rpminspect fails for 'shellsyntax' on a non-shell file

[Jonathan Wakely]

Has something changed in rpminspect recently? I built a new dejagnu
package and it's failing rpminspect:
https://artifacts.dev.testing-farm.io/d6ffbc34-995f-47a5-b41a-87b5ff33be0d/

The error is:
"/usr/share/dejagnu/remote.exp is not a valid sh script on noarch"

and ... well, that's true. It's not a sh script at all. It's not
executable, it doesn't have a shebang, it doesn't end in .sh ... why
is rpminspect even looking at it?

A build a few weeks ago didn't have this problem.

[Omair Majid]

Hi,

Jonathan Wakely  writes:
> Has something changed in rpminspect recently? I built a new dejagnu
> package and it's failing rpminspect:
> https://artifacts.dev.testing-farm.io/d6ffbc34-995f-47a5-b41a-87b5ff33be0d/
> The error is:
> "/usr/share/dejagnu/remote.exp is not a valid sh script on noarch"
>
> and ... well, that's true. It's not a sh script at all. It's not
> executable, it doesn't have a shebang, it doesn't end in .sh ... why
> is rpminspect even looking at it?

I suspect this is the reason why:
https://github.com/rpminspect/rpminspect/pull/1412

rpminspect sees that the remote.exp file has a mime-type beginning with
`text/`, then sees that it contains `exec sh...` so the heuristic it
uses concludes that the script itself is an `sh` script.
> A build a few weeks ago didn't have this problem.

Fedora's CI was using a stale version of rpmisnpect for a while, so
maybe that's why this started showing up now?

Omair

--
PGP Key: B157A9F0 (http://pgp.mit.edu/)
Fingerprint = 9DB5 2F0B FD3E C239 E108  E7BD DF99 7AF8 B157 A9F0

[Omair Majid]

Hi,

(Re-sending with fixed CC, sorry)

Jonathan Wakely  writes:
> Has something changed in rpminspect recently? I built a new dejagnu
> package and it's failing rpminspect:
> https://artifacts.dev.testing-farm.io/d6ffbc34-995f-47a5-b41a-87b5ff33be0d/
> The error is:
> "/usr/share/dejagnu/remote.exp is not a valid sh script on noarch"
>
> and ... well, that's true. It's not a sh script at all. It's not
> executable, it doesn't have a shebang, it doesn't end in .sh ... why
> is rpminspect even looking at it?

I suspect this is the reason why:
https://github.com/rpminspect/rpminspect/pull/1412

rpminspect sees that the remote.exp file has a mime-type beginning with
`text/`, then sees that it contains `exec sh...` so the heuristic it
uses concludes that the script itself is an `sh` script.
> A build a few weeks ago didn't have this problem.

Fedora's CI was using a stale version of rpmisnpect for a while, so
maybe that's why this started showing up now?

Omair
--
PGP Key: B157A9F0 (http://pgp.mit.edu/)
Fingerprint = 9DB5 2F0B FD3E C239 E108  E7BD DF99 7AF8 B157 A9F0

[Martin Cermak]

On  Sun  2026-05-24  22:32 , Omair Majid wrote:
> Hi,
>
> (Re-sending with fixed CC, sorry)
>
> Jonathan Wakely  writes:
> > Has something changed in rpminspect recently? I built a new dejagnu
> > package and it's failing rpminspect:
> > https://artifacts.dev.testing-farm.io/d6ffbc34-995f-47a5-b41a-87b5ff33be0d/
> > The error is:
> > "/usr/share/dejagnu/remote.exp is not a valid sh script on noarch"
> >
> > and ... well, that's true. It's not a sh script at all. It's not
> > executable, it doesn't have a shebang, it doesn't end in .sh ... why
> > is rpminspect even looking at it?
>
> I suspect this is the reason why:
> https://github.com/rpminspect/rpminspect/pull/1412
>
> rpminspect sees that the remote.exp file has a mime-type beginning with
> `text/`, then sees that it contains `exec sh...` so the heuristic it
> uses concludes that the script itself is an `sh` script.
> > A build a few weeks ago didn't have this problem.
>
> Fedora's CI was using a stale version of rpmisnpect for a while, so
> maybe that's why this started showing up now?

The last working RPMInspect version is 2.2-1.1.202605131544git7d0 
First broken one seems to be 2.2-1.1.202605141747git545 .
This imho points the finger to the following commit

https://github.com/rpminspect/rpminspect/commit/545d62d4387240acc3326145b4b9...

I've notified dcantrell (along with some rough AI generated patch
suggestion).

Martin

[Jonathan Wakely]

On Mon, 25 May 2026 at 03:32, Omair Majid  wrote:
> Hi,
>
> (Re-sending with fixed CC, sorry)
>
> Jonathan Wakely  writes:
> > Has something changed in rpminspect recently? I built a new dejagnu
> > package and it's failing rpminspect:
> > https://artifacts.dev.testing-farm.io/d6ffbc34-995f-47a5-b41a-87b5ff33be0d/
> > The error is:
> > "/usr/share/dejagnu/remote.exp is not a valid sh script on noarch"
> >
> > and ... well, that's true. It's not a sh script at all. It's not
> > executable, it doesn't have a shebang, it doesn't end in .sh ... why
> > is rpminspect even looking at it?
>
> I suspect this is the reason why:
> https://github.com/rpminspect/rpminspect/pull/1412

I did find that in the repo, but thought that it couldn't be the
reason because it was merged in 2024, but ...
> rpminspect sees that the remote.exp file has a mime-type beginning with
> `text/`, then sees that it contains `exec sh...` so the heuristic it
> uses concludes that the script itself is an `sh` script.
> > A build a few weeks ago didn't have this problem.
>
> Fedora's CI was using a stale version of rpmisnpect for a while, so
> maybe that's why this started showing up now?

... that would explain it, thanks.

[Dave Cantrell]

On 5/25/26 9:31 AM, Jonathan Wakely wrote:
> On Mon, 25 May 2026 at 03:32, Omair Majid  wrote:
> > Hi,
> >
> > (Re-sending with fixed CC, sorry)
> >
> > Jonathan Wakely  writes:
> > > Has something changed in rpminspect recently? I built a new dejagnu
> > > package and it's failing rpminspect:
> > > https://artifacts.dev.testing-farm.io/d6ffbc34-995f-47a5-b41a-87b5ff33be0d/
> > > The error is:
> > > "/usr/share/dejagnu/remote.exp is not a valid sh script on noarch"
> > >
> > > and ... well, that's true. It's not a sh script at all. It's not
> > > executable, it doesn't have a shebang, it doesn't end in .sh ... why
> > > is rpminspect even looking at it?
> >
> > I suspect this is the reason why:
> > https://github.com/rpminspect/rpminspect/pull/1412
>
> I did find that in the repo, but thought that it couldn't be the
> reason because it was merged in 2024, but ...
> > rpminspect sees that the remote.exp file has a mime-type beginning with
> > `text/`, then sees that it contains `exec sh...` so the heuristic it
> > uses concludes that the script itself is an `sh` script.
> > > A build a few weeks ago didn't have this problem.
> >
> > Fedora's CI was using a stale version of rpmisnpect for a while, so
> > maybe that's why this started showing up now?
>
> ... that would explain it, thanks.

I made this change today:

https://github.com/rpminspect/rpminspect/pull/1589

Restrict the looking for an exec line to only happen if we also pick up a known shell from a #! line.  This should avoid running checks on script code that lacks a #! as well as README files that have code in them.  In this case the dejagnu remote.exp script is Tcl code, but it's not meant to be run directly by a user.  And it would use tclsh or wish anyway, which the shellsyntax inspection does not handle.  Or at least doesn't mean to go out of its way to handle.