The attached patch (against devscripts master) fixes this bug:
* the ". "$(...)" carve-out now also matches a quoted command
substitution whose contents contain nested quotes, e.g.
. "$(realpath "${config_file}")";
* the check no longer fires when the token in the script-name
slot is a shell operator — that is a case pattern list such as
"" | . | .. | */)
not a sourced file (a separate report covers that shape).
It adds test/bashisms/870309.sh (test_870309), which keeps a real
case firing:
. ./config.sh "$@"
Verified: the new test and the full test/test_checkbashisms suite
pass with the patch; the added cases fail without it. Genuine
"sourced script with arguments" uses still fire, including
. "$(cmd)" realarg.
Disclosure, encouraged by Debian GR 2026-002: this patch was
prepared with AI assistance; it was verified by me against the
reproducers and the devscripts test suite.
fp2-sourced-script-870309.patch
Description: Binary data
