fix shellcheck results

LICENSE

@@ -1,11 +1,11 @@
-Proprietary License
-
-Copyright (c) 2026 Florian Zumpe. All rights reserved.
-
-Permission is granted to the recipient to run this script locally for its intended
-purpose.
-
-No permission is granted to copy, modify, distribute, sublicense, publish, sell,
-lease, host, or otherwise make this script available to third parties.
-
+Proprietary License
+
+Copyright (c) 2026 Florian Zumpe. All rights reserved.
+
+Permission is granted to the recipient to run this script locally for its intended
+purpose.
+
+No permission is granted to copy, modify, distribute, sublicense, publish, sell,
+lease, host, or otherwise make this script available to third parties.
+
 The script is provided "as is", without warranty of any kind.

domain-join.sh

@@ -375,7 +375,9 @@ configure_dns() {
   fi
 
   log "Discovered DNS server IPs:"
-  printf ' - %s\n' $dns_ips
+  while IFS= read -r ip; do
+    [[ -n "$ip" ]] && printf ' - %s\n' "$ip"
+  done <<< "$dns_ips"
 
   if systemctl is-active --quiet systemd-resolved 2>/dev/null; then
     log "Configuring DNS via systemd-resolved drop-in (/etc/systemd/resolved.conf.d/)"
@@ -558,8 +560,8 @@ keyring_is_working() {
   keyctl show >/dev/null 2>&1 || return 1
 
   # Write test: create new session + dummy key in @s
-  local sid kid
-  sid="$(keyctl new_session 2>/dev/null)" || return 1
+  local kid
+  keyctl new_session >/dev/null 2>&1 || return 1
   kid="$(printf 'ping' | keyctl padd user adjoin-key-test @s 2>/dev/null)" || return 1
 
   keyctl unlink "$kid" @s >/dev/null 2>&1 || true
@@ -1023,7 +1025,9 @@ log "DNS check: SRV lookup _ldap._tcp.${AD_DOMAIN_FQDN}"
 DC_LIST="$(discover_dcs "${AD_DOMAIN_FQDN}" || true)"
 if [[ -n "$DC_LIST" ]]; then
   log "Discovered Domain Controllers (via SRV):"
-  printf ' - %s\n' $DC_LIST
+  while IFS= read -r dc; do
+    [[ -n "$dc" ]] && printf ' - %s\n' "$dc"
+  done <<< "$DC_LIST"
 else
   warn "No DCs found via SRV. Join will likely fail (DNS not AD-capable?)."
 fi