From 93921d409379ef3db7093e900c4f4a8fc05cd647 Mon Sep 17 00:00:00 2001
From: EnumDev <enumdev@enumerated.dev>
Date: Sun, 28 Sep 2025 12:38:47 +0300
Subject: [PATCH] Use drone/envsubst module for bash variable expansion

---
 src/bpm/go.mod            |  1 +
 src/bpm/go.sum            |  4 ++++
 src/bpmlib/compilation.go | 13 ++++++++++---
 src/bpmlib/go.mod         |  1 +
 src/bpmlib/go.sum         |  4 ++++
 5 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/src/bpm/go.mod b/src/bpm/go.mod
index 5129f8b..73aaf41 100644
--- a/src/bpm/go.mod
+++ b/src/bpm/go.mod
@@ -9,6 +9,7 @@ require git.enumerated.dev/bubble-package-manager/bpm/src/bpmlib v0.5.0
 replace git.enumerated.dev/bubble-package-manager/bpm/src/bpmlib => ../bpmlib
 
 require (
+	github.com/drone/envsubst v1.0.3 // indirect
 	github.com/knqyf263/go-rpm-version v0.0.0-20240918084003-2afd7dc6a38f // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/src/bpm/go.sum b/src/bpm/go.sum
index 8a51310..b639e84 100644
--- a/src/bpm/go.sum
+++ b/src/bpm/go.sum
@@ -1,3 +1,7 @@
+github.com/drone/envsubst v1.0.3 h1:PCIBwNDYjs50AsLZPYdfhSATKaRg/FJmDc2D6+C2x8g=
+github.com/drone/envsubst v1.0.3/go.mod h1:N2jZmlMufstn1KEqvbHjw40h1KyTmnVzHcSc9bFiJ2g=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/knqyf263/go-rpm-version v0.0.0-20240918084003-2afd7dc6a38f h1:xt29M2T6STgldg+WEP51gGePQCsQvklmP2eIhPIBK3g=
 github.com/knqyf263/go-rpm-version v0.0.0-20240918084003-2afd7dc6a38f/go.mod h1:i4sF0l1fFnY1aiw08QQSwVAFxHEm311Me3WsU/X7nL0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
diff --git a/src/bpmlib/compilation.go b/src/bpmlib/compilation.go
index ecce113..dd73f9d 100644
--- a/src/bpmlib/compilation.go
+++ b/src/bpmlib/compilation.go
@@ -14,6 +14,7 @@ import (
 	"strings"
 	"syscall"
 
+	"github.com/drone/envsubst"
 	"gopkg.in/yaml.v3"
 )
 
@@ -339,7 +340,7 @@ func downloadPackageFiles(pkgInfo *PackageInfo, tempDirectory string) error {
 	for _, download := range pkgInfo.Downloads {
 		// Replace variables in download url
 		downloadUrl := download.Url
-		downloadUrl = os.Expand(downloadUrl, func(s string) string {
+		downloadUrl, err := envsubst.Eval(downloadUrl, func(s string) string {
 			switch s {
 			case "BPM_PKG_VERSION":
 				return pkgInfo.Version
@@ -349,6 +350,9 @@ func downloadPackageFiles(pkgInfo *PackageInfo, tempDirectory string) error {
 				return ""
 			}
 		})
+		if err != nil {
+			return err
+		}
 
 		switch download.Type {
 		case "", "file":
@@ -420,7 +424,7 @@ func downloadPackageFiles(pkgInfo *PackageInfo, tempDirectory string) error {
 		case "git":
 			// Replace variables in git branch
 			gitBranch := download.GitBranch
-			gitBranch = os.Expand(gitBranch, func(s string) string {
+			gitBranch, err := envsubst.Eval(gitBranch, func(s string) string {
 				switch s {
 				case "BPM_PKG_VERSION":
 					return pkgInfo.Version
@@ -430,6 +434,9 @@ func downloadPackageFiles(pkgInfo *PackageInfo, tempDirectory string) error {
 					return ""
 				}
 			})
+			if err != nil {
+				return err
+			}
 
 			cmd := exec.Command("git", "clone", "--depth=1", downloadUrl)
 			if gitBranch != "" {
@@ -442,7 +449,7 @@ func downloadPackageFiles(pkgInfo *PackageInfo, tempDirectory string) error {
 			cmd.Stdout = os.Stdout
 			cmd.Stderr = os.Stderr
 
-			err := cmd.Run()
+			err = cmd.Run()
 			if err != nil {
 				return err
 			}
diff --git a/src/bpmlib/go.mod b/src/bpmlib/go.mod
index d0dabd5..46b4404 100644
--- a/src/bpmlib/go.mod
+++ b/src/bpmlib/go.mod
@@ -3,6 +3,7 @@ module git.enumerated.dev/bubble-package-manager/bpm/src/bpmlib
 go 1.23
 
 require (
+	github.com/drone/envsubst v1.0.3
 	github.com/knqyf263/go-rpm-version v0.0.0-20240918084003-2afd7dc6a38f
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/src/bpmlib/go.sum b/src/bpmlib/go.sum
index 8a51310..b639e84 100644
--- a/src/bpmlib/go.sum
+++ b/src/bpmlib/go.sum
@@ -1,3 +1,7 @@
+github.com/drone/envsubst v1.0.3 h1:PCIBwNDYjs50AsLZPYdfhSATKaRg/FJmDc2D6+C2x8g=
+github.com/drone/envsubst v1.0.3/go.mod h1:N2jZmlMufstn1KEqvbHjw40h1KyTmnVzHcSc9bFiJ2g=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/knqyf263/go-rpm-version v0.0.0-20240918084003-2afd7dc6a38f h1:xt29M2T6STgldg+WEP51gGePQCsQvklmP2eIhPIBK3g=
 github.com/knqyf263/go-rpm-version v0.0.0-20240918084003-2afd7dc6a38f/go.mod h1:i4sF0l1fFnY1aiw08QQSwVAFxHEm311Me3WsU/X7nL0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=