Bash

Brian Fox wrote Bash for the GNU Project and released it on 8 June 1989. It is two things at once: an interactive command interpreter and a scripting language, and the same syntax serves both. Written in C, GPL-3.0-or-later since v4.0, stable at 5.3 (3 July 2025; confirmed still current on 2026-08-06 from Chet Ramey’s maintainer page, which gives the version and no date — over a year without a release, where php and erlang ship patches monthly). The syntax is a superset of the Bourne shell, so most sh scripts run unchanged, with ideas borrowed from csh and ksh: command substitution $(...), arrays and associative arrays (4.0+), brace expansion, here documents and here strings, job control, process substitution, arithmetic without spawning a process.

T2 — third-party encyclopaedic.

The interactive/script identity is the design decision

No other language in this corpus is typed at a prompt one line at a time and saved as a program with the same grammar. clojure, common-lisp and scheme have a REPL, but a REPL is a tool wrapped around a language designed for files. Bash is the reverse: a command line that turned out to be programmable, and the awkward parts of the language — word splitting, quoting, everything being a string — are the price of a grammar that had to be convenient to type before it had to be safe to maintain.

That is a design pressure the rest of the corpus never faces, and it belongs next to programming-language‘s axes rather than inside them.

And the corpus now has the other pole (added 2026-08-06). zsh states the same duality with an explicit order — “designed for interactive use, although it is also a powerful scripting language” — where this article puts both roles level. Two shells, same tension, different resolution, each stated by its own side.

Portability by convention, not by standard

Bash supports POSIX but its useful features exceed it, and the article names them for what they are: “bashisms” — associative arrays, brace expansion, [[...]]. So a script’s portability depends on which extensions the author used, checked by nobody, with the #!/bin/bash shebang as the only declaration. Compare c and scheme, where a document defines the language and implementations compete to satisfy it. Here the de-facto implementation is the definition and the standard is the subset (language-governance).

Reach is the same story from the other side: default login shell on many Linux distributions, present on macOS, Windows, Android and Solaris — but macOS moved its default to zsh, and the licence is why that is usually said to have happened (Apple ships the last GPL-2 Bash). A language’s licence changing its deployment is not something any first-party page in this corpus mentions.

The corpus’s first security incident

Shellshock (2014): Bash parsed function definitions out of environment variables, so anything that put attacker-controlled text into the environment of a shell — CGI, DHCP clients — could execute code. Every other source here discusses safety in the abstract: rust prevents, elixir recovers, spark proves, c declines. This is the corpus’s first record of a language feature that actually failed in the field, at scale, and the mechanism was ordinary — a convenience for exporting functions crossing a trust boundary nobody had drawn.

Related

programming-language · awk · zsh · c · language-governance · type-system · scheme · synthesis · (cross-spoke: ../defensive-security-wiki owns the Shellshock class of vulnerability)