0

Ubuntu 16.04

shellcheck states " Expressions don't expand in single quotes, use double quotes for that" but my password is a var. The script works just fine when I use single quotes to import bcrypt.

Here is my script:

#!/bin/bash

wDir="/home/work/amp/"
ampDir="${wDir}.pass_and_hash/"
ampPass="0192734654837948787098"
ampAdminPass="0192734654837948787098"
ampPassHashtxt="${ampDir}.ampPassHash.txt"
ampAdminPassHashtxt="${ampDir}.ampAdminPassHash.txt"

#-- create the .pass_and_hash folder
mkdir -p "$ampDir"

#-- echo both $ampPass and $ampAdminPass to files at .pass_and_hash
echo "${ampPass}" > "${ampDir}".ampPass.txt
echo "${ampAdminPass}" > "${ampDir}".ampAdminPass.txt

#-- generate hashes for $ampPass and $ampAdminPass and record output to files at .pass_and_hash
python2 -c 'import bcrypt; print(bcrypt.hashpw("$ampPass", bcrypt.gensalt(10)))' > "$ampPassHashtxt"
python2 -c 'import bcrypt; print(bcrypt.hashpw("$ampAdminPass", bcrypt.gensalt(10)))' > "$ampAdminPassHashtxt"

#-- Echo the values of the hash to /home/work/amp/Logs/console.log
echo "";
echo "*** After Created - Generate + Record Hashes for SuperAdmin + Administrator ****"
echo "SuperUser - generated password = $ampPass and hash = $(cat $ampPassHashtxt)"
echo "Administrator User - generated password = $ampAdminPass and hash = $(cat $ampAdminPassHashtxt)"
exit 0;

When I run the script, I receive zero errors:

root@pl /home/work/amp # ./run.sh

*** After Created - Generate + Record Hashes for SuperAdmin + Administrator ****
SuperUser - generated password = 0192734654837948787098 and hash = $2b$10$7UuG0NfTYZ8Ritgj3nhQt.7Fqa7RTYlN97WyoTt1EGrrXmA85pVc6
Administrator User - generated password = 0192734654837948787098 and hash = $2b$10$H3Gr4hrDL/6CAaCgSf2f7eEvqdbM9DUese1cQpyn/muBdQdmiFNgS

When I ask shellcheck what it thinks it says:

root@pl /home/work/amp # shellcheck run.sh

In run.sh line 18:
python2 -c 'import bcrypt; print(bcrypt.hashpw("$ampPass", bcrypt.gensalt(10)))' > "$ampPassHashtxt"
           ^-- SC2016: Expressions don't expand in single quotes, use double quotes for that.


    In run.sh line 19:
    python2 -c 'import bcrypt; print(bcrypt.hashpw("$ampAdminPass", bcrypt.gensalt(10)))' > "$ampAdminPassHashtxt"
               ^-- SC2016: Expressions don't expand in single quotes, use double quotes for that.

How do I fix the double quotes to satisfy shellcheck?

  • I doubt the generated passwords are correct. – Gerard H. Pille Mar 11 '18 at 4:16
1

I'm mimicking your script, no need to set the ampPass variable:

$ python2 -c 'print("$ampPass");'
$ampPass

Inside the single quotes, $ampPass won't be replaced, put it between double only:

python2 -c 'import bcrypt; print(bcrypt.hashpw("'"$ampPass"'", bcrypt.gensalt(10)))' > "$ampPassHashtxt"
  • Including passwords literally into source code isn't safe, because passwords can contain all manner of funny characters. Also, the command (including password) is public info (e.g. with ps). It'd be better to export the password vars, then use import os and os.environ['ampPass'] to get it as data within Python. – Gordon Davisson Mar 11 '18 at 7:29
  • My way above works fine. The passwords do work as I have already checked it and logged into the program I am using. YOur way also works but the var, $ampPass is now in red. If I double quote the exterior import section and escape the $, it works also. – Curious Sam Mar 11 '18 at 7:29
  • python2 -c "import bcrypt; print(bcrypt.hashpw(\"$ampAdminPass\", bcrypt.gensalt(10)))" The above works. I have to check if the password is functional. – Curious Sam Mar 11 '18 at 7:32
  • Perhaps your password really is '$ampPass'. Your code above, cannot "work fine". I never use bash, but it can't be that (expletive censored). – Gerard H. Pille Mar 11 '18 at 9:28
  • The password works. I have tried it 100 times, works great. I am simply trying to satisfy shellcheck as it complains about the single quotes around the entire expression. Looks at my 3rd code example above. If you copy and paste my script and run shellcheck against it, you will see what I am referring to. – Curious Sam Mar 15 '18 at 2:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.