R devel - Nov 2020 - Some packages have non-POSIX-compliant shell scripts. Implement a CRAN check for bashisms?

Dear R-devel,

Recently I ran into trouble installing two separate packages, nloptr and ncdf4,
both due to the same issue: they have scripts that have the shebang `#!
/bin/sh', but have bashisms in them, i.e. non-POSIX-compliant bash scripts.

I use dash [1] as my shell environment, since it's about 4x as fast as bash.
It looks like it's recently also become the default shell for Debian (and
thus Ubuntu).

It took quite a while to figure out what the issue was in great collaboration
with the author of ncdf4 (CC).

Perhaps it would be good to implement the utility checkbashisms [2] into the
CRAN make pipeline to help discover these kinds of issues? Running
`checkbashisms -f pkg/configure` on files that have the `#! /bin/sh` shebang
gives useful information about which lines of code are secretly bash code, with
some hints on how to make them POSIX-compliant. The alternative would of course
be to change the shebang into `#! /bin/bash`.

Kind regards,

Ilja Kocken



[1]: http://gondor.apana.org.au/~herbert/dash/
[2]: https://packages.qa.debian.org/d/devscripts.html

Your report underlines the importance of the checks implemented by CRAN.

In fact, checkbashisms has become an optional part of R CMD check in R
4.0.0, whose NEWS say
> R CMD check now optionally checks configure and cleanup scripts for
non-Bourne-shell code ('bashisms').
The R Internals manual at
https://cran.r-project.org/doc/manuals/r-devel/R-ints.html reveals that
the corresponding environment variable is called "_R_CHECK_BASHISMS_".
It is false by default but true for CRAN submission checks (--as-cran),
except on Windows. The check is probably not enabled for the routine
checks on the CRAN check farm.


Am 05.11.20 um 11:15 schrieb Kocken, I.J. (Ilja):
> Dear R-devel,
> 
> Recently I ran into trouble installing two separate packages, nloptr and
ncdf4, both due to the same issue: they have scripts that have the shebang `#!
/bin/sh', but have bashisms in them, i.e. non-POSIX-compliant bash scripts.
> 
> I use dash [1] as my shell environment, since it's about 4x as fast as
bash. It looks like it's recently also become the default shell for Debian
(and thus Ubuntu).
> 
> It took quite a while to figure out what the issue was in great
collaboration with the author of ncdf4 (CC).
> 
> Perhaps it would be good to implement the utility checkbashisms [2] into
the CRAN make pipeline to help discover these kinds of issues? Running
`checkbashisms -f pkg/configure` on files that have the `#! /bin/sh` shebang
gives useful information about which lines of code are secretly bash code, with
some hints on how to make them POSIX-compliant. The alternative would of course
be to change the shebang into `#! /bin/bash`.
> 
> Kind regards,
> 
> Ilja Kocken
> 
> 
> 
> [1]: http://gondor.apana.org.au/~herbert/dash/
> [2]: https://packages.qa.debian.org/d/devscripts.html
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
>