fix(scripts): make shell scripts run on macOS system bash 3.2 - #30
Open
alienwings wants to merge 1 commit into
Open
fix(scripts): make shell scripts run on macOS system bash 3.2#30alienwings wants to merge 1 commit into
alienwings wants to merge 1 commit into
Conversation
Two constructs in the scripts require bash 4, which macOS does not ship —
/bin/bash is still 3.2.57 there, so both scripts died immediately:
- fingerprint.sh:37 used ${INPUT,,}, the lowercase expansion (bash 4+).
Failed with: line 37: ${INPUT,,}: bad substitution
Replaced with a portable `tr` pipeline.
- find-api-calls.sh:91 used `declare -A` for a 9-key counter map.
Failed with: line 91: retrofit: unbound variable
Replaced with plain counters.
Separately, fingerprint.sh fed the DEX scan through
`unzip -p -- "$apk" "$dex" | strings -n 8`. Apple's cctools strings
skips the printable-run filter entirely when reading from stdin and
emits raw bytes instead, so the scan was fed megabytes of binary noise
rather than type descriptors. Handing strings a real file fixes it, and
also cuts the run on a 346 MB / 53-dex APK from 35.6s to 12.8s.
Verified on macOS against both interpreters:
/bin/bash (3.2.57) -n -> both scripts pass
bash 5.3.15 -n -> both scripts pass
fingerprint.sh before: `bad substitution` after: exit 0, 273 native libs listed
find-api-calls.sh before: `unbound variable` after: correct counts on a fixture
Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three portability bugs that make the scripts unusable out of the box on macOS.
1 & 2 — bash 4 constructs (both scripts crash immediately)
macOS ships bash 3.2.57 as
/bin/bash, so:fingerprint.sh:37${INPUT,,}(lowercase expansion)line 37: ${INPUT,,}: bad substitutionfind-api-calls.sh:91declare -A H=(...)line 91: retrofit: unbound variableReplaced with a
trpipeline and plain counters respectively.3 —
stringsreading from stdin (Apple cctools)fingerprint.shran the DEX type-name scan as:Apple's
stringsskips the printable-run filter entirely when reading from stdin and emits raw bytes instead. Verified against the same file:The scan was therefore fed megabytes of binary noise. Handing
stringsa real file fixes it, and also cuts the run on a 346 MB / 53-dex APK from 35.6s to 12.8s.Verification
Tested on macOS (Darwin 25.6.0, arm64) against both interpreters:
Not included in this PR
While testing I noticed
fingerprint.sh's obfuscation heuristic is structurallyinert for APK input. It runs
grep -oE '^[a-z]{1,2}/' "$LISTING", which countsZIP entry paths — but an APK's root entries are
assets/ lib/ res/ r/ ...(resource paths, not Java packages), so it scores ~1 and always reports LOW.
It behaves as designed for JAR/AAR, where entries really are
a/b/C.class.Left alone here because fixing it needs a design decision (scan the dex string
pool, or gate the heuristic to JAR/AAR input).
🤖 Generated with Claude Code