kernel installer bash script fails static code analysis. #13

Activity

1. davmonk commented on Jan 21, 2026

   

   davmonk

   on Jan 21, 2026

   Author

   More actions

   Patch attached for high pri issues:

   0001-fix-critical-bugs.patch
2. tmiland-labs commented on Oct 13, 2026

   

   tmiland-labs

   on Oct 13, 2026

   More actions

   Thanks for the detailed report and patch, @davmonk! I went through every finding against the current main (1.2.5 + hardening cycle). Status:

   #	Finding	Status in current main
   1	Undefined variable SCRIPT_NAME	Fixed — no SCRIPT_NAME references remain
   2	Broken numeric comparison in self-updater	Fixed — updater uses sort -V version ordering; versionToInt() used for kernel-version gates
   3	LIST_INSTALLED uninitialized / unquoted test	Fixed — initialized to 0 at startup
   4	Destructive cleanup of INSTALL_DIR	Fixed — is_safe_install_dir() marker check guards removal
   5	Wrong dpkg package names/globs	Fixed — package install uses the built version (LINUX_FULL_VER) with compgen glob checks
   6	--default-compression argument parsing	Fixed — require_arg + shift 2
   7	OS-detection command substitution bug	Fixed — /etc/os-release-based detection
   8	Unquoted YESNO comparison	Fixed — case ${YESNO,,} normalization
   9	PKGCHK one-package-at-a-time logic	Fixed — per-distro dpkg -s/rpm -q, single package argument
   10	versionToInt() vs. suffixed versions	Addressed — numeric coercion handles -rc suffixes
   11	wget --no-check-certificate	Fixed — tarball downloads are SHA256-verified by default (optional GPG)
   12	Hardcoded /usr/bin/* paths	Partially fixed — gpg/gpgv resolved via command -v; sha256sum/curl/xz still pinned to /usr/bin (low impact)
   13	Unused/shadowed variables	Fixed — shellcheck is clean and enforced in CI
   14	Missing set -euo pipefail	Not adopted — the script uses explicit error handling (fatal/run_ok + strict argument validation) instead

   Several fixes follow your patch's approach (updater version comparison — we went with sort -V; install-dir guard — marker-based instead of a path blacklist; --default-compression parsing; package naming). Credit where due — thanks again for taking the time.

   Closing this as addressed — please reopen or file a new issue if anything still fails for you.
3. tmiland

   closed this as completedon Oct 13, 2026