Merge pull request #10857 from SkamDart/shellcheck-auto-fixup

Shellcheck: test scripts

.shellcheckrc

@@ -1,2 +1,4 @@
 external-sources=true
 source-path=SCRIPTDIR
+# Hack for scripts in e.g. tests/functional/ca
+source-path=SCRIPTDIR/..

maintainers/flake-module.nix

@@ -507,50 +507,30 @@
             ''^scripts/install-nix-from-closure\.sh$''
             ''^scripts/install-systemd-multi-user\.sh$''
             ''^src/nix/get-env\.sh$''
-            ''^tests/functional/bash-profile\.sh$''
-            ''^tests/functional/binary-cache-build-remote\.sh$''
-            ''^tests/functional/binary-cache\.sh$''
-            ''^tests/functional/brotli\.sh$''
-            ''^tests/functional/build-delete\.sh$''
-            ''^tests/functional/build-dry\.sh$''
             ''^tests/functional/build\.sh$''
-            ''^tests/functional/ca/build-cache\.sh$''
             ''^tests/functional/ca/build-dry\.sh$''
             ''^tests/functional/ca/build-with-garbage-path\.sh$''
-            ''^tests/functional/ca/build\.sh$''
             ''^tests/functional/ca/common\.sh$''
             ''^tests/functional/ca/concurrent-builds\.sh$''
-            ''^tests/functional/ca/derivation-json\.sh$''
-            ''^tests/functional/ca/duplicate-realisation-in-closure\.sh$''
             ''^tests/functional/ca/eval-store\.sh$''
             ''^tests/functional/ca/gc\.sh$''
             ''^tests/functional/ca/import-derivation\.sh$''
             ''^tests/functional/ca/new-build-cmd\.sh$''
-            ''^tests/functional/ca/nix-copy\.sh$''
-            ''^tests/functional/ca/nix-run\.sh$''
             ''^tests/functional/ca/nix-shell\.sh$''
             ''^tests/functional/ca/post-hook\.sh$''
             ''^tests/functional/ca/recursive\.sh$''
             ''^tests/functional/ca/repl\.sh$''
             ''^tests/functional/ca/selfref-gc\.sh$''
-            ''^tests/functional/ca/signatures\.sh$''
-            ''^tests/functional/ca/substitute\.sh$''
             ''^tests/functional/ca/why-depends\.sh$''
-            ''^tests/functional/case-hack\.sh$''
-            ''^tests/functional/check-refs\.sh$''
-            ''^tests/functional/check-reqs\.sh$''
             ''^tests/functional/check\.sh$''
-            ''^tests/functional/chroot-store\.sh$''
             ''^tests/functional/common/vars-and-functions\.sh$''
             ''^tests/functional/completions\.sh$''
-            ''^tests/functional/compression-levels\.sh$''
             ''^tests/functional/compute-levels\.sh$''
             ''^tests/functional/config\.sh$''
             ''^tests/functional/db-migration\.sh$''
             ''^tests/functional/debugger\.sh$''
             ''^tests/functional/dependencies\.builder0\.sh$''
             ''^tests/functional/dependencies\.sh$''
-            ''^tests/functional/derivation-json\.sh$''
             ''^tests/functional/dump-db\.sh$''
             ''^tests/functional/dyn-drv/build-built-drv\.sh$''
             ''^tests/functional/dyn-drv/common\.sh$''
@@ -558,10 +538,8 @@
             ''^tests/functional/dyn-drv/eval-outputOf\.sh$''
             ''^tests/functional/dyn-drv/old-daemon-error-hack\.sh$''
             ''^tests/functional/dyn-drv/recursive-mod-json\.sh$''
-            ''^tests/functional/dyn-drv/text-hashed-output\.sh$''
             ''^tests/functional/eval-store\.sh$''
             ''^tests/functional/eval\.sh$''
-            ''^tests/functional/experimental-features\.sh$''
             ''^tests/functional/export-graph\.sh$''
             ''^tests/functional/export\.sh$''
             ''^tests/functional/extra-sandbox-profile\.sh$''
@@ -571,49 +549,32 @@
             ''^tests/functional/fetchGitSubmodules\.sh$''
             ''^tests/functional/fetchGitVerification\.sh$''
             ''^tests/functional/fetchMercurial\.sh$''
-            ''^tests/functional/fetchPath\.sh$''
-            ''^tests/functional/fetchTree-file\.sh$''
             ''^tests/functional/fetchurl\.sh$''
-            ''^tests/functional/filter-source\.sh$''
             ''^tests/functional/fixed\.builder1\.sh$''
             ''^tests/functional/fixed\.builder2\.sh$''
             ''^tests/functional/fixed\.sh$''
-            ''^tests/functional/flakes/absolute-attr-paths\.sh$''
             ''^tests/functional/flakes/absolute-paths\.sh$''
-            ''^tests/functional/flakes/build-paths\.sh$''
-            ''^tests/functional/flakes/bundle\.sh$''
             ''^tests/functional/flakes/check\.sh$''
-            ''^tests/functional/flakes/circular\.sh$''
             ''^tests/functional/flakes/common\.sh$''
             ''^tests/functional/flakes/config\.sh$''
             ''^tests/functional/flakes/develop\.sh$''
-            ''^tests/functional/flakes/flake-in-submodule\.sh$''
             ''^tests/functional/flakes/flakes\.sh$''
             ''^tests/functional/flakes/follow-paths\.sh$''
-            ''^tests/functional/flakes/init\.sh$''
-            ''^tests/functional/flakes/inputs\.sh$''
-            ''^tests/functional/flakes/mercurial\.sh$''
             ''^tests/functional/flakes/prefetch\.sh$''
             ''^tests/functional/flakes/run\.sh$''
-            ''^tests/functional/flakes/search-root\.sh$''
             ''^tests/functional/flakes/show\.sh$''
-            ''^tests/functional/flakes/unlocked-override\.sh$''
             ''^tests/functional/fmt\.sh$''
             ''^tests/functional/fmt\.simple\.sh$''
-            ''^tests/functional/function-trace\.sh$''
             ''^tests/functional/gc-auto\.sh$''
             ''^tests/functional/gc-concurrent\.builder\.sh$''
             ''^tests/functional/gc-concurrent\.sh$''
             ''^tests/functional/gc-concurrent2\.builder\.sh$''
             ''^tests/functional/gc-non-blocking\.sh$''
-            ''^tests/functional/gc-runtime\.sh$''
             ''^tests/functional/gc\.sh$''
             ''^tests/functional/git-hashing/common\.sh$''
             ''^tests/functional/git-hashing/simple\.sh$''
             ''^tests/functional/hash-convert\.sh$''
-            ''^tests/functional/hash-path\.sh$''
             ''^tests/functional/help\.sh$''
-            ''^tests/functional/import-derivation\.sh$''
             ''^tests/functional/impure-derivations\.sh$''
             ''^tests/functional/impure-env\.sh$''
             ''^tests/functional/impure-eval\.sh$''

tests/functional/bash-profile.sh

@@ -2,10 +2,10 @@
 
 source common.sh
 
-sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > $TEST_ROOT/nix-profile.sh
+sed -e "s|@localstatedir@|$TEST_ROOT/profile-var|g" -e "s|@coreutils@|$coreutils|g" < ../../scripts/nix-profile.sh.in > "$TEST_ROOT"/nix-profile.sh
 
 user=$(whoami)
-rm -rf $TEST_HOME $TEST_ROOT/profile-var
+rm -rf "$TEST_HOME" "$TEST_ROOT/profile-var"
-mkdir -p $TEST_HOME
+mkdir -p "$TEST_HOME"
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh; set"
 USER=$user $SHELL -e -c ". $TEST_ROOT/nix-profile.sh" # test idempotency

tests/functional/binary-cache-build-remote.sh

@@ -12,7 +12,7 @@ clearCacheCache
 outPath=$(nix-build --store "file://$cacheDir" --builders 'auto - - 1 1' -j0 dependencies.nix)
 
 # Test that the path exactly exists in the destination store.
-nix path-info --store "file://$cacheDir" $outPath
+nix path-info --store "file://$cacheDir" "$outPath"
 
 # Succeeds without any build capability because no-op
 nix-build --store "file://$cacheDir" -j0 dependencies.nix

tests/functional/binary-cache.sh

@@ -14,9 +14,9 @@ clearStore
 clearCache
 outPath=$(nix-build dependencies.nix --no-out-link)
 
-nix copy --to file://$cacheDir $outPath
+nix copy --to "file://$cacheDir" "$outPath"
 
-readarray -t paths < <(nix path-info --all --json --store file://$cacheDir | jq 'keys|sort|.[]' -r)
+readarray -t paths < <(nix path-info --all --json --store "file://$cacheDir" | jq 'keys|sort|.[]' -r)
 [[ "${#paths[@]}" -eq 3 ]]
 for path in "${paths[@]}"; do
     [[ "$path" =~ -dependencies-input-0$ ]] \
@@ -25,16 +25,16 @@ for path in "${paths[@]}"; do
 done
 
 # Test copying build logs to the binary cache.
-expect 1 nix log --store file://$cacheDir $outPath 2>&1 | grep 'is not available'
+expect 1 nix log --store "file://$cacheDir" "$outPath" 2>&1 | grep 'is not available'
-nix store copy-log --to file://$cacheDir $outPath
+nix store copy-log --to "file://$cacheDir" "$outPath"
-nix log --store file://$cacheDir $outPath | grep FOO
+nix log --store "file://$cacheDir" "$outPath" | grep FOO
-rm -rf $TEST_ROOT/var/log/nix
+rm -rf "$TEST_ROOT/var/log/nix"
-expect 1 nix log $outPath 2>&1 | grep 'is not available'
+expect 1 nix log "$outPath" 2>&1 | grep 'is not available'
-nix log --substituters file://$cacheDir $outPath | grep FOO
+nix log --substituters "file://$cacheDir" "$outPath" | grep FOO
 
 # Test copying build logs from the binary cache.
-nix store copy-log --from file://$cacheDir $(nix-store -qd $outPath)^'*'
+nix store copy-log --from "file://$cacheDir" "$(nix-store -qd "$outPath")"^'*'
-nix log $outPath | grep FOO
+nix log "$outPath" | grep FOO
 
 basicDownloadTests() {
     # No uploading tests bcause upload with force HTTP doesn't work.
@@ -46,15 +46,15 @@ basicDownloadTests() {
 
     nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "---"
 
-    nix-store --substituters "file://$cacheDir" --no-require-sigs -r $outPath
+    nix-store --substituters "file://$cacheDir" --no-require-sigs -r "$outPath"
 
-    [ -x $outPath/program ]
+    [ -x "$outPath/program" ]
 
 
     # But with the right configuration, "nix-env -qas" should also work.
     clearStore
     clearCacheCache
-    echo "WantMassQuery: 1" >> $cacheDir/nix-cache-info
+    echo "WantMassQuery: 1" >> "$cacheDir/nix-cache-info"
 
     nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
     nix-env --substituters "file://$cacheDir" -f dependencies.nix -qas \* | grep -- "--S"
@@ -62,12 +62,12 @@ basicDownloadTests() {
     x=$(nix-env -f dependencies.nix -qas \* --prebuilt-only)
     [ -z "$x" ]
 
-    nix-store --substituters "file://$cacheDir" --no-require-sigs -r $outPath
+    nix-store --substituters "file://$cacheDir" --no-require-sigs -r "$outPath"
 
-    nix-store --check-validity $outPath
+    nix-store --check-validity "$outPath"
-    nix-store -qR $outPath | grep input-2
+    nix-store -qR "$outPath" | grep input-2
 
-    echo "WantMassQuery: 0" >> $cacheDir/nix-cache-info
+    echo "WantMassQuery: 0" >> "$cacheDir/nix-cache-info"
 }
 
 
@@ -83,22 +83,22 @@ basicDownloadTests
 # Test whether Nix notices if the NAR doesn't match the hash in the NAR info.
 clearStore
 
-nar=$(ls $cacheDir/nar/*.nar.xz | head -n1)
+nar=$(find "$cacheDir/nar/" -type f -name "*.nar.xz" | head -n1)
-mv $nar $nar.good
+mv "$nar" "$nar".good
-mkdir -p $TEST_ROOT/empty
+mkdir -p "$TEST_ROOT/empty"
-nix-store --dump $TEST_ROOT/empty | xz > $nar
+nix-store --dump "$TEST_ROOT/empty" | xz > "$nar"
 
-expect 1 nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
+expect 1 nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" 2>&1 | tee "$TEST_ROOT/log"
-grepQuiet "hash mismatch" $TEST_ROOT/log
+grepQuiet "hash mismatch" "$TEST_ROOT/log"
 
-mv $nar.good $nar
+mv "$nar".good "$nar"
 
 
 # Test whether this unsigned cache is rejected if the user requires signed caches.
 clearStore
 clearCacheCache
 
-if nix-store --substituters "file://$cacheDir" -r $outPath; then
+if nix-store --substituters "file://$cacheDir" -r "$outPath"; then
     echo "unsigned binary cache incorrectly accepted"
     exit 1
 fi
@@ -107,131 +107,134 @@ fi
 # Test whether fallback works if a NAR has disappeared. This does not require --fallback.
 clearStore
 
-mv $cacheDir/nar $cacheDir/nar2
+mv "$cacheDir/nar" "$cacheDir/nar2"
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result"
 
-mv $cacheDir/nar2 $cacheDir/nar
+mv "$cacheDir/nar2" "$cacheDir/nar"
 
 
 # Test whether fallback works if a NAR is corrupted. This does require --fallback.
 clearStore
 
-mv $cacheDir/nar $cacheDir/nar2
+mv "$cacheDir/nar" "$cacheDir/nar2"
-mkdir $cacheDir/nar
+mkdir "$cacheDir/nar"
-for i in $(cd $cacheDir/nar2 && echo *); do touch $cacheDir/nar/$i; done
+for i in $(cd "$cacheDir/nar2" && echo *); do touch "$cacheDir"/nar/"$i"; done
 
-(! nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result)
+(! nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result")
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result --fallback
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" --fallback
 
-rm -rf $cacheDir/nar
+rm -rf "$cacheDir/nar"
-mv $cacheDir/nar2 $cacheDir/nar
+mv "$cacheDir/nar2" "$cacheDir/nar"
 
 
 # Test whether building works if the binary cache contains an
 # incomplete closure.
 clearStore
 
-rm -v $(grep -l "StorePath:.*dependencies-input-2" $cacheDir/*.narinfo)
+rm -v "$(grep -l "StorePath:.*dependencies-input-2" "$cacheDir"/*.narinfo)"
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" 2>&1 | tee "$TEST_ROOT/log"
-grepQuiet "copying path.*input-0" $TEST_ROOT/log
+grepQuiet "copying path.*input-0" "$TEST_ROOT/log"
-grepQuiet "copying path.*input-2" $TEST_ROOT/log
+grepQuiet "copying path.*input-2" "$TEST_ROOT/log"
-grepQuiet "copying path.*top" $TEST_ROOT/log
+grepQuiet "copying path.*top" "$TEST_ROOT/log"
 
 
 # Idem, but without cached .narinfo.
 clearStore
 clearCacheCache
 
-nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o $TEST_ROOT/result 2>&1 | tee $TEST_ROOT/log
+nix-build --substituters "file://$cacheDir" --no-require-sigs dependencies.nix -o "$TEST_ROOT/result" 2>&1 | tee "$TEST_ROOT/log"
-grepQuiet "don't know how to build" $TEST_ROOT/log
+grepQuiet "don't know how to build" "$TEST_ROOT/log"
-grepQuiet "building.*input-1" $TEST_ROOT/log
+grepQuiet "building.*input-1" "$TEST_ROOT/log"
-grepQuiet "building.*input-2" $TEST_ROOT/log
+grepQuiet "building.*input-2" "$TEST_ROOT/log"
-grepQuiet "copying path.*input-0" $TEST_ROOT/log
+grepQuiet "copying path.*input-0" "$TEST_ROOT/log"
-grepQuiet "copying path.*top" $TEST_ROOT/log
+grepQuiet "copying path.*top" "$TEST_ROOT/log"
 
 
 # Create a signed binary cache.
 clearCache
 clearCacheCache
 
-nix key generate-secret --key-name test.nixos.org-1 > $TEST_ROOT/sk1
+nix key generate-secret --key-name test.nixos.org-1 > "$TEST_ROOT/sk1"
-publicKey=$(nix key convert-secret-to-public < $TEST_ROOT/sk1)
+publicKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk1")
 
-nix key generate-secret --key-name test.nixos.org-1 > $TEST_ROOT/sk2
+nix key generate-secret --key-name test.nixos.org-1 > "$TEST_ROOT/sk2"
-badKey=$(nix key convert-secret-to-public < $TEST_ROOT/sk2)
+badKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk2")
 
-nix key generate-secret --key-name foo.nixos.org-1 > $TEST_ROOT/sk3
+nix key generate-secret --key-name foo.nixos.org-1 > "$TEST_ROOT/sk3"
-otherKey=$(nix key convert-secret-to-public < $TEST_ROOT/sk3)
+otherKey=$(nix key convert-secret-to-public < "$TEST_ROOT/sk3")
 
-_NIX_FORCE_HTTP= nix copy --to file://$cacheDir?secret-key=$TEST_ROOT/sk1 $outPath
+_NIX_FORCE_HTTP='' nix copy --to "file://$cacheDir"?secret-key="$TEST_ROOT"/sk1 "$outPath"
 
 
 # Downloading should fail if we don't provide a key.
 clearStore
 clearCacheCache
 
-(! nix-store -r $outPath --substituters "file://$cacheDir")
+(! nix-store -r "$outPath" --substituters "file://$cacheDir")
 
 
 # And it should fail if we provide an incorrect key.
 clearStore
 clearCacheCache
 
-(! nix-store -r $outPath --substituters "file://$cacheDir" --trusted-public-keys "$badKey")
+(! nix-store -r "$outPath" --substituters "file://$cacheDir" --trusted-public-keys "$badKey")
 
 
 # It should succeed if we provide the correct key.
-nix-store -r $outPath --substituters "file://$cacheDir" --trusted-public-keys "$otherKey $publicKey"
+nix-store -r "$outPath" --substituters "file://$cacheDir" --trusted-public-keys "$otherKey $publicKey"
 
 
 # It should fail if we corrupt the .narinfo.
 clearStore
 
 cacheDir2=$TEST_ROOT/binary-cache-2
-rm -rf $cacheDir2
+rm -rf "$cacheDir2"
-cp -r $cacheDir $cacheDir2
+cp -r "$cacheDir" "$cacheDir2"
 
-for i in $cacheDir2/*.narinfo; do
+for i in "$cacheDir2"/*.narinfo; do
-    grep -v References $i > $i.tmp
+    grep -v References "$i" > "$i".tmp
-    mv $i.tmp $i
+    mv "$i".tmp "$i"
 done
 
 clearCacheCache
 
-(! nix-store -r $outPath --substituters "file://$cacheDir2" --trusted-public-keys "$publicKey")
+(! nix-store -r "$outPath" --substituters "file://$cacheDir2" --trusted-public-keys "$publicKey")
 
 # If we provide a bad and a good binary cache, it should succeed.
 
-nix-store -r $outPath --substituters "file://$cacheDir2 file://$cacheDir" --trusted-public-keys "$publicKey"
+nix-store -r "$outPath" --substituters "file://$cacheDir2 file://$cacheDir" --trusted-public-keys "$publicKey"
 
 
 unset _NIX_FORCE_HTTP
 
 
 # Test 'nix verify --all' on a binary cache.
-nix store verify -vvvvv --all --store file://$cacheDir --no-trust
+nix store verify -vvvvv --all --store "file://$cacheDir" --no-trust
 
 
 # Test local NAR caching.
 narCache=$TEST_ROOT/nar-cache
-rm -rf $narCache
+rm -rf "$narCache"
-mkdir $narCache
+mkdir "$narCache"
 
-[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" $outPath/foobar) = FOOBAR ]]
+[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" "$outPath/foobar") = FOOBAR ]]
 
 rm -rfv "$cacheDir/nar"
 
-[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" $outPath/foobar) = FOOBAR ]]
+[[ $(nix store cat --store "file://$cacheDir?local-nar-cache=$narCache" "$outPath/foobar") = FOOBAR ]]
 
-(! nix store cat --store file://$cacheDir $outPath/foobar)
+(! nix store cat --store "file://$cacheDir" "$outPath/foobar")
 
 
 # Test NAR listing generation.
 clearCache
 
+
+# preserve quotes variables in the single-quoted string
+# shellcheck disable=SC2016
 outPath=$(nix-build --no-out-link -E '
   with import ./config.nix;
   mkDerivation {
@@ -240,16 +243,18 @@ outPath=$(nix-build --no-out-link -E '
   }
 ')
 
-nix copy --to file://$cacheDir?write-nar-listing=1 $outPath
+nix copy --to "file://$cacheDir"?write-nar-listing=1 "$outPath"
 
 diff -u \
-    <(jq -S < $cacheDir/$(basename $outPath | cut -c1-32).ls) \
+    <(jq -S < "$cacheDir/$(basename "$outPath" | cut -c1-32).ls") \
     <(echo '{"version":1,"root":{"type":"directory","entries":{"bar":{"type":"regular","size":4,"narOffset":232},"link":{"type":"symlink","target":"xyzzy"}}}}' | jq -S)
 
 
 # Test debug info index generation.
 clearCache
 
+# preserve quotes variables in the single-quoted string
+# shellcheck disable=SC2016
 outPath=$(nix-build --no-out-link -E '
   with import ./config.nix;
   mkDerivation {
@@ -258,14 +263,16 @@ outPath=$(nix-build --no-out-link -E '
   }
 ')
 
-nix copy --to "file://$cacheDir?index-debug-info=1&compression=none" $outPath
+nix copy --to "file://$cacheDir?index-debug-info=1&compression=none" "$outPath"
 
 diff -u \
-    <(cat $cacheDir/debuginfo/02623eda209c26a59b1a8638ff7752f6b945c26b.debug | jq -S) \
+    <(jq -S < "$cacheDir"/debuginfo/02623eda209c26a59b1a8638ff7752f6b945c26b.debug) \
     <(echo '{"archive":"../nar/100vxs724qr46phz8m24iswmg9p3785hsyagz0kchf6q6gf06sw6.nar","member":"lib/debug/.build-id/02/623eda209c26a59b1a8638ff7752f6b945c26b.debug"}' | jq -S)
 
 # Test against issue https://github.com/NixOS/nix/issues/3964
-#
+
+# preserve quotes variables in the single-quoted string
+# shellcheck disable=SC2016
 expr='
   with import ./config.nix;
   mkDerivation {
@@ -275,22 +282,22 @@ expr='
   }
 '
 outPath=$(nix-build --no-out-link -E "$expr")
-docPath=$(nix-store -q --references $outPath)
+docPath=$(nix-store -q --references "$outPath")
 
 # $ nix-store -q --tree $outPath
 # ...-multi-output
 # +---...-multi-output-doc
 
-nix copy --to "file://$cacheDir" $outPath
+nix copy --to "file://$cacheDir" "$outPath"
 
 hashpart() {
   basename "$1" | cut -c1-32
 }
 
 # break the closure of out by removing doc
-rm $cacheDir/$(hashpart $docPath).narinfo
+rm "$cacheDir/$(hashpart "$docPath")".narinfo
 
-nix-store --delete $outPath $docPath
+nix-store --delete "$outPath" "$docPath"
 # -vvv is the level that logs during the loop
 timeout 60 nix-build --no-out-link -E "$expr" --option substituters "file://$cacheDir" \
   --option trusted-binary-caches "file://$cacheDir"  --no-require-sigs

tests/functional/brotli.sh

@@ -9,15 +9,15 @@ cacheURI="file://$cacheDir?compression=br"
 
 outPath=$(nix-build dependencies.nix --no-out-link)
 
-nix copy --to $cacheURI $outPath
+nix copy --to "$cacheURI" "$outPath"
 
-HASH=$(nix hash path $outPath)
+HASH=$(nix hash path "$outPath")
 
 clearStore
 clearCacheCache
 
-nix copy --from $cacheURI $outPath --no-check-sigs
+nix copy --from "$cacheURI" "$outPath" --no-check-sigs
 
-HASH2=$(nix hash path $outPath)
+HASH2=$(nix hash path "$outPath")
 
-[[ $HASH = $HASH2 ]]
+[[ $HASH == "$HASH2" ]]

tests/functional/build-delete.sh

@@ -6,25 +6,25 @@ clearStore
 
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_independent_outputs() {
-    nix build -f multiple-outputs.nix --json independent --no-link > $TEST_ROOT/independent.json
+    nix build -f multiple-outputs.nix --json independent --no-link > "$TEST_ROOT"/independent.json
 
     # Make sure that 'nix build' can build a derivation that depends on both outputs of another derivation.
     p=$(nix build -f multiple-outputs.nix use-independent --no-link --print-out-paths)
     nix-store --delete "$p" # Clean up for next test
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
-    nix-store --delete "$(jq -r <$TEST_ROOT/independent.json .[0].outputs.first)"
+    nix-store --delete "$(jq -r <"$TEST_ROOT"/independent.json .[0].outputs.first)"
     p=$(nix build -f multiple-outputs.nix use-independent --no-link --print-out-paths)
-    cmp $p <<EOF
+    cmp "$p" <<EOF
 first
 second
 EOF
     nix-store --delete "$p" # Clean up for next test
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
-    nix-store --delete "$(jq -r <$TEST_ROOT/independent.json .[0].outputs.second)"
+    nix-store --delete "$(jq -r <"$TEST_ROOT"/independent.json .[0].outputs.second)"
     p=$(nix build -f multiple-outputs.nix use-independent --no-link --print-out-paths)
-    cmp $p <<EOF
+    cmp "$p" <<EOF
 first
 second
 EOF
@@ -36,16 +36,16 @@ issue_6572_independent_outputs
 # https://github.com/NixOS/nix/issues/6572
 issue_6572_dependent_outputs() {
 
-    nix build -f multiple-outputs.nix --json a --no-link > $TEST_ROOT/a.json
+    nix build -f multiple-outputs.nix --json a --no-link > "$TEST_ROOT"/a.json
 
     # # Make sure that 'nix build' can build a derivation that depends on both outputs of another derivation.
     p=$(nix build -f multiple-outputs.nix use-a --no-link --print-out-paths)
     nix-store --delete "$p" # Clean up for next test
 
     # Make sure that 'nix build' tracks input-outputs correctly when a single output is already present.
-    nix-store --delete "$(jq -r <$TEST_ROOT/a.json .[0].outputs.second)"
+    nix-store --delete "$(jq -r <"$TEST_ROOT"/a.json .[0].outputs.second)"
     p=$(nix build -f multiple-outputs.nix use-a --no-link --print-out-paths)
-    cmp $p <<EOF
+    cmp "$p" <<EOF
 first
 second
 EOF

tests/functional/build-dry.sh

@@ -35,17 +35,17 @@ clearStore
 clearCache
 
 RESULT=$TEST_ROOT/result-link
-rm -f $RESULT
+rm -f "$RESULT"
 
-nix-build dependencies.nix -o $RESULT --dry-run
+nix-build dependencies.nix -o "$RESULT" --dry-run
 
 [[ ! -h $RESULT ]] || fail "nix-build --dry-run created output link"
 
-nix build -f dependencies.nix -o $RESULT --dry-run
+nix build -f dependencies.nix -o "$RESULT" --dry-run
 
 [[ ! -h $RESULT ]] || fail "nix build --dry-run created output link"
 
-nix build -f dependencies.nix -o $RESULT
+nix build -f dependencies.nix -o "$RESULT"
 
 [[ -h $RESULT ]]
 
@@ -58,12 +58,12 @@ RES=$(nix build -f dependencies.nix --dry-run --json)
 
 if [[ -z "${NIX_TESTS_CA_BY_DEFAULT-}" ]]; then
     echo "$RES" | jq '.[0] | [
-        (.drvPath | test("'$NIX_STORE_DIR'.*\\.drv")),
+        (.drvPath | test("'"$NIX_STORE_DIR"'.*\\.drv")),
-        (.outputs.out | test("'$NIX_STORE_DIR'"))
+        (.outputs.out | test("'"$NIX_STORE_DIR"'"))
     ] | all'
 else
     echo "$RES" | jq '.[0] | [
-        (.drvPath | test("'$NIX_STORE_DIR'.*\\.drv")),
+        (.drvPath | test("'"$NIX_STORE_DIR"'.*\\.drv")),
         .outputs.out == null
     ] | all'
 fi

tests/functional/ca/build-cache.sh

@@ -26,7 +26,8 @@ copyAttr () {
     # Note: to copy CA derivations, we need to copy the realisations, which
     # currently requires naming the installables, not just the derivation output
     # path.
-    nix copy --to file://$cacheDir "${args[@]}"
+
+    nix copy --to "file://$cacheDir" "${args[@]}"
 }
 
 testRemoteCacheFor () {
@@ -35,7 +36,7 @@ testRemoteCacheFor () {
     copyAttr "$derivationPath" 1
     clearStore
     # Check nothing gets built.
-    buildAttr "$derivationPath" 1 --option substituters file://$cacheDir --no-require-sigs |& grepQuietInverse " will be built:"
+    buildAttr "$derivationPath" 1 --option substituters "file://$cacheDir" --no-require-sigs |& grepQuietInverse " will be built:"
 }
 
 testRemoteCache () {
@@ -48,4 +49,4 @@ testRemoteCache () {
 }
 
 clearStore
-testRemoteCache
+testRemoteCache

tests/functional/ca/build.sh

@@ -20,11 +20,11 @@ testDeterministicCA () {
 
 testCutoffFor () {
     local out1 out2
-    out1=$(buildAttr $1 1)
+    out1=$(buildAttr "$1" 1)
     # The seed only changes the root derivation, and not it's output, so the
     # dependent derivations should only need to be built once.
     buildAttr rootCA 2
-    out2=$(buildAttr $1 2 -j0)
+    out2=$(buildAttr "$1" 2 -j0)
     test "$out1" == "$out2"
 }
 
@@ -41,7 +41,7 @@ testGC () {
     nix-instantiate ./content-addressed.nix -A rootCA --arg seed 5
     nix-collect-garbage --option keep-derivations true
     clearStore
-    buildAttr rootCA 1 --out-link $TEST_ROOT/rootCA
+    buildAttr rootCA 1 --out-link "$TEST_ROOT"/rootCA
     nix-collect-garbage
     buildAttr rootCA 1 -j0
 }
@@ -55,7 +55,7 @@ testNixCommand () {
 testNormalization () {
     clearStore
     outPath=$(buildAttr rootCA 1)
-    test "$(stat -c %Y $outPath)" -eq 1
+    test "$(stat -c %Y "$outPath")" -eq 1
 }
 
 clearStore

tests/functional/ca/derivation-json.sh

@@ -1,29 +1,31 @@
+#!/usr/bin/env bash
+#
 source common.sh
 
 export NIX_TESTS_CA_BY_DEFAULT=1
 
 drvPath=$(nix-instantiate ../simple.nix)
 
-nix derivation show $drvPath | jq .[] > $TEST_HOME/simple.json
+nix derivation show "$drvPath" | jq .[] > "$TEST_HOME"/simple.json
 
-drvPath2=$(nix derivation add < $TEST_HOME/simple.json)
+drvPath2=$(nix derivation add < "$TEST_HOME"/simple.json)
 
 [[ "$drvPath" = "$drvPath2" ]]
 
 # Content-addressed derivations can be renamed.
-jq '.name = "foo"' < $TEST_HOME/simple.json > $TEST_HOME/foo.json
+jq '.name = "foo"' < "$TEST_HOME"/simple.json > "$TEST_HOME"/foo.json
-drvPath3=$(nix derivation add --dry-run < $TEST_HOME/foo.json)
+drvPath3=$(nix derivation add --dry-run < "$TEST_HOME"/foo.json)
 # With --dry-run nothing is actually written
 [[ ! -e "$drvPath3" ]]
 
 # But the JSON is rejected without the experimental feature
-expectStderr 1 nix derivation add < $TEST_HOME/foo.json --experimental-features nix-command | grepQuiet "experimental Nix feature 'ca-derivations' is disabled"
+expectStderr 1 nix derivation add < "$TEST_HOME"/foo.json --experimental-features nix-command | grepQuiet "experimental Nix feature 'ca-derivations' is disabled"
 
 # Without --dry-run it is actually written
-drvPath4=$(nix derivation add < $TEST_HOME/foo.json)
+drvPath4=$(nix derivation add < "$TEST_HOME"/foo.json)
 [[ "$drvPath4" = "$drvPath3" ]]
 [[ -e "$drvPath3" ]]
 
 # The modified derivation read back as JSON matches
-nix derivation show $drvPath3 | jq .[] > $TEST_HOME/foo-read.json
+nix derivation show "$drvPath3" | jq .[] > "$TEST_HOME"/foo-read.json
-diff $TEST_HOME/foo.json $TEST_HOME/foo-read.json
+diff "$TEST_HOME"/foo.json "$TEST_HOME"/foo-read.json

tests/functional/ca/duplicate-realisation-in-closure.sh

@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 source ./common.sh
 
 requireDaemonNewerThan "2.4pre20210625"
@@ -5,7 +7,7 @@ requireDaemonNewerThan "2.4pre20210625"
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
 
-rm -rf $REMOTE_STORE_DIR
+rm -rf "$REMOTE_STORE_DIR"
 clearStore
 
 # Build dep1 and push that to the binary cache.

tests/functional/ca/nix-copy.sh

@@ -15,13 +15,13 @@ testOneCopy () {
     rm -rf "$REMOTE_STORE_DIR"
 
     attrPath="$1"
-    nix copy --to $REMOTE_STORE "$attrPath" --file ./content-addressed.nix
+    nix copy --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix
 
     ensureCorrectlyCopied "$attrPath"
 
     # Ensure that we can copy back what we put in the store
     clearStore
-    nix copy --from $REMOTE_STORE \
+    nix copy --from "$REMOTE_STORE" \
         --file ./content-addressed.nix "$attrPath" \
         --no-check-sigs
 }

tests/functional/ca/nix-run.sh

@@ -4,4 +4,4 @@ source common.sh
 
 FLAKE_PATH=path:$PWD
 
-nix run --no-write-lock-file $FLAKE_PATH#runnable
+nix run --no-write-lock-file "$FLAKE_PATH#runnable"

tests/functional/ca/signatures.sh

@@ -1,10 +1,12 @@
+#!/usr/bin/env bash
+
 source common.sh
 
 clearStore
 clearCache
 
-nix-store --generate-binary-cache-key cache1.example.org $TEST_ROOT/sk1 $TEST_ROOT/pk1
+nix-store --generate-binary-cache-key cache1.example.org "$TEST_ROOT/sk1" "$TEST_ROOT/pk1"
-pk1=$(cat $TEST_ROOT/pk1)
+pk1=$(cat "$TEST_ROOT/pk1")
 
 export REMOTE_STORE_DIR="$TEST_ROOT/remote_store"
 export REMOTE_STORE="file://$REMOTE_STORE_DIR"
@@ -19,16 +21,16 @@ testOneCopy () {
     rm -rf "$REMOTE_STORE_DIR"
 
     attrPath="$1"
-    nix copy -vvvv --to $REMOTE_STORE "$attrPath" --file ./content-addressed.nix \
+    nix copy -vvvv --to "$REMOTE_STORE" "$attrPath" --file ./content-addressed.nix \
         --secret-key-files "$TEST_ROOT/sk1" --show-trace
 
     ensureCorrectlyCopied "$attrPath"
 
     # Ensure that we can copy back what we put in the store
     clearStore
-    nix copy --from $REMOTE_STORE \
+    nix copy --from "$REMOTE_STORE" \
         --file ./content-addressed.nix "$attrPath" \
-        --trusted-public-keys $pk1
+        --trusted-public-keys "$pk1"
 }
 
 for attrPath in rootCA dependentCA transitivelyDependentCA dependentNonCA dependentFixedOutput; do

tests/functional/ca/substitute.sh

@@ -4,9 +4,10 @@
 
 source common.sh
 
+# shellcheck disable=SC1111
 needLocalStore "“--no-require-sigs” can’t be used with the daemon"
 
-rm -rf $TEST_ROOT/binary_cache
+rm -rf "$TEST_ROOT/binary_cache"
 
 export REMOTE_STORE_DIR=$TEST_ROOT/binary_cache
 export REMOTE_STORE=file://$REMOTE_STORE_DIR
@@ -17,11 +18,11 @@ buildDrvs () {
 
 # Populate the remote cache
 clearStore
-nix copy --to $REMOTE_STORE --file ./content-addressed.nix
+nix copy --to "$REMOTE_STORE" --file ./content-addressed.nix
 
 # Restart the build on an empty store, ensuring that we don't build
 clearStore
-buildDrvs --substitute --substituters $REMOTE_STORE --no-require-sigs -j0 transitivelyDependentCA
+buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0 transitivelyDependentCA
 # Check that the thing we’ve just substituted has its realisation stored
 nix realisation info --file ./content-addressed.nix transitivelyDependentCA
 # Check that its dependencies have it too
@@ -63,9 +64,9 @@ clearStore
 # Add the realisations of rootCA to the cachecache
 clearCacheCache
 export _NIX_FORCE_HTTP=1
-buildDrvs --substitute --substituters $REMOTE_STORE --no-require-sigs -j0
+buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0
 # Try rebuilding, but remove the realisations from the remote cache to force
 # using the cachecache
 clearStore
-rm $REMOTE_STORE_DIR/realisations/*
+rm "$REMOTE_STORE_DIR"/realisations/*
-buildDrvs --substitute --substituters $REMOTE_STORE --no-require-sigs -j0
+buildDrvs --substitute --substituters "$REMOTE_STORE" --no-require-sigs -j0

tests/functional/case-hack.sh

@@ -4,18 +4,19 @@ source common.sh
 
 clearStore
 
-rm -rf $TEST_ROOT/case
+rm -rf "$TEST_ROOT/case"
 
-opts="--option use-case-hack true"
+opts=("--option" "use-case-hack" "true")
 
 # Check whether restoring and dumping a NAR that contains case
 # collisions is round-tripping, even on a case-insensitive system.
-nix-store $opts  --restore $TEST_ROOT/case < case.nar
+
-nix-store $opts --dump $TEST_ROOT/case > $TEST_ROOT/case.nar
+nix-store "${opts[@]}" --restore "$TEST_ROOT/case" < case.nar
-cmp case.nar $TEST_ROOT/case.nar
+nix-store "${opts[@]}" --dump "$TEST_ROOT/case" > "$TEST_ROOT/case.nar"
-[ "$(nix-hash $opts --type sha256 $TEST_ROOT/case)" = "$(nix-hash --flat --type sha256 case.nar)" ]
+cmp case.nar "$TEST_ROOT/case.nar"
+[ "$(nix-hash "${opts[@]}" --type sha256 "$TEST_ROOT/case")" = "$(nix-hash --flat --type sha256 case.nar)" ]
 
 # Check whether we detect true collisions (e.g. those remaining after
 # removal of the suffix).
 touch "$TEST_ROOT/case/xt_CONNMARK.h~nix~case~hack~3"
-(! nix-store $opts --dump $TEST_ROOT/case > /dev/null)
+(! nix-store "${opts[@]}" --dump "$TEST_ROOT/case" > /dev/null)

tests/functional/check-refs.sh

@@ -6,42 +6,42 @@ clearStore
 
 RESULT=$TEST_ROOT/result
 
-dep=$(nix-build -o $RESULT check-refs.nix -A dep)
+dep=$(nix-build -o "$RESULT" check-refs.nix -A dep)
 
 # test1 references dep, not itself.
-test1=$(nix-build -o $RESULT check-refs.nix -A test1)
+test1=$(nix-build -o "$RESULT" check-refs.nix -A test1)
-nix-store -q --references $test1 | grepQuietInverse $test1
+nix-store -q --references "$test1" | grepQuietInverse "$test1"
-nix-store -q --references $test1 | grepQuiet $dep
+nix-store -q --references "$test1" | grepQuiet "$dep"
 
 # test2 references src, not itself nor dep.
-test2=$(nix-build -o $RESULT check-refs.nix -A test2)
+test2=$(nix-build -o "$RESULT" check-refs.nix -A test2)
-nix-store -q --references $test2 | grepQuietInverse $test2
+nix-store -q --references "$test2" | grepQuietInverse "$test2"
-nix-store -q --references $test2 | grepQuietInverse $dep
+nix-store -q --references "$test2" | grepQuietInverse "$dep"
-nix-store -q --references $test2 | grepQuiet aux-ref
+nix-store -q --references "$test2" | grepQuiet aux-ref
 
 # test3 should fail (unallowed ref).
-(! nix-build -o $RESULT check-refs.nix -A test3)
+(! nix-build -o "$RESULT" check-refs.nix -A test3)
 
 # test4 should succeed.
-nix-build -o $RESULT check-refs.nix -A test4
+nix-build -o "$RESULT" check-refs.nix -A test4
 
 # test5 should succeed.
-nix-build -o $RESULT check-refs.nix -A test5
+nix-build -o "$RESULT" check-refs.nix -A test5
 
 # test6 should fail (unallowed self-ref).
-(! nix-build -o $RESULT check-refs.nix -A test6)
+(! nix-build -o "$RESULT" check-refs.nix -A test6)
 
 # test7 should succeed (allowed self-ref).
-nix-build -o $RESULT check-refs.nix -A test7
+nix-build -o "$RESULT" check-refs.nix -A test7
 
 # test8 should fail (toFile depending on derivation output).
-(! nix-build -o $RESULT check-refs.nix -A test8)
+(! nix-build -o "$RESULT" check-refs.nix -A test8)
 
 # test9 should fail (disallowed reference).
-(! nix-build -o $RESULT check-refs.nix -A test9)
+(! nix-build -o "$RESULT" check-refs.nix -A test9)
 
 # test10 should succeed (no disallowed references).
-nix-build -o $RESULT check-refs.nix -A test10
+nix-build -o "$RESULT" check-refs.nix -A test10
 
 if isDaemonNewer 2.12pre20230103; then
     if ! isDaemonNewer 2.16.0; then
@@ -50,6 +50,6 @@ if isDaemonNewer 2.12pre20230103; then
     fi
 
     # test11 should succeed.
-    test11=$(nix-build -o $RESULT check-refs.nix -A test11)
+    test11=$(nix-build -o "$RESULT" check-refs.nix -A test11)
     [[ -z $(nix-store -q --references "$test11") ]]
 fi

tests/functional/check-reqs.sh

@@ -6,13 +6,13 @@ clearStore
 
 RESULT=$TEST_ROOT/result
 
-nix-build -o $RESULT check-reqs.nix -A test1
+nix-build -o "$RESULT" check-reqs.nix -A test1
 
-(! nix-build -o $RESULT check-reqs.nix -A test2)
+(! nix-build -o "$RESULT" check-reqs.nix -A test2)
-(! nix-build -o $RESULT check-reqs.nix -A test3)
+(! nix-build -o "$RESULT" check-reqs.nix -A test3)
-(! nix-build -o $RESULT check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep1'
+(! nix-build -o "$RESULT" check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep1'
-(! nix-build -o $RESULT check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep2'
+(! nix-build -o "$RESULT" check-reqs.nix -A test4) 2>&1 | grepQuiet 'check-reqs-dep2'
-(! nix-build -o $RESULT check-reqs.nix -A test5)
+(! nix-build -o "$RESULT" check-reqs.nix -A test5)
-(! nix-build -o $RESULT check-reqs.nix -A test6)
+(! nix-build -o "$RESULT" check-reqs.nix -A test6)
 
-nix-build -o $RESULT check-reqs.nix -A test7
+nix-build -o "$RESULT" check-reqs.nix -A test7

tests/functional/chroot-store.sh

@@ -2,34 +2,34 @@
 
 source common.sh
 
-echo example > $TEST_ROOT/example.txt
+echo example > "$TEST_ROOT"/example.txt
-mkdir -p $TEST_ROOT/x
+mkdir -p "$TEST_ROOT/x"
 
 export NIX_STORE_DIR=/nix2/store
 
-CORRECT_PATH=$(cd $TEST_ROOT && nix-store --store ./x --add example.txt)
+CORRECT_PATH=$(cd "$TEST_ROOT" && nix-store --store ./x --add example.txt)
 
 [[ $CORRECT_PATH =~ ^/nix2/store/.*-example.txt$ ]]
 
-PATH1=$(cd $TEST_ROOT && nix path-info --store ./x $CORRECT_PATH)
+PATH1=$(cd "$TEST_ROOT" && nix path-info --store ./x "$CORRECT_PATH")
-[ $CORRECT_PATH == $PATH1 ]
+[ "$CORRECT_PATH" == "$PATH1" ]
 
-PATH2=$(nix path-info --store "$TEST_ROOT/x" $CORRECT_PATH)
+PATH2=$(nix path-info --store "$TEST_ROOT/x" "$CORRECT_PATH")
-[ $CORRECT_PATH == $PATH2 ]
+[ "$CORRECT_PATH" == "$PATH2" ]
 
-PATH3=$(nix path-info --store "local?root=$TEST_ROOT/x" $CORRECT_PATH)
+PATH3=$(nix path-info --store "local?root=$TEST_ROOT/x" "$CORRECT_PATH")
-[ $CORRECT_PATH == $PATH3 ]
+[ "$CORRECT_PATH" == "$PATH3" ]
 
 # Ensure store info trusted works with local store
-nix --store $TEST_ROOT/x store info --json | jq -e '.trusted'
+nix --store "$TEST_ROOT/x" store info --json | jq -e '.trusted'
 
 # Test building in a chroot store.
 if canUseSandbox; then
 
     flakeDir=$TEST_ROOT/flake
-    mkdir -p $flakeDir
+    mkdir -p "$flakeDir"
 
-    cat > $flakeDir/flake.nix <<EOF
+    cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = inputs: rec {
     packages.$system.default = import ./simple.nix;
@@ -37,11 +37,12 @@ if canUseSandbox; then
 }
 EOF
 
-    cp simple.nix shell.nix simple.builder.sh config.nix $flakeDir/
+    cp simple.nix shell.nix simple.builder.sh config.nix "$flakeDir/"
 
-    outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store $TEST_ROOT/x path:$flakeDir)
+    outPath=$(nix build --print-out-paths --no-link --sandbox-paths '/nix? /bin? /lib? /lib64? /usr?' --store "$TEST_ROOT/x" path:"$flakeDir")
 
     [[ $outPath =~ ^/nix2/store/.*-simple$ ]]
 
-    [[ $(cat $TEST_ROOT/x/nix/store/$(basename $outPath)/hello) = 'Hello World!' ]]
+    base=$(basename "$outPath")
+    [[ $(cat "$TEST_ROOT"/x/nix/store/"$base"/hello) = 'Hello World!' ]]
 fi

tests/functional/common/init.sh

@@ -13,7 +13,7 @@ mkdir "$TEST_HOME"
 
 mkdir "$NIX_STORE_DIR"
 mkdir "$NIX_LOCALSTATE_DIR"
-mkdir -p "$NIX_LOG_DIR"/drvs
+mkdir -p "$NIX_LOG_DIR/drvs"
 mkdir "$NIX_STATE_DIR"
 mkdir "$NIX_CONF_DIR"
 

tests/functional/compression-levels.sh

@@ -9,16 +9,16 @@ outPath=$(nix-build dependencies.nix --no-out-link)
 
 cacheURI="file://$cacheDir?compression=xz&compression-level=0"
 
-nix copy --to $cacheURI $outPath
+nix copy --to "$cacheURI" "$outPath"
 
-FILESIZES=$(cat ${cacheDir}/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
+FILESIZES=$(cat "${cacheDir}"/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
 
 clearCache
 
 cacheURI="file://$cacheDir?compression=xz&compression-level=5"
 
-nix copy --to $cacheURI $outPath
+nix copy --to "$cacheURI" "$outPath"
 
-FILESIZES2=$(cat ${cacheDir}/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
+FILESIZES2=$(cat "${cacheDir}"/*.narinfo | awk '/FileSize: /{sum+=$2}END{print sum}')
 
 [[ $FILESIZES -gt $FILESIZES2 ]]

tests/functional/dependencies.sh

@@ -33,7 +33,7 @@ nix-store -q --tree "$outPath" | grep '───.*dependencies-input-2'
 
 echo "output path is $outPath"
 
-text=$(cat "$outPath"/foobar)
+text=$(cat "$outPath/foobar")
 if test "$text" != "FOOBAR"; then exit 1; fi
 
 deps=$(nix-store -quR "$drvPath")

tests/functional/derivation-json.sh

@@ -4,11 +4,11 @@ source common.sh
 
 drvPath=$(nix-instantiate simple.nix)
 
-nix derivation show $drvPath | jq .[] > $TEST_HOME/simple.json
+nix derivation show "$drvPath" | jq .[] > "$TEST_HOME"/simple.json
 
-drvPath2=$(nix derivation add < $TEST_HOME/simple.json)
+drvPath2=$(nix derivation add < "$TEST_HOME"/simple.json)
 
 [[ "$drvPath" = "$drvPath2" ]]
 
 # Input addressed derivations cannot be renamed.
-jq '.name = "foo"' < $TEST_HOME/simple.json | expectStderr 1 nix derivation add | grepQuiet "has incorrect output"
+jq '.name = "foo"' < "$TEST_HOME"/simple.json | expectStderr 1 nix derivation add | grepQuiet "has incorrect output"

tests/functional/dyn-drv/text-hashed-output.sh

@@ -20,7 +20,7 @@ nix show-derivation "$drvProducingDrv"
 
 out1=$(nix-build ./text-hashed-output.nix -A producingDrv --no-out-link)
 
-nix path-info $drv --derivation --json | jq
+nix path-info "$drv" --derivation --json | jq
-nix path-info $out1 --derivation --json | jq
+nix path-info "$out1" --derivation --json | jq
 
-test $out1 == $drv
+test "$out1" == "$drv"

tests/functional/experimental-features.sh

@@ -33,35 +33,35 @@ source common.sh
 NIX_CONFIG='
   experimental-features = nix-command
   accept-flake-config = true
-' expect 1 nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' expect 1 nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
-[[ $(cat $TEST_ROOT/stdout) = '' ]]
+[[ $(cat "$TEST_ROOT/stdout") = '' ]]
-grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" $TEST_ROOT/stderr
+grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" "$TEST_ROOT/stderr"
-grepQuiet "error: could not find setting 'accept-flake-config'" $TEST_ROOT/stderr
+grepQuiet "error: could not find setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 # 'flakes' experimental-feature is disabled after, ignore and warn
 NIX_CONFIG='
   accept-flake-config = true
   experimental-features = nix-command
-' expect 1 nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' expect 1 nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
-[[ $(cat $TEST_ROOT/stdout) = '' ]]
+[[ $(cat "$TEST_ROOT/stdout") = '' ]]
-grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" $TEST_ROOT/stderr
+grepQuiet "Ignoring setting 'accept-flake-config' because experimental feature 'flakes' is not enabled" "$TEST_ROOT/stderr"
-grepQuiet "error: could not find setting 'accept-flake-config'" $TEST_ROOT/stderr
+grepQuiet "error: could not find setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 # 'flakes' experimental-feature is enabled before, process
 NIX_CONFIG='
   experimental-features = nix-command flakes
   accept-flake-config = true
-' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
-grepQuiet "true" $TEST_ROOT/stdout
+grepQuiet "true" "$TEST_ROOT/stdout"
-grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
+grepQuietInverse "Ignoring setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 # 'flakes' experimental-feature is enabled after, process
 NIX_CONFIG='
   accept-flake-config = true
   experimental-features = nix-command flakes
-' nix config show accept-flake-config 1>$TEST_ROOT/stdout 2>$TEST_ROOT/stderr
+' nix config show accept-flake-config 1>"$TEST_ROOT"/stdout 2>"$TEST_ROOT"/stderr
-grepQuiet "true" $TEST_ROOT/stdout
+grepQuiet "true" "$TEST_ROOT/stdout"
-grepQuietInverse "Ignoring setting 'accept-flake-config'" $TEST_ROOT/stderr
+grepQuietInverse "Ignoring setting 'accept-flake-config'" "$TEST_ROOT/stderr"
 
 function exit_code_both_ways {
     expect 1 nix --experimental-features 'nix-command' "$@" 1>/dev/null

tests/functional/fetchGitRefs.sh

@@ -14,7 +14,7 @@ git init "$repo"
 git -C "$repo" config user.email "foobar@example.com"
 git -C "$repo" config user.name "Foobar"
 
-echo utrecht > "$repo"/hello
+echo utrecht > "$repo/hello"
 git -C "$repo" add hello
 git -C "$repo" commit -m 'Bla1'
 

tests/functional/fetchPath.sh

@@ -2,7 +2,7 @@
 
 source common.sh
 
-touch $TEST_ROOT/foo -t 202211111111
+touch "$TEST_ROOT/foo" -t 202211111111
 # We only check whether 2022-11-1* **:**:** is the last modified date since
 # `lastModified` is transformed into UTC in `builtins.fetchTarball`.
 [[ "$(nix eval --impure --raw --expr "(builtins.fetchTree \"path://$TEST_ROOT/foo\").lastModifiedDate")" =~ 2022111.* ]]

tests/functional/fetchTree-file.sh

@@ -90,7 +90,7 @@ EOF
 EOF
 
     # Test tarball URLs on the command line.
-    [[ $(nix flake metadata --json file://$PWD/test_input_no_ext | jq -r .resolved.type) = tarball ]]
+    [[ $(nix flake metadata --json "file://$PWD/test_input_no_ext" | jq -r .resolved.type) = tarball ]]
 
     popd
 

tests/functional/filter-source.sh

@@ -2,26 +2,26 @@
 
 source common.sh
 
-rm -rf $TEST_ROOT/filterin
+rm -rf "$TEST_ROOT/filterin"
-mkdir $TEST_ROOT/filterin
+mkdir "$TEST_ROOT/filterin"
-mkdir $TEST_ROOT/filterin/foo
+mkdir "$TEST_ROOT/filterin/foo"
-touch $TEST_ROOT/filterin/foo/bar
+touch "$TEST_ROOT/filterin/foo/bar"
-touch $TEST_ROOT/filterin/xyzzy
+touch "$TEST_ROOT/filterin/xyzzy"
-touch $TEST_ROOT/filterin/b
+touch "$TEST_ROOT/filterin/b"
-touch $TEST_ROOT/filterin/bak
+touch "$TEST_ROOT/filterin/bak"
-touch $TEST_ROOT/filterin/bla.c.bak
+touch "$TEST_ROOT"/filterin/bla.c.bak
-ln -s xyzzy $TEST_ROOT/filterin/link
+ln -s xyzzy "$TEST_ROOT/filterin/link"
 
 checkFilter() {
-    test ! -e $1/foo/bar
+    test ! -e "$1/foo/bar"
-    test -e $1/xyzzy
+    test -e "$1/xyzzy"
-    test -e $1/bak
+    test -e "$1/bak"
-    test ! -e $1/bla.c.bak
+    test ! -e "$1"/bla.c.bak
-    test ! -L $1/link
+    test ! -L "$1/link"
 }
 
-nix-build ./filter-source.nix -o $TEST_ROOT/filterout1
+nix-build ./filter-source.nix -o "$TEST_ROOT/filterout1"
-checkFilter $TEST_ROOT/filterout1
+checkFilter "$TEST_ROOT/filterout1"
 
-nix-build ./path.nix -o $TEST_ROOT/filterout2
+nix-build ./path.nix -o "$TEST_ROOT/filterout2"
-checkFilter $TEST_ROOT/filterout2
+checkFilter "$TEST_ROOT/filterout2"

tests/functional/flakes/absolute-attr-paths.sh

@@ -4,8 +4,8 @@ source ./common.sh
 
 flake1Dir=$TEST_ROOT/flake1
 
-mkdir -p $flake1Dir
+mkdir -p "$flake1Dir"
-cat > $flake1Dir/flake.nix <<EOF
+cat > "$flake1Dir"/flake.nix <<EOF
 {
     outputs = { self }: {
         x = 1;
@@ -14,6 +14,6 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-[ "$(nix eval --impure --json $flake1Dir#.x)" -eq 1 ]
+[ "$(nix eval --impure --json "$flake1Dir"#.x)" -eq 1 ]
-[ "$(nix eval --impure --json $flake1Dir#x)" -eq 2 ]
+[ "$(nix eval --impure --json "$flake1Dir#x")" -eq 2 ]
-[ "$(nix eval --impure --json $flake1Dir#.packages.$system.x)" -eq 2 ]
+[ "$(nix eval --impure --json "$flake1Dir"#.packages."$system".x)" -eq 2 ]

tests/functional/flakes/build-paths.sh

@@ -5,15 +5,15 @@ source ./common.sh
 flake1Dir=$TEST_ROOT/flake1
 flake2Dir=$TEST_ROOT/flake2
 
-mkdir -p $flake1Dir $flake2Dir
+mkdir -p "$flake1Dir" "$flake2Dir"
 
-writeSimpleFlake $flake2Dir
+writeSimpleFlake "$flake2Dir"
-tar cfz $TEST_ROOT/flake.tar.gz -C $TEST_ROOT flake2
+tar cfz "$TEST_ROOT"/flake.tar.gz -C "$TEST_ROOT" flake2
-hash=$(nix hash path $flake2Dir)
+hash=$(nix hash path "$flake2Dir")
 
 dep=$(nix store add-path ./common.sh)
 
-cat > $flake1Dir/flake.nix <<EOF
+cat > "$flake1Dir"/flake.nix <<EOF
 {
   inputs.flake2.url = "file://$TEST_ROOT/flake.tar.gz";
 
@@ -79,43 +79,43 @@ cat > $flake1Dir/flake.nix <<EOF
 }
 EOF
 
-cp ../simple.nix ../simple.builder.sh ../config.nix $flake1Dir/
+cp ../simple.nix ../simple.builder.sh ../config.nix "$flake1Dir/"
 
-echo bar > $flake1Dir/foo
+echo bar > "$flake1Dir/foo"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a1
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a1"
 [[ -e $TEST_ROOT/result/simple.nix ]]
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a2
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a2"
-[[ $(cat $TEST_ROOT/result) = bar ]]
+[[ $(cat "$TEST_ROOT/result") = bar ]]
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a3
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a3"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a4
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a4"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a6
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a6"
 [[ -e $TEST_ROOT/result/simple.nix ]]
 
-nix build --impure --json --out-link $TEST_ROOT/result $flake1Dir#a8
+nix build --impure --json --out-link "$TEST_ROOT/result" "$flake1Dir#a8"
-diff common.sh $TEST_ROOT/result
+diff common.sh "$TEST_ROOT/result"
 
-expectStderr 1 nix build --impure --json --out-link $TEST_ROOT/result $flake1Dir#a9 \
+expectStderr 1 nix build --impure --json --out-link "$TEST_ROOT/result" "$flake1Dir#a9" \
   | grepQuiet "has 0 entries in its context. It should only have exactly one entry"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a10
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir"#a10
-[[ $(readlink -e $TEST_ROOT/result) = *simple.drv ]]
+[[ $(readlink -e "$TEST_ROOT/result") = *simple.drv ]]
 
-expectStderr 1 nix build --json --out-link $TEST_ROOT/result $flake1Dir#a11 \
+expectStderr 1 nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a11" \
   | grepQuiet "has a context which refers to a complete source and binary closure"
 
-nix build --json --out-link $TEST_ROOT/result $flake1Dir#a12
+nix build --json --out-link "$TEST_ROOT/result" "$flake1Dir#a12"
 [[ -e $TEST_ROOT/result/hello ]]
 
-expectStderr 1 nix build --impure --json --out-link $TEST_ROOT/result $flake1Dir#a13 \
+expectStderr 1 nix build --impure --json --out-link "$TEST_ROOT/result" "$flake1Dir#a13" \
   | grepQuiet "has 2 entries in its context. It should only have exactly one entry"
 
 # Test accessing output in installables with `.` (foobarbaz.<output>)
-nix build --json --no-link $flake1Dir#a14.foo | jq --exit-status '
+nix build --json --no-link "$flake1Dir"#a14.foo | jq --exit-status '
   (.[0] |
     (.drvPath | match(".*dot-installable.drv")) and
     (.outputs | keys == ["foo"]))

tests/functional/flakes/bundle.sh

@@ -2,9 +2,9 @@
 
 source common.sh
 
-cp ../simple.nix ../simple.builder.sh ../config.nix $TEST_HOME
+cp ../simple.nix ../simple.builder.sh ../config.nix "$TEST_HOME"
 
-cd $TEST_HOME
+cd "$TEST_HOME"
 
 cat <<EOF > flake.nix
 {
@@ -27,8 +27,8 @@ EOF
 
 nix build .#
 nix bundle --bundler .# .#
-nix bundle --bundler .#bundlers.$system.default .#packages.$system.default
+nix bundle --bundler .#bundlers."$system".default .#packages."$system".default
-nix bundle --bundler .#bundlers.$system.simple  .#packages.$system.default
+nix bundle --bundler .#bundlers."$system".simple  .#packages."$system".default
 
-nix bundle --bundler .#bundlers.$system.default .#apps.$system.default
+nix bundle --bundler .#bundlers."$system".default .#apps."$system".default
-nix bundle --bundler .#bundlers.$system.simple  .#apps.$system.default
+nix bundle --bundler .#bundlers."$system".simple  .#apps."$system".default

tests/functional/flakes/circular.sh

@@ -8,10 +8,10 @@ requireGit
 flakeA=$TEST_ROOT/flakeA
 flakeB=$TEST_ROOT/flakeB
 
-createGitRepo $flakeA
+createGitRepo "$flakeA"
-createGitRepo $flakeB
+createGitRepo "$flakeB"
 
-cat > $flakeA/flake.nix <<EOF
+cat > "$flakeA"/flake.nix <<EOF
 {
   inputs.b.url = git+file://$flakeB;
   inputs.b.inputs.a.follows = "/";
@@ -23,9 +23,9 @@ cat > $flakeA/flake.nix <<EOF
 }
 EOF
 
-git -C $flakeA add flake.nix
+git -C "$flakeA" add flake.nix
 
-cat > $flakeB/flake.nix <<EOF
+cat > "$flakeB"/flake.nix <<EOF
 {
   inputs.a.url = git+file://$flakeA;
 
@@ -35,18 +35,18 @@ cat > $flakeB/flake.nix <<EOF
 }
 EOF
 
-git -C $flakeB add flake.nix
+git -C "$flakeB" add flake.nix
-git -C $flakeB commit -a -m 'Foo'
+git -C "$flakeB" commit -a -m 'Foo'
 
-[[ $(nix eval $flakeA#foo) = 1579 ]]
+[[ $(nix eval "$flakeA#foo") = 1579 ]]
-[[ $(nix eval $flakeA#foo) = 1579 ]]
+[[ $(nix eval "$flakeA#foo") = 1579 ]]
 
-sed -i $flakeB/flake.nix -e 's/456/789/'
+sed -i "$flakeB"/flake.nix -e 's/456/789/'
-git -C $flakeB commit -a -m 'Foo'
+git -C "$flakeB" commit -a -m 'Foo'
 
-nix flake update b --flake $flakeA
+nix flake update b --flake "$flakeA"
-[[ $(nix eval $flakeA#foo) = 1912 ]]
+[[ $(nix eval "$flakeA#foo") = 1912 ]]
 
 # Test list-inputs with circular dependencies
-nix flake metadata $flakeA
+nix flake metadata "$flakeA"
 

tests/functional/flakes/flake-in-submodule.sh

@@ -27,8 +27,8 @@ rootRepo=$TEST_ROOT/rootRepo
 subRepo=$TEST_ROOT/submodule
 
 
-createGitRepo $subRepo
+createGitRepo "$subRepo"
-cat > $subRepo/flake.nix <<EOF
+cat > "$subRepo"/flake.nix <<EOF
 {
     outputs = { self }: {
         sub = import ./sub.nix;
@@ -36,28 +36,28 @@ cat > $subRepo/flake.nix <<EOF
     };
 }
 EOF
-echo '"expression in submodule"' > $subRepo/sub.nix
+echo '"expression in submodule"' > "$subRepo"/sub.nix
-git -C $subRepo add flake.nix sub.nix
+git -C "$subRepo" add flake.nix sub.nix
-git -C $subRepo commit -m Initial
+git -C "$subRepo" commit -m Initial
 
-createGitRepo $rootRepo
+createGitRepo "$rootRepo"
 
-git -C $rootRepo submodule init
+git -C "$rootRepo" submodule init
-git -C $rootRepo submodule add $subRepo submodule
+git -C "$rootRepo" submodule add "$subRepo" submodule
-echo '"expression in root repo"' > $rootRepo/root.nix
+echo '"expression in root repo"' > "$rootRepo"/root.nix
-git -C $rootRepo add root.nix
+git -C "$rootRepo" add root.nix
-git -C $rootRepo commit -m "Add root.nix"
+git -C "$rootRepo" commit -m "Add root.nix"
 
 flakeref=git+file://$rootRepo\?submodules=1\&dir=submodule
 
 # Flake can live inside a submodule and can be accessed via ?dir=submodule
-[[ $(nix eval --json $flakeref#sub ) = '"expression in submodule"' ]]
+[[ $(nix eval --json "$flakeref#sub" ) = '"expression in submodule"' ]]
 
 # The flake can access content outside of the submodule
-[[ $(nix eval --json $flakeref#root ) = '"expression in root repo"' ]]
+[[ $(nix eval --json "$flakeref#root" ) = '"expression in root repo"' ]]
 
 # Check that dirtying a submodule makes the entire thing dirty.
-[[ $(nix flake metadata --json $flakeref | jq -r .locked.rev) != null ]]
+[[ $(nix flake metadata --json "$flakeref" | jq -r .locked.rev) != null ]]
-echo '"foo"' > $rootRepo/submodule/sub.nix
+echo '"foo"' > "$rootRepo"/submodule/sub.nix
-[[ $(nix eval --json $flakeref#sub ) = '"foo"' ]]
+[[ $(nix eval --json "$flakeref#sub" ) = '"foo"' ]]
-[[ $(nix flake metadata --json $flakeref | jq -r .locked.rev) = null ]]
+[[ $(nix flake metadata --json "$flakeref" | jq -r .locked.rev) = null ]]

tests/functional/flakes/init.sh

@@ -8,16 +8,16 @@ templatesDir=$TEST_ROOT/templates
 flakeDir=$TEST_ROOT/flake
 nixpkgsDir=$TEST_ROOT/nixpkgs
 
-nix registry add --registry $registry templates git+file://$templatesDir
+nix registry add --registry "$registry" templates "git+file://$templatesDir"
-nix registry add --registry $registry nixpkgs git+file://$nixpkgsDir
+nix registry add --registry "$registry" nixpkgs "git+file://$nixpkgsDir"
 
-createGitRepo $nixpkgsDir
+createGitRepo "$nixpkgsDir"
-createSimpleGitFlake $nixpkgsDir
+createSimpleGitFlake "$nixpkgsDir"
 
 # Test 'nix flake init'.
-createGitRepo $templatesDir
+createGitRepo "$templatesDir"
 
-cat > $templatesDir/flake.nix <<EOF
+cat > "$templatesDir"/flake.nix <<EOF
 {
   description = "Some templates";
 
@@ -36,9 +36,9 @@ cat > $templatesDir/flake.nix <<EOF
 }
 EOF
 
-mkdir $templatesDir/trivial
+mkdir "$templatesDir/trivial"
 
-cat > $templatesDir/trivial/flake.nix <<EOF
+cat > "$templatesDir"/trivial/flake.nix <<EOF
 {
   description = "A flake for building Hello World";
 
@@ -50,40 +50,40 @@ cat > $templatesDir/trivial/flake.nix <<EOF
   };
 }
 EOF
-echo a > $templatesDir/trivial/a
+echo a > "$templatesDir/trivial/a"
-echo b > $templatesDir/trivial/b
+echo b > "$templatesDir/trivial/b"
 
-git -C $templatesDir add flake.nix trivial/
+git -C "$templatesDir" add flake.nix trivial/
-git -C $templatesDir commit -m 'Initial'
+git -C "$templatesDir" commit -m 'Initial'
 
 nix flake check templates
 nix flake show templates
 nix flake show templates --json | jq
 
-createGitRepo $flakeDir
+createGitRepo "$flakeDir"
-(cd $flakeDir && nix flake init)
+(cd "$flakeDir" && nix flake init)
-(cd $flakeDir && nix flake init) # check idempotence
+(cd "$flakeDir" && nix flake init) # check idempotence
-git -C $flakeDir add flake.nix
+git -C "$flakeDir" add flake.nix
-nix flake check $flakeDir
+nix flake check "$flakeDir"
-nix flake show $flakeDir
+nix flake show "$flakeDir"
-nix flake show $flakeDir --json | jq
+nix flake show "$flakeDir" --json | jq
-git -C $flakeDir commit -a -m 'Initial'
+git -C "$flakeDir" commit -a -m 'Initial'
 
 # Test 'nix flake init' with benign conflicts
 createGitRepo "$flakeDir"
-echo a > $flakeDir/a
+echo a > "$flakeDir/a"
-(cd $flakeDir && nix flake init) # check idempotence
+(cd "$flakeDir" && nix flake init) # check idempotence
 
 # Test 'nix flake init' with conflicts
 createGitRepo "$flakeDir"
-echo b > $flakeDir/a
+echo b > "$flakeDir/a"
-pushd $flakeDir
+pushd "$flakeDir"
 (! nix flake init) |& grep "refusing to overwrite existing file '$flakeDir/a'"
 popd
-git -C $flakeDir commit -a -m 'Changed'
+git -C "$flakeDir" commit -a -m 'Changed'
 
 # Test 'nix flake new'.
-rm -rf $flakeDir
+rm -rf "$flakeDir"
-nix flake new -t templates#trivial $flakeDir
+nix flake new -t templates#trivial "$flakeDir"
-nix flake new -t templates#trivial $flakeDir # check idempotence
+nix flake new -t templates#trivial "$flakeDir" # check idempotence
-nix flake check $flakeDir
+nix flake check "$flakeDir"

tests/functional/flakes/inputs.sh

@@ -8,12 +8,12 @@ requireGit
 test_subdir_self_path() {
     baseDir=$TEST_ROOT/$RANDOM
     flakeDir=$baseDir/b-low
-    mkdir -p $flakeDir
+    mkdir -p "$flakeDir"
-    writeSimpleFlake $baseDir
+    writeSimpleFlake "$baseDir"
-    writeSimpleFlake $flakeDir
+    writeSimpleFlake "$flakeDir"
 
-    echo all good > $flakeDir/message
+    echo all good > "$flakeDir/message"
-    cat > $flakeDir/flake.nix <<EOF
+    cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = inputs: rec {
     packages.$system = rec {
@@ -26,7 +26,7 @@ test_subdir_self_path() {
 }
 EOF
     (
-        nix build $baseDir?dir=b-low --no-link
+        nix build "$baseDir"?dir=b-low --no-link
     )
 }
 test_subdir_self_path
@@ -34,14 +34,14 @@ test_subdir_self_path
 
 test_git_subdir_self_path() {
     repoDir=$TEST_ROOT/repo-$RANDOM
-    createGitRepo $repoDir
+    createGitRepo "$repoDir"
     flakeDir=$repoDir/b-low
-    mkdir -p $flakeDir
+    mkdir -p "$flakeDir"
-    writeSimpleFlake $repoDir
+    writeSimpleFlake "$repoDir"
-    writeSimpleFlake $flakeDir
+    writeSimpleFlake "$flakeDir"
 
-    echo all good > $flakeDir/message
+    echo all good > "$flakeDir/message"
-    cat > $flakeDir/flake.nix <<EOF
+    cat > "$flakeDir"/flake.nix <<EOF
 {
   outputs = inputs: rec {
     packages.$system = rec {
@@ -55,15 +55,15 @@ test_git_subdir_self_path() {
 }
 EOF
     (
-        cd $flakeDir
+        cd "$flakeDir"
         git add .
         git commit -m init
         # nix build
     )
 
     clientDir=$TEST_ROOT/client-$RANDOM
-    mkdir -p $clientDir
+    mkdir -p "$clientDir"
-    cat > $clientDir/flake.nix <<EOF
+    cat > "$clientDir"/flake.nix <<EOF
 {
   inputs.inp = {
     type = "git";
@@ -76,7 +76,7 @@ EOF
   };
 }
 EOF
-    nix build $clientDir --no-link
+    nix build "$clientDir" --no-link
 
 }
 test_git_subdir_self_path

tests/functional/flakes/mercurial.sh

@@ -5,41 +5,41 @@ source ./common.sh
 [[ $(type -p hg) ]] || skipTest "Mercurial not installed"
 
 flake1Dir=$TEST_ROOT/flake-hg1
-mkdir -p $flake1Dir
+mkdir -p "$flake1Dir"
-writeSimpleFlake $flake1Dir
+writeSimpleFlake "$flake1Dir"
-hg init $flake1Dir
+hg init "$flake1Dir"
 
-nix registry add --registry $registry flake1 hg+file://$flake1Dir
+nix registry add --registry "$registry" flake1 "hg+file://$flake1Dir"
 
 flake2Dir=$TEST_ROOT/flake-hg2
-mkdir -p $flake2Dir
+mkdir -p "$flake2Dir"
-writeDependentFlake $flake2Dir
+writeDependentFlake "$flake2Dir"
-hg init $flake2Dir
+hg init "$flake2Dir"
 
-hg add $flake1Dir/*
+hg add "$flake1Dir"/*
-hg commit --config ui.username=foobar@example.org $flake1Dir -m 'Initial commit'
+hg commit --config ui.username=foobar@example.org "$flake1Dir" -m 'Initial commit'
 
-hg add $flake2Dir/flake.nix
+hg add "$flake2Dir"/flake.nix
-hg commit --config ui.username=foobar@example.org $flake2Dir -m 'Initial commit'
+hg commit --config ui.username=foobar@example.org "$flake2Dir" -m 'Initial commit'
 
-nix build -o $TEST_ROOT/result hg+file://$flake2Dir
+nix build -o "$TEST_ROOT/result" "hg+file://$flake2Dir"
 [[ -e $TEST_ROOT/result/hello ]]
 
-(! nix flake metadata --json hg+file://$flake2Dir | jq -e -r .revision)
+(! nix flake metadata --json "hg+file://$flake2Dir" | jq -e -r .revision)
 
-nix eval hg+file://$flake2Dir#expr
+nix eval "hg+file://$flake2Dir"#expr
 
-nix eval hg+file://$flake2Dir#expr
+nix eval "hg+file://$flake2Dir"#expr
 
-(! nix eval hg+file://$flake2Dir#expr --no-allow-dirty)
+(! nix eval "hg+file://$flake2Dir"#expr --no-allow-dirty)
 
-(! nix flake metadata --json hg+file://$flake2Dir | jq -e -r .revision)
+(! nix flake metadata --json "hg+file://$flake2Dir" | jq -e -r .revision)
 
-hg commit --config ui.username=foobar@example.org $flake2Dir -m 'Add lock file'
+hg commit --config ui.username=foobar@example.org "$flake2Dir" -m 'Add lock file'
 
-nix flake metadata --json hg+file://$flake2Dir --refresh | jq -e -r .revision
+nix flake metadata --json "hg+file://$flake2Dir" --refresh | jq -e -r .revision
-nix flake metadata --json hg+file://$flake2Dir
+nix flake metadata --json "hg+file://$flake2Dir"
-[[ $(nix flake metadata --json hg+file://$flake2Dir | jq -e -r .revCount) = 1 ]]
+[[ $(nix flake metadata --json "hg+file://$flake2Dir" | jq -e -r .revCount) = 1 ]]
 
-nix build -o $TEST_ROOT/result hg+file://$flake2Dir --no-registries --no-allow-dirty
+nix build -o "$TEST_ROOT/result" "hg+file://$flake2Dir" --no-registries --no-allow-dirty
-nix build -o $TEST_ROOT/result hg+file://$flake2Dir --no-use-registries --no-allow-dirty
+nix build -o "$TEST_ROOT/result" "hg+file://$flake2Dir" --no-use-registries --no-allow-dirty

tests/functional/flakes/search-root.sh

@@ -4,8 +4,8 @@ source common.sh
 
 clearStore
 
-writeSimpleFlake $TEST_HOME
+writeSimpleFlake "$TEST_HOME"
-cd $TEST_HOME
+cd "$TEST_HOME"
 mkdir -p foo/subdir
 
 echo '{ outputs = _: {}; }' > foo/flake.nix
@@ -27,11 +27,11 @@ success=("" . .# .#test ../subdir ../subdir#test "$PWD")
 failure=("path:$PWD" "../simple.nix")
 
 for i in "${success[@]}"; do
-    nix build $i || fail "flake should be found by searching up directories"
+    nix build "$i" || fail "flake should be found by searching up directories"
 done
 
 for i in "${failure[@]}"; do
-    ! nix build $i || fail "flake should not search up directories when using 'path:'"
+    ! nix build "$i" || fail "flake should not search up directories when using 'path:'"
 done
 
 popd
@@ -45,7 +45,7 @@ if [[ -n $(type -p git) ]]; then
     pushd subdir
     git init
     for i in "${success[@]}" "${failure[@]}"; do
-        ! nix build $i || fail "flake should not search past a git repository"
+        ! nix build "$i" || fail "flake should not search past a git repository"
     done
     rm -rf .git
     popd

tests/functional/flakes/unlocked-override.sh

@@ -7,26 +7,26 @@ requireGit
 flake1Dir=$TEST_ROOT/flake1
 flake2Dir=$TEST_ROOT/flake2
 
-createGitRepo $flake1Dir
+createGitRepo "$flake1Dir"
-cat > $flake1Dir/flake.nix <<EOF
+cat > "$flake1Dir"/flake.nix <<EOF
 {
     outputs = { self }: { x = import ./x.nix; };
 }
 EOF
-echo 123 > $flake1Dir/x.nix
+echo 123 > "$flake1Dir"/x.nix
-git -C $flake1Dir add flake.nix x.nix
+git -C "$flake1Dir" add flake.nix x.nix
-git -C $flake1Dir commit -m Initial
+git -C "$flake1Dir" commit -m Initial
 
-createGitRepo $flake2Dir
+createGitRepo "$flake2Dir"
-cat > $flake2Dir/flake.nix <<EOF
+cat > "$flake2Dir"/flake.nix <<EOF
 {
     outputs = { self, flake1 }: { x = flake1.x; };
 }
 EOF
-git -C $flake2Dir add flake.nix
+git -C "$flake2Dir" add flake.nix
 
-[[ $(nix eval --json $flake2Dir#x --override-input flake1 $TEST_ROOT/flake1) = 123 ]]
+[[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 123 ]]
 
-echo 456 > $flake1Dir/x.nix
+echo 456 > "$flake1Dir"/x.nix
 
-[[ $(nix eval --json $flake2Dir#x --override-input flake1 $TEST_ROOT/flake1) = 456 ]]
+[[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]

tests/functional/function-trace.sh

@@ -21,12 +21,12 @@ expect_trace() {
                <(echo "$expect") \
                <(echo "$actual")
     ) && result=0 || result=$?
-    if [ $result -eq 0 ]; then
+    if [ "$result" -eq 0 ]; then
         echo " ok."
     else
         echo " failed. difference:"
         echo "$msg"
-        return $result
+        return "$result"
     fi
 }
 

tests/functional/gc-concurrent.sh

@@ -20,8 +20,8 @@ outPath3=$(nix-store -r $drvPath3)
 touch $outPath3.lock
 
 rm -f "$NIX_STATE_DIR"/gcroots/foo*
-ln -s $drvPath2 "$NIX_STATE_DIR"/gcroots/foo
+ln -s $drvPath2 "$NIX_STATE_DIR/gcroots/foo"
-ln -s $outPath3 "$NIX_STATE_DIR"/gcroots/foo2
+ln -s $outPath3 "$NIX_STATE_DIR/gcroots/foo2"
 
 # Start build #1 in the background.  It starts immediately.
 nix-store -rvv "$drvPath1" &

tests/functional/gc-runtime.sh

@@ -12,27 +12,27 @@ esac
 set -m # enable job control, needed for kill
 
 profiles="$NIX_STATE_DIR"/profiles
-rm -rf $profiles
+rm -rf "$profiles"
 
-nix-env -p $profiles/test -f ./gc-runtime.nix -i gc-runtime
+nix-env -p "$profiles/test" -f ./gc-runtime.nix -i gc-runtime
 
-outPath=$(nix-env -p $profiles/test -q --no-name --out-path gc-runtime)
+outPath=$(nix-env -p "$profiles/test" -q --no-name --out-path gc-runtime)
-echo $outPath
+echo "$outPath"
 
 echo "backgrounding program..."
-$profiles/test/program &
+"$profiles"/test/program &
 sleep 2 # hack - wait for the program to get started
 child=$!
 echo PID=$child
 
-nix-env -p $profiles/test -e gc-runtime
+nix-env -p "$profiles/test" -e gc-runtime
-nix-env -p $profiles/test --delete-generations old
+nix-env -p "$profiles/test" --delete-generations old
 
 nix-store --gc
 
 kill -- -$child
 
-if ! test -e $outPath; then
+if ! test -e "$outPath"; then
     echo "running program was garbage collected!"
     exit 1
 fi

tests/functional/gc.sh

@@ -8,8 +8,8 @@ drvPath=$(nix-instantiate dependencies.nix)
 outPath=$(nix-store -rvv "$drvPath")
 
 # Set a GC root.
-rm -f "$NIX_STATE_DIR"/gcroots/foo
+rm -f "$NIX_STATE_DIR/gcroots/foo"
-ln -sf $outPath "$NIX_STATE_DIR"/gcroots/foo
+ln -sf $outPath "$NIX_STATE_DIR/gcroots/foo"
 
 [ "$(nix-store -q --roots $outPath)" = "$NIX_STATE_DIR/gcroots/foo -> $outPath" ]
 
@@ -42,7 +42,7 @@ cat $outPath/reference-to-input-2/bar
 # Check that the derivation has been GC'd.
 if test -e $drvPath; then false; fi
 
-rm "$NIX_STATE_DIR"/gcroots/foo
+rm "$NIX_STATE_DIR/gcroots/foo"
 
 nix-collect-garbage
 

tests/functional/hash-path.sh

@@ -3,7 +3,7 @@
 source common.sh
 
 try () {
-    printf "%s" "$2" > $TEST_ROOT/vector
+    printf "%s" "$2" > "$TEST_ROOT/vector"
     hash="$(nix-hash --flat ${FORMAT+--$FORMAT} --type "$1" "$TEST_ROOT/vector")"
     if ! (( "${NO_TEST_CLASSIC-}" )) && test "$hash" != "$3"; then
         echo "try nix-hash: hash $1, expected $3, got $hash"
@@ -61,7 +61,7 @@ NO_TEST_NIX_COMMAND=1 try sha512 "abc" "ddaf35a193617abacc417349ae20413112e6fa4e
 NO_TEST_CLASSIC=1 try sha512 "abc" "sha512-3a81oZNherrMQXNJriBBMRLm+k6JqX6iCp7u5ktV05ohkpkqJ0/BqDa6PCOj/uu9RU1EI2Q86A4qmslPpUyknw=="
 
 try2 () {
-    hash=$(nix-hash --type "$1" $TEST_ROOT/hash-path)
+    hash=$(nix-hash --type "$1" "$TEST_ROOT/hash-path")
     if test "$hash" != "$2"; then
         echo "try nix-hash; hash $1, expected $2, got $hash"
         exit 1
@@ -73,22 +73,22 @@ try2 () {
     fi
 }
 
-rm -rf $TEST_ROOT/hash-path
+rm -rf "$TEST_ROOT/hash-path"
-mkdir $TEST_ROOT/hash-path
+mkdir "$TEST_ROOT/hash-path"
-echo "Hello World" > $TEST_ROOT/hash-path/hello
+echo "Hello World" > "$TEST_ROOT/hash-path/hello"
 
 try2 md5 "ea9b55537dd4c7e104515b2ccfaf4100"
 
 # Execute bit matters.
-chmod +x $TEST_ROOT/hash-path/hello
+chmod +x "$TEST_ROOT/hash-path/hello"
 try2 md5 "20f3ffe011d4cfa7d72bfabef7882836"
 
 # Mtime and other bits don't.
-touch -r . $TEST_ROOT/hash-path/hello
+touch -r . "$TEST_ROOT/hash-path/hello"
-chmod 744 $TEST_ROOT/hash-path/hello
+chmod 744 "$TEST_ROOT/hash-path/hello"
 try2 md5 "20f3ffe011d4cfa7d72bfabef7882836"
 
 # File type (e.g., symlink) does.
-rm $TEST_ROOT/hash-path/hello
+rm "$TEST_ROOT/hash-path/hello"
-ln -s x $TEST_ROOT/hash-path/hello
+ln -s x "$TEST_ROOT/hash-path/hello"
 try2 md5 "f78b733a68f5edbdf9413899339eaa4a"

tests/functional/import-derivation.sh

@@ -11,4 +11,4 @@ fi
 
 outPath=$(nix-build ./import-derivation.nix --no-out-link)
 
-[ "$(cat $outPath)" = FOO579 ]
+[ "$(cat "$outPath")" = FOO579 ]

tests/functional/local-overlay-store/gc-inner.sh

@@ -20,8 +20,8 @@ outPath=$(nix-build ../hermetic.nix --no-out-link --arg busybox "$busybox" --arg
 
 # Set a GC root.
 mkdir -p "$stateB"
-rm -f "$stateB"/gcroots/foo
+rm -f "$stateB/gcroots/foo"
-ln -sf $outPath "$stateB"/gcroots/foo
+ln -sf $outPath "$stateB/gcroots/foo"
 
 [ "$(nix-store -q --roots $outPath)" = "$stateB/gcroots/foo -> $outPath" ]
 
@@ -46,7 +46,7 @@ nix-collect-garbage
 # Check that the root and its dependencies haven't been deleted.
 cat "$storeBRoot/$outPath"
 
-rm "$stateB"/gcroots/foo
+rm "$stateB/gcroots/foo"
 
 nix-collect-garbage
 

tests/functional/multiple-outputs.sh

@@ -35,7 +35,7 @@ outPath=$(nix-store -q $drvPath)
 echo "building b..."
 outPath=$(nix-build multiple-outputs.nix -A b --no-out-link)
 echo "output path is $outPath"
-[ "$(cat "$outPath"/file)" = "success" ]
+[ "$(cat "$outPath/file")" = "success" ]
 
 # Test nix-build on a derivation with multiple outputs.
 outPath1=$(nix-build multiple-outputs.nix -A a -o $TEST_ROOT/result)

tests/functional/readfile-context.sh

@@ -7,7 +7,7 @@ clearStore
 outPath=$(nix-build --no-out-link readfile-context.nix)
 
 # Set a GC root.
-ln -s $outPath "$NIX_STATE_DIR"/gcroots/foo
+ln -s $outPath "$NIX_STATE_DIR/gcroots/foo"
 
 # Check that file exists.
 [ "$(cat $(cat $outPath))" = "Hello World!" ]

tests/functional/referrers.sh

@@ -31,7 +31,7 @@ echo "registering..."
 nix-store --register-validity < $TEST_ROOT/reg_info
 
 echo "collecting garbage..."
-ln -sfn $reference "$NIX_STATE_DIR"/gcroots/ref
+ln -sfn $reference "$NIX_STATE_DIR/gcroots/ref"
 nix-store --gc
 
 if [ -n "$(type -p sqlite3)" -a "$(sqlite3 $NIX_STATE_DIR/db/db.sqlite 'select count(*) from Refs')" -ne 0 ]; then

tests/functional/simple.sh

@@ -14,7 +14,7 @@ echo "output path is $outPath"
 
 (! [ -w $outPath ])
 
-text=$(cat "$outPath"/hello)
+text=$(cat "$outPath/hello")
 if test "$text" != "Hello World!"; then exit 1; fi
 
 # Directed delete: $outPath is not reachable from a root, so it should