In bash, what do the parameter expansions ${VAR:-default}, ${VAR-default}, ${VAR:=default} and ${VAR:?message} each do, and what difference does the colon make?

## The family Bash has four closely related expansions that all answer the question "what if this variable has no useful value?" They are pure shell syntax — no subprocess, no `test` call — and they appear constantly in entrypoint scripts, CI wrappers and installers. | Expansion | If VAR has a value | If VAR is missing | |---|---|---| | `${VAR:-default}` | the value | `default` (VAR unchanged) | | `${VAR:=default}` | the value | `default`, **and VAR is assigned it** | | `${VAR:?message}` | the value | error on stderr, shell exits | | `${VAR:+alt}` | `alt` | empty string | ## What the colon changes Each operator exists in two forms: with a colon and without. Without the colon, only an *unset* variable is treated as missing. With the colon, both unset **and** null (empty string) are treated as missing. ```bash unset A B= C=value echo "[${A-fallback}] [${B-fallback}] [${C-fallback}]" # [fallback] [] [value] echo "[${A:-fallback}] [${B:-fallback}] [${C:-fallback}]" # [fallback] [fallback] [value] ``` That distinction is the whole point of the question. `B=` is a deliberate empty value. If your configuration treats "exported but empty" as "the operator turned this off", you want the colonless form. If empty means "nobody filled this in", which is far more common when values come from CI variables or a `.env` file, you want the colon form. In practice `:-` is right almost every time, and code that uses the colonless `-` should look deliberate. ## Assignment: `:=` `${VAR:=default}` substitutes *and* stores, so it is the idiom for "apply a default once, at the top of the script": ```bash : "${LOG_LEVEL:=info}" # LOG_LEVEL is now guaranteed non-empty echo "level=$LOG_LEVEL" ``` The leading `:` is the no-op builtin — it evaluates its arguments and does nothing else, which is how you use an expansion purely for its side effect. Note two limits: the assignment is to a shell variable, so it is not exported to children unless VAR was already exported or you `export` it; and `${1:=x}` on a positional parameter is an error (`$1: cannot assign in this way`) — use `${1:-x}` there. ## The guard: `:?` `${VAR:?message}` is the cheapest possible required-argument check: ```bash : "${DATABASE_URL:?must be set in the deploy environment}" ``` If `DATABASE_URL` is unset or empty, bash prints `DATABASE_URL: must be set in the deploy environment` to stderr and the script exits with a non-zero status. Two details matter. First, it exits a **non-interactive** shell; typed at an interactive prompt it just reports the error and returns you to the prompt. Second, it fires at the moment the expansion is evaluated, so putting these lines at the top of the script gives you a clean, immediate failure instead of a confusing error five hundred lines later. Omitting the message (`${VAR:?}`) produces bash's own "parameter null or not set" text. ## The mirror: `:+` `${VAR:+alt}` inverts the test: it produces `alt` when VAR is set and non-empty, otherwise nothing. It is how you add an optional flag without an `if`: ```bash curl ${AUTH_TOKEN:+-H "Authorization: Bearer $AUTH_TOKEN"} "$URL" ``` (That example deliberately leaves the expansion unquoted so it splits into separate arguments; building the argument list in an array is the safer general habit.) ## Practical notes - **Quote the expansion.** `"${VAR:-$DEFAULT}"` — the substituted word is itself subject to expansion, and without quotes the result is split on whitespace and globbed like any other unquoted expansion. - The word after the operator can be any expansion, including a command substitution: `"${PORT:-$(default_port)}"`. It is only evaluated when the default is actually needed. - Under a script that enables `set -u`, `"${OPTIONAL:-}"` is the standard way to read a variable that may legitimately be absent without tripping the unbound-variable error. - These are POSIX-standard operators (the `:-`, `:=`, `:?`, `:+` set), so they work in `/bin/sh` as well as bash.