Consistently use `#! /usr/bin/env bash' as shebang

[iamleot]

This increase portability of semgrep on platforms not having bash as
/bin/bash.

This is not just a possible theoretical problem but actually helps helping build
semgrep on NetBSD!

(And, FTR, I was finally able to build semgrep and can use it on NetBSD with mostly just this patch and a couple of notes that I should tidy up and share (but probably only relevant for NetBSD and pkgsrc users! :))

[cla-bot]

Even though most of our projects are open-source, we ask contributors to sign a contributor license agreement before we merge your PR. There are a few reasons for this that we've learned over time: it's important to have an explicit statement that you wrote the code yourself, that no one else has a copyright claim on it, and it gives us as the long-term maintainers flexibility should we need to change the license in the future (though we don't plan to).

We don't need your address or any other personal information, just a signature and your email address. Sorry to bug you with the legal stuff but the good news is once filed we can accept PRs from you on any project automatically!

Please email cla@r2c.dev with a signed copy of the contributor license agreement.

If you prefer anonymity, we will accept a cryptographically signed PDF using the public key associated with your Github account.

[ievans]

this looks great @iamleot -- thanks for the contribution! @cla-bot check

tagging @DrewDennison or @brendongo for packaging/devops review

@mjambon or @minusworld -- could we write a semgrep generic-mode rule for #!/bin/bash -> #! /usr/bin/env bash?

My attempt: https://semgrep.dev/s/vzxn

[iamleot]

Thanks @ievans!

[ievans]

@cla-bot check pls (seems flaky)

[cla-bot]

The cla-bot has been summoned, and re-checked this pull request!

[iamleot]

@mjambon or @minusworld -- could we write a semgrep generic-mode rule for #!/bin/bash -> #! /usr/bin/env bash?

My attempt: https://semgrep.dev/s/vzxn

Really a minor cosmetic nit: in my experience it is more common to have #!/usr/bin/env bash instead of #! /usr/bin/env bash (with a white space between the #! and /usr/bin/env). In this patch I have added a whitespace in order to be consistent with existent shebangs in semgrep codebase.

In pkgsrc package system we have the following sed(1) invocation to spot shebangs (via pkgsrc/mk/check/check-interpreter.mk:67):

sed -n -e '1s/^#![[:space:]]*\([^[:space:]]*\).*/\1/p' -e '1q'

(...and then the interpreter in \1 is double-checked to be existent (so possible packages installing scripts but not having the corresponding interpreter available as dependency are catched), but that is not useful in the semgrep context! So we can ignore it! :))

While checking possible [[:space:]]* between the #! and the /bin/bash would be nice I think that checking only the first line is even more important in this case to avoid possible false positives in the middle of text files.
I have tried to adjust the @ievans' rule trying to address that by trying:

=~/#!\/bin\/bash/

(both unquoted and quoted via a single quote ('...') but it seems to not match anything.)
Regarding the other possible problem: only catching the first line of the file, it seems that I wasn't able to find any possible way to express that by skimming the docs.

Anyway, these are mostly my side-notes on thinking aloud about the rule proposed by @ievans! :) (i.e. not strictly related to this PR :))

[iamleot]

While checking possible [[:space:]]* between the #! and the /bin/bash would be nice I think that checking only the first line is even more important in this case to avoid possible false positives in the middle of text files.
I have tried to adjust the @ievans' rule trying to address that by trying:

=~/#!\/bin\/bash/

(both unquoted and quoted via a single quote ('...') but it seems to not match anything.)
Regarding the other possible problem: only catching the first line of the file, it seems that I wasn't able to find any possible way to express that by skimming the docs.

Of course I have not skimmed enough! (pattern-regex can solve the first problem and it seems by accident using ^ in the regex also address the second problem (are multiple lines concatenated together in the generic mode?)):

https://semgrep.dev/s/gLle

[underyx]

Agreed, this is good practice. We should probably write a semgrep rule for it, too! Thanks for the patch.

Edit: oh, I clicked directly to the review screen and failed to notice the discussion above. I see I'm not the only one with these thoughts :D

[underyx]

This one works only with the standard no-space rule, but adds a rule ID, message, and matching any binary, not just bash. https://semgrep.dev/s/underyx:hardcoded-shebang-path

[iamleot]

Thanks for review/discussion/merge @ievans, @underyx and @aryx!

Happy holidays!