Generating security patch zip from tags

generate-security-patchset.sh

#!/usr/bin/env bash
# SPDX-License-Identifier: AGPL-3.0-or-later

set -eux

toClean=""
cleanup() {
    rm -Rf $toClean
}   
trap cleanup EXIT

mktd() {
    local d
    d=$(mktemp -d)
    toClean="$toClean $d"
    eval "$1=$d"
}   

mkt() {
    local d
    d=$(mktemp)
    toClean="$toClean $d"
    eval "$1=$d"
}   

here="$(dirname "$(readlink -f -- "$0")")"
rm -Rf "$here/patches"
mkdir -p "$here/patches"

mktd manifests
srctag="$1"
dsttag="$2"
git clone --single-branch -b "$srctag" https://android.googlesource.com/platform/manifest $manifests/src
git clone --single-branch -b "$dsttag" https://android.googlesource.com/platform/manifest $manifests/dst
if comm -3 <(sort $manifests/src/default.xml) <(sort $manifests/dst/default.xml) |grep -v -e $1 -e $2 |grep -vE -e '^[[:space:]]*$+' -e 'END open-source' ;then
    echo "Manifests aren't identical, abort"
    exit 1
fi  

mkt projects
xmlstarlet sel -t -m //project -v ./@name -o ' ' -v ./@path -n $manifests/src/default.xml > $projects
cat $projects
while read -r name path ;do
    git=https://android.googlesource.com/$name
    srcrev=$(git ls-remote $git $srctag'^{}' |grep -oE '^[0-9a-fA-F]*')
    dstrev=$(git ls-remote $git $dsttag'^{}' |grep -oE '^[0-9a-fA-F]*')
    if [ "$srcrev" = "$dstrev" ];then
        continue
    fi  
    
    mktd g
    git clone $git $g/aa -b "$srctag" --single-branch
    
    pushd $g/aa
        git fetch origin refs/tags/"$dsttag":refs/tags/"$dsttag"
        
        mkdir -p "$here/patches/$path"
        git format-patch -o "$here/patches/$path" "$srctag".."$dsttag"
    popd
    
    rm -Rf "$g"
done < $projects