diff --git a/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh b/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh
index 112d747fe4ed6..3e02b5ae33e41 100755
--- a/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh
+++ b/src/ci/docker/host-x86_64/disabled/dist-x86_64-dragonfly/build-toolchain.sh
@@ -17,7 +17,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
@@ -85,7 +85,7 @@ cd gcc-$GCC
 # These patches probably only need to be updated in case the gcc version is
 # updated.
 
-patch -p0 < $PATCH_TOOLCHAIN
+patch -p0 < "$PATCH_TOOLCHAIN"
 
 ./contrib/download_prerequisites
 
diff --git a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh
index faf30f36a20f9..7b409da4fe9e1 100755
--- a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh
+++ b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/build-toolchain.sh
@@ -4,12 +4,12 @@ set -ex
 
 ARCH=$1
 
-TOP=$(pwd)
+TOP="$(pwd)"
 
-BUILDTOOLS=$TOP/buildtools
-HAIKU=$TOP/haiku
+BUILDTOOLS="$TOP/buildtools"
+HAIKU="$TOP/haiku"
 OUTPUT=/tools
-SYSROOT=$OUTPUT/cross-tools-$ARCH/sysroot
+SYSROOT="$OUTPUT/cross-tools-$ARCH/sysroot"
 PACKAGE_ROOT=/system
 
 hide_output() {
@@ -22,7 +22,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
@@ -31,17 +31,17 @@ exit 1
 # First up, build a cross-compiler
 git clone --depth=1 https://git.haiku-os.org/haiku
 git clone --depth=1 https://git.haiku-os.org/buildtools
-cd $BUILDTOOLS/jam
+cd "$BUILDTOOLS/jam"
 hide_output make
 hide_output ./jam0 install
-mkdir -p $OUTPUT
-cd $OUTPUT
-hide_output $HAIKU/configure --build-cross-tools $ARCH $TOP/buildtools
+mkdir -p "$OUTPUT"
+cd "$OUTPUT"
+hide_output "$HAIKU/configure" --build-cross-tools "$ARCH" "$TOP/buildtools"
 
 # Set up sysroot to redirect to /system
-mkdir -p $SYSROOT/boot
-mkdir -p $PACKAGE_ROOT
-ln -s $PACKAGE_ROOT $SYSROOT/boot/system
+mkdir -p "$SYSROOT/boot"
+mkdir -p "$PACKAGE_ROOT"
+ln -s "$PACKAGE_ROOT" "$SYSROOT/boot/system"
 
 # Build needed packages and tools for the cross-compiler
 hide_output jam -q haiku.hpkg haiku_devel.hpkg '<build>package'
@@ -49,11 +49,11 @@ hide_output jam -q haiku.hpkg haiku_devel.hpkg '<build>package'
 # Set up our sysroot
 cp $OUTPUT/objects/linux/lib/*.so /lib/x86_64-linux-gnu
 cp $OUTPUT/objects/linux/x86_64/release/tools/package/package /bin/
-find $SYSROOT/../bin/ -type f -exec ln -s {} /bin/ \;
+find "$SYSROOT/../bin/" -type f -exec ln -s {} /bin/ \;
 
 # Extract packages
-package extract -C $PACKAGE_ROOT $OUTPUT/objects/haiku/$ARCH/packaging/packages/haiku.hpkg
-package extract -C $PACKAGE_ROOT $OUTPUT/objects/haiku/$ARCH/packaging/packages/haiku_devel.hpkg
+package extract -C $PACKAGE_ROOT $OUTPUT/objects/haiku/"$ARCH"/packaging/packages/haiku.hpkg
+package extract -C $PACKAGE_ROOT $OUTPUT/objects/haiku/"$ARCH"/packaging/packages/haiku_devel.hpkg
 find $OUTPUT/download/ -name '*.hpkg' -exec package extract -C $PACKAGE_ROOT {} \;
 
 # Fix libgcc_s so we can link to it
@@ -61,5 +61,5 @@ cd $PACKAGE_ROOT/develop/lib
 ln -s ../../lib/libgcc_s.so libgcc_s.so
 
 # Clean up
-rm -rf $BUILDTOOLS $HAIKU $OUTPUT/Jamfile $OUTPUT/attributes $OUTPUT/build \
-  $OUTPUT/build_packages $OUTPUT/download $OUTPUT/objects
+rm -rf "$BUILDTOOLS" "$HAIKU" "$OUTPUT"/Jamfile "$OUTPUT"/attributes "$OUTPUT"/build \
+  "$OUTPUT"/build_packages "$OUTPUT"/download "$OUTPUT"/objects
diff --git a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/fetch-packages.sh b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/fetch-packages.sh
index e4c9f86d268dc..be6d1f3998368 100755
--- a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/fetch-packages.sh
+++ b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/fetch-packages.sh
@@ -6,4 +6,4 @@ wget http://packages.haiku-os.org/haikuports/master/hpkg/llvm_libs-4.0.1-2-x86_6
 package extract -C /system llvm-4.0.1-2-x86_64.hpkg
 package extract -C /system llvm_libs-4.0.1-2-x86_64.hpkg
 
-rm -f *.hpkg
+rm -f -- *.hpkg
diff --git a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/llvm-config.sh b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/llvm-config.sh
index 83f3a6e5f1216..53f2210852594 100755
--- a/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/llvm-config.sh
+++ b/src/ci/docker/host-x86_64/disabled/dist-x86_64-haiku/llvm-config.sh
@@ -2,29 +2,29 @@
 
 case $1 in
 --version) echo  4.0.1;;
---prefix) echo  $SCRATCH/haiku-cross/sysroot/boot/system;;
---bindir) echo  $SCRATCH/haiku-cross/sysroot/boot/system/bin;;
---includedir) echo  $SCRATCH/haiku-cross/sysroot/boot/system/develop/headers;;
---libdir) echo  $SCRATCH/haiku-/cross/sysroot/boot/system/develop/lib;;
---cmakedir) echo  $SCRATCH/haiku-/cross/sysroot/boot/system/develop/lib/cmake/llvm;;
---cppflags) echo  -I$SCRATCH/haiku-/cross/sysroot/boot/system/develop/headers \
+--prefix) echo  "$SCRATCH"/haiku-cross/sysroot/boot/system;;
+--bindir) echo  "$SCRATCH"/haiku-cross/sysroot/boot/system/bin;;
+--includedir) echo  "$SCRATCH"/haiku-cross/sysroot/boot/system/develop/headers;;
+--libdir) echo  "$SCRATCH"/haiku-/cross/sysroot/boot/system/develop/lib;;
+--cmakedir) echo  "$SCRATCH"/haiku-/cross/sysroot/boot/system/develop/lib/cmake/llvm;;
+--cppflags) echo  -I"$SCRATCH"/haiku-/cross/sysroot/boot/system/develop/headers \
                   -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS;;
---cflags) echo  -I$SCRATCH/haiku-cross/sysroot/boot/system/develop/headers \
+--cflags) echo  -I"$SCRATCH"/haiku-cross/sysroot/boot/system/develop/headers \
                 -fPIC -Wall -W -Wno-unused-parameter -Wwrite-strings \
                 -Wno-missing-field-initializers -pedantic -Wno-long-long -Wno-comment \
                 -Werror=date-time -ffunction-sections -fdata-sections -O3 -DNDEBUG \
                 -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS;;
---cxxflags) echo  -I/$SCRATCH/haiku-cross/sysroot/boot/system/develop/headers \
+--cxxflags) echo  -I/"$SCRATCH"/haiku-cross/sysroot/boot/system/develop/headers \
                   -fPIC -fvisibility-inlines-hidden -Wall -W -Wno-unused-parameter \
                   -Wwrite-strings -Wcast-qual -Wno-missing-field-initializers -pedantic \
                   -Wno-long-long -Wno-maybe-uninitialized -Wdelete-non-virtual-dtor \
                   -Wno-comment -Werror=date-time -std=c++11 -ffunction-sections \
                   -fdata-sections -O3 -DNDEBUG  -fno-exceptions \
                   -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS;;
---ldflags) echo  -L$SCRATCH/haiku-cross/sysroot/boot/system/develop/lib ;;
+--ldflags) echo  -L"$SCRATCH"/haiku-cross/sysroot/boot/system/develop/lib ;;
 --system-libs) echo ;;
 --libs) echo  -lLLVM-4.0;;
---libfiles) echo  $SCRATCH/haiku-cross/sysroot/boot/system/develop/lib/libLLVM-4.0.so;;
+--libfiles) echo  "$SCRATCH"/haiku-cross/sysroot/boot/system/develop/lib/libLLVM-4.0.so;;
 --components) echo  aarch64 aarch64asmparser aarch64asmprinter aarch64codegen \
                     aarch64desc aarch64disassembler aarch64info aarch64utils all \
                     all-targets amdgpu amdgpuasmparser amdgpuasmprinter amdgpucodegen \
diff --git a/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh
index 390ba1a1ddf9c..f15a7081612d8 100755
--- a/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-aarch64-linux/build-toolchains.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh
index 2e790b77a96c2..3fd882521999a 100755
--- a/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-arm-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh
index a01c2e0eb0a7c..f425efd6057c6 100755
--- a/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-armhf-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh
index 28f8ba2437b3d..17dda2dbd1680 100755
--- a/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-armv7-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh b/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh
index d2e39834d6e96..264d0764f2957 100755
--- a/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-powerpc-linux/build-powerpc-toolchain.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh b/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh
index b873569278914..e84d219c24155 100644
--- a/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-powerpc64-linux/shared.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 hide_output() {
   set +x
   on_err="
@@ -8,7 +9,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh b/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh
index b873569278914..e84d219c24155 100644
--- a/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-powerpc64le-linux/shared.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 hide_output() {
   set +x
   on_err="
@@ -8,7 +9,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh b/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh
index 6a7c022d01a5d..a7025b2b7545e 100755
--- a/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh
+++ b/src/ci/docker/host-x86_64/dist-riscv64-linux/build-toolchains.sh
@@ -12,7 +12,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-riscv64-linux/crosstool-ng.sh b/src/ci/docker/host-x86_64/dist-riscv64-linux/crosstool-ng.sh
index fb067a79a5c85..dc9111e8406a5 100644
--- a/src/ci/docker/host-x86_64/dist-riscv64-linux/crosstool-ng.sh
+++ b/src/ci/docker/host-x86_64/dist-riscv64-linux/crosstool-ng.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 # Mirrored from https://github.com/crosstool-ng/crosstool-ng/archive/crosstool-ng-1.24.0.tar.gz
diff --git a/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh b/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh
index df9529da8a162..6f8d6be842b8e 100755
--- a/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-s390x-linux/build-s390x-toolchain.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
diff --git a/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh b/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh
index 9c7aaef4f436f..103dbbe6fdaba 100755
--- a/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh
+++ b/src/ci/docker/host-x86_64/dist-various-1/build-rumprun.sh
@@ -11,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm /tmp/build.log
diff --git a/src/ci/docker/host-x86_64/dist-various-1/install-mips-musl.sh b/src/ci/docker/host-x86_64/dist-various-1/install-mips-musl.sh
index 9584258d23403..0f216de8a0bae 100755
--- a/src/ci/docker/host-x86_64/dist-various-1/install-mips-musl.sh
+++ b/src/ci/docker/host-x86_64/dist-various-1/install-mips-musl.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 mkdir /usr/local/mips-linux-musl
@@ -10,5 +11,5 @@ FILE="OpenWrt-Toolchain-ar71xx-generic_gcc-5.3.0_musl-1.1.16.Linux-x86_64.tar.bz
 curl -L "$URL/$FILE" | tar xjf - -C /usr/local/mips-linux-musl --strip-components=2
 
 for file in /usr/local/mips-linux-musl/bin/mips-openwrt-linux-*; do
-  ln -s $file /usr/local/bin/`basename $file`
+  ln -s "$file" /usr/local/bin/"$(basename "$file")"
 done
diff --git a/src/ci/docker/host-x86_64/dist-various-1/install-mipsel-musl.sh b/src/ci/docker/host-x86_64/dist-various-1/install-mipsel-musl.sh
index 50a8e554b1675..9a8df063ec25d 100755
--- a/src/ci/docker/host-x86_64/dist-various-1/install-mipsel-musl.sh
+++ b/src/ci/docker/host-x86_64/dist-various-1/install-mipsel-musl.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 mkdir /usr/local/mipsel-linux-musl
@@ -10,5 +11,5 @@ FILE="OpenWrt-Toolchain-malta-le_gcc-5.3.0_musl-1.1.15.Linux-x86_64.tar.bz2"
 curl -L "$URL/$FILE" | tar xjf - -C /usr/local/mipsel-linux-musl --strip-components=2
 
 for file in /usr/local/mipsel-linux-musl/bin/mipsel-openwrt-linux-*; do
-  ln -s $file /usr/local/bin/`basename $file`
+  ln -s "$file" /usr/local/bin/"$(basename "$file")"
 done
diff --git a/src/ci/docker/host-x86_64/dist-various-2/build-cloudabi-toolchain.sh b/src/ci/docker/host-x86_64/dist-various-2/build-cloudabi-toolchain.sh
index b7ff6cd4e4feb..55a848a5f55a4 100755
--- a/src/ci/docker/host-x86_64/dist-various-2/build-cloudabi-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-various-2/build-cloudabi-toolchain.sh
@@ -25,12 +25,12 @@ apt-get install -y --no-install-recommends \
 # Based on the steps described at https://nuxi.nl/cloudabi/debian/
 target=$1
 for tool in ar nm objdump ranlib size; do
-  ln -s ../lib/llvm-5.0/bin/llvm-${tool} /usr/bin/${target}-${tool}
+  ln -s ../lib/llvm-5.0/bin/llvm-"${tool}" /usr/bin/"${target}-${tool}"
 done
-ln -s ../lib/llvm-5.0/bin/clang /usr/bin/${target}-cc
-ln -s ../lib/llvm-5.0/bin/clang /usr/bin/${target}-c++
-ln -s ../lib/llvm-5.0/bin/lld /usr/bin/${target}-ld
-ln -s ../../${target} /usr/lib/llvm-5.0/${target}
+ln -s ../lib/llvm-5.0/bin/clang /usr/bin/"${target}"-cc
+ln -s ../lib/llvm-5.0/bin/clang /usr/bin/"${target}"-c++
+ln -s ../lib/llvm-5.0/bin/lld /usr/bin/"${target}"-ld
+ln -s ../../"${target}" /usr/lib/llvm-5.0/"${target}"
 
 # Install the C++ runtime libraries from CloudABI Ports.
 apt-key adv --batch --yes --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 0DA51B8531344B15
diff --git a/src/ci/docker/host-x86_64/dist-various-2/build-fuchsia-toolchain.sh b/src/ci/docker/host-x86_64/dist-various-2/build-fuchsia-toolchain.sh
index 73acdf5be6356..f1ceab77cef3a 100755
--- a/src/ci/docker/host-x86_64/dist-various-2/build-fuchsia-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-various-2/build-fuchsia-toolchain.sh
@@ -27,11 +27,11 @@ build() {
     aarch64) tgt="zircon-qemu-arm64" ;;
   esac
 
-  hide_output make -j$(getconf _NPROCESSORS_ONLN) $tgt
-  dst=/usr/local/${arch}-fuchsia
-  mkdir -p $dst
-  cp -a build-${tgt}/sysroot/include $dst/
-  cp -a build-${tgt}/sysroot/lib $dst/
+  hide_output make "-j$(getconf _NPROCESSORS_ONLN)" $tgt
+  dst="/usr/local/${arch}-fuchsia"
+  mkdir -p "$dst"
+  cp -a "build-${tgt}/sysroot/include" "$dst/"
+  cp -a "build-${tgt}/sysroot/lib" "$dst/"
 }
 
 # Build sysroot
diff --git a/src/ci/docker/host-x86_64/dist-various-2/build-solaris-toolchain.sh b/src/ci/docker/host-x86_64/dist-various-2/build-solaris-toolchain.sh
index 4b3f284450eaa..d595b66526f11 100755
--- a/src/ci/docker/host-x86_64/dist-various-2/build-solaris-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-various-2/build-solaris-toolchain.sh
@@ -16,7 +16,7 @@ cd binutils
 curl https://ftp.gnu.org/gnu/binutils/binutils-$BINUTILS.tar.xz | tar xJf -
 mkdir binutils-build
 cd binutils-build
-hide_output ../binutils-$BINUTILS/configure --target=$ARCH-sun-solaris2.10
+hide_output ../binutils-$BINUTILS/configure --target="$ARCH"-sun-solaris2.10
 hide_output make -j10
 hide_output make install
 
@@ -27,21 +27,21 @@ rm -rf binutils
 mkdir solaris
 cd solaris
 
-dpkg --add-architecture $APT_ARCH
+dpkg --add-architecture "$APT_ARCH"
 apt-get update
-apt-get download $(apt-cache depends --recurse --no-replaces \
-  libc-dev:$APT_ARCH       \
-  libm-dev:$APT_ARCH       \
-  libpthread-dev:$APT_ARCH \
-  libresolv-dev:$APT_ARCH  \
-  librt-dev:$APT_ARCH      \
-  libsocket-dev:$APT_ARCH  \
-  system-crt:$APT_ARCH     \
-  system-header:$APT_ARCH  \
-  | grep "^\w")
-
-for deb in *$APT_ARCH.deb; do
-  dpkg -x $deb .
+apt-get download "$(apt-cache depends --recurse --no-replaces \
+  libc-dev:"$APT_ARCH"       \
+  libm-dev:"$APT_ARCH"       \
+  libpthread-dev:"$APT_ARCH" \
+  libresolv-dev:"$APT_ARCH"  \
+  librt-dev:"$APT_ARCH"      \
+  libsocket-dev:"$APT_ARCH"  \
+  system-crt:"$APT_ARCH"     \
+  system-header:"$APT_ARCH"  \
+  | grep "^\w")"
+
+for deb in *"$APT_ARCH".deb; do
+  dpkg -x "$deb" .
 done
 
 # Remove Solaris 11 functions that are optionally used by libbacktrace.
@@ -54,13 +54,13 @@ patch -p0  << 'EOF'
 -extern size_t strnlen(const char *, size_t);
 EOF
 
-mkdir                  /usr/local/$ARCH-sun-solaris2.10/usr
-mv usr/include         /usr/local/$ARCH-sun-solaris2.10/usr/include
-mv usr/lib/$LIB_ARCH/* /usr/local/$ARCH-sun-solaris2.10/lib
-mv     lib/$LIB_ARCH/* /usr/local/$ARCH-sun-solaris2.10/lib
+mkdir                  /usr/local/"$ARCH"-sun-solaris2.10/usr
+mv usr/include         /usr/local/"$ARCH"-sun-solaris2.10/usr/include
+mv usr/lib/"$LIB_ARCH"/* /usr/local/"$ARCH"-sun-solaris2.10/lib
+mv     lib/"$LIB_ARCH"/* /usr/local/"$ARCH"-sun-solaris2.10/lib
 
-ln -s usr/include /usr/local/$ARCH-sun-solaris2.10/sys-include
-ln -s usr/include /usr/local/$ARCH-sun-solaris2.10/include
+ln -s usr/include /usr/local/"$ARCH"-sun-solaris2.10/sys-include
+ln -s usr/include /usr/local/"$ARCH"-sun-solaris2.10/include
 
 cd ..
 rm -rf solaris
@@ -76,7 +76,7 @@ mkdir ../gcc-build
 cd ../gcc-build
 hide_output ../gcc-$GCC/configure \
   --enable-languages=c,c++        \
-  --target=$ARCH-sun-solaris2.10  \
+  --target="$ARCH"-sun-solaris2.10  \
   --with-gnu-as                   \
   --with-gnu-ld                   \
   --disable-multilib              \
diff --git a/src/ci/docker/host-x86_64/dist-various-2/build-wasi-toolchain.sh b/src/ci/docker/host-x86_64/dist-various-2/build-wasi-toolchain.sh
index c6db200f8660f..9ca5d2fb7964f 100755
--- a/src/ci/docker/host-x86_64/dist-various-2/build-wasi-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-various-2/build-wasi-toolchain.sh
@@ -7,13 +7,13 @@ set -ex
 # Originally from https://github.com/llvm/llvm-project/releases/download/llvmorg-10.0.0/clang+llvm-10.0.0-x86_64-linux-gnu-ubuntu-18.04.tar.xz
 curl https://ci-mirrors.rust-lang.org/rustc/clang%2Bllvm-10.0.0-x86_64-linux-gnu-ubuntu-18.04.tar.xz | \
   tar xJf -
-export PATH=`pwd`/clang+llvm-10.0.0-x86_64-linux-gnu-ubuntu-18.04/bin:$PATH
+export PATH="$(pwd)/clang+llvm-10.0.0-x86_64-linux-gnu-ubuntu-18.04/bin:$PATH"
 
 git clone https://github.com/WebAssembly/wasi-libc
 
 cd wasi-libc
 git reset --hard 215adc8ac9f91eb055311acc72683fd2eb1ae15a
-make -j$(nproc) INSTALL_DIR=/wasm32-wasi install
+make -j"$(nproc)" INSTALL_DIR=/wasm32-wasi install
 
 cd ..
 rm -rf wasi-libc
diff --git a/src/ci/docker/host-x86_64/dist-various-2/build-x86_64-fortanix-unknown-sgx-toolchain.sh b/src/ci/docker/host-x86_64/dist-various-2/build-x86_64-fortanix-unknown-sgx-toolchain.sh
index 1c0ef6c2b30b4..bde1e59a43a24 100755
--- a/src/ci/docker/host-x86_64/dist-various-2/build-x86_64-fortanix-unknown-sgx-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-various-2/build-x86_64-fortanix-unknown-sgx-toolchain.sh
@@ -3,8 +3,6 @@
 set -eu
 source shared.sh
 
-target="x86_64-fortanix-unknown-sgx"
-
 install_prereq() {
     curl https://apt.llvm.org/llvm-snapshot.gpg.key|apt-key add -
     add-apt-repository -y 'deb http://apt.llvm.org/bionic/ llvm-toolchain-bionic-11 main'
diff --git a/src/ci/docker/host-x86_64/dist-various-2/shared.sh b/src/ci/docker/host-x86_64/dist-various-2/shared.sh
index 7abace65b9c03..6525fd8038e18 100644
--- a/src/ci/docker/host-x86_64/dist-various-2/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-various-2/shared.sh
@@ -1,3 +1,5 @@
+#!/usr/bin/env bash
+
 hide_output() {
   { set +x; } 2>/dev/null
   on_err="
@@ -20,7 +22,9 @@ function retry {
   local n=1
   local max=5
   while true; do
-    "$@" && break || {
+    if "$@"; then
+      break
+    else
       if [[ $n -lt $max ]]; then
         sleep $n  # don't retry immediately
         ((n++))
@@ -29,7 +33,7 @@ function retry {
         echo "The command has failed after $n attempts."
         return 1
       fi
-    }
+    fi
   done
 }
 
@@ -39,8 +43,8 @@ function fetch_github_commit_archive {
     local cached="download-${module//\//-}.tar.gz"
     retry sh -c "rm -f $cached && \
         curl -f -sSL -o $cached $2"
-    mkdir $module
+    mkdir "$module"
     touch "$module/.git"
-    tar -C $module --strip-components=1 -xf $cached
-    rm $cached
+    tar -C "$module" --strip-components=1 -xf "$cached"
+    rm "$cached"
 }
diff --git a/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh b/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh
index b873569278914..e84d219c24155 100644
--- a/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh
+++ b/src/ci/docker/host-x86_64/dist-x86_64-linux/shared.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 hide_output() {
   set +x
   on_err="
@@ -8,7 +9,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   set -x
diff --git a/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh b/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh
index f8697c698b9fb..a62fac9db30c7 100755
--- a/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh
+++ b/src/ci/docker/host-x86_64/dist-x86_64-netbsd/build-netbsd-toolchain.sh
@@ -13,7 +13,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   rm /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
@@ -63,8 +63,8 @@ cat > /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-g++-sysroot <<'EOF'
 exec /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-g++ --sysroot=/x-tools/x86_64-unknown-netbsd/sysroot "$@"
 EOF
 
-GCC_SHA1=`sha1sum -b /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-gcc | cut -d' ' -f1`
-GPP_SHA1=`sha1sum -b /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-g++ | cut -d' ' -f1`
+GCC_SHA1="$(sha1sum -b /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-gcc | cut -d' ' -f1)"
+GPP_SHA1="$(sha1sum -b /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-g++ | cut -d' ' -f1)"
 
 echo "# $GCC_SHA1" >> /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-gcc-sysroot
 echo "# $GPP_SHA1" >> /x-tools/x86_64-unknown-netbsd/bin/x86_64--netbsd-g++-sysroot
diff --git a/src/ci/docker/run.sh b/src/ci/docker/run.sh
index c2ff62e74816d..e6feebea766b4 100755
--- a/src/ci/docker/run.sh
+++ b/src/ci/docker/run.sh
@@ -4,7 +4,7 @@ set -e
 
 export MSYS_NO_PATHCONV=1
 
-script=`cd $(dirname $0) && pwd`/`basename $0`
+script=$(cd "$(dirname "$0")" && pwd)/$(basename "$0")
 
 image=""
 dev=0
@@ -27,11 +27,11 @@ do
   shift
 done
 
-script_dir="`dirname $script`"
+script_dir="$(dirname "$script")"
 docker_dir="${script_dir}/host-$(uname -m)"
-ci_dir="`dirname $script_dir`"
-src_dir="`dirname $ci_dir`"
-root_dir="`dirname $src_dir`"
+ci_dir="$(dirname "$script_dir")"
+src_dir="$(dirname "$ci_dir")"
+root_dir="$(dirname "$src_dir")"
 
 objdir=$root_dir/obj
 dist=$objdir/build/dist
@@ -44,7 +44,7 @@ if [ -f "$docker_dir/$image/Dockerfile" ]; then
     if [ "$CI" != "" ]; then
       hash_key=/tmp/.docker-hash-key.txt
       rm -f "${hash_key}"
-      echo $image >> $hash_key
+      echo "$image" >> $hash_key
 
       cat "$docker_dir/$image/Dockerfile" >> $hash_key
       # Look for all source files involves in the COPY command
@@ -73,13 +73,14 @@ if [ -f "$docker_dir/$image/Dockerfile" ]; then
       retry curl -y 30 -Y 10 --connect-timeout 30 -f -L -C - -o /tmp/rustci_docker_cache "$url"
       loaded_images=$(docker load -i /tmp/rustci_docker_cache | sed 's/.* sha/sha/')
       set -e
-      echo "Downloaded containers:\n$loaded_images"
+      echo "Downloaded containers:"
+      echo "$loaded_images"
     fi
 
     dockerfile="$docker_dir/$image/Dockerfile"
     if [ -x /usr/bin/cygpath ]; then
-        context="`cygpath -w $script_dir`"
-        dockerfile="`cygpath -w $dockerfile`"
+        context="$(cygpath -w "$script_dir")"
+        dockerfile="$(cygpath -w "$dockerfile")"
     else
         context="$script_dir"
     fi
@@ -119,14 +120,14 @@ elif [ -f "$docker_dir/disabled/$image/Dockerfile" ]; then
         exit 1
     fi
     # Transform changes the context of disabled Dockerfiles to match the enabled ones
-    tar --transform 's#disabled/#./#' -C $script_dir -c . | docker \
+    tar --transform 's#disabled/#./#' -C "$script_dir" -c . | docker \
       build \
       --rm \
       -t rust-ci \
       -f "host-$(uname -m)/$image/Dockerfile" \
       -
 else
-    echo Invalid image: $image
+    echo "Invalid image: $image"
 
     # Check whether the image exists for other architectures
     for arch_dir in "${script_dir}"/host-*; do
@@ -152,20 +153,20 @@ else
     exit 1
 fi
 
-mkdir -p $HOME/.cargo
-mkdir -p $objdir/tmp
-mkdir -p $objdir/cores
+mkdir -p "$HOME/.cargo"
+mkdir -p "$objdir/tmp"
+mkdir -p "$objdir/cores"
 mkdir -p /tmp/toolstate
 
-args=
+args=()
 if [ "$SCCACHE_BUCKET" != "" ]; then
-    args="$args --env SCCACHE_BUCKET"
-    args="$args --env SCCACHE_REGION"
-    args="$args --env AWS_ACCESS_KEY_ID"
-    args="$args --env AWS_SECRET_ACCESS_KEY"
+    args+=(--env SCCACHE_BUCKET)
+    args+=(--env SCCACHE_REGION)
+    args+=(--env AWS_ACCESS_KEY_ID)
+    args+=(--env AWS_SECRET_ACCESS_KEY)
 else
-    mkdir -p $HOME/.cache/sccache
-    args="$args --env SCCACHE_DIR=/sccache --volume $HOME/.cache/sccache:/sccache"
+    mkdir -p "$HOME/.cache/sccache"
+    args+=(--env SCCACHE_DIR=/sccache --volume "$HOME/.cache/sccache:/sccache")
 fi
 
 # Run containers as privileged as it should give them access to some more
@@ -173,7 +174,7 @@ fi
 # discovered that the leak sanitizer apparently needs these syscalls nowadays so
 # we'll need `--privileged` for at least the `x86_64-gnu` builder, so this just
 # goes ahead and sets it for all builders.
-args="$args --privileged"
+args+=(--privileged)
 
 # Things get a little weird if this script is already running in a docker
 # container. If we're already in a docker container then we assume it's set up
@@ -200,20 +201,20 @@ args="$args --privileged"
 if [ -f /.dockerenv ]; then
   docker create -v /checkout --name checkout alpine:3.4 /bin/true
   docker cp . checkout:/checkout
-  args="$args --volumes-from checkout"
+  args+=(--volumes-from checkout)
 else
-  args="$args --volume $root_dir:/checkout:ro"
-  args="$args --volume $objdir:/checkout/obj"
-  args="$args --volume $HOME/.cargo:/cargo"
-  args="$args --volume $HOME/rustsrc:$HOME/rustsrc"
-  args="$args --volume /tmp/toolstate:/tmp/toolstate"
-  args="$args --env LOCAL_USER_ID=`id -u`"
+  args+=(--volume "$root_dir":/checkout:ro)
+  args+=(--volume "$objdir":/checkout/obj)
+  args+=(--volume "$HOME"/.cargo:/cargo)
+  args+=(--volume "$HOME"/rustsrc:"$HOME"/rustsrc)
+  args+=(--volume /tmp/toolstate:/tmp/toolstate)
+  args+=(--env "LOCAL_USER_ID=$(id -u)")
 fi
 
 if [ "$dev" = "1" ]
 then
   # Interactive + TTY
-  args="$args -it"
+  args+=(-it)
   command="/bin/bash"
 else
   command="/checkout/src/ci/run.sh"
@@ -223,7 +224,7 @@ docker \
   run \
   --workdir /checkout/obj \
   --env SRC=/checkout \
-  $args \
+  "${args[@]}" \
   --env CARGO_HOME=/cargo \
   --env DEPLOY \
   --env DEPLOY_ALT \
@@ -242,6 +243,6 @@ docker \
   $command
 
 if [ -f /.dockerenv ]; then
-  rm -rf $objdir
-  docker cp checkout:/checkout/obj $objdir
+  rm -rf "$objdir"
+  docker cp checkout:/checkout/obj "$objdir"
 fi
diff --git a/src/ci/docker/scripts/android-base-apt-get.sh b/src/ci/docker/scripts/android-base-apt-get.sh
index 1795b1696d323..46a47f52a3005 100644
--- a/src/ci/docker/scripts/android-base-apt-get.sh
+++ b/src/ci/docker/scripts/android-base-apt-get.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 apt-get update
diff --git a/src/ci/docker/scripts/android-ndk.sh b/src/ci/docker/scripts/android-ndk.sh
index dafcb3cb7a719..3f109ab86bd44 100644
--- a/src/ci/docker/scripts/android-ndk.sh
+++ b/src/ci/docker/scripts/android-ndk.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 URL=https://dl.google.com/android/repository
@@ -5,18 +6,18 @@ URL=https://dl.google.com/android/repository
 download_ndk() {
     mkdir -p /android/ndk
     cd /android/ndk
-    curl -fO $URL/$1
-    unzip -q $1
-    rm $1
+    curl -fO "$URL/$1"
+    unzip -q "$1"
+    rm "$1"
     mv android-ndk-* ndk
 }
 
 make_standalone_toolchain() {
     # See https://developer.android.com/ndk/guides/standalone_toolchain.htm
     python3 /android/ndk/ndk/build/tools/make_standalone_toolchain.py \
-        --install-dir /android/ndk/$1-$2 \
-        --arch $1 \
-        --api $2
+        --install-dir "/android/ndk/$1-$2" \
+        --arch "$1" \
+        --api "$2"
 }
 
 remove_ndk() {
@@ -24,7 +25,7 @@ remove_ndk() {
 }
 
 download_and_make_toolchain() {
-    download_ndk $1 && \
-    make_standalone_toolchain $2 $3 && \
+    download_ndk "$1" && \
+    make_standalone_toolchain "$2" "$3" && \
     remove_ndk
 }
diff --git a/src/ci/docker/scripts/android-sdk.sh b/src/ci/docker/scripts/android-sdk.sh
index e35be697a8df0..424835606d692 100755
--- a/src/ci/docker/scripts/android-sdk.sh
+++ b/src/ci/docker/scripts/android-sdk.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 export ANDROID_HOME=/android/sdk
@@ -15,8 +16,7 @@ LOCKFILE="${ANDROID_HOME}/android-sdk.lock"
 #
 /scripts/android-sdk-manager.py install "${LOCKFILE}" "${ANDROID_HOME}"
 
-details=$(cat "${LOCKFILE}" \
-    | grep system-images \
+details=$(grep system-images "${LOCKFILE}"\
     | sed 's/^system-images;android-\([0-9]\+\);default;\([a-z0-9-]\+\) /\1 \2 /g')
 api="$(echo "${details}" | awk '{print($1)}')"
 abi="$(echo "${details}" | awk '{print($2)}')"
diff --git a/src/ci/docker/scripts/android-start-emulator.sh b/src/ci/docker/scripts/android-start-emulator.sh
index 09f0d13759c79..83616e0a3a52b 100755
--- a/src/ci/docker/scripts/android-start-emulator.sh
+++ b/src/ci/docker/scripts/android-start-emulator.sh
@@ -11,6 +11,6 @@ export SHELL=/bin/bash
 # classic engine the emulator starts with the current date and the tests run
 # fine. If another image is used, this need to be evaluated again.
 nohup nohup emulator @armeabi-v7a-18 \
-    -engine classic -no-window -partition-size 2047 0<&- &>/dev/null &
+    -engine classic -no-window -partition-size 2047 0<&- > /dev/null 2>&1 &
 
 exec "$@"
diff --git a/src/ci/docker/scripts/cross-apt-packages.sh b/src/ci/docker/scripts/cross-apt-packages.sh
index 2de376443ad56..fde3b3a0a7ead 100644
--- a/src/ci/docker/scripts/cross-apt-packages.sh
+++ b/src/ci/docker/scripts/cross-apt-packages.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 apt-get update && apt-get install -y --no-install-recommends \
   automake \
   bison \
diff --git a/src/ci/docker/scripts/crosstool-ng-1.24.sh b/src/ci/docker/scripts/crosstool-ng-1.24.sh
index fb067a79a5c85..3eb2b7fb85f36 100644
--- a/src/ci/docker/scripts/crosstool-ng-1.24.sh
+++ b/src/ci/docker/scripts/crosstool-ng-1.24.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 # Mirrored from https://github.com/crosstool-ng/crosstool-ng/archive/crosstool-ng-1.24.0.tar.gz
@@ -6,7 +7,7 @@ curl -Lf $url | tar xzf -
 cd crosstool-ng-crosstool-ng-1.24.0
 ./bootstrap
 ./configure --prefix=/usr/local
-make -j$(nproc)
+make -j"$(nproc)"
 make install
 cd ..
 rm -rf crosstool-ng-crosstool-ng-1.24.0
diff --git a/src/ci/docker/scripts/crosstool-ng.sh b/src/ci/docker/scripts/crosstool-ng.sh
index 2773e687ebe6f..7ce2b265e18af 100644
--- a/src/ci/docker/scripts/crosstool-ng.sh
+++ b/src/ci/docker/scripts/crosstool-ng.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 url="https://github.com/crosstool-ng/crosstool-ng/archive/crosstool-ng-1.22.0.tar.gz"
@@ -5,7 +6,7 @@ curl -Lf $url | tar xzf -
 cd crosstool-ng-crosstool-ng-1.22.0
 ./bootstrap
 ./configure --prefix=/usr/local
-make -j$(nproc)
+make -j"$(nproc)"
 make install
 cd ..
 rm -rf crosstool-ng-crosstool-ng-1.22.0
diff --git a/src/ci/docker/scripts/emscripten.sh b/src/ci/docker/scripts/emscripten.sh
index 9481ee95399db..653b59a2f27de 100644
--- a/src/ci/docker/scripts/emscripten.sh
+++ b/src/ci/docker/scripts/emscripten.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 hide_output() {
@@ -10,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm -f /tmp/build.log
diff --git a/src/ci/docker/scripts/freebsd-toolchain.sh b/src/ci/docker/scripts/freebsd-toolchain.sh
index b10263d5a268e..c7ff78ca90c9d 100755
--- a/src/ci/docker/scripts/freebsd-toolchain.sh
+++ b/src/ci/docker/scripts/freebsd-toolchain.sh
@@ -19,7 +19,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   local ping_loop_pid=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $ping_loop_pid
   set -x
diff --git a/src/ci/docker/scripts/make3.sh b/src/ci/docker/scripts/make3.sh
index 47cb4158229d3..95f16d5c452e5 100644
--- a/src/ci/docker/scripts/make3.sh
+++ b/src/ci/docker/scripts/make3.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 curl -f https://ftp.gnu.org/gnu/make/make-3.81.tar.gz | tar xzf -
diff --git a/src/ci/docker/scripts/musl-toolchain.sh b/src/ci/docker/scripts/musl-toolchain.sh
index 1ae412340cb11..9a7add1c3283f 100644
--- a/src/ci/docker/scripts/musl-toolchain.sh
+++ b/src/ci/docker/scripts/musl-toolchain.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 # This script runs `musl-cross-make` to prepare C toolchain (Binutils, GCC, musl itself)
 # and builds static libunwind that we distribute for static target.
 #
@@ -16,7 +17,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm /tmp/build.log
@@ -38,21 +39,21 @@ cd musl-cross-make
 # A few commits ahead of v0.9.9 to include the cowpatch fix:
 git checkout a54eb56f33f255dfca60be045f12a5cfaf5a72a9
 
-hide_output make -j$(nproc) TARGET=$TARGET MUSL_VER=1.1.24
-hide_output make install TARGET=$TARGET MUSL_VER=1.1.24 OUTPUT=$OUTPUT
+hide_output make -j"$(nproc)" TARGET="$TARGET" MUSL_VER=1.1.24
+hide_output make install TARGET="$TARGET" MUSL_VER=1.1.24 OUTPUT="$OUTPUT"
 
 cd -
 
 # Install musl library to make binaries executable
-ln -s $OUTPUT/$TARGET/lib/libc.so /lib/ld-musl-$ARCH.so.1
-echo $OUTPUT/$TARGET/lib >> /etc/ld-musl-$ARCH.path
+ln -s "$OUTPUT/$TARGET/lib/libc.so" "/lib/ld-musl-$ARCH.so.1"
+echo "$OUTPUT/$TARGET/lib" >> "/etc/ld-musl-$ARCH.path"
 
 # Now when musl bootstraps itself create proper toolchain symlinks to make build and tests easier
 if [ "$REPLACE_CC" = "1" ]; then
     for exec in cc gcc; do
-        ln -s $TARGET-gcc /usr/local/bin/$exec
+        ln -s "$TARGET-gcc" "/usr/local/bin/$exec"
     done
     for exec in cpp c++ g++; do
-        ln -s $TARGET-g++ /usr/local/bin/$exec
+        ln -s "$TARGET-g++" "/usr/local/bin/$exec"
     done
 fi
diff --git a/src/ci/docker/scripts/musl.sh b/src/ci/docker/scripts/musl.sh
index 58393a5719a10..c6b1023ae7141 100644
--- a/src/ci/docker/scripts/musl.sh
+++ b/src/ci/docker/scripts/musl.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 hide_output() {
@@ -10,7 +11,7 @@ exit 1
   trap "$on_err" ERR
   bash -c "while true; do sleep 30; echo \$(date) - building ...; done" &
   PING_LOOP_PID=$!
-  $@ &> /tmp/build.log
+  "$@" &> /tmp/build.log
   trap - ERR
   kill $PING_LOOP_PID
   rm /tmp/build.log
@@ -32,11 +33,11 @@ if [ ! -d $MUSL ]; then
 fi
 
 cd $MUSL
-./configure --enable-optimize --enable-debug --disable-shared --prefix=/musl-$TAG $@
-if [ "$TAG" = "i586" -o "$TAG" = "i686" ]; then
-  hide_output make -j$(nproc) AR=ar RANLIB=ranlib
+./configure --enable-optimize --enable-debug --disable-shared --prefix=/musl-"$TAG" "$@"
+if [ "$TAG" = i586 ] || [ "$TAG" = i686 ]; then
+  hide_output make -j"$(nproc)" AR=ar RANLIB=ranlib
 else
-  hide_output make -j$(nproc)
+  hide_output make -j"$(nproc)"
 fi
 hide_output make install
 hide_output make clean
diff --git a/src/ci/docker/scripts/rustbuild-setup.sh b/src/ci/docker/scripts/rustbuild-setup.sh
index 94d7e600eacd2..7fc6579de75b8 100644
--- a/src/ci/docker/scripts/rustbuild-setup.sh
+++ b/src/ci/docker/scripts/rustbuild-setup.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 groupadd -r rustbuild && useradd -m -r -g rustbuild rustbuild
diff --git a/src/ci/docker/scripts/sccache.sh b/src/ci/docker/scripts/sccache.sh
index cebba57344bfd..95dbcdaae9f46 100644
--- a/src/ci/docker/scripts/sccache.sh
+++ b/src/ci/docker/scripts/sccache.sh
@@ -1,3 +1,4 @@
+#!/usr/bin/env bash
 set -ex
 
 case "$(uname -m)" in
diff --git a/src/ci/init_repo.sh b/src/ci/init_repo.sh
index 92c6e546a3895..b238ee8cd691c 100755
--- a/src/ci/init_repo.sh
+++ b/src/ci/init_repo.sh
@@ -8,19 +8,17 @@ set -o errexit
 set -o pipefail
 set -o nounset
 
-ci_dir=$(cd $(dirname $0) && pwd)
+ci_dir=$(cd "$(dirname "$0")" && pwd)
 . "$ci_dir/shared.sh"
 
 REPO_DIR="$1"
 CACHE_DIR="$2"
 
-cache_src_dir="$CACHE_DIR/src"
-
-if [ ! -d "$REPO_DIR" -o ! -d "$REPO_DIR/.git" ]; then
+if ! { [ -d "$REPO_DIR" ] && [ -d "$REPO_DIR/.git" ]; }; then
     echo "Error: $REPO_DIR does not exist or is not a git repo"
     exit 1
 fi
-cd $REPO_DIR
+cd "$REPO_DIR"
 if [ ! -d "$CACHE_DIR" ]; then
     echo "Error: $CACHE_DIR does not exist or is not an absolute path"
     exit 1
@@ -41,10 +39,10 @@ function fetch_github_commit_archive {
     local cached="download-${module//\//-}.tar.gz"
     retry sh -c "rm -f $cached && \
         curl -f -sSL -o $cached $2"
-    mkdir $module
+    mkdir "$module"
     touch "$module/.git"
-    tar -C $module --strip-components=1 -xf $cached
-    rm $cached
+    tar -C "$module" --strip-components=1 -xf "$cached"
+    rm "$cached"
 }
 
 included="src/llvm-project src/doc/book src/doc/rust-by-example"
@@ -53,14 +51,15 @@ modules=($modules)
 use_git=""
 urls="$(git config --file .gitmodules --get-regexp '\.url$' | cut -d' ' -f2)"
 urls=($urls)
-for i in ${!modules[@]}; do
-    module=${modules[$i]}
+
+for i in "${!modules[@]}"; do
+    module="${modules[$i]}"
     if [[ " $included " = *" $module "* ]]; then
-        commit="$(git ls-tree HEAD $module | awk '{print $3}')"
-        git rm $module
+        commit="$(git ls-tree HEAD "$module" | awk '{print $3}')"
+        git rm "$module"
         url=${urls[$i]}
         url=${url/\.git/}
-        fetch_github_commit_archive $module "$url/archive/$commit.tar.gz" &
+        fetch_github_commit_archive "$module" "$url/archive/$commit.tar.gz" &
         continue
     else
         use_git="$use_git $module"
diff --git a/src/ci/publish_toolstate.sh b/src/ci/publish_toolstate.sh
index 691df04e754a6..8c5ccfacef617 100755
--- a/src/ci/publish_toolstate.sh
+++ b/src/ci/publish_toolstate.sh
@@ -8,20 +8,20 @@ source "$(cd "$(dirname "$0")" && pwd)/shared.sh"
 # The following lines are also found in src/bootstrap/toolstate.rs,
 # so if updating here, please also update that file.
 
-export MESSAGE_FILE=$(mktemp -t msg.XXXXXX)
+MESSAGE_FILE=$(mktemp -t msg.XXXXXX)
+export MESSAGE_FILE
 
 git config --global user.email '7378925+rust-toolstate-update@users.noreply.github.com'
 git config --global user.name 'Rust Toolstate Update'
 git config --global credential.helper store
 printf 'https://%s:x-oauth-basic@github.com\n' "$TOOLSTATE_REPO_ACCESS_TOKEN" \
     > "$HOME/.git-credentials"
-git clone --depth=1 $TOOLSTATE_REPO
+git clone --depth=1 "$TOOLSTATE_REPO"
 
 GIT_COMMIT="$(git rev-parse HEAD)"
 GIT_COMMIT_MSG="$(git log --format=%s -n1 HEAD)"
 
 cd rust-toolstate
-FAILURE=1
 for RETRY_COUNT in 1 2 3 4 5; do
     # The purpose of this is to publish the new "current" toolstate in the toolstate repo.
     # This happens post-landing, on master.
@@ -31,11 +31,13 @@ for RETRY_COUNT in 1 2 3 4 5; do
         "$MESSAGE_FILE" \
         "$TOOLSTATE_REPO_ACCESS_TOKEN"
     # `git commit` failing means nothing to commit.
-    FAILURE=0
     git commit -a -F "$MESSAGE_FILE" || break
     # On failure randomly sleep for 0 to 3 seconds as a crude way to introduce jittering.
-    git push origin master && break || sleep $(LC_ALL=C tr -cd 0-3 < /dev/urandom | head -c 1)
-    FAILURE=1
+    if git push origin master; then
+        break
+    else
+        sleep "$(LC_ALL=C tr -cd 0-3 < /dev/urandom | head -c 1)"
+    fi
     git fetch origin master
     git reset --hard origin/master
 done
diff --git a/src/ci/run.sh b/src/ci/run.sh
index 5231aa2e76619..1cb1d32db46d5 100755
--- a/src/ci/run.sh
+++ b/src/ci/run.sh
@@ -8,7 +8,7 @@ fi
 
 if [ "$NO_CHANGE_USER" = "" ]; then
   if [ "$LOCAL_USER_ID" != "" ]; then
-    useradd --shell /bin/bash -u $LOCAL_USER_ID -o -c "" -m user
+    useradd --shell /bin/bash -u "$LOCAL_USER_ID" -o -c "" -m user
     export HOME=/home/user
     unset LOCAL_USER_ID
     exec su --preserve-environment -c "env PATH=$PATH \"$0\"" user
@@ -32,7 +32,7 @@ if [ "$SET_HARD_RLIMIT_STACK" = "1" ]; then
   fi
 fi
 
-ci_dir=`cd $(dirname $0) && pwd`
+ci_dir=$(cd "$(dirname "$0")" && pwd)
 source "$ci_dir/shared.sh"
 
 if command -v python > /dev/null; then
@@ -126,13 +126,13 @@ trap datecheck EXIT
 SCCACHE_IDLE_TIMEOUT=10800 sccache --start-server || true
 
 if [ "$RUN_CHECK_WITH_PARALLEL_QUERIES" != "" ]; then
-  $SRC/configure --enable-parallel-compiler
+  "$SRC"/configure --enable-parallel-compiler
   CARGO_INCREMENTAL=0 $PYTHON ../x.py check
   rm -f config.toml
   rm -rf build
 fi
 
-$SRC/configure $RUST_CONFIGURE_ARGS
+"$SRC"/configure $RUST_CONFIGURE_ARGS
 
 retry make prepare
 
@@ -147,15 +147,15 @@ if isMacOS; then
 else
     cat /proc/cpuinfo || true
     cat /proc/meminfo || true
-    ncpus=$(grep processor /proc/cpuinfo | wc -l)
+    ncpus=$(grep -c processor /proc/cpuinfo)
 fi
 
-if [ ! -z "$SCRIPT" ]; then
+if [ -n "$SCRIPT" ]; then
   sh -x -c "$SCRIPT"
 else
   do_make() {
     echo "make -j $ncpus $1"
-    make -j $ncpus $1
+    make -j "$ncpus" "$1"
     local retval=$?
     return $retval
   }
diff --git a/src/ci/shared.sh b/src/ci/shared.sh
index 8222758ed6dc4..10bba614c065a 100644
--- a/src/ci/shared.sh
+++ b/src/ci/shared.sh
@@ -13,16 +13,18 @@ function retry {
   local n=1
   local max=5
   while true; do
-    "$@" && break || {
-      if [[ $n -lt $max ]]; then
-        sleep $n  # don't retry immediately
-        ((n++))
-        echo "Command failed. Attempt $n/$max:"
+      if "$@"; then
+          break
       else
-        echo "The command has failed after $n attempts."
-        return 1
+          if [[ $n -lt $max ]]; then
+              sleep $n  # don't retry immediately
+              ((n++))
+              echo "Command failed. Attempt $n/$max:"
+          else
+              echo "The command has failed after $n attempts."
+              return 1
+          fi
       fi
-    }
   done
 }
 
diff --git a/src/etc/cat-and-grep.sh b/src/etc/cat-and-grep.sh
index 77dc52a935070..ce2f1e460e38f 100755
--- a/src/etc/cat-and-grep.sh
+++ b/src/etc/cat-and-grep.sh
@@ -33,7 +33,6 @@ while getopts ':vieh' OPTION; do
     case "$OPTION" in
         v)
             INVERT=1
-            ERROR_MSG='should not be found'
             ;;
         i)
             GREPFLAGS="i$GREPFLAGS"
diff --git a/src/etc/cpu-usage-over-time-plot.sh b/src/etc/cpu-usage-over-time-plot.sh
index 0905789079a3e..4e73bbfc9901f 100755
--- a/src/etc/cpu-usage-over-time-plot.sh
+++ b/src/etc/cpu-usage-over-time-plot.sh
@@ -20,7 +20,7 @@ bucket=rust-lang-ci2
 commit=$1
 builder=$2
 
-curl -O https://$bucket.s3.amazonaws.com/rustc-builds/$commit/cpu-$builder.csv
+curl -O https://"$bucket".s3.amazonaws.com/rustc-builds/"$commit"/cpu-"$builder".csv
 
 gnuplot <<-EOF
 reset
diff --git a/src/test/run-make/git_clone_sha1.sh b/src/test/run-make/git_clone_sha1.sh
index 626e4e4276121..3b837b0b8d735 100644
--- a/src/test/run-make/git_clone_sha1.sh
+++ b/src/test/run-make/git_clone_sha1.sh
@@ -1,4 +1,4 @@
-#!/bin/bash -x
+#!/usr/bin/env bash -x
 
 # Usage: $0 project_name url sha1
 # Get the crate with the specified sha1.
@@ -14,10 +14,10 @@ URL=$2
 SHA1=$3
 
 function err_exit() {
-    echo "ERROR:" $*
+    echo "ERROR:" "$@"
     exit 1
 }
 
-git clone $URL $PROJECT_NAME || err_exit
-cd $PROJECT_NAME || err_exit
-git reset --hard $SHA1 || err_exit
+git clone "$URL" "$PROJECT_NAME" || err_exit "$@"
+cd "$PROJECT_NAME" || err_exit "$@"
+git reset --hard "$SHA1" || err_exit "$@"
diff --git a/src/test/run-make/thumb-none-qemu/script.sh b/src/test/run-make/thumb-none-qemu/script.sh
index 045d02a8ed25d..10dbf00869519 100644
--- a/src/test/run-make/thumb-none-qemu/script.sh
+++ b/src/test/run-make/thumb-none-qemu/script.sh
@@ -1,19 +1,20 @@
+#!/usr/bin/env bash
 set -exuo pipefail
 
 CRATE=example
 
 env | sort
-mkdir -p $WORK_DIR
-pushd $WORK_DIR
-    rm -rf $CRATE || echo OK
-    cp -a $HERE/example .
-    pushd $CRATE
+mkdir -p "$WORK_DIR"
+pushd "$WORK_DIR"
+    rm -rf "$CRATE"
+    cp -a "$HERE"/"$CRATE" .
+    pushd "$CRATE"
         # HACK(eddyb) sets `RUSTC_BOOTSTRAP=1` so Cargo can accept nightly features.
         # These come from the top-level Rust workspace, that this crate is not a
         # member of, but Cargo tries to load the workspace `Cargo.toml` anyway.
         env RUSTC_BOOTSTRAP=1 RUSTFLAGS="-C linker=arm-none-eabi-ld -C link-arg=-Tlink.x" \
-            $BOOTSTRAP_CARGO run --target $TARGET           | grep "x = 42"
+            "$BOOTSTRAP_CARGO" run --target "$TARGET"           | grep "x = 42"
         env RUSTC_BOOTSTRAP=1 RUSTFLAGS="-C linker=arm-none-eabi-ld -C link-arg=-Tlink.x" \
-            $BOOTSTRAP_CARGO run --target $TARGET --release | grep "x = 42"
+            "$BOOTSTRAP_CARGO" run --target "$TARGET" --release | grep "x = 42"
     popd
 popd
diff --git a/src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/script.sh b/src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/script.sh
index ec93c98016078..bcbdd71de8134 100644
--- a/src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/script.sh
+++ b/src/test/run-make/x86_64-fortanix-unknown-sgx-lvi/script.sh
@@ -1,19 +1,20 @@
+#!/usr/bin/env bash
 set -exuo pipefail
 
 function build {
     CRATE=enclave
 
-    mkdir -p $WORK_DIR
-    pushd $WORK_DIR
-        rm -rf $CRATE
-        cp -a $TEST_DIR/enclave .
-        pushd $CRATE
-            echo ${WORK_DIR}
+    mkdir -p "$WORK_DIR"
+    pushd "$WORK_DIR"
+        rm -rf "$CRATE"
+        cp -a "$TEST_DIR"/"$CRATE" .
+        pushd "$CRATE"
+            echo "${WORK_DIR}"
             # HACK(eddyb) sets `RUSTC_BOOTSTRAP=1` so Cargo can accept nightly features.
             # These come from the top-level Rust workspace, that this crate is not a
             # member of, but Cargo tries to load the workspace `Cargo.toml` anyway.
             env RUSTC_BOOTSTRAP=1
-                cargo -v run --target $TARGET
+                cargo -v run --target "$TARGET"
         popd
     popd
 }
@@ -21,13 +22,14 @@ function build {
 function check {
     local func=$1
     local checks="${TEST_DIR}/$2"
-    local asm=$(mktemp)
+    local asm
+    asm="$(mktemp)"
     local objdump="${BUILD_DIR}/x86_64-unknown-linux-gnu/llvm/build/bin/llvm-objdump"
     local filecheck="${BUILD_DIR}/x86_64-unknown-linux-gnu/llvm/build/bin/FileCheck"
 
-    ${objdump} --disassemble-symbols=${func} --demangle \
-      ${WORK_DIR}/enclave/target/x86_64-fortanix-unknown-sgx/debug/enclave > ${asm}
-    ${filecheck} --input-file ${asm} ${checks}
+    "${objdump}" --disassemble-symbols="${func}" --demangle \
+      "${WORK_DIR}"/enclave/target/x86_64-fortanix-unknown-sgx/debug/enclave > "${asm}"
+    "${filecheck}" --input-file "${asm}" "${checks}"
 }
 
 build