From 090425cffcdff73def2b83b7eb7ef0f1132c0c43 Mon Sep 17 00:00:00 2001
From: Ralph Bean <rbean@redhat.com>
Date: Wed, 10 Jul 2024 16:58:37 -0400
Subject: [PATCH] Quote to prevent command substitution expansion

---
 task/build-vm-image/0.1/build-vm-image.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/task/build-vm-image/0.1/build-vm-image.yaml b/task/build-vm-image/0.1/build-vm-image.yaml
index 2a4e17f104..8550921af0 100644
--- a/task/build-vm-image/0.1/build-vm-image.yaml
+++ b/task/build-vm-image/0.1/build-vm-image.yaml
@@ -148,7 +148,7 @@ spec:
         # form the --type arguments
         IMAGE_TYPE_ARGUMENT=" --type $IMAGE_TYPE "
 
-        # this heredoc allows expansions for the image name
+        # this unquoted heredoc allows expansions for the image name
         cat >scripts/script-build.sh <<REMOTESSHEOF
         #!/bin/sh
         set -e
@@ -166,7 +166,7 @@ spec:
 
         REMOTESSHEOF
 
-        # no expansions in this one, the env vars are evaluated on the remote vm
+        # this quoted heredoc prevents expansions and command substitutions. the env vars are evaluated on the remote vm
         cat >>scripts/script-build.sh <<'REMOTESSHEOF'
         echo >config.toml <<EOF
         [[blueprint.customizations.user]]
@@ -203,9 +203,17 @@ spec:
         REMOTESSHEOF
 
         # script-push.sh script is intended run _inside_ podman on the ssh host and requires sudo
+        # this unquoted heredoc allows expansions for the image name
         cat >scripts/script-push.sh <<REMOTESSHEOF
         #!/bin/bash
         set -ex
+
+        export OUTPUT_IMAGE="$OUTPUT_IMAGE"
+
+        REMOTESSHEOF
+
+        # this quoted heredoc prevents expansions and command substitutions. the env vars are evaluated on the remote vm
+        cat >>scripts/script-push.sh <<'REMOTESSHEOF'
         dnf -y install buildah pigz jq
 
         # Build an image index of length 1 referring to an image manifest with the content