Fixed short options missing from getopt option strings by claude[bot] · Pull Request #6262 · cfengine/core

claude · 2026-07-31T19:46:38Z

Requested by Ole Herman · Slack thread

Several documented short options were silently rejected because their characters were missing from the getopt_long() option strings, and several option strings still carried characters for options removed years ago. After this PR:

Documented short options that were rejected as unknown now work: cf-check -V, cf-net -t/-c, cf-secret -v/-g/-I, cf-testd -r.
cf-serverd -L <path> (--ld-library-path) now receives its argument instead of a NULL optarg (which was dereferenced unconditionally) and a stray positional argument.
Stale characters left behind by removed options (-1 in cf-execd, -S in cf-monitord/cf-promises/cf-runagent/cf-serverd, and the vestigial argument-taking q:/i:/f: in cf-runagent/cf-promises/cf-testd) no longer swallow arguments or die with an unhelpful generic usage error — they are now reported as ordinary unrecognized options.
cf-runagent gains a --no-lock long option for its existing, working, previously help-invisible -K, matching cf-agent, cf-execd, cf-serverd and cf-monitord.

How

One commit per component:

File	Option string change	Why
`cf-check/cf-check.c`	`+hMg:dvI` → `+hMVg:dvI`	`-V` (`--version`) was advertised and handled but rejected
`cf-execd/cf-execd.c`	removed stray `1`	leftover from a removed undocumented `-F` alias; no table entry, no case
`cf-monitord/cf-monitord.c`	removed stray `S`	leftover from `--syntax`, removed 2008
`cf-net/cf-net.c`	appended `t:c:`	`-t` (`--tls-version`) and `-c` (`--ciphers`) advertised and handled but rejected
`cf-promises/cf-promises.c`	removed stray `S` and vestigial `i:`	`--syntax` leftover; `-i` swallowed an argument then errored
`cf-runagent/cf-runagent.c`	removed vestigial `q:` and stray `S`	`--query` moved to cf-hub in 2013; `-S` vestigial since 2008
`cf-runagent/cf-runagent.c`	added `{"no-lock", no_argument, 0, 'K'}` + matching HINTS entry	`-K` worked but had no long form and was absent from `--help`/man
`cf-secret/cf-secret.c`	`hMedk:o:H:` → `hMdvIg:k:o:H:`	`-v`/`-I`/`-g` advertised and handled but rejected; `e` left over from removed `--encrypt`
`cf-serverd/cf-serverd-functions.c`	`L` → `L:`, removed stray `S`	`--ld-library-path` is `required_argument` but got NULL `optarg`; `--syntax` leftover
`cf-testd/cf-testd.c`	removed orphan `f:`, added `r:`	`--file`/`-f` was renamed to `--report`/`-r` without updating the option string

Notes

Found by a systematic audit of every getopt_long() call site, prompted by the cf-hub -i bug fixed in cfengine/nova#2671.
Intentionally-hidden options were deliberately left alone: the hidden -M man-page generation hook shared by all daemons (used by docs/manpages/Makefile.am), and cf-promises' deliberate deprecated -r error shim.
Each finding was verified against --help/man output and git history before fixing. The pre-existing duplicate V/bare g in cf-execd's option string and the duplicate g: in cf-promises' were left untouched to keep the diff minimal.

CLAassistant · 2026-07-31T19:46:47Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

olehermanse · 2026-08-21T18:04:31Z

@cf-bottom jenkins, please

cf-bottom · 2026-08-21T18:08:19Z

Sure, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/14561/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14561/

olehermanse · 2026-08-21T18:31:37Z

Testing with current nightly (before these changes).

It is correct that cf-check -V does not work as intended:

root@ip-172-31-14-90:/home/ubuntu# cf-check --help
Usage: cf-check [OPTIONS] COMMAND [FILE]

Options:
  --help        , -h value - Print the help message
  --manpage     , -M       - Print the man page
  --version     , -V       - Output the version of the software
  --debug       , -d       - Enable debugging output
  --verbose     , -v       - Enable verbose output
  --log-level   , -g value - Specify how detailed logs should be. Possible values: 'error', 'warning', 'notice', 'info', 'verbose', 'debug'
  --inform      , -I       - Enable basic information output

Commands:
  help         - Prints general help or per topic.
                 Usage: cf-check help [command]
  diagnose     - Assess the health of one or more database files.
                 Usage: cf-check diagnose
  backup       - Backup database files to a timestamped folder.
                 Usage: cf-check backup
  repair       - Diagnose, then backup and delete any corrupt databases.
                 Usage: cf-check repair
  dump         - Print the contents of a database file.
                 Usage: cf-check dump /var/cfengine/state/cf_lastseen.lmdb
  lmdump       - LMDB database dumper (deprecated).
                 Usage: cf-check lmdump -a /var/cfengine/state/cf_lastseen.lmdb

Website: https://cfengine.com
This software is Copyright 2026 Northern.tech AS.
root@ip-172-31-14-90:/home/ubuntu# cf-check -V
cf-check: invalid option -- 'V'
root@ip-172-31-14-90:/home/ubuntu# cf-check --version
cf-check BETA version 3.29.0a.41a820ed2

olehermanse · 2026-08-21T18:36:51Z

cf-secret -I before changes:

root@ip-172-31-14-90:/home/ubuntu# cf-secret encrypt ./test -o test2 -I
   error: Unknown option '-I'
Usage: cf-secrets COMMAND [OPTIONS] [FILE]

Commands:
  encrypt      - Encrypt data for one or more hosts/keys.
                 Usage: cf-secret encrypt [-k/-H KEY/HOST] -o OUTPUT INPUT
  decrypt      - Decrypt data.
                 Usage: cf-secret decrypt [-k/-H KEY/HOST] -o OUTPUT INPUT
  print-headers - Print headers from an encrypted file.
                 Usage: cf-secret print-headers ENCRYPTED_FILE

Options:
  --help        , -h       - Print the help message
  --manpage     , -M       - Print the man page
  --debug       , -d       - Enable debugging output
  --verbose     , -v       - Enable verbose output
  --log-level   , -g value - Specify how detailed logs should be. Possible values: 'error', 'warning', 'notice', 'info', 'verbose', 'debug'
  --inform      , -I       - Enable basic information output
  --key         , -k value - Comma-separated list of key files to use
  --host        , -H value - Comma-separated list of hosts to encrypt/decrypt for (defaults to 'localhost')
  --output      , -o value - Output file (required for encrypt/decrypt)

Website: https://cfengine.com
This software is Copyright 2026 Northern.tech AS.
root@ip-172-31-14-90:/home/ubuntu# cf-secret encrypt ./test -o test2 --inform
    info: Inform log level enabled
   error: Could not open input file './test'
   error: Encryption failed

The --version long option worked, but the advertised -V short form was rejected as an unknown option because 'V' was missing from the getopt option string. The case 'V' handler already existed. Changelog: Fixed cf-check -V (--version) short option

'1' had no option table entry and no switch case, so -1 fell through to the generic usage error. It is a leftover from a removed undocumented alias for -F; --once/-O supersedes it. Changelog: none

'S' had no option table entry and no switch case, so -S fell through to the generic usage error. It is a leftover from the --syntax option removed in 2008. Changelog: none

The long options --tls-version and --ciphers worked, but their advertised short forms -t and -c were rejected as unknown options because they were missing from the getopt option string. Both take a required argument and both already have switch case handlers. Changelog: Fixed cf-net -t (--tls-version) and -c (--ciphers) short options

…tring Neither had an option table entry or a switch case: -S fell through to the generic usage error (leftover from the removed --syntax option), and -i silently swallowed an argument before erroring out. The deliberate deprecated -r error shim is left untouched. Changelog: none

…tring Neither had an option table entry or a switch case: -q silently swallowed an argument before failing with the generic usage error (leftover from --query, which moved to cf-hub in 2013), and -S fell through to the same error (vestigial since 2008). Changelog: none

The -K short option already worked (it sets ignore_locks) but had no option table entry, so it had no long form and was missing from --help and man output. This adds the --no-lock long option and hint, matching cf-agent, cf-execd, cf-serverd and cf-monitord. Changelog: Added --no-lock long option to cf-runagent, matching the existing -K short option

The --verbose, --inform and --log-level long options worked and their short forms are advertised in help and man output, but -v, -I and -g were rejected as unknown options because they were missing from the getopt option string. Also removed the stray 'e' left over from the removed --encrypt option. Changelog: Fixed cf-secret -v (--verbose), -g (--log-level) and -I (--inform) short options

The option table declares --ld-library-path as required_argument, but the option string had a bare 'L', so '-L <path>' left optarg NULL (dereferenced unconditionally) and the path behind as a stray positional argument. Also removed the stray 'S' left over from the --syntax option removed in 2008. Changelog: Fixed cf-serverd -L (--ld-library-path) to accept its argument

The --report long option worked and -r is advertised in help output, but the short form was rejected because 'r' was missing from the getopt option string. Also removed the orphan 'f:' left behind when --file/-f was renamed to --report/-r. Changelog: none

olehermanse · 2026-08-21T18:47:23Z

@cf-bottom jenkins, please

cf-bottom · 2026-08-21T18:48:19Z

Alright, I triggered a build:

Jenkins: https://ci.cfengine.com/job/pr-pipeline/14562/

Packages: http://buildcache.cfengine.com/packages/testing-pr/jenkins-pr-pipeline-14562/

craigcomstock

yeah. cool.

olehermanse requested review from larsewi and removed request for larsewi July 31, 2026 22:06

olehermanse self-assigned this Jul 31, 2026

olehermanse added the cherry-pick? Fixes which may need to be cherry-picked to LTS branches label Jul 31, 2026

olehermanse self-requested a review July 31, 2026 22:06