From 6f5ac7c4aefeb2fa8510184579dab04ae2ce69ba Mon Sep 17 00:00:00 2001
From: Ralph Sennhauser <ralph.sennhauser@gmail.com>
Date: Tue, 27 Aug 2024 16:14:51 +0200
Subject: [PATCH] Fix issues pointed out by shellcheck

Some are real bugs, some are bashisms, but most is zealous quoting of
variables.

Signed-off-by: Ralph Sennhauser <ralph.sennhauser@gmail.com>
---
 build/android/setup-libs.sh                   |  48 ++++----
 build/coverage/gen.sh                         |   8 +-
 build/workspaces/clean-workspaces.sh          |   2 +-
 build/workspaces/update-workspaces.sh         |  13 ++-
 libraries/build-macos-libs.sh                 | 106 +++++++++---------
 libraries/build-source-libs.sh                |  37 +++---
 libraries/clean-source-libs.sh                |   2 +-
 source/tools/dist/build-archives.sh           |   4 +-
 source/tools/dist/build-osx-executable.sh     |  49 ++++----
 source/tools/dist/build-unix-win32.sh         |  30 ++---
 source/tools/i18n/get-nightly-translations.sh |   2 +-
 source/tools/spirv/get-nightly-shaders.sh     |   2 +-
 .../tools/templatessorter/templatessorter.sh  |   6 +-
 .../tools/tracelogger/tracelogger_options.sh  |   3 +-
 14 files changed, 165 insertions(+), 147 deletions(-)

diff --git a/build/android/setup-libs.sh b/build/android/setup-libs.sh
index da9c438db7..08eb7870da 100755
--- a/build/android/setup-libs.sh
+++ b/build/android/setup-libs.sh
@@ -63,20 +63,20 @@ popd
 
 if [ "$build_toolchain" = "true" ]; then
 
-	rm -r $TOOLCHAIN || true
-	$NDK/build/tools/make-standalone-toolchain.sh --platform=android-14 --toolchain=arm-linux-androideabi-4.6 --install-dir=$TOOLCHAIN --system=linux-x86_64
+	rm -r "$TOOLCHAIN" || true
+	"$NDK"/build/tools/make-standalone-toolchain.sh --platform=android-14 --toolchain=arm-linux-androideabi-4.6 --install-dir="$TOOLCHAIN" --system=linux-x86_64
 
-	mkdir -p $SYSROOT/usr/local
+	mkdir -p "$SYSROOT"/usr/local
 
 	# Set up some symlinks to make the SpiderMonkey build system happy
-	ln -sfT ../platforms $NDK/build/platforms
-	for f in $TOOLCHAIN/bin/arm-linux-androideabi-*; do
-		ln -sf $f ${f/arm-linux-androideabi-/arm-eabi-}
+	ln -sfT ../platforms "$NDK"/build/platforms
+	for f in "$TOOLCHAIN"/bin/arm-linux-androideabi-*; do
+		ln -sf "$f" "${f/arm-linux-androideabi-/arm-eabi-}"
 	done
 
 	# Set up some symlinks for the typical autoconf-based build systems
-	for f in $TOOLCHAIN/bin/arm-linux-androideabi-*; do
-		ln -sf $f ${f/arm-linux-androideabi-/arm-linux-eabi-}
+	for f in "$TOOLCHAIN"/bin/arm-linux-androideabi-*; do
+		ln -sf "$f" "${f/arm-linux-androideabi-/arm-linux-eabi-}"
 	done
 
 fi
@@ -89,8 +89,8 @@ if [ "$build_boost" = "true" ]; then
 	cp files/boost_1_45_0.tar.bz2 temp/MysticTreeGames-Boost-for-Android-70838fc/
 	patch temp/MysticTreeGames-Boost-for-Android-70838fc/build-android.sh <boost-android-build.patch
 	pushd temp/MysticTreeGames-Boost-for-Android-70838fc
-	./build-android.sh $TOOLCHAIN
-	cp -rv build/{include,lib} $SYSROOT/usr/local/
+	./build-android.sh "$TOOLCHAIN"
+	cp -rv build/{include,lib} "$SYSROOT"/usr/local/
 	popd
 fi
 
@@ -98,7 +98,7 @@ if [ "$build_curl" = "true" ]; then
 	rm -rf temp/curl-7.33.0
 	tar xvf files/curl-7.33.0.tar.bz2 -C temp/
 	pushd temp/curl-7.33.0
-	./configure --host=arm-linux-androideabi --with-sysroot=$SYSROOT --prefix=$SYSROOT/usr/local CFLAGS="$CFLAGS" LDFLAGS="-lm" --disable-shared
+	./configure --host=arm-linux-androideabi --with-sysroot="$SYSROOT" --prefix="$SYSROOT"/usr/local CFLAGS="$CFLAGS" LDFLAGS="-lm" --disable-shared
 	make -j3
 	make install
 	popd
@@ -108,8 +108,8 @@ if [ "$build_libpng" = "true" ]; then
 	rm -rf temp/libpng-1.5.8
 	tar xvf files/libpng-1.5.8.tar.xz -C temp/
 	pushd temp/libpng-1.5.8
-	./configure --host=arm-linux-eabi --with-sysroot=$SYSROOT --prefix=$SYSROOT/usr/local CFLAGS="$CFLAGS"
-	make $JOBS
+	./configure --host=arm-linux-eabi --with-sysroot="$SYSROOT" --prefix="$SYSROOT"/usr/local CFLAGS="$CFLAGS"
+	make "$JOBS"
 	make install
 	popd
 fi
@@ -118,8 +118,8 @@ if [ "$build_libjpeg" = "true" ]; then
 	rm -rf temp/libjpeg-turbo-1.3.0
 	tar xvf files/libjpeg-turbo-1.3.0.tar.gz -C temp/
 	pushd temp/libjpeg-turbo-1.3.0
-	./configure --host=arm-linux-eabi --with-sysroot=$SYSROOT --prefix=$SYSROOT/usr/local CFLAGS="$CFLAGS" LDFLAGS="-lm"
-	make $JOBS
+	./configure --host=arm-linux-eabi --with-sysroot="$SYSROOT" --prefix="$SYSROOT"/usr/local CFLAGS="$CFLAGS" LDFLAGS="-lm"
+	make "$JOBS"
 	make install
 	popd
 fi
@@ -129,8 +129,8 @@ if [ "$build_libxml2" = "true" ]; then
 	tar xvf files/libxml2-2.7.8.tar.gz -C temp/
 	patch temp/libxml2-2.7.8/Makefile.in <libxml2-android-build.patch
 	pushd temp/libxml2-2.7.8
-	./configure --host=arm-linux-eabi --with-sysroot=$SYSROOT --prefix=$SYSROOT/usr/local CFLAGS="$CFLAGS"
-	make $JOBS
+	./configure --host=arm-linux-eabi --with-sysroot="$SYSROOT" --prefix="$SYSROOT"/usr/local CFLAGS="$CFLAGS"
+	make "$JOBS"
 	make install
 	popd
 fi
@@ -139,8 +139,8 @@ if [ "$build_enet" = "true" ]; then
 	rm -rf temp/enet-1.3.3
 	tar xvf files/enet-1.3.3.tar.gz -C temp/
 	pushd temp/enet-1.3.3
-	./configure --host=arm-linux-eabi --with-sysroot=$SYSROOT --prefix=$SYSROOT/usr/local CFLAGS="$CFLAGS"
-	make $JOBS
+	./configure --host=arm-linux-eabi --with-sysroot="$SYSROOT" --prefix="$SYSROOT"/usr/local CFLAGS="$CFLAGS"
+	make "$JOBS"
 	make install
 	popd
 fi
@@ -153,17 +153,17 @@ if [ "$build_js185" = "true" ]; then
 	CXXFLAGS="-I $TOOLCHAIN/arm-linux-androideabi/include/c++/4.4.3/arm-linux-androideabi" \
 		HOST_CXXFLAGS="-DFORCE_LITTLE_ENDIAN" \
 		./configure \
-		--prefix=$SYSROOT/usr/local \
+		--prefix="$SYSROOT"/usr/local \
 		--target=arm-android-eabi \
-		--with-android-ndk=$NDK \
-		--with-android-sdk=$SDK \
-		--with-android-toolchain=$TOOLCHAIN \
+		--with-android-ndk="$NDK" \
+		--with-android-sdk="$SDK" \
+		--with-android-toolchain="$TOOLCHAIN" \
 		--with-android-version=9 \
 		--disable-tests \
 		--disable-shared-js \
 		--with-arm-kuser \
 		CFLAGS="$CFLAGS"
-	make $JOBS JS_DISABLE_SHELL=1
+	make "$JOBS" JS_DISABLE_SHELL=1
 	make install JS_DISABLE_SHELL=1
 	popd
 fi
diff --git a/build/coverage/gen.sh b/build/coverage/gen.sh
index f43b2cb220..3eee689dc3 100755
--- a/build/coverage/gen.sh
+++ b/build/coverage/gen.sh
@@ -18,9 +18,9 @@ for APPDIR in ../workspaces/gcc/obj/*; do
 done
 
 (
-	cd ../../binaries/system/
+	cd ../../binaries/system/ || exit 1
 	./test_dbg
-)
+) || exit 1
 
 for APPDIR in ../workspaces/gcc/obj/*; do
 	lcov -d "$APPDIR" -b ../workspaces/gcc --capture -o temp.info &&
@@ -34,6 +34,6 @@ lcov -r app.info '*/third_party/*' -o app.info
 rm -rf output
 mkdir output
 (
-	cd output
+	cd output || exit 1
 	genhtml ../app.info
-)
+) || exit 1
diff --git a/build/workspaces/clean-workspaces.sh b/build/workspaces/clean-workspaces.sh
index 726b6aa699..0adb27ec83 100755
--- a/build/workspaces/clean-workspaces.sh
+++ b/build/workspaces/clean-workspaces.sh
@@ -3,7 +3,7 @@
 # This script remains for backwards compatibility, but consists of a single
 # git command.
 
-cd "$(dirname $0)/../../"
+cd "$(dirname "$0")/../../" || exit 1
 git clean -fx build source
 
 echo "WARNING: This script has been split with libraries/clean-source-libs.sh"
diff --git a/build/workspaces/update-workspaces.sh b/build/workspaces/update-workspaces.sh
index 54a26bd8d0..b407e5dfd9 100755
--- a/build/workspaces/update-workspaces.sh
+++ b/build/workspaces/update-workspaces.sh
@@ -7,7 +7,7 @@ fi
 
 die()
 {
-	echo ERROR: $*
+	echo ERROR: "$*"
 	exit 1
 }
 
@@ -24,7 +24,7 @@ case "$OS" in
 		;;
 esac
 
-cd "$(dirname $0)"
+cd "$(dirname "$0")" || die
 # Now in build/workspaces/ (where we assume this script resides)
 
 # Parse command-line options:
@@ -55,7 +55,7 @@ if [ "$enable_atlas" = "true" ]; then
 		export WX_CONFIG="${WX_CONFIG:="wx-config"}"
 	fi
 
-	if [ ! -x "$(command -v $WX_CONFIG)" ]; then
+	if [ ! -x "$(command -v "$WX_CONFIG")" ]; then
 		echo 'WX_CONFIG must be set and valid or wx-config must be present when --atlas is passed as argument.'
 		exit 1
 	fi
@@ -63,12 +63,12 @@ fi
 
 if [ "$OS" = "Darwin" ]; then
 	# Set minimal SDK version
-	export MIN_OSX_VERSION=${MIN_OSX_VERSION:="10.12"}
+	export MIN_OSX_VERSION="${MIN_OSX_VERSION:="10.12"}"
 fi
 
 # Now build Premake or use system's.
 
-cd ../premake
+cd ../premake || die
 premake_command="premake5"
 
 if [ "$with_system_premake5" = "false" ]; then
@@ -85,10 +85,13 @@ export HOSTTYPE="$HOSTTYPE"
 # Now run Premake to create the makefiles
 echo "Premake args: ${premake_args}"
 if [ "$OS" != "Darwin" ]; then
+	# shellcheck disable=SC2086
 	${premake_command} --file="premake5.lua" --outpath="../workspaces/gcc/" ${premake_args} gmake || die "Premake failed"
 else
+	# shellcheck disable=SC2086
 	${premake_command} --file="premake5.lua" --outpath="../workspaces/gcc/" --macosx-version-min="${MIN_OSX_VERSION}" ${premake_args} gmake || die "Premake failed"
 	# Also generate xcode workspaces if on OS X
+	# shellcheck disable=SC2086
 	${premake_command} --file="premake5.lua" --outpath="../workspaces/xcode4" --macosx-version-min="${MIN_OSX_VERSION}" ${premake_args} xcode4 || die "Premake failed"
 fi
 
diff --git a/libraries/build-macos-libs.sh b/libraries/build-macos-libs.sh
index 3eb29529b7..4752f14f46 100755
--- a/libraries/build-macos-libs.sh
+++ b/libraries/build-macos-libs.sh
@@ -102,7 +102,7 @@ ARCHLESS_LDFLAGS="$LDFLAGS -stdlib=libc++"
 if [ -z "${ARCH}" ]; then
 	ARCH=$(uname -m)
 fi
-if [ $ARCH == "arm64" ]; then
+if [ "$ARCH" == "arm64" ]; then
 	# Some libs want this passed to configure for cross compilation.
 	HOST_PLATFORM="--host=aarch64-apple-darwin"
 else
@@ -125,7 +125,7 @@ set -e
 
 die()
 {
-	echo ERROR: $*
+	echo ERROR: "$*"
 	exit 1
 }
 
@@ -134,9 +134,9 @@ download_lib()
 	local url=$1
 	local filename=$2
 
-	if [ ! -e $filename ]; then
+	if [ ! -e "$filename" ]; then
 		echo "Downloading $filename"
-		curl -fLo ${filename} ${url}${filename} || die "Download of $url$filename failed"
+		curl -fLo "${filename}" "${url}${filename}" || die "Download of $url$filename failed"
 	fi
 }
 
@@ -160,16 +160,16 @@ for i in "$@"; do
 	esac
 done
 
-cd "$(dirname $0)" # Now in libraries/ (where we assume this script resides)
+cd "$(dirname "$0")" # Now in libraries/ (where we assume this script resides)
 mkdir -p macos
 cd macos
 
 # Create a location to create copies of dependencies' *.pc files, so they can be found by pkg-config
 PC_PATH="$(pwd)/pkgconfig/"
 if [[ $force_rebuild == "true" ]]; then
-	rm -rf $PC_PATH
+	rm -rf "$PC_PATH"
 fi
-mkdir -p $PC_PATH
+mkdir -p "$PC_PATH"
 
 # --------------------------------------------------------------
 echo -e "Building zlib..."
@@ -197,10 +197,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" \
 			./configure --prefix="$ZLIB_DIR" \
 			--static &&
-		make ${JOBS} && make install) || die "zlib build failed"
+		make "${JOBS}" && make install) || die "zlib build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -255,10 +255,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--without-libidn2 \
 		--with-zlib="${ZLIB_DIR}" \
 		--enable-shared=no &&
-		make ${JOBS} && make install) || die "libcurl build failed"
+		make "${JOBS}" && make install) || die "libcurl build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -293,7 +293,7 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--without-libintl-prefix \
 		--disable-nls \
 		--enable-shared=no &&
-		make ${JOBS} && make install) || die "libiconv build failed"
+		make "${JOBS}" && make install) || die "libiconv build failed"
 	popd
 	echo "$LIB_VERSION" >.already-built
 else
@@ -330,10 +330,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--with-iconv="${ICONV_DIR}" \
 		--with-zlib="${ZLIB_DIR}" \
 		--enable-shared=no &&
-		make ${JOBS} && make install) || die "libxml2 build failed"
+		make "${JOBS}" && make install) || die "libxml2 build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -373,10 +373,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--without-x \
 		--enable-video-cocoa \
 		--enable-shared=no &&
-		make $JOBS && make install) || die "SDL2 build failed"
+		make "$JOBS" && make install) || die "SDL2 build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -407,11 +407,11 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	# Can't use macosx-version, see above comment.
 	(
 		./bootstrap.sh --with-libraries=filesystem,system \
-			--prefix=$INSTALL_DIR &&
+			--prefix="$INSTALL_DIR" &&
 			./b2 cflags="$CFLAGS" \
 				toolset=clang \
 				cxxflags="$CXXFLAGS" \
-				linkflags="$LDFLAGS" ${JOBS} \
+				linkflags="$LDFLAGS" "${JOBS}" \
 				-d2 \
 				--layout=system \
 				--debug-configuration \
@@ -475,11 +475,12 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	if [[ $MIN_OSX_VERSION && ${MIN_OSX_VERSION-_} ]]; then
 		CONF_OPTS="$CONF_OPTS --with-macosx-version-min=$MIN_OSX_VERSION"
 	fi
+	# shellcheck disable=SC2086
 	(../configure CFLAGS="$ARCHLESS_CFLAGS" \
 		CXXFLAGS="$ARCHLESS_CXXFLAGS" \
 		CPPFLAGS="-D__ASSERT_MACROS_DEFINE_VERSIONS_WITHOUT_UNDERSCORES=1" \
 		LDFLAGS="$ARCHLESS_LDFLAGS" $CONF_OPTS &&
-		make ${JOBS} && make install) || die "wxWidgets build failed"
+		make "${JOBS}" && make install) || die "wxWidgets build failed"
 	popd
 	popd
 	echo "$LIB_VERSION" >.already-built
@@ -512,12 +513,12 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	# libpng has no flags for zlib but the 10.12 version is too old, so link our own.
 	(./configure CFLAGS="$CFLAGS" CPPFLAGS=" -I $ZLIB_DIR/include " \
 		LDFLAGS="$LDFLAGS -L$ZLIB_DIR/lib" \
-		--prefix=$INSTALL_DIR \
+		--prefix="$INSTALL_DIR" \
 		--enable-shared=no &&
-		make ${JOBS} && make install) || die "libpng build failed"
+		make "${JOBS}" && make install) || die "libpng build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -546,15 +547,15 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	pushd $LIB_DIRECTORY
 
 	(./configure CFLAGS="$CFLAGS" LDFLAGS="$LDFLAGS" \
-		--prefix=$INSTALL_DIR \
+		--prefix="$INSTALL_DIR" \
 		"$HOST_PLATFORM" \
 		--enable-shared=no \
 		--with-harfbuzz=no \
 		--with-bzip2=no \
 		--with-brotli=no &&
-		make ${JOBS} && make install) || die "freetype build failed"
+		make "${JOBS}" && make install) || die "freetype build failed"
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -584,12 +585,12 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 
 	(./configure CFLAGS="$CFLAGS" \
 		LDFLAGS="$LDFLAGS" \
-		--prefix=$OGG_DIR \
+		--prefix="$OGG_DIR" \
 		--enable-shared=no &&
-		make ${JOBS} && make install) || die "libogg build failed"
+		make "${JOBS}" && make install) || die "libogg build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -622,10 +623,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--prefix="$INSTALL_DIR" \
 		--enable-shared=no \
 		--with-ogg="$OGG_DIR" &&
-		make ${JOBS} && make install) || die "libvorbis build failed"
+		make "${JOBS}" && make install) || die "libvorbis build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -665,10 +666,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--enable-fat \
 		--disable-shared \
 		--with-pic &&
-		make ${JOBS} && make install) || die "GMP build failed"
+		make "${JOBS}" && make install) || die "GMP build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -712,10 +713,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--disable-documentation \
 		--disable-openssl \
 		--disable-assembler &&
-		make ${JOBS} && make install) || die "Nettle build failed"
+		make "${JOBS}" && make install) || die "Nettle build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -770,10 +771,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 			--disable-doc \
 			--disable-tools \
 			--disable-nls &&
-		make ${JOBS} LDFLAGS= install) || die "GnuTLS build failed"
+		make "${JOBS}" LDFLAGS= install) || die "GnuTLS build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -817,10 +818,10 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 		--without-tests \
 		--without-examples \
 		--disable-getaddrinfo &&
-		make ${JOBS} && make install) || die "gloox build failed"
+		make "${JOBS}" && make install) || die "gloox build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -854,18 +855,18 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	(CFLAGS="$CFLAGS" CXXFLAGS="$CXXFLAGS" LDFLAGS="$LDFLAGS" \
 		../runConfigureICU MacOSX \
 		"$HOST_PLATFORM" \
-		--prefix=$INSTALL_DIR \
+		--prefix="$INSTALL_DIR" \
 		--disable-shared \
 		--enable-static \
 		--disable-samples \
 		--enable-extras \
 		--enable-icuio \
 		--enable-tools &&
-		make ${JOBS} && make install) || die "ICU build failed"
+		make "${JOBS}" && make install) || die "ICU build failed"
 
 	popd
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -895,12 +896,12 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 
 	(./configure CFLAGS="$CFLAGS" \
 		LDFLAGS="$LDFLAGS" \
-		--prefix=${INSTALL_DIR} \
+		--prefix="${INSTALL_DIR}" \
 		--enable-shared=no &&
-		make clean && make ${JOBS} && make install) || die "ENet build failed"
+		make clean && make "${JOBS}" && make install) || die "ENet build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -922,7 +923,7 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	INSTALL_DIR="$(pwd)"
 
 	rm -f .already-built
-	download_lib $LIB_URL $LIB_ARCHIVE
+	download_lib "$LIB_URL" $LIB_ARCHIVE
 
 	rm -rf $LIB_DIRECTORY bin include lib share
 	tar -xf $LIB_ARCHIVE
@@ -930,14 +931,14 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 
 	(
 		make clean &&
-			CFLAGS=$CFLAGS LDFLAGS=$LDFLAGS make ${JOBS} &&
+			CFLAGS=$CFLAGS LDFLAGS=$LDFLAGS make "${JOBS}" &&
 			INSTALLPREFIX="$INSTALL_DIR" make install
 	) || die "MiniUPnPc build failed"
 
 	popd
 	# TODO: how can we not build the dylibs?
 	rm -f lib/*.dylib
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -968,16 +969,16 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	(
 		./configure CFLAGS="$CFLAGS" \
 			LDFLAGS="$LDFLAGS" \
-			--prefix=${INSTALL_DIR} \
+			--prefix="${INSTALL_DIR}" \
 			--enable-shared=no &&
 			make clean &&
-			CFLAGS=$CFLAGS LDFLAGS=$LDFLAGS make ${JOBS} &&
+			CFLAGS=$CFLAGS LDFLAGS=$LDFLAGS make "${JOBS}" &&
 			make check &&
 			INSTALLPREFIX="$INSTALL_DIR" make install
 	) || die "libsodium build failed"
 
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$LIB_VERSION" >.already-built
 else
 	already_built
@@ -1010,16 +1011,17 @@ if [[ $force_rebuild == "true" ]] || [[ ! -e .already-built ]] || [[ "$(<.alread
 	mkdir -p build
 	pushd build
 
+	# shellcheck disable=SC2086
 	(cmake .. \
 		-DFMT_TEST=False \
 		-DFMT_DOC=False \
 		-DCMAKE_INSTALL_PREFIX="$INSTALL_DIR" \
 		$CMAKE_FLAGS &&
-		make fmt ${JOBS} && make install) || die "fmt build failed"
+		make fmt "${JOBS}" && make install) || die "fmt build failed"
 
 	popd
 	popd
-	cp -f lib/pkgconfig/* $PC_PATH
+	cp -f lib/pkgconfig/* "$PC_PATH"
 	echo "$FMT_VERSION" >.already-built
 else
 	already_built
diff --git a/libraries/build-source-libs.sh b/libraries/build-source-libs.sh
index fe02002b40..5d444f58aa 100755
--- a/libraries/build-source-libs.sh
+++ b/libraries/build-source-libs.sh
@@ -2,7 +2,7 @@
 
 die()
 {
-	echo ERROR: $*
+	echo ERROR: "$*"
 	exit 1
 }
 
@@ -11,11 +11,10 @@ die()
 source_svnrev="28207"
 
 if [ "$(uname -s)" = "Darwin" ]; then
-	echo 'This script should not be used on macOS: use build-macos-libs.sh instead.'
-	exit 1
+	die "This script should not be used on macOS: use build-macos-libs.sh instead."
 fi
 
-cd "$(dirname $0)"
+cd "$(dirname "$0")" || die
 # Now in libraries/ (where we assume this script resides)
 
 # Check for whitespace in absolute path; this will cause problems in the
@@ -51,10 +50,10 @@ done
 # Download source libs
 echo "Downloading source libs..."
 echo
-if [ -e ${source_libs_dir}/.svn ]; then
-	(cd ${source_libs_dir} && svn cleanup && svn up -r $source_svnrev)
+if [ -e "${source_libs_dir}"/.svn ]; then
+	(cd "${source_libs_dir}" && svn cleanup && svn up -r $source_svnrev)
 else
-	svn co -r $source_svnrev https://svn.wildfiregames.com/public/source-libs/trunk ${source_libs_dir}
+	svn co -r $source_svnrev https://svn.wildfiregames.com/public/source-libs/trunk "${source_libs_dir}"
 fi
 
 # Build/update bundled external libraries
@@ -72,25 +71,25 @@ case "$(uname -s)" in
 		;;
 esac
 
-(cd ${source_libs_dir}/fcollada && MAKE=${MAKE} JOBS=${JOBS} ./build.sh) || die "FCollada build failed"
+(cd "${source_libs_dir}"/fcollada && MAKE=${MAKE} JOBS=${JOBS} ./build.sh) || die "FCollada build failed"
 echo
 if [ "$with_system_nvtt" = "false" ] && [ "$without_nvtt" = "false" ]; then
-	(cd ${source_libs_dir}/nvtt && MAKE=${MAKE} JOBS=${JOBS} ./build.sh) || die "NVTT build failed"
+	(cd "${source_libs_dir}"/nvtt && MAKE=${MAKE} JOBS=${JOBS} ./build.sh) || die "NVTT build failed"
 fi
 echo
 if [ "$with_system_mozjs" = "false" ]; then
-	(cd ${source_libs_dir}/spidermonkey && MAKE=${MAKE} JOBS=${JOBS} ./build.sh) || die "SpiderMonkey build failed"
+	(cd "${source_libs_dir}"/spidermonkey && MAKE=${MAKE} JOBS=${JOBS} ./build.sh) || die "SpiderMonkey build failed"
 fi
 echo
 
 echo "Copying built files..."
 # Copy built binaries to binaries/system/
-cp ${source_libs_dir}/fcollada/bin/* ../binaries/system/
+cp "${source_libs_dir}"/fcollada/bin/* ../binaries/system/
 if [ "$with_system_nvtt" = "false" ] && [ "$without_nvtt" = "false" ]; then
-	cp ${source_libs_dir}/nvtt/bin/* ../binaries/system/
+	cp "${source_libs_dir}"/nvtt/bin/* ../binaries/system/
 fi
 if [ "$with_system_mozjs" = "false" ]; then
-	cp ${source_libs_dir}/spidermonkey/bin/* ../binaries/system/
+	cp "${source_libs_dir}"/spidermonkey/bin/* ../binaries/system/
 fi
 # If a custom source-libs dir was used, includes and static libs should be copied to libraries/source/
 # and all other bundled content should be copied.
@@ -99,17 +98,21 @@ if [ "$source_libs_dir" != "source" ]; then
 		--exclude fcollada \
 		--exclude nvtt \
 		--exclude spidermonkey \
-		${source_libs_dir}/ source
+		"${source_libs_dir}"/ source
 
 	mkdir -p source/fcollada
-	cp -r ${source_libs_dir}/fcollada/{include,lib} source/fcollada/
+	cp -r "${source_libs_dir}"/fcollada/include source/fcollada/
+	cp -r "${source_libs_dir}"/fcollada/lib source/fcollada/
 	if [ "$with_system_nvtt" = "false" ] && [ "$without_nvtt" = "false" ]; then
 		mkdir -p source/nvtt
-		cp -r ${source_libs_dir}/nvtt/{include,lib} source/nvtt/
+		cp -r "${source_libs_dir}"/nvtt/include source/nvtt/
+		cp -r "${source_libs_dir}"/nvtt/lib source/nvtt/
 	fi
 	if [ "$with_system_mozjs" = "false" ]; then
 		mkdir -p source/spidermonkey
-		cp -r ${source_libs_dir}/spidermonkey/{include-unix-debug,include-unix-release,lib} source/spidermonkey/
+		cp -r "${source_libs_dir}"/spidermonkey/include-unix-debug source/spidermonkey/
+		cp -r "${source_libs_dir}"/spidermonkey/include-unix-release source/spidermonkey/
+		cp -r "${source_libs_dir}"/spidermonkey/lib source/spidermonkey/
 	fi
 fi
 echo "Done."
diff --git a/libraries/clean-source-libs.sh b/libraries/clean-source-libs.sh
index e06a7a9bc4..ecdb5ccea8 100755
--- a/libraries/clean-source-libs.sh
+++ b/libraries/clean-source-libs.sh
@@ -6,7 +6,7 @@
 # will still be there, etc. This is mostly just to quickly fix problems in the
 # bundled dependencies.)
 
-cd "$(dirname $0)"
+cd "$(dirname "$0")" || exit 1
 # Now in libraries/ (where we assume this script resides)
 
 echo "Cleaning bundled third-party dependencies..."
diff --git a/source/tools/dist/build-archives.sh b/source/tools/dist/build-archives.sh
index 20387e2d62..bfa8216960 100755
--- a/source/tools/dist/build-archives.sh
+++ b/source/tools/dist/build-archives.sh
@@ -3,7 +3,7 @@ set -e
 
 die()
 {
-	echo ERROR: $*
+	echo ERROR: "$*"
 	exit 1
 }
 
@@ -20,7 +20,7 @@ echo "Filtering languages"
 LANGS=("ast" "ca" "cs" "de" "el" "en_GB" "es" "eu" "fi" "fr" "gd" "hu" "id" "it" "nl" "pl" "pt_BR" "ru" "sk" "sv" "tr" "uk")
 
 REGEX=$(printf "\|%s" "${LANGS[@]}")
-REGEX=".*/\("${REGEX:2}"\)\.[-A-Za-z0-9_.]\+\.po"
+REGEX=".*/\(${REGEX:2}\)\.[-A-Za-z0-9_.]\+\.po"
 
 find binaries/ -name "*.po" | grep -v "$REGEX" | xargs rm -v || die "Error filtering languages."
 
diff --git a/source/tools/dist/build-osx-executable.sh b/source/tools/dist/build-osx-executable.sh
index 1fa84211ae..e89f61aa81 100755
--- a/source/tools/dist/build-osx-executable.sh
+++ b/source/tools/dist/build-osx-executable.sh
@@ -2,18 +2,18 @@
 
 # Build the Pyrogenesis executable, used to create the bundle and run the archiver.
 
-export ARCH=${ARCH:=$(uname -m)}
+export ARCH="${ARCH:=$(uname -m)}"
 
 # Set mimimum required OS X version, SDK location and tools
 # Old SDKs can be found at https://github.com/phracker/MacOSX-SDKs
-export MIN_OSX_VERSION=${MIN_OSX_VERSION:="10.12"}
+export MIN_OSX_VERSION="${MIN_OSX_VERSION:="10.12"}"
 # Note that the 10.12 SDK is know to be too old for FMT 7.
-export SYSROOT=${SYSROOT:="/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"}
-export CC=${CC:="clang"} CXX=${CXX:="clang++"}
+export SYSROOT="${SYSROOT:="/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk"}"
+export CC="${CC:="clang"}" CXX="${CXX:="clang++"}"
 
 die()
 {
-	echo ERROR: $*
+	echo ERROR: "$*"
 	exit 1
 }
 
@@ -27,14 +27,14 @@ if [ ! -d "${SYSROOT}" ]; then
 	die "${SYSROOT} does not exist! You probably need to install Xcode"
 fi
 
-cd "build/workspaces/"
+cd "build/workspaces/" || die
 
 JOBS=${JOBS:="-j5"}
 
 # Toggle whether this is a full rebuild, including libraries (takes much longer).
 FULL_REBUILD=${FULL_REBUILD:=false}
 
-if $FULL_REBUILD = true; then
+if [ "$FULL_REBUILD" = true ]; then
 	CLEAN_WORKSPACE_ARGS=""
 	BUILD_LIBS_ARGS="--force-rebuild"
 else
@@ -45,26 +45,33 @@ fi
 ./clean-workspaces.sh "${CLEAN_WORKSPACE_ARGS}"
 
 # Build libraries against SDK
-echo "\nBuilding libraries\n"
-pushd ../../libraries/osx >/dev/null
+echo
+echo "Building libraries"
+echo
+cd ../../libraries/osx || die
 SYSROOT="${SYSROOT}" MIN_OSX_VERSION="${MIN_OSX_VERSION}" \
-	./build-osx-libs.sh $JOBS "${BUILD_LIBS_ARGS}" || die "Libraries build script failed"
-popd >/dev/null
+	./build-osx-libs.sh "$JOBS" "${BUILD_LIBS_ARGS}" || die "Libraries build script failed"
+cd - || die
 
 # Update workspaces
-echo "\nGenerating workspaces\n"
+echo
+echo "Generating workspaces"
+echo
 
 # Pass OS X options through to Premake
-(SYSROOT="${SYSROOT}" MIN_OSX_VERSION="${MIN_OSX_VERSION}" \
-	./update-workspaces.sh --sysroot="${SYSROOT}" --macosx-version-min="${MIN_OSX_VERSION}") || die "update-workspaces.sh failed!"
+(./update-workspaces.sh --sysroot="${SYSROOT}" --macosx-version-min="${MIN_OSX_VERSION}") || die "update-workspaces.sh failed!"
 
-pushd gcc >/dev/null
-echo "\nBuilding game\n"
-(make clean && CC="$CC -arch $ARCH" CXX="$CXX -arch $ARCH" make ${JOBS}) || die "Game build failed!"
-popd >/dev/null
+echo
+echo "Building game"
+echo
+cd gcc || die
+(make clean && CC="$CC -arch $ARCH" CXX="$CXX -arch $ARCH" make "${JOBS}") || die "Game build failed!"
+cd - || die
 
 # Run test to confirm all is OK
-pushd ../../binaries/system >/dev/null
-echo "\nRunning tests\n"
+echo
+echo "Running tests"
+echo
+cd ../../binaries/system || die
 ./test || die "Post-build testing failed!"
-popd >/dev/null
+cd - || die
diff --git a/source/tools/dist/build-unix-win32.sh b/source/tools/dist/build-unix-win32.sh
index dfa2eafdcd..03d60d7b84 100755
--- a/source/tools/dist/build-unix-win32.sh
+++ b/source/tools/dist/build-unix-win32.sh
@@ -8,7 +8,7 @@ BUNDLE_VERSION=${BUNDLE_VERSION:="0.0.xxx"}
 PREFIX="0ad-${BUNDLE_VERSION}-alpha"
 
 # Collect the relevant files
-tar cf $PREFIX-unix-build.tar \
+tar cf "$PREFIX"-unix-build.tar \
 	--exclude='*.bat' --exclude='*.dll' --exclude='*.exe' --exclude='*.lib' \
 	--exclude='libraries/source/fcollada/src/FCollada/FColladaTest' \
 	--exclude='libraries/source/spidermonkey/include-*' \
@@ -17,7 +17,7 @@ tar cf $PREFIX-unix-build.tar \
 	-s "|.|$PREFIX/~|" \
 	{source,build,libraries/source,binaries/system/readme.txt,binaries/data/l10n,binaries/data/tests,binaries/data/mods/_test.*,*.txt}
 
-tar cf $PREFIX-unix-data.tar \
+tar cf "$PREFIX"-unix-data.tar \
 	--exclude='binaries/data/config/dev.cfg' \
 	-s "|archives|$PREFIX/binaries/data/mods|" \
 	-s "|binaries|$PREFIX/binaries|" \
@@ -25,30 +25,32 @@ tar cf $PREFIX-unix-data.tar \
 # TODO: ought to include generated docs in here, perhaps?
 
 # Compress
-xz -kv ${XZOPTS} $PREFIX-unix-build.tar
-xz -kv ${XZOPTS} $PREFIX-unix-data.tar
+# shellcheck disable=SC2086
+xz -kv ${XZOPTS} "$PREFIX"-unix-build.tar
+# shellcheck disable=SC2086
+xz -kv ${XZOPTS} "$PREFIX"-unix-data.tar
 DO_GZIP=${DO_GZIP:=true}
-if $DO_GZIP = true; then
-	7z a ${GZIP7ZOPTS} $PREFIX-unix-build.tar.gz $PREFIX-unix-build.tar
-	7z a ${GZIP7ZOPTS} $PREFIX-unix-data.tar.gz $PREFIX-unix-data.tar
+if [ "$DO_GZIP" = true ]; then
+	7z a ${GZIP7ZOPTS} "$PREFIX"-unix-build.tar.gz "$PREFIX"-unix-build.tar
+	7z a ${GZIP7ZOPTS} "$PREFIX"-unix-data.tar.gz "$PREFIX"-unix-data.tar
 fi
 
 # Create Windows installer
 # This needs nsisbi for files > 2GB
 makensis -V4 -nocd \
 	-dcheckoutpath="." \
-	-dversion=${BUNDLE_VERSION} \
-	-dprefix=${PREFIX} \
+	-dversion="${BUNDLE_VERSION}" \
+	-dprefix="${PREFIX}" \
 	-darchive_path="archives/" \
 	source/tools/dist/0ad.nsi
 
 # Fix permissions
-chmod -f 644 ${PREFIX}-{unix-{build,data}.tar.xz,win32.exe}
+chmod -f 644 "${PREFIX}"-{unix-{build,data}.tar.xz,win32.exe}
 
 # Print digests for copying into wiki page
-shasum -a 1 ${PREFIX}-{unix-{build,data}.tar.xz,win32.exe}
+shasum -a 1 "${PREFIX}"-{unix-{build,data}.tar.xz,win32.exe}
 
-if $DO_GZIP = true; then
-	chmod -f 644 ${PREFIX}-unix-{build,data}.tar.gz
-	shasum -a 1 ${PREFIX}-unix-{build,data}.tar.gz
+if [ "$DO_GZIP" = true ]; then
+	chmod -f 644 "${PREFIX}"-unix-{build,data}.tar.gz
+	shasum -a 1 "${PREFIX}"-unix-{build,data}.tar.gz
 fi
diff --git a/source/tools/i18n/get-nightly-translations.sh b/source/tools/i18n/get-nightly-translations.sh
index 0303910cbb..6817d46a76 100755
--- a/source/tools/i18n/get-nightly-translations.sh
+++ b/source/tools/i18n/get-nightly-translations.sh
@@ -4,7 +4,7 @@ set -ev
 # Download translations from the latest nightly build
 # This will overwrite any uncommitted changes to messages.json files
 
-cd "$(dirname $0)"
+cd "$(dirname "$0")"
 
 svn export --force --depth files https://svn.wildfiregames.com/nightly-build/trunk/binaries/data/l10n ../../../binaries/data/l10n
 
diff --git a/source/tools/spirv/get-nightly-shaders.sh b/source/tools/spirv/get-nightly-shaders.sh
index f5ef2d23e4..238c13ff2e 100755
--- a/source/tools/spirv/get-nightly-shaders.sh
+++ b/source/tools/spirv/get-nightly-shaders.sh
@@ -3,7 +3,7 @@ set -ev
 
 # Download SPIR-V shaders from the latest nightly build
 
-cd "$(dirname $0)"
+cd "$(dirname "$0")"
 
 for m in "mod" "public"; do
 	svn export --force https://svn.wildfiregames.com/nightly-build/trunk/binaries/data/mods/${m}/shaders/spirv ../../../binaries/data/mods/${m}/shaders/spirv
diff --git a/source/tools/templatessorter/templatessorter.sh b/source/tools/templatessorter/templatessorter.sh
index 2fd6b8bc38..923aa4b6b7 100755
--- a/source/tools/templatessorter/templatessorter.sh
+++ b/source/tools/templatessorter/templatessorter.sh
@@ -1,10 +1,10 @@
 #!/bin/bash
 # check arguments count
 if [ $# -ne 1 ]; then
-	echo 'usage: '$0' directory'
-	exit
+	echo usage: "$0" directory
+	exit 1
 fi
 # assign arguments to variables with readable names
 input_directory=$1
 # perform work
-find $input_directory -name \*.xml -exec xsltproc -o {} templatessorter.xsl {} \;
+find "$input_directory" -name \*.xml -exec xsltproc -o {} templatessorter.xsl {} \;
diff --git a/source/tools/tracelogger/tracelogger_options.sh b/source/tools/tracelogger/tracelogger_options.sh
index 94b69cd7b7..7870f7e499 100755
--- a/source/tools/tracelogger/tracelogger_options.sh
+++ b/source/tools/tracelogger/tracelogger_options.sh
@@ -9,7 +9,8 @@
 # The last tested version of the tool is 1c67e97e794b5039d0cae95f72ea0c76e4aa4696,
 # it can be used if more recent versions cause trouble.
 
-export TLDIR="$(dirname $(realpath $0))"
+TLDIR="$(dirname "$(realpath "$0")")"
+export TLDIR
 
 # Use semicolons to separate values on Windows.
 # If that produces bogus output, you can try with commas instead.