3 ms·
IMHO, you should use unofficial strict mode (set -ueEo pipefail; trap "Error at ..." ERR ) often, because it catches a lot of bugs. Sadly, strict mode doesn't w
by drran 5y ago
IMHO, you should use unofficial strict mode (set -ueEo pipefail; trap "Error at ..." ERR ) often, because it catches a lot of bugs. Sadly, strict mode doesn't work in subshell.
Also, code without comments and documentation is useless, because developer must invest some time into browsing and understanding of your code first, but, often, it faster to rewrite code from scratch instead.
Also, you forget to include a license for your code, so nobody can use your code for any purpose.
I like the idea of downloading of modules at demand, with verification of integrity. I'm looking to implement something like that for my project too, but I'm afraid that I will not be able to implement it securely enough.
- arendtio 5y agoOne difference between the projects is that you are targeting Bash and I am targeting POSIX. Therefore, using the 'unofficial strict mode' is not an option for me. However, good tests can compensate a lot and are necessary anyway. Yes, there are certainly some modules which lack comments. On the other hand, there is at least one module which has its own readme to explain the code: https://github.com/arendtio/mdl.sh/tree/master/development/debug https://github.com/arendtio/mdl.sh/tree/master/development/d... Regarding the security: As said, I am targeting POSIX and as far as I know, the only checksum tool available is cksum. This is borderline insecure but catches transmission errors at least. However, if you do not have such strict requirements you can easily use something like sha256sum. In fact, my module allows to use alternative checksum tools but uses cksum if nothing else is specified (because it is better than nothing and always available).