Master POSIX Shell Scripting

Writes strictly POSIX-compliant, portable shell scripts that run identically across dash, ash, yash, and other Unix-like systems - avoiding all bash-specific features and following defensive, security-conscious patterns.

Use this skill when writing shell scripts that must run on legacy systems, embedded/BusyBox environments, or any Unix-like system without assuming bash is available, migrating an existing bash script to POSIX sh, or setting up multi-shell CI testing. Not a fit for scripts that can safely assume bash/zsh is present and want to use their extended features.

Lists ten POSIX constraints to work around: no arrays, no [[ conditionals (use [ only), no process substitution, no brace expansion, no local keyword, no declare/typeset/readonly, no += string concatenation, no ${var//pattern/replacement}, no associative arrays, and no source (use . instead).

Core approach: #!/bin/sh shebang, set -eu for error handling (no pipefail in POSIX), quoting every variable expansion, using [ ] for all tests, case/while for argument parsing instead of long-option getopts, mktemp with cleanup traps for temp files, printf instead of echo, and $() instead of backticks. Compatibility guidance covers testing across dash (Debian/Ubuntu default), ash (Alpine/BusyBox), and bash --posix, using command -v instead of which, and avoiding non-universal paths like /dev/stdin.

Provides concrete patterns for working without arrays (positional parameters via set --, delimited strings with IFS, newline-separated reads, counters), portable conditionals ([ -e ]/[ -f ]/[ -d ] file tests, -z/-n/= string tests, -eq/-lt numeric tests, case instead of regex matching), and safety/security patterns (quoting to prevent word splitting, validating numeric input via case, never using eval on untrusted input, -- to separate options from arguments, trap for cleanup, restrictive umask).

CI/CD integration guidance covers matrix testing across dash/ash/bash-posix/yash on Linux/macOS/Alpine, container-based testing (alpine:latest, debian:stable), and a pre-commit pipeline combining shellcheck -s sh, shfmt -ln posix, and checkbashisms. Embedded systems guidance covers BusyBox ash compatibility, resource constraints, missing-utility fallbacks (mktemp, seq), and read-only filesystem handling. Migration guidance from bash to POSIX sh covers using checkbashisms for assessment, converting arrays to delimited strings, replacing [[ with [, removing local, and incremental function-by-function conversion with continuous validation.

Lists twelve common pitfalls (using [[, arrays, local, echo without care, source, bash parameter expansion, process substitution, function keyword, $RANDOM, read -a, pipefail, &> redirection) and provides advanced technique snippets for error trapping, safe temp files, array simulation, field parsing from /etc/passwd-style files, and default value assignment (${var:-default}). Lists essential tools (ShellCheck, shfmt, checkbashisms, Semgrep, CodeQL) and testing frameworks (bats-core, shellspec, shunit2, sharness) with a full quality checklist covering ShellCheck POSIX mode, consistent formatting, multi-shell testing, and BusyBox validation.

Validated with ShellCheck (-s sh), shfmt (-ln posix), checkbashisms, and tested across dash, ash, yash, posh, osh, and bash --posix, with CI examples for GitHub Actions and container-based multi-shell matrices.

Systems engineers writing shell scripts for legacy, embedded, or maximally portable environments who need concrete POSIX-only patterns and multi-shell validation rather than bash-specific scripting that may fail on stricter shells.

tmpfile=$(mktemp) || exit 1
trap 'rm -f "$tmpfile"' EXIT INT TERM