The runnable companion repo for the Coursera course Bashrs from Zero: Bidirectional Shell Safety for Data Pipelines — Course 11 of the Rust for Data Engineering specialization. This is a teaching artifact: every file in this repo is referenced by name from a course lesson, lab, or the capstone reading.
.
├── etl/ # tiny CSV → SQLite ETL — what the install.sh deploys
├── installer/
│ ├── install.rs # Rust source of the installer
│ └── install.sh # transpiled by `bashrs build`, byte-identical across runs
├── scripts/
│ ├── messy/ # the BEFORE artifacts — deliberately broken
│ └── clean/ # the AFTER artifacts — bashrs-purified, score ≥ 8
├── playbooks/
│ └── install.playbook.yaml # state-machine test for install.sh
└── docs/
├── before-after.md # side-by-side messy → clean walkthrough
├── score-report.md # live `bashrs score` output (regenerable)
└── lab-references.md # which lab card uses which repo file
Prerequisites:
- Rust 1.89+ via rustup (
rust-toolchain.tomlpins it) bashrs6.66.0 —cargo install bashrs --version 6.66.0 --lockeddash+shellcheck(apt or brew) for cross-shell smoke tests- Optional:
cargo-llvm-covfor the 100% coverage gate
Then:
git clone https://github.com/paiml/bashrs-from-zero
cd bashrs-from-zero
make help # list every entry point
make test # cargo test in etl/ (18 passing — incl. contract negatives)
make coverage # cargo llvm-cov, gated at 100% lines + 100% functions
make lint # bashrs lint on every clean script
make score-report # regenerate docs/score-report.md
make build-installer # bashrs build installer/install.rs → install.sh
make verify-deterministic # transpile twice, diff (must be byte-identical)
make cross-shell # run install.sh under sh / dash / bash --dry-run
make pmat # pmat tdg + quality-gateCI (.github/workflows/ci.yml) enforces every gate from the course spec.
A green run on main means all of these hold from a fresh clone:
| Gate | Command | Pass condition |
|---|---|---|
| 1 | bashrs lint scripts/clean/*.sh scripts/clean/Dockerfile |
findings reported (advisory, see note) |
| 2 | bashrs score scripts/clean/*.sh |
every script ≥ 8.0/10 |
| 3 | bashrs audit scripts/clean/bootstrap.sh |
grade reported (advisory) |
| 4 | bashrs build installer/install.rs twice → diff |
byte-identical |
| 5 | sh / dash / bash installer/install.sh --dry-run |
exit 0 in all three |
| 6 | make verify-deterministic |
byte-identical transpile |
| 7 | bashrs mutate scripts/clean/deploy.sh --count 10 |
advisory in main CI; 80% kill-rate gate runs weekly via mutation.yml |
| 8 | cargo test in etl/ |
≥ 5 tests, all green |
A note on Gate 2: the original course spec wrote "score ≥ 95" assuming
a 0-100 scale; bashrs score returns 0-10. The honest equivalent is
≥ 8.0/10, which is the threshold this repo enforces. Current
actuals (regenerable via make score-report):
| Script | Score | Grade |
|---|---|---|
scripts/clean/bootstrap.sh |
8.4 | B+ |
scripts/clean/deploy.sh |
8.7 | A- |
scripts/clean/cron-load.sh |
9.3 | A |
Shell scripts are the layer of a data-engineering stack that everyone
ships and nobody reviews. Every bug story in the course has a one-line
shell defect at the bottom of it: $RANDOM chose a session id, a
cron retry double-inserted a day of rows, a Dockerfile's
mkdir /opt/etl fell over on rebuild. bashrs treats those as
falsifiable claims about a script — it is deterministic, it is
idempotent, it transpiles byte-identically — and gives you commands
to verify each one.
The Bashrs from Zero course teaches the workflow. This repo is the
runnable corpus the course points at: every defect class has a
matching messy/ → clean/ pair, and the Rust→shell story has a
working installer end-to-end.
Sibling repos in the same series: paiml/postgres-from-zero · paiml/duckdb-from-zero · paiml/iac-from-zero · paiml/mysql-from-zero
This repo is a course companion artifact. Substantive content changes
flow through the course's authoring workflow, not GitHub PRs. Bug
reports and reproductions of broken-on-clean-clone issues are welcome
— open an issue with the output of make test and make lint and
your platform.
MIT. The bashrs tool itself is dual-licensed MIT/Apache-2.0 — see https://github.com/paiml/bashrs for terms.