diff --git a/.github/bors.toml b/.github/bors.toml
index 0281d2438..5b4469724 100644
--- a/.github/bors.toml
+++ b/.github/bors.toml
@@ -1,5 +1,5 @@
 block_labels = ["needs-decision"]
 delete_merged_branches = true
 required_approvals = 1
-status = ["rust-embedded.cross"]
+status = ["rust-embedded.cross", "shellcheck"]
 timeout_sec = 21600
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..8e69329b1
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,11 @@
+on: [pull_request, push]
+
+name: CI
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: ShellCheck
+        uses: azohra/shell-linter@v0.3.0
diff --git a/build-docker-image.sh b/build-docker-image.sh
index 7d43eeccb..eb0188457 100755
--- a/build-docker-image.sh
+++ b/build-docker-image.sh
@@ -3,12 +3,14 @@
 set -x
 set -euo pipefail
 
+version="$(cargo metadata --format-version 1 | jq --raw-output '.packages[] | select(.name == "cross") | .version')"
+
 cd docker
 
 run() {
   local dockerfile="Dockerfile.${1}"
   local image_name="rustembedded/cross:${1}"
-  local cache_from_args=
+  local cache_from_args=()
 
   if ! docker image inspect "${image_name}" &>/dev/null; then
     if docker pull "${image_name}"; then
@@ -16,9 +18,7 @@ run() {
     fi
   fi
 
-  docker build ${cache_from_args[@]} --pull -t "${image_name}" -f "${dockerfile}" .
-
-  local version="$(cargo metadata --format-version 1 | jq --raw-output '.packages[] | select(.name == "cross") | .version')"
+  docker build ${cache_from_args[@]+"${cache_from_args[@]}"} --pull -t "${image_name}" -f "${dockerfile}" .
 
   if ! [[ "${version}" =~ alpha ]] && ! [[ "${version}" =~ dev ]]; then
     local versioned_image_name="${image_name}-${version}"
@@ -26,7 +26,7 @@ run() {
   fi
 }
 
-if [ -z "${@:-}" ]; then
+if [[ -z "${*}" ]]; then
   for t in Dockerfile.*; do
     run "${t##Dockerfile.}"
   done
diff --git a/ci/test.sh b/ci/test.sh
index 841655545..a3575a5fd 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -4,19 +4,19 @@ set -x
 set -euo pipefail
 
 function retry {
-  local tries=${TRIES-5}
-  local timeout=${TIMEOUT-1}
+  local tries="${TRIES-5}"
+  local timeout="${TIMEOUT-1}"
   local try=0
   local exit_code=0
 
-  while (( ${try} < ${tries} )); do
+  while (( try < tries )); do
     if "${@}"; then
       return 0
     else
       exit_code=$?
     fi
 
-    sleep ${timeout}
+    sleep "${timeout}"
     echo "Retrying ..." 1>&2
     try=$(( try + 1 ))
     timeout=$(( timeout * 2 ))
@@ -28,7 +28,7 @@ function retry {
 main() {
     local td=
 
-    if [ "${BRANCH-}" = master ] || [[ "${TAG-}" =~ ^v.* ]]; then
+    if [[ "${BRANCH-}" = master ]] || [[ "${TAG-}" =~ ^v.* ]]; then
         return
     fi
 
@@ -40,12 +40,12 @@ main() {
     if (( ${STD:-0} )); then
         # test `cross check`
         td=$(mktemp -d)
-        cargo init --lib --name foo $td
-        pushd $td
+        cargo init --lib --name foo "${td}"
+        pushd "${td}"
         echo '#![no_std]' > src/lib.rs
-        cross check --target $TARGET
+        cross check --target "${TARGET}"
         popd
-        rm -rf $td
+        rm -rf "${td}"
     else
         # `cross build` test for targets where `std` is not available
         td=$(mktemp -d)
@@ -53,44 +53,44 @@ main() {
         git clone \
             --depth 1 \
             --recursive \
-            https://github.com/rust-lang-nursery/compiler-builtins $td
+            https://github.com/rust-lang-nursery/compiler-builtins "${td}"
 
-        pushd $td
+        pushd "${td}"
         cat > Cross.toml <<EOF
 [build]
 xargo = true
 EOF
         retry cargo fetch
-        cross build --lib --target $TARGET
+        cross build --lib --target "${TARGET}"
         popd
 
-        rm -rf $td
+        rm -rf "${td}"
 
         return
     fi
 
     # `cross build` test for the other targets
-    if [[ "$TARGET" == *-unknown-emscripten ]]; then
+    if [[ "${TARGET}" == *-unknown-emscripten ]]; then
         td=$(mktemp -d)
 
-        pushd $td
+        pushd "${td}"
         cargo init --lib --name foo .
         retry cargo fetch
-        cross build --target $TARGET
+        cross build --target "${TARGET}"
         popd
 
-        rm -rf $td
-    elif [[ "$TARGET" != thumb* ]]; then
+        rm -rf "${td}"
+    elif [[ "${TARGET}" != thumb* ]]; then
         td=$(mktemp -d)
 
-        pushd $td
+        pushd "${td}"
         # test that linking works
         cargo init --bin --name hello .
         retry cargo fetch
-        cross build --target $TARGET
+        cross build --target "${TARGET}"
         popd
 
-        rm -rf $td
+        rm -rf "${td}"
     fi
 
     if (( ${RUN:-0} )); then
@@ -98,47 +98,47 @@ EOF
         if (( ${DYLIB:-0} )); then
             td=$(mktemp -d)
 
-            pushd $td
+            pushd "${td}"
             cargo init --lib --name foo .
-            cross_test --target $TARGET
-            cross_bench --target $TARGET
+            cross_test --target "${TARGET}"
+            cross_bench --target "${TARGET}"
             popd
 
-            rm -rf $td
+            rm -rf "${td}"
         fi
 
         # `cross run` test
-        case $TARGET in
+        case "${TARGET}" in
             thumb*-none-eabi*)
                 td=$(mktemp -d)
 
                 git clone \
                     --depth 1 \
                     --recursive \
-                    https://github.com/japaric/cortest $td
+                    https://github.com/japaric/cortest "${td}"
 
-                pushd $td
-                cross_run --target $TARGET --example hello --release
+                pushd "${td}"
+                cross_run --target "${TARGET}" --example hello --release
                 popd
 
-                rm -rf $td
+                rm -rf "${td}"
             ;;
             *)
                 td=$(mktemp -d)
 
-                cargo init --bin --name hello $td
+                cargo init --bin --name hello "${td}"
 
-                pushd $td
+                pushd "${td}"
                 mkdir examples tests
                 echo "fn main() { println!(\"Example!\"); }" > examples/e.rs
                 echo "#[test] fn t() {}" > tests/t.rs
-                cross_run --target $TARGET
-                cross_run --target $TARGET --example e
-                cross_test --target $TARGET
-                cross_bench --target $TARGET
+                cross_run --target "${TARGET}"
+                cross_run --target "${TARGET}" --example e
+                cross_test --target "${TARGET}"
+                cross_bench --target "${TARGET}"
                 popd
 
-                rm -rf $td
+                rm -rf "${td}"
             ;;
         esac
 
@@ -146,21 +146,21 @@ EOF
 
     # Test C++ support
     if (( ${CPP:-0} )); then
-        td=$(mktemp -d)
+        td="$(mktemp -d)"
 
-        git clone --depth 1 https://github.com/japaric/hellopp $td
+        git clone --depth 1 https://github.com/japaric/hellopp "${td}"
 
-        pushd $td
+        pushd "${td}"
         cargo update -p gcc
         retry cargo fetch
         if (( ${RUN:-0} )); then
-            cross_run --target $TARGET
+            cross_run --target "${TARGET}"
         else
-            cross build --target $TARGET
+            cross build --target "${TARGET}"
         fi
         popd
 
-        rm -rf $td
+        rm -rf "${td}"
     fi
 }
 
@@ -168,8 +168,8 @@ cross_run() {
     if [[ -z "${RUNNERS:-}" ]]; then
         cross run "$@"
     else
-        for runner in $RUNNERS; do
-            echo -e "[target.$TARGET]\nrunner = \"$runner\"" > Cross.toml
+        for runner in ${RUNNERS}; do
+            echo -e "[target.${TARGET}]\nrunner = \"${runner}\"" > Cross.toml
             cross run "$@"
         done
     fi
@@ -179,8 +179,8 @@ cross_test() {
     if [[ -z "${RUNNERS:-}" ]]; then
         cross test "$@"
     else
-        for runner in $RUNNERS; do
-            echo -e "[target.$TARGET]\nrunner = \"$runner\"" > Cross.toml
+        for runner in ${RUNNERS}; do
+            echo -e "[target.${TARGET}]\nrunner = \"${runner}\"" > Cross.toml
             cross test "$@"
         done
     fi
@@ -190,8 +190,8 @@ cross_bench() {
     if [[ -z "${RUNNERS:-}" ]]; then
         cross bench "$@"
     else
-        for runner in $RUNNERS; do
-            echo -e "[target.$TARGET]\nrunner = \"$runner\"" > Cross.toml
+        for runner in ${RUNNERS}; do
+            echo -e "[target.${TARGET}]\nrunner = \"${runner}\"" > Cross.toml
             cross bench "$@"
         done
     fi
diff --git a/docker/android-ndk.sh b/docker/android-ndk.sh
index 7773ef183..9d8a2f07d 100755
--- a/docker/android-ndk.sh
+++ b/docker/android-ndk.sh
@@ -6,8 +6,8 @@ set -euo pipefail
 NDK_URL=https://dl.google.com/android/repository/android-ndk-r13b-linux-x86_64.zip
 
 main() {
-    local arch=$1 \
-          api=$2
+    local arch="${1}" \
+          api="${2}"
 
     local dependencies=(
         curl
@@ -17,33 +17,34 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    td=$(mktemp -d)
+    local td
+    td="$(mktemp -d)"
 
-    pushd $td
-    curl -O $NDK_URL
+    pushd "${td}"
+    curl -O "${NDK_URL}"
     unzip -q android-ndk-*.zip
     pushd android-ndk-*
     ./build/tools/make_standalone_toolchain.py \
       --install-dir /android-ndk \
-      --arch $arch \
-      --api $api
+      --arch "${arch}" \
+      --api "${api}"
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
     popd
     popd
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/android-system.sh b/docker/android-system.sh
index 68fdf46af..78cb7f242 100755
--- a/docker/android-system.sh
+++ b/docker/android-system.sh
@@ -4,9 +4,10 @@ set -x
 set -euo pipefail
 
 main() {
-    local arch=$1
-    local td=$(mktemp -d)
-    pushd $td
+    local arch="${1}"
+    local td
+    td="$(mktemp -d)"
+    pushd "${td}"
 
     local dependencies=(
         ca-certificates
@@ -42,10 +43,10 @@ EOF
 
     apt-get update
     local purge_list=(default-jre)
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
@@ -67,7 +68,7 @@ EOF
     ./repo sync -c external/stlport
     ./repo sync -c prebuilts/clang/linux-x86/host/3.5
     ./repo sync -c system/core
-    case $arch in
+    case "${arch}" in
         arm)
             ./repo sync prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.8
         ;;
@@ -91,17 +92,18 @@ EOF
     sed -i -e 's/if (!kernel_supplied_AT_SECURE)/if (false)/g' bionic/linker/linker_environ.cpp
 
     set +u
+    # shellcheck disable=SC1091
     source build/envsetup.sh
-    lunch aosp_$arch-user
+    lunch "aosp_${arch}-user"
     mmma bionic/
     mmma external/mksh/
     mmma system/core/toolbox/
     set -u
 
-    if [ $arch = "arm" ]; then
+    if [[ "${arch}" = "arm" ]]; then
         mv out/target/product/generic/system/ /
     else
-        mv out/target/product/generic_$arch/system/ /
+        mv "out/target/product/generic_${arch}/system"/ /
     fi
 
     # list from https://elinux.org/Android_toolbox
@@ -111,19 +113,19 @@ EOF
         printenv ps reboot renice rm rmdir rmmod route schedtop sendevent \
         setconsole setprop sleep smd start stop sync top touch umount \
         uptime vmstat watchprops wipe; do
-        ln -s /system/bin/toolbox /system/bin/$tool
+        ln -s /system/bin/toolbox "/system/bin/${tool}"
     done
 
     echo "127.0.0.1 localhost" > /system/etc/hosts
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --auto-remove -y "${purge_list[@]}"
     fi
 
     popd
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/cmake.sh b/docker/cmake.sh
index 6c2ef8f01..cd40f5c47 100755
--- a/docker/cmake.sh
+++ b/docker/cmake.sh
@@ -10,16 +10,17 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --assume-yes --no-install-recommends $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    local td="$(mktemp -d)"
+    local td
+    td="$(mktemp -d)"
 
-    pushd $td
+    pushd "${td}"
 
     curl -sSfL "https://github.com/Kitware/CMake/releases/download/v${version}/cmake-${version}-Linux-x86_64.sh" -o cmake.sh
     sh cmake.sh --skip-license --prefix=/usr/local
@@ -27,12 +28,12 @@ main() {
     popd
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --assume-yes --auto-remove ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm -rf $td
+    rm -rf "${td}"
     rm -rf /var/lib/apt/lists/*
-    rm $0
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/disabled/dragonfly.sh b/docker/disabled/dragonfly.sh
index 50ada5c8e..e8e9f477a 100755
--- a/docker/disabled/dragonfly.sh
+++ b/docker/disabled/dragonfly.sh
@@ -23,24 +23,25 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --no-install-recommends --assume-yes "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    local td=$(mktemp -d)
+    local td
+    td="$(mktemp -d)"
 
-    mkdir $td/{binutils,gcc}{,-build} $td/dragonfly
+    mkdir "${td}"/{binutils,gcc}{,-build} "${td}/dragonfly"
 
-    curl https://ftp.gnu.org/gnu/binutils/binutils-$binutils.tar.bz2 | \
-        tar -C $td/binutils --strip-components=1 -xj
+    curl "https://ftp.gnu.org/gnu/binutils/binutils-${binutils}.tar.bz2" | \
+        tar -C "${td}/binutils" --strip-components=1 -xj
 
-    curl https://ftp.gnu.org/gnu/gcc/gcc-$gcc/gcc-$gcc.tar.bz2 | \
-        tar -C $td/gcc --strip-components=1 -xj
+    curl "https://ftp.gnu.org/gnu/gcc/gcc-${gcc}/gcc-${gcc}.tar.bz2" | \
+        tar -C "${td}/gcc" --strip-components=1 -xj
 
-    pushd $td
+    pushd "${td}"
 
     cd gcc
     sed -i -e 's/ftp:/https:/g' ./contrib/download_prerequisites
@@ -89,34 +90,34 @@ EOF
 EOF
     cd ..
 
-    curl https://mirror-master.dragonflybsd.org/iso-images/dfly-x86_64-$dragonfly.iso.bz2 | \
+    curl "https://mirror-master.dragonflybsd.org/iso-images/dfly-x86_64-${dragonfly}.iso.bz2" | \
         bzcat | \
-        bsdtar xf - -C $td/dragonfly ./usr/include ./usr/lib ./lib
+        bsdtar xf - -C "${td}/dragonfly" ./usr/include ./usr/lib ./lib
 
     cd binutils-build
     ../binutils/configure \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
-    local destdir=/usr/local/$target
-    cp -r $td/dragonfly/usr/include $destdir/
-    cp $td/dragonfly/lib/libc.so.8 $destdir/lib
-    cp $td/dragonfly/lib/libm.so.4 $destdir/lib
-    cp $td/dragonfly/lib/libutil.so.4 $destdir/lib
-    cp $td/dragonfly/usr/lib/libexecinfo.so.1 $destdir/lib
-    cp $td/dragonfly/usr/lib/libpthread.so $destdir/lib/libpthread.so
-    cp $td/dragonfly/usr/lib/librt.so.0 $destdir/lib
-    cp $td/dragonfly/usr/lib/lib{c,m,util}.a $destdir/lib
-    cp $td/dragonfly/usr/lib/thread/libthread_xu.so.2 $destdir/lib/libpthread.so.0
-    cp $td/dragonfly/usr/lib/{crt1,Scrt1,crti,crtn}.o $destdir/lib
-
-    ln -s libc.so.8 $destdir/lib/libc.so
-    ln -s libexecinfo.so.1 $destdir/lib/libexecinfo.so
-    ln -s libm.so.4 $destdir/lib/libm.so
-    ln -s librt.so.0 $destdir/lib/librt.so
-    ln -s libutil.so.4 $destdir/lib/libutil.so
+    local destdir="/usr/local/${target}"
+    cp -r "${td}/dragonfly/usr/include" "${destdir}"/
+    cp "${td}/dragonfly/lib/libc.so.8" "${destdir}/lib"
+    cp "${td}/dragonfly/lib/libm.so.4" "${destdir}/lib"
+    cp "${td}/dragonfly/lib/libutil.so.4" "${destdir}/lib"
+    cp "${td}/dragonfly/usr/lib/libexecinfo.so.1" "${destdir}/lib"
+    cp "${td}/dragonfly/usr/lib/libpthread.so" "${destdir}/lib/libpthread.so"
+    cp "${td}/dragonfly/usr/lib/librt.so.0" "${destdir}/lib"
+    cp "${td}/dragonfly/usr/lib/lib{c,m,util}.a" "${destdir}/lib"
+    cp "${td}/dragonfly/usr/lib/thread/libthread_xu.so.2" "${destdir}/lib/libpthread.so.0"
+    cp "${td}/dragonfly/usr/lib/{crt1,Scrt1,crti,crtn}.o" "${destdir}/lib"
+
+    ln -s libc.so.8 "${destdir}/lib/libc.so"
+    ln -s libexecinfo.so.1 "${destdir}/lib/libexecinfo.so"
+    ln -s libm.so.4 "${destdir}/lib/libm.so"
+    ln -s librt.so.0 "${destdir}/lib/librt.so"
+    ln -s libutil.so.4 "${destdir}/lib/libutil.so"
 
     cd gcc-build
     ../gcc/configure \
@@ -132,8 +133,8 @@ EOF
         --disable-multilib \
         --disable-nls \
         --enable-languages=c,c++ \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
@@ -141,11 +142,11 @@ EOF
     popd
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/dropbear.sh b/docker/dropbear.sh
index 09a5743dc..dd6b2f285 100755
--- a/docker/dropbear.sh
+++ b/docker/dropbear.sh
@@ -4,8 +4,7 @@ set -x
 set -euo pipefail
 
 main() {
-    local version=2019.78 \
-          td=$(mktemp -d)
+    local version=2019.78
 
     local dependencies=(
         autoconf
@@ -18,16 +17,19 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    pushd $td
+    local td
+    td="$(mktemp -d)"
 
-    curl -L https://matt.ucc.asn.au/dropbear/dropbear-$version.tar.bz2 | \
+    pushd "${td}"
+
+    curl -L "https://matt.ucc.asn.au/dropbear/dropbear-${version}.tar.bz2" | \
         tar --strip-components=1 -xj
 
     # Remove some unwanted message
@@ -45,17 +47,17 @@ main() {
        --disable-pututline \
        --disable-pututxline
 
-    make -j$(nproc) PROGRAMS=dbclient
+    make "-j$(nproc)" PROGRAMS=dbclient
     cp dbclient /usr/local/bin/
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
     popd
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/emscripten.sh b/docker/emscripten.sh
index c014cf74e..5a080f040 100755
--- a/docker/emscripten.sh
+++ b/docker/emscripten.sh
@@ -14,10 +14,10 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --no-install-recommends --assume-yes "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
@@ -32,7 +32,7 @@ main() {
     echo 'int main() {}' > a.c
     emcc a.c
     emcc -s BINARYEN=1 a.c
-    echo -e "#include <iostream>\n void hello(){ std::cout << std::endl; }" > a.cpp
+    echo -e '#include <iostream>\n void hello(){ std::cout << std::endl; }' > a.cpp
     emcc a.cpp
     emcc -s BINARYEN=1 a.cpp
     rm -f a.*
@@ -41,10 +41,10 @@ main() {
     chmod a+rwX -R "${EMSDK}"
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm $0
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/freebsd.sh b/docker/freebsd.sh
index b35b8f046..83a6af69e 100755
--- a/docker/freebsd.sh
+++ b/docker/freebsd.sh
@@ -4,11 +4,11 @@ set -x
 set -euo pipefail
 
 main() {
-    local arch=$1
+    local arch="${1}"
 
     local binutils=2.25.1 \
           gcc=5.3.0 \
-          target=$arch-unknown-freebsd10
+          target="${arch}-unknown-freebsd10"
 
     local dependencies=(
         bzip2
@@ -22,24 +22,25 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --no-install-recommends --assume-yes "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    local td=$(mktemp -d)
+    local td
+    td="$(mktemp -d)"
 
-    mkdir $td/{binutils,gcc}{,-build} $td/freebsd
+    mkdir "${td}"/{binutils,gcc}{,-build} "${td}/freebsd"
 
-    curl https://ftp.gnu.org/gnu/binutils/binutils-$binutils.tar.bz2 | \
-        tar -C $td/binutils --strip-components=1 -xj
+    curl "https://ftp.gnu.org/gnu/binutils/binutils-${binutils}.tar.bz2" | \
+        tar -C "${td}/binutils" --strip-components=1 -xj
 
-    curl https://ftp.gnu.org/gnu/gcc/gcc-$gcc/gcc-$gcc.tar.bz2 | \
-        tar -C $td/gcc --strip-components=1 -xj
+    curl "https://ftp.gnu.org/gnu/gcc/gcc-${gcc}/gcc-${gcc}.tar.bz2" | \
+        tar -C "${td}/gcc" --strip-components=1 -xj
 
-    pushd $td
+    pushd "${td}"
 
     cd gcc
     sed -i -e 's/ftp:/https:/g' ./contrib/download_prerequisites
@@ -47,7 +48,7 @@ main() {
     cd ..
 
     local bsd_arch=
-    case $arch in
+    case "${arch}" in
         x86_64)
             bsd_arch=amd64
             ;;
@@ -56,34 +57,34 @@ main() {
             ;;
     esac
 
-    curl http://ftp.freebsd.org/pub/FreeBSD/releases/$bsd_arch/10.2-RELEASE/base.txz | \
-        tar -C $td/freebsd -xJ ./usr/include ./usr/lib ./lib
+    curl "http://ftp.freebsd.org/pub/FreeBSD/releases/${bsd_arch}/10.2-RELEASE/base.txz" | \
+        tar -C "${td}/freebsd" -xJ ./usr/include ./usr/lib ./lib
 
     cd binutils-build
     ../binutils/configure \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
-    local destdir=/usr/local/$target
-    cp -r $td/freebsd/usr/include $destdir
-    cp $td/freebsd/lib/libc.so.7 $destdir/lib
-    cp $td/freebsd/lib/libm.so.5 $destdir/lib
-    cp $td/freebsd/lib/libthr.so.3 $destdir/lib/libpthread.so
-    cp $td/freebsd/lib/libutil.so.9 $destdir/lib
-    cp $td/freebsd/usr/lib/libc++.so.1 $destdir/lib
-    cp $td/freebsd/usr/lib/libc++.a $destdir/lib
-    cp $td/freebsd/usr/lib/lib{c,util,m}.a $destdir/lib
-    cp $td/freebsd/usr/lib/lib{rt,execinfo}.so.1 $destdir/lib
-    cp $td/freebsd/usr/lib/{crt1,Scrt1,crti,crtn}.o $destdir/lib
-
-    ln -s libc.so.7 $destdir/lib/libc.so
-    ln -s libc++.so.1 $destdir/lib/libc++.so
-    ln -s libexecinfo.so.1 $destdir/lib/libexecinfo.so
-    ln -s libm.so.5 $destdir/lib/libm.so
-    ln -s librt.so.1 $destdir/lib/librt.so
-    ln -s libutil.so.9 $destdir/lib/libutil.so
+    local destdir="/usr/local/${target}"
+    cp -r "${td}/freebsd/usr/include" "${destdir}"
+    cp "${td}/freebsd/lib/libc.so.7" "${destdir}/lib"
+    cp "${td}/freebsd/lib/libm.so.5" "${destdir}/lib"
+    cp "${td}/freebsd/lib/libthr.so.3" "${destdir}/lib/libpthread.so"
+    cp "${td}/freebsd/lib/libutil.so.9" "${destdir}/lib"
+    cp "${td}/freebsd/usr/lib/libc++.so.1" "${destdir}/lib"
+    cp "${td}/freebsd/usr/lib/libc++.a" "${destdir}/lib"
+    cp "${td}/freebsd/usr/lib"/lib{c,util,m}.a "${destdir}/lib"
+    cp "${td}/freebsd/usr/lib"/lib{rt,execinfo}.so.1 "${destdir}/lib"
+    cp "${td}/freebsd/usr/lib"/{crt1,Scrt1,crti,crtn}.o "${destdir}/lib"
+
+    ln -s libc.so.7 "${destdir}/lib/libc.so"
+    ln -s libc++.so.1 "${destdir}/lib/libc++.so"
+    ln -s libexecinfo.so.1 "${destdir}/lib/libexecinfo.so"
+    ln -s libm.so.5 "${destdir}/lib/libm.so"
+    ln -s librt.so.1 "${destdir}/lib/librt.so"
+    ln -s libutil.so.9 "${destdir}/lib/libutil.so"
 
     cd gcc-build
     ../gcc/configure \
@@ -99,8 +100,8 @@ main() {
         --disable-multilib \
         --disable-nls \
         --enable-languages=c,c++ \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
@@ -108,11 +109,11 @@ main() {
     popd
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/linux-image.sh b/docker/linux-image.sh
index ca23220f0..d83c22beb 100755
--- a/docker/linux-image.sh
+++ b/docker/linux-image.sh
@@ -5,45 +5,45 @@ set -euo pipefail
 
 main() {
     # arch in the rust target
-    local arch=$1 \
+    local arch="${1}" \
           kversion=4.9.0-11
 
     local debsource="deb http://http.debian.net/debian/ stretch main"
-    debsource="$debsource\ndeb http://security.debian.org/ stretch/updates main"
+    debsource="${debsource}\ndeb http://security.debian.org/ stretch/updates main"
 
     local dropbear="dropbear-bin"
 
-    local deps=
+    local -a deps
     local kernel=
 
     # select debian arch and kernel version
-    case $arch in
+    case "${arch}" in
         aarch64)
             arch=arm64
-            kernel=$kversion-arm64
+            kernel="${kversion}-arm64"
             ;;
         armv7)
             arch=armhf
-            kernel=$kversion-armmp
+            kernel="${kversion}-armmp"
             ;;
         i686)
             arch=i386
-            kernel=$kversion-686
+            kernel="${kversion}-686"
             ;;
         mips|mipsel)
-            kernel=$kversion-4kc-malta
+            kernel="${kversion}-4kc-malta"
             ;;
         mips64el)
-            kernel=$kversion-5kc-malta
+            kernel="${kversion}-5kc-malta"
             ;;
         powerpc)
             # there is no stretch powerpc port, so we use jessie
             # use a more recent kernel from backports
             kernel=4.9.0-0.bpo.6-powerpc
             debsource="deb http://archive.debian.org/debian jessie main"
-            debsource="$debsource\ndeb http://archive.debian.org/debian jessie-backports main"
-            debsource="$debsource\ndeb http://ftp.ports.debian.org/debian-ports unstable main"
-            debsource="$debsource\ndeb http://ftp.ports.debian.org/debian-ports unreleased main"
+            debsource="${debsource}\ndeb http://archive.debian.org/debian jessie-backports main"
+            debsource="${debsource}\ndeb http://ftp.ports.debian.org/debian-ports unstable main"
+            debsource="${debsource}\ndeb http://ftp.ports.debian.org/debian-ports unreleased main"
 
             # archive.debian.org Release files are expired.
             echo "Acquire::Check-Valid-Until false;" | tee -a /etc/apt/apt.conf.d/10-nocheckvalid
@@ -57,33 +57,33 @@ main() {
             # https://packages.debian.org/en/sid/linux-image-powerpc64
             kernel='*-powerpc64'
             debsource="deb http://ftp.ports.debian.org/debian-ports unstable main"
-            debsource="$debsource\ndeb http://ftp.ports.debian.org/debian-ports unreleased main"
+            debsource="${debsource}\ndeb http://ftp.ports.debian.org/debian-ports unreleased main"
             # sid version of dropbear requires these dependencies
-            deps="libtommath1:ppc64 libtomcrypt1:ppc64 libgmp10:ppc64"
+            deps=(libtommath1:ppc64 libtomcrypt1:ppc64 libgmp10:ppc64)
             ;;
         powerpc64le)
             arch=ppc64el
-            kernel=$kversion-powerpc64le
+            kernel="${kversion}-powerpc64le"
             ;;
         s390x)
             arch=s390x
-            kernel=$kversion-s390x
+            kernel="${kversion}-s390x"
             ;;
         sparc64)
             # there is no stable port
             # https://packages.debian.org/en/sid/linux-image-sparc64
             kernel='*-sparc64'
             debsource="deb http://ftp.ports.debian.org/debian-ports unstable main"
-            debsource="$debsource\ndeb http://ftp.ports.debian.org/debian-ports unreleased main"
+            debsource="${debsource}\ndeb http://ftp.ports.debian.org/debian-ports unreleased main"
             # sid version of dropbear requires these dependencies
-            deps="libtommath1:sparc64 libtomcrypt1:sparc64 libgmp10:sparc64"
+            deps=(libtommath1:sparc64 libtomcrypt1:sparc64 libgmp10:sparc64)
             ;;
         x86_64)
             arch=amd64
-            kernel=$kversion-amd64
+            kernel="${kversion}-amd64"
             ;;
         *)
-            echo "Invalid arch: $arch"
+            echo "Invalid arch: ${arch}"
             exit 1
             ;;
     esac
@@ -96,22 +96,22 @@ main() {
 
     local purge_list=()
     apt-get update
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
     # Download packages
     mv /etc/apt/sources.list /etc/apt/sources.list.bak
-    echo -e "$debsource" > /etc/apt/sources.list
+    echo -e "${debsource}" > /etc/apt/sources.list
 
     # Old ubuntu does not support --add-architecture, so we directly change multiarch file
     if [ -f /etc/dpkg/dpkg.cfg.d/multiarch ]; then
         cp /etc/dpkg/dpkg.cfg.d/multiarch /etc/dpkg/dpkg.cfg.d/multiarch.bak
     fi
-    dpkg --add-architecture $arch || echo "foreign-architecture $arch" > /etc/dpkg/dpkg.cfg.d/multiarch
+    dpkg --add-architecture "${arch}" || echo "foreign-architecture ${arch}" > /etc/dpkg/dpkg.cfg.d/multiarch
 
     # Add Debian keys.
     curl -sL https://ftp-master.debian.org/keys/archive-key-{7.0,8,9,10}.asc      | apt-key add -
@@ -120,45 +120,47 @@ main() {
     curl -sL https://www.ports.debian.org/archive_{2020,2021}.key                 | apt-key add -
     apt-get update
 
-    mkdir -p -m 777 /qemu/$arch
-    cd /qemu/$arch
+    mkdir -p "/qemu/${arch}"
+    chmod 777 /qemu "/qemu/${arch}"
+
+    cd "/qemu/${arch}"
     apt-get -d --no-install-recommends download \
-        $deps \
-        busybox:$arch \
-        $dropbear:$arch \
-        libc6:$arch \
-        libgcc1:$arch \
-        libstdc++6:$arch \
-        linux-image-$kernel:$arch \
+        ${deps[@]+"${deps[@]}"} \
+        "busybox:${arch}" \
+        "${dropbear}:${arch}" \
+        "libc6:${arch}" \
+        "libgcc1:${arch}" \
+        "libstdc++6:${arch}" \
+        "linux-image-${kernel}:${arch}" \
         ncurses-base \
-        zlib1g:$arch
+        "zlib1g:${arch}"
     cd /qemu
 
     # Install packages
-    root=root-$arch
-    mkdir -p $root/{bin,etc/dropbear,root,sys,dev,proc,sbin,tmp,usr/{bin,sbin},var/log}
-    for deb in $arch/*deb; do
-        dpkg -x $deb $root/
+    root="root-${arch}"
+    mkdir -p "${root}"/{bin,etc/dropbear,root,sys,dev,proc,sbin,tmp,usr/{bin,sbin},var/log}
+    for deb in "${arch}"/*deb; do
+        dpkg -x "${deb}" "${root}"/
     done
 
-    cp $root/boot/vmlinu* kernel
+    cp "${root}/boot/vmlinu"* kernel
 
     # initrd
-    mkdir -p $root/modules
+    mkdir -p "${root}/modules"
     cp \
-        $root/lib/modules/*/kernel/drivers/net/net_failover.ko \
-        $root/lib/modules/*/kernel/drivers/net/virtio_net.ko \
-        $root/lib/modules/*/kernel/drivers/virtio/* \
-        $root/lib/modules/*/kernel/fs/9p/9p.ko \
-        $root/lib/modules/*/kernel/fs/fscache/fscache.ko \
-        $root/lib/modules/*/kernel/net/9p/9pnet.ko \
-        $root/lib/modules/*/kernel/net/9p/9pnet_virtio.ko \
-        $root/lib/modules/*/kernel/net/core/failover.ko \
-        $root/modules || true # some file may not exist
-    rm -rf $root/boot
-    rm -rf $root/lib/modules
-
-    cat << 'EOF' > $root/etc/hosts
+        "${root}/lib/modules"/*/kernel/drivers/net/net_failover.ko \
+        "${root}/lib/modules"/*/kernel/drivers/net/virtio_net.ko \
+        "${root}/lib/modules"/*/kernel/drivers/virtio/* \
+        "${root}/lib/modules"/*/kernel/fs/9p/9p.ko \
+        "${root}/lib/modules"/*/kernel/fs/fscache/fscache.ko \
+        "${root}/lib/modules"/*/kernel/net/9p/9pnet.ko \
+        "${root}/lib/modules"/*/kernel/net/9p/9pnet_virtio.ko \
+        "${root}/lib/modules"/*/kernel/net/core/failover.ko \
+        "${root}/modules" || true # some file may not exist
+    rm -rf "${root:?}/boot"
+    rm -rf "${root:?}/lib/modules"
+
+    cat << 'EOF' > "${root}/etc/hosts"
 127.0.0.1 localhost qemu
 EOF
 
@@ -195,7 +197,7 @@ end
 EOF
 
     # dropbear complains when this file is missing
-    touch $root/var/log/lastlog
+    touch "${root}/var/log/lastlog"
 
     cat << 'EOF' > $root/init
 #!/bin/busybox sh
@@ -233,23 +235,23 @@ mount -t 9p -o trans=virtio target /target -oversion=9p2000.u || true
 exec dropbear -F -E -B
 EOF
 
-    chmod +x $root/init
-    cd $root
+    chmod +x "${root}/init"
+    cd "${root}"
     find . | cpio --create --format='newc' --quiet | gzip > ../initrd.gz
     cd -
 
     # Clean up
-    rm -rf /qemu/$root /qemu/$arch
+    rm -rf "/qemu/${root}" "/qemu/${arch}"
     mv -f /etc/apt/sources.list.bak /etc/apt/sources.list
     if [ -f /etc/dpkg/dpkg.cfg.d/multiarch.bak ]; then
         mv /etc/dpkg/dpkg.cfg.d/multiarch.bak /etc/dpkg/dpkg.cfg.d/multiarch
     fi
     # can fail if arch is used (amd64 and/or i386)
-    dpkg --remove-architecture $arch || true
+    dpkg --remove-architecture "${arch}" || true
     apt-get update
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
     ls -lh /qemu
diff --git a/docker/linux-runner b/docker/linux-runner
index e50d8300a..f72fcf3b7 100755
--- a/docker/linux-runner
+++ b/docker/linux-runner
@@ -5,15 +5,15 @@ set -e
 LOG=/tmp/qemu.log
 LOCK=/tmp/qemu.lock
 
-if [ -n "$CROSS_DEBUG" ]; then
+if [ -n "${CROSS_DEBUG}" ]; then
     set -x
 fi
 
 # arch in the rust target
-arch=$1
+arch="${1}"
 shift
 
-if [ "$CROSS_RUNNER" = "" ]; then
+if [ "${CROSS_RUNNER}" = "" ]; then
     if [[ "${arch}" == i?86 ]] || [[ "${arch}" == x86_64 ]]; then
         CROSS_RUNNER=native
     else
@@ -22,8 +22,8 @@ if [ "$CROSS_RUNNER" = "" ]; then
 fi
 
 # select qemu arch
-qarch=$arch
-case "$arch" in
+qarch="${arch}"
+case "${arch}" in
     armv7)
         qarch="arm"
         ;;
@@ -37,7 +37,7 @@ case "$arch" in
         qarch="ppc64"
         ;;
     powerpc64le)
-        if [ "$CROSS_RUNNER" = "qemu-user" ]; then
+        if [ "${CROSS_RUNNER}" = "qemu-user" ]; then
             qarch="ppc64le"
         else
             qarch="ppc64"
@@ -45,30 +45,30 @@ case "$arch" in
         ;;
 esac
 
-case "$CROSS_RUNNER" in
+case "${CROSS_RUNNER}" in
     native)
         exec "${@}"
         ;;
     qemu-user)
-        exec qemu-$qarch "${@}"
+        exec "qemu-${qarch}" "${@}"
         ;;
     qemu-system)
         true
         ;;
     *)
-        echo "Invalid runner: \"$CROSS_RUNNER\"";
+        echo "Invalid runner: \"${CROSS_RUNNER}\"";
         echo "Valid runners are: native, qemu-user and qemu-system"
         exit 1
         ;;
 esac
 
-n=$(nproc)
+n="$(nproc)"
 memory=1G
 driver9p="virtio-9p-pci"
 drivernet="virtio-net-pci"
 
 # select qemu parameters
-case "$arch" in
+case "${arch}" in
     aarch64)
         # 8 is the max number of cpu supported by qemu-aarch64
         n=$(( n > 8 ? 8 : n ))
@@ -121,37 +121,37 @@ esac
 
     echo Booting QEMU virtual machine with $n cpus...
 
-    QEMU_CMD="qemu-system-$qarch \
-        -m $memory \
-        -smp $n \
+    QEMU_CMD="qemu-system-${qarch} \
+        -m ${memory} \
+        -smp ${n} \
         -nographic \
         -monitor none \
         -netdev user,id=net0,hostfwd=tcp::10022-:22 \
-        -device $drivernet,netdev=net0 \
+        -device ${drivernet},netdev=net0 \
         -kernel /qemu/kernel \
         -initrd /qemu/initrd.gz \
-        $opt \
+        ${opt} \
         -fsdev local,id=fs0,path=/target,security_model=mapped \
-        -device $driver9p,fsdev=fs0,mount_tag=target"
+        -device ${driver9p},fsdev=fs0,mount_tag=target"
 
-    touch $LOG
-    if [ -n "$CROSS_DEBUG" ]; then
-        ($QEMU_CMD 2>&1 | tee -a $LOG) &
+    touch "${LOG}"
+    if [[ -n "${CROSS_DEBUG}" ]]; then
+        (${QEMU_CMD} 2>&1 | tee -a "${LOG}") &
     else
-        $QEMU_CMD 2>&1 >> $LOG &
+        ${QEMU_CMD} >> "${LOG}" 2>&1 &
     fi
 
     # wait for dropbear
-    for i in $(seq 240); do
-        if grep -q "Not backgrounding" $LOG; then
+    for _ in $(seq 240); do
+        if grep -q "Not backgrounding" "${LOG}"; then
             READY=1
             break
         fi
         sleep 0.5s
     done
 
-    if [ -z "$READY" ]; then
-        if [ -n "$CROSS_DEBUG" ]; then
+    if [ -z "${READY}" ]; then
+        if [ -n "${CROSS_DEBUG}" ]; then
             echo "Not ready but continuing because CROSS_DEBUG is set"
         else
             echo "Qemu is not ready..."
@@ -160,11 +160,11 @@ esac
         fi
     fi
 
-    echo Booted in $SECONDS seconds
+    echo "Booted in ${SECONDS} seconds"
 
-) 200>$LOCK
+) 200>"${LOCK}"
 
-if [ -t 1 ] && [ -t 2]; then
+if [[ -t 1 ]] && [[ -t 2 ]]; then
   tty_flag='-t'
 fi
 
diff --git a/docker/mingw.sh b/docker/mingw.sh
old mode 100644
new mode 100755
index 6c0e544cb..da91872be
--- a/docker/mingw.sh
+++ b/docker/mingw.sh
@@ -11,26 +11,26 @@ main() {
     # Later we replace these packages with the new ones
     apt-get install --assume-yes --no-install-recommends g++-mingw-w64-i686
 
-    local td=$(mktemp -d)
-
-    local dependencies=(
-        build-essential
-        $(apt-cache showsrc gcc-mingw-w64-i686 | grep Build | cut -d: -f2 | tr , '\n' | cut -d' ' -f2 | sort | uniq)
-    )
+    local dependencies=(build-essential)
+    while IFS='' read -r dep; do dependencies+=("${dep}"); done < \
+      <(apt-cache showsrc gcc-mingw-w64-i686 | grep Build | cut -d: -f2 | tr , '\n' | cut -d' ' -f2 | sort | uniq)
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep > /dev/null; then
-            apt-get install --assume-yes --no-install-recommends $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}" > /dev/null; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    pushd $td
+    local td
+    td="$(mktemp -d)"
+
+    pushd "${td}" || exit 1
 
     apt-get source gcc-mingw-w64-i686
-    cd gcc-mingw-w64-*
+    pushd gcc-mingw-w64-* || exit 1
 
     # We are using dwarf exceptions instead of sjlj
     sed -i -e 's/libgcc_s_sjlj-1/libgcc_s_dw2-1/g' debian/gcc-mingw-w64-i686.install
@@ -91,12 +91,12 @@ EOF
 @@ -85,7 +85,7 @@
  	sed -i 's/@@VERSION@@/$(target_version)/g' debian/control
  	touch $@
- 
+
 -targets := i686-w64-mingw32 x86_64-w64-mingw32
 +targets := i686-w64-mingw32
 -threads := posix win32
 +threads := posix
- 
+
  # Hardening on the host, none on the target
 @@ -216,6 +216,10 @@
  # Enable libatomic
@@ -118,13 +118,14 @@ EOF
     dpkg -i ../g*-mingw-w64-i686*.deb ../gcc-mingw-w64-base*.deb
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    popd
+    popd || exit 1
+    popd || exit 1
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/musl.sh b/docker/musl.sh
index 878c896b0..87f6ac42b 100755
--- a/docker/musl.sh
+++ b/docker/musl.sh
@@ -5,17 +5,16 @@ set -euo pipefail
 
 hide_output() {
     set +x
-    on_err="
-echo ERROR: An error was encountered with the build.
-cat /tmp/build.log
-exit 1
-"
-    trap "$on_err" ERR
-    bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
+    trap "
+      echo 'ERROR: An error was encountered with the build.'
+      cat /tmp/build.log
+      exit 1
+    " ERR
+    bash -c 'while true; do sleep 30; echo $(date) - building ...; done' &
     PING_LOOP_PID=$!
-    "$@" &> /tmp/build.log
+    "${@}" &> /tmp/build.log
     trap - ERR
-    kill $PING_LOOP_PID
+    kill "${PING_LOOP_PID}"
     set -x
 }
 
@@ -28,34 +27,35 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    local td=$(mktemp -d)
+    local td
+    td="$(mktemp -d)"
 
-    pushd $td
+    pushd "${td}"
     curl -L https://github.com/richfelker/musl-cross-make/archive/v0.9.8.tar.gz | \
         tar --strip-components=1 -xz
 
-    hide_output make install -j$(nproc) \
+    hide_output make install "-j$(nproc)" \
         GCC_VER=6.4.0 \
         MUSL_VER=1.1.22 \
-        DL_CMD="curl -C - -L -o" \
+        DL_CMD='curl -C - -L -o' \
         OUTPUT=/usr/local/ \
-        "$@"
+        "${@}"
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
     popd
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/netbsd.sh b/docker/netbsd.sh
index e75be9fe2..e34e07862 100755
--- a/docker/netbsd.sh
+++ b/docker/netbsd.sh
@@ -21,24 +21,25 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    local td=$(mktemp -d)
+    local td
+    td="$(mktemp -d)"
 
-    mkdir $td/{binutils,gcc}{,-build} $td/netbsd
+    mkdir "${td}"/{binutils,gcc}{,-build} "${td}/netbsd"
 
-    curl https://ftp.gnu.org/gnu/binutils/binutils-$binutils.tar.bz2 | \
-        tar -C $td/binutils --strip-components=1 -xj
+    curl "https://ftp.gnu.org/gnu/binutils/binutils-${binutils}.tar.bz2" | \
+        tar -C "${td}/binutils" --strip-components=1 -xj
 
-    curl https://ftp.gnu.org/gnu/gcc/gcc-$gcc/gcc-$gcc.tar.bz2 | \
-        tar -C $td/gcc --strip-components=1 -xj
+    curl "https://ftp.gnu.org/gnu/gcc/gcc-${gcc}/gcc-${gcc}.tar.bz2" | \
+        tar -C "${td}/gcc" --strip-components=1 -xj
 
-    pushd $td
+    pushd "${td}"
 
     cd gcc
     sed -i -e 's/ftp:/https:/g' ./contrib/download_prerequisites
@@ -49,44 +50,44 @@ main() {
     )
 
     local patch
-    for patch in ${patches[@]}; do
-        patch=$(curl $patch)
-        echo "$patch" | patch -Np0
+    for patch in "${patches[@]}"; do
+        patch="$(curl "${patch}")"
+        echo "${patch}" | patch -Np0
     done
     cd ..
 
     curl ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-7.0/amd64/binary/sets/base.tgz | \
-        tar -C $td/netbsd -xz ./usr/include ./usr/lib ./lib
+        tar -C "${td}/netbsd" -xz ./usr/include ./usr/lib ./lib
 
     curl ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-7.0/amd64/binary/sets/comp.tgz | \
-        tar -C $td/netbsd -xz ./usr/include ./usr/lib
+        tar -C "${td}/netbsd" -xz ./usr/include ./usr/lib
 
     cd binutils-build
     ../binutils/configure \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
-    local destdir=/usr/local/$target
-    cp -r $td/netbsd/usr/include $destdir/
-    cp $td/netbsd/lib/libc.so.12.193.1 $destdir/lib
-    cp $td/netbsd/lib/libm.so.0.11 $destdir/lib
-    cp $td/netbsd/lib/libutil.so.7.21 $destdir/lib
-    cp $td/netbsd/usr/lib/libpthread.so.1.2 $destdir/lib
-    cp $td/netbsd/usr/lib/librt.so.1.1 $destdir/lib
-    cp $td/netbsd/usr/lib/lib{c,m,pthread}{,_p,_pic}.a $destdir/lib
-    cp $td/netbsd/usr/lib/{crt0,crti,crtn,crtbeginS,crtendS,crtbegin,crtend,gcrt0}.o $destdir/lib
-
-    ln -s libc.so.12.193.1 $destdir/lib/libc.so
-    ln -s libc.so.12.193.1 $destdir/lib/libc.so.12
-    ln -s libm.so.0.11 $destdir/lib/libm.so
-    ln -s libm.so.0.11 $destdir/lib/libm.so.0
-    ln -s libpthread.so.1.2 $destdir/lib/libpthread.so
-    ln -s libpthread.so.1.2 $destdir/lib/libpthread.so.1
-    ln -s librt.so.1.1 $destdir/lib/librt.so
-    ln -s libutil.so.7.21 $destdir/lib/libutil.so
-    ln -s libutil.so.7.21 $destdir/lib/libutil.so.7
+    local destdir="/usr/local/${target}"
+    cp -r "${td}/netbsd/usr/include" "${destdir}"/
+    cp "${td}/netbsd/lib/libc.so.12.193.1" "${destdir}/lib"
+    cp "${td}/netbsd/lib/libm.so.0.11" "${destdir}/lib"
+    cp "${td}/netbsd/lib/libutil.so.7.21" "${destdir}/lib"
+    cp "${td}/netbsd/usr/lib/libpthread.so.1.2" "${destdir}/lib"
+    cp "${td}/netbsd/usr/lib/librt.so.1.1" "${destdir}/lib"
+    cp "${td}/netbsd/usr/lib"/lib{c,m,pthread}{,_p,_pic}.a "${destdir}/lib"
+    cp "${td}/netbsd/usr/lib"/{crt0,crti,crtn,crtbeginS,crtendS,crtbegin,crtend,gcrt0}.o "${destdir}/lib"
+
+    ln -s libc.so.12.193.1 "${destdir}/lib/libc.so"
+    ln -s libc.so.12.193.1 "${destdir}/lib/libc.so.12"
+    ln -s libm.so.0.11 "${destdir}/lib/libm.so"
+    ln -s libm.so.0.11 "${destdir}/lib/libm.so.0"
+    ln -s libpthread.so.1.2 "${destdir}/lib/libpthread.so"
+    ln -s libpthread.so.1.2 "${destdir}/lib/libpthread.so.1"
+    ln -s librt.so.1.1 "${destdir}/lib/librt.so"
+    ln -s libutil.so.7.21 "${destdir}/lib/libutil.so"
+    ln -s libutil.so.7.21 "${destdir}/lib/libutil.so.7"
 
     cd gcc-build
     ../gcc/configure \
@@ -103,8 +104,8 @@ main() {
         --disable-multilib \
         --disable-nls \
         --enable-languages=c,c++ \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
@@ -112,11 +113,11 @@ main() {
     popd
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/qemu.sh b/docker/qemu.sh
index 4c0055c12..310b15d32 100755
--- a/docker/qemu.sh
+++ b/docker/qemu.sh
@@ -11,13 +11,12 @@ main() {
     # is 3.0.1.
     # Upstream Issue:
     #   https://bugs.launchpad.net/qemu/+bug/1821444
-    if [[ $1 == ppc* ]]; then
+    if [[ "${1}" == ppc* ]]; then
         version=3.0.1
     fi
 
-    local arch=$1 \
-          softmmu=${2:-} \
-          td=$(mktemp -d)
+    local arch="${1}" \
+          softmmu="${2:-}"
 
     local dependencies=(
         autoconf
@@ -42,26 +41,29 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    pushd $td
+    local td
+    td="$(mktemp -d)"
 
-    curl -L https://download.qemu.org/qemu-$version.tar.xz | \
+    pushd "${td}"
+
+    curl -L "https://download.qemu.org/qemu-${version}.tar.xz" | \
         tar --strip-components=1 -xJ
 
-   local targets="$arch-linux-user"
+   local targets="${arch}-linux-user"
    local virtfs=""
-   case "$softmmu" in
+   case "${softmmu}" in
       softmmu)
-         if [ "$arch" = "ppc64le" ]; then
-            targets="$targets,ppc64-softmmu"
+         if [ "${arch}" = "ppc64le" ]; then
+            targets="${targets},ppc64-softmmu"
          else
-            targets="$targets,$arch-softmmu"
+            targets="${targets},${arch}-softmmu"
          fi
          virtfs="--enable-virtfs"
          ;;
@@ -69,7 +71,7 @@ main() {
          true
          ;;
       *)
-         echo "Invalid softmmu option: $softmmu"
+         echo "Invalid softmmu option: ${softmmu}"
          exit 1
          ;;
    esac
@@ -79,23 +81,23 @@ main() {
         --disable-vnc \
         --enable-user \
         --static \
-        $virtfs \
-        --target-list=$targets
-    make -j$(nproc)
+        ${virtfs} \
+        --target-list="${targets}"
+    make "-j$(nproc)"
     make install
 
     # HACK the binfmt_misc interpreter we'll use expects the QEMU binary to be
     # in /usr/bin. Create an appropriate symlink
-    ln -s /usr/local/bin/qemu-$arch /usr/bin/qemu-$arch-static
+    ln -s "/usr/local/bin/qemu-${arch}" "/usr/bin/qemu-${arch}-static"
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
     popd
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/solaris.sh b/docker/solaris.sh
index 6b9a4320d..fad0c0101 100755
--- a/docker/solaris.sh
+++ b/docker/solaris.sh
@@ -4,11 +4,11 @@ set -x
 set -euo pipefail
 
 main() {
-    local arch=$1
+    local arch="${1}"
 
     local binutils=2.28.1 \
           gcc=6.4.0 \
-          target=$arch-sun-solaris2.10
+          target="${arch}-sun-solaris2.10"
 
     local dependencies=(
         bzip2
@@ -24,24 +24,25 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
-    local td=$(mktemp -d)
+    local td
+    td="$(mktemp -d)"
 
-    mkdir $td/{binutils,gcc}{,-build} $td/solaris
+    mkdir "${td}"/{binutils,gcc}{,-build} "${td}/solaris"
 
-    curl https://ftp.gnu.org/gnu/binutils/binutils-$binutils.tar.xz | \
-        tar -C $td/binutils --strip-components=1 -xJ
+    curl "https://ftp.gnu.org/gnu/binutils/binutils-${binutils}.tar.xz" | \
+        tar -C "${td}/binutils" --strip-components=1 -xJ
 
-    curl https://ftp.gnu.org/gnu/gcc/gcc-$gcc/gcc-$gcc.tar.xz | \
-        tar -C $td/gcc --strip-components=1 -xJ
+    curl "https://ftp.gnu.org/gnu/gcc/gcc-${gcc}/gcc-${gcc}.tar.xz" | \
+        tar -C "${td}/gcc" --strip-components=1 -xJ
 
-    pushd $td
+    pushd "${td}"
 
     cd gcc
     sed -i -e 's/ftp:/https:/g' ./contrib/download_prerequisites
@@ -50,7 +51,7 @@ main() {
 
     local apt_arch=
     local lib_arch=
-    case $arch in
+    case "${arch}" in
         x86_64)
             apt_arch=solaris-i386
             lib_arch=amd64
@@ -63,29 +64,29 @@ main() {
 
     apt-key adv --batch --yes --keyserver keyserver.ubuntu.com --recv-keys 74DA7924C5513486
     add-apt-repository -y 'deb http://apt.dilos.org/dilos dilos2-testing main'
-    dpkg --add-architecture $apt_arch
+    dpkg --add-architecture "${apt_arch}"
     apt-get update
-    apt-get download $(apt-cache depends --recurse --no-replaces \
-      libc-dev:$apt_arch       \
-      libdl-dev:$apt_arch      \
-      libm-dev:$apt_arch       \
-      libnsl-dev:$apt_arch     \
-      libpthread-dev:$apt_arch \
-      libresolv-dev:$apt_arch  \
-      librt-dev:$apt_arch      \
-      libsocket-dev:$apt_arch  \
-      system-crt:$apt_arch     \
-      system-header:$apt_arch  \
-      | grep "^\w")
-
-    for deb in *$apt_arch.deb; do
-      dpkg -x $deb $td/solaris
+    apt-cache depends --recurse --no-replaces \
+      "libc-dev:${apt_arch}"       \
+      "libdl-dev:${apt_arch}"      \
+      "libm-dev:${apt_arch}"       \
+      "libnsl-dev:${apt_arch}"     \
+      "libpthread-dev:${apt_arch}" \
+      "libresolv-dev:${apt_arch}"  \
+      "librt-dev:${apt_arch}"      \
+      "libsocket-dev:${apt_arch}"  \
+      "system-crt:${apt_arch}"     \
+      "system-header:${apt_arch}"  \
+      | grep "^\w" | xargs apt-get download
+
+    for deb in *"${apt_arch}.deb"; do
+      dpkg -x "${deb}" "${td}/solaris"
     done
 
     cd binutils-build
     ../binutils/configure \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
@@ -100,14 +101,14 @@ main() {
 -extern size_t strnlen(const char *, size_t);
 EOF
 
-    local destdir=/usr/local/$target
-    mkdir $destdir/usr
-    cp -r $td/solaris/usr/include $destdir/usr
-    mv $td/solaris/usr/lib/$lib_arch/* $destdir/lib
-    mv $td/solaris/lib/$lib_arch/* $destdir/lib
+    local destdir="/usr/local/${target}"
+    mkdir "${destdir}/usr"
+    cp -r "${td}/solaris/usr/include" "${destdir}/usr"
+    mv "${td}/solaris/usr/lib/${lib_arch}"/* "${destdir}/lib"
+    mv "${td}/solaris/lib/${lib_arch}"/* "${destdir}/lib"
 
-    ln -s usr/include $destdir/sys-include
-    ln -s usr/include $destdir/include
+    ln -s usr/include "${destdir}/sys-include"
+    ln -s usr/include "${destdir}/include"
 
     cd gcc-build
     ../gcc/configure \
@@ -125,8 +126,8 @@ EOF
         --enable-languages=c,c++ \
         --with-gnu-as \
         --with-gnu-ld \
-        --target=$target
-    make -j$(nproc)
+        --target="${target}"
+    make "-j$(nproc)"
     make install
     cd ..
 
@@ -134,11 +135,11 @@ EOF
     popd
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm -rf $td
-    rm $0
+    rm -rf "${td}"
+    rm "${0}"
 }
 
 main "${@}"
diff --git a/docker/windows-entry.sh b/docker/windows-entry.sh
index 4dec54b7a..d7673f85f 100755
--- a/docker/windows-entry.sh
+++ b/docker/windows-entry.sh
@@ -3,17 +3,19 @@
 set -e
 
 export HOME=/tmp/home
-mkdir -p $HOME
+mkdir -p "${HOME}"
 
 # Initialize the wine prefix (virtual windows installation)
 export WINEPREFIX=/tmp/wine
-mkdir -p $WINEPREFIX
+mkdir -p "${WINEPREFIX}"
 # FIXME: Make the wine prefix initialization faster
 wineboot &> /dev/null
 
 # Put libstdc++ and some other mingw dlls in WINEPATH
 # This must work for x86_64 and i686
-P1=$(dirname $(find /usr -name libwinpthread-1.dll))
-export WINEPATH="$(ls -d /usr/lib/gcc/*-w64-mingw32/*posix);$P1"
+P1="$(dirname "$(find /usr -name libwinpthread-1.dll)")"
+
+WINEPATH="$(ls -d /usr/lib/gcc/*-w64-mingw32/*posix);${P1}"
+export WINEPATH
 
 exec "$@"
diff --git a/docker/xargo.sh b/docker/xargo.sh
index 3bdac349b..0ea69d00c 100755
--- a/docker/xargo.sh
+++ b/docker/xargo.sh
@@ -11,10 +11,10 @@ main() {
 
     apt-get update
     local purge_list=()
-    for dep in ${dependencies[@]}; do
-        if ! dpkg -L $dep; then
-            apt-get install --no-install-recommends --assume-yes $dep
-            purge_list+=( $dep )
+    for dep in "${dependencies[@]}"; do
+        if ! dpkg -L "${dep}"; then
+            apt-get install --assume-yes --no-install-recommends "${dep}"
+            purge_list+=( "${dep}" )
         fi
     done
 
@@ -30,10 +30,10 @@ main() {
     rm -r "${RUSTUP_HOME}" "${CARGO_HOME}"
 
     if (( ${#purge_list[@]} )); then
-      apt-get purge --auto-remove -y ${purge_list[@]}
+      apt-get purge --assume-yes --auto-remove "${purge_list[@]}"
     fi
 
-    rm $0
+    rm "${0}"
 }
 
 main "${@}"