Eleven variants of one shell script launched years-old images into a FedRAMP cluster

Someone writes it in bash because bash is right there. A colleague asks for it, and it gets pasted into a second repo where it picks up a flag that repo needed. A third repo copies that version, and when someone fixes a bug in the fourth copy the first three never hear about it ^[7]. After two years and a couple of re-orgs there is no original left to diff against, and the author of the dev.to post says he looked for one "for longer than was sensible" ^[8].

The post lets bash off. "Bash didn't fail. Bash did what bash does, which is get run wherever it's been put," the author wrote ^[22].

The change that was needed was one line, a new image tag, and the machines it had to reach were hundreds of laptops nobody on the team could get to ^[9]. There was no channel back to them, and the best available move was a Slack message asking people to update their copy ^[11]. "The people who read it had usually already updated. The people who hadn't were the reason we were asking," the author wrote ^[12].

The line the post draws is about reach. "A script is a thing you run where it lives. A tool is a thing you can change in places you can't get to," the author wrote ^[10]. Self-updating became the first requirement and everything else came after it ^[13]. The target was one thing every engineer ran that knew how to replace itself, so that a fix made on a Wednesday was the fix on every laptop by Thursday without anybody being asked ^[14].

Self-update killed the obvious rewrite too. A Python tool in one repo needs Python, a particular Python, and its dependencies on every machine it lands on, and that interpreter is a second thing you cannot update sitting underneath the first ^[15]. The author wrote that he had watched a just-pip-install-it tool spend more of its life being installed than being used ^[16].

So the tool had to compile to a single file with no runtime under it. `go build` hands over one binary that runs on a laptop with nothing else installed, and cross-compiles for the Mac on the next desk from the same source ^[17]. The second reason given for Go is social. It is easy to hand to a busy engineer who has never written it, and the author wanted people fixing their own bugs in the tool instead of raising tickets against it ^[18]. The cost list in the post is a repository, a build and a release pipeline, and the published text breaks off mid-sentence there ^[19].

More than seventy scripts were in that state across thirty-odd repositories ^[5], which works out to better than two per repo ^[21], and the Kubernetes one was the dangerous one only because of where it pointed ^[6]. For the Go conclusion to transfer, the machines have to be ones you genuinely cannot reach by other means. If the same script runs in CI or on servers under configuration management, the one-line tag change lands with a merge and a single static binary buys you nothing you did not already have. What forced it here was developer laptops at one end and a compliance boundary, FedRAMP for the American clusters, at the other ^[1][3]. Absent that, the post's own view holds: "A script is the right first move almost every time" ^[20].