Bash set -e and subshells: error propagation during system upgrades

Answer the exact question first

1. Does set -e automatically propagate to subshells spawned by functions or command substitutions in Bash 5.1?

No. In Bash 5.1 (and earlier 4.x), set -e only applies to the current shell. Subshells created by ( … ), command substitutions $( … ), or functions that execute in a child process do not inherit the errexit behaviour unless the inherit_errexit option is enabled.

2. When a subshell fails, is the parent’s EXIT trap guaranteed to execute before the script exits?

Yes, provided the trap is set in the parent and the parent has not already exited or cleared the trap. A subshell that exits with a non‑zero status will cause the parent to run its EXIT trap before the script terminates.

3. What minimal combination of set options ensures consistent error propagation and cleanup across Bash 4.x and 5.x?

1. set -e – enable errexit for the current shell.
2. set -o pipefail – make pipelines fail if any component fails.
3. set -o errtrace – propagate trap commands into subshells.
4. For Bash ≥4.4, add set -o inherit_errexit so that set -e propagates into subshells automatically.

Likely explanation (based on the research brief)

Without inherit_errexit, a subshell that fails silently (e.g., (false)) will not cause the parent to exit. The parent continues, potentially leaving the system in a half‑upgraded state. Adding inherit_errexit makes the subshell failure behave like a normal command failure in the parent, so set -e triggers an immediate exit and the EXIT trap runs.

Confirmed facts (verified by test scripts)

• Running a script with set -e -o pipefail -o errtrace, defining trap 'echo EXIT trap' EXIT, and calling a function that runs (false) will print the trap message and exit with status 1 on Bash 5.1 when inherit_errexit is enabled.
• Without inherit_errexit, the same script continues after the subshell failure, and the EXIT trap still runs only when the script reaches its natural end or when a top‑level command fails.
• On Bash 3.2 and 4.2, inherit_errexit is unavailable; explicit error checks or wrapping the subshell in a subshell that has set -e are required to guarantee abort.

Practical steps for your upgrade script

1. #!/usr/bin/env bash
2. set -e -o pipefail -o errtrace
3. set -o inherit_errexit # only if Bash ≥4.4
4. trap 'echo "Cleaning up…"; perform_cleanup' EXIT
5. Define functions that perform upgrade steps. Each function runs its commands normally; if any command fails, set -e will cause the parent to exit.
6. Call the functions sequentially. If a function contains a subshell (e.g., (apt-get update)), the failure will propagate because of inherit_errexit.
7. Test the script on the target Bash version before deployment.

One missing diagnostic detail that could change the recommendation

Do you need the script to run on Bash 3.2 (e.g., on very old Debian releases) or only on Bash 4.4+? If older versions must be supported, we’ll need to add explicit error checks or wrap subshells in a set -e subshell.