fix: terminate option parsing for qvm commands

salt/signal/firewall.sls

@@ -9,16 +9,16 @@ SPDX-License-Identifier: AGPL-3.0-or-later
     - require:
       - qvm: {{ slsdotpath }}
     - name: |
-        qvm-check -q --running {{ slsdotpath }} && qvm-pause {{ slsdotpath }}
-        qvm-firewall {{ slsdotpath }} reset
-        qvm-firewall {{ slsdotpath }} del --rule-no 0
-        qvm-check -q --running {{ slsdotpath }} && qvm-unpause {{ slsdotpath }}
-        qvm-firewall {{ slsdotpath }} add accept signal.org
-        qvm-firewall {{ slsdotpath }} add accept storage.signal.org
-        qvm-firewall {{ slsdotpath }} add accept chat.signal.org
-        qvm-firewall {{ slsdotpath }} add accept cdn.signal.org
-        qvm-firewall {{ slsdotpath }} add accept cdn2.signal.org
-        qvm-firewall {{ slsdotpath }} add accept sfu.voip.signal.org
-        qvm-firewall {{ slsdotpath }} add accept turn.voip.signal.org
-        qvm-firewall {{ slsdotpath }} add accept turn2.voip.signal.org
-        qvm-firewall {{ slsdotpath }} add accept turn3.voip.signal.org
+        qvm-check -q --running -- {{ slsdotpath }} && qvm-pause -- {{ slsdotpath }}
+        qvm-firewall -- {{ slsdotpath }} reset
+        qvm-firewall -- {{ slsdotpath }} del --rule-no 0
+        qvm-check -q --running -- {{ slsdotpath }} && qvm-unpause -- {{ slsdotpath }}
+        qvm-firewall -- {{ slsdotpath }} add accept signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept storage.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept chat.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept cdn.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept cdn2.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept sfu.voip.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept turn.voip.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept turn2.voip.signal.org
+        qvm-firewall -- {{ slsdotpath }} add accept turn3.voip.signal.org

salt/sys-git/files/client/git-core/git-init-qrexec

@@ -45,10 +45,10 @@ elif command -v qrexec-client >/dev/null; then
   if test "${authority}" = "@default"; then
     authority="${default_qube}"
   fi
-  if ! qvm-check "${authority}" >/dev/null 2>&1; then
+  if ! qvm-check -- "${authority}" >/dev/null 2>&1; then
     die "Qube doesn't exist: '${authority}'"
   fi
-  qvm-start --skip-if-running "${authority}"
+  qvm-start --skip-if-running -- "${authority}"
   exec qrexec-client -tT -d "${authority}" -- "DEFAULT:QUBESRPC ${rpc_cmd} dom0"
 fi
 

salt/sys-git/files/client/git-core/git-remote-qrexec-connect

@@ -72,10 +72,10 @@ elif command -v qrexec-client >/dev/null; then
   if test "${authority}" = "@default"; then
     authority="${default_qube}"
   fi
-  if ! qvm-check "${authority}" >/dev/null 2>&1; then
+  if ! qvm-check -- "${authority}" >/dev/null 2>&1; then
     die "Qube doesn't exist: '${authority}'"
   fi
-  qvm-start --skip-if-running "${authority}"
+  qvm-start --skip-if-running -- "${authority}"
   log "->" qrexec-client -T -d "${authority}" -- "DEFAULT:QUBESRPC ${rpc_cmd} dom0"
   exec qrexec-client -T -d "${authority}" -- "DEFAULT:QUBESRPC ${rpc_cmd} dom0"
 fi