From 499674dfa61d3df222e0041db1cc6e7cb78f0f55 Mon Sep 17 00:00:00 2001
From: Gilles Peskine <Gilles.Peskine@arm.com>
Date: Fri, 9 Jan 2026 19:20:47 +0100
Subject: [PATCH 1/2] all.sh: fail if a file is missing on a "not grep ..."
 line

Fixes https://github.com/Mbed-TLS/mbedtls-framework/issues/266

Automatically redirect `not grep ...` calls to the new function `not_grep`
which insists that the return code of `grep` is 1 (not found) and not
2 or more (error such as a missing file).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
---
 scripts/all-core.sh | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/scripts/all-core.sh b/scripts/all-core.sh
index a9070a8e20..f20feb3495 100644
--- a/scripts/all-core.sh
+++ b/scripts/all-core.sh
@@ -718,6 +718,7 @@ pre_setup_keep_going () {
             *test*) true;; # make test, tests/stuff, env V=v tests/stuff, ...
             *make*check*) true;;
             "grep "*) true;;
+            "not_grep "*) true;;
             "[ "*) true;;
             "! "*) true;;
             *) false;;
@@ -780,9 +781,48 @@ pre_setup_keep_going () {
     }
 }
 
+## not_grep [GREP_OPTION...] REGEXP FILE[...]
+## Assert that none of the files contains a match for REGEXP.
+## Errors such as a missing file are also assertion failures.
+## If the assertion fails, print an error and consider the test case
+## to be failed.
+not_grep () {
+    #set -x
+    declare ret=0
+    # Add /dev/null as a file name. This forces the file name to be displayed
+    # if there is a single file name, and prevents blocking waiting on stdin
+    # if this function is accidentally called with zero file names.
+    grep "$@" /dev/null || ret=$?
+    if [[ $ret -eq 0 ]]; then
+        # A match was found, and displayed on stdout.
+        # This is a test failure.
+        report_failed_command="not_grep $*"
+        false
+        unset report_failed_command
+    elif [[ $ret -ne 1 ]]; then
+        # If grep exited with error code 1, grep ran find and found that
+        # there were no matches, which means the assertion is true.
+        # If grep exited with an error code >=2, then something went
+        # wrong, probably a missing file (or e.g. a command syntax error).
+        # grep already printed an error message, so we just need to assert
+        # the condition and the ERR trap will mark the test case as failed.
+        # But make sure that the failure report indicates the grep command.
+        report_failed_command="not_grep $*"
+        (exit $ret)
+        unset report_failed_command
+    fi
+}
+
 # '! true' does not trigger the ERR trap. Arrange to trigger it, with
 # a reasonably informative error message (not just "$@").
 not () {
+    # "not grep" is fragile and should not be used.
+    # https://github.com/Mbed-TLS/mbedtls-framework/issues/266
+    if [ "$1" = "grep" ]; then
+        shift
+        not_grep "$@"
+        return
+    fi
     if "$@"; then
         report_failed_command="! $*"
         false

From 076016b4bfd4eb305cef37f8c0ea8bfce9cd5a0b Mon Sep 17 00:00:00 2001
From: Gilles Peskine <Gilles.Peskine@arm.com>
Date: Wed, 14 Jan 2026 17:36:22 +0100
Subject: [PATCH 2/2] Support piping into not_grep

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
---
 scripts/all-core.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/scripts/all-core.sh b/scripts/all-core.sh
index f20feb3495..dc89478685 100644
--- a/scripts/all-core.sh
+++ b/scripts/all-core.sh
@@ -789,10 +789,7 @@ pre_setup_keep_going () {
 not_grep () {
     #set -x
     declare ret=0
-    # Add /dev/null as a file name. This forces the file name to be displayed
-    # if there is a single file name, and prevents blocking waiting on stdin
-    # if this function is accidentally called with zero file names.
-    grep "$@" /dev/null || ret=$?
+    grep -H "$@" || ret=$?
     if [[ $ret -eq 0 ]]; then
         # A match was found, and displayed on stdout.
         # This is a test failure.