Advanced scripting for DevSecOps

Correct — redirect with `while ...; done < <(cmd)` or enable `shopt -s lastpipe` to run that stage in the current shell.

Correct — assignments and cd inside ( ) vanish on exit; inside { } they persist.

Correct — redirections apply left to right and capture the current target — put >file first: `cmd >file 2>&1`.

Correct — diff <(a) <(b) compares two streams with no temp files and no cleanup.

Correct — it fixes the classic `cmd | while read` counter loss (with job control off).

Correct — declare/assign on one line hides the RHS status; split them: `local out; out=$(false) || handle`.

Correct — without it, `false | true` succeeds and a failed producer goes unnoticed.

Correct — without -E your error trap silently does nothing in the very functions where errors happen.

Correct — strip the longest leading match up to the last slash -> app.log, no external `basename` process.

Correct — fewer processes and one pass mean faster and fewer failure points, especially in loops.

Correct — use jq for JSON and yq for YAML — they parse the real grammar and return the exact field.

Correct — looping `caller $i` prints lineno/function/source for each frame — a map of how execution reached the failure.

Correct — SIGKILL (and SIGSTOP) cannot be caught, blocked or ignored — that is their purpose.

Correct — signal traps then just set intent and exit; the EXIT trap does the actual rm/unlock.

Correct — the -k grace guarantees a stuck process that ignores TERM is still killed, so nothing hangs forever.

Correct — a shell that forwards signals imperfectly is the usual cause of pods that take the full grace period to die.

Correct — end option parsing with `--` and/or use `-e`/`--` guards so a leading dash cannot become a switch.

Correct — never build commands from data with eval; just run `cp -- "$src" "$dst"` with quoted args.

Correct — controlling PATH (and calling critical tools by full path) ensures you execute the real binary, not a hijack.

Correct — an attacker can pre-create the predictable path pointing at a file you then write as root.

Correct — rename is atomic within a filesystem, so consumers see either the old or the new file, never a partial one.

Correct — treat ShellCheck findings as errors in CI so an unquoted `rm -rf $VAR` cannot merge.

Correct — you then assert e.g. [ "$status" -eq 0 ] and [ "$output" = "1.4.2" ].

Correct — sourcing loads the functions for testing without triggering the entry point.

Correct — processes each have their own GIL, so CPU work actually runs on multiple cores.

Correct — many requests are in flight at once; you are waiting on the network, not the CPU.

Correct — share nothing and use a queue, or protect shared state with a lock.

Correct — use async-native libraries or push blocking work to an executor; asyncio is cooperative.

Correct — bounded concurrency protects the target service and your own file-descriptor limits.

Correct — let unexpected exceptions propagate, or catch specifically and exit non-zero.

Correct — frozen=True plus type hints makes config safe to pass around and mypy-checkable.

Correct — the most specific, most intentional source wins; fall back predictably.

Correct — the "during handling of the above" chain shows exactly what the underlying failure was.

Correct — non-idempotent retries can duplicate side effects; permanent errors will never succeed.

Correct — random jitter spreads the retries so the recovering service is not hit by a synchronized wave.

Correct — files, locks, sessions and temp dirs are released even if the block raises — ExitStack composes several safely.

Correct — an argument list is never re-parsed by a shell, so injected characters stay inert.

Correct — the default for many calls is no timeout at all; a bounded wait fails loudly instead of hanging silently.

Correct — host-key verification is the control that stops man-in-the-middle; never auto-add in production.

Correct — the channel’s exit status is the remote command’s real result; branch on it.

Correct — 429 means slow down; retrying immediately makes rate limiting worse.

Correct — a lazy pipeline processes huge inputs in a few MB instead of OOMing.

Correct — nested quantifiers are a DoS vector; prefer specific, anchored classes and cap input length or use a timeout.

Correct — machines can index JSON fields; separating streams keeps real output pipeable.

Correct — safe_load removes the object-construction (RCE) capability entirely.

Correct — treat pickle as RCE on untrusted input; use JSON, which has no execution semantics.

Correct — security-sensitive values (tokens, nonces, salts) require cryptographic randomness.

Correct — early-exit equality leaks how many leading characters matched; compare_digest does not.

Correct — hash pinning makes installs reproducible and defends the supply chain.

Correct — you commit the lock and install from it, so two builds a week apart are identical.

Correct — distribution becomes copying one .pyz/.pex file that just runs.

Correct — compile in a fat builder, copy just the artifact into a tiny final image, drop privileges.

Correct — vendor or verify bootstrap scripts and pin what they install.

Correct — a tool that only ever returns 0 or 1 forces callers to scrape stderr to know what happened.

Correct — dry-run prints what would happen and changes nothing; idempotent actions check state before acting, so a re-run converges.

Correct — trends and freshness of success/failure are what make unattended jobs observable.

Correct — that is the record an incident review and a compliance auditor ask for first.

Correct — a Bill of Materials turns a days-long scramble into a lookup.

Correct — a dependency clean at release can turn vulnerable later, so scan on every build and on a schedule.

Correct — an admission controller or the consumer verifies the signature/identity before running the tool.