Skip to content

fix: use unset-safe expansions in entrypoint validation checks#989

Open
Kubudak90 wants to merge 2 commits intobase:mainfrom
Kubudak90:fix-set-u-env-validation
Open

fix: use unset-safe expansions in entrypoint validation checks#989
Kubudak90 wants to merge 2 commits intobase:mainfrom
Kubudak90:fix-set-u-env-validation

Conversation

@Kubudak90
Copy link

Fixes #988

Problem

The entrypoint scripts use set -u which causes bash to exit when an unset variable is expanded. However, the validation logic uses -z "$VAR" which expands the variable before checking if it's empty.

This means if OP_NODE_NETWORK is unset and OP_NODE_ROLLUP_CONFIG is set (for op-node-entrypoint), the script crashes on unbound OP_NODE_NETWORK expansion instead of evaluating the condition correctly.

Solution

Use unset-safe expansions in checks (${VAR:-}) while keeping set -u for safety.

Changes

  • op-node-entrypoint: Use ${OP_NODE_NETWORK:-} and ${OP_NODE_ROLLUP_CONFIG:-}
  • nethermind/nethermind-entrypoint: Use ${OP_NODE_NETWORK:-} and ${OP_NODE_L2_ENGINE_AUTH_RAW:-}

This ensures the validation logic works correctly even when variables are unset, while maintaining the safety benefits of set -u.

Fixes base#988

The entrypoint scripts use `set -u` which causes bash to exit when an
unset variable is expanded. However, the validation logic uses `-z "$VAR"`
which expands the variable before checking if it's empty.

This means if OP_NODE_NETWORK is unset and OP_NODE_ROLLUP_CONFIG is set,
the script crashes on unbound OP_NODE_NETWORK expansion instead of
evaluating the condition correctly.

Changes:
- op-node-entrypoint: Use `${OP_NODE_NETWORK:-}` and `${OP_NODE_ROLLUP_CONFIG:-}`
- nethermind-entrypoint: Use `${OP_NODE_NETWORK:-}` and `${OP_NODE_L2_ENGINE_AUTH_RAW:-}`

This allows the validation logic to work correctly while keeping `set -u`
for safety.
@cb-heimdall
Copy link
Collaborator

cb-heimdall commented Mar 13, 2026

🟡 Heimdall Review Status

Requirement Status More Info
Reviews 🟡 0/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 1
Sum 2

When using `set -u` (nounset), referencing unset variables causes
an unbound variable error before the script can check if they're set.

This change uses `${VAR:-}` parameter expansion to safely handle
unset variables in validation checks, allowing proper error messages
instead of shell errors.

Fixes base#988
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

set -u causes incorrect env validation behavior in entrypoint scripts

2 participants