neulab/tldr huggingface dataset:
-oA <filename> / --outFile <filename> Similar to nmap it does a file output to all available file formats: LOG, JSON pretty, CSV, HTML. If the filename supplied is equal auto the filename is automatically generated using ´${NODE}-p${port}${YYYYMMDD-HHMM}.${EXT}´ with the according extension. If a directory is provided all output files will put into <filename>/${NODE}-p${port}${YYYYMMDD-HHMM}.{log,json,csv,html}.
-oa <filename> / --outfile <filename> Does the same as the previous option but uses flat JSON instead.
--hints This option is not in use yet. This option is meant to give hints how to fix a finding or at least a help to improve something. GIVE_HINTS is the environment variable for this.
--severity <severity> For CSV and both JSON outputs this will only add findings to the output file if a severity is equal or higher than the severity value specified. Allowed are <LOW|MEDIUM|HIGH|CRITICAL>. WARN is another level which translates to a client-side scanning error or problem. Thus you will always see them in a file if they occur.
--append Normally, if an output file already exists and it has a file size greater zero, testssl.sh will prompt you to manually remove the file exit with an error. --append however will append to this file, without a header. The environment variable APPEND does the same. Be careful using this switch/variable. A complementary option which overwrites an existing file doesn´t exist per design.
--outprefix <fname_prefix> Prepend output filename prefix fname_prefix before ´${NODE}-´. You can use as well the environment variable FNAME_PREFIX. Using this any output files will be named <fname_prefix>-${NODE}-p${port}${YYYYMMDD-HHMM}.<format> when no file name of the respective output option was specified. If you do not like the separator ´-´ you can as well supply a <fname_prefix> ending in ´.´, ´_´ or ´,´. In this case or if you already supplied ´-´ no additional ´-´ will be appended to <fname_prefix>.
A few file output options can also be preset via environment variables.
COLOR RATINGS Testssl.sh makes use of (the eight) standard terminal colors. The color scheme is as follows:
•   light red: a critical finding
•   red: a high finding
•   brown: a medium finding
•   yellow: a low finding
•   green (blue if COLORBLIND is set): something which is either in general a good thing or a negative result of a check which otherwise results in a high finding
•   light green (light blue if COLORBLIND is set) : something which is either in general a very good thing or a negative result of a check which otherwise results in a critical finding
•   no color at places where also a finding can be expected: a finding on an info level
•   cyan: currently only used for --show-each or an additional hint
•   magenta: signals a warning condition, e.g. either a local lack of capabilities on the client side or another problem
•   light magenta: a fatal error which either requires strict consent from the user to continue or a condition which leaves no other choice for testssl.sh to quit
What is labeled as "light" above appears as such on the screen but is technically speaking "bold". Besides --color=3 will color ciphers according to an internal and rough rating.
Markup (without any color) is used in the following manner:
•   bold: for the name of the test
•   underline + bold: for the headline of each test section
•   underline: for a sub-headline
•   italics: for strings just reflecting a value read from the server
TUNING via ENV variables and more options Except the environment variables mentioned above which can replace command line options here a some which cannot be set otherwise. Variables used for tuning are preset with reasonable values. There should be no reason to change them unless you use testssl.sh under special conditions.
•   TERM_WIDTH is a variable which overrides the auto-determined terminal width size. Setting this variable normally only makes sense if you log the output to a file using the --log, --logfile or -oL option.
•   DEBUG_ALLINONE / SETX: when setting one of those to true testssl.sh falls back to the standard bash behavior, i.e. calling bash -x testssl.sh it displays the bash debugging output not in an external file /tmp/testssl-<XX>.log
•   DEBUGTIME: Profiling option. When using bash´s debug mode and when this is set to true, it generates a separate text file with epoch times in /tmp/testssl-<XX>.time. They need to be concatenated by paste /tmp/testssl-<XX>.{time,log}
•   EXPERIMENTAL=true is an option which is sometimes used in the development process to make testing easier. In released versions this has no effect.
•   ALL_CLIENTS=true runs a client simulation with all (currently 126) clients when testing HTTP.
•   UNBRACKTD_IPV6: needs to be set to true for some old versions of OpenSSL (like from Gentoo) which don´t support [bracketed] IPv6 addresses
•   NO_ENGINE: if you have problems with garbled output containing the word ´engine´ you might want to set this to true. It forces testssl.sh not try to configure openssl´s engine or a non existing one from libressl
•   HEADER_MAXSLEEP: To wait how long before killing the process to retrieve a service banner / HTTP header
•   MAX_WAITSOCK: It instructs testssl.sh to wait until the specified time before declaring a socket connection dead. Don´t change this unless you´re absolutely sure what you´re doing. Value is in seconds.
•   CCS_MAX_WAITSOCK Is the similar to above but applies only to the CCS handshakes, for both of the two the two CCS payload. Don´t change this unless you´re absolutely sure what you´re doing. Value is in seconds.
•   HEARTBLEED_MAX_WAITSOCK Is the similar to MAX_WAITSOCK but applies only to the ServerHello after sending the Heartbleed payload. Don´t change this unless you´re absolutely sure what you´re doing. Value is in seconds.
•   MEASURE_TIME_FILE For seldom cases when you don´t want the scan time to be included in the output you can set this to false.
•   STARTTLS_SLEEP is per default set to 10 (seconds). That´s the value testssl.sh waits for a string in the STARTTLS handshake before giving up.
•   MAX_PARALLEL is the maximum number of tests to run in parallel in parallel mass testing mode. The default value of 20 may be made larger on systems with faster processors.
•   MAX_WAIT_TEST is the maximum time (in seconds) to wait for a single test in parallel mass testing mode to complete. The default is 1200.
•   HSTS_MIN is preset to 179 (days). If you want warnings sooner or later for HTTP Strict Transport Security you can change this.
•   HPKP_MIN is preset to 30 (days). If you want warnings sooner or later for HTTP Public Key Pinning you can change this
•   DAYS2WARN1 is the first threshold when you´ll be warning of a certificate expiration of a host, preset to 60 (days). For Let´s Encrypt this value will be divided internally by 2.
•   DAYS2WARN2 is the second threshold when you´ll be warning of a certificate expiration of a host, preset to 30 (days). For Let´s Encrypt this value will be divided internally by 2.
•   TESTSSL_INSTALL_DIR is the derived installation directory of testssl.sh. Relatively to that the bin and mandatory etc directory will be looked for.
•   CA_BUNDLES_PATH: If you have an own set of CA bundles or you want to point testssl.sh to a specific location of a CA bundle, you can use this variable to set the directory which testssl.sh will use. Please note that it overrides completely the builtin path of testssl.sh which means that you will only test against the bundles you point to. Also you might want to use ~/utils/create_ca_hashes.sh to create the hashes for HPKP.
•   MAX_SOCKET_FAIL: A number which tells testssl.sh how often a TCP socket connection may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like Fatal error: repeated openssl s_client connect problem, doesn´t make sense to continue.
•   MAX_OSSL_FAIL: A number which tells testssl.sh how often an OpenSSL s_client connect may fail before the program gives up and terminates. The default is 2. You can increase it to a higher value if you frequently see a message like Fatal error: repeated TCP connect problems, giving up.
•   MAX_HEADER_FAIL: A number which tells testssl.sh how often a HTTP GET request over OpenSSL may return an empty file before the program gives up and terminates. The default is 3. Also here you can increase the threshold when you spot messages like Fatal error: repeated HTTP header connect problems, doesn´t make sense to continue.
testssl.sh testssl.sh
does a default run on https://testssl.sh (protocols, standard cipher lists, PFS, server preferences, server defaults, vulnerabilities, testing all known 370 ciphers, client simulation.
testssl.sh testssl.net:443
does the same default run as above with the subtle difference that testssl.net has two IPv4 addresses. Both are tested.
testssl.sh --ip=one --wide https://testssl.net:443
does the same checks as above, with the difference that one IP address is being picked randomly. Displayed is everything where possible in wide format.
testssl.sh -6 https://testssl.net
As opposed to the first example it also tests the IPv6 part -- supposed you have an IPv6 network and your openssl supports IPv6 (see above).
testssl.sh -t smtp smtp.gmail.com:25
Checks are done via a STARTTLS handshake on the plain text port 25. It checks every IP on smtp.gmail.com.
testssl.sh --starttls=imap imap.gmx.net:143
does the same on the plain text IMAP port.
Please note that for plain TLS-encrypted ports you must not specify the protocol option when no STARTTLS handshake is offered: testssl.sh smtp.gmail.com:465 just checks the encryption on the SMTPS port, testssl.sh imap.gmx.net:993 on the IMAPS port. Also MongoDB which provides TLS support without STARTTLS can be tested directly.
RFCs and other standards •   RFC 2246: The TLS Protocol Version 1.0
•   RFC 2818: HTTP Over TLS
•   RFC 2595: Using TLS with IMAP, POP3 and ACAP
•   RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security
•   RFC 3501: INTERNET MESSAGE ACCESS PROTOCOL - VERSION 4rev1
•   RFC 4346: The Transport Layer Security (TLS) Protocol Version 1.1
•   RFC 4366: Transport Layer Security (TLS) Extensions
•   RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS)
•   RFC 5077: Transport Layer Security (TLS) Session Resumption
•   RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2
•   RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
•   RFC 5321: Simple Mail Transfer Protocol
•   RFC 5746: Transport Layer Security (TLS) Renegotiation Indication Extension
•   RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions
•   RFC 6101: The Secure Sockets Layer (SSL) Protocol Version 3.0
•   RFC 6120: Extensible Messaging and Presence Protocol (XMPP): Core
•   RFC 6125: Domain-Based Application Service Identity [..]
•   RFC 6797: HTTP Strict Transport Security (HSTS)
•   RFC 6961: The Transport Layer Security (TLS) Multiple Certificate Status Request Extension
•   RFC 7469: Public Key Pinning Extension for HTTP (HPKP)
•   RFC 7507: TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks
•   RFC 7627: Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension
•   RFC 7633: X.509v3 Transport Layer Security (TLS) Feature Extension
•   RFC 7465: Prohibiting RC4 Cipher Suites
•   RFC 7685: A Transport Layer Security (TLS) ClientHello Padding Extension
•   RFC 7905: ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS)
•   RFC 7919: Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security
•   RFC 8143: Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP)
•   RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3
•   W3C CSP: Content Security Policy Level 1-3
•   TLSWG Draft: The Transport Layer Security (TLS) Protocol Version 1.3
•   0 testssl.sh finished successfully without errors and without ambiguous results
•   1 testssl.sh has encountered exactly one ambiguous situation or an error during run
•   1+n same as previous. The errors or ambiguous results are added, also per IP.
•   50-200 reserved for returning a vulnerability scoring for system monitoring or a CI tools
•   242 (ERR_CHILD) Child received a signal from master
•   244 (ERR_RESOURCE) Resources testssl.sh needs couldn´t be read
•   245 (ERR_CLUELESS) Weird state, either though user options or testssl.sh
•   246 (ERR_CONNECT) Connectivity problem
•   247 (ERR_DNSLOOKUP) Problem with resolving IP addresses or names
•   248 (ERR_OTHERCLIENT) Other client problem
•   249 (ERR_DNSBIN) Problem with DNS lookup binaries
•   250 (ERR_OSSLBIN) Problem with OpenSSL binary
•   251 (ERR_NOSUPPORT) Feature requested is not supported
•   252 (ERR_FNAMEPARSE) Input file couldn´t be parsed
•   253 (ERR_FCREATE) Output file couldn´t be created
•   254 (ERR_CMDLINE) Cmd line couldn´t be parsed
•   255 (ERR_BASH) Bash version incorrect
etc/*pem are the certificate stores from Apple, Linux, Mozilla Firefox, Windows and Java.
etc/client-simulation.txt contains client simulation data.
etc/cipher-mapping.txt provides a mandatory file with mapping from OpenSSL cipher suites names to the ones from IANA / used in the RFCs.
etc/tls_data.txt provides a mandatory file for ciphers (bash sockets) and key material.
Developed by Dirk Wetter, David Cooper and many others, see CREDITS.md .
Copyright © 2012 Dirk Wetter. License GPLv2: Free Software Foundation, Inc. This is free software: you are free to change and redistribute it under the terms of the license, see LICENSE.
Attribution is important for the future of this project - also in the internet. Thus if you´re offering a scanner based on testssl.sh as a public and/or paid service in the internet you are strongly encouraged to mention to your audience that you´re using this program and where to get this program from. That helps us to get bugfixes, other feedback and more contributions.
Usage WITHOUT ANY WARRANTY. USE at your OWN RISK!
All native Windows platforms emulating Linux are known to be slow.
Probably. Current known ones and interface for filing new ones: https://testssl.sh/bugs/ .
ciphers(1), openssl(1), s_client(1), x509(1), verify(1), ocsp(1), crl(1), bash(1) and the websites https://testssl.sh/ and https://github.com/drwetter/testssl.sh/ .
NETSELECT-APT(1)             General Commands Manual            NETSELECT-APT(1)
netselect-apt - create sources.list for the fastest Debian mirrors
netselect-apt [OPTIONS] [stable|testing|unstable|experimental|release_codename|sid]
netselect-apt automatically creates a sources.list file for using with apt for the specified distribution by downloading the list of Debian mirrors using wget choosing the fastest servers using netselect, and testing the valid servers using curl (if available). The output file is written to OUTFILE.
The list of fastest servers is determined by checking through netselect, which servers responder faster to ICMP queries. In order to determine if the servers are valid a connectiong using the specificied protocol (HTTP or FTP) is done using curl.
If netselect is not installed setuid, then netselect-apt needs to run as an administrator user (i.e. root). This is only required because the network probes done by netselect requires these permissions. No changes are done to the system.
If -i INFILE is passed netselect-apt uses that rather than downloading another copy to a temporary file. The file will be downloaded from http://www.debian.org/mirror/mirrors_full
stable|testing|unstable|experimental|release_codename|sid Specify which distribution of Debian to use.  By default stable is used.
-a, --arch ARCH Use mirrors containing ARCH. By default the architecture of the current machine is used as reported by dpkg
-s, --sources While generating OUTFILE include also deb-src lines to use with ``apt-get source'' to obtain Debian source packages.
-i, --infile INFILE Use INFILE instead of downloading the mirror list to a temporary file. The file must be in the same format as mirrors_full.
-o, --outfile OUTFILE Use OUTFILE instead of sources.list.
-n, --nonfree Include also non-free section while generating OUTFILE.
-f, --ftp Use FTP mirrors instead of HTTP and generate OUTFILE accordingly.
-O OPTIONS The OPTIONS provided are added, verbatim, to netselect when it is run. Here you can provide a (quoted) list of options for netselect.
-t, --tests hosts Make a short list with the number of hosts provided and use that list to test for mirror validity.  By default 10 hosts are tested.
-c, --country COUNTRY Only test the sites found under the country COUNTRY (the value can either be an ISO-3166 value or the full name of the language, in English).  When this value is set the mirror list or the INFILE will be filtered and only the sites that are listed under the given country will be tested. Note that restricting the search might not give the best results, as the "fastest" mirror might not even be in the same country as the system the program is running in.
WANT_SOURCES setting this to 1 is equivalent to --sources
WANT_NONFREE setting this to 1 is equivalent to --nonfree
netselect-apt is unable to work with restricted environments in which network filtering is implemented as it relies on netselect being able to find a suitable mirror. To do this, the system where the script is run needs to have network visibility of the mirrors, as it will probe them using ICMP probes.
netselect-apt is also unable to work in environments where HTTP or FTP network connections have to be done through a proxy host, as it relies on being able to test the validity of the remote mirrors doing direct network connections to them.
netselect-apt will not check if the mirror it suggests as the "fastest" mirror is either valid or up-to-date. It is recommended that users that use this tool also validate that the mirrors suggested are official mirrors and are also current.
netselect(1), wget(1), curl(1), apt(8), sources.list(5).
For Debian GNU/Linux it is recommended that users review the official mirror list at http://www.debian.org/mirror/official as well as the mirror checker tool at http://mirror.debian.org/status.html (which provides information on the up-to-dateness status of mirrors)
This manual page and program have been also enhanced by Filippo Giunchedi <filippo@esaurito.net> and Javier Fernandez-Sanguino <jfs@debian.org>
KSH(1)                       General Commands Manual                      KSH(1)
ksh, rksh, pfksh - KornShell, a standard/restricted command and programming language
Currently, rksh and pfksh are not available on macOS / Darwin.
ksh [ ±abcefhiknoprstuvxBCDP ] [ -R file ] [ ±o option ] ... [ - ] [ arg ... ]
Ksh is a command and programming language that executes commands read from a terminal or a file.  Rksh is a restricted version of the command interpreter ksh; it is used to set up login names and execution environments whose capabilities are more controlled than those of the standard shell.  Rpfksh is a profile shell version of the command interpreter ksh; it is used to execute commands with the attributes specified by the user's profiles (see pfexec(1)).  See Invocation below for the meaning of arguments to the shell.
Definitions. A metacharacter is one of the following characters:
;   &   (   )   ⎪   <   >   new-line   space   tab
A blank is a tab or a space.  An identifier is a sequence of letters, digits, or underscores starting with a letter or underscore.  Identifiers are used as components of variable names.  A vname is a sequence of one or more identifiers separated by a . and optionally preceded by a .. Vnames are used as function and variable names.  A word is a sequence of characters from the character set defined by the current locale, excluding non-quoted metacharacters.
A command is a sequence of characters in the syntax of the shell language.  The shell reads each command and carries out the desired action either directly or by invoking separate utilities.  A built-in command is a command that is carried out by the shell itself without creating a separate process.  Some commands are built-in purely for convenience and are not documented here.  Built-ins that cause side effects in the shell environment and built-ins that are found before performing a path search (see Execution below) are documented here.  For historical reasons, some of these built-ins behave differently than other built-ins and are called special built-ins.
Commands. A simple-command is a list of variable assignments (see Variable Assignments below) or a sequence of blank separated words which may be preceded by a list of variable assignments (see Environment below).  The first word specifies the name of the command to be executed.  Except as specified below, the remaining words are passed as arguments to the invoked command.  The command name is passed as argument 0 (see exec(2)). The value of a simple-command is its exit status; 0-255 if it terminates normally; 256+signum if it terminates abnormally (the name of the signal corresponding to the exit status can be obtained via the -l option of the kill built-in utility).
A pipeline is a sequence of one or more commands separated by ⎪.  The standard output of each command but the last is connected by a pipe(2) to the standard input of the next command.  Each command, except possibly the last, is run as a separate process; the shell waits for the last command to terminate.  The exit status of a pipeline is the exit status of the last command unless the pipefail option is enabled.  Each pipeline can be preceded by the reserved word !  which causes the exit status of the pipeline to become 0 if the exit status of the last command is non- zero, and 1 if the exit status of the last command is 0.
A list is a sequence of one or more pipelines separated by ;, &, ⎪&, &&, or ⎪⎪, and optionally terminated by ;, &, or ⎪&.  Of these five symbols, ;, &, and ⎪& have equal precedence, which is lower than that of && and ⎪⎪.  The symbols && and ⎪⎪ also have equal precedence.  A semicolon (;) causes sequential execution of the preceding pipeline; an ampersand (&) causes asynchronous execution of the preceding pipeline (i.e., the shell does not wait for that pipeline to finish).  The symbol ⎪& causes asynchronous execution of the preceding pipeline with a two-way pipe established to the parent shell; the standard input and output of the spawned pipeline can be written to and read from by the parent shell by applying the redirection operators <& and >& with arg p to commands and by using -p option of the built-in commands read and print described later.  The symbol && (⎪⎪) causes the list following it to be executed only if the preceding pipeline returns a zero (non-zero) value.  One or more new-lines may appear in a list instead of a semicolon, to delimit a command.  The first item  of the first pipeline of a list that is a simple command not beginning with a redirection, and not occurring within a while, until, or if list, can be preceded by a semicolon.  This semicolon is ignored unless the showme option is enabled as described with the set built-in below.
A command is either a simple-command or one of the following.  Unless otherwise stated, the value returned by a command is that of the last simple-command executed in the command.
for vname [ in word ... ] ;do list ;done Each time a for command is executed, vname is set to the next word taken from the in word list.  If in word ...  is omitted, then the for command executes the do list once for each positional parameter that is set starting from 1 (see Parameter Expansion below).  Execution ends when there are no more words in the list.
for (( [expr1] ; [expr2] ; [expr3] )) ;do list ;done The arithmetic expression expr1 is evaluated first (see Arithmetic evaluation below).  The arithmetic expression expr2 is repeatedly evaluated until it evaluates to zero and when non-zero, list is executed and the arithmetic expression expr3 evaluated.  If any expression is omitted, then it behaves as if it evaluated to 1.
select vname [ in word ... ] ;do list ;done A select command prints on standard error (file descriptor 2) the set of words, each preceded by a number.  If in word ...  is omitted, then the positional parameters starting from 1 are used instead (see Parameter Expansion below).  The PS3 prompt is printed and a line is read from the standard input.  If this line consists of the number of one of the listed words, then the value of the variable vname is set to the word corresponding to this number.  If this line is empty, the selection list is printed again.  Otherwise the value of the variable vname is set to null. The contents of the line read from standard input is saved in the variable REPLY.  The list is executed for each selection until a break or end-of-file is encountered.  If the REPLY variable is set to null by the execution of list, then the selection list is printed before displaying the PS3 prompt for the next selection.
case word in [ [(]pattern [ ⎪ pattern ] ... ) list ;; ] ... esac A case command executes the list associated with the first pattern that matches word.  The form of the patterns is the same as that used for file-name generation (see File Name Generation below). The ;; operator causes execution of case to terminate.  If ;& is used in place of ;; the next subsequent list, if any,  is executed.
if list ;then list [ ;elif list ;then list ] ... [ ;else list ] ;fi The list following if is executed and, if it returns a zero exit status, the list following the first then is executed.  Otherwise, the list following elif is executed and, if its value is zero, the list following the next then is executed.  Failing each successive elif list, the else list is executed.  If the if list has non-zero exit status and there is no else list, then the if command returns a zero exit status.
while list ;do list ;done until list ;do list ;done A while command repeatedly executes the while list and, if the exit status of the last command in the list is zero, executes the do list; otherwise the loop terminates.  If no commands in the do list are executed, then the while command returns a zero exit status; until may be used in place of while to negate the loop termination test.
((expression)) The expression is evaluated using the rules for arithmetic evaluation described below.  If the value of the arithmetic expression is non-zero, the exit status is 0, otherwise the exit status is 1.
(list) Execute list in a separate environment.  Note, that if two adjacent open parentheses are needed for nesting, a space must be inserted to avoid evaluation as an arithmetic command as described above.
{ list;} list is simply executed.  Note that unlike the metacharacters ( and ), { and } are reserved words and must occur at the beginning of a line or after a ; in order to be recognized.
[[ expression ]] Evaluates expression and returns a zero exit status when expression is true.  See Conditional Expressions below, for a description of expression.
function varname { list ;} varname () { list ;} Define a function which is referenced by varname.  A function whose varname contains a .  is called a discipline function and the portion of the varname preceding the last .  must refer to an existing variable.  The body of the function is the list of commands between { and }.  A function defined with the function varname syntax can also be used as an argument to the .  special built-in command to get the equivalent behavior as if the varname() syntax were used to define it.  (See Functions below.)
namespace varname { list ;} Defines or uses the name space identifier and runs the commands in list in this name space.  (See Name Spaces below.)
& [ name [ arg... ]  ] Causes subsequent list commands terminated by & to be placed in the background job pool name.  If name is omitted a default unnamed pool is used.  Commands in a named background pool may be executed remotely.
time [ pipeline ] If pipeline is omitted the user and system time for the current shell and completed child processes is printed on standard error. Otherwise, pipeline is executed and the elapsed time as well as the user and system time are printed on standard error.  The TIMEFORMAT variable may be set to a format string that specifies how the timing information should be displayed.  See Shell Variables below for a description of the TIMEFORMAT variable.
The following reserved words are recognized as reserved only when they are the first word of a command and are not quoted:
if then else elif fi case esac for while until do done { } function select time [[ ]] !
Variable Assignments. One or more variable assignments can start a simple command or can be arguments to the typeset, enum, export, or readonly special built-in commands as well as to other declaration commands created as types.  The syntax for an assignment is of the form:
varname=word varname[word]=word No space is permitted between varname and the = or between = and word.
varname=(assign_list) No space is permitted between varname and the =.  The variable varname is unset before the assignment.  An assign_list can be one of the following: word ... Indexed array assignment. [word]=word ... Associative array assignment.  If preceded by typeset -a this will create an indexed array instead. assignment ... Compound variable assignment.  This creates a compound variable varname with sub-variables of the form varname.name, where name is the name portion of assignment.  The value of varname will contain all the assignment elements.  Additional assignments made to sub-variables of varname will also be displayed as part of the value of varname. If no assignments are specified, varname will be a compound variable allowing subsequence child elements to be defined. typeset [options] assignment ... Nested variable assignment.  Multiple assignments can be specified by separating each of them with a ;.  The previous value is unset before the assignment.  Other declaration commands such as readonly, enum, and other declaration commands can be used in place of typeset. . filename Include the assignment commands contained in filename.
In addition, a += can be used in place of the = to signify adding to or appending to the previous value.  When += is applied to an arithmetic type, word is evaluated as an arithmetic expression and added to the current value.  When applied to a string variable, the value defined by word is appended to the value.  For compound assignments, the previous value is not unset and the new values are appended to the current ones provided that the types are compatible.
The right hand side of a variable assignment undergoes all the expansion listed below except word splitting, brace expansion, and file name generation.  When the left hand side is an assignment is a compound variable and the right hand is the name of a compound variable, the compound variable on the right will be copied or appended to the compound variable on the left.
Comments. A word beginning with # causes that word and all the following characters up to a new-line to be ignored. Aliasing. The first word of each command is replaced by the text of an alias if an alias for this word has been defined.  An alias name consists of any number of characters excluding metacharacters, quoting characters, file expansion characters, parameter expansion and command substitution characters, the characters / and =.  The replacement string can contain any valid shell script including the metacharacters listed above.  The first word of each command in the replaced text, other than any that are in the process of being replaced, will be tested for aliases.  If the last character of the alias value is a blank then the word following the alias will also be checked for alias substitution.  Aliases can be used to redefine built-in commands but cannot be used to redefine the reserved words listed above.  Aliases can be created and listed with the alias command and can be removed with the unalias command. Aliasing is performed when scripts are read, not while they are executed. Therefore, for an alias to take effect, the alias definition command has to be executed before the command which references the alias is read. The following aliases are compiled into the shell but can be unset or redefined: autoload=′typeset -fu′ bool=′_Bool′ command=′command  ′ compound=′typeset -C′ fc=hist float=′typeset -lE′ functions=′typeset -f′ hash=′alias -t --′ history=′hist -l′ integer=′typeset -li′ nameref=′typeset -n′ nohup=′nohup  ′ r=′hist -s′ redirect=′command exec′ source=′command .′ stop=′kill -s STOP′ suspend=′kill -s STOP "$$"′ type=′whence -v′
Tilde Substitution. After alias substitution is performed, each word is checked to see if it begins with an unquoted ∼.  For tilde substitution, word also refers to the word portion of parameter expansion (see Parameter Expansion below). If it does, then the word up to a / is checked to see if it matches a user name in the password database (See getpwname(3).)  If a match is found, the ∼ and the matched login name are replaced by the login directory of the matched user.  If no match is found, the original text is left unchanged.  A ∼ by itself, or in front of a /, is replaced by $HOME.  A ∼ followed by a + or - is replaced by the value of $PWD and $OLDPWD respectively.  A ∼ followed by {fd} where fd is a file descriptor number or the name of a variable whose value is a file descriptor, is replaced by a string that is the equivalent to the path name of the file or directory corresponding to this file descriptor.
In addition, when expanding a variable assignment, tilde substitution is attempted when the value of the assignment begins with a ∼, and when a ∼ appears after a :.  The : also terminates a ∼ login name.
Command Substitution. The standard output from a command list enclosed in parentheses preceded by a dollar sign ( $(list) ), or in a brace group preceded by a dollar sign ( ${ list;} ), or in a pair of grave accents (``) may be used as part or all of a word; trailing new-lines are removed.  In the second case, the { and } are treated as a reserved words so that { must be followed by a blank and } must appear at the beginning of the line or follow a ;.  In the third (obsolete) form, the string between the quotes is processed for special quoting characters before the command is executed (see Quoting below).  The command substitution $(cat file) can be replaced by the equivalent but faster $(<file).  The command substitution $(n<#) will expand to the current byte offset for file descriptor n.  Except for the second form, the command list is run in a subshell so that no side effects are possible.  For the second form, the final } will be recognized as a reserved word after any token.
Arithmetic Substitution. An arithmetic expression enclosed in double parentheses preceded by a dollar sign ( $(()) ) is replaced by the value of the arithmetic expression within the double parentheses.
Process Substitution. Each command argument of the form <(list) or >(list) will run process list asynchronously connected to some file in /dev/fd if this directory exists, or else a fifo a temporary directory.  The name of this file will become the argument to the command.  If the form with > is selected then writing on this file will provide input for list.  If < is used, then the file passed as an argument will contain the output of the list process. For example,
paste <(cut -f1 file1) <(cut -f3 file2) | tee >(process1) >(process2)
cuts fields 1 and 3 from the files file1 and file2 respectively, pastes the results together, and sends it to the processes process1 and process2, as well as putting it onto the standard output.  Note that the file, which is passed as an argument to the command, is a UNIX pipe(2) so programs that expect to lseek(2) on the file will not work.
Process substitution of the form <(list) can also be used with the < redirection operator which causes the output of list to be standard input or the input for whatever file descriptor is specified.
Parameter Expansion. A parameter is a variable, one or more digits, or any of the characters *, @, #, ?, -, $, and !.  A variable is denoted by a vname.  To create a variable whose vname contains a ., a variable whose vname consists of everything before the last . must already exist.  A variable has a value and zero or more attributes.  Variables can be assigned values and attributes by using the typeset special built-in command.  The attributes supported by the shell are described later with the typeset special built-in command.  Exported variables pass values and attributes to the environment.
The shell supports both indexed and associative arrays.  An element of an array variable is referenced by a subscript.  A subscript for an indexed array is denoted by an arithmetic expression (see Arithmetic evaluation below) between a [ and a ].  To assign values to an indexed array, use vname=(value ...) or set -A vname  value ... .  The value of all non- negative subscripts must be in the range of 0 through 4,194,303.  A negative subscript is treated as an offset from the maximum current index +1 so that -1 refers to the last element.  Indexed arrays can be declared with the -a option to typeset.  Indexed arrays need not be declared.  Any reference to a variable with a valid subscript is legal and an array will be created if necessary.
An associative array is created with the -A option to typeset.  A subscript for an associative array is denoted by a string enclosed between [ and ].
Referencing any array without a subscript is equivalent to referencing the array with subscript 0.
The value of a variable may be assigned by writing:
vname=value [ vname=value ] ...
${parameter%pattern} ${parameter%%pattern} If the shell pattern matches the end of the value of parameter, then the value of this expansion is the value of the parameter with the matched part deleted; otherwise substitute the value of parameter.  In the first form the smallest matching pattern is deleted and in the second form the largest matching pattern is deleted.  When parameter is @, *, or an array variable with subscript @ or *, the substring operation is applied to each element in turn.
${parameter/pattern/string} ${parameter//pattern/string} ${parameter/#pattern/string} ${parameter/%pattern/string} Expands parameter and replaces the longest match of pattern with the given string.  Each occurrence of \n in string is replaced by the portion of parameter that matches the n-th sub-pattern.  In the first form, only the first occurrence of pattern is replaced. In the second form, each match for pattern is replaced by the given string.  The third form restricts the pattern match to the beginning of the string while the fourth form restricts the pattern match to the end of the string.  When string is null, the pattern will be deleted and the / in front of string may be omitted.  When parameter is @, *, or an array variable with subscript @ or *, the substitution operation is applied to each element in turn.  In this case, the string portion of word will be re-evaluated for each element.
${parameter^pattern} ${parameter^^pattern} ${parameter,pattern} ${parameter,,pattern} Case  modification.   This expansion modifies the case of alphabetic characters in parameter.  The pattern is expanded to produce a  pattern just as in pathname expansion.  The ^ operator converts lowercase characters matching pattern to uppercase.  The , operator converts matching uppercase characters to lowercase. The ^^ and ,, expansions  convert  all  matched  character  in the expanded  value.  The  ^ and , expansions match and convert only the first character in the expanded value.  If pattern is omitted it is treated like a ?, which matches every character.  If parameter is @ or *, or an array subscripted by @ or *, the case modification operation is  applied to each element.
The brackets denote optional portions.  The optional p is a digit specifying the precision, the number of fractional digits after a decimal point.  A value of 0 causes no decimal point or fraction to be output.  At most three places after the decimal point can be displayed; values of p greater than 3 are treated as 3.  If p is not specified, the value 3 is used.
The optional l specifies a longer format, including hours if greater than zero, minutes, and seconds of the form HHhMMmSS.FFs.  The value of p determines whether or not the fraction is included.
All other characters are output without change and a trailing newline is added.  If unset, the default value, $'\nreal\t%2lR\nuser\t%2lU\nsys%2lS', is used.  If the value is null, no timing information is displayed.
TMOUT  If set to a value greater than zero, TMOUT will be the default timeout value for the read built-in command.  The select compound command terminates after TMOUT seconds when input is from a terminal.  Otherwise, the shell will terminate if a line is not entered within the prescribed number of seconds while reading from a terminal.  (Note that the shell can be compiled with a maximum bound for this value which cannot be exceeded.)
VISUAL If the value of this variable matches the pattern *[Vv][Ii]*, then the vi option (see Special Command set below) is turned on.  If the value matches the pattern *gmacs* , the gmacs option is turned on.  If the value matches the pattern *macs*, then the emacs option will be turned on.  The value of VISUAL overrides the value of EDITOR.
The shell gives default values to PATH, PS1, PS2, PS3, PS4, MAILCHECK, FCEDIT, TMOUT and IFS, while HOME, SHELL, ENV, and MAIL are not set at all by the shell (although HOME is set by login(1)).  On some systems MAIL and SHELL are also set by login(1).
Field Splitting. After parameter expansion and command substitution, the results of substitutions are scanned for the field separator characters (those found in IFS) and split into distinct fields where such characters are found. Explicit null fields ("" or ′′) are retained.  Implicit null fields (those resulting from parameters that have no values or command substitutions with no output) are removed.
If the braceexpand (-B) option is set then each of the fields resulting from IFS are checked to see if they contain one or more of the brace patterns {*,*}, {l1..l2} , {n1..n2} , {n1..n2% fmt} , {n1..n2 ..n3} , or {n1..n2 ..n3%fmt} , where * represents any character, l1,l2 are letters and n1,n2,n3 are signed numbers and fmt is a format specified as used by printf.  In each case, fields are created by prepending the characters before the { and appending the characters after the } to each of the strings generated by the characters between the { and }.  The resulting fields are checked to see if they have any brace patterns.
In the first form, a field is created for each string between { and ,, between , and ,, and between , and }.  The string represented by * can contain embedded matching { and } without quoting.  Otherwise, each { and } with * must be quoted.
In the seconds form, l1 and l2 must both be either upper case or both be lower case characters in the C locale.  In this case a field is created for each character from l1 thru l2.
In the remaining forms, a field is created for each number starting at n1 and continuing until it reaches n2 incrementing n1 by n3.  The cases where n3 is not specified behave as if n3 where 1 if n1<=n2 and -1 otherwise.  If forms which specify %fmt any format flags, widths and precisions can be specified and fmt can end in any of the specifiers cdiouxX.  For example, {a,z}{1..5..3%02d}{b..c}x expands to the 8 fields, a01bx, a01cx, a04bx, a04cx, z01bx, z01cx, z04bx and z4cx.
File Name Generation. Following splitting, each field is scanned for the characters *, ?, (, and [ unless the -f option has been set.  If one of these characters appears, then the word is regarded as a pattern.  Each file name component that contains any pattern character is replaced with a lexicographically sorted set of names that matches the pattern from that directory.  If no file name is found that matches the pattern, then that component of the filename is left unchanged unless the pattern is prefixed with ∼(N) in which case it is removed as described below.  If FIGNORE is set, then each file name component that matches the pattern defined by the value of FIGNORE is ignored when generating the matching filenames.  The names .  and ..  are also ignored.  If FIGNORE is not set, the character .  at the start of each file name component will be ignored unless the first character of the pattern corresponding to this component is the character .  itself.  Note, that for other uses of pattern matching the / and .  are not treated specially.
*      Matches any string, including the null string.  When used for filename expansion, if the globstar option is on, an isolated pattern of two adjacent *'s will match all files and zero or more directories and subdirectories.  If followed by a / then only directories and subdirectories will match. ?      Matches any single character. [...]  Matches any one of the enclosed characters.  A pair of characters separated by - matches any character lexically between the pair, inclusive.  If the first character following the opening [ is a !  or ^ then any character not enclosed is matched.  A - can be included in the character set by putting it as the first or last character. Within [ and ], character classes can be specified with the syntax [:class:] where class is one of the following classes defined in the ANSI-C standard: (Note that word is equivalent to alnum plus the character _.) alnum alpha blank cntrl digit graph lower print punct space upper word xdigit Within [ and ], an equivalence class can be specified with the syntax [=c=] which matches all characters with the same primary collation weight (as defined by the current locale) as the character c.  Within [ and ], [.symbol.]  matches the collating symbol symbol. A pattern-list is a list of one or more patterns separated from each other with a & or ⎪.  A & signifies that all patterns must be matched whereas ⎪ requires that only one pattern be matched.  Composite patterns can be formed with one or more of the following sub-patterns: ?(pattern-list) Optionally matches any one of the given patterns. *(pattern-list) Matches zero or more occurrences of the given patterns. +(pattern-list) Matches one or more occurrences of the given patterns. {n}(pattern-list) Matches n occurrences of the given patterns. {m,n}(pattern-list) Matches from m to n occurrences of the given patterns.  If m is omitted, 0 will be used.  If n is omitted at least m occurrences will be matched. @(pattern-list) Matches exactly one of the given patterns. !(pattern-list) Matches anything except one of the given patterns. By default, each pattern, or sub-pattern will match the longest string possible consistent with generating the longest overall match.  If more than one match is possible, the one starting closest to the beginning of the string will be chosen.   However, for each of the above compound patterns a - can be inserted in front of the ( to cause the shortest match to the specified pattern-list to be used.
When pattern-list is contained within parentheses, the backslash character \ is treated specially even when inside a character class. All ANSI-C character escapes are recognized and match the specified character.  In addition the following escape sequences are recognized: \d     Matches any character in the digit class. \D     Matches any character not in the digit class. \s     Matches any character in the space class. \S     Matches any character not in the space class. \w     Matches any character in the word class. \W     Matches any character not in the word class.