DevSecOps Engineer, Author, and Mentor

There is a point in many shell projects where printf >&2 starts accumulating policy.

The first message is straightforward. Then there are severity levels, quiet and debug modes, timestamps, terminal colors, machine-readable output, tags, and the question that tends to arrive after the first sensitive value appears in a log: how do we make sure that value does not leave the process through the logging path?

I wanted a reusable answer to that problem, but I did not want a logging library that took over the application around it. I did not want traps, shell-option changes, hidden network behavior, automatic environment discovery, generic functions named info and error, or a transport stack pretending every Bash program needed to become a logging daemon.

That became bashlog, a sourceable pure-Bash logging library with a deliberately small runtime boundary.

The project is still marked pre-release as I write this, so I am describing the current architecture and public contract rather than implying a finished 1.0 API. The boundaries are already the part I find most interesting.

Read More

A few of my recent Bash projects consume small external artifacts during their builds. adrctl, for example, consumes mktext, and other projects use bash-doxygen to generate reference documentation.

A common solution is to put a few curl commands and checksum checks in the Makefile, download the files into vendor/, and move on.

That works until the same security-sensitive logic exists in several projects, each copy evolves slightly differently, and one of them eventually makes the wrong assumption.

That happened in adrctl. A cached mktext artifact remained at the expected path after the desired dependency version changed. The surrounding build metadata said one thing while the bytes actually embedded in the generated artifact came from an older version.

The filename was right. The bytes were wrong.

That failure became the reason for bashdeps.

Read More

Over the last several weeks, I have written about three Doxygen filters: bash-doxygen, awk-doxygen, and python-doxygen. Seen together, that sequence could suggest that I had decided to write a Doxygen filter for every language I use, although that was never the goal. I was trying to create a coherent documentation structure across the languages I use regularly while allowing the maintained source in each language to remain recognizable and appropriate to that language.

That distinction became more important as the work progressed. Bash needed a filter because Doxygen does not understand Bash well enough to infer the structures I wanted documented. AWK needed a different filter because its functions, globals, locals, and pattern/action rules do not map cleanly onto the Bash model. Python already had a mature documentation system, so its problem was less about inventing structure and more about translating Python-native docstrings without allowing Doxygen to become the authoring language. By the time I reached PHP, I had enough examples to ask a better question than “what should the next filter look like?” The more useful question was whether PHP needed a filter at all.

It did not. PHPDoc-style DocBlocks and Doxygen overlap closely enough that I could define a common subset and let Doxygen consume the maintained PHP directly. That result clarified the larger architecture for me: the consistency I wanted belonged in the documentation contract and the generated reference material, not in forcing every source language through identical syntax or identical tooling.

Read More