shellcheck: prevent globbing and word splitting in package shell scripts

pkgs/clightning-plugins/default.nix

@@ -60,18 +60,18 @@ let
       buildInputs = [ python ];
 
       buildCommand = ''
-        cp --no-preserve=mode -r ${src}/${name} $out
-        cd $out
+        cp --no-preserve=mode -r '${src}/${name}' "$out"
+        cd "$out"
         ${lib.optionalString (plugin ? patchRequirements) ''
           substituteInPlace requirements.txt ${plugin.patchRequirements}
         ''}
 
         # Check that requirements are met
-        PYTHONPATH=${toString python}/${python.sitePackages} \
+        PYTHONPATH='${toString python}/${python.sitePackages}' \
           ${pkgs.python3Packages.pip}/bin/pip install -r requirements.txt --no-cache --no-index
 
-        chmod +x ${script}
-        patchShebangs ${script}
+        chmod +x '${script}'
+        patchShebangs '${script}'
       '';
 
       passthru.path = "${drv}/${script}";

pkgs/clightning-rest/default.nix

@@ -39,8 +39,8 @@ let self = stdenvNoCC.mkDerivation {
       --exclude=/{screenshots,'*.Dockerfile'} \
       $dest
 
-    makeWrapper ${self.nodejsRuntime}/bin/node $out/bin/cl-rest \
-      --add-flags $dest/cl-rest.js
+    makeWrapper ${self.nodejsRuntime}/bin/node "$out/bin/cl-rest" \
+      --add-flags "$dest/cl-rest.js"
 
     runHook postInstall
   '';

pkgs/joinmarket/default.nix

@@ -34,14 +34,14 @@ stdenv.mkDerivation {
   buildInputs = [ pythonEnv ];
 
   installPhase = ''
-    mkdir -p $out/bin
+    mkdir -p "$out/bin"
 
     # add-utxo.py -> bin/jm-add-utxo
     cpBin() {
-      cp scripts/$1 $out/bin/jm-''${1%.py}
+      cp "scripts/$1" "$out/bin/jm-''${1%.py}"
     }
 
-    cp scripts/joinmarketd.py $out/bin/joinmarketd
+    cp scripts/joinmarketd.py "$out/bin/joinmarketd"
     cpBin add-utxo.py
     cpBin convert_old_wallet.py
     cpBin receive-payjoin.py
@@ -52,17 +52,17 @@ stdenv.mkDerivation {
     cpBin yg-privacyenhanced.py
     cpBin genwallet.py
 
-    chmod +x -R $out/bin
-    patchShebangs $out/bin
+    chmod +x -R "$out/bin"
+    patchShebangs "$out/bin"
 
     ## ob-watcher
     obw=$out/libexec/joinmarket-ob-watcher
-    install -D scripts/obwatch/ob-watcher.py $obw/ob-watcher
-    patchShebangs $obw/ob-watcher
-    ln -s $obw/ob-watcher $out/bin/jm-ob-watcher
+    install -D scripts/obwatch/ob-watcher.py "$obw/ob-watcher"
+    patchShebangs "$obw/ob-watcher"
+    ln -s "$obw/ob-watcher" "$out/bin/jm-ob-watcher"
 
     # These files must be placed in the same dir as ob-watcher
-    cp -r scripts/obwatch/{orderbook.html,sybil_attack_calculations.py,vendor} $obw
+    cp -r scripts/obwatch/{orderbook.html,sybil_attack_calculations.py,vendor} "$obw"
   '';
 
   meta = with lib; {

pkgs/netns-exec/default.nix

@@ -5,6 +5,6 @@ stdenv.mkDerivation {
   buildInputs = [ pkgs.libcap ];
   src = ./src;
   installPhase = ''
-    cp main $out
+    cp main "$out"
   '';
 }

pkgs/nixops/default.nix

@@ -34,8 +34,8 @@ let
   };
 
   src = runCommand "src" {} ''
-    cp --no-preserve=mode -r ${origSrc} $out
-    cd $out
+    cp --no-preserve=mode -r '${origSrc}' "$out"
+    cd "$out"
     patch -p1 < ${./release.nix.patch}
   '';
 

pkgs/python-packages/specific-versions/autobahn.nix

@@ -19,7 +19,7 @@ buildPythonPackage rec {
   checkInputs = [ mock pytest ];
   checkPhase = ''
     runHook preCheck
-    USE_TWISTED=true py.test $out
+    USE_TWISTED=true py.test "$out"
     runHook postCheck
   '';
 

pkgs/rtl/default.nix

@@ -58,8 +58,8 @@ let self = stdenvNoCC.mkDerivation {
       ${self.nodeModules}/lib/node_modules \
       $dest
 
-    makeWrapper ${self.nodejsRuntime}/bin/node $out/bin/rtl \
-      --add-flags $dest/rtl.js
+    makeWrapper ${self.nodejsRuntime}/bin/node "$out/bin/rtl" \
+      --add-flags "$dest/rtl.js"
 
     runHook postInstall
   '';