shellcheck: Add shellcheck to the pre-commit hook

* Move the shellcheck script from the Makefile to its own script file
* Reformat the shellcheck script so it's easier to read and modify
* Call the shellcheck script from the pre-commit hook

Fixes bug 30967; not in any released version of Tor.

Makefile.am

@@ -239,23 +239,7 @@ test: all
 	$(top_builddir)/src/test/test
 
 shellcheck:
-	# Only use shellcheck if shellcheck is installed
-	# Check the directories that contain scripts that we can fix
-	if command -v shellcheck; then \
-                find "$(top_srcdir)" -name "*.sh" -path "$(top_srcdir)/contrib/*" -path "$(top_srcdir)/doc/*" -path "$(top_srcdir)/scripts/*" -path "$(top_srcdir)/src/*" -not -path "$(top_srcdir)/src/ext/*" -not -path "$(top_srcdir)/src/rust/registry/*" -exec shellcheck {} +; \
-	        if [ -d "$(top_srcdir)/scripts/test" ]; then \
-                        shellcheck $(top_srcdir)/scripts/test/cov-diff $(top_srcdir)/scripts/test/coverage; \
-                fi; \
-                if [ -e "$(top_srcdir)/contrib/dirauth-tools/nagios-check-tor-authority-cert" ]; then \
-                        shellcheck "$(top_srcdir)/contrib/dirauth-tools/nagios-check-tor-authority-cert"; \
-                fi; \
-                if [ -e "$(top_srcdir)/contrib/client-tools/torify" ]; then \
-                        shellcheck "$(top_srcdir)/contrib/client-tools/torify"; \
-                fi; \
-                if [ -d "$(top_srcdir)/scripts/git" ]; then \
-                        shellcheck $(top_srcdir)/scripts/git/*.git-hook; \
-                fi; \
-	fi
+	$(top_srcdir)/scripts/maint/checkShellScripts.sh
 
 check-local: check-spaces check-changes check-includes check-best-practices shellcheck
 

scripts/git/pre-commit.git-hook

@@ -53,3 +53,7 @@ if [ -e "${PT_DIR}/practracker.py" ]; then
         fi
     fi
 fi
+
+if [ -e scripts/maint/checkShellScripts.sh ]; then
+    scripts/maint/checkShellScripts.sh
+fi

scripts/maint/checkShellScripts.sh

+#!/usr/bin/env bash
+#
+# Copyright (c) 2019 The Tor Project, Inc.
+# See LICENSE for license information
+#
+# checkShellScripts.sh
+# --------------------
+# If shellcheck is installed, check all the shell scripts that we can fix.
+
+set -e
+
+# Only run this script if shellcheck is installed
+# command echoes the path to shellcheck, which is a useful diagnostic log
+if ! command -v shellcheck; then
+    printf "%s: Install shellcheck to check shell scripts.\\n" "$0"
+    exit 0
+fi
+
+# Some platforms don't have realpath
+if command -v realpath ; then
+    HERE=$(dirname "$(realpath "$0")")
+else
+    HERE=$(dirname "$0")
+    if [ ! -d "$HERE" ]; then
+        HERE=$(dirname "$PWD/$0")
+    fi
+fi
+TOPLEVEL=$(dirname "$(dirname "$HERE")")
+
+# Check we actually have a tor/src directory
+if [ ! -d "$TOPLEVEL/src" ]; then
+    printf "Error: Couldn't find src directory in expected location: %s\\n" \
+        "$TOPLEVEL/src"
+fi
+
+# Check *.sh scripts, but ignore the ones that we can't fix
+find "$TOPLEVEL" \
+    -name "*.sh" \
+    -path "$TOPLEVEL/contrib/*" \
+    -path "$TOPLEVEL/doc/*" \
+    -path "$TOPLEVEL/scripts/*" \
+    -path "$TOPLEVEL/src/*" \
+    -not -path "$TOPLEVEL/src/ext/*" \
+    -not -path "$TOPLEVEL/src/rust/registry/*" \
+    -exec shellcheck {} +
+
+# Check scripts that aren't named *.sh
+if [ -d "$TOPLEVEL/scripts/test" ]; then
+    shellcheck \
+        "$TOPLEVEL/scripts/test/cov-diff" \
+        "$TOPLEVEL/scripts/test/coverage"
+fi
+if [ -e \
+    "$TOPLEVEL/contrib/dirauth-tools/nagios-check-tor-authority-cert" \
+   ]; then
+    shellcheck \
+        "$TOPLEVEL/contrib/dirauth-tools/nagios-check-tor-authority-cert"
+fi
+if [ -e "$TOPLEVEL/contrib/client-tools/torify" ]; then
+    shellcheck "$TOPLEVEL/contrib/client-tools/torify"
+fi
+if [ -d "$TOPLEVEL/scripts/git" ]; then
+    shellcheck "$TOPLEVEL/scripts/git/"*.git-hook
+fi