Add Shellcheck

This adds [Shellcheck](https://www.shellcheck.net) to:
- `make lint`
- Circle CI
- pre-commit config

All reported warnings are fixed.

Author: ulope

.circleci/conditional_skip.sh

@@ -6,12 +6,14 @@ set +e
 
 SKIP_TAG="\[skip tests\]"
 
-if [[ ! -z ${CIRCLE_TAG} ]]; then
+# shellcheck disable=SC2154
+if [[ -n ${CIRCLE_TAG} ]]; then
     # TAG build - never skip those
     echo "Tagged commit, not skipping build"
     exit 0
 fi
 
+# shellcheck disable=SC2154
 if [[ -z ${CIRCLE_PR_NUMBER} ]]; then
     # Not a PR, also never skip
     echo "Not a PR, not skipping build"
@@ -20,7 +22,7 @@ fi
 
 if [[ -a ~/.local/BASE_COMMIT ]]; then
     # The is a PR and we know the base commit (see fetch_pr_base_commit.sh)
-    LOG_RANGE="$(cat ~/.local/BASE_COMMIT)..${CIRCLE_SHA1}"
+    LOG_RANGE="$(cat ~/.local/BASE_COMMIT)..${CIRCLE_SHA1:?}"
 else
     # Otherwise just look at the HEAD commit
     LOG_RANGE="-1"

.circleci/config.yml

@@ -53,6 +53,9 @@ templates:
     SOLC_VERSION: 'v0.6.3'
 
 
+orbs:
+  shellcheck: circleci/[email protected]
+
 executors:
   docker:
     parameters:
@@ -696,6 +699,11 @@ workflows:
           requires:
             - prepare-system-linux
 
+      - shellcheck/check:
+          name: shellcheck
+          requires:
+            - prepare-system-linux
+
       - lint:
           name: lint-3.7
           py-version: "3.7"
@@ -789,6 +797,7 @@ workflows:
             - test-unit-3.7
             - test-fuzz-3.7
             - test-mocked-3.7
+            - shellcheck
 
       - test:
           name: test-integration-matrix-parity-3.7
@@ -807,6 +816,7 @@ workflows:
             - test-unit-3.7
             - test-fuzz-3.7
             - test-mocked-3.7
+            - shellcheck
 
       - finalize:
           requires:
@@ -928,6 +938,11 @@ workflows:
           requires:
           - prepare-system-linux
 
+      - shellcheck/check:
+          name: shellcheck
+          requires:
+            - prepare-system-linux
+
       - lint:
           name: lint-3.7
           py-version: "3.7"
@@ -1021,7 +1036,7 @@ workflows:
             - test-unit-3.7
             - test-fuzz-3.7
             - test-mocked-3.7
-
+            - shellcheck
 
       - test:
           name: test-integration-matrix-parity-3.7
@@ -1040,6 +1055,7 @@ workflows:
             - test-unit-3.7
             - test-fuzz-3.7
             - test-mocked-3.7
+            - shellcheck
 
       - finalize:
           requires:

.circleci/enforce_decreasing_lint_errors.sh

@@ -44,18 +44,18 @@ function compare_pylint_reports() {
         previous_error_count=$(wc -l "${old}" | cut '-d ' -f1)
 
         if [[ $new_error_count -gt $previous_error_count ]]; then
-            diff ${old} ${new}
+            diff "${old}" "${new}"
 
             # DO NOT overwrite the old report in the cache, we want to keep the
             # version with the lower number of errors
         else
             # This PR fixed errors, move the new report over the old one to enforce
             # a new lower bound on the number of errors
-            mv ${new} ${old}
+            mv "${new}" "${old}"
         fi
     else
         # Save the report to compare on subsequent runs
-        mv ${new} ${old}
+        mv "${new}" "${old}"
     fi
 }
 
@@ -74,17 +74,17 @@ function compare_mypy_reports() {
     fi
 
     if [[ -e "${old}" ]]; then
-        if ! ./.circleci/lint_report.py ${old} ${new}; then
+        if ! ./.circleci/lint_report.py "${old}" "${new}"; then
             # DO NOT overwrite the old report in the cache, we want to keep the
             # version with the lower number of errors
             #
             # If this PR fixed errors, move the new report over the old one to
             # enforce a new lower bound on the number of errors
-            mv ${new} ${old}
+            mv "${new}" "${old}"
         fi
     else
         # Save the report to compare on subsequent runs
-        mv ${new} ${old}
+        mv "${new}" "${old}"
     fi
 }
 
@@ -96,19 +96,20 @@ old_report_mypy="${CACHE_DIR}/mypy"
 new_report_pylint=$(mktemp)
 new_report_mypy=$(mktemp)
 
-if [[ ! -z ${CIRCLECI} ]]; then
+# shellcheck disable=SC2154
+if [[ -n ${CIRCLECI} ]]; then
     JOBS=8
 else
     JOBS=0
 fi
 
 pylint --jobs=${JOBS} \
     --load-plugins=tools.pylint.gevent_checker,tools.pylint.assert_checker \
-    raiden/ tools/scenario-player/ > ${new_report_pylint} || true
+    raiden/ tools/scenario-player/ > "${new_report_pylint}" || true
 
 mypy --config-file /dev/null --strict --disallow-subclassing-any \
     --disallow-any-expr --disallow-any-decorated --disallow-any-explicit \
-    --disallow-any-generics raiden tools > ${new_report_mypy} || true
+    --disallow-any-generics raiden tools > "${new_report_mypy}" || true
 
 exit_code=0
 

.circleci/fetch_geth_parity_solc.sh

@@ -3,6 +3,11 @@
 set -e
 set -x
 
+[[ -n ${OS_NAME:?} ]]
+[[ -n ${GETH_VERSION:?} ]]
+[[ -n ${PARITY_VERSION:?} ]]
+[[ -n ${SOLC_VERSION:?} ]]
+
 if [[ -z ${LOCAL_BASE} ]]; then
     LOCAL_BASE=~/.local
 fi
@@ -11,41 +16,41 @@ GETH_PATH="${LOCAL_BASE}/bin/geth-${OS_NAME}-${GETH_VERSION}"
 if [[ ! -x ${GETH_PATH} ]]; then
   mkdir -p ${LOCAL_BASE}/bin
   TEMP=$(mktemp -d 2>/dev/null || mktemp -d -t 'gethtmp')
-  pushd ${TEMP}
+  pushd "${TEMP}"
   GETH_URL_VAR="GETH_URL_${OS_NAME}"
-  curl -o geth.tar.gz ${!GETH_URL_VAR}
+  curl -o geth.tar.gz "${!GETH_URL_VAR}"
   tar xzf geth.tar.gz
   cd geth*/
-  install -m 755 geth ${GETH_PATH}
+  install -m 755 geth "${GETH_PATH}"
 
   GETH_MD5_VAR="GETH_MD5_${OS_NAME}"
-  if [[ ! -n ${!GETH_MD5_VAR} ]]; then
-      COMPUTED_MD5=$(md5sum ${GETH_PATH} | cut '-d ' -f1)
+  if [[ -z ${!GETH_MD5_VAR} ]]; then
+      COMPUTED_MD5=$(md5sum "${GETH_PATH}" | cut '-d ' -f1)
 
-      if [[ ${COMPUTED_MD5} != ${!GETH_MD5_VAR} ]]; then
+      if [[ ${COMPUTED_MD5} != "${!GETH_MD5_VAR}" ]]; then
           exit 1;
       fi
   fi
 fi
-ln -sfn ${GETH_PATH} ${LOCAL_BASE}/bin/geth
+ln -sfn "${GETH_PATH}" "${LOCAL_BASE}"/bin/geth
 
 PARITY_PATH="${LOCAL_BASE}/bin/parity-${OS_NAME}-${PARITY_VERSION}"
 if [[ ! -x ${PARITY_PATH} ]]; then
   mkdir -p ${LOCAL_BASE}/bin
   PARITY_URL_VAR="PARITY_URL_${OS_NAME}"
-  curl -L ${!PARITY_URL_VAR} > ${PARITY_PATH}
-  chmod 775 ${PARITY_PATH}
+  curl -L "${!PARITY_URL_VAR}" > "${PARITY_PATH}"
+  chmod 775 "${PARITY_PATH}"
 
   PARITY_SHA256_VAR="PARITY_SHA256_${OS_NAME}"
-  if [[ ! -n ${!PARITY_SHA256_VAR} ]]; then
-      COMPUTED_SHA256=$(sha256sum ${PARITY_PATH} | cut '-d ' -f1)
+  if [[ -z ${!PARITY_SHA256_VAR} ]]; then
+      COMPUTED_SHA256=$(sha256sum "${PARITY_PATH}" | cut '-d ' -f1)
 
-      if [[ ${COMPUTED_SHA256} != ${!PARITY_SHA256_VAR} ]]; then
+      if [[ ${COMPUTED_SHA256} != "${!PARITY_SHA256_VAR}" ]]; then
           exit 1;
       fi
   fi
 fi
-ln -sfn ${PARITY_PATH} ${LOCAL_BASE}/bin/parity
+ln -sfn "${PARITY_PATH}" "${LOCAL_BASE}"/bin/parity
 
 # Only deal with solc for Linux since it's only used for testing
 if [[ ${OS_NAME} != "LINUX" ]]; then
@@ -56,7 +61,7 @@ SOLC_PATH="${LOCAL_BASE}/bin/solc-${OS_NAME}-${SOLC_VERSION}"
 if [[ ! -x ${SOLC_PATH} ]]; then
   mkdir -p ${LOCAL_BASE}/bin
   SOLC_URL_VAR="SOLC_URL_${OS_NAME}"
-  curl -L ${!SOLC_URL_VAR} > ${SOLC_PATH}
-  chmod 775 ${SOLC_PATH}
+  curl -L "${!SOLC_URL_VAR}" > "${SOLC_PATH}"
+  chmod 775 "${SOLC_PATH}"
 fi
-ln -sfn ${SOLC_PATH} ${LOCAL_BASE}/bin/solc
+ln -sfn "${SOLC_PATH}" "${LOCAL_BASE}"/bin/solc

.circleci/fetch_pr_base_commit.sh

@@ -1,10 +1,11 @@
 #!/bin/bash
 
+# shellcheck disable=SC2154
 if [[ -n "${CIRCLE_PR_NUMBER}" ]]; then
     # If this is a PR get the base commit from the GitHub API
-    PR_DETAILS_URL="https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${CIRCLE_PR_NUMBER}"
-    BASE_COMMIT=$(curl ${PR_DETAILS_URL} | jq -r .base.sha)
+    PR_DETAILS_URL="https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME:?}/${CIRCLE_PROJECT_REPONAME:?}/pulls/${CIRCLE_PR_NUMBER}"
+    BASE_COMMIT=$(curl "${PR_DETAILS_URL}" | jq -r .base.sha)
     if [[ ${BASE_COMMIT} =~ ^[0-9a-zA-Z]{40}$ ]]; then
-        echo ${BASE_COMMIT} > ~/.local/BASE_COMMIT
+        echo "${BASE_COMMIT}" > ~/.local/BASE_COMMIT
     fi
 fi

.circleci/fetch_ssh_hostkey.sh

@@ -7,11 +7,11 @@ FINGERPRINT="$2"
 
 PUBKEY=$(mktemp)
 
-ssh-keyscan -H ${HOST} > ${PUBKEY} 2>/dev/null
+ssh-keyscan -H "${HOST}" > "${PUBKEY}" 2>/dev/null
 
-if [[ $(ssh-keygen -l -f ${PUBKEY} | cut -d ' ' -f 2) != ${FINGERPRINT} ]]; then
+if [[ $(ssh-keygen -l -f "${PUBKEY}" | cut -d ' ' -f 2) != "${FINGERPRINT}" ]]; then
     echo "Warning fingerprint mismatch while fetching public key for ${HOST}"
     exit 1
 fi
 
-cat ${PUBKEY} >> ~/.ssh/known_hosts
+cat "${PUBKEY}" >> ~/.ssh/known_hosts

.circleci/get_archive_tag.sh

@@ -1,7 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -ex
 
-if [[ ! -z ${CIRCLE_TAG} ]]; then
+# shellcheck disable=SC2154
+if [[ -n ${CIRCLE_TAG} ]]; then
     export ARCHIVE_TAG=${CIRCLE_TAG}
     if [[ ${CIRCLE_TAG} = "*-rc*" ]]; then
         export RELEASE_TYPE="RC"
@@ -16,7 +17,7 @@ else
     export RELEASE_TYPE="NIGHTLY"
 fi
 
-echo "export ARCHIVE_TAG=${ARCHIVE_TAG}" >> ${BASH_ENV}
-echo "export RELEASE_TYPE=${RELEASE_TYPE}" >> ${BASH_ENV}
+echo "export ARCHIVE_TAG=${ARCHIVE_TAG}" >> "${BASH_ENV}"
+echo "export RELEASE_TYPE=${RELEASE_TYPE}" >> "${BASH_ENV}"
 
 set +ex

.circleci/run_tests.sh

@@ -10,7 +10,7 @@ test_type=$3
 # Remove the above arguments, every thing extra will be passed down to coverage
 shift 3
 
-mkdir -p ${test_report_dir}
+mkdir -p "${test_report_dir}"
 
 # Using 9min as the dormant timeout, CircleCI will kill the container after
 # 10min
@@ -39,21 +39,22 @@ dormant_signal=SIGUSR1
     --color=yes \
     --log-config='raiden:DEBUG' \
     --random \
-    --junit-xml=${test_report_dir}/results.xml \
-    --blockchain-type=${blockchain_type} \
+    --junit-xml="${test_report_dir}"/results.xml \
+    --blockchain-type="${blockchain_type}" \
     --select-fail-on-missing \
     --select-from-file selected-tests.txt \
     "${@}"
 
 # Skip log splitting for unit tests
-if [ "${test_type}" != "unit" ]; then
-    if [ -n ${RAIDEN_TESTS_LOGSDIR} ]; then
+if [[ "${test_type}" != "unit" ]]; then
+    # shellcheck disable=SC2154
+    if [[ -n ${RAIDEN_TESTS_LOGSDIR} ]]; then
         # Enable nullglob, otherwise the loop bellow would do one iteration
         # over the pattern, leading to a failure, since the pattern is not a
         # valid file.
         shopt -s nullglob
 
-        for test_directory in ${RAIDEN_TESTS_LOGSDIR}/*; do
+        for test_directory in "${RAIDEN_TESTS_LOGSDIR}"/*; do
             # Pytest's paremetrize tests have brackets in their names, e.g.
             # `test_api_open_channel_invalid_input[matrix-False-0-1]`, the
             # expression bellow must have the test_directory variable in quotes to

.circleci/select_tests.sh

@@ -14,16 +14,17 @@ output_file=$(mktemp)
         --collect-only \
         --quiet \
         "--blockchain-type=${blockchain_type}" \
-        ${additional_args} > ${output_file}
+        ${additional_args:+"$additional_args"} > "${output_file}"
 } || {
     # Print pytest's output if test selection failed. This may happen if a
     # depencency is broken or if the codebase has syntax errors.
-    cat ${output_file};
+    cat "${output_file}"
     exit 1;
 }
 
 # Save the tests in a file, it will be used by follow up steps
-cat ${output_file} \
+# shellcheck disable=SC2002
+cat "${output_file}" \
     | grep '::' \
     | circleci tests split --split-by=timings --timings-type=testname \
     | grep '::' > selected-tests.txt

.circleci/upload_to_s3.sh

@@ -10,30 +10,32 @@ dir=$3
 bucket=$4
 endpoint=$5
 
+[[ -n ${RELEASE_TYPE:?} ]]
+
 s3cmd \
-    --access_key ${access_key} \
-    --secret_key ${secret_key} \
-    --host ${endpoint} \
+    --access_key "${access_key}" \
+    --secret_key "${secret_key}" \
+    --host "${endpoint}" \
     --host-bucket "%(bucket)s.${endpoint}" \
     --no-progress \
     --stats \
     --no-delete-removed \
     --guess-mime-type \
     --acl-public \
     put \
-    ${dir}/_LATEST*.txt \
-    s3://${bucket}/
+    "${dir}"/_LATEST*.txt \
+    s3://"${bucket}"/
 
 s3cmd \
-    --access_key ${access_key} \
-    --secret_key ${secret_key} \
-    --host ${endpoint} \
+    --access_key "${access_key}" \
+    --secret_key "${secret_key}" \
+    --host "${endpoint}" \
     --host-bucket "%(bucket)s.${endpoint}" \
     --no-progress \
     --stats \
     --no-delete-removed \
     --guess-mime-type \
     --acl-public \
     put \
-    ${dir}/raiden* \
-    s3://${bucket}/${RELEASE_TYPE}/
+    "${dir}"/raiden* \
+    s3://"${bucket}"/"${RELEASE_TYPE}"/