Make slightly more involved changes to make shellcheck happy.

 - Use `read -r` instead of other forms of read or looping
 - Use arrays instead of strings with whitespaces.
 - In one instance, use ${var%%.*} instead of $(echo $var|cut -f. -d1)

1 files changed, 2 insertions, 2 deletions

diff --git a/commitpkg.in b/commitpkg.in
index 0482170..90210e5 100644
--- a/commitpkg.in
+++ b/commitpkg.in
@@ -148,9 +148,9 @@ for _arch in "${arch[@]}"; do
 		if [[ ! -f $sigfile ]]; then
 			msg "Signing package %s..." "${pkgfile}"
 			if [[ -n $GPGKEY ]]; then
-				SIGNWITHKEY="-u ${GPGKEY}"
+				SIGNWITHKEY=(-u "${GPGKEY}")
 			fi
-			gpg --detach-sign --use-agent --no-armor ${SIGNWITHKEY} "${pkgfile}" || die
+			gpg --detach-sign --use-agent --no-armor "${SIGNWITHKEY[@]}" "${pkgfile}" || die
 		fi
 		if ! gpg --verify "$sigfile" >/dev/null 2>&1; then
 			die "Signature %s.sig is incorrect!" "$pkgfile"