DevSecOps Engineer, Author, and Mentor

Over the past several weeks, I have written about a few small Bash tools that grew out of larger projects: mktext for literal text substitution, bash-doxygen for source documentation, bashdeps for exact artifact materialization, and bashlog for predictable logging and explicit redaction.

Those tools each have intentionally narrow responsibilities. At some point, though, I also needed a place to answer a different question: what does a Bash project look like when these practices are assembled into one coherent starting point?

That is the role of template-bash.

template-bash is a private repository I maintain alongside Getting Started with Bash Engineering. It is a starter for maintainable, documented, tested, and releasable Bash projects, and it consolidates patterns that have been exercised across adrctl, bashdeps, Bootstrap, mktext, bashlog, and related work.

The GitHub repository itself is private, and I am not distributing repository access. I publish a versioned export of the starter as the Bash Engineering Starter Kit. That archive is available free to people who request it through the book’s companion-resource page.

Read More

There is a point in many shell projects where printf >&2 starts accumulating policy.

The first message is straightforward. Then there are severity levels, quiet and debug modes, timestamps, terminal colors, machine-readable output, tags, and the question that tends to arrive after the first sensitive value appears in a log: how do we make sure that value does not leave the process through the logging path?

I wanted a reusable answer to that problem, but I did not want a logging library that took over the application around it. I did not want traps, shell-option changes, hidden network behavior, automatic environment discovery, generic functions named info and error, or a transport stack pretending every Bash program needed to become a logging daemon.

That became bashlog, a sourceable pure-Bash logging library with a deliberately small runtime boundary.

The project is still marked pre-release as I write this, so I am describing the current architecture and public contract rather than implying a finished 1.0 API. The boundaries are already the part I find most interesting.

Read More

A few of my recent Bash projects consume small external artifacts during their builds. adrctl, for example, consumes mktext, and other projects use bash-doxygen to generate reference documentation.

A common solution is to put a few curl commands and checksum checks in the Makefile, download the files into vendor/, and move on.

That works until the same security-sensitive logic exists in several projects, each copy evolves slightly differently, and one of them eventually makes the wrong assumption.

That happened in adrctl. A cached mktext artifact remained at the expected path after the desired dependency version changed. The surrounding build metadata said one thing while the bytes actually embedded in the generated artifact came from an older version.

The filename was right. The bytes were wrong.

That failure became the reason for bashdeps.

Read More