17 files changed, 276 insertions, 262 deletions

diff --git a/bin/build-master-status b/bin/build-master-status
index 90469f2..147b325 100755
--- a/bin/build-master-status
+++ b/bin/build-master-status
@@ -80,8 +80,7 @@ pending_packages=$(
 next_tasks=$(
   (
     grep -vxF 'break_loops' "${work_dir}/build-list"
-    ls "${work_dir}/package-states" | \
-      grep '\.broken$' | \
+    find "${work_dir}/package-states" -maxdepth 1 -name '*.broken' -printf '%f\n' | \
       sed '
         s|\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)\.[^.]\+$| \1 \2 \3|
         p
@@ -113,8 +112,7 @@ testing=$(
     grep -c '\.pkg\.tar\.xz$'
 )
 (
-  ls "${work_dir}/package-states/" | \
-    grep '\.broken$' | \
+  find "${work_dir}/package-states/" -maxdepth 1 -name '*.broken' -printf '%f\n' | \
     sed 's|\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)\.[^.]\+$| \1 \2 \3|' | \
     while read -r pkg rev mod_rev repo; do
       if [ -z "$(find_dependencies_on_build_list "${pkg}" "${rev}" "${mod_rev}" "${repo}")" ]; then
@@ -122,13 +120,11 @@ testing=$(
       fi
     done
   (
-    ls "${work_dir}/build-list.loops" | \
-      grep '^loop_[0-9]\+$' | \
-      sed "s|^|${work_dir}/build-list.loops/|" | \
+    find "${work_dir}/build-list.loops" -maxdepth 1 | \
+      grep '/loop_[0-9]\+$' | \
       xargs -r cat | \
       sort -u
-    ls "${work_dir}/package-states/" | \
-      grep '\.broken$' | \
+    find "${work_dir}/package-states/" -maxdepth 1 -name '*.broken' -printf '%f\n' | \
       sed 's|\(\.[^.]\+\)\{4\}||' | \
       sort -u
   ) | \
@@ -142,21 +138,20 @@ broken=$(
     "${tmp_dir}/broken-packages-names"
 )
 blocked=$(
-  ls "${work_dir}/package-states/" | \
-    grep -c '\.blocked$'
-) || true
+  find "${work_dir}/package-states/" -maxdepth 1 -name '*.blocked' | \
+    wc -l
+)
 locked=$(
-  ls "${work_dir}/package-states/" | \
-    grep -c '\.locked$'
-) || true
+  find "${work_dir}/package-states/" -maxdepth 1 -name '*.locked' | \
+    wc -l
+)
 loops=$(
-  ls "${work_dir}/build-list.loops" | \
-    grep -c '^loop_[0-9]\+$'
+  find "${work_dir}/build-list.loops" -maxdepth 1 | \
+    grep -c '/loop_[0-9]\+$'
 ) || true
 looped_packages=$(
-  ls "${work_dir}/build-list.loops" | \
-    grep '^loop_[0-9]\+$' | \
-    sed "s|^|${work_dir}/build-list.loops/|" | \
+  find "${work_dir}/build-list.loops" -maxdepth 1 | \
+    grep '/loop_[0-9]\+$' | \
     xargs -r cat | \
     sort -u | \
     wc -l
@@ -245,8 +240,7 @@ if ${web}; then
       'dependent' \
       'blocked'
     printf '</tr>\n'
-    ls "${work_dir}/package-states" | \
-      grep '\.broken$' | \
+    find "${work_dir}/package-states" -maxdepth 1 -name '*.broken' -printf '%f\n' | \
       sed 's|\.broken$||' | \
       sed 's|^\(\(.\+\)\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)\)$|\1 \2 \3 \4 \5|' | \
       sort -k1,1 | \
diff --git a/bin/build-packages b/bin/build-packages
index c207966..4209eea 100755
--- a/bin/build-packages
+++ b/bin/build-packages
@@ -22,6 +22,7 @@
 #  avoid any-packages from x86_64 mirrors in /var/cache/pacman/pkg of
 #   build slave
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 usage() {
@@ -35,7 +36,7 @@ usage() {
   >&2 echo '               The default is $count=1 or 0 iff -t or -x is given.'
   >&2 echo '  -t seconds:  Do not request new assignment(s) $seconds seconds after start.'
   >&2 echo '  -x:          If package build fails, do not request new assignment(s).'
-  [ -z "$1" ] && exit 1 || exit $1
+  [ -z "$1" ] && exit 1 || exit "$1"
 }
 
 eval set -- "$(
@@ -58,7 +59,7 @@ do
     -n)
       shift
       count="$1"
-      [ ${count} -eq 0 ] && \
+      [ "${count}" -eq 0 ] && \
         count=-1
     ;;
     -t)
@@ -86,18 +87,18 @@ if [ $# -ne 0 ]; then
 fi
 
 if [ -z "${count}" ]; then
-  if [ ${timeout} -ne 0 ] || ${exit_after_failure}; then
+  if [ "${timeout}" -ne 0 ] || ${exit_after_failure}; then
     count=-1
   else
     count=1
   fi
 fi
 
-if [ ${timeout} -ne 0 ]; then
-  timeout=$((${timeout}+$(date +%s)))
+if [ "${timeout}" -ne 0 ]; then
+  timeout=$((timeout+$(date +%s)))
 fi
 
-while [ ${count} -ne 0 ]; do
+while [ "${count}" -ne 0 ]; do
 
   if [ ${timeout} -ne 0 ] && [ ${timeout} -lt $(date +%s) ];
   then
@@ -118,7 +119,7 @@ while [ ${count} -ne 0 ]; do
     #  0: ok, I gave you an assignment
     0)
       [ ${count} -gt 0 ] && \
-        count=$((${count}-1))
+        count=$((count-1))
       repository="${package##* }"
       package="${package% *}"
       mod_git_revision="${package##* }"
@@ -139,12 +140,12 @@ while [ ${count} -ne 0 ]; do
 
       bail_out() {
         err=$?
-        if [ -n $1 ]; then
-          err=$1
+        if [ -n "$1" ]; then
+          err="$1"
         fi
         cd "${base_dir}"
         recursively_umount_and_rm "${tmp_dir}"
-        exit ${err}
+        exit "${err}"
       }
       tmp_dir=$(mktemp -d "${work_dir}/tmp.XXXXXX")
       trap bail_out EXIT
@@ -210,7 +211,8 @@ while [ ${count} -ne 0 ]; do
           parameters=''
         fi
 
-        rm -f *".pkg.tar.xz" *".pkg.tar.xz.sig"
+        find . -maxdepth 1 -type f \( -name '*.pkg.tar.xz' -o -name '*.pkg.tar.xz.sig' \) -exec \
+          rm {} \;
 
         >&2 printf '%s: building package "%s" (straw: %s) ...' \
           "$(date +'%Y-%m-%d %T')" \
@@ -225,15 +227,15 @@ while [ ${count} -ne 0 ]; do
           ).build-log" 2>&1; then
           # build successful
           >&2 printf ' ok.\n'
-          ls -1 *.pkg.tar.xz | \
-            xargs -rn1 gpg --local-user="${package_key}" --detach-sign
-          tar -cf 'package.tar' $(
-            ls -1 | \
-              grep '\.pkg\.tar\.xz\(\.sig\)\?$' | \
-              grep -v -- '-debug-'
+          find . -maxdepth 1 -type f -name '*.pkg.tar.xz' -exec \
+            gpg --local-user="${package_key}" --detach-sign {} \;
+          # shellcheck disable=SC2046
+          tar -cf 'package.tar' -- $(
+            find . -maxdepth 1 \( -name '*.pkg.tar.xz' -o -name '*.pkg.tar.xz.sig' \) -not -name '*-debug-*'
             )
           while true; do
             err=0
+            # shellcheck disable=SC2029
             ssh \
               -i "${master_build_server_identity}" \
               -p "${master_build_server_port}" \
@@ -280,7 +282,7 @@ while [ ${count} -ne 0 ]; do
           fi
         done
         if tar -cf 'build-logs.gz.tar' \
-          *'.build-log.gz'; then
+          ./*'.build-log.gz'; then
           while ! ssh \
             -i "${master_build_server_identity}" \
             -p "${master_build_server_port}" \
diff --git a/bin/calculate-dependent-packages b/bin/calculate-dependent-packages
index 99e7bdb..70e244f 100755
--- a/bin/calculate-dependent-packages
+++ b/bin/calculate-dependent-packages
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 if [ -s "${work_dir}/build-master-sanity" ]; then
@@ -20,13 +21,13 @@ done < \
   "${tmp_dir}/build-list"
 
 mkdir "${tmp_dir}/loops"
-ls "${work_dir}/build-list.loops" | \
-  grep '^loop_[0-9]\+$' | \
+find "${work_dir}/build-list.loops" -maxdepth 1 | \
+  grep '/loop_[0-9]\+$' | \
   while read -r loop; do
-    sort -u "${work_dir}/build-list.loops/${loop}" | \
+    sort -u "${loop}" | \
       join -j 1 - "${tmp_dir}/build-list" | \
       tr ' ' '.' > \
-      "${tmp_dir}/loops/${loop}"
+      "${tmp_dir}/loops/${loop##*/}"
   done
 
 touch "${tmp_dir}/dependent-count"
@@ -102,18 +103,15 @@ while [ -s "${tmp_dir}/build-list" ] && [ "${sums}" != "$(sha512sum "${tmp_dir}/
       "${count}" \
       "${sf}" >> \
       "${tmp_dir}/dependent-count.new"
-    ls "${tmp_dir}/loops" | \
-      sed '
-        s|^|'"${tmp_dir}"'/loops/|
-      ' | \
-      xargs -r grep -lxF "${sf}" | \
-      xargs -r rm -f
+    find "${tmp_dir}/loops" -maxdepth 1 \
+      -exec grep -qxF "${sf}" {} \; \
+      -exec rm {} \;
   done < \
     "${tmp_dir}/build-list"
 
-  ls "${tmp_dir}/loops" | \
+  find "${tmp_dir}/loops" -maxdepth 1 | \
     while read -r loop; do
-      if [ ! -f "${tmp_dir}/loops/${loop}" ]; then
+      if [ ! -f "${loop}" ]; then
         continue
       fi
       if [ -n "$(
@@ -121,11 +119,11 @@ while [ -s "${tmp_dir}/build-list" ] && [ "${sums}" != "$(sha512sum "${tmp_dir}/
             sed '
               s|^|'"${work_dir}"'/package-infos/|
               s|$|.builds|
-            ' "${tmp_dir}/loops/${loop}" | \
+            ' "${loop}" | \
               xargs -r cat | \
               sort -u
             (
-              sed 'p' "${tmp_dir}/loops/${loop}"
+              sed 'p' "${loop}"
               cat "${tmp_dir}/build-list"
             ) | \
               sort | \
@@ -148,7 +146,7 @@ while [ -s "${tmp_dir}/build-list" ] && [ "${sums}" != "$(sha512sum "${tmp_dir}/
         sed '
           s|^|'"${work_dir}"'/package-infos/|
           s|$|.builds|
-        ' "${tmp_dir}/loops/${loop}" | \
+        ' "${loop}" | \
           xargs -r cat | \
           sort -u | \
         join -1 1 -2 2 -o 2.1 - "${tmp_dir}/dependent-count.needs" | \
@@ -162,17 +160,13 @@ while [ -s "${tmp_dir}/build-list" ] && [ "${sums}" != "$(sha512sum "${tmp_dir}/
       while read -r sf; do
         printf '%s %s\n' "${count}" "${sf}" >> \
           "${tmp_dir}/dependent-count.new"
-        ls "${tmp_dir}/loops" | \
-          grep -vxF "${loop}" | \
-          sed '
-            s|^|'"${tmp_dir}"'/loops/|
-          ' | \
-          xargs -r grep -lxF "${sf}" | \
-          xargs -r rm -f
+        find "${tmp_dir}/loops" -maxdepth 1 -not -name "${loop##*/}" \
+          -exec grep -qxF "${sf}" {} \; \
+          -exec rm {} \;
       done < \
-        "${tmp_dir}/loops/${loop}"
+        "${loop}"
 
-      rm "${tmp_dir}/loops/${loop}"
+      rm "${loop}"
     done
 
   cat "${tmp_dir}/dependent-count" "${tmp_dir}/dependent-count.new" | \
diff --git a/bin/clean-cache b/bin/clean-cache
index b7cef9f..06ac8a1 100755
--- a/bin/clean-cache
+++ b/bin/clean-cache
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 if [ $# -eq 0 ]; then
diff --git a/bin/cleanup b/bin/cleanup
index 93af0bc..c8de490 100755
--- a/bin/cleanup
+++ b/bin/cleanup
@@ -2,6 +2,7 @@
 
 # clean up unnecessary data
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 # we only clean if run interactive or if no one is logged in
@@ -19,8 +20,7 @@ fi
 # remove blocked/broken/locked markes of packages not on the buildlist anymore
 
 (
-  ls "${work_dir}/package-states" | \
-    grep '\.broken$\|\.b\?locked$' | \
+  find "${work_dir}/package-states" -maxdepth 1 \( -name '*.broken' -o -name '*.locked' -o -name '*.blocked' \) -printf '%f\n' | \
     sed '
       s|^\(.*\)\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)$|state \0 \1 \2 \3 \4 \5|
     '
@@ -40,11 +40,10 @@ fi
 # remove logs where package is not broken/locked anymore
 
 (
-  ls "${build_log_directory}" | \
+  find "${build_log_directory}" -maxdepth 1 -printf '%f\n' | \
     sed 's|\.[^.]\+\.build-log\.gz$||' | \
     sort -u
-  ls "${work_dir}/package-states" | \
-    grep '\.broken$\|\.locked$' | \
+  find "${work_dir}/package-states" -maxdepth 1 \( -name '*.broken' -o -name '*.locked' \) -printf '%f\n' | \
     sed '
       s|\.[^.]\+$||
       p
@@ -52,19 +51,21 @@ fi
 ) | \
   sort | \
   uniq -u | \
-  while read -r s t; do
+  cut -d' ' -f1 | \
+  while read -r s; do
     rm -f "${build_log_directory}/${s}."*
   done
 
 # only keep 10 newest logs per package
 
-ls "${build_log_directory}" | \
+find "${build_log_directory}" -maxdepth 1 -printf '%f\n' | \
   sed 's|^\(.*\)\(\.\([^.]\+\)\.build-log\.gz\)$|\1\2 \3 \1|' | \
   sort -k3,3 -k2r,2 | \
   uniq -f2 --group=prepend | \
+  cut -d' ' -f1 | \
   (
     count=0
-    while read -r a b c; do
+    while read -r a; do
       if [ -z "${a}" ]; then
         count=0
         continue
@@ -72,7 +73,7 @@ ls "${build_log_directory}" | \
       if [ ${count} -ge 10 ]; then
         echo "${build_log_directory}/${a}"
       fi
-      count=$((${count}+1))
+      count=$((count+1))
     done
   ) | \
   xargs -rn1 rm
diff --git a/bin/common-functions b/bin/common-functions
index b85a345..b2819b2 100755
--- a/bin/common-functions
+++ b/bin/common-functions
@@ -2,6 +2,11 @@
 
 # contains functions used by more than one script
 
+if [ -z "${base_dir}" ]; then
+  # just to make shellcheck happy
+  . 'conf/default.conf'
+fi
+
 # find_pkgbuilds package repository git_repository git_revision mod_git_revision
 # find the PKGBUILD and modification of $package from $repository
 # sets $PKGBUILD and $PKGBUILD_mod
@@ -304,10 +309,12 @@ delete_old_metadata() {
             continue
           fi
           revs=$(
+            # shellcheck disable=SC2086
             printf '%s\n' ${revs} ${rev} | \
               sort -u
           )
           mod_revs=$(
+            # shellcheck disable=SC2086
             printf '%s\n' ${mod_revs} ${mod_rev} | \
               sort -u
           )
@@ -425,7 +432,7 @@ wait_some_time() {
       cut -d' ' -f1
   )
 
-  sleep $((${minimum} + ${random} % ${diff}))
+  sleep $((minimum + random % diff))
 }
 
 # str_to_regex $string
@@ -505,9 +512,8 @@ insert_break_loops_orders() {
   local line
 
   looped_packages=$(
-    ls "${work_dir}/build-list.loops" | \
-      grep '^loop_[0-9]\+$' | \
-      sed "s|^|${work_dir}/build-list.loops/|" | \
+    find "${work_dir}/build-list.loops" -maxdepth 1 | \
+      grep '/loop_[0-9]\+$' | \
       xargs -r cat | \
       sort -u | \
       wc -l
@@ -516,16 +522,16 @@ insert_break_loops_orders() {
   (
     while read -r line; do
       if [ "${line}" = 'break_loops' ]; then
-        if [ ${looped_packages} -eq 0 ]; then
+        if [ "${looped_packages}" -eq 0 ]; then
           continue
         fi
-        looped_packages=$((${looped_packages}-1))
+        looped_packages=$((looped_packages-1))
       fi
       printf '%s\n' "${line}"
     done < \
       "${file}"
     while [ ${looped_packages} -gt 0 ]; do
-      looped_packages=$((${looped_packages}-1))
+      looped_packages=$((looped_packages-1))
       echo 'break_loops'
     done
   ) | \
@@ -549,10 +555,10 @@ find_newest_of_git_revisions() {
   local repo
   revisions=$(cat)
 
-  if [ $(
+  if [ "$(
     echo "${revisions}" | \
       wc -l
-    ) -eq 1 ]; then
+    )" -eq 1 ]; then
 
     echo "${revisions}"
     return
@@ -649,6 +655,7 @@ extract_source_directory() {
 
   append_architectures "${output}/PKGBUILD"
 
+  # shellcheck disable=SC2016
   sed -i '/^\$Id\$$/d' "${output}/PKGBUILD"
 
 }
@@ -693,10 +700,12 @@ download_sources_by_hash() {
   local git_mod_revision="$4"
 
   local return_value=1
-  local tmp_dir=$(mktemp -d)
+  local tmp_dir
   local sum_type
   local arch_suffix
 
+  tmp_dir=$(mktemp -d)
+
   if ! make_source_info "${package}" "${repository}" "${git_revision}" "${git_mod_revision}" "${tmp_dir}/.SRCINFO"; then
     >&2 echo 'download_sources_by_hash: make_source_info failed.'
     rm -rf --one-file-system "${tmp_dir}"
@@ -723,7 +732,7 @@ download_sources_by_hash() {
         ' | \
         cat -n > \
         "${tmp_dir}/urls"
-      if [ $(wc -l < "${tmp_dir}/sums") -eq $(wc -l < "${tmp_dir}/urls") ]; then
+      if [ "$(wc -l < "${tmp_dir}/sums")" -eq "$(wc -l < "${tmp_dir}/urls")" ]; then
         join -1 1 -2 1 -o 1.2,2.2 "${tmp_dir}/sums" "${tmp_dir}/urls" > \
           "${tmp_dir}/joined"
         while read -r sum file; do
diff --git a/bin/db-update b/bin/db-update
index 75d0465..d05f69f 100755
--- a/bin/db-update
+++ b/bin/db-update
@@ -25,8 +25,10 @@
 
 # use "builds" instead of assuming package builds only it's name
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
+# shellcheck disable=SC2016
 usage() {
   >&2 echo ''
   >&2 echo 'db-update [options] [packages]:'
@@ -39,7 +41,7 @@ usage() {
   >&2 echo '                    stable from $file (- is stdin).'
   >&2 echo '  -h|--help:        Show this help and exit.'
   >&2 echo '  -n|--no-action:   Only print what would be moved.'
-  [ -z "$1" ] && exit 1 || exit $1
+  [ -z "$1" ] && exit 1 || exit "$1"
 }
 
 # move_packages $package/$from_repository/$to_repository ...
@@ -62,7 +64,7 @@ move_packages() {
   local dummynator
   local file
 
-  rm -rf --one-file-system "${tmp_dir}/"*
+  rm -rf --one-file-system "${tmp_dir:?}/"*
 
   touch "${tmp_dir}/repos"
   touch "${tmp_dir}/packages"
@@ -82,7 +84,7 @@ move_packages() {
         "${tmp_dir}/master-mirror-listing"
     done
 
-  for package in $@; do
+  for package in "$@"; do
     if [ -z "${package}" ]; then
       continue
     fi
@@ -163,8 +165,9 @@ move_packages() {
     mkdir -p "${tmp_dir}/${to_repo}"
 
     repos=$(
+      # shellcheck disable=SC2046
       printf '%s\n' "${from_repo}" "${to_repo}" $(cat "${tmp_dir}/repos") | \
-      sort -u
+        sort -u
     )
     echo "${repos}" > \
       "${tmp_dir}/repos"
@@ -179,8 +182,7 @@ move_packages() {
           echo "'${file}'"
         else
           echo "${file}:"
-          cat "${file}" | \
-            sed 's|^|<<|;s|$|>>|'
+          sed 's|^|<<|;s|$|>>|' "${file}"
         fi
         echo
       done
@@ -199,6 +201,7 @@ move_packages() {
 
     if grep -qxF "${repo}" "${tmp_dir}/"*".from_repo"; then
 
+      # shellcheck disable=SC2046
       repo-remove -q \
         "${tmp_dir}/${repo}/${repo}.db.tar.gz" \
         $(
@@ -303,9 +306,8 @@ move_packages() {
         "${work_dir}/package-states/${package}.${from_ending}"
     else
       # remove old state files of $package with ending $to_ending
-      ls "${work_dir}/package-states" | \
-        grep "^$(str_to_regex "${package%.*.*.*}")\(\.[^.]\+\)\{3\}\.${to_ending}\$" | \
-        sed "s|^|${work_dir}/package-states/|" | \
+      find "${work_dir}/package-states" -maxdepth 1 | \
+        grep "/$(str_to_regex "${package%.*.*.*}")\(\.[^.]\+\)\{3\}\.${to_ending}\$" | \
         xargs -rn1 ${dummynator} rm
       ${dummynator} mv \
         "${work_dir}/package-states/${package}.${from_ending}" \
@@ -318,12 +320,13 @@ move_packages() {
   if ! ${no_action}; then
     date '+%s' > \
       "${tmp_dir}/lastupdate"
+    # shellcheck disable=SC2086
     ${dummynator} ${master_mirror_rsync_command} \
       "${tmp_dir}/lastupdate" \
       "${master_mirror_rsync_directory}/lastupdate"
   fi
 
-  rm -rf --one-file-system "${tmp_dir}/"*
+  rm -rf --one-file-system "${tmp_dir:?}/"*
 
 }
 
@@ -373,9 +376,10 @@ do
 done
 
 packages_to_stabilize=$(
+  # shellcheck disable=SC2086
   printf '%s\n' \
     ${packages_to_stabilize} \
-    ${@}
+    "${@}"
 )
 
 if [ -s "${work_dir}/build-master-sanity" ]; then
@@ -388,6 +392,7 @@ trap 'rm -rf --one-file-system "${tmp_dir}"' EXIT
 
 packages_to_stabilize=$(
   (
+    # shellcheck disable=SC2086
     printf '%s\n' ${packages_to_stabilize} | \
       sort -u | \
       sed '
@@ -396,14 +401,8 @@ packages_to_stabilize=$(
           d
         }
       '
-    ls "${work_dir}/package-states" | \
-      sed -n '
-        /\.testing$/{
-          s|^|'"${work_dir}"'/package-states/|
-          p
-        }
-      ' | \
-      xargs -r grep -HF '' | \
+    find "${work_dir}/package-states" -maxdepth 1 -type f -name '*.testing' -exec \
+      grep -HF '' {} \; | \
       sed '
         s|^.*/||
         s|^\([^:]\+\)\.testing:|\1 |
@@ -453,15 +452,13 @@ for ending in 'done' 'testing'; do
     continue
   fi
   if [ -n "$(
-    ls "${work_dir}/package-states" | \
-      grep "\.${ending}\$" | \
+    find "${work_dir}/package-states" -name ".${ending}" -printf '%f\n' | \
       sed 's|\(\.[^.]\+\)\{4\}$||' | \
       sort | \
       uniq -d
     )" ]; then
     >&2 echo 'Removing duplicates not yet implemented:'
-    ls "${work_dir}/package-states" | \
-      grep "\.${ending}\$" | \
+    find "${work_dir}/package-states" -name ".${ending}" -printf '%f\n' | \
       sed 's|\(\.[^.]\+\)\{4\}$||' | \
       sort | \
       uniq -d
@@ -480,12 +477,10 @@ done
     done | \
     sort -u
 
-  ls "${work_dir}/package-infos" | \
-    grep '\.groups' | \
-    sed "s|^|${work_dir}/package-infos/|" | \
-    xargs -r grep -lx 'base\(-devel\)\?' | \
+  find "${work_dir}/package-infos" -name '*.groups' \
+    -exec grep -qx 'base\(-devel\)\?' {} \; \
+    -printf '%f\n' | \
     sed '
-      s|^.*/||
       s|\(\.[^.]\+\)\{4\}$||
     ' | \
     sort -u > \
@@ -605,6 +600,7 @@ done_packages=$(
 
 # move packages in packages_to_stabilize from *testing/ to the stable repos
 
+# shellcheck disable=SC2046
 move_packages $(
 
   for package in ${packages_to_stabilize}; do
@@ -624,6 +620,7 @@ move_packages $(
 
 # move packages from *staging to *testing
 
+# shellcheck disable=SC2046
 move_packages $(
 
   for package in ${done_packages}; do
diff --git a/bin/get-assignment b/bin/get-assignment
index fd76a7f..7185a35 100755
--- a/bin/get-assignment
+++ b/bin/get-assignment
@@ -17,6 +17,7 @@
 
 #  respect build-manually-list ("blocked")
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 mkdir -p "${work_dir}/package-states"
@@ -30,10 +31,9 @@ hand_out_assignment() {
 
   # we don't care anymore if an older version of this package was
   # "locked" or "broken" (we keep only marker for older "done" packages)
-  ls "${work_dir}/package-states" | \
-    grep "^$(str_to_regex "${1}")\(\.[^.]\+\)\{3\}\.\(locked\|broken\)\$" | \
-    grep -v "^$(str_to_regex "$1.$2.$3.$4.")[^.]\+\$" | \
-    sed "s|^|${work_dir}/package-states/|" | \
+  find "${work_dir}/package-states" -maxdepth 1 | \
+    grep "/$(str_to_regex "${1}")\(\.[^.]\+\)\{3\}\.\(locked\|broken\)\$" | \
+    grep -v "/$(str_to_regex "$1.$2.$3.$4.")[^.]\+\$" | \
     xargs -rn1 rm -f
 
   echo "$1 $2 $3 $4"
@@ -81,7 +81,7 @@ while read -r package git_revision mod_git_revision repository; do
     continue
   fi
 
-  generate_package_metadata $package.$git_revision.$mod_git_revision.$repository
+  generate_package_metadata "${package}.${git_revision}.${mod_git_revision}.${repository}"
 
   if [ -f "${work_dir}/package-states/${package}.${git_revision}.${mod_git_revision}.${repository}.blocked" ]; then
     continue
@@ -90,7 +90,7 @@ while read -r package git_revision mod_git_revision repository; do
   if [ -f "${work_dir}/package-states/${package}.${git_revision}.${mod_git_revision}.${repository}.locked" ];
   then
     if [ "${slave}" = "$(head -n1 "${work_dir}/package-states/${package}.${git_revision}.${mod_git_revision}.${repository}.locked")" ]; then
-      num_jobs=$((${num_jobs}+1));
+      num_jobs=$((num_jobs+1));
     fi
   else
     pending_packages=true
@@ -150,7 +150,8 @@ for hand_out_broken in false true; do
 
     hand_out_assignment "${package}" "${git_revision}" "${mod_git_revision}" "${repository}"
 
-  done < "${work_dir}/build-list"
+  done < \
+    "${work_dir}/build-list"
 
 done
 
@@ -158,7 +159,7 @@ done
 # which breaks the most unlocked loops
 
 locked_packages=$(
-  ls "${work_dir}/package-states/" | \
+  find "${work_dir}/package-states/" -maxdepth 1 -printf '%f\n' | \
     grep '\(\.[0-9a-f]\{40\}\)\{2\}\.[^\.\]\+\.locked$' | \
     sed 's|\(\.[0-9a-f]\{40\}\)\{2\}\.[^\.\]\+\.locked$||'
 )
@@ -168,18 +169,19 @@ grep -vxF 'break_loops' "${work_dir}/build-list" | \
   "${work_dir}/build-list.sorted-by-package"
 
 for package in $(
-  ls "${work_dir}/build-list.loops/" | \
-    grep '^loop_[0-9]\+$' | \
+  # shellcheck disable=SC2030
+  find "${work_dir}/build-list.loops/" -maxdepth 1 | \
+    grep '/loop_[0-9]\+$' | \
     while read -r loop; do
       if [ -z "$(
         (
-          cat "${work_dir}/build-list.loops/${loop}"
+          cat "${loop}"
           echo "${locked_packages}"
         ) | \
           sort | \
           uniq -d
         )" ]; then
-        cat "${work_dir}/build-list.loops/${loop}"
+        cat "${loop}"
       fi
     done | \
     sort | \
@@ -207,6 +209,7 @@ for package in $(
     sort -k1n,1 -k2nr,2 | \
     cut -d' ' -f3
 ); do
+  # shellcheck disable=SC2046,SC2031
   hand_out_assignment $(
     echo "${package}" | \
       sed 's|\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)$| \1 \2 \3|'
diff --git a/bin/get-package-updates b/bin/get-package-updates
index d7d6b3b..fbb05f8 100755
--- a/bin/get-package-updates
+++ b/bin/get-package-updates
@@ -17,6 +17,7 @@
 
 #  remove extra whitelist cases
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 usage() {
@@ -28,7 +29,7 @@ usage() {
   >&2 echo '  -b|--block:   If necessary, wait for lock blocking.'
   >&2 echo '  -h|--help:    Show this help and exit.'
   >&2 echo '  -n|--no-pull: Do not pull git repos, merely reorder build list.'
-  [ -z "$1" ] && exit 1 || exit $1
+  [ -z "$1" ] && exit 1 || exit "$1"
 }
 
 eval set -- "$(
@@ -153,6 +154,7 @@ for repo in ${repo_names}; do
   eval new_repo_revision='"${new_repo_revisions__'"${repo}"'}"'
   (
     # if old revision unknown, mimic "git diff"-output
+    # shellcheck disable=SC2154
     if [ "${old_repo_revision}" = "NONE" ]; then
       git -C "${repo_path}" archive --format=tar HEAD | \
         tar -t | \
@@ -166,6 +168,7 @@ for repo in ${repo_names}; do
     if [ "${repo}" = "archlinux32" ]; then
     # modify the directory structure from the modifiaction-repository
     # to the one of an original source repository
+      # shellcheck disable=SC2016
       sed 's|^\(.\t\)\([^/]\+\)/\([^/]\+\)/\(.\+\)$|\2 \1\3/repos/\2-x86_64/\4|' | \
         while read -r pkg_repo rest; do
           eval "printf '%s %s\n'" \
@@ -189,6 +192,7 @@ done | \
       # new or modified PKGBUILD
       "A"|"M")
         sed -i "/^$(str_to_regex "${package}") /d" "${work_dir}/build-list.new"
+        # shellcheck disable=SC2154
         echo "${package} ${git_revision} ${new_repo_revisions__archlinux32} ${repository}" >> \
           "${work_dir}/build-list.new"
         sed -i "/^$(str_to_regex "${package}")\$/d" "${work_dir}/deletion-list.new"
@@ -231,15 +235,14 @@ black_listed_new=$(
   (
     git -C "${repo_paths__archlinux32}" archive "$(cat "${work_dir}/archlinux32.revision")" -- 'blacklist' | \
       tar -Ox 'blacklist'
-    ls "${work_dir}/package-infos" | \
-      grep '^lib32-' | \
+    find "${work_dir}/package-infos" -maxdepth 1 -name 'lib32-*' -printf '%f\n' | \
       sed 's|\(\.[^.]\+\)\{4\}$||' | \
       uniq
   ) | \
     sort -u
 )
 
-ls "${work_dir}/package-infos/" | \
+find "${work_dir}/package-infos/" -maxdepth 1 -name '*.builds' -printf '%f\n' | \
   grep '\(\.[0-9a-f]\{40\}\)\{2\}\.[^.]\+\.builds$' | \
   sed '
     s|^\(.*\)\.\([^.]\+\)\.\([^.]\+\)\.\([^.]\+\)\.[^.]\+$|\2 \3 \4 \1|
@@ -255,11 +258,13 @@ ls "${work_dir}/package-infos/" | \
         "${opkg}" \
         "${opkg}" \
         "$(
+          # shellcheck disable=SC2086
           printf '%s\n' ${revs} | \
             sort -u | \
             find_newest_of_git_revisions
         )" \
         "$(
+          # shellcheck disable=SC2086
           printf '%s\n' ${mod_revs} | \
             sort -u | \
             find_newest_of_git_revisions
@@ -309,11 +314,13 @@ sed "
 
 while [ -n "${black_listed_new}" ]; do
   black_listed=$(
+    # shellcheck disable=SC2086
     printf '%s\n' ${black_listed} ${black_listed_new} | \
       sort -u
   )
   black_listed_new=$(
     (
+      # shellcheck disable=SC2086
       printf '%s\n' ${black_listed} | \
         sort -k1,1 | \
         join -j1 -o 2.2 - "${work_dir}/newest-revisions" | \
@@ -356,6 +363,7 @@ while [ -n "${black_listed_new}" ]; do
       sort -u
   )
   black_listed_new=$(
+    # shellcheck disable=SC2086
     printf '%s\n' ${black_listed} ${black_listed} ${black_listed_new} | \
       sort | \
       uniq -u
@@ -427,7 +435,7 @@ if [ -s "${work_dir}/tsort.error" ]; then
     ' "${work_dir}/tsort.error"
 
   # remove lines from loop files which are no packages
-  ls "${work_dir}/build-list.loops.new" | \
+  find "${work_dir}/build-list.loops.new" -maxdepth 1 -printf '%f\n' | \
     grep '^loop_[0-9]\+$' | \
     while read -r loop; do
       (
@@ -455,6 +463,7 @@ fi
 rm -rf --one-file-system "${work_dir}/build-list.loops"
 (
   printf '%s\n' "build-list.loops" "build-list.new" "build-list" "deletion-list"
+  # shellcheck disable=SC2086
   printf '%s.revision\n' ${repo_names}
 ) | \
   while read -r file; do
diff --git a/bin/prioritize-build-list b/bin/prioritize-build-list
index 20b11ae..8e02590 100755
--- a/bin/prioritize-build-list
+++ b/bin/prioritize-build-list
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 if [ $# -ne 1 ]; then
diff --git a/bin/return-assignment b/bin/return-assignment
index cd9656d..ddea81b 100755
--- a/bin/return-assignment
+++ b/bin/return-assignment
@@ -18,6 +18,7 @@
 
 #  fix signing of database
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 if [ -s "${work_dir}/build-master-sanity" ]; then
@@ -64,8 +65,7 @@ if [ "$5" = 'ERROR' ]; then
   # unlock every loop this package would have broken and which is not
   # broken by another locked package
   locked_packages=$(
-    ls "${work_dir}/package-states/" | \
-      grep '\.locked$' | \
+    find "${work_dir}/package-states/" -maxdepth 1 -name '*.locked' | \
       sed 's@^.*/\([^/]\+\)\.\([0-9a-f]\{40\}\.\)\{2\}[^.]\+\.locked$@\1@'
   )
   grep -lxF "${1}" "${work_dir}/build-list.loops/loop_"* 2> /dev/null | \
@@ -134,7 +134,7 @@ tar -x \
 
 # check if all packages are signed and all signatures belong to a package
 signature_errors=$(
-  ls -1 *.pkg.tar.xz *.pkg.tar.xz.sig | \
+  find . -maxdepth 1 -name '*.pkg.tar.xz' -o -name '*.pkg.tar.xz.sig' \
     sed 's|\.sig$||' | \
     sort | \
     uniq -c | \
@@ -150,11 +150,11 @@ fi
 
 # check if the sent packages are the expected ones
 packages=$(
-  ls -1 | \
-    grep '\.pkg\.tar\.xz$'
+  find . -maxdepth 1 -name '*.pkg.tar.xz' -printf '%f\n'
 )
 package_errors=$(
   (
+    # shellcheck disable=SC2086
     printf '%s\n' ${packages} | \
       sed '
         s@\(-[^-]\+\)\{2\}-\([^-]\+\)\.pkg\.tar\.xz$@ \2@
@@ -185,6 +185,7 @@ ${master_mirror_rsync_command} \
   "${master_mirror_rsync_directory}/i686/${destination}/${destination}.db."* \
   "${master_mirror_rsync_directory}/i686/${destination}/${destination}.files."* \
   .
+# shellcheck disable=SC2086
 repo-add "${destination}.db.tar.gz" ${packages}
 # repo-add -v -s -k "${repo_key}" "${destination}.db.tar.gz" ${packages}
 
@@ -201,11 +202,10 @@ done
 
 # remove old state files (these should be only "done" markers, but
 # actually we don't care what it is) - as long as it's not "testing"
-ls "${work_dir}/package-states" | \
-  grep "^$(str_to_regex "$1")\(\.[^.]\+\)\{4\}\$" | \
-  grep -v "^$(str_to_regex "$1.$2.$3.$4")\.[^.]\+\$" | \
+find "${work_dir}/package-states" -maxdepth 1 | \
+  grep "/$(str_to_regex "$1")\(\.[^.]\+\)\{4\}\$" | \
+  grep -v "/$(str_to_regex "$1.$2.$3.$4")\.[^.]\+\$" | \
   grep -v '\.testing$' | \
-  sed "s|^|${work_dir}/package-states/|" | \
   xargs -rn1 rm -f
 
 # remove all loops which are broken by this package
@@ -213,7 +213,7 @@ grep -lxF "$1" "${work_dir}/build-list.loops/loop_"* 2> /dev/null | \
   sed 'p;s|$|.locked|' | \
   xargs -rn1 rm -f
 
-if ! ls "${work_dir}/build-list.loops" | \
+if ! find "${work_dir}/build-list.loops" -maxdepth 1 -printf '%f\n' | \
   grep -q '^loop_[0-9]\+$'; then
   # no loops left
   sed -i '/^break_loops$/d' "${work_dir}/build-list"
@@ -224,6 +224,7 @@ sed -i "/^$(str_to_regex "$1 $2 $3 $4")\$/d" "${work_dir}/build-list"
 
 # remove package lock file
 if ! [ "${destination}" = 'build-support' ]; then
+  # shellcheck disable=SC2086
   printf '%s\n' ${packages} > \
     "${work_dir}/package-states/$1.$2.$3.$4.done"
 fi
diff --git a/bin/sanity-check b/bin/sanity-check
index a61f3aa..6ce0565 100755
--- a/bin/sanity-check
+++ b/bin/sanity-check
@@ -2,6 +2,7 @@
 
 # do some basic sanity checks
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 usage() {
@@ -12,7 +13,7 @@ usage() {
   >&2 echo '  -h|--help:             Show this help and exit.'
   >&2 echo '  -q|--quiet:            Only print errors found.'
   >&2 echo '  -r|--really-quiet:     Do not print anything.'
-  [ -z "$1" ] && exit 1 || exit $1
+  [ -z "$1" ] && exit 1 || exit "$1"
 }
 
 i_am_insane() {
@@ -130,6 +131,7 @@ while [ $# -gt 0 ]; do
 
       errors=$(
         (
+          # shellcheck disable=SC2086
           printf 'expected %s\n' ${repos}
           ls_master_mirror 'i686' | \
             sed 's|^|found |'
@@ -245,7 +247,7 @@ while [ $# -gt 0 ]; do
           i_am_insane
         fi
 
-        rm -rf --one-file-system "${tmp_dir}/"*
+        rm -rf --one-file-system "${tmp_dir:?}/"*
 
         [ ${silence} -gt 0 ] || \
           >&2 echo ' passed.'
@@ -263,10 +265,8 @@ while [ $# -gt 0 ]; do
 
         errors=$(
           (
-            ls "${work_dir}/package-states" | \
-              grep "\.${status#*:}\$" | \
-              sed "s|^|${work_dir}/package-states/|" | \
-              xargs -r cat | \
+            find "${work_dir}/package-states" -name "*.${status#*:}" -exec \
+              cat {} \; | \
               sed 's|^|package-state-file |'
             ls_master_mirror 'i686' | \
               grep "${status%:*}\$" | \
diff --git a/bin/seed-build-list b/bin/seed-build-list
index d2e342b..998ca21 100755
--- a/bin/seed-build-list
+++ b/bin/seed-build-list
@@ -2,8 +2,10 @@
 
 # seed the build list from differences between an x86_64 and our master mirror
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
+# shellcheck disable=SC2016
 usage() {
   >&2 echo ''
   >&2 echo 'seed-build-list [options]:'
@@ -22,11 +24,12 @@ usage() {
   >&2 echo '    Do not actually update build-list, just print it.'
   >&2 echo '  -p|--package $pkg_regex:'
   >&2 echo '    Update packages matching $pkg_regex.'
-  [ -z "$1" ] && exit 1 || exit $1
+  [ -z "$1" ] && exit 1 || exit "$1"
 }
 
 tmp_dir=$(mktemp -d)
-trap "rm -rf --one-file-system '${tmp_dir}'" EXIT
+# shellcheck disable=SC2064
+trap "rm -rf --one-file-system '${tmp_dir:?}'" EXIT
 
 eval set -- "$(
   getopt -o hi:m:np: \
@@ -173,36 +176,30 @@ while read -r pkg; do
   if [ -z "${pkg}" ]; then
     continue
   fi
-  success=false
-  for arch in x86_64 any; do
-    pkgbase=$(
-      curl -sS "https://www.archlinux.org/packages/community/x86_64/${pkg}/" | \
-        sed -n '
-          /Base Package:/{
-            :a
-            N
-            s|</tr>.*$||
-            Ta
-            p
-          }
-        ' | \
-        tr '<>' '\n' | \
-        grep '^a href="' | \
-        sed '
-          s|^a href="||
-          s|".*||
-          s|/$||
-          s|^.*/||
-        '
-    )
-    if [ -n "${pkgbase}" ]; then
-      echo "${pkgbase}" >> \
-        "${tmp_dir}/delta_pkgbases"
-      success=true
-      break
-    fi
-  done
-  if ! ${sucess}; then
+  pkgbase=$(
+    curl -sS "https://www.archlinux.org/packages/community/x86_64/${pkg}/" | \
+      sed -n '
+        /Base Package:/{
+          :a
+          N
+          s|</tr>.*$||
+          Ta
+          p
+        }
+      ' | \
+      tr '<>' '\n' | \
+      grep '^a href="' | \
+      sed '
+        s|^a href="||
+        s|".*||
+        s|/$||
+        s|^.*/||
+      '
+  )
+  if [ -n "${pkgbase}" ]; then
+    echo "${pkgbase}" >> \
+      "${tmp_dir}/delta_pkgbases"
+  else
     echo "${pkg}"
   fi
 done < \
@@ -248,23 +245,22 @@ if ${update}; then
   flock 9
 fi
 
-# ignore packages already on the build list
-grep -vxF 'break_loops' "${work_dir}/build-list" | \
-  awk '{print "old " $1 " " $2 " " $3 " " $4 " " $1}' > \
-  "${tmp_dir}/build-list.old"
+{
+  # ignore packages already on the build list
+  grep -vxF 'break_loops' "${work_dir}/build-list" | \
+    awk '{print "old " $1 " " $2 " " $3 " " $4 " " $1}'
 
-# ignore packages on the deletion-list
-awk '{print "delete " $1 " X X X " $1}' "${work_dir}/deletion-list" >> \
-  "${tmp_dir}/build-list.old"
+  # ignore packages on the deletion-list
+  awk '{print "delete " $1 " X X X " $1}' "${work_dir}/deletion-list"
 
-# ignore packages on the blacklist
-git -C "${repo_paths__archlinux32}" archive "$(cat "${work_dir}/archlinux32.revision")" -- blacklist | \
-  tar -Ox blacklist | \
-  awk '{print "blacklist " $1 " X X X " $1}' >> \
-  "${tmp_dir}/build-list.old"
+  # ignore packages on the blacklist
+  git -C "${repo_paths__archlinux32}" archive "$(cat "${work_dir}/archlinux32.revision")" -- blacklist | \
+    tar -Ox blacklist | \
+    awk '{print "blacklist " $1 " X X X " $1}'
 
-# ignore explicitely ignored packages
-awk '{print "ignore " $1 " X X X " $1}' "${tmp_dir}/ignore_packages" >> \
+  # ignore explicitely ignored packages
+  awk '{print "ignore " $1 " X X X " $1}' "${tmp_dir}/ignore_packages"
+} > \
   "${tmp_dir}/build-list.old"
 
 if ${update}; then
diff --git a/bin/show-dependencies b/bin/show-dependencies
index a2677bd..f6110d3 100755
--- a/bin/show-dependencies
+++ b/bin/show-dependencies
@@ -1,13 +1,13 @@
 #!/bin/sh
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 # Create a lock file.
 
 if [ $# -eq 0 ]; then
   broken=$(
-    ls "${work_dir}/package-states" | \
-      grep '\.broken$' | \
+    find "${work_dir}/package-states" -maxdepth 1 -name '*.broken' -printf '%f\n' | \
       sed 's|\(\.[^.]\+\)\{4\}$||' | \
       sort -u
   )
@@ -15,10 +15,8 @@ if [ $# -eq 0 ]; then
   sum=''
   tmp_dir=$(mktemp -d)
   trap 'rm -rf --one-file-system "${tmp_dir}"' EXIT
-  ls "${work_dir}/package-infos" | \
-    grep '\.builds$' | \
-    sed "s|^|${work_dir}/package-infos/|" | \
-    xargs grep -HF '' | \
+  find "${work_dir}/package-infos" -name '*.builds' -exec \
+    grep -HF '' {} \; | \
     sed '
       s|^.*/||
       s|\(\.[^.]\+\)\{4\}:| |
@@ -27,17 +25,16 @@ if [ $# -eq 0 ]; then
     "${tmp_dir}/builds"
   while ! [ "${new_sum}" = "${sum}" ]; do
     sum="${new_sum}"
+    # shellcheck disable=SC2086
     printf '%s\n' ${broken} | \
       sort > \
       "${tmp_dir}/broken"
     broken=$(
       (
-        ls "${work_dir}/package-infos" | \
-          grep '\.depends$' | \
-          sed 's|^\(.*\)\(\.[^.]\+\)\{4\}|\1 \0|' | \
+        find "${work_dir}/package-infos" -maxdepth 1 -name '*.depends' | \
+          sed 's|^.*/\(.*\)\(\.[^.]\+\)\{4\}|\1 \0|' | \
           sort -k1,1 | \
           join -1 1 -2 1 -o 1.2 - "${tmp_dir}/broken" | \
-          sed "s|^|${work_dir}/package-infos/|" | \
           xargs -r cat
       ) | \
         sort -u | \
@@ -46,6 +43,7 @@ if [ $# -eq 0 ]; then
     broken=$(
       (
         (
+          # shellcheck disable=SC2086
           printf '%s\n' ${broken}
           cat "${tmp_dir}/broken"
         ) | \
@@ -57,6 +55,7 @@ if [ $# -eq 0 ]; then
         uniq -d
     )
     new_sum=$(
+      # shellcheck disable=SC2086
       printf '%s\n' ${broken} | \
         sha512sum
     )
@@ -66,6 +65,7 @@ if [ $# -eq 0 ]; then
   trap - EXIT
   broken=$(
     (
+      # shellcheck disable=SC2086
       printf '%s\n' ${broken}
       (
         ls "${webserver_directory}/graphs" | \
@@ -82,9 +82,11 @@ if [ $# -eq 0 ]; then
     ) | \
       sort -u
   )
+  # shellcheck disable=SC2086
   "$0" 'ALL' ${broken}
   (
     ls "${webserver_directory}/graphs"
+    # shellcheck disable=SC2086
     printf '%s.png\n' ${broken} ${broken} 'ALL' 'ALL'
   ) | \
     sort | \
@@ -94,6 +96,7 @@ if [ $# -eq 0 ]; then
   exit
 fi
 
+# shellcheck disable=SC2009
 if ps ax | \
   grep -v grep | \
   grep -v "^\s*$$\s" | \
@@ -137,21 +140,19 @@ ls "${work_dir}/package-infos" | \
   sort -u > \
   "${tmp_dir}/known-packages"
 
-ls "${work_dir}/package-infos" | \
-  grep '\.groups$' | \
-  while read -r pf; do
-    cat "${work_dir}/package-infos/${pf}" | \
-      xargs -r printf "${pf%.*.*.*.*} %s\n" >> \
-      "${tmp_dir}/known-groups"
-  done
+find "${work_dir}/package-infos" -maxdepth 1 -name '*.groups' -printf '%f %p\n' | \
+  while read -r name pf; do
+    xargs -r printf "${name%.*.*.*.*} %s\n" < \
+      "${pf}"
+  done > \
+  "${tmp_dir}/known-groups"
 
-ls "${work_dir}/package-infos" | \
-  grep '\.packages$' | \
-  while read -r pf; do
-    grep -vxF "${pf%.*.*.*.*}" "${work_dir}/package-infos/${pf}" | \
-      xargs -r printf "${pf%.*.*.*.*} %s\n" >> \
-      "${tmp_dir}/known-split-packages"
-  done
+find "${work_dir}/package-infos" -maxdepth 1 -name '*.packages' -printf '%f %p\n' | \
+  while read -r name pf; do
+    grep -vxF "${name%.*.*.*.*}" "${pf}" | \
+      xargs -r printf "${name%.*.*.*.*} %s\n"
+  done > \
+  "${tmp_dir}/known-split-packages"
 
 for target_package in "$@"; do
 
@@ -231,7 +232,7 @@ for target_package in "$@"; do
     "${tmp_dir}/build-order" | \
     sort -u | \
     join -j 1 - "${tmp_dir}/build-list.sorted-by-package" | \
-    while read pkg rev mod_rev repo; do
+    while read -r pkg rev mod_rev repo; do
       if [ -f "${work_dir}/package-states/${pkg}.${rev}.${mod_rev}.${repo}.broken" ]; then
         printf '1 broken-build-list-package %s\n' "${pkg}"
       else
@@ -308,7 +309,7 @@ for target_package in "$@"; do
       }'
 
     ls "${tmp_dir}/neighbours" | \
-      while read file; do
+      while read -r file; do
         sed "
             s@\(^\| \)$(str_to_regex "${file}")\( \|\$\)@\1<knot>\2@
           " "${tmp_dir}/neighbours/${file}" | \
@@ -349,41 +350,42 @@ for target_package in "$@"; do
   sort -u "${tmp_dir}/knots" | \
     sponge "${tmp_dir}/knots"
 
-  printf '%s\n' \
-    'digraph dependencies {' \
-    '  fontname=dejavu;' > \
-    "${tmp_dir}/input"
+  {
+    printf '%s\n' \
+      'digraph dependencies {' \
+      '  fontname=dejavu;'
+
+    cut -d' ' -f1,3 < \
+      "${tmp_dir}/knots" | \
+      while read -r who what; do
+        if [ "${what}" = 'broken-build-list-package' ]; then
+          color='#ff0000'
+        elif [ "${what}" = 'build-list-package' ]; then
+          color='#800000'
+        elif [ "${what}" = 'target-package' ]; then
+          color='#00ff00'
+        elif [ "${what}" = 'package' ]; then
+          color='#000000'
+        elif [ "${what}" = 'split-package' ]; then
+          color='#8080ff'
+        elif [ "${what}" = 'group' ]; then
+          color='#0000ff'
+        elif [ "${what}" = 'deletion-list-package' ]; then
+          color='#808080'
+        else
+          color='#ff80ff'
+        fi
+        printf '  "%s" [fontcolor="%s"];\n' "${who}" "${color}"
+      done
 
-  while read -r who num what; do
-    if [ "${what}" = 'broken-build-list-package' ]; then
-      color='#ff0000'
-    elif [ "${what}" = 'build-list-package' ]; then
-      color='#800000'
-    elif [ "${what}" = 'target-package' ]; then
-      color='#00ff00'
-    elif [ "${what}" = 'package' ]; then
-      color='#000000'
-    elif [ "${what}" = 'split-package' ]; then
-      color='#8080ff'
-    elif [ "${what}" = 'group' ]; then
-      color='#0000ff'
-    elif [ "${what}" = 'deletion-list-package' ]; then
-      color='#808080'
-    else
-      color='#ff80ff'
-    fi
-    printf '  "%s" [fontcolor="%s"];\n' "${who}" "${color}"
-  done < \
-    "${tmp_dir}/knots" >> \
-    "${tmp_dir}/input"
+    sed 's|\\|\\\\|g' "${tmp_dir}/build-order" | \
+      xargs -rn2 printf '  "%s" -> "%s";\n' | \
+      sort -u
 
-  sed 's|\\|\\\\|g' "${tmp_dir}/build-order" | \
-    xargs -rn2 printf '  "%s" -> "%s";\n' | \
-    sort -u >> \
-    "${tmp_dir}/input"
+    printf '%s\n' \
+      '}'
 
-  printf '%s\n' \
-    '}' >> \
+  } > \
     "${tmp_dir}/input"
 
   sed -i '
diff --git a/bin/slave-build-connect b/bin/slave-build-connect
index 4ef2b2b..497c96f 100755
--- a/bin/slave-build-connect
+++ b/bin/slave-build-connect
@@ -1,5 +1,6 @@
 #!/bin/sh
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 if [ "${SSH_ORIGINAL_COMMAND%% *}" = "get-assignment" ] || \
diff --git a/bin/strict-bashism-check b/bin/strict-bashism-check
index a6694f4..1bcfdfd 100755
--- a/bin/strict-bashism-check
+++ b/bin/strict-bashism-check
@@ -21,8 +21,8 @@ if [ "$allownonascii" != "true" ] &&
   # Note that the use of brackets around a tr range is ok here, (it's
   # even required, for portability to Solaris 10's /usr/bin/tr), since
   # the square bracket bytes happen to fall in the designated range.
-  test $(git diff --cached --name-only --diff-filter=A -z $against |
-    LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0
+  test "$(git diff --cached --name-only --diff-filter=A -z $against |
+    LC_ALL=C tr -d '[ -~]\0' | wc -c)" != 0
 then
   cat <<\EOF
 Error: Attempt to add a non-ASCII file name.
@@ -50,7 +50,8 @@ git archive "${tree}" | \
   tar -C "${tmp_dir}" -x
 
 errors=$(
-  cd "${tmp_dir}"
+  cd "${tmp_dir}" || \
+    echo 'Cannot cd.'
   find "bin" "conf" -type f -not -executable -not -name '.gitignore'
 )
 
@@ -71,7 +72,8 @@ if [ -n "${errors}" ]; then
 fi
 
 errors=$(
-  cd "${tmp_dir}"
+  cd "${tmp_dir}" || \
+    echo 'Cannot cd.'
   checkbashisms bin/* conf/* 2>&1
 )
 
diff --git a/bin/why_dont_you b/bin/why_dont_you
index 774d19c..a03f50f 100755
--- a/bin/why_dont_you
+++ b/bin/why_dont_you
@@ -4,6 +4,7 @@
 
 # investigate, why a certain operation is not done with certain packages
 
+# shellcheck source=conf/default.conf
 . "${0%/*}/../conf/default.conf"
 
 action="$1"
@@ -59,7 +60,7 @@ case "${action}" in
 
     for pkg in "$@"; do
 
-      if ! ls -1 "${work_dir}/package-states" | \
+      if ! find "${work_dir}/package-states" -maxdepth 1 -printf '%f\n' | \
         grep -q "^$(str_to_regex "${pkg}")\(\.[^.]\+\)\{3\}\.done\$"; then
         printf '"%s" is not in staging!\n' "${pkg}"
         continue
@@ -132,7 +133,7 @@ case "${action}" in
     while read -r pkg; do
 
       if builds_file=$(
-        ls "${work_dir}/package-infos" | \
+        find "${work_dir}/package-infos" -maxdepth 1 -printf '%f\n' | \
           grep -m1 "^$(str_to_regex "${pkg}")\(\.[^.]\+\)\{3\}\.builds\$"
         ); then
 
@@ -215,22 +216,21 @@ case "${action}" in
         continue
       fi
 
-      if ! needs=$(
-          ls "${work_dir}/package-infos" | \
-            grep "^$(str_to_regex "${pkg}")\..*\.needs\$"
-        ); then
+      needs=$(
+        find "${work_dir}/package-infos" -maxdepth 1 -name "${pkg}.*.needs"
+      )
+      if [ -z "${needs}" ]; then
         printf 'Package "%s" was deleted in the git repositories.\n' "${pkg}"
         continue
       fi
 
       needs=$(
-        printf "${work_dir}/package-infos/%s\n" ${needs} | \
-          xargs -r cat | \
-          sort -u
+        sort -u "${needs}"
       )
 
       errors=$(
         (
+          # shellcheck disable=SC2086
           printf '%s\n' ${needs}
           awk '{print $3}' "${tmp_file}" | \
             sort -u
@@ -241,6 +241,7 @@ case "${action}" in
       )
       if [ -n "${errors}" ]; then
         printf 'Package "%s" has dependencies on the deletion list:\n' "${pkg}"
+        # shellcheck disable=SC2086,SC2183
         printf '%s %s %s\n' ${errors}
         printf '\n'
         continue