xbmk: remove even more eval statements

in one or two cases, the use of eval is retained, but
modified so as to be safer.

Signed-off-by: Leah Rowe <leah@libreboot.org>

7 files changed, 249 insertions, 59 deletions

diff --git a/include/get.sh b/include/get.sh
index 5cc65c2b..dabbcf0c 100644
--- a/include/get.sh
+++ b/include/get.sh
@@ -33,7 +33,10 @@ fetch_project()
 	    err "Can't read config 'config/git/$project/pkg.cfg'" \
 	    "fetch_project" "@"
 
-	chkvars url bkup_url
+	if [ -z "$url" ] || [ -z "$bkup_url" ]; then
+		err "url/bkup_url not both set 'config/git/$project/pkg.cfg'" \
+		    "fetch_project" "$@"
+	fi
 
 	if [ -n "$xtree" ]; then
 		x_ ./mk -f coreboot "$xtree"
@@ -68,7 +71,9 @@ git_prep()
 	_patchdir="$3"
 	_loc="$4" # $1 and $2 are gitrepo and gitrepo_backup
 
-	chkvars rev
+	if [ -z "$rev" ]; then
+		err "$project/$tree: rev not set" "git_prep" "$@"
+	fi
 
 	xbget git "$1" "$2" "$tmpgit" "$rev" "$_patchdir"
 	if singletree "$project" || [ $# -gt 4 ]; then
@@ -114,7 +119,16 @@ fetch_submodule()
 		return 0
 	fi
 
-	chkvars "sub${st}" "sub${st}_bkup" "subhash"
+	if [ "$st" = "curl" ]; then
+		if [ -z "$subcurl" ] || [ -z "$subcurl_bkup" ]; then
+			err "subcurl/subcurl_bkup not both set" \
+			    "fetch_submodule" "$@"
+		fi
+	elif [ -z "$subgit" ] || [ -z "$subgit_bkup" ]; then
+		err "subgit/subgit_bkup not both set" "fetch_submodule" "$@"
+	elif [ -z "$subhash" ]; then
+		err "subhash not set" "fetch_submodule" "$@"
+	fi
 
 	if [ "$st" = "git" ]; then
 		x_ rm -Rf "$tmpgit/$1"
@@ -314,5 +328,23 @@ tmpclone()
 {
 	( x_ git clone "$1" "$2" ) || return 1
 	( x_ git -C "$2" reset --hard "$3" ) || return 1
-	( fx_ "eval x_ git -C \"$2\" am" find "$4" -type f ) || return 1; :
+
+	if [ ! -d "$4" ]; then
+		return 0
+	fi
+
+	tmpclone_patchlist="`mktemp || err "Can't create tmp patch list"`" || \
+	    err "Can't create tmp patch list" "tmpclone" "$@"
+
+	x_ find "$4" -type f > "$tmpclone_patchlist" || \
+	    err "Can't write patch names to '$tmpclone_patchlist'" \
+	    "tmpclone" "$@"
+
+	while read -r tmpclone_patch; do
+
+		( x_ git -C "$2" am "$tmpclone_patch" ) || \
+		    err "Can't apply '$tmpclone_patch'" "tmpclone" "$@"; :
+
+	done < "$tmpclone_patchlist" || \
+	    err "Can't read '$tmpclone_patchlist'" "tmpclone" "$@"
 }
diff --git a/include/init.sh b/include/init.sh
index 90d7de80..03e33e74 100644
--- a/include/init.sh
+++ b/include/init.sh
@@ -12,12 +12,28 @@ projectname="libreboot"
 projectsite="https://libreboot.org/"
 
 if [ -z "${PATH+x}" ]; then
-export PATH="/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
+	export PATH="/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games"
 fi
 
-eval "`setvars "" board reinstall versiondate aur_notice configdir xbmkpath \
-    datadir version xbmkpwd relname xbmkpwd xbtmp python pyver xbmklock \
-    cvxbmk cvchk is_child basetmp`"
+board=""
+reinstall=""
+version=""
+versiondate=""
+aur_notice=""
+configdir=""
+xbmkpath=""
+datadir=""
+xbmkpwd=""
+relname=""
+xbmkpwd=""
+xbtmp=""
+python=""
+pyver=""
+xbmklock=""
+cvxbmk=""
+cvchk=""
+is_child=""
+basetmp=""
 
 xbmk_init()
 {
@@ -59,7 +75,10 @@ xbmkpkg()
 	. "config/dependencies/$2" || \
 	    err "Can't read 'config/dependencies/$2'" "xbmkpkg" "$@"
 
-	chkvars pkg_add pkglist
+	if [ -z "$pkg_add" ] || [ -z "$pkglist" ]; then
+		err "pkg_add/pkglist not both set" "xbmkpkg" "$@"
+	fi
+
 	x_ $pkg_add $pkglist
 
 	if [ -n "$aur_notice" ]; then
@@ -78,11 +97,11 @@ xbmk_get_version()
 		    err "can't read versiondate" xbmk_get_version "$@"
 	fi
 
-	if [ -f ".version" ]; then
-		chkvars version
+	if [ -f ".version" ] && [ -z "$version" ]; then
+		err "version not set" "xbmk_get_version" "$@"
 	fi
-	if [ -f ".versiondate" ]; then
-		chkvars versiondate
+	if [ -f ".versiondate" ] && [ -z "$versiondate" ]; then
+		err "versiondate not set" "xbmk_get_version" "$@"
 	fi
 
 	if [ ! -e ".git" ] && [ ! -f ".version" ]; then
@@ -281,7 +300,10 @@ xbmk_set_version()
 		    --pretty='%ct' HEAD)" || versiondate="$versiondate_"
 	fi
 
-	chkvars version versiondate
+	if [ -z "$version" ] || [ -z "$versiondate" ]; then
+		err "version and/or versiondate unset" "xbmk_set_version" "$@"
+	fi
+
 	update_xbmkver "."
 
 	relname="$projectname-$version"
diff --git a/include/inject.sh b/include/inject.sh
index 9f30b0a0..19a2716e 100644
--- a/include/inject.sh
+++ b/include/inject.sh
@@ -17,8 +17,17 @@ if [ -n "$cvchk" ]; then
 	cv="$cv $cvchk"
 fi
 
-eval "`setvars "" archive boarddir IFD_platform ifdprefix tree new_mac \
-    tmpromdir board xchanged $cv`"
+archive=""
+boarddir=""
+IFD_platform=""
+ifdprefix=""
+tree=""
+new_mac=""
+tmpromdir=""
+board=""
+xchanged=""
+
+eval "`setvars "" $cv`"
 
 inject()
 {
@@ -118,7 +127,9 @@ check_target()
 	. "$boarddir/target.cfg" || \
 	    err "Can't read '$boarddir/target.cfg'" "check_target" "$@"
 
-	chkvars tree
+	if [ -z "$tree" ]; then
+		err "tree unset in '$boarddir/target.cfg'" "check_target" "$@"
+	fi
 
 	x_ ./mk -d coreboot "$tree"
 
diff --git a/include/lib.sh b/include/lib.sh
index 833f284d..c888200c 100644
--- a/include/lib.sh
+++ b/include/lib.sh
@@ -91,7 +91,6 @@ setvars()
 	_setvars=""
 
 	if [ $# -lt 2 ]; then
-		printf "err \"setvars: too few args\\n\""
 
 		return 0
 	else
@@ -107,14 +106,6 @@ setvars()
 	fi
 }
 
-chkvars()
-{
-	while [ $# -gt 0 ]; do
-		eval "[ -n \"\${$1+x}\" ] || err \"$1 unset\""
-		eval "[ -n \"\$$1\" ] || err \"$1 unset\"; shift 1; :"
-	done; :
-}
-
 # return 0 if project is single-tree, otherwise 1
 # e.g. coreboot is multi-tree, so 1
 singletree()
diff --git a/include/mrc.sh b/include/mrc.sh
index d2249aeb..92241b22 100644
--- a/include/mrc.sh
+++ b/include/mrc.sh
@@ -18,7 +18,10 @@ extract_refcode()
 	# and refcode is extracted from an image using the old scheme. we use
 	# cbfstool from coreboot 4.11_branch, the tree used by ASUS KGPE-D16:
 
-	chkvars cbfstoolref
+	if [ -z "$cbfstoolref" ]; then
+		err "cbfstoolref not set" "extract_refcode" "$@"
+	fi
+
 	x_ mkdir -p "${_pre_dest%/*}"
 
 	x_ "$cbfstoolref" "$appdir/bios.bin" extract \
@@ -35,7 +38,12 @@ extract_refcode()
 
 extract_mrc()
 {
-	chkvars "MRC_board" "CONFIG_MRC_FILE"
+	if [ -z "$MRC_board" ]; then
+		err "MRC_board unset" "extract_mrc" "$@"
+	elif [ -z "$CONFIG_MRC_FILE" ]; then
+		err "CONFIG_MRC_FILE unset" "extract_mrc" "$@"
+	fi
+
 	SHELLBALL="chromeos-firmwareupdate-$MRC_board"
 
 	(
diff --git a/include/tree.sh b/include/tree.sh
index 80815465..6d2d2f7c 100644
--- a/include/tree.sh
+++ b/include/tree.sh
@@ -4,11 +4,48 @@
 # Copyright (c) 2022 Ferass El Hafidi <vitali64pmemail@protonmail.com>
 # Copyright (c) 2023-2025 Leah Rowe <leah@libreboot.org>
 
-eval "`setvars "" xarch srcdir premake gnatdir xlang mode makeargs elfdir cmd \
-    project target target_dir targets xtree _f release bootstrapargs mkhelper \
-    autoconfargs listfile autogenargs btype rev build_depend gccdir cmakedir \
-    defconfig postmake mkhelpercfg dry dest_dir mdir cleanargs gccver gccfull \
-    gnatver gnatfull do_make badhash badtghash tree forcepull`"
+xarch=""
+srcdir=""
+premake=""
+gnatdir=""
+xlang=""
+mode=""
+makeargs=""
+elfdir=""
+cmd=""
+project=""
+target=""
+target_dir=""
+targets=""
+xtree=""
+_f=""
+release=""
+bootstrapargs=""
+mkhelper=""
+autoconfargs=""
+listfile=""
+autogenargs=""
+btype=""
+rev=""
+build_depend=""
+gccdir=""
+cmakedir=""
+defconfig=""
+postmake=""
+mkhelpercfg=""
+dry=""
+dest_dir=""
+mdir=""
+cleanargs=""
+gccver=""
+gccfull=""
+gnatver=""
+gnatfull=""
+do_make=""
+badhash=""
+badtghash=""
+tree=""
+forcepull=""
 
 trees()
 {
@@ -172,7 +209,10 @@ handle_defconfig()
 		return 0
 	fi
 
-	chkvars tree
+	if [ -z "$tree" ]; then
+		err "$configdir: 'tree' not set" "handle_defconfig" "$@"
+	fi
+
 	srcdir="src/$project/$tree"
 
 	if [ "$mode" = "${mode%clean}" ] && [ ! -d "$srcdir" ]; then
@@ -209,9 +249,21 @@ handle_defconfig()
 
 configure_project()
 {
-	eval "`setvars "" cleanargs build_depend autoconfargs xtree postmake \
-	    makeargs btype mkhelper bootstrapargs premake release xlang xarch \
-	    badhash badtghash`"
+	cleanargs=""
+	build_depend=""
+	autoconfargs=""
+	xtree=""
+	postmake=""
+	makeargs=""
+	btype=""
+	mkhelper=""
+	bootstrapargs=""
+	premake=""
+	release=""
+	xlang=""
+	xarch=""
+	badhash=""
+	badtghash=""
 
 	_tcfg="$1/target.cfg"
 
diff --git a/include/vendor.sh b/include/vendor.sh
index 3ed16d8e..87b1df84 100644
--- a/include/vendor.sh
+++ b/include/vendor.sh
@@ -35,17 +35,65 @@ cvxbmk="CONFIG_ME_BIN_PATH CONFIG_SMSC_SCH5545_EC_FW_FILE CONFIG_FSP_FULL_FD \
     CONFIG_HAVE_REFCODE_BLOB CONFIG_REFCODE_BLOB_FILE CONFIG_FSP_FD_PATH \
     CONFIG_IFD_BIN_PATH CONFIG_MRC_FILE CONFIG_FSP_M_CBFS"
 
-# lbmk-specific extensions; mostly used for downloading vendor files
-eval "`setvars "" has_hashes EC_hash DL_hash DL_url_bkup MRC_refcode_gbe vcfg \
-    E6400_VGA_DL_hash E6400_VGA_DL_url E6400_VGA_DL_url_bkup E6400_VGA_offset \
-    E6400_VGA_romname SCH5545EC_DL_url_bkup SCH5545EC_DL_hash _dest mecleaner \
-    kbc1126_ec_dump MRC_refcode_cbtree _dl SCH5545EC_DL_url EC_url rom DL_url \
-    nuke cbfstoolref FSPFD_hash _7ztest ME11bootguard ME11delta xromsize \
-    ME11version ME11sku ME11pch _me _metmp mfs TBFW_url_bkup TBFW_url cbdir \
-    TBFW_hash TBFW_size hashfile EC_url_bkup FSPM_bin_hash FSPS_bin_hash \
-    EC_FW1_hash EC_FW2_hash ME_bin_hash MRC_bin_hash REF_bin_hash _dl_bin \
-    SCH5545EC_bin_hash TBFW_bin_hash E6400_VGA_bin_hash _pre_dest \
-    XBMKmecleaner MEclean`"
+# lbmk-specific extensions; general variables
+_dest=""
+has_hashes=""
+vcfg=""
+mecleaner=""
+kbc1126_ec_dump=""
+_dl=""
+rom=""
+nuke=""
+_7ztest=""
+cbfstoolref=""
+_me=""
+_metmp=""
+mfs=""
+cbdir=""
+hashfile=""
+_dl_bin=""
+_pre_dest=""
+
+# lbmk-specific extensions; declared in pkg.cfg files in config/vendor/
+EC_hash=""
+DL_hash=""
+DL_url_bkup=""
+MRC_refcode_gbe=""
+E6400_VGA_DL_hash=""
+E6400_VGA_DL_url=""
+E6400_VGA_DL_url_bkup=""
+E6400_VGA_offset=""
+E6400_VGA_romname=""
+SCH5545EC_DL_url_bkup=""
+SCH5545EC_DL_hash=""
+MRC_refcode_cbtree=""
+SCH5545EC_DL_url=""
+EC_url=""
+DL_url=""
+FSPFD_hash=""
+ME11bootguard=""
+ME11delta=""
+xromsize=""
+ME11version=""
+ME11sku=""
+ME11pch=""
+TBFW_url_bkup=""
+TBFW_url=""
+TBFW_hash=""
+TBFW_size=""
+EC_url_bkup=""
+FSPM_bin_hash=""
+FSPS_bin_hash=""
+EC_FW1_hash=""
+EC_FW2_hash=""
+ME_bin_hash=""
+MRC_bin_hash=""
+REF_bin_hash=""
+SCH5545EC_bin_hash=""
+TBFW_bin_hash=""
+E6400_VGA_bin_hash=""
+XBMKmecleaner=""
+MEclean=""
 
 download()
 {
@@ -118,6 +166,10 @@ fetch()
 	dlop="$6"
 	binsum="$7"
 
+	if [ -z "$binsum" ]; then
+		err "binsum is empty (no checksum)" "fetch" "$@"
+	fi
+
 	_dl="$XBMK_CACHE/file/$dlsum" # internet file to extract from e.g. .exe
 	_dl_bin="$XBMK_CACHE/file/$binsum" # extracted file e.g. me.bin
 
@@ -130,11 +182,17 @@ fetch()
 	remkdir "${_pre_dest%/*}" "$appdir"
 
 	# HACK: if grabbing fsp from coreboot, fix the path for lbmk
-	[ "$dl_type" = "fsp" ] && for _cdl in dl dl_bkup; do
-		eval "$_cdl=\"\${$_cdl##*../}\"; _cdp=\"\$$_cdl\""
-		[ -f "$_cdp" ] || _cdp="$cbdir/$_cdp"
-		[ -f "$_cdp" ] && eval "$_cdl=\"$_cdp\""; :
-	done; :
+	if [ "$dl_type" = "fsp" ]; then
+		dl="${dl##*../}"
+		_cdp="$dl"
+		[ -f "$_cdp" ] || _cdp="$cbdir/$_cdp"; :
+		[ -f "$_cdp" ] && dl="$_cdp"; :
+
+		dl="${dl_bkup##*../}"
+		_cdp="$dl_bkup"
+		[ -f "$_cdp" ] || _cdp="$cbdir/$_cdp"; :
+		[ -f "$_cdp" ] && dl_bkup="$_cdp"; :
+	fi
 
 	# download the file (from the internet) to extract from:
 
@@ -162,7 +220,7 @@ fetch()
 	# some functions don't output directly to the given file, _pre_dest.
 	# instead, they put multiple files there, but we need the one matching
 	# the given hashsum. So, search for a matching file via bruteforce:
-	( fx_ "eval mkdst \"$binsum\"" x_ find "${_pre_dest%/*}" -type f ) || :
+	( fx_ "mkdst $binsum" x_ find "${_pre_dest%/*}" -type f ) || :
 
 	if ! bad_checksum "$binsum" "$_dest"; then
 		if [ -f "$_dest" ]; then
@@ -210,7 +268,13 @@ extract_intel_me()
 
 	if [ "$ME11bootguard" = "y" ]; then
 		mfs="--whitelist MFS"
-		chkvars ME11delta ME11version ME11sku ME11pch
+
+		if [ -z "$ME11delta" ] || [ -z "$ME11version" ] || \
+		    [ -z "$ME11sku" ] || [ -z "$ME11pch" ]; then
+			err "$board: ME11delta/ME11version/ME11sku/ME11pch" \
+			    "extract_intel_me" "$@"
+		fi
+
 		x_ ./mk -f deguard
 	fi
 
@@ -356,7 +420,10 @@ extract_e6400vga()
 {
 	set +u +e
 
-	chkvars E6400_VGA_offset E6400_VGA_romname
+	if [ -z "$E6400_VGA_offset" ] || [ -z "$E6400_VGA_romname" ]; then
+		err "$board: E6400_VGA_romname/E6400_VGA_offset unset" \
+		    "extract_e6400vga" "$@"
+	fi
 
 	tail -c +$E6400_VGA_offset "$_dl" | gunzip > "$appdir/bios.bin" || :
 
@@ -387,7 +454,10 @@ extract_sch5545ec()
 # https://pcsupport.lenovo.com/us/en/products/laptops-and-netbooks/thinkpad-t-series-laptops/thinkpad-t480-type-20l5-20l6/20l5/solutions/ht508988
 extract_tbfw()
 {
-	chkvars TBFW_size
+	if [ -z "$TBFW_size" ]; then
+		err "$board: TBFW_size unset" "extract_tbfw" "$@"
+	fi
+
 	fx_ copytb x_ find "$appdir" -type f -name "TBT.bin"
 }
 
@@ -410,8 +480,12 @@ extract_fsp()
 setvfile()
 {
 	[ -n "$vcfg" ] && for c in $cvchk; do
-		vcmd="[ \"\${$c}\" != \"/dev/null\" ] && [ -n \"\${$c}\" ]"
-		eval "$vcmd && getvfile \"\$@\" && return 0"
+		vcmd="[ \"\${$c}\" = \"/dev/null\" ] || [ -z \"\${$c}\" ]"
+		eval "$vcmd || return 0"
+
+		if getvfile "$@"; then
+			return 0
+		fi
 	done && return 1; :
 }