From 7c86b313f0e7fe91b5eb8a672ad5b1189a62e515 Mon Sep 17 00:00:00 2001
From: shum <github.shum@liber.li>
Date: Thu, 22 Oct 2026 05:33:49 +0000
Subject: [PATCH] scripts: end the egress check on a missing chain

---
 scripts/store-service/egress.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/store-service/egress.sh b/scripts/store-service/egress.sh
index a98db20b7e..cc0c52e007 100755
--- a/scripts/store-service/egress.sh
+++ b/scripts/store-service/egress.sh
@@ -333,10 +333,11 @@ check_family() {
       failed=1
     fi
   done < <(rules_for "$family")
-  jumps=$(jumps_for "$tool")
+  # check runs under ||, where errexit is off, so a failed lookup has to end the check itself
+  jumps=$(jumps_for "$tool") || return 1
   while read -r parent line; do
     jump="-A $parent $line -j $CHAIN"
-    rules=$(chain_rules "$tool" "$parent")
+    rules=$(chain_rules "$tool" "$parent") || return 1
     if [[ ${rules%%$'\n'*} != "$jump" ]]; then
       echo "$tool: the first rule of $parent is not $jump" >&2
       failed=1