use an "about box".
   You should also get your employer (if you work as a programmer) or school,
 if any, to sign a "copyright disclaimer" for the program, if necessary.
 For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
+<https://www.gnu.org/licenses/>.
 
   The GNU General Public License does not permit incorporating your program
 into proprietary programs.  If your program is a subroutine library, you
 may consider it more useful to permit linking proprietary applications with
 the library.  If this is what you want to do, use the GNU Lesser General
 Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+<https://www.gnu.org/philosophy/why-not-lgpl.html>.

README.md

@@ -1,46 +1,76 @@
+[![Build Status](https://travis-ci.org/koalaman/shellcheck.svg?branch=master)](https://travis-ci.org/koalaman/shellcheck)
+
 # ShellCheck - A shell script static analysis tool
 
 ShellCheck is a GPLv3 tool that gives warnings and suggestions for bash/sh shell scripts:
 
-![Screenshot of a terminal showing problematic shell script lines highlighted](doc/terminal.png).
+![Screenshot of a terminal showing problematic shell script lines highlighted](doc/terminal.png)
 
 The goals of ShellCheck are
 
-  - To point out and clarify typical beginner's syntax issues
-    that cause a shell to give cryptic error messages.
+- To point out and clarify typical beginner's syntax issues that cause a shell
+  to give cryptic error messages.
 
-  - To point out and clarify typical intermediate level semantic problems
-    that cause a shell to behave strangely and counter-intuitively.
+- To point out and clarify typical intermediate level semantic problems that
+  cause a shell to behave strangely and counter-intuitively.
 
-  - To point out subtle caveats, corner cases and pitfalls that may cause an
-    advanced user's otherwise working script to fail under future circumstances.
+- To point out subtle caveats, corner cases and pitfalls that may cause an
+  advanced user's otherwise working script to fail under future circumstances.
 
 See [the gallery of bad code](README.md#user-content-gallery-of-bad-code) for examples of what ShellCheck can help you identify!
 
+## Table of Contents
+
+- [How to use](#how-to-use)
+  - [On the web](#on-the-web)
+  - [From your terminal](#from-your-terminal)
+  - [In your editor](#in-your-editor)
+  - [In your build or test suites](#in-your-build-or-test-suites)
+- [Installing](#installing)
+- [Travis CI](#travis-ci)
+- [Compiling from source](#compiling-from-source)
+  - [Installing Cabal](#installing-cabal)
+  - [Compiling ShellCheck](#compiling-shellcheck)
+  - [Running tests](#running-tests)
+- [Gallery of bad code](#gallery-of-bad-code)
+  - [Quoting](#quoting)
+  - [Conditionals](#conditionals)
+  - [Frequently misused commands](#frequently-misused-commands)
+  - [Common beginner's mistakes](#common-beginners-mistakes)
+  - [Style](#style)
+  - [Data and typing errors](#data-and-typing-errors)
+  - [Robustness](#robustness)
+  - [Portability](#portability)
+  - [Miscellaneous](#miscellaneous)
+- [Testimonials](#testimonials)
+- [Ignoring issues](#ignoring-issues)
+- [Reporting bugs](#reporting-bugs)
+- [Contributing](#contributing)
+- [Copyright](#copyright)
 
 ## How to use
-There are a variety of ways to use ShellCheck!
 
+There are a number of ways to use ShellCheck!
 
-#### On the web
-Paste a shell script on http://www.shellcheck.net for instant feedback.
+### On the web
 
-[ShellCheck.net](http://www.shellcheck.net) is always synchronized to the latest git commit, and is the simplest way to give ShellCheck a go. Tell your friends!
+Paste a shell script on https://www.shellcheck.net for instant feedback.
 
+[ShellCheck.net](https://www.shellcheck.net) is always synchronized to the latest git commit, and is the easiest way to give ShellCheck a go. Tell your friends!
+
+### From your terminal
 
-#### From your terminal
 Run `shellcheck yourscript` in your terminal for instant output, as seen above.
 
-
-#### In your editor
+### In your editor
 
 You can see ShellCheck suggestions directly in a variety of editors.
 
-* Vim, through [ALE](https://github.com/w0rp/ale) or [Syntastic](https://github.com/scrooloose/syntastic):
+* Vim, through [ALE](https://github.com/w0rp/ale), [Neomake](https://github.com/neomake/neomake), or [Syntastic](https://github.com/scrooloose/syntastic):
 
 ![Screenshot of Vim showing inlined shellcheck feedback](doc/vim-syntastic.png).
 
-* Emacs, through [Flycheck](https://github.com/flycheck/flycheck):
+* Emacs, through [Flycheck](https://github.com/flycheck/flycheck) or [Flymake](https://github.com/federicotdn/flymake-shellcheck):
 
 ![Screenshot of emacs showing inlined shellcheck feedback](doc/emacs-flycheck.png).
 
@@ -48,28 +78,16 @@ You can see ShellCheck suggestions directly in a variety of editors.
 
 * Atom, through [Linter](https://github.com/AtomLinter/linter-shellcheck).
 
+* VSCode, through [vscode-shellcheck](https://github.com/timonwong/vscode-shellcheck).
+
 * Most other editors, through [GCC error compatibility](shellcheck.1.md#user-content-formats).
 
+### In your build or test suites
 
-#### In your build or test suites
 While ShellCheck is mostly intended for interactive use, it can easily be added to builds or test suites.
 
 ShellCheck makes canonical use of exit codes, and can output simple JSON, CheckStyle compatible XML, GCC compatible warnings as well as human readable text (with or without ANSI colors). See the [Integration](https://github.com/koalaman/shellcheck/wiki/Integration) wiki page for more documentation.
 
-## Travis CI Setup
-
-If you want to use ShellCheck in Travis CI, setting it up is simple :tada:.
-
-```yml
-language: bash
-addons:
-  apt:
-    sources:
-    - debian-sid    # Grab ShellCheck from the Debian repo
-    packages:
-    - shellcheck
-```
-
 ## Installing
 
 The easiest way to install ShellCheck locally is through your package manager.
@@ -79,10 +97,21 @@ On systems with Cabal (installs to `~/.cabal/bin`):
     cabal update
     cabal install ShellCheck
 
+On systems with Stack (installs to `~/.local/bin`):
+
+    stack update
+    stack install ShellCheck
+
 On Debian based distros:
 
     apt-get install shellcheck
 
+On Arch Linux based distros:
+
+    pacman -S shellcheck
+
+or get the dependency free [shellcheck-static](https://aur.archlinux.org/packages/shellcheck-static/) from the AUR.
+
 On Gentoo based distros:
 
     emerge --ask shellcheck
@@ -96,62 +125,113 @@ On Fedora based distros:
 
     dnf install ShellCheck
 
+On FreeBSD:
+
+    pkg install hs-ShellCheck
+
 On OS X with homebrew:
 
     brew install shellcheck
 
-On OS X with MacPorts:
-
-    port install shellcheck
-
-On openSUSE:Tumbleweed:
+On openSUSE
 
     zypper in ShellCheck
 
-On other openSUSE distributions:
+Or use OneClickInstall - https://software.opensuse.org/package/ShellCheck
 
-add OBS devel:languages:haskell repository from https://build.opensuse.org/project/repositories/devel:languages:haskell
+On Solus:
 
-    zypper ar http://download.opensuse.org/repositories/devel:/languages:/haskell/openSUSE_$(version)/devel:languages:haskell.repo
-    zypper in ShellCheck
+    eopkg install shellcheck
+    
+On Windows (via [scoop](http://scoop.sh)):
 
-or use OneClickInstall - https://software.opensuse.org/package/ShellCheck
+    scoop install shellcheck
+
+From Snap Store:
+
+    snap install --channel=edge shellcheck
 
 From Docker Hub:
 
-    docker pull koalaman/shellcheck
+```sh
+docker pull koalaman/shellcheck:stable  # Or :v0.4.7 for that version, or :latest for daily builds
+docker run -v "$PWD:/mnt" koalaman/shellcheck myscript
+```
+
+or use `koalaman/shellcheck-alpine` if you want a larger Alpine Linux based image to extend. It works exactly like a regular Alpine image, but has shellcheck preinstalled.
+
+Alternatively, you can download pre-compiled binaries for the latest release here:
+
+* [Linux, x86_64](https://storage.googleapis.com/shellcheck/shellcheck-stable.linux.x86_64.tar.xz) (statically linked)
+* [Linux, armv6hf](https://storage.googleapis.com/shellcheck/shellcheck-stable.linux.armv6hf.tar.xz), i.e. Raspberry Pi (statically linked)
+* [Windows, x86](https://storage.googleapis.com/shellcheck/shellcheck-stable.zip)
+
+or see the [storage bucket listing](https://shellcheck.storage.googleapis.com/index.html) for checksums, older versions and the latest daily builds.
+
+## Travis CI
+
+Travis CI has now integrated ShellCheck by default, so you don't need to manually install it.
+
+If you still want to do so in order to upgrade at your leisure or ensure the latest release, follow the steps to install the shellcheck binary, bellow.
+
+## Installing the shellcheck binary
+
+*Pre-requisite*: the program 'xz' needs to be installed on the system.  
+To install it on debian/ubuntu/linux mint, run `apt install xz-utils`.  
+To install it on Redhat/Fedora/CentOS, run `yum -y install xz`.  
+
+```bash
+export scversion="stable" # or "v0.4.7", or "latest"
+wget "https://storage.googleapis.com/shellcheck/shellcheck-${scversion}.linux.x86_64.tar.xz"
+tar --xz -xvf shellcheck-"${scversion}".linux.x86_64.tar.xz
+cp shellcheck-"${scversion}"/shellcheck /usr/bin/
+shellcheck --version
+```
 
 ## Compiling from source
 
 This section describes how to build ShellCheck from a source directory. ShellCheck is written in Haskell and requires 2GB of RAM to compile.
 
-
-#### Installing Cabal
+### Installing Cabal
 
 ShellCheck is built and packaged using Cabal. Install the package `cabal-install` from your system's package manager (with e.g. `apt-get`, `brew`, `emerge`, `yum`, or `zypper`).
 
+On MacOS (OS X), you can do a fast install of Cabal using brew, which takes a couple of minutes instead of more than 30 minutes if you try to compile it from source.
+
+    brew install cask
+    brew cask install haskell-platform
+    cabal install cabal-install
+
 On MacPorts, the package is instead called `hs-cabal-install`, while native Windows users should install the latest version of the Haskell platform from https://www.haskell.org/platform/
 
 Verify that `cabal` is installed and update its dependency list with
 
     $ cabal update
 
-#### Compiling ShellCheck
+### Compiling ShellCheck
 
 `git clone` this repository, and `cd` to the ShellCheck source directory to build/install:
 
     $ cabal install
 
+Or if you intend to run the tests:
+
+    $ cabal install --enable-tests
+
 This will compile ShellCheck and install it to your `~/.cabal/bin` directory.
 
 Add this directory to your `PATH` (for bash, add this to your `~/.bashrc`):
 
-    export PATH="$HOME/.cabal/bin:$PATH"
+```sh
+export PATH="$HOME/.cabal/bin:$PATH"
+```
 
 Log out and in again, and verify that your PATH is set up correctly:
 
-    $ which shellcheck
-    ~/.cabal/bin/shellcheck
+```sh
+$ which shellcheck
+~/.cabal/bin/shellcheck
+```
 
 On native Windows, the `PATH` should already be set up, but the system
 may use a legacy codepage. In `cmd.exe`, `powershell.exe` and Powershell ISE,
@@ -165,155 +245,170 @@ In Powershell ISE, you may need to additionally update the output encoding:
 
     > [Console]::OutputEncoding = [System.Text.Encoding]::UTF8
 
-#### Running tests
+### Running tests
 
 To run the unit test suite:
 
     $ cabal test
 
-
 ## Gallery of bad code
+
 So what kind of things does ShellCheck look for? Here is an incomplete list of detected issues.
 
-#### Quoting
+### Quoting
 
 ShellCheck can recognize several types of incorrect quoting:
 
-    echo $1                           # Unquoted variables
-    find . -name *.ogg                # Unquoted find/grep patterns
-    rm "~/my file.txt"                # Quoted tilde expansion
-    v='--verbose="true"'; cmd $v      # Literal quotes in variables
-    for f in "*.ogg"                  # Incorrectly quoted 'for' loops
-    touch $@                          # Unquoted $@
-    echo 'Don't forget to restart!'   # Singlequote closed by apostrophe
-    echo 'Don\'t try this at home'    # Attempting to escape ' in ''
-    echo 'Path is $PATH'              # Variables in single quotes
-    trap "echo Took ${SECONDS}s" 0    # Prematurely expanded trap
+```sh
+echo $1                           # Unquoted variables
+find . -name *.ogg                # Unquoted find/grep patterns
+rm "~/my file.txt"                # Quoted tilde expansion
+v='--verbose="true"'; cmd $v      # Literal quotes in variables
+for f in "*.ogg"                  # Incorrectly quoted 'for' loops
+touch $@                          # Unquoted $@
+echo 'Don't forget to restart!'   # Singlequote closed by apostrophe
+echo 'Don\'t try this at home'    # Attempting to escape ' in ''
+echo 'Path is $PATH'              # Variables in single quotes
+trap "echo Took ${SECONDS}s" 0    # Prematurely expanded trap
+```
 
-
-#### Conditionals
+### Conditionals
 
 ShellCheck can recognize many types of incorrect test statements.
 
-    [[ n != 0 ]]                      # Constant test expressions
-    [[ -e *.mpg ]]                    # Existence checks of globs
-    [[ $foo==0 ]]                     # Always true due to missing spaces
-    [[ -n "$foo " ]]                  # Always true due to literals
-    [[ $foo =~ "fo+" ]]               # Quoted regex in =~
-    [ foo =~ re ]                     # Unsupported [ ] operators
-    [ $1 -eq "shellcheck" ]           # Numerical comparison of strings
-    [ $n && $m ]                      # && in [ .. ]
-    [ grep -q foo file ]              # Command without $(..)
-    [[ "$$file" == *.jpg ]]           # Comparisons that can't succeed
-    (( 1 -lt 2 ))                     # Using test operators in ((..))
+```sh
+[[ n != 0 ]]                      # Constant test expressions
+[[ -e *.mpg ]]                    # Existence checks of globs
+[[ $foo==0 ]]                     # Always true due to missing spaces
+[[ -n "$foo " ]]                  # Always true due to literals
+[[ $foo =~ "fo+" ]]               # Quoted regex in =~
+[ foo =~ re ]                     # Unsupported [ ] operators
+[ $1 -eq "shellcheck" ]           # Numerical comparison of strings
+[ $n && $m ]                      # && in [ .. ]
+[ grep -q foo file ]              # Command without $(..)
+[[ "$$file" == *.jpg ]]           # Comparisons that can't succeed
+(( 1 -lt 2 ))                     # Using test operators in ((..))
+```
 
-
-#### Frequently misused commands
+### Frequently misused commands
 
 ShellCheck can recognize instances where commands are used incorrectly:
 
-    grep '*foo*' file                 # Globs in regex contexts
-    find . -exec foo {} && bar {} \;  # Prematurely terminated find -exec
-    sudo echo 'Var=42' > /etc/profile # Redirecting sudo
-    time --format=%s sleep 10         # Passing time(1) flags to time builtin
-    while read h; do ssh "$h" uptime  # Commands eating while loop input
-    alias archive='mv $1 /backup'     # Defining aliases with arguments
-    tr -cd '[a-zA-Z0-9]'              # [] around ranges in tr
-    exec foo; echo "Done!"            # Misused 'exec'
-    find -name \*.bak -o -name \*~ -delete  # Implicit precedence in find
-    f() { whoami; }; sudo f           # External use of internal functions
+```sh
+grep '*foo*' file                 # Globs in regex contexts
+find . -exec foo {} && bar {} \;  # Prematurely terminated find -exec
+sudo echo 'Var=42' > /etc/profile # Redirecting sudo
+time --format=%s sleep 10         # Passing time(1) flags to time builtin
+while read h; do ssh "$h" uptime  # Commands eating while loop input
+alias archive='mv $1 /backup'     # Defining aliases with arguments
+tr -cd '[a-zA-Z0-9]'              # [] around ranges in tr
+exec foo; echo "Done!"            # Misused 'exec'
+find -name \*.bak -o -name \*~ -delete  # Implicit precedence in find
+# find . -exec foo > bar \;       # Redirections in find
+f() { whoami; }; sudo f           # External use of internal functions
+```
 
-
-#### Common beginner's mistakes
+### Common beginner's mistakes
 
 ShellCheck recognizes many common beginner's syntax errors:
 
-    var = 42                          # Spaces around = in assignments
-    $foo=42                           # $ in assignments
-    for $var in *; do ...             # $ in for loop variables
-    var$n="Hello"                     # Wrong indirect assignment
-    echo ${var$n}                     # Wrong indirect reference
-    var=(1, 2, 3)                     # Comma separated arrays
-    array=( [index] = value )         # Incorrect index initialization
-    echo "Argument 10 is $10"         # Positional parameter misreference
-    if $(myfunction); then ..; fi     # Wrapping commands in $()
-    else if othercondition; then ..   # Using 'else if'
-    
+```sh
+var = 42                          # Spaces around = in assignments
+$foo=42                           # $ in assignments
+for $var in *; do ...             # $ in for loop variables
+var$n="Hello"                     # Wrong indirect assignment
+echo ${var$n}                     # Wrong indirect reference
+var=(1, 2, 3)                     # Comma separated arrays
+array=( [index] = value )         # Incorrect index initialization
+echo $var[14]                     # Missing {} in array references
+echo "Argument 10 is $10"         # Positional parameter misreference
+if $(myfunction); then ..; fi     # Wrapping commands in $()
+else if othercondition; then ..   # Using 'else if'
+f; f() { echo "hello world; }     # Using function before definition
+[ false ]                         # 'false' being true
+if ( -f file )                    # Using (..) instead of test
+```
 
-
-#### Style
+### Style
 
 ShellCheck can make suggestions to improve style:
 
-    [[ -z $(find /tmp | grep mpg) ]]  # Use grep -q instead
-    a >> log; b >> log; c >> log      # Use a redirection block instead
-    echo "The time is `date`"         # Use $() instead
-    cd dir; process *; cd ..;         # Use subshells instead
-    echo $[1+2]                       # Use standard $((..)) instead of old $[]
-    echo $(($RANDOM % 6))             # Don't use $ on variables in $((..))
-    echo "$(date)"                    # Useless use of echo
-    cat file | grep foo               # Useless use of cat
+```sh
+[[ -z $(find /tmp | grep mpg) ]]  # Use grep -q instead
+a >> log; b >> log; c >> log      # Use a redirection block instead
+echo "The time is `date`"         # Use $() instead
+cd dir; process *; cd ..;         # Use subshells instead
+echo $[1+2]                       # Use standard $((..)) instead of old $[]
+echo $(($RANDOM % 6))             # Don't use $ on variables in $((..))
+echo "$(date)"                    # Useless use of echo
+cat file | grep foo               # Useless use of cat
+```
 
-
-#### Data and typing errors
+### Data and typing errors
 
 ShellCheck can recognize issues related to data and typing:
 
-    args="$@"                         # Assigning arrays to strings
-    files=(foo bar); echo "$files"    # Referencing arrays as strings
-    declare -A arr=(foo bar)          # Associative arrays without index
-    printf "%s\n" "Arguments: $@."    # Concatenating strings and arrays
-    [[ $# > 2 ]]                      # Comparing numbers as strings
-    var=World; echo "Hello " var      # Unused lowercase variables
-    echo "Hello $name"                # Unassigned lowercase variables
-    cmd | read bar; echo $bar         # Assignments in subshells
+```sh
+args="$@"                         # Assigning arrays to strings
+files=(foo bar); echo "$files"    # Referencing arrays as strings
+declare -A arr=(foo bar)          # Associative arrays without index
+printf "%s\n" "Arguments: $@."    # Concatenating strings and arrays
+[[ $# > 2 ]]                      # Comparing numbers as strings
+var=World; echo "Hello " var      # Unused lowercase variables
+echo "Hello $name"                # Unassigned lowercase variables
+cmd | read bar; echo $bar         # Assignments in subshells
+cat foo | cp bar                  # Piping to commands that don't read
+printf '%s: %s\n' foo             # Mismatches in printf argument count
+```
 
-
-#### Robustness
+### Robustness
 
 ShellCheck can make suggestions for improving the robustness of a script:
 
-    rm -rf "$STEAMROOT/"*            # Catastrophic rm
-    touch ./-l; ls *                 # Globs that could become options
-    find . -exec sh -c 'a && b {}' \; # Find -exec shell injection
-    printf "Hello $name"             # Variables in printf format
-    for f in $(ls *.txt); do         # Iterating over ls output
-    export MYVAR=$(cmd)              # Masked exit codes
+```sh
+rm -rf "$STEAMROOT/"*            # Catastrophic rm
+touch ./-l; ls *                 # Globs that could become options
+find . -exec sh -c 'a && b {}' \; # Find -exec shell injection
+printf "Hello $name"             # Variables in printf format
+for f in $(ls *.txt); do         # Iterating over ls output
+export MYVAR=$(cmd)              # Masked exit codes
+case $version in 2.*) :;; 2.6.*) # Shadowed case branches
+```
 
-
-#### Portability
+### Portability
 
 ShellCheck will warn when using features not supported by the shebang. For example, if you set the shebang to `#!/bin/sh`, ShellCheck will warn about portability issues similar to `checkbashisms`:
 
+```sh
+echo {1..$n}                     # Works in ksh, but not bash/dash/sh
+echo {1..10}                     # Works in ksh and bash, but not dash/sh
+echo -n 42                       # Works in ksh, bash and dash, undefined in sh
+trap 'exit 42' sigint            # Unportable signal spec
+cmd &> file                      # Unportable redirection operator
+read foo < /dev/tcp/host/22      # Unportable intercepted files
+foo-bar() { ..; }                # Undefined/unsupported function name
+[ $UID = 0 ]                     # Variable undefined in dash/sh
+local var=value                  # local is undefined in sh
+time sleep 1 | sleep 5           # Undefined uses of 'time'
+```
 
-    echo {1..$n}                     # Works in ksh, but not bash/dash/sh
-    echo {1..10}                     # Works in ksh and bash, but not dash/sh
-    echo -n 42                       # Works in ksh, bash and dash, undefined in sh
-    trap 'exit 42' sigint            # Unportable signal spec
-    cmd &> file                      # Unportable redirection operator
-    read foo < /dev/tcp/host/22      # Unportable intercepted files
-    foo-bar() { ..; }                # Undefined/unsupported function name
-    [ $UID = 0 ]                     # Variable undefined in dash/sh
-    local var=value                  # local is undefined in sh
-    time sleep 1 | sleep 5           # Undefined uses of 'time'
-
-
-#### Miscellaneous
+### Miscellaneous
 
 ShellCheck recognizes a menagerie of other issues:
 
-    PS1='\e[0;32m\$\e[0m '            # PS1 colors not in \[..\]
-    PATH="$PATH:~/bin"                # Literal tilde in $PATH
-    rm “file”                         # Unicode quotes
-    echo "Hello world"                # Carriage return / DOS line endings
-    echo hello \                      # Trailing spaces after \
-    var=42 echo $var                  # Expansion of inlined environment
-    #!/bin/bash -x -e                 # Common shebang errors
-    echo $((n/180*100))               # Unnecessary loss of precision
-    ls *[:digit:].txt                 # Bad character class globs
-    sed 's/foo/bar/' file > file      # Redirecting to input
-
-
+```sh
+PS1='\e[0;32m\$\e[0m '            # PS1 colors not in \[..\]
+PATH="$PATH:~/bin"                # Literal tilde in $PATH
+rm “file”                         # Unicode quotes
+echo "Hello world"                # Carriage return / DOS line endings
+echo hello \                      # Trailing spaces after \
+var=42 echo $var                  # Expansion of inlined environment
+#!/bin/bash -x -e                 # Common shebang errors
+echo $((n/180*100))               # Unnecessary loss of precision
+ls *[:digit:].txt                 # Bad character class globs
+sed 's/foo/bar/' file > file      # Redirecting to input
+while getopts "a" f; do case $f in "b") # Unhandled getopts flags
+```
 
 ## Testimonials
 
@@ -334,19 +429,24 @@ Please use the GitHub issue tracker for any bugs or feature suggestions:
 
 https://github.com/koalaman/shellcheck/issues
 
-
 ## Contributing
 
-Please submit patches to code or documentation as GitHub pull requests!
+Please submit patches to code or documentation as GitHub pull requests! Check
+out the [DevGuide](https://github.com/koalaman/shellcheck/wiki/DevGuide) on the
+ShellCheck Wiki.
 
 Contributions must be licensed under the GNU GPLv3.
 The contributor retains the copyright.
 
-
 ## Copyright
 
 ShellCheck is licensed under the GNU General Public License, v3. A copy of this license is included in the file [LICENSE](LICENSE).
 
-Copyright 2012-2015, Vidar 'koala_man' Holen and contributors.
+Copyright 2012-2018, Vidar 'koala_man' Holen and contributors.
 
 Happy ShellChecking!
+
+
+## Other Resources                                                                          
+* The wiki has [long form descriptions](https://github.com/koalaman/shellcheck/wiki/Checks) for each warning, e.g. [SC2221](https://github.com/koalaman/shellcheck/wiki/SC2221).
+* ShellCheck does not attempt to enforce any kind of formatting or indenting style, so also check out [shfmt](https://github.com/mvdan/sh)!

ShellCheck.cabal

@@ -1,12 +1,12 @@
 Name:             ShellCheck
-Version:          0.4.6
+Version:          0.5.0
 Synopsis:         Shell script analysis tool
 License:          GPL-3
 License-file:     LICENSE
 Category:         Static Analysis
 Author:           Vidar Holen
 Maintainer:       vidar@vidarholen.net
-Homepage:         http://www.shellcheck.net/
+Homepage:         https://www.shellcheck.net/
 Build-Type:       Custom
 Cabal-Version:    >= 1.8
 Bug-reports:      https://github.com/koalaman/shellcheck/issues
@@ -31,16 +31,30 @@ Extra-Source-Files:
     -- tests
     test/shellcheck.hs
 
+custom-setup
+  setup-depends:
+    base    >= 4    && <5,
+    process >= 1.0  && <1.7,
+    Cabal   >= 1.10 && <2.5
+
 source-repository head
     type: git
     location: git://github.com/koalaman/shellcheck.git
 
 library
+    hs-source-dirs: src
+    if impl(ghc < 8.0)
+      build-depends:
+        semigroups
     build-depends:
-      base >= 4 && < 5,
-      containers,
+      -- GHC 7.6.3 (base 4.6.0.1) is buggy (#1131, #1119) in optimized mode.
+      -- Just disable that version entirely to fail fast.
+      aeson,
+      base > 4.6.0.1 && < 5,
+      bytestring,
+      containers >= 0.5,
+      deepseq >= 1.4.0.0,
       directory,
-      json,
       mtl >= 2.2.1,
       parsec,
       regex-tdfa,
@@ -69,29 +83,36 @@ library
       Paths_ShellCheck
 
 executable shellcheck
+    if impl(ghc < 8.0)
+      build-depends:
+        semigroups
     build-depends:
-      ShellCheck,
+      aeson,
       base >= 4 && < 5,
+      bytestring,
+      deepseq >= 1.4.0.0,
+      ShellCheck,
       containers,
       directory,
-      json,
       mtl >= 2.2.1,
-      parsec,
-      regex-tdfa,
-      QuickCheck >= 2.7.4
+      parsec >= 3.0,
+      QuickCheck >= 2.7.4,
+      regex-tdfa
     main-is: shellcheck.hs
 
 test-suite test-shellcheck
     type: exitcode-stdio-1.0
     build-depends:
-      ShellCheck,
+      aeson,
       base >= 4 && < 5,
+      bytestring,
+      deepseq >= 1.4.0.0,
+      ShellCheck,
       containers,
       directory,
-      json,
       mtl >= 2.2.1,
       parsec,
-      regex-tdfa,
-      QuickCheck >= 2.7.4
+      QuickCheck >= 2.7.4,
+      regex-tdfa
     main-is: test/shellcheck.hs
 

ShellCheck/Formatter/JSON.hs

@@ -1,60 +0,0 @@
-{-
-    Copyright 2012-2015 Vidar Holen
-
-    This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
-
-    ShellCheck is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    ShellCheck is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
--}
-module ShellCheck.Formatter.JSON (format) where
-
-import ShellCheck.Interface
-import ShellCheck.Formatter.Format
-
-import Data.IORef
-import GHC.Exts
-import System.IO
-import Text.JSON
-
-format = do
-    ref <- newIORef []
-    return Formatter {
-        header = return (),
-        onResult = collectResult ref,
-        onFailure = outputError,
-        footer = finish ref
-    }
-
-instance JSON (PositionedComment) where
-  showJSON comment@(PositionedComment start end (Comment level code string)) = makeObj [
-      ("file", showJSON $ posFile start),
-      ("line", showJSON $ posLine start),
-      ("endLine", showJSON $ posLine end),
-      ("column", showJSON $ posColumn start),
-      ("endColumn", showJSON $ posColumn end),
-      ("level", showJSON $ severityText comment),
-      ("code", showJSON code),
-      ("message", showJSON string)
-      ]
-
-  readJSON = undefined
-
-outputError file msg = hPutStrLn stderr $ file ++ ": " ++ msg
-collectResult ref result _ =
-    modifyIORef ref (\x -> crComments result ++ x)
-
-finish ref = do
-    list <- readIORef ref
-    putStrLn $ encodeStrict list
-

ShellCheck/Formatter/TTY.hs

@@ -1,91 +0,0 @@
-{-
-    Copyright 2012-2015 Vidar Holen
-
-    This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
-
-    ShellCheck is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    ShellCheck is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
--}
-module ShellCheck.Formatter.TTY (format) where
-
-import ShellCheck.Interface
-import ShellCheck.Formatter.Format
-
-import Data.List
-import GHC.Exts
-import System.Info
-import System.IO
-
-format :: FormatterOptions -> IO Formatter
-format options = return Formatter {
-    header = return (),
-    footer = return (),
-    onFailure = outputError options,
-    onResult = outputResult options
-}
-
-colorForLevel level =
-    case level of
-        "error"   -> 31 -- red
-        "warning" -> 33 -- yellow
-        "info"    -> 32 -- green
-        "style"   -> 32 -- green
-        "message" -> 1 -- bold
-        "source"  -> 0 -- none
-        otherwise -> 0 -- none
-
-outputError options file error = do
-    color <- getColorFunc $ foColorOption options
-    hPutStrLn stderr $ color "error" $ file ++ ": " ++ error
-
-outputResult options result contents = do
-    color <- getColorFunc $ foColorOption options
-    let comments = crComments result
-    let fileLines = lines contents
-    let lineCount = fromIntegral $ length fileLines
-    let groups = groupWith lineNo comments
-    mapM_ (\x -> do
-        let lineNum = lineNo (head x)
-        let line = if lineNum < 1 || lineNum > lineCount
-                        then ""
-                        else fileLines !! fromIntegral (lineNum - 1)
-        putStrLn ""
-        putStrLn $ color "message" $
-           "In " ++ crFilename result ++" line " ++ show lineNum ++ ":"
-        putStrLn (color "source" line)
-        mapM_ (\c -> putStrLn (color (severityText c) $ cuteIndent c)) x
-        putStrLn ""
-      ) groups
-
-cuteIndent :: PositionedComment -> String
-cuteIndent comment =
-    replicate (fromIntegral $ colNo comment - 1) ' ' ++
-        "^-- " ++ code (codeNo comment) ++ ": " ++ messageText comment
-
-code code = "SC" ++ show code
-
-getColorFunc colorOption = do
-    term <- hIsTerminalDevice stdout
-    let windows = "mingw" `isPrefixOf` os
-    let isUsableTty = term && not windows
-    let useColor = case colorOption of
-                       ColorAlways -> True
-                       ColorNever -> False
-                       ColorAuto -> isUsableTty
-    return $ if useColor then colorComment else const id
-  where
-    colorComment level comment =
-        ansi (colorForLevel level) ++ comment ++ clear
-    clear = ansi 0
-    ansi n = "\x1B[" ++ show n ++ "m"

ShellCheck/Interface.hs

@@ -1,116 +0,0 @@
-{-
-    Copyright 2012-2015 Vidar Holen
-
-    This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
-
-    ShellCheck is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    ShellCheck is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
--}
-module ShellCheck.Interface where
-
-import ShellCheck.AST
-import Control.Monad.Identity
-import qualified Data.Map as Map
-
-
-data SystemInterface m = SystemInterface {
-    -- Read a file by filename, or return an error
-    siReadFile :: String -> m (Either ErrorMessage String)
-}
-
--- ShellCheck input and output
-data CheckSpec = CheckSpec {
-    csFilename :: String,
-    csScript :: String,
-    csExcludedWarnings :: [Integer],
-    csShellTypeOverride :: Maybe Shell
-} deriving (Show, Eq)
-
-data CheckResult = CheckResult {
-    crFilename :: String,
-    crComments :: [PositionedComment]
-} deriving (Show, Eq)
-
-emptyCheckSpec = CheckSpec {
-    csFilename = "",
-    csScript = "",
-    csExcludedWarnings = [],
-    csShellTypeOverride = Nothing
-}
-
--- Parser input and output
-data ParseSpec = ParseSpec {
-    psFilename :: String,
-    psScript :: String
-} deriving (Show, Eq)
-
-data ParseResult = ParseResult {
-    prComments :: [PositionedComment],
-    prTokenPositions :: Map.Map Id Position,
-    prRoot :: Maybe Token
-} deriving (Show, Eq)
-
--- Analyzer input and output
-data AnalysisSpec = AnalysisSpec {
-    asScript :: Token,
-    asShellType :: Maybe Shell,
-    asExecutionMode :: ExecutionMode
-}
-
-data AnalysisResult = AnalysisResult {
-    arComments :: [TokenComment]
-}
-
-
--- Formatter options
-data FormatterOptions = FormatterOptions {
-    foColorOption :: ColorOption
-}
-
-
--- Supporting data types
-data Shell = Ksh | Sh | Bash | Dash deriving (Show, Eq)
-data ExecutionMode = Executed | Sourced deriving (Show, Eq)
-
-type ErrorMessage = String
-type Code = Integer
-
-data Severity = ErrorC | WarningC | InfoC | StyleC deriving (Show, Eq, Ord)
-data Position = Position {
-    posFile :: String,    -- Filename
-    posLine :: Integer,   -- 1 based source line
-    posColumn :: Integer  -- 1 based source column, where tabs are 8
-} deriving (Show, Eq)
-
-data Comment = Comment Severity Code String deriving (Show, Eq)
-data PositionedComment = PositionedComment Position Position Comment deriving (Show, Eq)
-data TokenComment = TokenComment Id Comment deriving (Show, Eq)
-
-data ColorOption =
-    ColorAuto
-    | ColorAlways
-    | ColorNever
-  deriving (Ord, Eq, Show)
-
--- For testing
-mockedSystemInterface :: [(String, String)] -> SystemInterface Identity
-mockedSystemInterface files = SystemInterface {
-    siReadFile = rf
-}
-  where
-    rf file =
-        case filter ((== file) . fst) files of
-            [] -> return $ Left "File not included in mock."
-            [(_, contents)] -> return $ Right contents
-

nextnumber

@@ -1,10 +1,13 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # TODO: Find a less trashy way to get the next available error code
-
-shopt -s globstar
+if ! shopt -s globstar
+then
+  echo "Error: This script depends on Bash 4." >&2
+  exit 1
+fi
 
 for i in 1 2
 do
-  last=$(grep -hv "^prop" **/*.hs | grep -Ewo "$i[0-9]{3}" | sort -n | tail -n 1)
+  last=$(grep -hv "^prop" ./**/*.hs | grep -Ewo "$i[0-9]{3}" | sort -n | tail -n 1)
   echo "Next ${i}xxx: $((last+1))"
 done

quickrun

@@ -1,5 +1,5 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # quickrun runs ShellCheck in an interpreted mode.
 # This allows testing changes without recompiling.
 
-runghc -idist/build/autogen shellcheck.hs "$@"
+runghc -isrc -idist/build/autogen shellcheck.hs "$@"

quicktest

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # quicktest runs the ShellCheck unit tests in an interpreted mode.
 # This allows running tests without compiling, which can be faster.
 # 'cabal test' remains the source of truth.

shellcheck.1.md

@@ -32,6 +32,12 @@ not warn at all, as `ksh` supports decimals in arithmetic contexts.
 
 # OPTIONS
 
+**-a**,\ **--check-sourced**
+
+:   Emit warnings in sourced files. Normally, `shellcheck` will only warn
+    about issues in the specified files. With this option, any issues in
+    sourced files files will also be reported.
+
 **-C**[*WHEN*],\ **--color**[=*WHEN*]
 
 :   For TTY output, enable colors *always*, *never* or *auto*. The default
@@ -50,6 +56,11 @@ not warn at all, as `ksh` supports decimals in arithmetic contexts.
     standard output. Subsequent **-f** options are ignored, see **FORMATS**
     below for more information.
 
+**-S**\ *SEVERITY*,\ **--severity=***severity*
+
+:   Specify minimum severity of errors to consider. Valid values are *error*,
+    *warning*, *info* and *style*.    The default is *style*.
+
 **-s**\ *shell*,\ **--shell=***shell*
 
 :   Specify Bourne shell dialect. Valid values are *sh*, *bash*, *dash* and *ksh*.
@@ -60,6 +71,11 @@ not warn at all, as `ksh` supports decimals in arithmetic contexts.
 
 :   Print version information and exit.
 
+**-W** *NUM*,\ **--wiki-link-count=NUM**
+
+:   For TTY output, show *NUM* wiki links to more information about mentioned
+    warnings. Set to 0 to disable them entirely.
+
 **-x**,\ **--external-sources**
 
 :   Follow 'source' statements even when the file is not specified as input.
@@ -67,6 +83,7 @@ not warn at all, as `ksh` supports decimals in arithmetic contexts.
     line (plus `/dev/null`). This option allows following any file the script
     may `source`.
 
+
 # FORMATS
 
 **tty**
@@ -157,6 +174,11 @@ Valid keys are:
     used to tell shellcheck where to look for a file whose name is determined
     at runtime, or to skip a source by telling it to use `/dev/null`.
 
+**shell**
+:   Overrides the shell detected from the shebang.  This is useful for
+    files meant to be included (and thus lacking a shebang), or possibly
+    as a more targeted alternative to 'disable=2039'.
+
 # ENVIRONMENT VARIABLES
 The environment variable `SHELLCHECK_OPTS` can be set with default flags:
 
@@ -195,7 +217,7 @@ https://github.com/koalaman/shellcheck/issues
 # COPYRIGHT
 Copyright 2012-2015, Vidar Holen.
 Licensed under the GNU General Public License version 3 or later,
-see http://gnu.org/licenses/gpl.html
+see https://gnu.org/licenses/gpl.html
 
 
 # SEE ALSO

shellcheck.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,35 +15,38 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
-import ShellCheck.Data
-import ShellCheck.Checker
-import ShellCheck.Interface
-import ShellCheck.Regex
+import           ShellCheck.Checker
+import           ShellCheck.Data
+import           ShellCheck.Interface
+import           ShellCheck.Regex
 
-import ShellCheck.Formatter.Format
 import qualified ShellCheck.Formatter.CheckStyle
+import           ShellCheck.Formatter.Format
 import qualified ShellCheck.Formatter.GCC
 import qualified ShellCheck.Formatter.JSON
 import qualified ShellCheck.Formatter.TTY
 
-import Control.Exception
-import Control.Monad
-import Control.Monad.Except
-import Data.Bits
-import Data.Char
-import Data.Functor
-import Data.Either
-import qualified Data.Map as Map
-import Data.Maybe
-import Data.Monoid
-import Prelude hiding (catch)
-import System.Console.GetOpt
-import System.Directory
-import System.Environment
-import System.Exit
-import System.IO
+import           Control.Exception
+import           Control.Monad
+import           Control.Monad.Except
+import           Data.Bits
+import           Data.Char
+import           Data.Either
+import           Data.Functor
+import           Data.IORef
+import           Data.List
+import qualified Data.Map                        as Map
+import           Data.Maybe
+import           Data.Monoid
+import           Data.Semigroup                  (Semigroup (..))
+import           Prelude                         hiding (catch)
+import           System.Console.GetOpt
+import           System.Directory
+import           System.Environment
+import           System.Exit
+import           System.IO
 
 data Flag = Flag String String
 data Status =
@@ -54,39 +57,54 @@ data Status =
     | RuntimeException
   deriving (Ord, Eq, Show)
 
+instance Semigroup Status where
+    (<>) = max
+
 instance Monoid Status where
     mempty = NoProblems
-    mappend = max
+    mappend = (Data.Semigroup.<>)
 
 data Options = Options {
-    checkSpec :: CheckSpec,
-    externalSources :: Bool,
-    formatterOptions :: FormatterOptions
+    checkSpec        :: CheckSpec,
+    externalSources  :: Bool,
+    formatterOptions :: FormatterOptions,
+    minSeverity      :: Severity
 }
 
 defaultOptions = Options {
     checkSpec = emptyCheckSpec,
     externalSources = False,
-    formatterOptions = FormatterOptions {
+    formatterOptions = newFormatterOptions {
         foColorOption = ColorAuto
-    }
+    },
+    minSeverity = StyleC
 }
 
 usageHeader = "Usage: shellcheck [OPTIONS...] FILES..."
 options = [
-    Option "e" ["exclude"]
-        (ReqArg (Flag "exclude") "CODE1,CODE2..") "exclude types of warnings",
-    Option "f" ["format"]
-        (ReqArg (Flag "format") "FORMAT") "output format",
+    Option "a" ["check-sourced"]
+        (NoArg $ Flag "sourced" "false") "Include warnings from sourced files",
     Option "C" ["color"]
         (OptArg (maybe (Flag "color" "always") (Flag "color")) "WHEN")
         "Use color (auto, always, never)",
+    Option "e" ["exclude"]
+        (ReqArg (Flag "exclude") "CODE1,CODE2..") "Exclude types of warnings",
+    Option "f" ["format"]
+        (ReqArg (Flag "format") "FORMAT") $
+        "Output format (" ++ formatList ++ ")",
     Option "s" ["shell"]
-        (ReqArg (Flag "shell") "SHELLNAME") "Specify dialect (sh,bash,dash,ksh)",
-    Option "x" ["external-sources"]
-        (NoArg $ Flag "externals" "true") "Allow 'source' outside of FILES.",
+        (ReqArg (Flag "shell") "SHELLNAME")
+        "Specify dialect (sh, bash, dash, ksh)",
+    Option "S" ["severity"]
+        (ReqArg (Flag "severity") "SEVERITY")
+        "Minimum severity of errors to consider (error, warning, info, style)",
     Option "V" ["version"]
-        (NoArg $ Flag "version" "true") "Print version information"
+        (NoArg $ Flag "version" "true") "Print version information",
+    Option "W" ["wiki-link-count"]
+        (ReqArg (Flag "wiki-link-count") "NUM")
+        "The number of wiki links to show, when applicable.",
+    Option "x" ["external-sources"]
+        (NoArg $ Flag "externals" "true") "Allow 'source' outside of FILES"
     ]
 
 printErr = lift . hPutStrLn stderr
@@ -107,9 +125,13 @@ formats options = Map.fromList [
     ("tty",  ShellCheck.Formatter.TTY.format options)
     ]
 
-getOption [] _ = Nothing
+formatList = intercalate ", " names
+  where
+    names = Map.keys $ formats (formatterOptions defaultOptions)
+
+getOption [] _                  = Nothing
 getOption (Flag var val:_) name | name == var = return val
-getOption (_:rest) flag = getOption rest flag
+getOption (_:rest) flag         = getOption rest flag
 
 getOptions options name =
     map (\(Flag _ val) -> val) . filter (\(Flag var _) -> var == name) $ options
@@ -123,13 +145,7 @@ split char str =
         else split' rest (a:element)
     split' [] element = [reverse element]
 
-getExclusions options =
-    let elements = concatMap (split ',') $ getOptions options "exclude"
-        clean = dropWhile (not . isDigit)
-    in
-        map (Prelude.read . clean) elements :: [Int]
-
-toStatus = liftM (either id id) . runExceptT
+toStatus = fmap (either id id) . runExceptT
 
 getEnvArgs = do
     opts <- getEnv "SHELLCHECK_OPTS" `catch` cantWaitForLookupEnv
@@ -149,10 +165,10 @@ main = do
 
 statusToCode status =
     case status of
-        NoProblems -> ExitSuccess
-        SomeProblems -> ExitFailure 1
-        SyntaxFailure -> ExitFailure 3
-        SupportFailure -> ExitFailure 4
+        NoProblems       -> ExitSuccess
+        SomeProblems     -> ExitFailure 1
+        SyntaxFailure    -> ExitFailure 3
+        SupportFailure   -> ExitFailure 4
         RuntimeException -> ExitFailure 2
 
 process :: [Flag] -> [FilePath] -> ExceptT Status IO Status
@@ -186,30 +202,50 @@ runFormatter sys format options files = do
         newStatus <- process file `catch` handler file
         return $ status `mappend` newStatus
     handler :: FilePath -> IOException -> IO Status
-    handler file e = do
-        onFailure format file (show e)
+    handler file e = reportFailure file (show e)
+    reportFailure file str = do
+        onFailure format file str
         return RuntimeException
 
     process :: FilePath -> IO Status
     process filename = do
-        contents <- inputFile filename
-        let checkspec = (checkSpec options) {
-            csFilename = filename,
-            csScript = contents
-        }
-        result <- checkScript sys checkspec
-        onResult format result contents
-        return $
-            if null (crComments result)
-            then NoProblems
-            else SomeProblems
+        input <- siReadFile sys filename
+        either (reportFailure filename) check input
+      where
+        check contents = do
+            let checkspec = (checkSpec options) {
+                csFilename = filename,
+                csScript = contents
+            }
+            result <- checkScript sys checkspec
+            onResult format result sys
+            return $
+                if null (crComments result)
+                then NoProblems
+                else SomeProblems
 
-parseColorOption colorOption =
-    case colorOption of
-        "auto" -> ColorAuto
-        "always" -> ColorAlways
-        "never" -> ColorNever
-        _ -> error $ "Bad value for --color `" ++ colorOption ++ "'"
+parseEnum name value list =
+    case filter ((== value) . fst) list of
+        [(name, value)] -> return value
+        [] -> do
+            printErr $ "Unknown value for --" ++ name ++ ". " ++
+                       "Valid options are: " ++ (intercalate ", " $ map fst list)
+            throwError SupportFailure
+
+parseColorOption value =
+    parseEnum "color" value [
+        ("auto",   ColorAuto),
+        ("always", ColorAlways),
+        ("never",  ColorNever)
+        ]
+
+parseSeverityOption value =
+    parseEnum "severity" value [
+        ("error",   ErrorC),
+        ("warning", WarningC),
+        ("info",    InfoC),
+        ("style",   StyleC)
+        ]
 
 parseOption flag options =
     case flag of
@@ -223,7 +259,7 @@ parseOption flag options =
                         }
 
         Flag "exclude" str -> do
-            new <- mapM parseNum $ split ',' str
+            new <- mapM parseNum $ filter (not . null) $ split ',' str
             let old = csExcludedWarnings . checkSpec $ options
             return options {
                 checkSpec = (checkSpec options) {
@@ -240,10 +276,34 @@ parseOption flag options =
                 externalSources = True
             }
 
-        Flag "color" color ->
+        Flag "color" color -> do
+            option <- parseColorOption color
             return options {
                 formatterOptions = (formatterOptions options) {
-                    foColorOption = parseColorOption color
+                    foColorOption = option
+                }
+            }
+
+        Flag "sourced" _ ->
+            return options {
+                checkSpec = (checkSpec options) {
+                    csCheckSourced = True
+                }
+            }
+
+        Flag "severity" severity -> do
+            option <- parseSeverityOption severity
+            return options {
+                checkSpec = (checkSpec options) {
+                    csMinSeverity = option
+                }
+            }
+
+        Flag "wiki-link-count" countString -> do
+            count <- parseNum countString
+            return options {
+                formatterOptions = (formatterOptions options) {
+                    foWikiLinkCount = count
                 }
             }
 
@@ -255,20 +315,34 @@ parseOption flag options =
     parseNum ('S':'C':str) = parseNum str
     parseNum num = do
         unless (all isDigit num) $ do
-            printErr $ "Bad exclusion: " ++ num
+            printErr $ "Invalid number: " ++ num
             throwError SyntaxFailure
         return (Prelude.read num :: Integer)
 
 ioInterface options files = do
     inputs <- mapM normalize files
+    cache <- newIORef emptyCache
     return SystemInterface {
-        siReadFile = get inputs
+        siReadFile = get cache inputs
     }
   where
-    get inputs file = do
+    emptyCache :: Map.Map FilePath String
+    emptyCache = Map.empty
+    get cache inputs file = do
+        map <- readIORef cache
+        case Map.lookup file map of
+            Just x  -> return $ Right x
+            Nothing -> fetch cache inputs file
+
+    fetch cache inputs file = do
         ok <- allowable inputs file
         if ok
-          then (Right <$> inputFile file) `catch` handler
+          then (do
+            (contents, shouldCache) <- inputFile file
+            when shouldCache $
+                modifyIORef cache $ Map.insert file contents
+            return $ Right contents
+            ) `catch` handler
           else return $ Left (file ++ " was not specified as input (see shellcheck -x).")
 
       where
@@ -289,16 +363,19 @@ ioInterface options files = do
         fallback path _ = return path
 
 inputFile file = do
-    handle <-
+    (handle, shouldCache) <-
             if file == "-"
-            then return stdin
-            else openBinaryFile file ReadMode
+            then return (stdin, True)
+            else do
+                h <- openBinaryFile file ReadMode
+                reopenable <- hIsSeekable h
+                return (h, not reopenable)
 
     hSetBinaryMode handle True
     contents <- decodeString <$> hGetContents handle -- closes handle
 
     seq (length contents) $
-        return contents
+        return (contents, shouldCache)
 
 -- Decode a char8 string into a utf8 string, with fallback on
 -- ISO-8859-1. This avoids depending on additional libraries.
@@ -317,7 +394,7 @@ decodeString = decode
         in
             case next of
                 Just (n, remainder) -> chr n : decode remainder
-                Nothing -> c : decode rest
+                Nothing             -> c : decode rest
 
     construct x 0 rest = do
         guard $ x <= 0x10FFFF
@@ -340,4 +417,4 @@ printVersion = do
     putStrLn   "ShellCheck - shell script analysis tool"
     putStrLn $ "version: " ++ shellcheckVersion
     putStrLn   "license: GNU General Public License, version 3"
-    putStrLn   "website: http://www.shellcheck.net"
+    putStrLn   "website: https://www.shellcheck.net"

snap/snapcraft.yaml

@@ -0,0 +1,46 @@
+name: shellcheck
+summary: A shell script static analysis tool
+description: |
+  ShellCheck is a GPLv3 tool that gives warnings and suggestions for bash/sh
+  shell scripts.
+
+  The goals of ShellCheck are
+
+  - To point out and clarify typical beginner's syntax issues that cause a
+    shell to give cryptic error messages.
+
+  - To point out and clarify typical intermediate level semantic problems that
+    cause a shell to behave strangely and counter-intuitively.
+
+  - To point out subtle caveats, corner cases and pitfalls that may cause an
+    advanced user's otherwise working script to fail under future
+    circumstances.
+
+  By default ShellCheck can only check non-hidden files under /home, to make 
+  ShellCheck be able to check files under /media and /run/media you must
+  connect it to the `removable-media` interface manually:
+
+      # snap connect shellcheck:removable-media
+  
+version: git
+grade: devel
+confinement: strict
+
+apps:
+  shellcheck:
+    command: usr/bin/shellcheck
+    plugs: [home, removable-media]
+
+parts:
+  shellcheck:
+    plugin: dump
+    source: ./
+    build-packages:
+      - cabal-install
+    build: |
+      cabal sandbox init
+      cabal update
+      cabal install -j
+    install: |
+      install -d $SNAPCRAFT_PART_INSTALL/usr/bin
+      install .cabal-sandbox/bin/shellcheck $SNAPCRAFT_PART_INSTALL/usr/bin

src/ShellCheck/AST.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,30 +15,33 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
+{-# LANGUAGE DeriveGeneric, DeriveAnyClass #-}
 module ShellCheck.AST where
 
-import Control.Monad
+import GHC.Generics (Generic)
 import Control.Monad.Identity
+import Control.DeepSeq
 import Text.Parsec
 import qualified ShellCheck.Regex as Re
+import Prelude hiding (id)
 
-data Id = Id Int deriving (Show, Eq, Ord)
+newtype Id = Id Int deriving (Show, Eq, Ord, Generic, NFData)
 
 data Quoted = Quoted | Unquoted deriving (Show, Eq)
 data Dashed = Dashed | Undashed deriving (Show, Eq)
 data AssignmentMode = Assign | Append deriving (Show, Eq)
-data FunctionKeyword = FunctionKeyword Bool deriving (Show, Eq)
-data FunctionParentheses = FunctionParentheses Bool deriving (Show, Eq)
+newtype FunctionKeyword = FunctionKeyword Bool deriving (Show, Eq)
+newtype FunctionParentheses = FunctionParentheses Bool deriving (Show, Eq)
 data CaseType = CaseBreak | CaseFallThrough | CaseContinue deriving (Show, Eq)
 
-data Root = Root Token
+newtype Root = Root Token
 data Token =
     TA_Binary Id String Token Token
     | TA_Assignment Id String Token Token
+    | TA_Variable Id String [Token]
     | TA_Expansion Id [Token]
-    | TA_Index Id Token
     | TA_Sequence Id [Token]
     | TA_Trinary Id Token Token Token
     | TA_Unary Id String Token
@@ -48,8 +51,9 @@ data Token =
     | TC_Nullary Id ConditionType Token
     | TC_Or Id ConditionType String Token Token
     | TC_Unary Id ConditionType String Token
+    | TC_Empty Id ConditionType
     | T_AND_IF Id
-    | T_AndIf Id (Token) (Token)
+    | T_AndIf Id Token Token
     | T_Arithmetic Id Token
     | T_Array Id [Token]
     | T_IndexedElement Id [Token] Token
@@ -110,7 +114,7 @@ data Token =
     | T_NEWLINE Id
     | T_NormalWord Id [Token]
     | T_OR_IF Id
-    | T_OrIf Id (Token) (Token)
+    | T_OrIf Id Token Token
     | T_ParamSubSpecialChar Id String -- e.g. '%' in ${foo%bar}  or '/' in ${foo/bar/baz}
     | T_Pipeline Id [Token] [Token] -- [Pipe separators] [Commands]
     | T_ProcSub Id String [Token]
@@ -133,7 +137,8 @@ data Token =
     | T_Pipe Id String
     | T_CoProc Id (Maybe String) Token
     | T_CoProcBody Id Token
-    | T_Include Id Token Token -- . & source: SimpleCommand T_Script
+    | T_Include Id Token
+    | T_SourceCommand Id Token Token
     deriving (Show)
 
 data Annotation =
@@ -162,11 +167,6 @@ analyze f g i =
         i newT
     roundAll = mapM round
 
-    roundMaybe Nothing = return Nothing
-    roundMaybe (Just v) = do
-        s <- round v
-        return (Just s)
-
     dl l v = do
         x <- roundAll l
         return $ v x
@@ -270,13 +270,15 @@ analyze f g i =
         c <- round t3
         return $ TA_Trinary id a b c
     delve (TA_Expansion id t) = dl t $ TA_Expansion id
-    delve (TA_Index id t) = d1 t $ TA_Index id
+    delve (TA_Variable id str t) = dl t $ TA_Variable id str
     delve (T_Annotation id anns t) = d1 t $ T_Annotation id anns
     delve (T_CoProc id var body) = d1 body $ T_CoProc id var
     delve (T_CoProcBody id t) = d1 t $ T_CoProcBody id
-    delve (T_Include id includer script) = d2 includer script $ T_Include id
+    delve (T_Include id script) = d1 script $ T_Include id
+    delve (T_SourceCommand id includer t_include) = d2 includer t_include $ T_SourceCommand id
     delve t = return t
 
+getId :: Token -> Id
 getId t = case t of
         T_AND_IF id  -> id
         T_OR_IF id  -> id
@@ -363,7 +365,6 @@ getId t = case t of
         TA_Sequence id _  -> id
         TA_Trinary id _ _ _  -> id
         TA_Expansion id _  -> id
-        TA_Index id _  -> id
         T_ProcSub id _ _ -> id
         T_Glob id _ -> id
         T_ForArithmetic id _ _ _ _ -> id
@@ -374,12 +375,18 @@ getId t = case t of
         T_Pipe id _ -> id
         T_CoProc id _ _ -> id
         T_CoProcBody id _ -> id
-        T_Include id _ _ -> id
+        T_Include id _ -> id
+        T_SourceCommand id _ _ -> id
         T_UnparsedIndex id _ _ -> id
+        TC_Empty id _ -> id
+        TA_Variable id _ _ -> id
 
 blank :: Monad m => Token -> m ()
 blank = const $ return ()
+doAnalysis :: Monad m => (Token -> m ()) -> Token -> m Token
 doAnalysis f = analyze f blank return
+doStackAnalysis :: Monad m => (Token -> m ()) -> (Token -> m ()) -> Token -> m Token
 doStackAnalysis startToken endToken = analyze startToken endToken return
+doTransform :: (Token -> Token) -> Token -> Token
 doTransform i = runIdentity . analyze blank blank (return . i)
 

src/ShellCheck/ASTLib.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 module ShellCheck.ASTLib where
 
@@ -23,6 +23,7 @@ import ShellCheck.AST
 
 import Control.Monad.Writer
 import Control.Monad
+import Data.Char
 import Data.Functor
 import Data.List
 import Data.Maybe
@@ -48,8 +49,8 @@ willSplit x =
     T_NormalWord _ l -> any willSplit l
     _ -> False
 
-isGlob (T_Extglob {}) = True
-isGlob (T_Glob {}) = True
+isGlob T_Extglob {} = True
+isGlob T_Glob {} = True
 isGlob (T_NormalWord _ l) = any isGlob l
 isGlob _ = False
 
@@ -112,6 +113,7 @@ getFlagsUntil stopCondition (T_SimpleCommand _ _ (_:args)) =
 getFlagsUntil _ _ = error "Internal shellcheck error, please report! (getFlags on non-command)"
 
 -- Get all flags in a GNU way, up until --
+getAllFlags :: Token -> [(Token, String)]
 getAllFlags = getFlagsUntil (== "--")
 -- Get all flags in a BSD way, up until first non-flag argument or --
 getLeadingFlags = getFlagsUntil (\x -> x == "--" || (not $ "-" `isPrefixOf` x))
@@ -119,6 +121,16 @@ getLeadingFlags = getFlagsUntil (\x -> x == "--" || (not $ "-" `isPrefixOf` x))
 -- Check if a command has a flag.
 hasFlag cmd str = str `elem` (map snd $ getAllFlags cmd)
 
+-- Is this token a word that starts with a dash?
+isFlag token =
+    case getWordParts token of
+        T_Literal _ ('-':_) : _ -> True
+        _ -> False
+
+-- Is this token a flag where the - is unquoted?
+isUnquotedFlag token = fromMaybe False $ do
+    str <- getLeadingUnquotedString token
+    return $ "-" `isPrefixOf` str
 
 -- Given a T_DollarBraced, return a simplified version of the string contents.
 bracedString (T_DollarBraced _ l) = concat $ oversimplify l
@@ -144,9 +156,9 @@ mayBecomeMultipleArgs t = willBecomeMultipleArgs t || f t
 -- Is it certain that this word will becomes multiple words?
 willBecomeMultipleArgs t = willConcatInAssignment t || f t
   where
-    f (T_Extglob {}) = True
-    f (T_Glob {}) = True
-    f (T_BraceExpansion {}) = True
+    f T_Extglob {} = True
+    f T_Glob {} = True
+    f T_BraceExpansion {} = True
     f (T_DoubleQuoted _ parts) = any f parts
     f (T_NormalWord _ parts) = any f parts
     f _ = False
@@ -154,7 +166,7 @@ willBecomeMultipleArgs t = willConcatInAssignment t || f t
 -- This does token cause implicit concatenation in assignments?
 willConcatInAssignment token =
     case token of
-        t@(T_DollarBraced {}) -> isArrayExpansion t
+        t@T_DollarBraced {} -> isArrayExpansion t
         (T_DoubleQuoted _ parts) -> any willConcatInAssignment parts
         (T_NormalWord _ parts) -> any willConcatInAssignment parts
         _ -> False
@@ -169,7 +181,7 @@ onlyLiteralString = fromJust . getLiteralStringExt (const $ return "")
 
 -- Maybe get a literal string, but only if it's an unquoted argument.
 getUnquotedLiteral (T_NormalWord _ list) =
-    liftM concat $ mapM str list
+    concat <$> mapM str list
   where
     str (T_Literal _ s) = return s
     str _ = Nothing
@@ -186,9 +198,16 @@ getTrailingUnquotedLiteral t =
   where
     from t =
         case t of
-            (T_Literal {}) -> return t
+            T_Literal {} -> return t
             _ -> Nothing
 
+-- Get the leading, unquoted, literal string of a token (if any).
+getLeadingUnquotedString :: Token -> Maybe String
+getLeadingUnquotedString t =
+    case t of
+        T_NormalWord _ ((T_Literal _ s) : _) -> return s
+        _ -> Nothing
+
 -- Maybe get the literal string of this token and any globs in it.
 getGlobOrLiteralString = getLiteralStringExt f
   where
@@ -200,7 +219,7 @@ getGlobOrLiteralString = getLiteralStringExt f
 getLiteralStringExt :: (Token -> Maybe String) -> Token -> Maybe String
 getLiteralStringExt more = g
   where
-    allInList = liftM concat . mapM g
+    allInList = fmap concat . mapM g
     g (T_DoubleQuoted _ l) = allInList l
     g (T_DollarDoubleQuoted _ l) = allInList l
     g (T_NormalWord _ l) = allInList l
@@ -208,8 +227,43 @@ getLiteralStringExt more = g
     g (T_SingleQuoted _ s) = return s
     g (T_Literal _ s) = return s
     g (T_ParamSubSpecialChar _ s) = return s
+    g (T_DollarSingleQuoted _ s) = return $ decodeEscapes s
     g x = more x
 
+    -- Bash style $'..' decoding
+    decodeEscapes ('\\':c:cs) =
+        case c of
+            'a' -> '\a' : rest
+            'b' -> '\b' : rest
+            'e' -> '\x1B' : rest
+            'f' -> '\f' : rest
+            'n' -> '\n' : rest
+            'r' -> '\r' : rest
+            't' -> '\t' : rest
+            'v' -> '\v' : rest
+            '\'' -> '\'' : rest
+            '"' -> '"' : rest
+            '\\' -> '\\' : rest
+            'x' ->
+                case cs of
+                    (x:y:more) ->
+                        if isHexDigit x && isHexDigit y
+                        then chr (16*(digitToInt x) + (digitToInt y)) : rest
+                        else '\\':c:rest
+            _ | isOctDigit c ->
+                let digits = take 3 $ takeWhile isOctDigit (c:cs)
+                    num = parseOct digits
+                in (if num < 256 then chr num else '?') : rest
+            _ -> '\\' : c : rest
+      where
+        rest = decodeEscapes cs
+        parseOct = f 0
+          where
+            f n "" = n
+            f n (c:rest) = f (n * 8 + digitToInt c) rest
+    decodeEscapes (c:cs) = c : decodeEscapes cs
+    decodeEscapes [] = []
+
 -- Is this token a string literal?
 isLiteral t = isJust $ getLiteralString t
 
@@ -237,19 +291,29 @@ getCommand t =
         T_Redirecting _ _ w -> getCommand w
         T_SimpleCommand _ _ (w:_) -> return t
         T_Annotation _ _ t -> getCommand t
-        otherwise -> Nothing
+        _ -> Nothing
 
--- Maybe get the command name of a token representing a command
-getCommandName t = do
+-- Maybe get the command name string of a token representing a command
+getCommandName :: Token -> Maybe String
+getCommandName = fst . getCommandNameAndToken
+
+-- Get the command name token from a command, i.e.
+-- the token representing 'ls' in 'ls -la 2> foo'.
+-- If it can't be determined, return the original token.
+getCommandTokenOrThis = snd . getCommandNameAndToken
+
+getCommandNameAndToken :: Token -> (Maybe String, Token)
+getCommandNameAndToken t = fromMaybe (Nothing, t) $ do
     (T_SimpleCommand _ _ (w:rest)) <- getCommand t
     s <- getLiteralString w
-    if "busybox" `isSuffixOf` s
+    if "busybox" `isSuffixOf` s || "builtin" == s
         then
             case rest of
-                (applet:_) -> getLiteralString applet
-                _ -> return s
+                (applet:_) -> return (getLiteralString applet, applet)
+                _ -> return (Just s, w)
         else
-            return s
+            return (Just s, w)
+
 
 -- If a command substitution is a single command, get its name.
 --  $(date +%s) = Just "date"
@@ -259,13 +323,13 @@ getCommandNameFromExpansion t =
         T_DollarExpansion _ [c] -> extract c
         T_Backticked _ [c] -> extract c
         T_DollarBraceCommandExpansion _ [c] -> extract c
-        otherwise -> Nothing
+        _ -> Nothing
   where
     extract (T_Pipeline _ _ [cmd]) = getCommandName cmd
     extract _ = Nothing
 
 -- Get the basename of a token representing a command
-getCommandBasename = liftM basename . getCommandName
+getCommandBasename = fmap basename . getCommandName
   where
     basename = reverse . takeWhile (/= '/') . reverse
 
@@ -275,7 +339,7 @@ isAssignment t =
         T_SimpleCommand _ (w:_) [] -> True
         T_Assignment {} -> True
         T_Annotation _ _ w -> isAssignment w
-        otherwise -> False
+        _ -> False
 
 isOnlyRedirection t =
     case t of
@@ -283,7 +347,7 @@ isOnlyRedirection t =
         T_Annotation _ _ w -> isOnlyRedirection w
         T_Redirecting _ (_:_) c -> isOnlyRedirection c
         T_SimpleCommand _ [] [] -> True
-        otherwise -> False
+        _ -> False
 
 isFunction t = case t of T_Function {} -> True; _ -> False
 
@@ -291,6 +355,7 @@ isBraceExpansion t = case t of T_BraceExpansion {} -> True; _ -> False
 
 -- Get the lists of commands from tokens that contain them, such as
 -- the body of while loops or branches of if statements.
+getCommandSequences :: Token -> [[Token]]
 getCommandSequences t =
     case t of
         T_Script _ _ cmds -> [cmds]
@@ -301,16 +366,18 @@ getCommandSequences t =
         T_ForIn _ _ _ cmds -> [cmds]
         T_ForArithmetic _ _ _ _ cmds -> [cmds]
         T_IfExpression _ thens elses -> map snd thens ++ [elses]
-        otherwise -> []
+        T_Annotation _ _ t -> getCommandSequences t
+        _ -> []
 
 -- Get a list of names of associative arrays
 getAssociativeArrays t =
     nub . execWriter $ doAnalysis f t
   where
     f :: Token -> Writer [String] ()
-    f t@(T_SimpleCommand {}) = fromMaybe (return ()) $ do
+    f t@T_SimpleCommand {} = fromMaybe (return ()) $ do
         name <- getCommandName t
-        guard $ name == "declare" || name == "typeset"
+        let assocNames = ["declare","local","typeset"]
+        guard $ elem name assocNames
         let flags = getAllFlags t
         guard $ elem "A" $ map snd flags
         let args = map fst . filter ((==) "" . snd) $ flags
@@ -321,7 +388,7 @@ getAssociativeArrays t =
     nameAssignments t =
         case t of
             T_Assignment _ _ name _ _ -> return name
-            otherwise -> Nothing
+            _ -> Nothing
 
 -- A Pseudoglob is a wildcard pattern used for checking if a match can succeed.
 -- For example, [[ $(cmd).jpg == [a-z] ]] will give the patterns *.jpg and ?, which
@@ -333,7 +400,7 @@ data PseudoGlob = PGAny | PGMany | PGChar Char
 -- PGMany.
 wordToPseudoGlob :: Token -> Maybe [PseudoGlob]
 wordToPseudoGlob word =
-    simplifyPseudoGlob <$> concat <$> mapM f (getWordParts word)
+    simplifyPseudoGlob . concat <$> mapM f (getWordParts word)
   where
     f x = case x of
         T_Literal _ s -> return $ map PGChar s
@@ -351,6 +418,19 @@ wordToPseudoGlob word =
 
         _ -> return [PGMany]
 
+-- Turn a word into a PG pattern, but only if we can preserve
+-- exact semantics.
+wordToExactPseudoGlob :: Token -> Maybe [PseudoGlob]
+wordToExactPseudoGlob word =
+    simplifyPseudoGlob . concat <$> mapM f (getWordParts word)
+  where
+    f x = case x of
+        T_Literal _ s -> return $ map PGChar s
+        T_SingleQuoted _ s -> return $ map PGChar s
+        T_Glob _ "?" -> return [PGAny]
+        T_Glob _ "*" -> return [PGMany]
+        _ -> fail "Unknown token type"
+
 -- Reorder a PseudoGlob for more efficient matching, e.g.
 -- f?*?**g -> f??*g
 simplifyPseudoGlob :: [PseudoGlob] -> [PseudoGlob]
@@ -382,5 +462,31 @@ pseudoGlobsCanOverlap = matchable
     matchable (_:_) [] = False
     matchable [] r = matchable r []
 
+-- Check whether the first pattern always overlaps the second.
+pseudoGlobIsSuperSetof :: [PseudoGlob] -> [PseudoGlob] -> Bool
+pseudoGlobIsSuperSetof = matchable
+  where
+    matchable x@(xf:xs) y@(yf:ys) =
+        case (xf, yf) of
+            (PGMany, PGMany) -> matchable x ys
+            (PGMany, _) -> matchable x ys || matchable xs y
+            (_, PGMany) -> False
+            (PGAny, _) -> matchable xs ys
+            (_, PGAny) -> False
+            (_, _) -> xf == yf && matchable xs ys
+
+    matchable [] [] = True
+    matchable (PGMany : rest) [] = matchable rest []
+    matchable _ _ = False
+
 wordsCanBeEqual x y = fromMaybe True $
     liftM2 pseudoGlobsCanOverlap (wordToPseudoGlob x) (wordToPseudoGlob y)
+
+-- Is this an expansion that can be quoted,
+-- e.g. $(foo) `foo` $foo (but not {foo,})?
+isQuoteableExpansion t = case t of
+    T_DollarExpansion {} -> True
+    T_DollarBraceCommandExpansion {} -> True
+    T_Backticked {} -> True
+    T_DollarBraced {} -> True
+    _ -> False

src/ShellCheck/Analyzer.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 module ShellCheck.Analyzer (analyzeScript) where
 
@@ -30,9 +30,9 @@ import qualified ShellCheck.Checks.ShellSupport
 
 -- TODO: Clean up the cruft this is layered on
 analyzeScript :: AnalysisSpec -> AnalysisResult
-analyzeScript spec = AnalysisResult {
+analyzeScript spec = newAnalysisResult {
     arComments =
-        filterByAnnotation (asScript spec) . nub $
+        filterByAnnotation spec params . nub $
             runAnalytics spec
             ++ runChecker params (checkers params)
 }

src/ShellCheck/AnalyzerLib.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,11 +15,12 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
-{-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE FlexibleContexts #-}
+{-# LANGUAGE TemplateHaskell  #-}
 module ShellCheck.AnalyzerLib where
+
 import ShellCheck.AST
 import ShellCheck.ASTLib
 import ShellCheck.Data
@@ -28,6 +29,7 @@ import ShellCheck.Parser
 import ShellCheck.Regex
 
 import Control.Arrow (first)
+import Control.DeepSeq
 import Control.Monad.Identity
 import Control.Monad.RWS
 import Control.Monad.State
@@ -35,10 +37,11 @@ import Control.Monad.Writer
 import Data.Char
 import Data.List
 import Data.Maybe
+import Data.Semigroup
 import qualified Data.Map as Map
 
 import Test.QuickCheck.All (forAllProperties)
-import Test.QuickCheck.Test (quickCheckWithResult, stdArgs, maxSuccess)
+import Test.QuickCheck.Test (maxSuccess, quickCheckWithResult, stdArgs)
 
 type Analysis = AnalyzerM ()
 type AnalyzerM a = RWS Parameters [TokenComment] Cache a
@@ -47,7 +50,7 @@ nullCheck = const $ return ()
 
 data Checker = Checker {
     perScript :: Root -> Analysis,
-    perToken :: Token -> Analysis
+    perToken  :: Token -> Analysis
 }
 
 runChecker :: Parameters -> Checker -> [TokenComment]
@@ -57,26 +60,31 @@ runChecker params checker = notes
         check = perScript checker `composeAnalyzers` (\(Root x) -> void $ doAnalysis (perToken checker) x)
         notes = snd $ evalRWS (check $ Root root) params Cache
 
+instance Semigroup Checker where
+    (<>) x y = Checker {
+        perScript = perScript x `composeAnalyzers` perScript y,
+        perToken = perToken x `composeAnalyzers` perToken y
+        }
+
 instance Monoid Checker where
     mempty = Checker {
         perScript = nullCheck,
         perToken = nullCheck
         }
-    mappend x y = Checker {
-        perScript = perScript x `composeAnalyzers` perScript y,
-        perToken = perToken x `composeAnalyzers` perToken y
-        }
-
+    mappend = (Data.Semigroup.<>)
 
 composeAnalyzers :: (a -> Analysis) -> (a -> Analysis) -> a -> Analysis
 composeAnalyzers f g x = f x >> g x
 
 data Parameters = Parameters {
-    variableFlow :: [StackData],
-    parentMap :: Map.Map Id Token,
-    shellType :: Shell,
-    shellTypeSpecified :: Bool,
-    rootNode :: Token
+    hasLastpipe        :: Bool,           -- Whether this script has the 'lastpipe' option set/default.
+    hasSetE            :: Bool,           -- Whether this script has 'set -e' anywhere.
+    variableFlow       :: [StackData],   -- A linear (bad) analysis of data flow
+    parentMap          :: Map.Map Id Token, -- A map from Id to parent Token
+    shellType          :: Shell,            -- The shell type, such as Bash or Ksh
+    shellTypeSpecified :: Bool,    -- True if shell type was forced via flags
+    rootNode           :: Token,              -- The root node of the AST
+    tokenPositions     :: Map.Map Id (Position, Position) -- map from token id to start and end position
     }
 
 -- TODO: Cache results of common AST ops here
@@ -94,20 +102,25 @@ data StackData =
 data DataType = DataString DataSource | DataArray DataSource
   deriving (Show)
 
-data DataSource = SourceFrom [Token] | SourceExternal | SourceDeclaration | SourceInteger
+data DataSource =
+    SourceFrom [Token]
+    | SourceExternal
+    | SourceDeclaration
+    | SourceInteger
+    | SourceChecked
   deriving (Show)
 
 data VariableState = Dead Token String | Alive deriving (Show)
 
-defaultSpec root = AnalysisSpec {
-    asScript = root,
+defaultSpec root = spec {
     asShellType = Nothing,
+    asCheckSourced = False,
     asExecutionMode = Executed
-}
+} where spec = newAnalysisSpec root
 
 pScript s =
   let
-    pSpec = ParseSpec {
+    pSpec = newParseSpec {
         psFilename = "script",
         psScript = s
     }
@@ -123,9 +136,16 @@ producesComments c s = do
 
 makeComment :: Severity -> Id -> Code -> String -> TokenComment
 makeComment severity id code note =
-    TokenComment id $ Comment severity code note
+    newTokenComment {
+        tcId = id,
+        tcComment = newComment {
+            cSeverity = severity,
+            cCode = code,
+            cMessage = note
+        }
+    }
 
-addComment note = tell [note]
+addComment note = note `deepseq` tell [note]
 
 warn :: MonadWriter [TokenComment] m => Id -> Code -> String -> m ()
 warn  id code str = addComment $ makeComment WarningC id code str
@@ -133,17 +153,67 @@ err   id code str = addComment $ makeComment ErrorC id code str
 info  id code str = addComment $ makeComment InfoC id code str
 style id code str = addComment $ makeComment StyleC id code str
 
+warnWithFix id code str fix = addComment $
+    let comment = makeComment WarningC id code str in
+    comment {
+        tcFix = Just fix
+    }
+
+makeCommentWithFix :: Severity -> Id -> Code -> String -> Fix -> TokenComment
+makeCommentWithFix severity id code str fix =
+    let comment = makeComment severity id code str
+        withFix = comment {
+            tcFix = Just fix
+        }
+    in withFix `deepseq` withFix
+
 makeParameters spec =
     let params = Parameters {
         rootNode = root,
         shellType = fromMaybe (determineShell root) $ asShellType spec,
+        hasSetE = containsSetE root,
+        hasLastpipe =
+            case shellType params of
+                Bash -> containsLastpipe root
+                Dash -> False
+                Sh   -> False
+                Ksh  -> True,
+
         shellTypeSpecified = isJust $ asShellType spec,
         parentMap = getParentTree root,
-        variableFlow =
-            getVariableFlow (shellType params) (parentMap params) root
+        variableFlow = getVariableFlow params root,
+        tokenPositions = asTokenPositions spec
     } in params
   where root = asScript spec
 
+
+-- Does this script mention 'set -e' anywhere?
+-- Used as a hack to disable certain warnings.
+containsSetE root = isNothing $ doAnalysis (guard . not . isSetE) root
+  where
+    isSetE t =
+        case t of
+            T_Script _ str _ -> str `matches` re
+            T_SimpleCommand {}  ->
+                t `isUnqualifiedCommand` "set" &&
+                    ("errexit" `elem` oversimplify t ||
+                        "e" `elem` map snd (getAllFlags t))
+            _ -> False
+    re = mkRegex "[[:space:]]-[^-]*e"
+
+-- Does this script mention 'shopt -s lastpipe' anywhere?
+-- Also used as a hack.
+containsLastpipe root =
+        isNothing $ doAnalysis (guard . not . isShoptLastPipe) root
+    where
+        isShoptLastPipe t =
+            case t of
+                T_SimpleCommand {}  ->
+                    t `isUnqualifiedCommand` "shopt" &&
+                        ("lastpipe" `elem` oversimplify t)
+                _ -> False
+
+
 prop_determineShell0 = determineShell (fromJust $ pScript "#!/bin/sh") == Sh
 prop_determineShell1 = determineShell (fromJust $ pScript "#!/usr/bin/env ksh") == Ksh
 prop_determineShell2 = determineShell (fromJust $ pScript "") == Bash
@@ -161,9 +231,9 @@ determineShell t = fromMaybe Bash $ do
     forAnnotation t =
         case t of
             (ShellOverride s) -> return s
-            _ -> fail ""
+            _                 -> fail ""
     getCandidates :: Token -> [Maybe String]
-    getCandidates t@(T_Script {}) = [Just $ fromShebang t]
+    getCandidates t@T_Script {} = [Just $ fromShebang t]
     getCandidates (T_Annotation _ annotations s) =
         map forAnnotation annotations ++
            [Just $ fromShebang s]
@@ -179,29 +249,38 @@ executableFromShebang = shellFor
     shellFor s = reverse . takeWhile (/= '/') . reverse $ s
 
 
---- Context seeking
 
+-- Given a root node, make a map from Id to parent Token.
+-- This is used to populate parentMap in Parameters
+getParentTree :: Token -> Map.Map Id Token
 getParentTree t =
     snd . snd $ runState (doStackAnalysis pre post t) ([], Map.empty)
   where
     pre t = modify (first ((:) t))
     post t = do
-        (_:rest, map) <- get
-        case rest of [] -> put (rest, map)
-                     (x:_) -> put (rest, Map.insert (getId t) x map)
+        (x, map) <- get
+        case x of
+          _:rest -> case rest of []    -> put (rest, map)
+                                 (x:_) -> put (rest, Map.insert (getId t) x map)
 
+-- Given a root node, make a map from Id to Token
+getTokenMap :: Token -> Map.Map Id Token
 getTokenMap t =
     execState (doAnalysis f t) Map.empty
   where
     f t = modify (Map.insert (getId t) t)
 
 
--- Is this node self quoting for a regular element?
-isQuoteFree = isQuoteFreeNode False
-
--- Is this node striclty self quoting, for array expansions
+-- Is this token in a quoting free context? (i.e. would variable expansion split)
+-- True:  Assignments, [[ .. ]], here docs, already in double quotes
+-- False: Regular words
 isStrictlyQuoteFree = isQuoteFreeNode True
 
+-- Like above, but also allow some cases where splitting may be desired.
+-- True:  Like above + for loops
+-- False: Like above
+isQuoteFree = isQuoteFreeNode False
+
 
 isQuoteFreeNode strict tree t =
     (isQuoteFreeElement t == Just True) ||
@@ -212,53 +291,63 @@ isQuoteFreeNode strict tree t =
         case t of
             T_Assignment {} -> return True
             T_FdRedirect {} -> return True
-            _ -> Nothing
+            _               -> Nothing
 
     -- Are any subnodes inherently self-quoting?
     isQuoteFreeContext t =
         case t of
-            TC_Nullary _ DoubleBracket _ -> return True
-            TC_Unary _ DoubleBracket _ _ -> return True
+            TC_Nullary _ DoubleBracket _    -> return True
+            TC_Unary _ DoubleBracket _ _    -> return True
             TC_Binary _ DoubleBracket _ _ _ -> return True
-            TA_Sequence {} -> return True
-            T_Arithmetic {} -> return True
-            T_Assignment {} -> return True
-            T_Redirecting {} -> return False
-            T_DoubleQuoted _ _ -> return True
-            T_DollarDoubleQuoted _ _ -> return True
-            T_CaseExpression {} -> return True
-            T_HereDoc {} -> return True
-            T_DollarBraced {} -> return True
+            TA_Sequence {}                  -> return True
+            T_Arithmetic {}                 -> return True
+            T_Assignment {}                 -> return True
+            T_Redirecting {}                -> return False
+            T_DoubleQuoted _ _              -> return True
+            T_DollarDoubleQuoted _ _        -> return True
+            T_CaseExpression {}             -> return True
+            T_HereDoc {}                    -> return True
+            T_DollarBraced {}               -> return True
             -- When non-strict, pragmatically assume it's desirable to split here
-            T_ForIn {} -> return (not strict)
-            T_SelectIn {} -> return (not strict)
-            _ -> Nothing
+            T_ForIn {}                      -> return (not strict)
+            T_SelectIn {}                   -> return (not strict)
+            _                               -> Nothing
 
+-- Check if a token is a parameter to a certain command by name:
+-- Example: isParamTo (parentMap params) "sed" t
+isParamTo :: Map.Map Id Token -> String -> Token -> Bool
 isParamTo tree cmd =
     go
   where
     go x = case Map.lookup (getId x) tree of
-                Nothing -> False
+                Nothing     -> False
                 Just parent -> check parent
     check t =
         case t of
             T_SingleQuoted _ _ -> go t
             T_DoubleQuoted _ _ -> go t
-            T_NormalWord _ _ -> go t
+            T_NormalWord _ _   -> go t
             T_SimpleCommand {} -> isCommand t cmd
-            T_Redirecting {} -> isCommand t cmd
-            _ -> False
+            T_Redirecting {}   -> isCommand t cmd
+            _                  -> False
 
+-- Get the parent command (T_Redirecting) of a Token, if any.
+getClosestCommand :: Map.Map Id Token -> Token -> Maybe Token
 getClosestCommand tree t =
-    msum . map getCommand $ getPath tree t
+    findFirst findCommand $ getPath tree t
   where
-    getCommand t@(T_Redirecting {}) = return t
-    getCommand _ = Nothing
+    findCommand t =
+        case t of
+            T_Redirecting {} -> return True
+            T_Script {}      -> return False
+            _                -> Nothing
 
+-- Like above, if koala_man knew Haskell when starting this project.
 getClosestCommandM t = do
     tree <- asks parentMap
     return $ getClosestCommand tree t
 
+-- Is the token used as a command name (the first word in a T_SimpleCommand)?
 usedAsCommandName tree token = go (getId token) (tail $ getPath tree token)
   where
     go currentId (T_NormalWord id [word]:rest)
@@ -269,10 +358,10 @@ usedAsCommandName tree token = go (getId token) (tail $ getPath tree token)
         | currentId == getId word = True
     go _ _ = False
 
--- A list of the element and all its parents
+-- A list of the element and all its parents up to the root node.
 getPath tree t = t :
     case Map.lookup (getId t) tree of
-        Nothing -> []
+        Nothing     -> []
         Just parent -> getPath tree parent
 
 -- Version of the above taking the map from the current context
@@ -290,6 +379,18 @@ pathTo t = do
     parents <- reader parentMap
     return $ getPath parents t
 
+-- Find the first match in a list where the predicate is Just True.
+-- Stops if it's Just False and ignores Nothing.
+findFirst :: (a -> Maybe Bool) -> [a] -> Maybe a
+findFirst p l =
+    case l of
+        [] -> Nothing
+        (x:xs) ->
+            case p x of
+                Just True  -> return x
+                Just False -> Nothing
+                Nothing    -> findFirst p xs
+
 -- Check whether a word is entirely output from a single command
 tokenIsJustCommandOutput t = case t of
     T_NormalWord id [T_DollarExpansion _ cmds] -> check cmds
@@ -299,32 +400,32 @@ tokenIsJustCommandOutput t = case t of
     _ -> False
   where
     check [x] = not $ isOnlyRedirection x
-    check _ = False
+    check _   = False
 
 -- TODO: Replace this with a proper Control Flow Graph
-getVariableFlow shell parents t =
+getVariableFlow params t =
     let (_, stack) = runState (doStackAnalysis startScope endScope t) []
     in reverse stack
   where
     startScope t =
-        let scopeType = leadType shell parents t
+        let scopeType = leadType params t
         in do
             when (scopeType /= NoneScope) $ modify (StackScope scopeType:)
             when (assignFirst t) $ setWritten t
 
     endScope t =
-        let scopeType = leadType shell parents t
+        let scopeType = leadType params t
         in do
             setRead t
             unless (assignFirst t) $ setWritten t
             when (scopeType /= NoneScope) $ modify (StackScopeEnd:)
 
-    assignFirst (T_ForIn {}) = True
-    assignFirst (T_SelectIn {}) = True
-    assignFirst _ = False
+    assignFirst T_ForIn {}    = True
+    assignFirst T_SelectIn {} = True
+    assignFirst _             = False
 
     setRead t =
-        let read    = getReferencedVariables parents t
+        let read    = getReferencedVariables (parentMap params) t
         in mapM_ (\v -> modify (Reference v:)) read
 
     setWritten t =
@@ -332,7 +433,7 @@ getVariableFlow shell parents t =
         in mapM_ (\v -> modify (Assignment v:)) written
 
 
-leadType shell parents t =
+leadType params t =
     case t of
         T_DollarExpansion _ _  -> SubshellScope "$(..) expansion"
         T_Backticked _ _  -> SubshellScope "`..` expansion"
@@ -346,26 +447,19 @@ leadType shell parents t =
         _ -> NoneScope
   where
     parentPipeline = do
-        parent <- Map.lookup (getId t) parents
+        parent <- Map.lookup (getId t) (parentMap params)
         case parent of
             T_Pipeline {} -> return parent
-            _ -> Nothing
+            _             -> Nothing
 
     causesSubshell = do
         (T_Pipeline _ _ list) <- parentPipeline
         if length list <= 1
             then return False
-            else if lastCreatesSubshell
+            else if not $ hasLastpipe params
                 then return True
                 else return . not $ (getId . head $ reverse list) == getId t
 
-    lastCreatesSubshell =
-        case shell of
-            Bash -> True
-            Dash -> True
-            Sh -> True
-            Ksh -> False
-
 getModifiedVariables t =
     case t of
         T_SimpleCommand _ vars [] ->
@@ -374,20 +468,29 @@ getModifiedVariables t =
                                     [(x, x, name, dataTypeFrom DataString w)]
                                 _ -> []
                       ) vars
-        c@(T_SimpleCommand {}) ->
+        c@T_SimpleCommand {} ->
             getModifiedVariableCommand c
 
-        TA_Unary _ "++|" var -> maybeToList $ do
-            name <- getLiteralString var
-            return (t, t, name, DataString $ SourceFrom [t])
-        TA_Unary _ "|++" var -> maybeToList $ do
-            name <- getLiteralString var
-            return (t, t, name, DataString $ SourceFrom [t])
-        TA_Assignment _ op lhs rhs -> maybeToList $ do
+        TA_Unary _ "++|" v@(TA_Variable _ name _)  ->
+            [(t, v, name, DataString $ SourceFrom [v])]
+        TA_Unary _ "|++" v@(TA_Variable _ name _)  ->
+            [(t, v, name, DataString $ SourceFrom [v])]
+        TA_Assignment _ op (TA_Variable _ name _) rhs -> maybeToList $ do
             guard $ op `elem` ["=", "*=", "/=", "%=", "+=", "-=", "<<=", ">>=", "&=", "^=", "|="]
-            name <- getLiteralString lhs
             return (t, t, name, DataString $ SourceFrom [rhs])
 
+        -- Count [[ -v foo ]] as an "assignment".
+        -- This is to prevent [ -v foo ] being unassigned or unused.
+        TC_Unary id _ "-v" token -> maybeToList $ do
+            str <- fmap (takeWhile (/= '[')) $ -- Quoted index
+                    flip getLiteralStringExt token $ \x ->
+                case x of
+                    T_Glob _ s -> return s -- Unquoted index
+                    _          -> Nothing
+
+            guard . not . null $ str
+            return (t, token, str, DataString SourceChecked)
+
         T_DollarBraced _ l -> maybeToList $ do
             let string = bracedString t
             let modifier = getBracedModifier string
@@ -401,16 +504,16 @@ getModifiedVariables t =
             [(t, t, fromMaybe "COPROC" name, DataArray SourceInteger)]
 
         --Points to 'for' rather than variable
-        T_ForIn id str [] _ -> [(t, t, str, DataString $ SourceExternal)]
+        T_ForIn id str [] _ -> [(t, t, str, DataString SourceExternal)]
         T_ForIn id str words _ -> [(t, t, str, DataString $ SourceFrom words)]
         T_SelectIn id str words _ -> [(t, t, str, DataString $ SourceFrom words)]
         _ -> []
 
 isClosingFileOp op =
     case op of
-        T_IoFile _ (T_GREATAND _) (T_NormalWord _ [T_Literal _ "-"]) -> True
-        T_IoFile _ (T_LESSAND  _) (T_NormalWord _ [T_Literal _ "-"]) -> True
-        _ -> False
+        T_IoDuplicate _ (T_GREATAND _) "-" -> True
+        T_IoDuplicate _ (T_LESSAND  _) "-" -> True
+        _                                  -> False
 
 
 -- Consider 'export/declare -x' a reference, since it makes the var available
@@ -419,7 +522,9 @@ getReferencedVariableCommand base@(T_SimpleCommand _ _ (T_NormalWord _ (T_Litera
         "export" -> if "f" `elem` flags
             then []
             else concatMap getReference rest
-        "declare" -> if any (`elem` flags) ["x", "p"]
+        "declare" -> if
+                any (`elem` flags) ["x", "p"] &&
+                    (not $ any (`elem` flags) ["f", "F"])
             then concatMap getReference rest
             else []
         "readonly" ->
@@ -439,16 +544,26 @@ getReferencedVariableCommand base@(T_SimpleCommand _ _ (T_NormalWord _ (T_Litera
 
 getReferencedVariableCommand _ = []
 
+-- The function returns a tuple consisting of four items describing an assignment.
+-- Given e.g. declare foo=bar
+-- (
+--   BaseCommand :: Token,     -- The command/structure assigning the variable, i.e. declare foo=bar
+--   AssignmentToken :: Token, -- The specific part that assigns this variable, i.e. foo=bar
+--   VariableName :: String,   -- The variable name, i.e. foo
+--   VariableValue :: DataType -- A description of the value being assigned, i.e. "Literal string with value foo"
+-- )
 getModifiedVariableCommand base@(T_SimpleCommand _ _ (T_NormalWord _ (T_Literal _ x:_):rest)) =
    filter (\(_,_,s,_) -> not ("-" `isPrefixOf` s)) $
     case x of
         "read" ->
-            let params = map getLiteral rest in
-                catMaybes . takeWhile isJust . reverse $ params
+            let params = map getLiteral rest
+                readArrayVars = getReadArrayVariables rest
+            in
+                catMaybes . (++ readArrayVars) . takeWhile isJust . reverse $ params
         "getopts" ->
             case rest of
                 opts:var:_ -> maybeToList $ getLiteral var
-                _ -> []
+                _          -> []
 
         "let" -> concatMap letParamToLiteral rest
 
@@ -487,16 +602,20 @@ getModifiedVariableCommand base@(T_SimpleCommand _ _ (T_NormalWord _ (T_Literal
       where
         defaultType = if any (`elem` flags) ["a", "A"] then DataArray else DataString
 
-    getLiteral t = do
+    getLiteralOfDataType t d = do
         s <- getLiteralString t
         when ("-" `isPrefixOf` s) $ fail "argument"
-        return (base, t, s, DataString SourceExternal)
+        return (base, t, s, d)
+
+    getLiteral t = getLiteralOfDataType t (DataString SourceExternal)
+
+    getLiteralArray t = getLiteralOfDataType t (DataArray SourceExternal)
 
     getModifierParamString = getModifierParam DataString
 
     getModifierParam def t@(T_Assignment _ _ name _ value) =
         [(base, t, name, dataTypeFrom def value)]
-    getModifierParam def t@(T_NormalWord {}) = maybeToList $ do
+    getModifierParam def t@T_NormalWord {} = maybeToList $ do
         name <- getLiteralString t
         guard $ isVariableName name
         return (base, t, name, def SourceDeclaration)
@@ -512,9 +631,9 @@ getModifiedVariableCommand base@(T_SimpleCommand _ _ (T_NormalWord _ (T_Literal
     getSetParams (t:rest) =
         let s = getLiteralString t in
             case s of
-                Just "--" -> return rest
+                Just "--"    -> return rest
                 Just ('-':_) -> getSetParams rest
-                _ -> return (t:fromMaybe [] (getSetParams rest))
+                _            -> return (t:fromMaybe [] (getSetParams rest))
     getSetParams [] = Nothing
 
     getPrintfVariable list = f $ map (\x -> (x, getLiteralString x)) list
@@ -532,6 +651,11 @@ getModifiedVariableCommand base@(T_SimpleCommand _ _ (T_NormalWord _ (T_Literal
         guard $ isVariableName name
         return (base, lastArg, name, DataArray SourceExternal)
 
+    -- get all the array variables used in read, e.g. read -a arr
+    getReadArrayVariables args = do
+        map (getLiteralArray . snd)
+            (filter (\(x,_) -> getLiteralString x == Just "-a") (zip (args) (tail args)))
+
 getModifiedVariableCommand _ = []
 
 getIndexReferences s = fromMaybe [] $ do
@@ -541,12 +665,17 @@ getIndexReferences s = fromMaybe [] $ do
   where
     re = mkRegex "(\\[.*\\])"
 
+prop_getOffsetReferences1 = getOffsetReferences ":bar" == ["bar"]
+prop_getOffsetReferences2 = getOffsetReferences ":bar:baz" == ["bar", "baz"]
+prop_getOffsetReferences3 = getOffsetReferences "[foo]:bar" == ["bar"]
+prop_getOffsetReferences4 = getOffsetReferences "[foo]:bar:baz" == ["bar", "baz"]
 getOffsetReferences mods = fromMaybe [] $ do
+-- if mods start with [, then drop until ]
     match <- matchRegex re mods
-    offsets <- match !!! 0
+    offsets <- match !!! 1
     return $ matchAllStrings variableNameRegex offsets
   where
-    re = mkRegex "^ *:(.*)"
+    re = mkRegex "^(\\[.+\\])? *:([^-=?+].*)"
 
 getReferencedVariables parents t =
     case t of
@@ -555,10 +684,10 @@ getReferencedVariables parents t =
                 map (\x -> (l, l, x)) (
                     getIndexReferences str
                     ++ getOffsetReferences (getBracedModifier str))
-        TA_Expansion id _ ->
+        TA_Variable id name _ ->
             if isArithmeticAssignment t
             then []
-            else getIfReference t t
+            else [(t, t, name)]
         T_Assignment id mode str _ word ->
             [(t, t, str) | mode == Append] ++ specialReferences str t word
 
@@ -584,8 +713,9 @@ getReferencedVariables parents t =
                 getVariablesFromLiteralToken word
         else []
 
-    literalizer (TA_Index {}) = return ""  -- x[0] becomes a reference of x
-    literalizer _ = Nothing
+    literalizer t = case t of
+        T_Glob _ s -> return s    -- Also when parsed as globs
+        _          -> Nothing
 
     getIfReference context token = maybeToList $ do
             str <- getLiteralStringExt literalizer token
@@ -597,23 +727,29 @@ getReferencedVariables parents t =
 
     isArithmeticAssignment t = case getPath parents t of
         this: TA_Assignment _ "=" lhs _ :_ -> lhs == t
-        _ -> False
+        _                                  -> False
 
 dataTypeFrom defaultType v = (case v of T_Array {} -> DataArray; _ -> defaultType) $ SourceFrom [v]
 
 
 --- Command specific checks
 
+-- Compare a command to a string: t `isCommand` "sed" (also matches /usr/bin/sed)
 isCommand token str = isCommandMatch token (\cmd -> cmd  == str || ('/' : str) `isSuffixOf` cmd)
+
+-- Compare a command to a literal. Like above, but checks full path.
 isUnqualifiedCommand token str = isCommandMatch token (== str)
 
-isCommandMatch token matcher = fromMaybe False $ do
-    cmd <- getCommandName token
-    return $ matcher cmd
+isCommandMatch token matcher = fromMaybe False $
+    fmap matcher (getCommandName token)
 
+-- Does this regex look like it was intended as a glob?
+-- True:  *foo*
+-- False: .*foo.*
+isConfusedGlobRegex :: String -> Bool
 isConfusedGlobRegex ('*':_) = True
 isConfusedGlobRegex [x,'*'] | x /= '\\' = True
-isConfusedGlobRegex _ = False
+isConfusedGlobRegex _       = False
 
 isVariableStartChar x = x == '_' || isAsciiLower x || isAsciiUpper x
 isVariableChar x = isVariableStartChar x || isDigit x
@@ -623,7 +759,7 @@ prop_isVariableName1 = isVariableName "_fo123"
 prop_isVariableName2 = not $ isVariableName "4"
 prop_isVariableName3 = not $ isVariableName "test: "
 isVariableName (x:r) = isVariableStartChar x && all isVariableChar r
-isVariableName _ = False
+isVariableName _     = False
 
 getVariablesFromLiteralToken token =
     getVariablesFromLiteral (fromJust $ getLiteralStringExt (const $ return " ") token)
@@ -637,6 +773,7 @@ getVariablesFromLiteral string =
   where
     variableRegex = mkRegex "\\$\\{?([A-Za-z0-9_]+)"
 
+-- Get the variable name from an expansion like ${var:-foo}
 prop_getBracedReference1 = getBracedReference "foo" == "foo"
 prop_getBracedReference2 = getBracedReference "#foo" == "foo"
 prop_getBracedReference3 = getBracedReference "#" == "#"
@@ -655,7 +792,7 @@ getBracedReference s = fromMaybe s $
   where
     noPrefix = dropPrefix s
     dropPrefix (c:rest) = if c `elem` "!#" then rest else c:rest
-    dropPrefix "" = ""
+    dropPrefix ""       = ""
     takeName s = do
         let name = takeWhile isVariableChar s
         guard . not $ null name
@@ -680,23 +817,32 @@ getBracedModifier s = fromMaybe "" . listToMaybe $ do
     a <- dropModifier s
     dropPrefix var a
   where
-    dropPrefix [] t = return t
+    dropPrefix [] t        = return t
     dropPrefix (a:b) (c:d) | a == c = dropPrefix b d
-    dropPrefix _ _ = []
+    dropPrefix _ _         = []
 
     dropModifier (c:rest) | c `elem` "#!" = [rest, c:rest]
-    dropModifier x = [x]
+    dropModifier x        = [x]
 
--- Useful generic functions
+-- Useful generic functions.
+
+-- Run an action in a Maybe (or do nothing).
+-- Example:
+-- potentially $ do
+--   s <- getLiteralString cmd
+--   guard $ s `elem` ["--recursive", "-r"]
+--   return $ warn .. "Something something recursive"
 potentially :: Monad m => Maybe (m ()) -> m ()
 potentially = fromMaybe (return ())
 
+-- Get element 0 or a default. Like `head` but safe.
 headOrDefault _ (a:_) = a
-headOrDefault def _ = def
+headOrDefault def _   = def
 
+--- Get element n of a list, or Nothing. Like `!!` but safe.
 (!!!) list i =
     case drop i list of
-        [] -> Nothing
+        []    -> Nothing
         (r:_) -> Just r
 
 -- Run a command if the shell is in the given list
@@ -705,23 +851,71 @@ whenShell l c = do
     when (shell `elem` l ) c
 
 
-filterByAnnotation token =
+filterByAnnotation asSpec params =
     filter (not . shouldIgnore)
   where
-    idFor (TokenComment id _) = id
+    token = asScript asSpec
     shouldIgnore note =
         any (shouldIgnoreFor (getCode note)) $
-            getPath parents (T_Bang $ idFor note)
+            getPath parents (T_Bang $ tcId note)
     shouldIgnoreFor num (T_Annotation _ anns _) =
         any hasNum anns
       where
         hasNum (DisableComment ts) = num == ts
-        hasNum _ = False
-    shouldIgnoreFor _ (T_Include {}) = True -- Ignore included files
+        hasNum _                   = False
+    shouldIgnoreFor _ T_Include {} = not $ asCheckSourced asSpec
     shouldIgnoreFor _ _ = False
-    parents = getParentTree token
-    getCode (TokenComment _ (Comment _ c _)) = c
+    parents = parentMap params
+    getCode = cCode . tcComment
 
+-- Is this a ${#anything}, to get string length or array count?
+isCountingReference (T_DollarBraced id token) =
+    case concat $ oversimplify token of
+        '#':_ -> True
+        _     -> False
+isCountingReference _ = False
+
+-- FIXME: doesn't handle ${a:+$var} vs ${a:+"$var"}
+isQuotedAlternativeReference t =
+    case t of
+        T_DollarBraced _ _ ->
+            getBracedModifier (bracedString t) `matches` re
+        _ -> False
+  where
+    re = mkRegex "(^|\\]):?\\+"
+
+-- getGnuOpts "erd:u:" will parse a SimpleCommand like
+--     read -re -d : -u 3 bar
+-- into
+--     Just [("r", -re), ("e", -re), ("d", :), ("u", 3), ("", bar)]
+-- where flags with arguments map to arguments, while others map to themselves.
+-- Any unrecognized flag will result in Nothing.
+getGnuOpts = getOpts getAllFlags
+getBsdOpts = getOpts getLeadingFlags
+getOpts :: (Token -> [(Token, String)]) -> String -> Token -> Maybe [(String, Token)]
+getOpts flagTokenizer string cmd = process flags
+  where
+    flags = flagTokenizer cmd
+    flagList (c:':':rest) = ([c], True) : flagList rest
+    flagList (c:rest)     = ([c], False) : flagList rest
+    flagList []           = []
+    flagMap = Map.fromList $ ("", False) : flagList string
+
+    process [] = return []
+    process [(token, flag)] = do
+        takesArg <- Map.lookup flag flagMap
+        guard $ not takesArg
+        return [(flag, token)]
+    process ((token1, flag1):rest2@((token2, flag2):rest)) = do
+        takesArg <- Map.lookup flag1 flagMap
+        if takesArg
+            then do
+                guard $ flag2 == ""
+                more <- process rest
+                return $ (flag1, token2) : more
+            else do
+                more <- process rest2
+                return $ (flag1, token1) : more
 
 return []
 runTests =  $( [| $(forAllProperties) (quickCheckWithResult (stdArgs { maxSuccess = 1 }) ) |])

src/ShellCheck/Checker.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 {-# LANGUAGE TemplateHaskell #-}
 module ShellCheck.Checker (checkScript, ShellCheck.Checker.runTests) where
@@ -37,64 +37,93 @@ import Control.Monad
 
 import Test.QuickCheck.All
 
-tokenToPosition map (TokenComment id c) = fromMaybe fail $ do
-    position <- Map.lookup id map
-    return $ PositionedComment position position c
+tokenToPosition startMap t = fromMaybe fail $ do
+    span <- Map.lookup (tcId t) startMap
+    return $ newPositionedComment {
+        pcStartPos = fst span,
+        pcEndPos = snd span,
+        pcComment = tcComment t,
+        pcFix = tcFix t
+    }
   where
     fail = error "Internal shellcheck error: id doesn't exist. Please report!"
 
 checkScript :: Monad m => SystemInterface m -> CheckSpec -> m CheckResult
 checkScript sys spec = do
     results <- checkScript (csScript spec)
-    return CheckResult {
+    return emptyCheckResult {
         crFilename = csFilename spec,
         crComments = results
     }
   where
     checkScript contents = do
-        result <- parseScript sys ParseSpec {
+        result <- parseScript sys newParseSpec {
             psFilename = csFilename spec,
-            psScript = contents
+            psScript = contents,
+            psCheckSourced = csCheckSourced spec,
+            psShellTypeOverride = csShellTypeOverride spec
         }
         let parseMessages = prComments result
+        let tokenPositions = prTokenPositions result
+        let analysisSpec root =
+                as {
+                    asScript = root,
+                    asShellType = csShellTypeOverride spec,
+                    asCheckSourced = csCheckSourced spec,
+                    asExecutionMode = Executed,
+                    asTokenPositions = tokenPositions
+                } where as = newAnalysisSpec root
         let analysisMessages =
                 fromMaybe [] $
                     (arComments . analyzeScript . analysisSpec)
                         <$> prRoot result
-        let translator = tokenToPosition (prTokenPositions result)
+        let translator = tokenToPosition tokenPositions
         return . nub . sortMessages . filter shouldInclude $
             (parseMessages ++ map translator analysisMessages)
 
-    shouldInclude (PositionedComment _ _ (Comment _ code _)) =
-        code `notElem` csExcludedWarnings spec
+    shouldInclude pc =
+        let code     = cCode (pcComment pc)
+            severity = cSeverity (pcComment pc)
+        in
+            code `notElem` csExcludedWarnings spec &&
+            severity <= csMinSeverity spec
 
     sortMessages = sortBy (comparing order)
-    order (PositionedComment pos _ (Comment severity code message)) =
-        (posFile pos, posLine pos, posColumn pos, severity, code, message)
-    getPosition (PositionedComment pos _ _) = pos
+    order pc =
+        let pos = pcStartPos pc
+            comment = pcComment pc in
+        (posFile pos,
+         posLine pos,
+         posColumn pos,
+         cSeverity comment,
+         cCode comment,
+         cMessage comment)
+    getPosition = pcStartPos
 
-    analysisSpec root =
-        AnalysisSpec {
-            asScript = root,
-            asShellType = csShellTypeOverride spec,
-            asExecutionMode = Executed
-         }
 
 getErrors sys spec =
     sort . map getCode . crComments $
         runIdentity (checkScript sys spec)
   where
-    getCode (PositionedComment _ _ (Comment _ code _)) = code
+    getCode = cCode . pcComment
 
 check = checkWithIncludes []
 
+checkWithSpec includes =
+    getErrors (mockedSystemInterface includes)
+
 checkWithIncludes includes src =
-    getErrors
-        (mockedSystemInterface includes)
-        emptyCheckSpec {
-            csScript = src,
-            csExcludedWarnings = [2148]
-        }
+    checkWithSpec includes emptyCheckSpec {
+        csScript = src,
+        csExcludedWarnings = [2148]
+    }
+
+checkRecursive includes src =
+    checkWithSpec includes emptyCheckSpec {
+        csScript = src,
+        csExcludedWarnings = [2148],
+        csCheckSourced = True
+    }
 
 prop_findsParseIssue = check "echo \"$12\"" == [1037]
 
@@ -126,6 +155,21 @@ prop_optionDisablesIssue2 =
                     csExcludedWarnings = [2148, 1037]
                 }
 
+prop_wontParseBadShell =
+    [1071] == check "#!/usr/bin/python\ntrue $1\n"
+
+prop_optionDisablesBadShebang =
+    null $ getErrors
+                (mockedSystemInterface [])
+                emptyCheckSpec {
+                    csScript = "#!/usr/bin/python\ntrue\n",
+                    csShellTypeOverride = Just Sh
+                }
+
+prop_annotationDisablesBadShebang =
+    [] == check "#!/usr/bin/python\n# shellcheck shell=sh\ntrue\n"
+
+
 prop_canParseDevNull =
     [] == check "source /dev/null"
 
@@ -153,6 +197,12 @@ prop_cantSourceDynamic2 =
 prop_canSourceDynamicWhenRedirected =
     null $ checkWithIncludes [("lib", "")] "#shellcheck source=lib\n. \"$1\""
 
+prop_recursiveAnalysis =
+    [2086] == checkRecursive [("lib", "echo $1")] "source lib"
+
+prop_recursiveParsing =
+    [1037] == checkRecursive [("lib", "echo \"$10\"")] "source lib"
+
 prop_sourceDirectiveDoesntFollowFile =
     null $ checkWithIncludes
                 [("foo", "source bar"), ("bar", "baz=3")]
@@ -164,7 +214,7 @@ prop_filewideAnnotation1 = null $
 prop_filewideAnnotation2 = null $
     check "#!/bin/sh\n# shellcheck disable=2086\ntrue\necho $1"
 prop_filewideAnnotation3 = null $
-    check "#!/bin/sh\n#unerlated\n# shellcheck disable=2086\ntrue\necho $1"
+    check "#!/bin/sh\n#unrelated\n# shellcheck disable=2086\ntrue\necho $1"
 prop_filewideAnnotation4 = null $
     check "#!/bin/sh\n# shellcheck disable=2086\n#unrelated\ntrue\necho $1"
 prop_filewideAnnotation5 = null $
@@ -178,5 +228,8 @@ prop_filewideAnnotationBase2 = [2086, 2181] == check "true\n[ $? == 0 ] && echo
 prop_filewideAnnotation8 = null $
     check "# Disable $? warning\n#shellcheck disable=SC2181\n# Disable quoting warning\n#shellcheck disable=2086\ntrue\n[ $? == 0 ] && echo $1"
 
+prop_sourcePartOfOriginalScript = -- #1181: -x disabled posix warning for 'source'
+    2039 `elem` checkWithIncludes [("./saywhat.sh", "echo foo")] "#!/bin/sh\nsource ./saywhat.sh"
+
 return []
 runTests = $quickCheckAll

src/ShellCheck/Checks/Commands.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,15 +15,13 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 {-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE FlexibleContexts #-}
 
 -- This module contains checks that examine specific commands by name.
-module ShellCheck.Checks.Commands (checker
-    , ShellCheck.Checks.Commands.runTests
-) where
+module ShellCheck.Checks.Commands (checker , ShellCheck.Checks.Commands.runTests) where
 
 import ShellCheck.AST
 import ShellCheck.ASTLib
@@ -38,7 +36,7 @@ import Control.Monad.RWS
 import Data.Char
 import Data.List
 import Data.Maybe
-import qualified Data.Map as Map
+import qualified Data.Map.Strict as Map
 import Test.QuickCheck.All (forAllProperties)
 import Test.QuickCheck.Test (quickCheckWithResult, stdArgs, maxSuccess)
 
@@ -85,13 +83,22 @@ commandChecks = [
     ,checkDeprecatedTempfile
     ,checkDeprecatedEgrep
     ,checkDeprecatedFgrep
+    ,checkWhileGetoptsCase
+    ,checkCatastrophicRm
+    ,checkLetUsage
+    ,checkMvArguments, checkCpArguments, checkLnArguments
+    ,checkFindRedirections
+    ,checkReadExpansions
+    ,checkWhich
+    ,checkSudoRedirect
+    ,checkSudoArgs
     ]
 
 buildCommandMap :: [CommandCheck] -> Map.Map CommandName (Token -> Analysis)
 buildCommandMap = foldl' addCheck Map.empty
   where
     addCheck map (CommandCheck name function) =
-        Map.insertWith' composeAnalyzers name function map
+        Map.insertWith composeAnalyzers name function map
 
 
 checkCommand :: Map.Map CommandName (Token -> Analysis) -> Token -> Analysis
@@ -134,6 +141,7 @@ prop_checkTr8 = verifyNot checkTr "tr aeiou _____"
 prop_checkTr9 = verifyNot checkTr "a-z n-za-m"
 prop_checkTr10= verifyNot checkTr "tr --squeeze-repeats rl lr"
 prop_checkTr11= verifyNot checkTr "tr abc '[d*]'"
+prop_checkTr12= verifyNot checkTr "tr '[=e=]' 'e'"
 checkTr = CommandCheck (Basename "tr") (mapM_ f . arguments)
   where
     f w | isGlob w = -- The user will go [ab] -> '[ab]' -> 'ab'. Fixme?
@@ -145,7 +153,7 @@ checkTr = CommandCheck (Basename "tr") (mapM_ f . arguments)
         Just s -> do  -- Eliminate false positives by only looking for dupes in SET2?
           when (not ("-" `isPrefixOf` s || "[:" `isInfixOf` s) && duplicated s) $
             info (getId word) 2020 "tr replaces sets of chars, not words (mentioned due to duplicates)."
-          unless ("[:" `isPrefixOf` s) $
+          unless ("[:" `isPrefixOf` s || "[=" `isPrefixOf` s) $
             when ("[" `isPrefixOf` s && "]" `isSuffixOf` s && (length s > 2) && ('*' `notElem` s)) $
               info (getId word) 2021 "Don't use [] around classes in tr, it replaces literal square brackets."
         Nothing -> return ()
@@ -176,7 +184,7 @@ prop_checkNeedlessExpr4 = verifyNot checkNeedlessExpr "foo=$(expr foo \\< regex)
 checkNeedlessExpr = CommandCheck (Basename "expr") f where
     f t =
         when (all (`notElem` exceptions) (words $ arguments t)) $
-            style (getId t) 2003
+            style (getId $ getCommandTokenOrThis t) 2003
                 "expr is antiquated. Consider rewriting this using $((..)), ${} or [[ ]]."
     -- These operators are hard to replicate in POSIX
     exceptions = [ ":", "<", ">", "<=", ">=" ]
@@ -195,6 +203,9 @@ prop_checkGrepRe9 = verifyNot checkGrepRe "grep '[0-9]*' file"
 prop_checkGrepRe10= verifyNot checkGrepRe "grep '^aa*' file"
 prop_checkGrepRe11= verifyNot checkGrepRe "grep --include=*.png foo"
 prop_checkGrepRe12= verifyNot checkGrepRe "grep -F 'Foo*' file"
+prop_checkGrepRe13= verifyNot checkGrepRe "grep -- -foo bar*"
+prop_checkGrepRe14= verifyNot checkGrepRe "grep -e -foo bar*"
+prop_checkGrepRe15= verifyNot checkGrepRe "grep --regex -foo bar*"
 
 checkGrepRe = CommandCheck (Basename "grep") check where
     check cmd = f cmd (arguments cmd)
@@ -202,8 +213,18 @@ checkGrepRe = CommandCheck (Basename "grep") check where
     skippable (Just s) = not ("--regex=" `isPrefixOf` s) && "-" `isPrefixOf` s
     skippable _ = False
     f _ [] = return ()
-    f cmd (x:r) | skippable (getLiteralStringExt (const $ return "_") x) = f cmd r
-    f cmd (re:_) = do
+    f cmd (x:r) =
+        let str = getLiteralStringExt (const $ return "_") x
+        in
+            if str `elem` [Just "--", Just "-e", Just "--regex"]
+            then checkRE cmd r -- Regex is *after* this
+            else
+                if skippable str
+                then f cmd r           -- Regex is elsewhere
+                else checkRE cmd (x:r) -- Regex is this
+
+    checkRE _ [] = return ()
+    checkRE cmd (re:_) = do
         when (isGlob re) $
             warn (getId re) 2062 "Quote the grep pattern so the shell won't interpret it."
 
@@ -304,26 +325,18 @@ prop_checkUnusedEchoEscapes2 = verifyNot checkUnusedEchoEscapes "echo -e 'foi\\n
 prop_checkUnusedEchoEscapes3 = verify checkUnusedEchoEscapes "echo \"n:\\t42\""
 prop_checkUnusedEchoEscapes4 = verifyNot checkUnusedEchoEscapes "echo lol"
 prop_checkUnusedEchoEscapes5 = verifyNot checkUnusedEchoEscapes "echo -n -e '\n'"
-checkUnusedEchoEscapes = CommandCheck (Basename "echo") (f . arguments)
+checkUnusedEchoEscapes = CommandCheck (Basename "echo") f
   where
-    isDashE = mkRegex "^-.*e"
     hasEscapes = mkRegex "\\\\[rnt]"
-    f args | concat (concatMap oversimplify allButLast) `matches` isDashE =
-        return ()
-      where allButLast = reverse . drop 1 . reverse $ args
-    f args = mapM_ checkEscapes args
+    f cmd =
+        whenShell [Sh, Bash, Ksh] $
+            unless (cmd `hasFlag` "e") $
+                mapM_ examine $ arguments cmd
 
-    checkEscapes (T_NormalWord _ args) =
-        mapM_ checkEscapes args
-    checkEscapes (T_DoubleQuoted id args) =
-        mapM_ checkEscapes args
-    checkEscapes (T_Literal id str) = examine id str
-    checkEscapes (T_SingleQuoted id str) = examine id str
-    checkEscapes _ = return ()
-
-    examine id str =
+    examine token = do
+        let str = onlyLiteralString token
         when (str `matches` hasEscapes) $
-            info id 2028 "echo won't expand escape sequences. Consider printf."
+            info (getId token) 2028 "echo may not expand escape sequences. Use printf."
 
 
 prop_checkInjectableFindSh1 = verify checkInjectableFindSh "find . -exec sh -c 'echo {}' \\;"
@@ -385,17 +398,26 @@ prop_checkMkdirDashPM11 = verifyNot checkMkdirDashPM "mkdir --parents a/b"
 prop_checkMkdirDashPM12 = verifyNot checkMkdirDashPM "mkdir --mode=0755 a/b"
 prop_checkMkdirDashPM13 = verifyNot checkMkdirDashPM "mkdir_func -pm 0755 a/b"
 prop_checkMkdirDashPM14 = verifyNot checkMkdirDashPM "mkdir -p -m 0755 singlelevel"
+prop_checkMkdirDashPM15 = verifyNot checkMkdirDashPM "mkdir -p -m 0755 ../bin"
+prop_checkMkdirDashPM16 = verify checkMkdirDashPM "mkdir -p -m 0755 ../bin/laden"
+prop_checkMkdirDashPM17 = verifyNot checkMkdirDashPM "mkdir -p -m 0755 ./bin"
+prop_checkMkdirDashPM18 = verify checkMkdirDashPM "mkdir -p -m 0755 ./bin/laden"
+prop_checkMkdirDashPM19 = verifyNot checkMkdirDashPM "mkdir -p -m 0755 ./../bin"
+prop_checkMkdirDashPM20 = verifyNot checkMkdirDashPM "mkdir -p -m 0755 .././bin"
+prop_checkMkdirDashPM21 = verifyNot checkMkdirDashPM "mkdir -p -m 0755 ../../bin"
 checkMkdirDashPM = CommandCheck (Basename "mkdir") check
   where
     check t = potentially $ do
         let flags = getAllFlags t
         dashP <- find ((\f -> f == "p" || f == "parents") . snd) flags
         dashM <- find ((\f -> f == "m" || f == "mode") . snd) flags
-        guard $ any couldHaveSubdirs (drop 1 $ arguments t) -- mkdir -pm 0700 dir  is fine, but dir/subdir is not.
+        -- mkdir -pm 0700 dir  is fine, so is ../dir, but dir/subdir is not.
+        guard $ any couldHaveSubdirs (drop 1 $ arguments t)
         return $ warn (getId $ fst dashM) 2174 "When used with -p, -m only applies to the deepest directory."
     couldHaveSubdirs t = fromMaybe True $ do
         name <- getLiteralString t
-        return $ '/' `elem` name
+        return $ '/' `elem` name && not (name `matches` re)
+    re = mkRegex "^(\\.\\.?\\/)+[^/]+$"
 
 
 prop_checkNonportableSignals1 = verify checkNonportableSignals "trap f 8"
@@ -404,9 +426,13 @@ prop_checkNonportableSignals3 = verifyNot checkNonportableSignals "trap f 14"
 prop_checkNonportableSignals4 = verify checkNonportableSignals "trap f SIGKILL"
 prop_checkNonportableSignals5 = verify checkNonportableSignals "trap f 9"
 prop_checkNonportableSignals6 = verify checkNonportableSignals "trap f stop"
+prop_checkNonportableSignals7 = verifyNot checkNonportableSignals "trap 'stop' int"
 checkNonportableSignals = CommandCheck (Exactly "trap") (f . arguments)
   where
-    f = mapM_ check
+    f args = case args of
+        first:rest -> unless (isFlag first) $ mapM_ check rest
+        _ -> return ()
+
     check param = potentially $ do
         str <- getLiteralString param
         let id = getId param
@@ -451,13 +477,13 @@ checkInteractiveSu = CommandCheck (Basename "su") f
 prop_checkSshCmdStr1 = verify checkSshCommandString "ssh host \"echo $PS1\""
 prop_checkSshCmdStr2 = verifyNot checkSshCommandString "ssh host \"ls foo\""
 prop_checkSshCmdStr3 = verifyNot checkSshCommandString "ssh \"$host\""
+prop_checkSshCmdStr4 = verifyNot checkSshCommandString "ssh -i key \"$host\""
 checkSshCommandString = CommandCheck (Basename "ssh") (f . arguments)
   where
-    nonOptions =
-        filter (\x -> not $ "-" `isPrefixOf` concat (oversimplify x))
+    isOption x = "-" `isPrefixOf` (concat $ oversimplify x)
     f args =
-        case nonOptions args of
-            (hostport:r@(_:_)) -> checkArg $ last r
+        case partition isOption args of
+            ([], hostport:r@(_:_)) -> checkArg $ last r
             _ -> return ()
     checkArg (T_NormalWord _ [T_DoubleQuoted id parts]) =
         case filter (not . isConstant) parts of
@@ -478,6 +504,13 @@ prop_checkPrintfVar8 = verifyNot checkPrintfVar "printf '%s %s %s' \"${var[@]}\"
 prop_checkPrintfVar9 = verifyNot checkPrintfVar "printf '%s %s %s\\n' *.png"
 prop_checkPrintfVar10= verifyNot checkPrintfVar "printf '%s %s %s' foo bar baz"
 prop_checkPrintfVar11= verifyNot checkPrintfVar "printf '%(%s%s)T' -1"
+prop_checkPrintfVar12= verify checkPrintfVar "printf '%s %s\\n' 1 2 3"
+prop_checkPrintfVar13= verifyNot checkPrintfVar "printf '%s %s\\n' 1 2 3 4"
+prop_checkPrintfVar14= verify checkPrintfVar "printf '%*s\\n' 1"
+prop_checkPrintfVar15= verifyNot checkPrintfVar "printf '%*s\\n' 1 2"
+prop_checkPrintfVar16= verifyNot checkPrintfVar "printf $'string'"
+prop_checkPrintfVar17= verify checkPrintfVar "printf '%-*s\\n' 1"
+prop_checkPrintfVar18= verifyNot checkPrintfVar "printf '%-*s\\n' 1 2"
 checkPrintfVar = CommandCheck (Exactly "printf") (f . arguments) where
     f (doubledash:rest) | getLiteralString doubledash == Just "--" = f rest
     f (dashv:var:rest) | getLiteralString dashv == Just "-v" = f rest
@@ -488,10 +521,20 @@ checkPrintfVar = CommandCheck (Exactly "printf") (f . arguments) where
         case string of
             '%':'%':rest -> countFormats rest
             '%':'(':rest -> 1 + countFormats (dropWhile (/= ')') rest)
-            '%':rest -> 1 + countFormats rest
+            '%':rest -> regexBasedCountFormats rest + countFormats (dropWhile (/= '%') rest)
             _:rest -> countFormats rest
             [] -> 0
 
+    regexBasedCountFormats rest =
+        maybe 1 (foldl (\acc group -> acc + (if group == "*" then 1 else 0)) 1) (matchRegex re rest)
+      where
+        -- constructed based on specifications in "man printf"
+        re = mkRegex "#?-?\\+? ?0?(\\*|\\d*).?(\\d*|\\*)[diouxXfFeEgGaAcsb]"
+        --            \____ _____/\___ ____/ \____ ____/\________ ________/
+        --                 V          V           V               V
+        --               flags    field width  precision   format character
+        -- field width and precision can be specified with a '*' instead of a digit,
+        -- in which case printf will accept one more argument for each '*' used
     check format more = do
         fromMaybe (return ()) $ do
             string <- getLiteralString format
@@ -503,7 +546,7 @@ checkPrintfVar = CommandCheck (Exactly "printf") (f . arguments) where
                         "This printf format string has no variables. Other arguments are ignored."
 
                 when (vars > 0
-                        && length more < vars
+                        && ((length more) `mod` vars /= 0 || null more)
                         && all (not . mayBecomeMultipleArgs) more) $
                     warn (getId format) 2183 $
                         "This format string has " ++ show vars ++ " variables, but is passed " ++ show (length more) ++ " arguments."
@@ -556,15 +599,48 @@ checkSetAssignment = CommandCheck (Exactly "set") (f . arguments)
 prop_checkExportedExpansions1 = verify checkExportedExpansions "export $foo"
 prop_checkExportedExpansions2 = verify checkExportedExpansions "export \"$foo\""
 prop_checkExportedExpansions3 = verifyNot checkExportedExpansions "export foo"
-checkExportedExpansions = CommandCheck (Exactly "export") (check . arguments)
+prop_checkExportedExpansions4 = verifyNot checkExportedExpansions "export ${foo?}"
+checkExportedExpansions = CommandCheck (Exactly "export") (mapM_ check . arguments)
   where
-    check = mapM_ checkForVariables
-    checkForVariables f =
-        case getWordParts f of
-            [t@(T_DollarBraced {})] ->
-                warn (getId t) 2163 "Exporting an expansion rather than a variable."
-            _ -> return ()
+    check t = potentially $ do
+        var <- getSingleUnmodifiedVariable t
+        let name = bracedString var
+        return . warn (getId t) 2163 $
+            "This does not export '" ++ name ++ "'. Remove $/${} for that, or use ${var?} to quiet."
 
+prop_checkReadExpansions1 = verify checkReadExpansions "read $var"
+prop_checkReadExpansions2 = verify checkReadExpansions "read -r $var"
+prop_checkReadExpansions3 = verifyNot checkReadExpansions "read -p $var"
+prop_checkReadExpansions4 = verifyNot checkReadExpansions "read -rd $delim name"
+prop_checkReadExpansions5 = verify checkReadExpansions "read \"$var\""
+prop_checkReadExpansions6 = verify checkReadExpansions "read -a $var"
+prop_checkReadExpansions7 = verifyNot checkReadExpansions "read $1"
+prop_checkReadExpansions8 = verifyNot checkReadExpansions "read ${var?}"
+checkReadExpansions = CommandCheck (Exactly "read") check
+  where
+    options = getGnuOpts "sreu:n:N:i:p:a:"
+    getVars cmd = fromMaybe [] $ do
+        opts <- options cmd
+        return . map snd $ filter (\(x,_) -> x == "" || x == "a") opts
+
+    check cmd = mapM_ warning $ getVars cmd
+    warning t = potentially $ do
+        var <- getSingleUnmodifiedVariable t
+        let name = bracedString var
+        guard $ isVariableName name   -- e.g. not $1
+        return . warn (getId t) 2229 $
+            "This does not read '" ++ name ++ "'. Remove $/${} for that, or use ${var?} to quiet."
+
+-- Return the single variable expansion that makes up this word, if any.
+-- e.g. $foo -> $foo, "$foo"'' -> $foo , "hello $name" -> Nothing
+getSingleUnmodifiedVariable :: Token -> Maybe Token
+getSingleUnmodifiedVariable word =
+    case getWordParts word of
+        [t@(T_DollarBraced {})] ->
+            let contents = bracedString t
+                name = getBracedReference contents
+            in guard (contents == name) >> return t
+        _ -> Nothing
 
 prop_checkAliasesUsesArgs1 = verify checkAliasesUsesArgs "alias a='cp $1 /a'"
 prop_checkAliasesUsesArgs2 = verifyNot checkAliasesUsesArgs "alias $1='foo'"
@@ -605,19 +681,26 @@ prop_checkFindWithoutPath1 = verify checkFindWithoutPath "find -type f"
 prop_checkFindWithoutPath2 = verify checkFindWithoutPath "find"
 prop_checkFindWithoutPath3 = verifyNot checkFindWithoutPath "find . -type f"
 prop_checkFindWithoutPath4 = verifyNot checkFindWithoutPath "find -H -L \"$path\" -print"
+prop_checkFindWithoutPath5 = verifyNot checkFindWithoutPath "find -O3 ."
+prop_checkFindWithoutPath6 = verifyNot checkFindWithoutPath "find -D exec ."
+prop_checkFindWithoutPath7 = verifyNot checkFindWithoutPath "find --help"
+prop_checkFindWithoutPath8 = verifyNot checkFindWithoutPath "find -Hx . -print"
 checkFindWithoutPath = CommandCheck (Basename "find") f
   where
-    f (T_SimpleCommand _ _ (cmd:args)) =
-        unless (hasPath args) $
+    f t@(T_SimpleCommand _ _ (cmd:args)) =
+        unless (t `hasFlag` "help" || hasPath args) $
             info (getId cmd) 2185 "Some finds don't have a default path. Specify '.' explicitly."
 
-    -- This is a bit of a kludge. find supports flag arguments both before and after the path,
-    -- as well as multiple non-flag arguments that are not the path. We assume that all the
-    -- pre-path flags are single characters, which is generally the case.
+    -- This is a bit of a kludge. find supports flag arguments both before and
+    -- after the path, as well as multiple non-flag arguments that are not the
+    -- path. We assume that all the pre-path flags are single characters from a
+    -- list of GNU and macOS flags.
     hasPath (first:rest) =
         let flag = fromJust $ getLiteralStringExt (const $ return "___") first in
-            not ("-" `isPrefixOf` flag) || length flag <= 2 && hasPath rest
+            not ("-" `isPrefixOf` flag) || isLeadingFlag flag && hasPath rest
     hasPath [] = False
+    isLeadingFlag flag = length flag <= 2 || all (`elem` leadingFlagChars) flag
+    leadingFlagChars="-EHLPXdfsxO0123456789"
 
 
 prop_checkTimeParameters1 = verify checkTimeParameters "time -f lol sleep 10"
@@ -666,20 +749,264 @@ checkLocalScope = CommandCheck (Exactly "local") $ \t ->
     whenShell [Bash, Dash] $ do -- Ksh allows it, Sh doesn't support local
         path <- getPathM t
         unless (any isFunction path) $
-            err (getId t) 2168 "'local' is only valid in functions."
+            err (getId $ getCommandTokenOrThis t) 2168 "'local' is only valid in functions."
 
 prop_checkDeprecatedTempfile1 = verify checkDeprecatedTempfile "var=$(tempfile)"
 prop_checkDeprecatedTempfile2 = verifyNot checkDeprecatedTempfile "tempfile=$(mktemp)"
 checkDeprecatedTempfile = CommandCheck (Basename "tempfile") $
-    \t -> warn (getId t) 2186 "tempfile is deprecated. Use mktemp instead."
+    \t -> warn (getId $ getCommandTokenOrThis t) 2186 "tempfile is deprecated. Use mktemp instead."
 
 prop_checkDeprecatedEgrep = verify checkDeprecatedEgrep "egrep '.+'"
 checkDeprecatedEgrep = CommandCheck (Basename "egrep") $
-    \t -> info (getId t) 2196 "egrep is non-standard and deprecated. Use grep -E instead."
+    \t -> info (getId $ getCommandTokenOrThis t) 2196 "egrep is non-standard and deprecated. Use grep -E instead."
 
 prop_checkDeprecatedFgrep = verify checkDeprecatedFgrep "fgrep '*' files"
 checkDeprecatedFgrep = CommandCheck (Basename "fgrep") $
-    \t -> info (getId t) 2197 "fgrep is non-standard and deprecated. Use grep -F instead."
+    \t -> info (getId $ getCommandTokenOrThis t) 2197 "fgrep is non-standard and deprecated. Use grep -F instead."
+
+prop_checkWhileGetoptsCase1 = verify checkWhileGetoptsCase "while getopts 'a:b' x; do case $x in a) foo;; esac; done"
+prop_checkWhileGetoptsCase2 = verify checkWhileGetoptsCase "while getopts 'a:' x; do case $x in a) foo;; b) bar;; esac; done"
+prop_checkWhileGetoptsCase3 = verifyNot checkWhileGetoptsCase "while getopts 'a:b' x; do case $x in a) foo;; b) bar;; *) :;esac; done"
+prop_checkWhileGetoptsCase4 = verifyNot checkWhileGetoptsCase "while getopts 'a:123' x; do case $x in a) foo;; [0-9]) bar;; esac; done"
+prop_checkWhileGetoptsCase5 = verifyNot checkWhileGetoptsCase "while getopts 'a:' x; do case $x in a) foo;; \\?) bar;; *) baz;; esac; done"
+checkWhileGetoptsCase = CommandCheck (Exactly "getopts") f
+  where
+    f :: Token -> Analysis
+    f t@(T_SimpleCommand _ _ (cmd:arg1:_))  = do
+        path <- getPathM t
+        potentially $ do
+            options <- getLiteralString arg1
+            (T_WhileExpression _ _ body) <- findFirst whileLoop path
+            caseCmd <- mapMaybe findCase body !!! 0
+            return $ check (getId arg1) (map (:[]) $ filter (/= ':') options) caseCmd
+    f _ = return ()
+
+    check :: Id -> [String] -> Token -> Analysis
+    check optId opts (T_CaseExpression id _ list) = do
+            unless (Nothing `Map.member` handledMap) $ do
+                mapM_ (warnUnhandled optId id) $ catMaybes $ Map.keys notHandled
+
+                unless (any (`Map.member` handledMap) [Just "*",Just "?"]) $
+                    warn id 2220 "Invalid flags are not handled. Add a *) case."
+
+            mapM_ warnRedundant $ Map.toList notRequested
+
+        where
+            handledMap = Map.fromList (concatMap getHandledStrings list)
+            requestedMap = Map.fromList $ map (\x -> (Just x, ())) opts
+
+            notHandled = Map.difference requestedMap handledMap
+            notRequested = Map.difference handledMap requestedMap
+
+    warnUnhandled optId caseId str =
+        warn caseId 2213 $ "getopts specified -" ++ str ++ ", but it's not handled by this 'case'."
+
+    warnRedundant (key, expr) = potentially $ do
+        str <- key
+        guard $ str `notElem` ["*", ":", "?"]
+        return $ warn (getId expr) 2214 "This case is not specified by getopts."
+
+    getHandledStrings (_, globs, _) =
+        map (\x -> (literal x, x)) globs
+
+    literal :: Token -> Maybe String
+    literal t = do
+        getLiteralString t <> fromGlob t
+
+    fromGlob t =
+        case t of
+            T_Glob _ ('[':c:']':[]) -> return [c]
+            T_Glob _ "*" -> return "*"
+            T_Glob _ "?" -> return "?"
+            _ -> Nothing
+
+    whileLoop t =
+        case t of
+            T_WhileExpression {} -> return True
+            T_Script {} -> return False
+            _ -> Nothing
+
+    findCase t =
+        case t of
+            T_Annotation _ _ x -> findCase x
+            T_Pipeline _ _ [x] -> findCase x
+            T_Redirecting _ _ x@(T_CaseExpression {}) -> return x
+            _ -> Nothing
+
+prop_checkCatastrophicRm1 = verify checkCatastrophicRm "rm -r $1/$2"
+prop_checkCatastrophicRm2 = verify checkCatastrophicRm "rm -r /home/$foo"
+prop_checkCatastrophicRm3 = verifyNot checkCatastrophicRm "rm -r /home/${USER:?}/*"
+prop_checkCatastrophicRm4 = verify checkCatastrophicRm "rm -fr /home/$(whoami)/*"
+prop_checkCatastrophicRm5 = verifyNot checkCatastrophicRm "rm -r /home/${USER:-thing}/*"
+prop_checkCatastrophicRm6 = verify checkCatastrophicRm "rm --recursive /etc/*$config*"
+prop_checkCatastrophicRm8 = verify checkCatastrophicRm "rm -rf /home"
+prop_checkCatastrophicRm10= verifyNot checkCatastrophicRm "rm -r \"${DIR}\"/{.gitignore,.gitattributes,ci}"
+prop_checkCatastrophicRm11= verify checkCatastrophicRm "rm -r /{bin,sbin}/$exec"
+prop_checkCatastrophicRm12= verify checkCatastrophicRm "rm -r /{{usr,},{bin,sbin}}/$exec"
+prop_checkCatastrophicRm13= verifyNot checkCatastrophicRm "rm -r /{{a,b},{c,d}}/$exec"
+prop_checkCatastrophicRmA = verify checkCatastrophicRm "rm -rf /usr /lib/nvidia-current/xorg/xorg"
+prop_checkCatastrophicRmB = verify checkCatastrophicRm "rm -rf \"$STEAMROOT/\"*"
+checkCatastrophicRm = CommandCheck (Basename "rm") $ \t ->
+    when (isRecursive t) $
+        mapM_ (mapM_ checkWord . braceExpand) $ arguments t
+  where
+    isRecursive = any (`elem` ["r", "R", "recursive"]) . map snd . getAllFlags
+
+    checkWord token =
+        case getLiteralString token of
+            Just str ->
+                when (fixPath str `elem` importantPaths) $
+                    warn (getId token) 2114 "Warning: deletes a system directory."
+            Nothing ->
+                checkWord' token
+
+    checkWord' token = fromMaybe (return ()) $ do
+        filename <- getPotentialPath token
+        let path = fixPath filename
+        return . when (path `elem` importantPaths) $
+            warn (getId token) 2115 $ "Use \"${var:?}\" to ensure this never expands to " ++ path ++ " ."
+
+    fixPath filename =
+        let normalized = skipRepeating '/' . skipRepeating '*' $ filename in
+            if normalized == "/" then normalized else stripTrailing '/' normalized
+
+    getPotentialPath = getLiteralStringExt f
+      where
+        f (T_Glob _ str) = return str
+        f (T_DollarBraced _ word) =
+            let var = onlyLiteralString word in
+                -- This shouldn't handle non-colon cases.
+                if any (`isInfixOf` var) [":?", ":-", ":="]
+                then Nothing
+                else return ""
+        f _ = return ""
+
+    stripTrailing c = reverse . dropWhile (== c) . reverse
+    skipRepeating c (a:b:rest) | a == b && b == c = skipRepeating c (b:rest)
+    skipRepeating c (a:r) = a:skipRepeating c r
+    skipRepeating _ [] = []
+
+    paths = [
+        "", "/bin", "/etc", "/home", "/mnt", "/usr", "/usr/share", "/usr/local",
+        "/var", "/lib", "/dev", "/media", "/boot", "/lib64", "/usr/bin"
+        ]
+    importantPaths = filter (not . null) $
+        ["", "/", "/*", "/*/*"] >>= (\x -> map (++x) paths)
+
+
+prop_checkLetUsage1 = verify checkLetUsage "let a=1"
+prop_checkLetUsage2 = verifyNot checkLetUsage "(( a=1 ))"
+checkLetUsage = CommandCheck (Exactly "let") f
+  where
+    f t = whenShell [Bash,Ksh] $ do
+        style (getId t) 2219 $ "Instead of 'let expr', prefer (( expr )) ."
+
+
+missingDestination handler token = do
+    case params of
+        [single] -> do
+            unless (hasTarget || mayBecomeMultipleArgs single) $
+                handler token
+        _ -> return ()
+  where
+    args = getAllFlags token
+    params = map fst $ filter (\(_,x) -> x == "") args
+    hasTarget =
+        any (\x -> x /= "" && x `isPrefixOf` "target-directory") $
+            map snd args
+
+prop_checkMvArguments1 = verify    checkMvArguments "mv 'foo bar'"
+prop_checkMvArguments2 = verifyNot checkMvArguments "mv foo bar"
+prop_checkMvArguments3 = verifyNot checkMvArguments "mv 'foo bar'{,bak}"
+prop_checkMvArguments4 = verifyNot checkMvArguments "mv \"$@\""
+prop_checkMvArguments5 = verifyNot checkMvArguments "mv -t foo bar"
+prop_checkMvArguments6 = verifyNot checkMvArguments "mv --target-directory=foo bar"
+prop_checkMvArguments7 = verifyNot checkMvArguments "mv --target-direc=foo bar"
+prop_checkMvArguments8 = verifyNot checkMvArguments "mv --version"
+prop_checkMvArguments9 = verifyNot checkMvArguments "mv \"${!var}\""
+checkMvArguments = CommandCheck (Basename "mv") $ missingDestination f
+  where
+    f t = err (getId t) 2224 "This mv has no destination. Check the arguments."
+
+checkCpArguments = CommandCheck (Basename "cp") $ missingDestination f
+  where
+    f t = err (getId t) 2225 "This cp has no destination. Check the arguments."
+
+checkLnArguments = CommandCheck (Basename "ln") $ missingDestination f
+  where
+    f t = warn (getId t) 2226 "This ln has no destination. Check the arguments, or specify '.' explicitly."
+
+
+prop_checkFindRedirections1 = verify    checkFindRedirections "find . -exec echo {} > file \\;"
+prop_checkFindRedirections2 = verifyNot checkFindRedirections "find . -exec echo {} \\; > file"
+prop_checkFindRedirections3 = verifyNot checkFindRedirections "find . -execdir sh -c 'foo > file' \\;"
+checkFindRedirections = CommandCheck (Basename "find") f
+  where
+    f t = do
+        redirecting <- getClosestCommandM t
+        case redirecting of
+            Just (T_Redirecting _ redirs@(_:_) (T_SimpleCommand _ _ args@(_:_:_))) -> do
+                -- This assumes IDs are sequential, which is mostly but not always true.
+                let minRedir = minimum $ map getId redirs
+                let maxArg   = maximum $ map getId args
+                when (minRedir < maxArg) $
+                    warn minRedir 2227
+                        "Redirection applies to the find command itself. Rewrite to work per action (or move to end)."
+            _ -> return ()
+
+prop_checkWhich = verify checkWhich "which '.+'"
+checkWhich = CommandCheck (Basename "which") $
+    \t -> info (getId $ getCommandTokenOrThis t) 2230 "which is non-standard. Use builtin 'command -v' instead."
+
+prop_checkSudoRedirect1 = verify checkSudoRedirect "sudo echo 3 > /proc/file"
+prop_checkSudoRedirect2 = verify checkSudoRedirect "sudo cmd < input"
+prop_checkSudoRedirect3 = verify checkSudoRedirect "sudo cmd >> file"
+prop_checkSudoRedirect4 = verify checkSudoRedirect "sudo cmd &> file"
+prop_checkSudoRedirect5 = verifyNot checkSudoRedirect "sudo cmd 2>&1"
+prop_checkSudoRedirect6 = verifyNot checkSudoRedirect "sudo cmd 2> log"
+prop_checkSudoRedirect7 = verifyNot checkSudoRedirect "sudo cmd > /dev/null 2>&1"
+checkSudoRedirect = CommandCheck (Basename "sudo") f
+  where
+    f t = do
+        t_redir <- getClosestCommandM t
+        case t_redir of
+            Just (T_Redirecting _ redirs _) ->
+                mapM_ warnAbout redirs
+    warnAbout (T_FdRedirect _ s (T_IoFile id op file))
+        | (s == "" || s == "&") && not (special file) =
+        case op of
+            T_Less _ ->
+              info (getId op) 2024
+                "sudo doesn't affect redirects. Use sudo cat file | .."
+            T_Greater _ ->
+              warn (getId op) 2024
+                "sudo doesn't affect redirects. Use ..| sudo tee file"
+            T_DGREAT _ ->
+              warn (getId op) 2024
+                "sudo doesn't affect redirects. Use .. | sudo tee -a file"
+            _ -> return ()
+    warnAbout _ = return ()
+    special file = concat (oversimplify file) == "/dev/null"
+
+prop_checkSudoArgs1 = verify checkSudoArgs "sudo cd /root"
+prop_checkSudoArgs2 = verify checkSudoArgs "sudo export x=3"
+prop_checkSudoArgs3 = verifyNot checkSudoArgs "sudo ls /usr/local/protected"
+prop_checkSudoArgs4 = verifyNot checkSudoArgs "sudo ls && export x=3"
+prop_checkSudoArgs5 = verifyNot checkSudoArgs "sudo echo ls"
+prop_checkSudoArgs6 = verifyNot checkSudoArgs "sudo -n -u export ls"
+prop_checkSudoArgs7 = verifyNot checkSudoArgs "sudo docker export foo"
+checkSudoArgs = CommandCheck (Basename "sudo") f
+  where
+    f t = potentially $ do
+        opts <- parseOpts t
+        let nonFlags = map snd $ filter (\(flag, _) -> flag == "") opts
+        commandArg <- nonFlags !!! 0
+        command <- getLiteralString commandArg
+        guard $ command `elem` builtins
+        return $ warn (getId t) 2232 $ "Can't use sudo with builtins like " ++ command ++ ". Did you want sudo sh -c .. instead?"
+    builtins = [ "cd", "eval", "export", "history", "read", "source", "wait" ]
+    -- This mess is why ShellCheck prefers not to know.
+    parseOpts = getBsdOpts "vAknSbEHPa:g:h:p:u:c:T:r:"
 
 return []
 runTests =  $( [| $(forAllProperties) (quickCheckWithResult (stdArgs { maxSuccess = 1 }) ) |])

src/ShellCheck/Checks/ShellSupport.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2016 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,13 +15,11 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 {-# LANGUAGE TemplateHaskell #-}
 {-# LANGUAGE FlexibleContexts #-}
-module ShellCheck.Checks.ShellSupport (checker
-    , ShellCheck.Checks.ShellSupport.runTests
-) where
+module ShellCheck.Checks.ShellSupport (checker , ShellCheck.Checks.ShellSupport.runTests) where
 
 import ShellCheck.AST
 import ShellCheck.ASTLib
@@ -58,6 +56,7 @@ checks = [
     ,checkEchoSed
     ,checkBraceExpansionVars
     ,checkMultiDimensionalArrays
+    ,checkPS1Assignments
     ]
 
 testChecker (ForShell _ t) =
@@ -128,13 +127,15 @@ prop_checkBashisms44= verifyNot checkBashisms "#!/bin/dash\ntrap foo int"
 prop_checkBashisms45= verifyNot checkBashisms "#!/bin/dash\ntrap foo INT"
 prop_checkBashisms46= verify checkBashisms "#!/bin/dash\ntrap foo SIGINT"
 prop_checkBashisms47= verify checkBashisms "#!/bin/dash\necho foo 42>/dev/null"
-prop_checkBashisms48= verifyNot checkBashisms "#!/bin/dash\necho $LINENO"
+prop_checkBashisms48= verifyNot checkBashisms "#!/bin/sh\necho $LINENO"
 prop_checkBashisms49= verify checkBashisms "#!/bin/dash\necho $MACHTYPE"
 prop_checkBashisms50= verify checkBashisms "#!/bin/sh\ncmd >& file"
 prop_checkBashisms51= verifyNot checkBashisms "#!/bin/sh\ncmd 2>&1"
 prop_checkBashisms52= verifyNot checkBashisms "#!/bin/sh\ncmd >&2"
 prop_checkBashisms53= verifyNot checkBashisms "#!/bin/sh\nprintf -- -f\n"
 prop_checkBashisms54= verify checkBashisms "#!/bin/sh\nfoo+=bar"
+prop_checkBashisms55= verify checkBashisms "#!/bin/sh\necho ${@%foo}"
+prop_checkBashisms56= verifyNot checkBashisms "#!/bin/sh\necho ${##}"
 checkBashisms = ForShell [Sh, Dash] $ \t -> do
     params <- ask
     kludge params t
@@ -160,10 +161,15 @@ checkBashisms = ForShell [Sh, Dash] $ \t -> do
     bashism (T_Condition id DoubleBracket _) = warnMsg id "[[ ]] is"
     bashism (T_HereString id _) = warnMsg id "here-strings are"
     bashism (TC_Binary id SingleBracket op _ _)
-        | op `elem` [ "-nt", "-ef", "\\<", "\\>"] =
+        | op `elem` [ "<", ">", "\\<", "\\>", "<=", ">=", "\\<=", "\\>="] =
+            unless isDash $ warnMsg id $ "lexicographical " ++ op ++ " is"
+    bashism (TC_Binary id SingleBracket op _ _)
+        | op `elem` [ "-nt", "-ef" ] =
             unless isDash $ warnMsg id $ op ++ " is"
     bashism (TC_Binary id SingleBracket "==" _ _) =
             warnMsg id "== in place of = is"
+    bashism (TC_Binary id SingleBracket "=~" _ _) =
+            warnMsg id "=~ regex matching is"
     bashism (TC_Unary id _ "-a" _) =
             warnMsg id "unary -a in place of -e is"
     bashism (TA_Unary id op _)
@@ -185,11 +191,9 @@ checkBashisms = ForShell [Sh, Dash] $ \t -> do
     bashism (T_Glob id str) | "[^" `isInfixOf` str =
             warnMsg id "^ in place of ! in glob bracket expressions is"
 
-    bashism t@(TA_Expansion id _) | isBashism =
-        warnMsg id $ fromJust str ++ " is"
-      where
-        str = getLiteralString t
-        isBashism = isJust str && isBashVariable (fromJust str)
+    bashism t@(TA_Variable id str _) | isBashVariable str =
+        warnMsg id $ str ++ " is"
+
     bashism t@(T_DollarBraced id token) = do
         mapM_ check expansion
         when (isBashVariable var) $
@@ -273,14 +277,18 @@ checkBashisms = ForShell [Sh, Dash] $ \t -> do
             "let", "caller", "builtin", "complete", "compgen", "declare", "dirs", "disown",
             "enable", "mapfile", "readarray", "pushd", "popd", "shopt", "suspend",
             "typeset"
-            ] ++ if not isDash then ["local", "type"] else []
+            ] ++ if not isDash then ["local"] else []
         allowedFlags = Map.fromList [
-            ("read", if isDash then ["r", "p"] else ["r"]),
-            ("ulimit", ["f"]),
+            ("exec", []),
+            ("export", ["-p"]),
             ("printf", []),
-            ("exec", [])
+            ("read", if isDash then ["r", "p"] else ["r"]),
+            ("ulimit", ["f"])
             ]
-
+    bashism t@(T_SourceCommand id src _) =
+        let name = fromMaybe "" $ getCommandName src
+        in do
+            when (name == "source") $ warnMsg id "'source' in place of '.' is"
     bashism _ = return ()
 
     varChars="_0-9a-zA-Z"
@@ -289,15 +297,16 @@ checkBashisms = ForShell [Sh, Dash] $ \t -> do
         (re $ "^[" ++ varChars ++ "]+\\[.*\\]$", "array references are"),
         (re $ "^![" ++ varChars ++ "]+\\[[*@]]$", "array key expansion is"),
         (re $ "^![" ++ varChars ++ "]+[*@]$", "name matching prefixes are"),
-        (re $ "^[" ++ varChars ++ "]+:[^-=?+]", "string indexing is"),
-        (re $ "^[" ++ varChars ++ "]+(\\[.*\\])?/", "string replacement is")
+        (re $ "^[" ++ varChars ++ "*@]+:[^-=?+]", "string indexing is"),
+        (re $ "^([*@][%#]|#[@*])", "string operations on $@/$* are"),
+        (re $ "^[" ++ varChars ++ "*@]+(\\[.*\\])?/", "string replacement is")
         ]
     bashVars = [
-        "LINENO", "OSTYPE", "MACHTYPE", "HOSTTYPE", "HOSTNAME",
+        "OSTYPE", "MACHTYPE", "HOSTTYPE", "HOSTNAME",
         "DIRSTACK", "EUID", "UID", "SHLVL", "PIPESTATUS", "SHELLOPTS"
         ]
     bashDynamicVars = [ "RANDOM", "SECONDS" ]
-    dashVars = [ "LINENO" ]
+    dashVars = [ ]
     isBashVariable var =
         (var `elem` bashDynamicVars
             || var `elem` bashVars && not (isAssigned var))
@@ -383,6 +392,32 @@ checkMultiDimensionalArrays = ForShell [Bash] f
     re = mkRegex "^\\[.*\\]\\[.*\\]"  -- Fixme, this matches ${foo:- [][]} and such as well
     isMultiDim t = getBracedModifier (bracedString t) `matches` re
 
+prop_checkPS11 = verify checkPS1Assignments "PS1='\\033[1;35m\\$ '"
+prop_checkPS11a= verify checkPS1Assignments "export PS1='\\033[1;35m\\$ '"
+prop_checkPSf2 = verify checkPS1Assignments "PS1='\\h \\e[0m\\$ '"
+prop_checkPS13 = verify checkPS1Assignments "PS1=$'\\x1b[c '"
+prop_checkPS14 = verify checkPS1Assignments "PS1=$'\\e[3m; '"
+prop_checkPS14a= verify checkPS1Assignments "export PS1=$'\\e[3m; '"
+prop_checkPS15 = verifyNot checkPS1Assignments "PS1='\\[\\033[1;35m\\]\\$ '"
+prop_checkPS16 = verifyNot checkPS1Assignments "PS1='\\[\\e1m\\e[1m\\]\\$ '"
+prop_checkPS17 = verifyNot checkPS1Assignments "PS1='e033x1B'"
+prop_checkPS18 = verifyNot checkPS1Assignments "PS1='\\[\\e\\]'"
+checkPS1Assignments = ForShell [Bash] f
+  where
+    f token = case token of
+        (T_Assignment _ _ "PS1" _ word) -> warnFor word
+        _ -> return ()
+
+    warnFor word =
+        let contents = concat $ oversimplify word in
+            when (containsUnescaped contents) $
+                info (getId word) 2025 "Make sure all escape sequences are enclosed in \\[..\\] to prevent line wrapping issues"
+    containsUnescaped s =
+        let unenclosed = subRegex enclosedRegex s "" in
+           isJust $ matchRegex escapeRegex unenclosed
+    enclosedRegex = mkRegex "\\\\\\[.*\\\\\\]" -- FIXME: shouldn't be eager
+    escapeRegex = mkRegex "\\\\x1[Bb]|\\\\e|\x1B|\\\\033"
+
 
 return []
 runTests =  $( [| $(forAllProperties) (quickCheckWithResult (stdArgs { maxSuccess = 1 }) ) |])

src/ShellCheck/Data.hs

@@ -39,7 +39,7 @@ internalVariables = [
   ]
 
 variablesWithoutSpaces = [
-    "$", "-", "?", "!",
+    "$", "-", "?", "!", "#",
     "BASHPID", "BASH_ARGC", "BASH_LINENO", "BASH_SUBSHELL", "EUID", "LINENO",
     "OPTIND", "PPID", "RANDOM", "SECONDS", "SHELLOPTS", "SHLVL", "UID",
     "COLUMNS", "HISTFILESIZE", "HISTSIZE", "LINES"
@@ -77,6 +77,14 @@ commonCommands = [
     "zcat"
   ]
 
+nonReadingCommands = [
+    "alias", "basename", "bg", "cal", "cd", "chgrp", "chmod", "chown",
+    "cp", "du", "echo", "export", "false", "fg", "fuser", "getconf",
+    "getopt", "getopts", "ipcrm", "ipcs", "jobs", "kill", "ln", "ls",
+    "locale", "mv", "printf", "ps", "pwd", "renice", "rm", "rmdir",
+    "set", "sleep", "touch", "trap", "true", "ulimit", "unalias", "uname"
+    ]
+
 sampleWords = [
     "alpha", "bravo", "charlie", "delta", "echo", "foxtrot",
     "golf", "hotel", "india", "juliett", "kilo", "lima", "mike",

src/ShellCheck/Formatter/CheckStyle.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 module ShellCheck.Formatter.CheckStyle (format) where
 
@@ -34,14 +34,27 @@ format = return Formatter {
         putStrLn "<checkstyle version='4.3'>",
 
     onFailure = outputError,
-    onResult = outputResult,
+    onResult = outputResults,
 
     footer = putStrLn "</checkstyle>"
 }
 
-outputResult result contents = do
-    let comments = makeNonVirtual (crComments result) contents
-    putStrLn . formatFile (crFilename result) $ comments
+outputResults cr sys =
+    if null comments
+    then outputFile (crFilename cr) "" []
+    else mapM_ outputGroup fileGroups
+  where
+    comments = crComments cr
+    fileGroups = groupWith sourceFile comments
+    outputGroup group = do
+        let filename = sourceFile (head group)
+        result <- (siReadFile sys) filename
+        let contents = either (const "") id result
+        outputFile filename contents group
+
+outputFile filename contents warnings = do
+    let comments = makeNonVirtual warnings contents
+    putStrLn . formatFile filename $ comments
 
 formatFile name comments = concat [
     "<file ", attr "name" name, ">\n",

src/ShellCheck/Formatter/Format.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 module ShellCheck.Formatter.Format where
 
@@ -25,21 +25,22 @@ import ShellCheck.Interface
 -- A formatter that carries along an arbitrary piece of data
 data Formatter = Formatter {
     header ::  IO (),
-    onResult :: CheckResult -> String -> IO (),
+    onResult :: CheckResult -> SystemInterface IO -> IO (),
     onFailure :: FilePath -> ErrorMessage -> IO (),
     footer :: IO ()
 }
 
-lineNo (PositionedComment pos _ _) = posLine pos
-endLineNo (PositionedComment _ end _) = posLine end
-colNo  (PositionedComment pos _ _) = posColumn pos
-endColNo  (PositionedComment _ end _) = posColumn end
-codeNo (PositionedComment _ _ (Comment _ code _)) = code
-messageText (PositionedComment _ _ (Comment _ _ t)) = t
+sourceFile = posFile . pcStartPos
+lineNo = posLine . pcStartPos
+endLineNo = posLine . pcEndPos
+colNo  = posColumn . pcStartPos
+endColNo = posColumn . pcEndPos
+codeNo = cCode . pcComment
+messageText = cMessage . pcComment
 
 severityText :: PositionedComment -> String
-severityText (PositionedComment _ _ (Comment c _ _)) =
-    case c of
+severityText pc =
+    case cSeverity (pcComment pc) of
         ErrorC   -> "error"
         WarningC -> "warning"
         InfoC    -> "info"
@@ -50,11 +51,14 @@ makeNonVirtual comments contents =
     map fix comments
   where
     ls = lines contents
-    fix c@(PositionedComment start end comment) = PositionedComment start {
-        posColumn = realignColumn lineNo colNo c
-    } end {
-        posColumn = realignColumn endLineNo endColNo c
-    } comment
+    fix c = c {
+        pcStartPos = (pcStartPos c) {
+            posColumn = realignColumn lineNo colNo c
+        }
+      , pcEndPos = (pcEndPos c) {
+            posColumn = realignColumn endLineNo endColNo c
+        }
+    }
     realignColumn lineNo colNo c =
       if lineNo c > 0 && lineNo c <= fromIntegral (length ls)
       then real (ls !! fromIntegral (lineNo c - 1)) 0 0 (colNo c)

src/ShellCheck/Formatter/GCC.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 module ShellCheck.Formatter.GCC (format) where
 
@@ -31,14 +31,25 @@ format = return Formatter {
     header = return (),
     footer = return (),
     onFailure = outputError,
-    onResult = outputResult
+    onResult = outputAll
 }
 
 outputError file error = hPutStrLn stderr $ file ++ ": " ++ error
 
-outputResult result contents = do
-    let comments = makeNonVirtual (crComments result) contents
-    mapM_ (putStrLn . formatComment (crFilename result)) comments
+outputAll cr sys = mapM_ f groups
+  where
+    comments = crComments cr
+    groups = groupWith sourceFile comments
+    f :: [PositionedComment] -> IO ()
+    f group = do
+        let filename = sourceFile (head group)
+        result <- (siReadFile sys) filename
+        let contents = either (const "") id result
+        outputResult filename contents group
+
+outputResult filename contents warnings = do
+    let comments = makeNonVirtual warnings contents
+    mapM_ (putStrLn . formatComment filename) comments
 
 formatComment filename c = concat [
     filename, ":",

src/ShellCheck/Formatter/JSON.hs

@@ -0,0 +1,99 @@
+{-# LANGUAGE OverloadedStrings #-}
+{-
+    Copyright 2012-2015 Vidar Holen
+
+    This file is part of ShellCheck.
+    https://www.shellcheck.net
+
+    ShellCheck is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    ShellCheck is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-}
+module ShellCheck.Formatter.JSON (format) where
+
+import ShellCheck.Interface
+import ShellCheck.Formatter.Format
+
+import Data.Aeson
+import Data.IORef
+import Data.Monoid
+import GHC.Exts
+import System.IO
+import qualified Data.ByteString.Lazy.Char8 as BL
+
+format = do
+    ref <- newIORef []
+    return Formatter {
+        header = return (),
+        onResult = collectResult ref,
+        onFailure = outputError,
+        footer = finish ref
+    }
+
+instance ToJSON Replacement where
+    toJSON replacement =
+        let start = repStartPos replacement
+            end = repEndPos replacement
+            str = repString replacement in
+        object [
+          "line" .= posLine start,
+          "endLine" .= posLine end,
+          "column" .= posColumn start,
+          "endColumn" .= posColumn end,
+          "replaceWith" .= str
+        ]
+
+instance ToJSON PositionedComment where
+  toJSON comment =
+    let start = pcStartPos comment
+        end = pcEndPos comment
+        c = pcComment comment in
+    object [
+      "file" .= posFile start,
+      "line" .= posLine start,
+      "endLine" .= posLine end,
+      "column" .= posColumn start,
+      "endColumn" .= posColumn end,
+      "level" .= severityText comment,
+      "code" .= cCode c,
+      "message" .= cMessage c,
+      "fix" .= pcFix comment
+    ]
+
+  toEncoding comment =
+    let start = pcStartPos comment
+        end = pcEndPos comment
+        c = pcComment comment in
+    pairs (
+         "file" .= posFile start
+      <> "line" .= posLine start
+      <> "endLine" .= posLine end
+      <> "column" .= posColumn start
+      <> "endColumn" .= posColumn end
+      <> "level" .= severityText comment
+      <> "code" .= cCode c
+      <> "message" .= cMessage c
+      <> "fix" .= pcFix comment
+    )
+
+instance ToJSON Fix where
+    toJSON fix = object [
+        "replacements" .= fixReplacements fix
+        ]
+
+outputError file msg = hPutStrLn stderr $ file ++ ": " ++ msg
+collectResult ref result _ =
+    modifyIORef ref (\x -> crComments result ++ x)
+
+finish ref = do
+    list <- readIORef ref
+    BL.putStrLn $ encode list

src/ShellCheck/Formatter/TTY.hs

@@ -0,0 +1,214 @@
+{-
+    Copyright 2012-2015 Vidar Holen
+
+    This file is part of ShellCheck.
+    https://www.shellcheck.net
+
+    ShellCheck is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    ShellCheck is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-}
+module ShellCheck.Formatter.TTY (format) where
+
+import ShellCheck.Interface
+import ShellCheck.Formatter.Format
+
+import Control.Monad
+import Data.IORef
+import Data.List
+import Data.Maybe
+import GHC.Exts
+import System.IO
+import System.Info
+
+wikiLink = "https://www.shellcheck.net/wiki/"
+
+-- An arbitrary Ord thing to order warnings
+type Ranking = (Char, Severity, Integer)
+
+format :: FormatterOptions -> IO Formatter
+format options = do
+    topErrorRef <- newIORef []
+    return Formatter {
+        header = return (),
+        footer = outputWiki topErrorRef,
+        onFailure = outputError options,
+        onResult = outputResult options topErrorRef
+    }
+
+colorForLevel level =
+    case level of
+        "error"   -> 31 -- red
+        "warning" -> 33 -- yellow
+        "info"    -> 32 -- green
+        "style"   -> 32 -- green
+        "message" -> 1 -- bold
+        "source"  -> 0 -- none
+        _ -> 0         -- none
+
+rankError :: PositionedComment -> Ranking
+rankError err = (ranking, cSeverity $ pcComment err, cCode $ pcComment err)
+  where
+    ranking =
+        if cCode (pcComment err) `elem` uninteresting
+        then 'Z'
+        else 'A'
+
+    -- A list of the most generic, least directly helpful
+    -- error codes to downrank.
+    uninteresting = [
+        1009, -- Mentioned parser error was..
+        1019, -- Expected this to be an argument
+        1036, -- ( is invalid here
+        1047, -- Expected 'fi'
+        1062, -- Expected 'done'
+        1070, -- Parsing stopped here (generic)
+        1072, -- Missing/unexpected ..
+        1073, -- Couldn't parse this ..
+        1088, -- Parsing stopped here (paren)
+        1089  -- Parsing stopped here (keyword)
+        ]
+
+appendComments errRef comments max = do
+    previous <- readIORef errRef
+    let current = map (\x -> (rankError x, cCode $ pcComment x, cMessage $ pcComment x)) comments
+    writeIORef errRef . take max . nubBy equal . sort $ previous ++ current
+  where
+    fst3 (x,_,_) = x
+    equal x y = fst3 x == fst3 y
+
+outputWiki :: IORef [(Ranking, Integer, String)] -> IO ()
+outputWiki errRef = do
+    issues <- readIORef errRef
+    unless (null issues) $ do
+        putStrLn "For more information:"
+        mapM_ showErr issues
+  where
+    showErr (_, code, msg) =
+        putStrLn $ "  " ++ wikiLink ++ "SC" ++ show code ++ " -- " ++ shorten msg
+    limit = 40
+    shorten msg =
+        if length msg < limit
+        then msg
+        else (take (limit-3) msg) ++ "..."
+
+outputError options file error = do
+    color <- getColorFunc $ foColorOption options
+    hPutStrLn stderr $ color "error" $ file ++ ": " ++ error
+
+outputResult options ref result sys = do
+    color <- getColorFunc $ foColorOption options
+    let comments = crComments result
+    appendComments ref comments (fromIntegral $ foWikiLinkCount options)
+    let fileGroups = groupWith sourceFile comments
+    mapM_ (outputForFile color sys) fileGroups
+
+outputForFile color sys comments = do
+    let fileName = sourceFile (head comments)
+    result <- (siReadFile sys) fileName
+    let contents = either (const "") id result
+    let fileLines = lines contents
+    let lineCount = fromIntegral $ length fileLines
+    let groups = groupWith lineNo comments
+    mapM_ (\commentsForLine -> do
+        let lineNum = lineNo (head commentsForLine)
+        let line = if lineNum < 1 || lineNum > lineCount
+                        then ""
+                        else fileLines !! fromIntegral (lineNum - 1)
+        putStrLn ""
+        putStrLn $ color "message" $
+           "In " ++ fileName ++" line " ++ show lineNum ++ ":"
+        putStrLn (color "source" line)
+        mapM_ (\c -> putStrLn (color (severityText c) $ cuteIndent c)) commentsForLine
+        putStrLn ""
+        -- FIXME: Enable when reasonably stable
+        -- showFixedString color comments lineNum line
+      ) groups
+
+hasApplicableFix lineNum comment = fromMaybe False $ do
+    replacements <- fixReplacements <$> pcFix comment
+    guard $ all (\c -> onSameLine (repStartPos c) && onSameLine (repEndPos c)) replacements
+    return True
+  where
+    onSameLine pos = posLine pos == lineNum
+
+-- FIXME: Work correctly with multiple replacements
+showFixedString color comments lineNum line =
+    case filter (hasApplicableFix lineNum) comments of
+        (first:_) -> do
+            -- in the spirit of error prone
+            putStrLn $ color "message" "Did you mean: "
+            putStrLn $ fixedString first line
+            putStrLn ""
+        _ -> return ()
+
+-- need to do something smart about sorting by end index
+fixedString :: PositionedComment -> String -> String
+fixedString comment line =
+    case (pcFix comment) of
+    Nothing -> ""
+    Just rs ->
+        applyReplacement (fixReplacements rs) line 0
+        where
+            applyReplacement [] s _ = s
+            applyReplacement (rep:xs) s offset =
+                let replacementString = repString rep
+                    start = (posColumn . repStartPos) rep
+                    end = (posColumn . repEndPos) rep
+                    z = doReplace start end s replacementString
+                    len_r = (fromIntegral . length) replacementString in
+                applyReplacement xs z (offset + (end - start) + len_r)
+
+-- FIXME: Work correctly with tabs
+-- start and end comes from pos, which is 1 based
+-- doReplace 0 0 "1234" "A" -> "A1234" -- technically not valid
+-- doReplace 1 1 "1234" "A" -> "A1234"
+-- doReplace 1 2 "1234" "A" -> "A234"
+-- doReplace 3 3 "1234" "A" -> "12A34"
+-- doReplace 4 4 "1234" "A" -> "123A4"
+-- doReplace 5 5 "1234" "A" -> "1234A"
+doReplace start end o r =
+    let si = fromIntegral (start-1)
+        ei = fromIntegral (end-1)
+        (x, xs) = splitAt si o
+        (y, z) = splitAt (ei - si) xs
+    in
+    x ++ r ++ z
+
+cuteIndent :: PositionedComment -> String
+cuteIndent comment =
+    replicate (fromIntegral $ colNo comment - 1) ' ' ++
+        makeArrow ++ " " ++ code (codeNo comment) ++ ": " ++ messageText comment
+  where
+    arrow n = '^' : replicate (fromIntegral $ n-2) '-' ++ "^"
+    makeArrow =
+        let sameLine = lineNo comment == endLineNo comment
+            delta = endColNo comment - colNo comment
+        in
+            if sameLine && delta > 2 && delta < 32 then arrow delta else "^--"
+
+code num = "SC" ++ show num
+
+getColorFunc colorOption = do
+    term <- hIsTerminalDevice stdout
+    let windows = "mingw" `isPrefixOf` os
+    let isUsableTty = term && not windows
+    let useColor = case colorOption of
+                       ColorAlways -> True
+                       ColorNever -> False
+                       ColorAuto -> isUsableTty
+    return $ if useColor then colorComment else const id
+  where
+    colorComment level comment =
+        ansi (colorForLevel level) ++ comment ++ clear
+    clear = ansi 0
+    ansi n = "\x1B[" ++ show n ++ "m"

src/ShellCheck/Interface.hs

@@ -0,0 +1,269 @@
+{-
+    Copyright 2012-2015 Vidar Holen
+
+    This file is part of ShellCheck.
+    https://www.shellcheck.net
+
+    ShellCheck is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    ShellCheck is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+-}
+{-# LANGUAGE DeriveGeneric, DeriveAnyClass #-}
+module ShellCheck.Interface
+    (
+    SystemInterface(..)
+    , CheckSpec(csFilename, csScript, csCheckSourced, csExcludedWarnings, csShellTypeOverride, csMinSeverity)
+    , CheckResult(crFilename, crComments)
+    , ParseSpec(psFilename, psScript, psCheckSourced, psShellTypeOverride)
+    , ParseResult(prComments, prTokenPositions, prRoot)
+    , AnalysisSpec(asScript, asShellType, asExecutionMode, asCheckSourced, asTokenPositions)
+    , AnalysisResult(arComments)
+    , FormatterOptions(foColorOption, foWikiLinkCount)
+    , Shell(Ksh, Sh, Bash, Dash)
+    , ExecutionMode(Executed, Sourced)
+    , ErrorMessage
+    , Code
+    , Severity(ErrorC, WarningC, InfoC, StyleC)
+    , Position(posFile, posLine, posColumn)
+    , Comment(cSeverity, cCode, cMessage)
+    , PositionedComment(pcStartPos , pcEndPos , pcComment, pcFix)
+    , ColorOption(ColorAuto, ColorAlways, ColorNever)
+    , TokenComment(tcId, tcComment, tcFix)
+    , emptyCheckResult
+    , newParseResult
+    , newAnalysisSpec
+    , newAnalysisResult
+    , newFormatterOptions
+    , newPosition
+    , newTokenComment
+    , mockedSystemInterface
+    , newParseSpec
+    , emptyCheckSpec
+    , newPositionedComment
+    , newComment
+    , Fix(fixReplacements)
+    , newFix
+    , Replacement(repStartPos, repEndPos, repString)
+    , newReplacement
+    ) where
+
+import ShellCheck.AST
+
+import Control.DeepSeq
+import Control.Monad.Identity
+import Data.Monoid
+import GHC.Generics (Generic)
+import qualified Data.Map as Map
+
+
+newtype SystemInterface m = SystemInterface {
+    -- Read a file by filename, or return an error
+    siReadFile :: String -> m (Either ErrorMessage String)
+}
+
+-- ShellCheck input and output
+data CheckSpec = CheckSpec {
+    csFilename :: String,
+    csScript :: String,
+    csCheckSourced :: Bool,
+    csExcludedWarnings :: [Integer],
+    csShellTypeOverride :: Maybe Shell,
+    csMinSeverity :: Severity
+} deriving (Show, Eq)
+
+data CheckResult = CheckResult {
+    crFilename :: String,
+    crComments :: [PositionedComment]
+} deriving (Show, Eq)
+
+emptyCheckResult :: CheckResult
+emptyCheckResult = CheckResult {
+    crFilename = "",
+    crComments = []
+}
+
+emptyCheckSpec :: CheckSpec
+emptyCheckSpec = CheckSpec {
+    csFilename = "",
+    csScript = "",
+    csCheckSourced = False,
+    csExcludedWarnings = [],
+    csShellTypeOverride = Nothing,
+    csMinSeverity = StyleC
+}
+
+newParseSpec :: ParseSpec
+newParseSpec = ParseSpec {
+    psFilename = "",
+    psScript = "",
+    psCheckSourced = False,
+    psShellTypeOverride = Nothing
+}
+
+-- Parser input and output
+data ParseSpec = ParseSpec {
+    psFilename :: String,
+    psScript :: String,
+    psCheckSourced :: Bool,
+    psShellTypeOverride :: Maybe Shell
+} deriving (Show, Eq)
+
+data ParseResult = ParseResult {
+    prComments :: [PositionedComment],
+    prTokenPositions :: Map.Map Id (Position, Position),
+    prRoot :: Maybe Token
+} deriving (Show, Eq)
+
+newParseResult :: ParseResult
+newParseResult = ParseResult {
+    prComments = [],
+    prTokenPositions = Map.empty,
+    prRoot = Nothing
+}
+
+-- Analyzer input and output
+data AnalysisSpec = AnalysisSpec {
+    asScript :: Token,
+    asShellType :: Maybe Shell,
+    asExecutionMode :: ExecutionMode,
+    asCheckSourced :: Bool,
+    asTokenPositions :: Map.Map Id (Position, Position)
+}
+
+newAnalysisSpec token = AnalysisSpec {
+    asScript = token,
+    asShellType = Nothing,
+    asExecutionMode = Executed,
+    asCheckSourced = False,
+    asTokenPositions = Map.empty
+}
+
+newtype AnalysisResult = AnalysisResult {
+    arComments :: [TokenComment]
+}
+
+newAnalysisResult = AnalysisResult {
+    arComments = []
+}
+
+-- Formatter options
+data FormatterOptions = FormatterOptions {
+    foColorOption :: ColorOption,
+    foWikiLinkCount :: Integer
+}
+
+newFormatterOptions = FormatterOptions {
+    foColorOption = ColorAuto,
+    foWikiLinkCount = 3
+}
+
+
+-- Supporting data types
+data Shell = Ksh | Sh | Bash | Dash deriving (Show, Eq)
+data ExecutionMode = Executed | Sourced deriving (Show, Eq)
+
+type ErrorMessage = String
+type Code = Integer
+
+data Severity = ErrorC | WarningC | InfoC | StyleC
+    deriving (Show, Eq, Ord, Generic, NFData)
+data Position = Position {
+    posFile :: String,    -- Filename
+    posLine :: Integer,   -- 1 based source line
+    posColumn :: Integer  -- 1 based source column, where tabs are 8
+} deriving (Show, Eq, Generic, NFData)
+
+newPosition :: Position
+newPosition = Position {
+    posFile   = "",
+    posLine   = 1,
+    posColumn = 1
+}
+
+data Comment = Comment {
+    cSeverity :: Severity,
+    cCode     :: Code,
+    cMessage  :: String
+} deriving (Show, Eq, Generic, NFData)
+
+newComment :: Comment
+newComment = Comment {
+    cSeverity = StyleC,
+    cCode     = 0,
+    cMessage  = ""
+}
+
+-- only support single line for now
+data Replacement = Replacement {
+    repStartPos :: Position,
+    repEndPos :: Position,
+    repString :: String
+} deriving (Show, Eq, Generic, NFData)
+
+newReplacement = Replacement {
+    repStartPos = newPosition,
+    repEndPos = newPosition,
+    repString = ""
+}
+
+data Fix = Fix {
+    fixReplacements :: [Replacement]
+} deriving (Show, Eq, Generic, NFData)
+
+newFix = Fix {
+    fixReplacements = []
+}
+
+data PositionedComment = PositionedComment {
+    pcStartPos :: Position,
+    pcEndPos   :: Position,
+    pcComment  :: Comment,
+    pcFix      :: Maybe Fix
+} deriving (Show, Eq, Generic, NFData)
+
+newPositionedComment :: PositionedComment
+newPositionedComment = PositionedComment {
+    pcStartPos = newPosition,
+    pcEndPos   = newPosition,
+    pcComment  = newComment,
+    pcFix      = Nothing
+}
+
+data TokenComment = TokenComment {
+    tcId :: Id,
+    tcComment :: Comment,
+    tcFix :: Maybe Fix
+} deriving (Show, Eq, Generic, NFData)
+
+newTokenComment = TokenComment {
+    tcId = Id 0,
+    tcComment = newComment,
+    tcFix = Nothing
+}
+
+data ColorOption =
+    ColorAuto
+    | ColorAlways
+    | ColorNever
+  deriving (Ord, Eq, Show)
+
+-- For testing
+mockedSystemInterface :: [(String, String)] -> SystemInterface Identity
+mockedSystemInterface files = SystemInterface {
+    siReadFile = rf
+}
+  where
+    rf file =
+        case filter ((== file) . fst) files of
+            [] -> return $ Left "File not included in mock."
+            [(_, contents)] -> return $ Right contents
+

src/ShellCheck/Regex.hs

@@ -2,7 +2,7 @@
     Copyright 2012-2015 Vidar Holen
 
     This file is part of ShellCheck.
-    http://www.vidarholen.net/contents/shellcheck
+    https://www.shellcheck.net
 
     ShellCheck is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -15,7 +15,7 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
 -}
 {-# LANGUAGE FlexibleContexts #-}
 

stack.yaml

@@ -1,8 +1,8 @@
 # This file was automatically generated by stack init
-# For more information, see: http://docs.haskellstack.org/en/stable/yaml_configuration/
+# For more information, see: https://docs.haskellstack.org/en/stable/yaml_configuration/
 
 # Specifies the GHC version and set of packages available (e.g., lts-3.5, nightly-2015-09-21, ghc-7.10.2)
-resolver: lts-5.5
+resolver: lts-8.5
 
 # Local packages, usually specified by relative directory name
 packages:

striptests

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# This file strips all unit tests from ShellCheck, removing
+# the dependency on QuickCheck and Template Haskell and
+# reduces the binary size considerably.
+set -o pipefail
+
+sponge() {
+  local data
+  data="$(cat)"
+  printf '%s\n' "$data" > "$1"
+}
+
+modify() {
+  if ! "${@:2}" < "$1" | sponge "$1"
+  then
+    {
+      printf 'Failed to modify %s: ' "$1"
+      printf '%q ' "${@:2}"
+      printf '\n'
+    } >&2
+    exit 1
+  fi
+}
+
+detestify() {
+  printf '%s\n' '-- AUTOGENERATED from ShellCheck by striptests. Do not modify.'
+  awk '
+    BEGIN {
+      state = 0;
+    }
+
+    /LANGUAGE TemplateHaskell/ { next; }
+    /^import.*Test\./ { next; }
+
+    /^module/ {
+      sub(/,[^,)]*runTests/, "");
+    }
+
+    # Delete tests
+    /^prop_/ { state = 1; next; }
+
+    # ..and any blank lines following them.
+    state == 1 && /^ / { next; }
+
+    # Template Haskell marker
+    /^return / {
+      exit;
+    }
+
+    { state = 0; print; }
+    '
+}
+
+
+
+if [[ ! -e 'ShellCheck.cabal' ]]
+then
+  echo "Run me from the ShellCheck directory." >&2
+  exit 1
+fi
+
+if [[ -d '.git' ]] && ! git diff --exit-code > /dev/null 2>&1
+then
+  echo "You have local changes! These may be overwritten." >&2
+  exit 2
+fi
+
+modify 'ShellCheck.cabal' sed -e '
+  /QuickCheck/d
+  /^test-suite/{ s/.*//; q; }
+  '
+
+find . -name '.git' -prune -o -type f -name '*.hs' -print |
+  while IFS= read -r file
+  do
+    modify "$file" detestify
+  done
+

test/buildtest

@@ -0,0 +1,35 @@
+#!/bin/bash
+# This script configures, builds and runs tests.
+# It's meant for automatic cross-distro testing.
+
+die() { echo "$*" >&2; exit 1; }
+
+[ -e "ShellCheck.cabal" ] ||
+  die "ShellCheck.cabal not in current dir"
+command -v cabal ||
+  die "cabal is missing"
+
+cabal update ||
+  die "can't update"
+cabal install --dependencies-only --enable-tests ||
+  die "can't install dependencies"
+cabal configure --enable-tests ||
+  die "configure failed"
+cabal build ||
+  die "build failed"
+cabal test ||
+  die "test failed"
+
+dist/build/shellcheck/shellcheck - << 'EOF' || die "execution failed"
+#!/bin/sh
+echo "Hello World"
+EOF
+
+dist/build/shellcheck/shellcheck - << 'EOF' && die "negative execution failed"
+#!/bin/sh
+echo $1
+EOF
+
+
+echo "Success"
+exit 0

test/distrotest

@@ -0,0 +1,75 @@
+#!/bin/bash
+# This script runs 'buildtest' on each of several distros
+# via Docker.
+set -o pipefail
+
+exec 3>&1 4>&2
+die() { echo "$*" >&4; exit 1; }
+
+[ -e "ShellCheck.cabal" ] || die "ShellCheck.cabal not in this dir"
+
+[ "$1" = "--run" ] || {
+cat << EOF
+This script pulls multiple distros via Docker and compiles
+ShellCheck and dependencies for each one. It takes hours,
+and is still highly experimental.
+
+Make sure you're plugged in and have screen/tmux in place,
+then re-run with $0 --run to continue.
+EOF
+exit 0
+}
+
+
+log=$(mktemp) || die "Can't create temp file"
+date >> "$log" || die "Can't write to log"
+
+echo "Logging to $log" >&3
+exec >> "$log" 2>&1
+
+final=0
+while read -r distro setup
+do
+  [[ "$distro" = "#"* || -z "$distro" ]] && continue
+  printf '%s ' "$distro" >&3
+  docker pull "$distro" || die "Can't pull $distro"
+  printf 'pulled. ' >&3
+
+  tmp=$(mktemp -d) || die "Can't make temp dir"
+  cp -r . "$tmp/" || die "Can't populate test dir"
+  printf 'Result: ' >&3
+  < /dev/null docker run -v "$tmp:/mnt" "$distro" sh -c "
+    $setup
+    cd /mnt || exit 1
+    test/buildtest
+    "
+  ret=$?
+  if [ "$ret" = 0 ]
+  then
+    echo "OK" >&3
+  else
+    echo "FAIL with $ret. See $log" >&3
+    final=1
+  fi
+  rm -rf "$tmp"
+done << EOF
+# Docker tag          Setup command
+debian:stable         apt-get update && apt-get install -y cabal-install
+debian:testing        apt-get update && apt-get install -y cabal-install
+ubuntu:latest         apt-get update && apt-get install -y cabal-install
+opensuse:latest       zypper install -y cabal-install ghc
+
+# Older Ubuntu versions we want to support
+ubuntu:18.04          apt-get update && apt-get install -y cabal-install
+ubuntu:17.10          apt-get update && apt-get install -y cabal-install
+
+# Misc
+haskell:latest        true
+
+# Known to currently fail
+centos:latest         yum install -y epel-release && yum install -y cabal-install
+fedora:latest         dnf install -y cabal-install
+base/archlinux:latest pacman -S -y --noconfirm cabal-install ghc-static base-devel
+EOF
+
+exit "$final"