Skip to content

Commit 6a5af1c

Browse files
j-kalij-kali
committed
Lint: Shellcheck
1 parent c1c045b commit 6a5af1c

File tree

4 files changed

+42
-37
lines changed

4 files changed

+42
-37
lines changed

‎client/container_preparation/entrypoint.sh

+16-16
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ docker_path="/var/run/docker.sock"
88

99
# Argument parser, arguments for both container preparation and key shipping should be handled here.
1010
parse_args() {
11-
while [[ "$#" -gt 0 ]]; do
11+
while [ "${#}" -gt 0 ]; do
1212
case "$1" in
1313
--config)
1414
config="$2"
@@ -69,7 +69,7 @@ parse_args() {
6969
done
7070

7171
# Check for required arguments
72-
if [ -z "$config" ] || [ -z "$base_oci_image" ] || [ -z "$sif_path" ] || [ -z "$data_path" ] || [ -z "$data_path_at_rest" ] || ([ -z "$users" ] && [ -z "$groups" ]) || [ -z "$compute_nodes" ]; then
72+
if [ -z "$config" ] || [ -z "$base_oci_image" ] || [ -z "$sif_path" ] || [ -z "$data_path" ] || [ -z "$data_path_at_rest" ] || { [ -z "$users" ] && [ -z "$groups" ]; } || [ -z "$compute_nodes" ]; then
7373
echo echo "Please provides options for both of these programs : "
7474
python3 ./prepare_container.py --help
7575
python3 ./utils/ship_a_key.py --help
@@ -79,7 +79,7 @@ parse_args() {
7979

8080
# Cleanup spire-agent generated files
8181
end_entrypoint() {
82-
if ! [ -n "$encrypted" ]; then
82+
if [ -z "$encrypted" ]; then
8383
echo "No encryption, nothing to clean"
8484
else
8585
echo "Cleaning everything before leaving ..."
@@ -100,21 +100,21 @@ NC='\033[0m' # No Color
100100
# Parse arguments from cli
101101
parse_args "$@"
102102

103-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Entering entrypoint"
103+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Entering entrypoint"
104104

105105
#
106106
## [RUN] Perform node attestation (spawn agent, register it's and it's workload's spiffeID)
107107
#
108108

109109
if [ -n "$encrypted" ]; then
110-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Encryption mode is on. Registering and running SPIRE Agent"
110+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Encryption mode is on. Registering and running SPIRE Agent"
111111

112-
python3 ./utils/spawn_agent.py --config $config >/dev/null 2>/dev/null &
112+
python3 ./utils/spawn_agent.py --config "$config" >/dev/null 2>/dev/null &
113113
spire_agent_pid=$!
114114

115115
fi
116116

117-
ps $spire_agent_pid >/dev/null || (
117+
ps "$spire_agent_pid" >/dev/null || (
118118
echo "spire agent died, aborting"
119119
end_entrypoint "$spire_agent_pid" 1
120120
)
@@ -123,7 +123,7 @@ ps $spire_agent_pid >/dev/null || (
123123
## [END] Perform node attestation
124124
#
125125

126-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Run container preparation"
126+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Run container preparation"
127127

128128
#
129129
## [RUN] Run container preparation (Preparation of new image, build of new image, build of Apptainer/Singularity image)
@@ -139,7 +139,7 @@ fi
139139
## [END] Run container preparation
140140
#
141141

142-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Container preparation ended"
142+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Container preparation ended"
143143

144144
#
145145
## [RUN] Ship private key to the vault (Creation of workload identity to give access to the key, writing key to the vault)
@@ -150,29 +150,29 @@ if [ -n "$encrypted" ]; then
150150
fi
151151

152152
if [ -z "$encrypted" ]; then
153-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Encryption mode is off, nothing to do"
153+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Encryption mode is off, nothing to do"
154154

155155
else
156-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Encryption mode is on, writing key to the vault, using spiffeID $spiffeID"
156+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Encryption mode is on, writing key to the vault, using spiffeID $spiffeID"
157157

158158
if [ -z "$users" ]; then
159159
# If the user provided only groups
160-
python3 ./utils/ship_a_key.py --config $config --username "$username" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
160+
python3 ./utils/ship_a_key.py --config "$config" --username "$username" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
161161
elif [ -z "$groups" ]; then
162162
# If the user provided only users
163-
python3 ./utils/ship_a_key.py --config $config --username "$username" -u "$users" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
163+
python3 ./utils/ship_a_key.py --config "$config" --username "$username" -u "$users" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
164164
else
165165
# If the user provided both
166-
python3 ./utils/ship_a_key.py --config $config --username "$username" -u "$users" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
166+
python3 ./utils/ship_a_key.py --config "$config" --username "$username" -u "$users" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
167167
fi
168168

169-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Key written to the vault"
169+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Key written to the vault"
170170
fi
171171

172172
#
173173
## [END] Ship private key to the vault
174174
#
175175

176-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Leaving entrypoint"
176+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Container preparation]${NC} Leaving entrypoint"
177177

178178
end_entrypoint "$spire_agent_pid" 0

‎client/container_preparation/input_logic/run.sh

+5-3
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,12 @@ PATH="$PATH:/sd-container/tools/input_logic/"
77
echo "[SD-Container][Input-Logic] : Getting data decryption key from vault"
88

99
# Get token via vault login. The data_login environment variable need to be exported from calling script
10-
data_token=$(curl -s --request POST --data "$data_login" $vault/v1/auth/jwt/login | jq '.auth.client_token' -r) || exit 1
10+
# shellcheck disable=SC2154 # data_login and vault are actually environment variables someone at some point decided to use lower case letters for <- TODO: fix this
11+
data_token=$(curl -s --request POST --data "$data_login" "$vault/v1/auth/jwt/login" | jq '.auth.client_token' -r) || exit 1
1112

1213
# Use the token to access the key. The data_path environment variable needs to be exported from calling script
13-
data_key=$(curl -s -H "X-Vault-Token: $data_token" $vault/v1/kv/data/${data_path} | jq '.data.data.key' -r) || exit 1
14+
# shellcheck disable=SC2154 # data_path and vault are actually environment variables someone at some point decided to use lower case letters for <- TODO: fix this
15+
data_key=$(curl -s -H "X-Vault-Token: $data_token" "$vault/v1/kv/data/${data_path}" | jq '.data.data.key' -r) || exit 1
1416

1517
# Write the key in an encrypted volume
1618
echo "$data_key" >/sd-container/encrypted/decryption_key
@@ -26,7 +28,7 @@ rm /sd-container/encrypted/decryption_key
2628
echo "[SD-Container][Input-Logic] : Data decrypted"
2729

2830
# Untar the not anymore encrypted archive
29-
cd /sd-container/encrypted
31+
cd /sd-container/encrypted || exit 1
3032
tar xvf /sd-container/encrypted/decrypted_data.tgz || exit 1
3133

3234
echo "[SD-Container][Input-Logic] : Data untared"

‎client/data_preparation/entrypoint.sh

+15-15
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
# Argument parser, arguments for both Data preparation and key shipping should be handled here.
77
parse_args() {
8-
while [[ "$#" -gt 0 ]]; do
8+
while [ "$#" -gt 0 ]; do
99
case "$1" in
1010
--config)
1111
config="$2"
@@ -58,7 +58,7 @@ parse_args() {
5858
done
5959

6060
# Check for required arguments
61-
if [ -z "$config" ] || [ -z "$input_data" ] || [ -z "$output_data" ] || [ -z "$data_path" ] || [ -z "$data_path_at_rest" ] || [ -z "$username" ] || ([ -z "$users" ] && [ -z "$groups" ]) || [ -z "$compute_nodes" ]; then
61+
if [ -z "$config" ] || [ -z "$input_data" ] || [ -z "$output_data" ] || [ -z "$data_path" ] || [ -z "$data_path_at_rest" ] || [ -z "$username" ] || { [ -z "$users" ] && [ -z "$groups" ]; } || [ -z "$compute_nodes" ]; then
6262
echo echo "Please provides options for both of these programs : "
6363
python3 ./prepare_data.py --help
6464
python3 ./utils/ship_a_key.py --help
@@ -86,21 +86,21 @@ NC='\033[0m' # No Color
8686
# Parse arguments from cli
8787
parse_args "$@"
8888

89-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Entering entrypoint"
89+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Entering entrypoint"
9090

9191
#
9292
## [RUN] Perform node attestation (spawn agent, register it's and it's workload's spiffeID)
9393
#
9494

95-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Registering and running SPIRE Agent"
95+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Registering and running SPIRE Agent"
9696

97-
python3 ./utils/spawn_agent.py --config $config >/dev/null 2>/dev/null &
97+
python3 ./utils/spawn_agent.py --config "$config" >/dev/null 2>/dev/null &
9898
spire_agent_pid=$!
9999

100100
until [ -e /tmp/agent.sock ]; do
101-
echo -e "${RED}[LUMI-SD][Data preparation] Spire workload api socket doesn't exist, waiting 10 seconds ${NC}"
101+
printf "%b\n" "${RED}[LUMI-SD][Data preparation] Spire workload api socket doesn't exist, waiting 10 seconds ${NC}"
102102
sleep 10
103-
if ! ps | grep $spire_agent_pid >/dev/null; then
103+
if pgrep -f "$spire_agent_pid" > /dev/null; then
104104
echo "spire agent died, aborting"
105105
end_entrypoint "$spire_agent_pid" 1
106106
fi
@@ -110,7 +110,7 @@ done
110110
## [END] Perform node attestation
111111
#
112112

113-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Run Data preparation"
113+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Run Data preparation"
114114

115115
#
116116
## [RUN] Run Data preparation (Encryption of input data)
@@ -122,34 +122,34 @@ python3 ./prepare_data.py -i "$input_data" -o "$output_data" || end_entrypoint "
122122
## [END] Run Data preparation
123123
#
124124

125-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Data preparation ended"
125+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Data preparation ended"
126126

127127
#
128128
## [RUN] Ship private key to the vault (Creation of workload identity to give access to the key, writing key to the vault)
129129
#
130130

131131
spiffeID=$(spire-agent api fetch --output json -socketPath /tmp/agent.sock | jq '.svids[0].spiffe_id' -r)
132132

133-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Writing key to the vault, using spiffeID $spiffeID"
133+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Writing key to the vault, using spiffeID $spiffeID"
134134

135135
# Handle different cases of user provided compute nodes / user / groups
136136
if [ -z "$users" ]; then
137137
# If the user provided only groups
138-
python3 ./utils/ship_a_key.py --config $config --username "$username" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
138+
python3 ./utils/ship_a_key.py --config "$config" --username "$username" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
139139
elif [ -z "$groups" ]; then
140140
# If the user provided only users
141-
python3 ./utils/ship_a_key.py --config $config --username "$username" -u "$users" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
141+
python3 ./utils/ship_a_key.py --config "$config" --username "$username" -u "$users" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
142142
else
143143
# If the user provided both
144-
python3 ./utils/ship_a_key.py --config $config --username "$username" -u "$users" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
144+
python3 ./utils/ship_a_key.py --config "$config" --username "$username" -u "$users" -g "$groups" -c "$compute_nodes" --data-path "$data_path" --data-path-at-rest "$data_path_at_rest" -i "$spiffeID" || end_entrypoint "$spire_agent_pid" 1
145145
fi
146146

147-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Key written to the vault"
147+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Key written to the vault"
148148

149149
#
150150
## [END] Ship private key to the vault
151151
#
152152

153-
echo -e "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Leaving entrypoint"
153+
printf "%b\n" "${YELLOW}[LUMI-SD]${NC}${BLUE}[Data preparation]${NC} Leaving entrypoint"
154154

155155
end_entrypoint "$spire_agent_pid" 0

‎server/entrypoint.sh

+6-3
Original file line numberDiff line numberDiff line change
@@ -21,11 +21,14 @@ rm -rf /tmp/data
2121
spire-agent run -config /tmp/agent.conf || end_entrypoint 0 1 &
2222
spire_agent_pid=$!
2323

24-
agent_socket_path=$(cat /tmp/agent.conf | grep "socket_path" | cut -d "=" -f2 | cut -d '"' -f1)
24+
agent_socket_path=$(grep "socket_path" /tmp/agent.conf | cut -d "=" -f2 | cut -d '"' -f1)
25+
26+
RED='\033[0;31m'
27+
NC='\033[0m'
2528

2629
sleep 10
27-
until [ -e $agent_socket_path ]; do
28-
echo -e "${RED}[LUMI-SD][Data preparation] Spire workload api socket doesn't exist, waiting 10 seconds ${NC}"
30+
until [ -e "${agent_socket_path}" ]; do
31+
printf "%b[LUMI-SD][Data preparation] Spire workload api socket doesn't exist, waiting 10 seconds %b" "${RED}" "${NC}\n"
2932
sleep 10
3033
done
3134

0 commit comments

Comments
 (0)