Script fixes

.githooks/githooks.sh

@@ -57,9 +57,9 @@ SUB_HOOK_DIR="${HOOKS_DIR}/${CALLED_AS}.d"
 
 if [ -d "$SUB_HOOK_DIR" ]; then
     # Sort files naturally so 01- runs before 02-
-    for script in $(ls "$SUB_HOOK_DIR" | sort); do
+    for FULL_PATH in "$SUB_HOOK_DIR"/*; do
-        FULL_PATH="$SUB_HOOK_DIR/$script"
         [ -x "$FULL_PATH" ] || continue
+        script=$(basename "$FULL_PATH")
 
         # Replay stdin if we captured it, otherwise execute normally
         if [ -n "$STDIN_DATA" ]; then

bin/install_tool

@@ -125,8 +125,17 @@ function deb_only {
 function get_latest_github_release_url {
   local repo="$1"
   local glob="$2"
-  curl -s "https://api.github.com/repos/${repo}/releases/latest" | \
+  require jq "jq is required to parse GitHub releases."
-    jq -r --arg rx "${glob}" '.assets[] | select(.name | test($rx)) | .browser_download_url'
+  local response
+  response=$(curl -s "https://api.github.com/repos/${repo}/releases/latest")
+  
+  if ! echo "${response}" | jq -e '.assets' >/dev/null 2>&1; then
+    local msg
+    msg=$(echo "${response}" | jq -r '.message // "Unknown error fetching latest release."')
+    die "GitHub API error for ${repo}: ${msg}"
+  fi
+  
+  echo "${response}" | jq -r --arg rx "${glob}" '.assets[] | select(.name | test($rx)) | .browser_download_url'
 }
 
 function require {

bin/linux/backup.sh

@@ -8,13 +8,18 @@ if [ "$(uname)" != "Linux" ]; then
   exit 1
 fi
 
-DEFAULT=`echo /media/${USER}/[bB]ackup/${USER}/`
+shopt -s nullglob
+matches=( /media/"${USER}"/[bB]ackup/"${USER}"/ )
+shopt -u nullglob
+if [ ${#matches[@]} -gt 0 ]; then
+  DEFAULT="${matches[0]}"
+else
+  DEFAULT="/media/${USER}/Backup/${USER}/"
+fi
 DEST="${1:-${DEFAULT}}"
 
 function verify_dest {
-  arr=($1)
+  if [ -z "$1" ] ; then
-  items=${#arr[@]}
-  if [ $items -ne 1 ] ; then
     echo "Bad count of backup destinations." > /dev/stderr
     exit 1
   fi
@@ -25,7 +30,7 @@ function verify_dest {
     echo -n "Destination $dir does not end in a /, " > /dev/stderr
     echo "this is probably not what you want!" > /dev/stderr
     echo "Press a key to continue, or CTRL-C to cancel." > /dev/stderr
-    read
+    read -r
   fi
 }
 

bin/linux/i3lock.sh

@@ -1,6 +1,10 @@
 #!/bin/sh
 LOCKTIME="${SCREENSAVER_MIN:-5}"
 LOCKER="i3lock -c 000000"
+# Cleanup previously leaked background agents
+pkill -x xss-lock 2>/dev/null || true
+pkill -x xautolock 2>/dev/null || true
+
 # intentionally want word splitting below
 # do not quote this
 /usr/bin/xss-lock -- ${LOCKER} &

bin/linux/switch_virt.sh

@@ -1,11 +1,13 @@
 #!/bin/bash
 
+set -e
+
 if [ $# -lt 1 ] ; then
   echo "Usage: $0 <kvm|vbox>" >&2
   exit 1
 fi
 
-if [ `whoami` != "root" ] ; then
+if [ "$(id -u)" -ne 0 ] ; then
   if which sudo >/dev/null 2>&1 ; then
     sudo "$0" "$@"
     exit

deb-to-kali.sh

@@ -1,12 +1,12 @@
 #!/bin/bash
 
-if [ `whoami` != "root" ] ; then
+if [ "$(id -u)" -ne 0 ] ; then
   echo "This must be run as root." >&2
   exit 1
 fi
 
-BASEDIR=`dirname $0`
+BASEDIR="$(dirname "$0")"
-if ! test -f ${BASEDIR}/keys/gpg/kali-repo.key ; then
+if ! test -f "${BASEDIR}/keys/gpg/kali-repo.key" ; then
   echo "Couldn't find key, are you in the right place?" >&2
   exit 1
 fi
@@ -15,6 +15,6 @@ cat >/etc/apt/sources.list.d/kali.list <<KALI_EOF
 deb http://http.kali.org/kali kali-rolling main contrib non-free
 KALI_EOF
 
-/usr/bin/apt-key add ${BASEDIR}/keys/gpg/kali-repo.key
+/usr/bin/apt-key add "${BASEDIR}/keys/gpg/kali-repo.key"
 /usr/bin/apt-get update
 /usr/bin/apt-get install -y kali-linux-full

dotfiles/config/i3status/build_config.sh

@@ -13,13 +13,15 @@ function disks {
 	local DISKS=(/ /home)
 	local d
 	local used
-	for d in ${DISKS[@]} ; do
+	for d in "${DISKS[@]}" ; do
-		local dev=`df $d | tail -1 | awk '{print $1}'`
+		local dev
-		if [[ $used == *$dev* ]] ; then
+		dev=$(df "$d" | tail -1 | awk '{print $1}')
+		if [[ " $used " == *" $dev "* ]] ; then
 			continue
 		fi
-		local size=`df $d | tail -1 | awk '{print $2}'`
+		local size
-		if [ $size -eq 0 ] ; then
+		size=$(df "$d" | tail -1 | awk '{print $2}')
+		if [ "$size" -eq 0 ] ; then
 			continue
 		fi
 		used="${used} ${dev}"
@@ -99,7 +101,9 @@ function battery {
 				status_chr = "↑ CHR"
 				status_bat = "↓ BAT"
 		EOF
-		if [ $(bc <<< "$(i3status --version | awk '{print $2}') < 2.11") -eq 0 ] ;
+		local i3ver
+		i3ver=$(i3status --version 2>/dev/null | awk '{print $2}')
+		if [ -z "$i3ver" ] || [ "$(bc <<< "$i3ver < 2.11" 2>/dev/null)" -eq 0 ] ;
 		then
 			cat <<-EOF
 				status_unk = "? UNK"

install.sh

@@ -114,15 +114,17 @@ install_known_hosts() {
     if [[ -x "${merge_script}" ]]; then
       # Use the robust awk script for merging.
       verbose "Merging known_hosts with authoritative script..."
-      "${merge_script}" "${skel_hosts}" "${user_hosts}" > "$tmpf"
+      if "${merge_script}" "${skel_hosts}" "${user_hosts}" > "$tmpf"; then
+        cat "$tmpf" >| "${user_hosts}"
+      fi
     else
       # Fallback to the old, less robust method if the script is missing.
       verbose "Warning: ${merge_script} not found or not executable. Using simple sort."
-      cat "${skel_hosts}" "${user_hosts}" | sort -u > "$tmpf"
+      if cat "${skel_hosts}" "${user_hosts}" | sort -u > "$tmpf"; then
+        cat "$tmpf" >| "${user_hosts}"
+      fi
     fi
-    # Safely replace the original file.
+    rm -f "$tmpf"
-    cat "$tmpf" >| "${user_hosts}"
-    rm "$tmpf"
   else
     # User does not have a known_hosts file, just copy the new one.
     cp "${skel_hosts}" "${user_hosts}"
@@ -139,8 +141,7 @@ install_keys() {
 }
 
 read_saved_prefs() {
-  # Can't use basedir here as we don't have it yet
+  local pref_file="${SCRIPT_DIR}/.installed-prefs"
-  local pref_file="$(dirname "$0")/.installed-prefs"
   if [[ -f "${pref_file}" ]] ; then
     verbose "Loading saved skel preferences from ${pref_file}"
     # source is a bashism
@@ -209,9 +210,17 @@ install_starship() {
 
   local install_path="${tmpd}/install.sh"
   if have_command curl ; then
-    curl -sSL --show-error -o "${install_path}" https://starship.rs/install.sh
+    if ! curl -fsSL --show-error -o "${install_path}" https://starship.rs/install.sh; then
+      echo "Failed to download starship installer!" >&2
+      rm -rf "${tmpd}"
+      return 1
+    fi
   elif have_command wget ; then
-    wget -q -O "${install_path}" --https-only https://starship.rs/install.sh
+    if ! wget -q -O "${install_path}" --https-only https://starship.rs/install.sh; then
+      echo "Failed to download starship installer!" >&2
+      rm -rf "${tmpd}"
+      return 1
+    fi
   else
     echo "No curl or wget available!!" >&2
     rm -rf "${tmpd}"