scripts: put quotes around file/directory names

Signed-off-by: Leah Rowe <leah@libreboot.org>

11 files changed, 102 insertions, 101 deletions

diff --git a/fetch b/fetch
index 2aef4bec..5bc0e56b 100755
--- a/fetch
+++ b/fetch
@@ -35,7 +35,7 @@ main()
 	[ "${depend}" = "" ] || ./fetch ${depend} || \
 	    fail "Cannot fetch dependency, ${depend}, for project, ${name}"
 
-	rm -Rf ${tmp_dir} || fail "cannot remove tmpdir, ${tmp_dir}"
+	rm -Rf "${tmp_dir}" || fail "cannot remove tmpdir, ${tmp_dir}"
 }
 
 read_config()
@@ -71,17 +71,17 @@ clone_project()
 {
 	tmp_dir=$(mktemp -dt "${name}_XXXXX")
 
-	git clone ${url} ${tmp_dir} || git clone ${bkup_url} ${tmp_dir} || \
+	git clone ${url} "${tmp_dir}" || git clone ${bkup_url} "${tmp_dir}" || \
 	    fail "clone_project: could not download ${name}"
 	(
-	cd ${tmp_dir} || fail "clone_project: tmpdir not created"
+	cd "${tmp_dir}" || fail "clone_project: tmpdir not created"
 	git reset --hard ${revision} || \
 	    fail "clone_project: Cannot reset revision"
 	)
 	patch_project
 
 	[ ! -d "${location}" ] || \
-		rm -Rf ${location} || \
+		rm -Rf "${location}" || \
 		    fail "clone_project: Can't remove directory '${location}'"
 	mv "${tmp_dir}" "${location}" || \
 	    fail "clone_project: could not copy temp file to destination"
@@ -91,7 +91,7 @@ patch_project()
 {
 	patchdir="resources/${name}/patches"
 
-	for patchfile in ${PWD}/${patchdir}/*.patch ; do
+	for patchfile in "${PWD}/${patchdir}"/*.patch ; do
 		[ -f "${patchfile}" ] || continue
 		(
 		cd "${tmp_dir}" || fail "patch_project: tmpdir unavailable"
diff --git a/fetch_trees b/fetch_trees
index 91f868c7..d61eb102 100755
--- a/fetch_trees
+++ b/fetch_trees
@@ -40,7 +40,7 @@ main()
 		err "running lbmk as root as not permitted"
 	fi
 
-	rm -f ${cfgsdir}/*/seen || err_rm_seen "main 1"
+	rm -f "${cfgsdir}"/*/seen || err_rm_seen "main 1"
 
 	printf "Downloading %s and (if available) applying patches\n" \
 	    ${project}
@@ -68,7 +68,7 @@ main()
 		    err "${project}/${target}: cannot download source tree"
 	done
 
-	rm -f ${cfgsdir}/*/seen || err_rm_seen "main 3"
+	rm -f "${cfgsdir}"/*/seen || err_rm_seen "main 3"
 }
 
 download_for_target()
diff --git a/resources/scripts/build/boot/roms_helper b/resources/scripts/build/boot/roms_helper
index a8e7635d..64cb9a71 100755
--- a/resources/scripts/build/boot/roms_helper
+++ b/resources/scripts/build/boot/roms_helper
@@ -189,7 +189,7 @@ if [ "${payload_grub}" = "y" ] || \
 		printf "Required GRUB payloads not yet built. Building now.\n" \
 		    1>&2
 	fi
-	for keymapfile in ${kmapdir}/*; do
+	for keymapfile in "${kmapdir}"/*; do
 		[ -f "${keymapfile}" ] || continue
 
 		keymap="${keymapfile##*/}"
@@ -230,11 +230,11 @@ moverom() {
 	printf "\nCreating new ROM image: %s\n" "${newrompath}"
 
 	if [ "${cuttype}" = "4MiB IFD BIOS region" ]; then
-		dd if=${rompath} of=${newrompath} bs=1 \
-		    skip=$(($(stat -c %s ${rompath}) - 0x400000)) \
+		dd if="${rompath}" of="${newrompath}" bs=1 \
+		    skip=$(($(stat -c %s "${rompath}") - 0x400000)) \
 		    count=4194304 || err "moverom: cannot cut 4MB section"
 	else
-		cp ${rompath} ${newrompath} || err "moverom: cannot copy rom"
+		cp "${rompath}" "${newrompath}" || err "moverom: can't copy rom"
 	fi
 
 	# pike2008 cards cause a system hang when loading option roms in seabios
@@ -245,7 +245,7 @@ moverom() {
 		touch "${emptyrom}" || err "cannot create fake oprom"
 		for deviceID in "0072" "3050"; do
 			"${cbfstool}" "${newrompath}" add -f "${emptyrom}" \
-			    -n pci1000,${deviceID}.rom -t raw || \
+			    -n "pci1000,${deviceID}.rom" -t raw || \
 			    err "moverom: cannot insert fake pike2008 rom"
 		done
 		rm -f "${emptyrom}" || err "moverom: cannot remove pike2008 rom"
@@ -257,7 +257,7 @@ moverom() {
 			[ -f "${ifdgbe}" ] || \
 				./build descriptors ich9m || \
 				    err "moverom: cannot create ich9m ifd"
-			dd if=${ifdgbe} of=${newrompath} bs=1 count=12k \
+			dd if="${ifdgbe}" of="${newrompath}" bs=1 count=12k \
 			    conv=notrunc || err "moverom: cant insert ich9m ifd"
 		fi
 		cmpstr="${romsize}MiB ICH9 IFD NOGBE NOR flash"
@@ -266,18 +266,19 @@ moverom() {
 			[ -f "${ifdgbe}" ] || \
 				./build descriptors ich9m || \
 				    err "moverom: cannot create ich9m ifd"
-			dd if=${ifdgbe} of=${newrompath} bs=1 count=4k \
+			dd if="${ifdgbe}" of="${newrompath}" bs=1 count=4k \
 			    conv=notrunc || err "moverom: cant insert ich9m ifd"
 		fi
 	done
 
 	if [ "${cuttype}" = "i945 laptop" ]; then
-		dd if=${newrompath} of=top64k.bin bs=1 \
-		    skip=$(($(stat -c %s ${newrompath}) - 0x10000)) count=64k \
-		    || err "moverom: cannot copy boot block from i945 rom"
-		dd if=top64k.bin of=${newrompath} bs=1 \
-		    seek=$(($(stat -c %s ${newrompath}) - 0x20000)) count=64k \
-		    conv=notrunc || \
+		dd if="${newrompath}" of=top64k.bin bs=1 \
+		    skip=$(($(stat -c %s "${newrompath}") - 0x10000)) \
+		    count=64k || \
+		    err "moverom: cannot copy boot block from i945 rom"
+		dd if=top64k.bin of="${newrompath}" bs=1 \
+		    seek=$(($(stat -c %s "${newrompath}") - 0x20000)) \
+		    count=64k conv=notrunc || \
 		    err "moverom: cannot copy boot block into i945 rom"
 		rm -f top64k.bin || err "moverom: can't remove top64k.bin"
 	fi
@@ -292,7 +293,7 @@ moverom() {
 		if [ "${microcode_present}" = "n" ]; then
 			rm -f "${_newrom_b}" || err "cannot remove ${_newrom_b}"
 			printf "REMARK: '%s' already lacks microcode\n" \
-			    ${newrompath}
+			    "${newrompath}"
 			printf "Renaming default ROM file instead.\n"
 			mv "${newrompath}" "${_newrom_b}" || \
 			    err "moverom: mv \"${newrompath}\" \"${_newrom_b}\""
@@ -520,7 +521,7 @@ mkRoms()
 
 	if [ "${payload_memtest}" = "y" ]; then
 		"${cbfstool}" "${corebootrom}" add-payload \
-		    -f ${memtest_bin} -n img/memtest -c lzma || \
+		    -f "${memtest_bin}" -n img/memtest -c lzma || \
 		    err "mkRoms: cannot add img/memtest to coreboot rom"
 	fi
 
diff --git a/resources/scripts/build/grub/payload b/resources/scripts/build/grub/payload
index 00ed4d44..63849bac 100755
--- a/resources/scripts/build/grub/payload
+++ b/resources/scripts/build/grub/payload
@@ -82,22 +82,22 @@ build_grub_elf()
 	grub/grub-mkstandalone \
 	    --grub-mkimage="grub/grub-mkimage" \
 	    -O i386-coreboot \
-	    -o elf/grub/grub_${keymap}.elf \
+	    -o "elf/grub/grub_${keymap}.elf" \
 	    -d grub/grub-core/ \
 	    --fonts= --themes= --locales=  \
 	    --modules="${grub_modules}" \
 	    --install-modules="${grub_install_modules}" \
-	    ${gcfg} ${grubk} || \
+	    "${gcfg}" "${grubk}" || \
 	    err "build_grub_elf: cannot build grub payload (grub-mkstandalone)"
 }
 
 create_grub_config()
 {
-	sed "s/usqwerty/${keymap}/" < ${grubcfgsdir}/config/grub.cfg \
-	    > elf/grub/grub_${keymap}.cfg || \
+	sed "s/usqwerty/${keymap}/" < "${grubcfgsdir}/config/grub.cfg" \
+	    > "elf/grub/grub_${keymap}.cfg" || \
 	    err "create_grub_config: sed failed: grub.cfg"
-	sed "s/grubtest.cfg/grub.cfg/" < elf/grub/grub_${keymap}.cfg \
-	    > elf/grub/grub_${keymap}_test.cfg || \
+	sed "s/grubtest.cfg/grub.cfg/" < "elf/grub/grub_${keymap}.cfg" \
+	    > "elf/grub/grub_${keymap}_test.cfg" || \
 	    err "create_grub_config: sed failed: grubtest.cfg"
 }
 
diff --git a/resources/scripts/build/release/roms b/resources/scripts/build/release/roms
index bdc54c9b..395fb8d7 100755
--- a/resources/scripts/build/release/roms
+++ b/resources/scripts/build/release/roms
@@ -125,7 +125,7 @@ strip_archive()
 {
 	romdir=${1}
 
-	[ -d coreboot/${tree} ] || \
+	[ -d "coreboot/${tree}" ] || \
 		./fetch_trees coreboot ${tree} || \
 		    err "strip_archive: coreboot/${tree}: can't fetch source"
 	./build coreboot utils ${tree} || \
@@ -143,7 +143,7 @@ strip_archive()
 	    err "strip_archive: !touch ${blobdir}/blobhashes"
 
 	(
-	cd ${romdir} || err "strip_archive: !cd ${romdir}"
+	cd "${romdir}" || err "strip_archive: !cd ${romdir}"
 	sha1sum *.rom >> blobhashes || \
 	    err "strip_archive: ${romdir}: !sha1sum *.rom >> blobhashes"
 	)
@@ -160,7 +160,7 @@ strip_rom_image()
 	[ -f "${romfile}" ] || return 0
 
 	if [ "${CONFIG_HAVE_ME_BIN}" = "y" ]; then
-		${ifdtool} --nuke me "${romfile}" || \
+		"${ifdtool}" --nuke me "${romfile}" || \
 		    err "strip_rom_images: ${romfile}: cannot nuke Intel ME"
 		mv "${romfile}" "${romdir}_tmp" || \
 		    err "strip_rom_images: !mv ${romfile} ${romdir}_tmp"
@@ -169,25 +169,25 @@ strip_rom_image()
 	fi
 
 	if [ "${CONFIG_HAVE_MRC}" = "y" ]; then
-		${cbfstool} "${romfile}" remove -n mrc.bin || \
+		"${cbfstool}" "${romfile}" remove -n mrc.bin || \
 		    err "strip_rom_images: ${romfile}: cannot nuke mrc.bin"
-		${cbfstool} "${romfile}" print || :
+		"${cbfstool}" "${romfile}" print || :
 	fi
 
 	if [ "${CONFIG_KBC1126_FIRMWARE}" = "y" ]; then
-		${cbfstool} "${romfile}" remove -n ecfw1.bin || \
+		"${cbfstool}" "${romfile}" remove -n ecfw1.bin || \
 		    err "strip_rom_images: ${romfile}: can't nuke ecfw1.bin"
-		${cbfstool} "${romfile}" remove -n ecfw2.bin || \
+		"${cbfstool}" "${romfile}" remove -n ecfw2.bin || \
 		    err "strip_rom_images: ${romfile}: can't nuke ecfw2.bin"
 	fi
 
 	[ "${CONFIG_INCLUDE_SMSC_SCH5545_EC_FW}" != "y" ] || \
-		${cbfstool} "${romfile}" remove -n sch5545_ecfw.bin || \
+		"${cbfstool}" "${romfile}" remove -n sch5545_ecfw.bin || \
 		    err "strip_rom_images: ${romfile}: can't nuke sch5545ec fw"
 
 	# TODO: replace this board-specific hack
 	if [ "${target}" = "e6400nvidia_4mb" ]; then
-		${cbfstool} "${romfile}" remove -n "pci10de,06eb.rom" || \
+		"${cbfstool}" "${romfile}" remove -n "pci10de,06eb.rom" || \
 		    err "strip_rom_images: ${romfile}: can't nuke e6400 vga rom"
 	fi
 }
diff --git a/resources/scripts/build/release/src b/resources/scripts/build/release/src
index 498bfabb..2e1b7174 100755
--- a/resources/scripts/build/release/src
+++ b/resources/scripts/build/release/src
@@ -125,7 +125,7 @@ copy_blobs()
 			[ -e "${srcdir}/blobs/${i}" ] || \
 				mkdir -p "${srcdir}/blobs/${i}" || \
 				    err "copy_blobs: ! -d ${srcdir}/blobs/${i}"
-			cp blobs/${i}/${j}.bin "${srcdir}/blobs/${i}" || \
+			cp "blobs/${i}/${j}.bin" "${srcdir}/blobs/${i}" || \
 			    err "copy_blobs: ! -f ${srcdir}/blobs/${i}"
 		done
 	done
diff --git a/resources/scripts/handle/config/file b/resources/scripts/handle/config/file
index 9f26fc69..5e32fed4 100755
--- a/resources/scripts/handle/config/file
+++ b/resources/scripts/handle/config/file
@@ -84,7 +84,7 @@ main()
 	fi
 
 	[ -d "${elfdir}" ] || [ "${mode}" != "all" ] || \
-		mkdir -p ${elfdir}/ || fail "cannot create directory: ${elfdir}"
+		mkdir -p "${elfdir}/" || fail "can't create directory ${elfdir}"
 
 	for x in "$@"; do
 		target="${x}"
diff --git a/resources/scripts/update/blobs/download b/resources/scripts/update/blobs/download
index 422f0b3c..13a4c29d 100755
--- a/resources/scripts/update/blobs/download
+++ b/resources/scripts/update/blobs/download
@@ -79,7 +79,7 @@ main()
 detect_firmware()
 {
 	set -- "${boarddir}/config/"*
-	. ${1} 2>/dev/null
+	. "${1}"
 	. "${boarddir}/target.cfg"
 
 	[ "${CONFIG_HAVE_MRC}" = "y" ] && needs="${needs} MRC"
@@ -94,7 +94,7 @@ detect_firmware()
 	[ -z ${needs+x} ] && \
 		printf "No binary blobs needed for this board\n" && \
 		return 1
-	printf "Firmware needed for board '%s':\n%s\n" ${board} ${needs}
+	printf "Firmware needed for board '%s':\n%s\n" "${board}" "${needs}"
 }
 
 scan_sources_config()
@@ -167,8 +167,8 @@ build_dependencies()
 	[ -f uefitool/uefiextract ] || \
 		./build src for -b uefitool || \
 		    err "build_dependencies: can't build uefitool"
-	if [ ! -f ${cbdir}/util/kbc1126/kbc1126_ec_dump ]; then
-		make -BC ${cbdir}/util/kbc1126 || \
+	if [ ! -f "${cbdir}/util/kbc1126/kbc1126_ec_dump" ]; then
+		make -BC "${cbdir}/util/kbc1126" || \
 		    err "build_dependencies: can't build kbc1126_ec_dump"
 	fi
 }
@@ -210,7 +210,7 @@ extract_blob_intel_me()
 	_me_destination=${CONFIG_ME_BIN_PATH#../../}
 
 	[ -d "${_me_destination%/*}" ] || \
-		mkdir -p ${_me_destination%/*} || \
+		mkdir -p "${_me_destination%/*}" || \
 		    err "extract_blob_intel_me: mkdir ${_me_destination%/*}"
 	[ ! -d "${appdir}" ] || \
 		rm -Rf "${appdir}" || \
@@ -222,8 +222,8 @@ extract_blob_intel_me()
 
 	printf "Extracting and stripping Intel ME firmware\n"
 
-	innoextract ${dl_path} -d ${appdir} || \
-	    7z x ${dl_path} -o${appdir} || \
+	innoextract "${dl_path}" -d "${appdir}" || \
+	    7z x "${dl_path}" -o"${appdir}" || \
 	    unar "${dl_path}" -o "${appdir}" || \
 	    err "extract_blob_intel_me: could not extract vendor update"
 
@@ -265,11 +265,11 @@ bruteforce_extract_blob_intel_me()
 			    && break # (we found me.bin)	
 			"${mecleaner}" -r -t -O "${_me_destination}" "${i}" \
 			    && break # (we found me.bin)
-			"${me7updateparser}" -O ${_me_destination} "${i}" \
+			"${me7updateparser}" -O "${_me_destination}" "${i}" \
 			    && break # (we found me.bin)
 			_7ztest="${_7ztest}a"
-			7z x "${i}" -o${_7ztest} \
-			    || innoextract "${i}" -d  "${_7ztest}" \
+			7z x "${i}" -o"${_7ztest}" \
+			    || innoextract "${i}" -d "${_7ztest}" \
 			    || unar "${i}" -o "${_7ztest}" \
 			    || continue
 			bruteforce_extract_blob_intel_me "${_me_destination}" \
@@ -368,10 +368,10 @@ extract_e6400vga()
 		return 0
 	fi
 	[ -d "${_vga_destination%/*}" ] || \
-		mkdir -p ${_vga_destination%/*} || \
+		mkdir -p "${_vga_destination%/*}" || \
 		    err "extract_e6400vga: can't mkdir ${_vga_destination%/*}"
 	[ ! -d "${appdir}" ] || \
-		rm -Rf ${appdir} || \
+		rm -Rf "${appdir}" || \
 		    err "extract_e6400vga: can't rm -Rf ${appdir}"
 
 	mkdir -p "${appdir}" || \
@@ -482,18 +482,18 @@ fetch_update()
 	[ -z "${dl_url+x}" ] && [ "${fw_type}" != "e6400vga" ] && \
 		err "fetch_update ${fw_type}: dl_url unspecified for: ${board}"
 
-	dl_path=${blobdir}/cache/${dlsum}
-	mkdir -p ${blobdir}/cache || err "fetch_update: !mkdir ${blobdir}/cache"
+	dl_path="${blobdir}/cache/${dlsum}"
+	mkdir -p "${blobdir}/cache" || err "fetch_update: !mkdir ${blobdir}/cache"
 
 	dl_fail="y"
-	vendor_checksum ${dlsum} && dl_fail="n"
+	vendor_checksum "${dlsum}" && dl_fail="n"
 	for x in "${dl}" "${dl_bkup}"; do
 		[ "${dl_fail}" = "n" ] && break
 		[ -z "${x}" ] && continue
 		rm -f "${dl_path}" || \
 		    err "fetch_update ${fw_type}: !rm -f ${dl_path}"
-		wget -U "${agent}" ${x} -O ${dl_path} || continue
-		vendor_checksum ${dlsum} && dl_fail="n"
+		wget -U "${agent}" "${x}" -O "${dl_path}" || continue
+		vendor_checksum "${dlsum}" && dl_fail="n"
 	done
 	if [ "${dl_fail}" = "y" ]; then
 		printf "ERROR: invalid vendor updates for: %s\n" "${board}" 1>&2
@@ -504,10 +504,11 @@ fetch_update()
 vendor_checksum()
 {
 	if [ ! -f "${dl_path}" ]; then
-		printf "Vendor update not found on disk for: %s\n" ${board} 1>&2
+		printf "Vendor update not found on disk for: %s\n" "${board}" \
+		    1>&2
 		return 1
 	elif [ "$(sha1sum ${dl_path} | awk '{print $1}')" != "${1}" ]; then
-		printf "Bad checksum on vendor update for: %s\n" ${board} 1>&2
+		printf "Bad checksum on vendor update for: %s\n" "${board}" 1>&2
 		return 1
 	fi
 }
diff --git a/resources/scripts/update/blobs/extract b/resources/scripts/update/blobs/extract
index b6b3af3b..fa76dfb5 100755
--- a/resources/scripts/update/blobs/extract
+++ b/resources/scripts/update/blobs/extract
@@ -88,28 +88,27 @@ extract_blobs()
 	# Cleans up other files extracted with ifdtool
 	rm -f flashregion*.bin || err "extract_blobs: !rm -f flashregion*.bin"
 
-	[ -f ${_ifd_destination} ] || err "extract_blobs: Could not extract IFD"
-	printf "gbe, ifd, and me extracted to %s\n" \
-	    "${_me_destination%/*}"
+	[ -f "${_ifd_destination}" ] || err "extract_blobs: Cannot extract IFD"
+	printf "gbe, ifd, and me extracted to %s\n" "${_me_destination%/*}"
 }
 
 extract_blob_intel_me()
 {
 	printf "extracting clean ime and modified ifd\n"
 
-	${mecleaner} -D ${_ifd_destination} \
-		-M ${_me_destination} ${vendor_rom} -t -r -S || \
-	    ${me7updateparser} \
-		-O ${_me_destination} ${vendor_rom} || \
+	"${mecleaner}" -D "${_ifd_destination}" \
+		-M "${_me_destination}" "${vendor_rom}" -t -r -S || \
+	    "${me7updateparser}" \
+		-O "${_me_destination}" "${vendor_rom}" || \
 	    err "extract_blob_intel_me: cannot extract from vendor rom"
 }
 
 extract_blob_intel_gbe_nvm()
 {
 	printf "extracting gigabit ethernet firmware"
-	./${ifdtool} -x ${vendor_rom} || \
+	./"${ifdtool}" -x "${vendor_rom}" || \
 	    err "extract_blob_intel_gbe_nvm: cannot extract gbe.bin from rom"
-	mv flashregion*gbe.bin ${_gbe_destination} || \
+	mv flashregion*gbe.bin "${_gbe_destination}" || \
 	    err "extract_blob_intel_gbe_nvm: cannot move gbe.bin"
 }
 
diff --git a/resources/scripts/update/blobs/inject b/resources/scripts/update/blobs/inject
index 4ab0c366..3cdf38c6 100755
--- a/resources/scripts/update/blobs/inject
+++ b/resources/scripts/update/blobs/inject
@@ -72,7 +72,7 @@ main()
 
 check_board()
 {
-	if ! check_release ${archive} ; then
+	if ! check_release "${archive}" ; then
 		[ -f "${rom}" ] || \
 			err "check_board: \"${rom}\" is not a valid path"
 		[ -z ${rom+x} ] && \
@@ -102,7 +102,7 @@ check_release()
 # It will only succeed if the filename is not changed from the build/download
 detect_board()
 {
-	path=${1}
+	path="${1}"
 	filename=$(basename ${path})
 	case ${filename} in
 	grub_*)
@@ -146,20 +146,20 @@ patch_release_roms()
 	tar xf "${releasearchive}" -C "${_tmpdir}" || \
 	    err "patch_release_roms: could not extract release archive"
 
-	for x in ${_tmpdir}/bin/*/*.rom ; do
+	for x in "${_tmpdir}"/bin/*/*.rom ; do
 		echo "patching rom $x"
-		patch_rom ${x} || err "patch_release_roms: could not patch ${x}"
+		patch_rom "${x}" || err "patch_release_roms: could not patch ${x}"
 	done
 
 	(
-	cd ${_tmpdir}/bin/*
+	cd "${_tmpdir}"/bin/*
 	sha1sum --status -c blobhashes || \
 	    err "patch_release_roms: ROMs did not match expected hashes"
 	)
 
 	if [ "${modifygbe}" = "true" ]; then
-		for x in ${_tmpdir}/bin/*/*.rom ; do
-			modify_gbe ${x}
+		for x in "${_tmpdir}"/bin/*/*.rom ; do
+			modify_gbe "${x}"
 		done
 	fi
 
@@ -203,7 +203,7 @@ patch_rom()
 	    [ "${CONFIG_SMSC_SCH5545_EC_FW_FILE}" != "" ] && \
 		inject_blob_smsc_sch5545_ec "${rom}"
 	[ "${modifygbe}" = "true" ] && ! [ "${release}" = "true" ] && \
-		modify_gbe ${rom}
+		modify_gbe "${rom}"
 
 	printf "ROM image successfully patched: %s\n" "${rom}"
 }
@@ -232,7 +232,7 @@ inject_blob_intel_mrc()
 	# source code, and it is *always* correct for haswell platform.
 	# TODO: this logic should be tweaked to handle more platforms
 
-	${cbfstool} ${rom} add -f mrc/haswell/mrc.bin -n mrc.bin -t mrc \
+	"${cbfstool}" "${rom}" add -f mrc/haswell/mrc.bin -n mrc.bin -t mrc \
 	    -b 0xfffa0000 || err "inject_blob_intel_mrc: cannot insert mrc.bin"
 }
 
@@ -248,7 +248,7 @@ inject_blob_intel_me()
 	[ ! -f "${_me_location}" ] && \
 		err "inject_blob_intel_me: per CONFIG_ME_BIN_PATH: file missing"
 
-	${ifdtool} -i me:${_me_location} ${rom} -O ${rom} || \
+	"${ifdtool}" -i me:"${_me_location}" "${rom}" -O "${rom}" || \
 	    err "inject_blob_intel_me: cannot insert me.bin"
 }
 
@@ -273,10 +273,10 @@ inject_blob_hp_kbc1126_ec()
 		err "inject_blob_hp_kbc1126_ec: ${board}: ecfw not downloaded"
 	fi
 
-	${cbfstool} "${rom}" add -f ${_ec1_location} -n ecfw1.bin \
+	"${cbfstool}" "${rom}" add -f "${_ec1_location}" -n ecfw1.bin \
 	    -b ${_ec1_offset} -t raw || \
 	    err "inject_blob_hp_kbc1126_ec: cannot insert ecfw1.bin"
-	${cbfstool} "${rom}" add -f ${_ec2_location} -n ecfw2.bin \
+	"${cbfstool}" "${rom}" add -f "${_ec2_location}" -n ecfw2.bin \
 	    -b ${_ec2_offset} -t raw || \
 	    err "inject_blob_hp_kbc1126_ec: cannot insert ecfw2.bin"
 }
@@ -298,7 +298,7 @@ inject_blob_dell_e6400_vgarom_nvidia()
 		err "inject_blob_dell_e6400vga: ${_vga_location} doesn't exist"
 	fi
 
-	${cbfstool} ${rom} add -f "${_vga_location}" \
+	"${cbfstool}" "${rom}" add -f "${_vga_location}" \
 	    -n "pci${CONFIG_VGA_BIOS_ID}.rom" -t optionrom || \
 	    err "inject_blob_dell_e6400vga: cannot insert vga oprom"
 }
@@ -322,7 +322,7 @@ modify_gbe()
 {
 	printf "changing mac address in gbe to ${new_mac}\n"
 
-	rom=${1}
+	rom="${1}"
 
 	[ -z ${CONFIG_GBE_BIN_PATH} ] && \
 		err "modify_gbe: ${board}: CONFIG_GBE_BIN_PATH not set"
@@ -331,27 +331,27 @@ modify_gbe()
 
 	[ -f "${_gbe_location}" ] || \
 		err "modify_gbe: CONFIG_GBE_BIN_PATH points to missing file"
-	[ -f ${nvmutil} ] || \
+	[ -f "${nvmutil}" ] || \
 		make -C util/nvmutil || err "modify_gbe: couldn't build nvmutil"
 
 	_gbe_tmp=$(mktemp -t gbeXXXX.bin)
-	cp ${_gbe_location} ${_gbe_tmp}
-	${nvmutil} "${_gbe_tmp}" setmac "${new_mac}" || \
+	cp "${_gbe_location}" "${_gbe_tmp}"
+	"${nvmutil}" "${_gbe_tmp}" setmac "${new_mac}" || \
 	    err "modify_gbe: ${board}: failed to modify mac address"
 
-	${ifdtool} -i GbE:${_gbe_tmp} "${rom}" -O "${rom}" || \
+	"${ifdtool}" -i GbE:"${_gbe_tmp}" "${rom}" -O "${rom}" || \
 	    err "modify_gbe: ${board}: cannot insert modified gbe.bin"
 
-	rm -f ${_gbe_tmp}
+	rm -f "${_gbe_tmp}"
 }
 
 listboards()
 {
-	for boarddir in ${cbcfgsdir}/*; do
+	for boarddir in "${cbcfgsdir}"/*; do
 		[ -d "${boarddir}" ] || continue
 		board="${boarddir##${cbcfgsdir}/}"
 		board="${board%/}"
-		printf '%s\n' "${board##*/}"
+		printf "%s\n" "${board##*/}"
 	done
 }
 
diff --git a/resources/scripts/update/blobs/mrc b/resources/scripts/update/blobs/mrc
index 74899990..c069e678 100755
--- a/resources/scripts/update/blobs/mrc
+++ b/resources/scripts/update/blobs/mrc
@@ -60,10 +60,10 @@ main()
 
 check_existing()
 {
-	[ -f ${_mrc_complete} ] || \
+	[ -f "${_mrc_complete}" ] || \
 		return 0
 	printf 'found existing mrc.bin\n'
-	[ "$(sha1sum ${_mrc_complete} | awk '{print $1}')" \
+	[ "$(sha1sum "${_mrc_complete}" | awk '{print $1}')" \
 	    = "${_mrc_complete_hash}" ] && \
 		return 1
 	printf 'hashes did not match, starting over\n'
@@ -84,18 +84,18 @@ fetch_mrc()
 	(
 	cd mrc/haswell/ || err "fetch_mrc: !cd mrc/haswell"
 
-	download_image ${_url} ${_file} ${_sha1sum}
+	download_image "${_url}" "${_file}" "${_sha1sum}"
 	[ -f ${_file} ] || \
-		download_image ${_url2} ${_file} ${_sha1sum}
+		download_image "${_url2}" "${_file}" "${_sha1sum}"
 	[ -f $_file ] || \
 		err "fetch_mrc: ${_file} not downloaded / verification failed."
 
-	extract_partition ROOT-A ${_file} root-a.ext2
+	extract_partition ROOT-A "${_file}" root-a.ext2
 	extract_shellball root-a.ext2 chromeos-firmwareupdate-${_board}
 
 	extract_coreboot chromeos-firmwareupdate-${_board}
 
-	../../${cbfstool} coreboot-*.bin extract -f mrc.bin -n mrc.bin \
+	../../"${cbfstool}" coreboot-*.bin extract -f mrc.bin -n mrc.bin \
 	    -r RO_SECTION || err "fetch_mrc: could not fetch mrc.bin"
 	rm -f "chromeos-firmwareupdate-${_board}" coreboot-*.bin \
 	    "${_file}" "root-a.ext2" || err "fetch_mrc: cannot remove files"
@@ -113,7 +113,7 @@ download_image()
 	printf "Downloading recovery image\n"
 	curl "$url" > "$_file.zip" || err "download_image: curl failed"
 	printf "Verifying recovery image checksum\n"
-	if [ "$(sha1sum ${_file}.zip | awk '{print $1}')" = "${_sha1sum}" ]
+	if [ "$(sha1sum "${_file}.zip" | awk '{print $1}')" = "${_sha1sum}" ]
 	then
 		unzip -q "${_file}.zip" || err "download_image: cannot unzip"
 		rm -f "${_file}.zip" || err "download_image: can't rm zip {1}"
@@ -132,12 +132,12 @@ extract_partition()
 
 	printf "Extracting ROOT-A partition\n"
 	ROOTP=$( printf "unit\nB\nprint\nquit\n" | \
-	    parted ${FILE} 2>/dev/null | grep ${NAME} )
+	    parted "${FILE}" 2>/dev/null | grep "${NAME}" )
 
 	START=$(( $( echo ${ROOTP} | cut -f2 -d\ | tr -d "B" ) ))
 	SIZE=$(( $( echo ${ROOTP} | cut -f4 -d\ | tr -d "B" ) ))
 
-	dd if=${FILE} of=${ROOTFS} bs=${_bs} skip=$(( ${START} / ${_bs} )) \
+	dd if="${FILE}" of="${ROOTFS}" bs=${_bs} skip=$(( ${START} / ${_bs} )) \
 	    count=$(( ${SIZE} / ${_bs} )) || \
 	    err "extract_partition: can't extract root file system"
 }
@@ -149,7 +149,7 @@ extract_shellball()
 
 	printf "Extracting chromeos-firmwareupdate\n"
 	printf "cd /usr/sbin\ndump chromeos-firmwareupdate ${SHELLBALL}\nquit" \
-	    | debugfs ${ROOTFS} || err "extract_shellball: debugfs"
+	    | debugfs "${ROOTFS}" || err "extract_shellball: debugfs"
 }
 
 extract_coreboot()
@@ -162,7 +162,7 @@ extract_coreboot()
 	[ -f "${_shellball}" ] || \
 	    err "extract_coreboot: shellball missing in google peppy image"
 
-	sh ${_shellball} --unpack ${_unpacked} || \
+	sh "${_shellball}" --unpack "${_unpacked}" || \
 	    err "extract_coreboot: shellball exits with non-zero status"
 
 	# TODO: audit the f* out of that shellball, for each mrc version.
@@ -172,10 +172,10 @@ extract_coreboot()
 	[ -f "${_unpacked}/VERSION" ] || \
 	    err "extract_coreboot: VERSION file missing on google coreboot rom"
 
-	_version=$( cat ${_unpacked}/VERSION | grep BIOS\ version: | \
+	_version=$( cat "${_unpacked}/VERSION" | grep BIOS\ version: | \
 	    cut -f2 -d: | tr -d \  )
 
-	cp ${_unpacked}/bios.bin coreboot-${_version}.bin || \
+	cp "${_unpacked}/bios.bin" "coreboot-${_version}.bin" || \
 	    err "extract_coreboot: cannot copy google peppy rom"
 	rm -Rf "${_unpacked}" || \
 	    err "extract_coreboot: cannot remove extracted google peppy archive"