app-shells/bash: support -readline properly, GLOBSORT protection, misc cleanups

Address a regression whereby the new initialisation files were composing
a PS1 prompt containing '\[' and '\]' for builds without readline
support. These sequences are normally used to denote sequences of
non-printing characters but are not treated specially unless readline
support is present. This came up 12 years ago as bug #432338. SpanKY's
solution at the time was to have the ebuild monkey-patch
/etc/bash/bashrc with sed, disabling colour support outright for the
USE="-readline" case. Unsurprisingly, moving the colour-related code to
a distinct bashrc.d snippet had prevented this method from being
effective.

After deliberating over the matter, I reached the conclusion that there
are already too many ebuilds containing overly brittle code of this
sort. Therefore, I decided to implement a runtime check instead.
Specifically, it is implemented as a trivial function, which works by
checking whether the direxpand shell option exists. This function is now
used in a twofold manner. Firstly, it is used to determine whether the
no_empty_cmd_completion and histappend shell options should be set in
etc/bash/bashrc (both of those require readline). Secondly, it it used
to determine whether the prompt should _not_ be colourised in
/etc/bash/bashrc.d/10-gentoo-color.bash, even in the case that the
terminal is understood to support colour.

Doing it this way has a few immediate benefits. No longer will colour
support be needlessly disabled outright; there was never any sense in
doing that. Instead, users that elect to compile bash without readline -
for whatever reason - may continue to enjoy full colour support with
only the prompt being rendered in monochrome. Moreover, the ebuild has
been simplified as a consequence of being able to completely drop the
section that defined sed_args before proceeding to clumsily modify
/etc/skel/.bashrc (with no effect, mind) and /etc/bash/bashrc.

Render /etc/bash/bashrc.d processing safer by unsetting the GLOBSORT
variable beforehand. This variable, which is introduced by
bash-5.3-alpha, allows for the user to affect the order in which words
occur as a result of pathname expansion. While there is no question that
the feature is useful, it must not be allowed to influence the order in
which files residing under /etc/bash/bashrc.d are processed. That is,
users must be able to expect that the files are processed in an order
that is based solely on the effective collation.

Remove st-256color from the list of terminals whitelisted for colour
support. There was no need for it to be there because it can already be
matched by the *color* globbing pattern.

The latest round of ebuilds have been cleaned up and should be slightly
easier to maintain from hereon. Further, they are now shellcheck-clean,
albeit with two warning categories having been disabled in the global
scope (so chosen because they aren't particularly helpful in the course
of evaluating ebuilds). Finally, version 9999 has been updated so as to
be abreast of these developments.

Signed-off-by: Kerin Millar <kfm@plushkava.net>
Signed-off-by: Sam James <sam@gentoo.org>

1 files changed, 148 insertions, 154 deletions

diff --git a/app-shells/bash/bash-9999.ebuild b/app-shells/bash/bash-9999.ebuild
index 036e48751a1f..0acd12385e07 100644
--- a/app-shells/bash/bash-9999.ebuild
+++ b/app-shells/bash/bash-9999.ebuild
@@ -1,91 +1,71 @@
 # Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
+# shellcheck shell=bash disable=2015,2034
 
 EAPI=8
 
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/chetramey.asc
 inherit flag-o-matic toolchain-funcs prefix verify-sig
 
-# Uncomment if we have a patchset
+# Uncomment if we have a patchset.
 #GENTOO_PATCH_DEV="sam"
 #GENTOO_PATCH_VER="${PV}"
 
-# Official patchlevel
-# See ftp://ftp.cwru.edu/pub/bash/bash-5.1-patches/
-PLEVEL="${PV##*_p}"
-MY_PV="${PV/_p*}"
-MY_PV="${MY_PV/_/-}"
-MY_P="${PN}-${MY_PV}"
+MY_PV=${PV/_p*}
+MY_PV=${MY_PV/_/-}
+MY_P=${PN}-${MY_PV}
 MY_PATCHES=()
 
-is_release() {
-	case ${PV} in
-		9999|*_alpha*|*_beta*|*_rc*)
-			return 1
-			;;
-		*)
-			return 0
-			;;
-	esac
-}
-
-[[ ${PV} != *_p* ]] && PLEVEL=0
-
-# The version of readline this bash normally ships with.
-# Note: right now, we don't use the system copy of readline for bash for non-releases.
+# Determine the patchlevel.
+case ${PV} in
+	*_p*)
+		PLEVEL=${PV##*_p}
+		;;
+	9999|*_alpha*|*_beta*|*_rc*)
+		# Set a negative patchlevel to indicate that it's a pre-release.
+		PLEVEL=-1
+		;;
+	*)
+		PLEVEL=0
+esac
+
+# The version of readline this bash normally ships with. Note that we only use
+# the bundled copy of readline for pre-releases.
 READLINE_VER="8.3_alpha"
 
 DESCRIPTION="The standard GNU Bourne again shell"
 HOMEPAGE="https://tiswww.case.edu/php/chet/bash/bashtop.html https://git.savannah.gnu.org/cgit/bash.git"
 
-if [[ ${PV} == 9999 ]] ; then
+if [[ ${PV} == 9999 ]]; then
 	EGIT_REPO_URI="https://git.savannah.gnu.org/git/bash.git"
 	EGIT_BRANCH=devel
 	inherit git-r3
-elif is_release ; then
-	SRC_URI="mirror://gnu/bash/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/bash/${MY_P}.tar.gz.sig )"
-
-	if [[ ${PLEVEL} -gt 0 ]] ; then
-		# bash-5.1 -> bash51
-		my_p=${PN}$(ver_rs 1-2 '' $(ver_cut 1-2))
-
-		patch_url=
-		my_patch_index=
-
-		upstream_url_base="mirror://gnu/bash"
-		mirror_url_base="ftp://ftp.cwru.edu/pub/bash"
-
-		for ((my_patch_index=1; my_patch_index <= ${PLEVEL} ; my_patch_index++)) ; do
-			printf -v mangled_patch_ver ${my_p}-%03d ${my_patch_index}
-			patch_url="${upstream_url_base}/${MY_P}-patches/${mangled_patch_ver}"
+else
+	my_urls=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}.tar.gz" )
 
-			SRC_URI+=" ${patch_url}"
-			SRC_URI+=" verify-sig? ( ${patch_url}.sig )"
+	# bash-5.1 -> bash51
+	my_p=${PN}$(ver_cut 1-2) my_p=${my_p/.}
 
-			# Add in the mirror URL too.
-			SRC_URI+=" ${patch_url/${upstream_url_base}/${mirror_url_base}}"
-			SRC_URI+=" verify-sig? ( ${patch_url/${upstream_url_base}/${mirror_url_base}}.sig )"
+	for (( my_patch_idx = 1; my_patch_idx <= PLEVEL; my_patch_idx++ )); do
+		printf -v my_patch_ver %s-%03d "${my_p}" "${my_patch_idx}"
+		my_urls+=( {'mirror://gnu/bash','ftp://ftp.cwru.edu/pub/bash'}/"${MY_P}-patches/${my_patch_ver}" )
+		MY_PATCHES+=( "${DISTDIR}/${my_patch_ver}" )
+	done
 
-			MY_PATCHES+=( "${DISTDIR}"/${mangled_patch_ver} )
-		done
+	SRC_URI="${my_urls[*]} verify-sig? ( ${my_urls[*]/%/.sig} )"
 
-		unset my_p patch_url my_patch_index upstream_url_base mirror_url_base
-	fi
-else
-	SRC_URI="mirror://gnu/${PN}/${MY_P}.tar.gz ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz"
-	SRC_URI+=" verify-sig? ( mirror://gnu/${PN}/${MY_P}.tar.gz.sig ftp://ftp.cwru.edu/pub/bash/${MY_P}.tar.gz.sig )"
+	unset -v my_urls my_p my_patch_idx my_patch_ver
 fi
 
-if [[ -n ${GENTOO_PATCH_VER} ]] ; then
-	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
+if [[ ${GENTOO_PATCH_VER} ]]; then
+	SRC_URI+=" https://dev.gentoo.org/~${GENTOO_PATCH_DEV:?}/distfiles/${CATEGORY}/${PN}/${PN}-${GENTOO_PATCH_VER:?}-patches.tar.xz"
 fi
 
-S="${WORKDIR}/${MY_P}"
+S=${WORKDIR}/${MY_P}
 
 LICENSE="GPL-3+"
 SLOT="0"
-if is_release ; then
+if (( PLEVEL >= 0 )); then
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="afs bashlogger examples mem-scramble +net nls plugins pgo +readline"
@@ -94,80 +74,84 @@ DEPEND="
 	>=sys-libs/ncurses-5.2-r2:=
 	nls? ( virtual/libintl )
 "
-if is_release ; then
+if (( PLEVEL >= 0 )); then
 	DEPEND+=" readline? ( >=sys-libs/readline-${READLINE_VER}:= )"
 fi
 RDEPEND="
 	${DEPEND}
 "
-# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011)
+# We only need bison (yacc) when the .y files get patched (bash42-005, bash51-011).
 BDEPEND="
 	pgo? ( dev-util/gperf )
 	verify-sig? ( sec-keys/openpgp-keys-chetramey )
 "
 
-# EAPI 8 tries to append it but it doesn't exist here
+# EAPI 8 tries to append it but it doesn't exist here.
 QA_CONFIGURE_OPTIONS="--disable-static"
 
 PATCHES=(
 	#"${WORKDIR}"/${PN}-${GENTOO_PATCH_VER}/
 
-	# Patches from Chet sent to bash-bug ml
-	"${FILESDIR}"/${PN}-5.0-syslog-history-extern.patch
+	# Patches to or from Chet, posted to the bug-bash mailing list.
+	"${FILESDIR}/${PN}-5.0-syslog-history-extern.patch"
 )
 
 pkg_setup() {
 	# bug #7332
-	if is-flag -malign-double ; then
+	if is-flag -malign-double; then
 		eerror "Detected bad CFLAGS '-malign-double'.  Do not use this"
 		eerror "as it breaks LFS (struct stat64) on x86."
 		die "remove -malign-double from your CFLAGS mr ricer"
 	fi
 
-	if use bashlogger ; then
+	if use bashlogger; then
 		ewarn "The logging patch should ONLY be used in restricted (i.e. honeypot) envs."
 		ewarn "This will log ALL output you enter into the shell, you have been warned."
 	fi
 }
 
 src_unpack() {
-	if [[ ${PV} == 9999 ]] ; then
+	local patch
+
+	if [[ ${PV} == 9999 ]]; then
 		git-r3_src_unpack
 	else
-		if use verify-sig ; then
-			verify-sig_verify_detached "${DISTDIR}"/${MY_P}.tar.gz{,.sig}
+		if use verify-sig; then
+			verify-sig_verify_detached "${DISTDIR}/${MY_P}.tar.gz"{,.sig}
 
-			local patch
-			for patch in "${MY_PATCHES[@]}" ; do
-				verify-sig_verify_detached ${patch}{,.sig}
+			for patch in "${MY_PATCHES[@]}"; do
+				verify-sig_verify_detached "${patch}"{,.sig}
 			done
 		fi
 
-		unpack ${MY_P}.tar.gz
+		unpack "${MY_P}.tar.gz"
 
-		if [[ -n ${GENTOO_PATCH_VER} ]] ; then
-			unpack ${PN}-${GENTOO_PATCH_VER}-patches.tar.xz
+		if [[ ${GENTOO_PATCH_VER} ]]; then
+			unpack "${PN}-${GENTOO_PATCH_VER}-patches.tar.xz"
 		fi
 	fi
 }
 
 src_prepare() {
-	# Include official patches
-	[[ ${PLEVEL} -gt 0 ]] && eapply -p0 "${MY_PATCHES[@]}"
-
-	# Clean out local libs so we know we use system ones w/releases.
-	if is_release ; then
-		rm -rf lib/{readline,termcap}/* || die
-		touch lib/{readline,termcap}/Makefile.in || die # for config.status
-		sed -ri -e 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in || die
+	# Include official patches.
+	(( PLEVEL > 0 )) && eapply -p0 "${MY_PATCHES[@]}"
+
+	# Clean out local libs so we know we use system ones w/releases. The
+	# touch utility is invoked for the benefit of config.status.
+	if (( PLEVEL >= 0 )); then
+		rm -rf lib/{readline,termcap}/* \
+		&& touch lib/{readline,termcap}/Makefile.in \
+		&& sed -i -E 's:\$[{(](RL|HIST)_LIBSRC[)}]/[[:alpha:]_-]*\.h::g' Makefile.in \
+		|| die
 	fi
 
 	# Prefixify hardcoded path names. No-op for non-prefix.
 	hprefixify pathnames.h.in
 
-	# Avoid regenerating docs after patches, bug #407985
-	sed -i -r '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in || die
-	touch -r . doc/* || die
+	# Avoid regenerating docs after patches, bug #407985.
+	sed -i -E '/^(HS|RL)USER/s:=.*:=:' doc/Makefile.in \
+	&& touch -r . doc/* \
+	|| die
 
 	# Sometimes hangs (more noticeable w/ pgo), bug #907403.
 	rm tests/run-jobs || die
@@ -177,18 +161,21 @@ src_prepare() {
 }
 
 src_configure() {
+	local -a myconf
+
 	# Upstream only test with Bison and require GNUisms like YYEOF and
 	# YYERRCODE. The former at least may be in POSIX soon:
 	# https://www.austingroupbugs.net/view.php?id=1269.
 	# configure warns on use of non-Bison but doesn't abort. The result
 	# may misbehave at runtime.
-	unset YACC
+	unset -v YACC
 
 	# wcsnwidth(), substring() issues with -Wlto-type-mismatch, reported
 	# upstream to Chet by email.
 	filter-lto
 
-	local myconf=(
+	# shellcheck disable=2207
+	myconf=(
 		--disable-profiling
 
 		# Force linking with system curses ... the bundled termcap lib
@@ -206,8 +193,9 @@ src_configure() {
 		$(use_with mem-scramble bash-malloc)
 	)
 
-	# For descriptions of these, see config-top.h
+	# For descriptions of these, see config-top.h.
 	# bashrc/#26952 bash_logout/#90488 ssh/#24762 mktemp/#574426
+	# shellcheck disable=2046
 	append-cppflags \
 		-DDEFAULT_PATH_VALUE=\'\""${EPREFIX}"/usr/local/sbin:"${EPREFIX}"/usr/local/bin:"${EPREFIX}"/usr/sbin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/bin\"\' \
 		-DSTANDARD_UTILS_PATH=\'\""${EPREFIX}"/bin:"${EPREFIX}"/usr/bin:"${EPREFIX}"/sbin:"${EPREFIX}"/usr/sbin\"\' \
@@ -217,13 +205,9 @@ src_configure() {
 		-DSSH_SOURCE_BASHRC \
 		$(use bashlogger && echo -DSYSLOG_HISTORY)
 
-	# Don't even think about building this statically without
-	# reading bug #7714 first.  If you still build it statically,
-	# don't come crying to us with bugs ;).
-	#use static && export LDFLAGS="${LDFLAGS} -static"
 	use nls || myconf+=( --disable-nls )
 
-	if is_release ; then
+	if (( PLEVEL >= 0 )); then
 		# Historically, we always used the builtin readline, but since
 		# our handling of SONAME upgrades has gotten much more stable
 		# in the PM (and the readline ebuild itself preserves the old
@@ -237,17 +221,15 @@ src_configure() {
 		myconf+=( --with-installed-readline=. )
 	fi
 
-	if use plugins ; then
-		append-ldflags -Wl,-rpath,"${EPREFIX}"/usr/$(get_libdir)/bash
+	if use plugins; then
+		append-ldflags "-Wl,-rpath,${EPREFIX}/usr/$(get_libdir)/bash"
 	else
-		# Disable the plugins logic by hand since bash doesn't
-		# provide a way of doing it.
+		# Disable the plugins logic by hand since bash doesn't provide
+		# a way of doing it.
 		export ac_cv_func_dl{close,open,sym}=no \
 			ac_cv_lib_dl_dlopen=no ac_cv_header_dlfcn_h=no
 
-		sed -i \
-			-e '/LOCAL_LDFLAGS=/s:-rdynamic::' \
-			configure || die
+		sed -i -e '/LOCAL_LDFLAGS=/s:-rdynamic::' configure || die
 	fi
 
 	# bug #444070
@@ -257,20 +239,37 @@ src_configure() {
 }
 
 src_compile() {
-	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
-	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/pgo -fprofile-generate=${T}/pgo $(test-flags-CC -fprofile-partial-training)")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/pgo -fprofile-dir=${T}/pgo $(test-flags-CC -fprofile-partial-training)")
+	local -a pgo_generate_flags pgo_use_flags
+	local flag
+
+	# -fprofile-partial-training because upstream notes the test suite isn't
+	# super comprehensive.
+	# https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	if use pgo; then
+		pgo_generate_flags=(
+			-fprofile-update=atomic
+			-fprofile-dir="${T}"/pgo
+			-fprofile-generate="${T}"/pgo
+		)
+		pgo_use_flags=(
+			-fprofile-use="${T}"/pgo
+			-fprofile-dir="${T}"/pgo
+		)
+		if flag=$(test-flags-CC -fprofile-partial-training); then
+			pgo_generate_flags+=( "${flag}" )
+			pgo_use_flags+=( "${flag}" )
+		fi
+	fi
 
-	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
-	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags}" all others
+	emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}"
+	use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" all others
 
 	# Build Bash and run its tests to generate profiles.
-	if use pgo ; then
+	if (( ${#pgo_generate_flags[@]} )); then
 		# Used in test suite.
-		unset A
+		unset -v A
 
-		emake CFLAGS="${CFLAGS} ${pgo_generate_flags}" -k check
+		emake CFLAGS="${CFLAGS} ${pgo_generate_flags[*]}" -k check
 
 		if tc-is-clang; then
 			llvm-profdata merge "${T}"/pgo --output="${T}"/pgo/default.profdata || die
@@ -278,14 +277,14 @@ src_compile() {
 
 		# Rebuild Bash using the profiling data we just generated.
 		emake clean
-		emake CFLAGS="${CFLAGS} ${pgo_use_flags}"
-		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags}" all others
+		emake CFLAGS="${CFLAGS} ${pgo_use_flags[*]}"
+		use plugins && emake -C examples/loadables CFLAGS="${CFLAGS} ${pgo_use_flags[*]}" all others
 	fi
 }
 
 src_test() {
 	# Used in test suite.
-	unset A
+	unset -v A
 
 	default
 }
@@ -295,63 +294,57 @@ src_install() {
 
 	default
 
+	my_prefixify() {
+		while read -r; do
+			if [[ $REPLY == *$1* ]]; then
+				REPLY=${REPLY/"/etc/"/"${EPREFIX}/etc/"}
+			fi
+			printf '%s\n' "${REPLY}" || ! break
+		done < "$2" || die
+	}
+
 	dodir /bin
-	mv "${ED}"/usr/bin/bash "${ED}"/bin/ || die
+	mv -- "${ED}"/usr/bin/bash "${ED}"/bin/ || die
 	dosym bash /bin/rbash
 
 	insinto /etc/bash
 	doins "${FILESDIR}"/bash_logout
-	newins "$(prefixify_ro "${FILESDIR}"/bashrc-r1)" bashrc
+	my_prefixify bashrc.d "${FILESDIR}"/bashrc-r1 | newins - bashrc
 
 	insinto /etc/bash/bashrc.d
-	doins "${FILESDIR}"/bashrc.d/*.bash
+	my_prefixify DIR_COLORS "${FILESDIR}"/bashrc.d/10-gentoo-color.bash | newins - 10-gentoo-color.bash
+	doins "${FILESDIR}"/bashrc.d/10-gentoo-title.bash
 
 	insinto /etc/skel
-	for f in bash{_logout,_profile,rc} ; do
-		newins "${FILESDIR}"/dot-${f} .${f}
+	for f in bash{_logout,_profile,rc}; do
+		newins "${FILESDIR}/dot-${f}" ".${f}"
 	done
 
-	local sed_args=(
-		-e 's:#GNU#@::'
-		-e '/#@/d'
-	)
-
-	if ! use readline ; then
-		# bug #432338
-		sed_args+=(
-			-e '/^shopt -s histappend/s:^:#:'
-			-e 's:use_color=true:use_color=false:'
-		)
-	fi
-
-	sed -i \
-		"${sed_args[@]}" \
-		"${ED}"/etc/skel/.bashrc \
-		"${ED}"/etc/bash/bashrc || die
-
-	if use plugins ; then
-		exeinto /usr/$(get_libdir)/bash
-		doexe $(echo examples/loadables/*.o | sed 's:\.o::g')
+	if use plugins; then
+		exeinto "/usr/$(get_libdir)/bash"
+		set -- examples/loadables/*.o
+		doexe "${@%.o}"
 
 		insinto /usr/include/bash-plugins
+		# shellcheck disable=2035
 		doins *.h builtins/*.h include/*.h lib/{glob/glob.h,tilde/tilde.h}
 	fi
 
-	if use examples ; then
-		for d in examples/{functions,misc,scripts,startup-files} ; do
-			exeinto /usr/share/doc/${PF}/${d}
-			docinto ${d}
-			for f in ${d}/* ; do
-				if [[ ${f##*/} != PERMISSION ]] && [[ ${f##*/} != *README ]] ; then
-					doexe ${f}
+	if use examples; then
+		for d in examples/{functions,misc,scripts,startup-files}; do
+			exeinto "/usr/share/doc/${PF}/${d}"
+			docinto "${d}"
+			for f in "${d}"/*; do
+				if [[ ${f##*/} != @(PERMISSION|*README) ]]; then
+					doexe "${f}"
 				else
-					dodoc ${f}
+					dodoc "${f}"
 				fi
 			done
 		done
 	fi
 
-	# Install bash_builtins.1 and rbash.1
+	# Install bash_builtins.1 and rbash.1.
 	emake -C doc DESTDIR="${D}" install_builtins
 	sed 's:bash\.1:man1/&:' doc/rbash.1 > "${T}"/rbash.1 || die
 	doman "${T}"/rbash.1
@@ -361,26 +354,27 @@ src_install() {
 }
 
 pkg_preinst() {
-	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]] ; then
-		mkdir -p "${EROOT}"/etc/bash
-		mv -f "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/
+	if [[ -e ${EROOT}/etc/bashrc ]] && [[ ! -d ${EROOT}/etc/bash ]]; then
+		mkdir -p -- "${EROOT}"/etc/bash \
+		&& mv -f -- "${EROOT}"/etc/bashrc "${EROOT}"/etc/bash/ \
+		|| die
 	fi
 }
 
 pkg_postinst() {
 	local old_ver
 
-	# If /bin/sh does not exist, provide it
-	if [[ ! -e ${EROOT}/bin/sh ]] ; then
-		ln -sf bash "${EROOT}"/bin/sh
+	# If /bin/sh does not exist, provide it.
+	if [[ ! -e ${EROOT}/bin/sh ]]; then
+		ln -sf -- bash "${EROOT}"/bin/sh || die
 	fi
 
 	read -r old_ver <<<"${REPLACING_VERSIONS}"
-	if [[ ! $old_ver ]] ; then
+	if [[ ! $old_ver ]]; then
 		:
-	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r1" ; then
+	elif ver_test "$old_ver" -ge "5.2" && ver_test "$old_ver" -ge "5.2_p26-r1"; then
 		return
-	elif ver_test "$old_ver" -lt "5.2" && ver_test "$old_ver" -ge "5.1_p16-r8" ; then
+	elif ver_test "$old_ver" -lt "5.2" && ver_test "$old_ver" -ge "5.1_p16-r8"; then
 		return
 	fi