From ae7ccc59959ce45948bd6b767d8559ff9715cdbf Mon Sep 17 00:00:00 2001
From: Jonas Weber <github@jonasw.de>
Date: Tue, 2 Oct 2018 21:44:27 +0200
Subject: [PATCH] Fix SC2086 on all scripts

Relevant documentation: https://github.com/koalaman/shellcheck/wiki/SC2086

relates to: #540

This commit addresses 241 separate cases of missing quotes around
variables.
---
 cdist/conf/explorer/cpu_cores                 |  2 +-
 cdist/conf/explorer/cpu_sockets               |  2 +-
 cdist/conf/explorer/lsb_codename              |  2 +-
 cdist/conf/explorer/lsb_description           |  2 +-
 cdist/conf/explorer/lsb_id                    |  2 +-
 cdist/conf/explorer/lsb_release               |  2 +-
 cdist/conf/explorer/os_version                |  2 +-
 cdist/conf/type/__apt_ppa/gencode-remote      |  4 ++--
 .../type/__ccollect_source/gencode-remote     | 16 ++++++-------
 cdist/conf/type/__ccollect_source/manifest    |  2 +-
 cdist/conf/type/__cron/explorer/entry         |  4 ++--
 cdist/conf/type/__daemontools/manifest        |  4 ++--
 .../conf/type/__daemontools_service/manifest  |  4 ++--
 cdist/conf/type/__directory/gencode-remote    | 16 ++++++-------
 cdist/conf/type/__docker/manifest             | 10 ++++----
 .../conf/type/__docker_compose/gencode-remote |  4 ++--
 cdist/conf/type/__docker_compose/manifest     |  4 ++--
 cdist/conf/type/__file/gencode-remote         | 16 ++++++-------
 .../conf/type/__firewalld_rule/explorer/rule  |  2 +-
 .../conf/type/__firewalld_rule/gencode-remote |  8 +++----
 cdist/conf/type/__git/explorer/group          |  2 +-
 cdist/conf/type/__git/explorer/owner          |  2 +-
 cdist/conf/type/__grafana_dashboard/manifest  |  4 ++--
 cdist/conf/type/__group/explorer/gshadow      |  2 +-
 cdist/conf/type/__group/gencode-remote        |  8 +++----
 .../__install_bootloader_grub/gencode-remote  |  2 +-
 .../__install_generate_fstab/gencode-local    |  4 ++--
 .../gencode-remote                            | 14 +++++------
 cdist/conf/type/__jail/manifest               |  2 +-
 cdist/conf/type/__link/explorer/type          |  2 +-
 .../conf/type/__package/explorer/pkgng_exists |  2 +-
 .../type/__package_luarocks/gencode-remote    |  4 ++--
 cdist/conf/type/__package_opkg/gencode-remote |  4 ++--
 .../conf/type/__package_pacman/gencode-remote |  4 ++--
 .../type/__package_pkg_freebsd/gencode-remote |  2 +-
 .../type/__package_rubygem/gencode-remote     |  4 ++--
 .../__package_update_index/explorer/currage   |  2 +-
 .../type/__package_update_index/explorer/type |  2 +-
 .../__package_update_index/gencode-remote     |  2 +-
 .../type/__package_upgrade_all/gencode-remote |  4 ++--
 cdist/conf/type/__package_yum/gencode-remote  |  4 ++--
 .../conf/type/__package_zypper/gencode-remote |  6 ++---
 cdist/conf/type/__pacman_conf/manifest        | 24 +++++++++----------
 .../type/__pacman_conf_integrate/manifest     | 10 ++++----
 cdist/conf/type/__pf_apply/explorer/rcvar     |  2 +-
 cdist/conf/type/__pf_ruleset/explorer/cksum   |  2 +-
 cdist/conf/type/__pf_ruleset/explorer/rcvar   |  2 +-
 .../type/__prometheus_alertmanager/manifest   |  2 +-
 .../conf/type/__prometheus_exporter/manifest  |  8 +++----
 cdist/conf/type/__prometheus_server/manifest  |  6 ++---
 cdist/conf/type/__pyvenv/explorer/group       |  2 +-
 cdist/conf/type/__pyvenv/explorer/owner       |  2 +-
 cdist/conf/type/__pyvenv/gencode-remote       |  2 +-
 cdist/conf/type/__qemu_img/gencode-remote     |  2 +-
 cdist/conf/type/__rsync/gencode-local         |  2 +-
 cdist/conf/type/__rvm/explorer/state          |  2 +-
 .../type/__ssh_authorized_key/explorer/entry  |  2 +-
 .../type/__ssh_authorized_key/gencode-remote  |  2 +-
 .../conf/type/__start_on_boot/gencode-remote  | 10 ++++----
 cdist/conf/type/__start_on_boot/manifest      |  2 +-
 cdist/conf/type/__user/explorer/shadow        |  2 +-
 cdist/conf/type/__user/gencode-remote         |  6 ++---
 cdist/conf/type/__zypper_repo/gencode-remote  |  8 +++----
 .../__zypper_service/explorer/service_uri     |  2 +-
 .../conf/type/__zypper_service/gencode-remote | 16 ++++++-------
 65 files changed, 154 insertions(+), 154 deletions(-)

diff --git a/cdist/conf/explorer/cpu_cores b/cdist/conf/explorer/cpu_cores
index 2f676f7a..27cc6800 100755
--- a/cdist/conf/explorer/cpu_cores
+++ b/cdist/conf/explorer/cpu_cores
@@ -31,7 +31,7 @@ case "$os" in
     *)
         if [ -r /proc/cpuinfo ]; then
             cores="$(grep "core id" /proc/cpuinfo | sort | uniq | wc -l)"
-            if [ ${cores} -eq 0 ]; then
+            if [ "${cores}" -eq 0 ]; then
                 cores="1"
             fi
             echo "$cores"
diff --git a/cdist/conf/explorer/cpu_sockets b/cdist/conf/explorer/cpu_sockets
index 2d577043..a32e2f00 100755
--- a/cdist/conf/explorer/cpu_sockets
+++ b/cdist/conf/explorer/cpu_sockets
@@ -31,7 +31,7 @@ case "$os" in
     *)
     if [ -r /proc/cpuinfo ]; then
         sockets="$(grep "physical id" /proc/cpuinfo | sort -u | wc -l)"
-        if [ ${sockets} -eq 0 ]; then
+        if [ "${sockets}" -eq 0 ]; then
             sockets="$(grep -c "processor" /proc/cpuinfo)"
         fi
         echo "${sockets}"
diff --git a/cdist/conf/explorer/lsb_codename b/cdist/conf/explorer/lsb_codename
index eebd3e0f..bfabd444 100755
--- a/cdist/conf/explorer/lsb_codename
+++ b/cdist/conf/explorer/lsb_codename
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("$__explorer/os")" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_CODENAME")
    ;;
diff --git a/cdist/conf/explorer/lsb_description b/cdist/conf/explorer/lsb_description
index 23f45421..441fdbf3 100755
--- a/cdist/conf/explorer/lsb_description
+++ b/cdist/conf/explorer/lsb_description
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("$__explorer/os")" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_DESCRIPTION")
    ;;
diff --git a/cdist/conf/explorer/lsb_id b/cdist/conf/explorer/lsb_id
index 9754eb63..1a12b610 100755
--- a/cdist/conf/explorer/lsb_id
+++ b/cdist/conf/explorer/lsb_id
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("$__explorer/os")" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_ID")
    ;;
diff --git a/cdist/conf/explorer/lsb_release b/cdist/conf/explorer/lsb_release
index 35b5547c..25eb95b1 100755
--- a/cdist/conf/explorer/lsb_release
+++ b/cdist/conf/explorer/lsb_release
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("$__explorer/os")" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_RELEASE")
    ;;
diff --git a/cdist/conf/explorer/os_version b/cdist/conf/explorer/os_version
index 380782cc..4c41695b 100755
--- a/cdist/conf/explorer/os_version
+++ b/cdist/conf/explorer/os_version
@@ -22,7 +22,7 @@
 #
 #
 
-case "$($__explorer/os)" in
+case "$("$__explorer/os")" in
    amazon)
       cat /etc/system-release
    ;;
diff --git a/cdist/conf/type/__apt_ppa/gencode-remote b/cdist/conf/type/__apt_ppa/gencode-remote
index f60cb7ac..25dec58d 100755
--- a/cdist/conf/type/__apt_ppa/gencode-remote
+++ b/cdist/conf/type/__apt_ppa/gencode-remote
@@ -29,9 +29,9 @@ fi
 
 case "$state_should" in
    present)
-      echo add-apt-repository \"$name\"
+      echo "add-apt-repository \"$name\""
    ;;
    absent)
-      echo remove-apt-repository \"$name\"
+      echo "remove-apt-repository \"$name\""
    ;;
 esac
diff --git a/cdist/conf/type/__ccollect_source/gencode-remote b/cdist/conf/type/__ccollect_source/gencode-remote
index 763f219e..5f2f97e3 100755
--- a/cdist/conf/type/__ccollect_source/gencode-remote
+++ b/cdist/conf/type/__ccollect_source/gencode-remote
@@ -42,18 +42,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \"$1\" \"$destination\"
-    echo chgrp $1 >> "$__messages_out"
+    echo chgrp \""$1"\" \""$destination"\"
+    echo chgrp "$1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \"$1\" \"$destination\"
-    echo chown $1 >> "$__messages_out"
+    echo chown \""$1"\" \""$destination"\"
+    echo chown "$1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \"$1\" \"$destination\"
-   echo chmod $1 >> "$__messages_out"
+   echo chmod \""$1"\" \""$destination"\"
+   echo chmod "$1" >> "$__messages_out"
 }
 
 set_attributes=
@@ -67,7 +67,7 @@ case "$state_should" in
 
             # change 0xxx format to xxx format => same as stat returns
             if [ "$attribute" = mode ]; then
-                value_should="$(echo $value_should | sed 's/^0\(...\)/\1/')"
+                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
             fi
             
             value_is="$(get_current_value "$attribute" "$value_should")"
@@ -81,7 +81,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \"$destination\"
+            echo rm -f \""$destination"\"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__ccollect_source/manifest b/cdist/conf/type/__ccollect_source/manifest
index 26c6cc99..727a4c97 100755
--- a/cdist/conf/type/__ccollect_source/manifest
+++ b/cdist/conf/type/__ccollect_source/manifest
@@ -55,5 +55,5 @@ if [ -f "$__object/parameter/exclude" ]; then
 fi
 
 if [ -f "$__object/parameter/create-destination" ]; then
-    __directory "${destination}" --parents --state ${state}
+    __directory "${destination}" --parents --state "${state}"
 fi
diff --git a/cdist/conf/type/__cron/explorer/entry b/cdist/conf/type/__cron/explorer/entry
index 2167e045..801861a3 100644
--- a/cdist/conf/type/__cron/explorer/entry
+++ b/cdist/conf/type/__cron/explorer/entry
@@ -24,7 +24,7 @@ user="$(cat "$__object/parameter/user")"
 
 if [ -f "$__object/parameter/raw_command" ]; then
     command="$(cat "$__object/parameter/command")"
-    crontab -u $user -l 2>/dev/null | grep "^$command\$" || true
+    crontab -u "$user" -l 2>/dev/null | grep "^$command\$" || true
 else
-    crontab -u $user -l 2>/dev/null | grep "# $name\$" || true
+    crontab -u "$user" -l 2>/dev/null | grep "# $name\$" || true
 fi
diff --git a/cdist/conf/type/__daemontools/manifest b/cdist/conf/type/__daemontools/manifest
index 45ce3df6..656f4984 100755
--- a/cdist/conf/type/__daemontools/manifest
+++ b/cdist/conf/type/__daemontools/manifest
@@ -3,8 +3,8 @@
 pkg=$(cat "$__object/parameter/from-package")
 servicedir=$(cat "$__object/parameter/servicedir")
 
-__package $pkg
-__directory $servicedir --mode 700
+__package "$pkg"
+__directory "$servicedir" --mode 700
 
 os=$(cat "$__global/explorer/os")
 init=$(cat "$__global/explorer/init")
diff --git a/cdist/conf/type/__daemontools_service/manifest b/cdist/conf/type/__daemontools_service/manifest
index 9e8e0bee..78bae285 100755
--- a/cdist/conf/type/__daemontools_service/manifest
+++ b/cdist/conf/type/__daemontools_service/manifest
@@ -25,14 +25,14 @@ badusage() {
 [ -z "$run$runfile" ] && badusage
 [ -n "$run" ] && [ -n "$runfile" ] && badusage
 
-__directory $servicedir/$name/log/main --parents
+__directory "$servicedir/$name/log/main" --parents
 
 echo "$RUN_PREFIX$run" | require="__directory/$servicedir/$name/log/main" __config_file "$servicedir/$name/run" \
 	--onchange "svc -t '$servicedir/$name' 2>/dev/null" \
 	--mode 755 \
 	--source "${runfile:--}"
 
-echo "$RUN_PREFIX$logrun" | require="__directory/$servicedir/$name/log/main" __config_file $servicedir/$name/log/run \
+echo "$RUN_PREFIX$logrun" | require="__directory/$servicedir/$name/log/main" __config_file "$servicedir/$name/log/run" \
 	--onchange "svc -t '$servicedir/$name/log' 2>/dev/null" \
 	--mode 755 \
 	--source "-"
diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote
index cced4624..35866eb4 100755
--- a/cdist/conf/type/__directory/gencode-remote
+++ b/cdist/conf/type/__directory/gencode-remote
@@ -57,18 +57,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp $recursive \"$1\" \"$destination\"
-    echo chgrp $recursive $1 >> "$__messages_out"
+    echo chgrp "$recursive" \""$1"\" \""$destination"\"
+    echo chgrp "$recursive" "$1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown $recursive \"$1\" \"$destination\"
-    echo chown $recursive $1 >> "$__messages_out"
+    echo chown "$recursive" \""$1"\" \""$destination"\"
+    echo chown "$recursive" "$1" >> "$__messages_out"
 }
 
 set_mode() {
-    echo chmod $recursive \"$1\" \"$destination\"
-    echo chmod $recursive $1 >> "$__messages_out"
+    echo chmod "$recursive" \""$1"\" \""$destination"\"
+    echo chmod "$recursive" "$1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -94,7 +94,7 @@ case "$state_should" in
 
             # change 0xxx format to xxx format => same as stat returns
             if [ "$attribute" = mode ]; then
-                value_should="$(echo $value_should | sed 's/^0\(...\)/\1/')"
+                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
             fi
 
             if [ "$set_attributes" = 1 ] || [ "$value_should" != "$value_is" ]; then
@@ -105,7 +105,7 @@ case "$state_should" in
    ;;
    absent)
         if [ "$type" = "directory" ]; then
-            echo rm -rf \"$destination\"
+            echo rm -rf \""$destination"\"
             echo remove >> "$__messages_out"
         fi
    ;;
diff --git a/cdist/conf/type/__docker/manifest b/cdist/conf/type/__docker/manifest
index e0558b46..35760cef 100755
--- a/cdist/conf/type/__docker/manifest
+++ b/cdist/conf/type/__docker/manifest
@@ -31,8 +31,8 @@ case "$os" in
             --enabled \
             --gpgcheck 1 \
             --gpgkey 'https://download.docker.com/linux/centos/gpg' \
-            --state ${state}
-          require="__yum_repo/docker-ce-stable" __package docker-ce --state ${state}
+            --state "${state}"
+          require="__yum_repo/docker-ce-stable" __package docker-ce --state "${state}"
         else
           echo "CentOS version 7 is required!" >&2
           exit 1
@@ -45,14 +45,14 @@ case "$os" in
         __package gnupg2
       fi
       __apt_key_uri docker --name "Docker Release (CE deb) <docker@docker.com>" \
-        --uri "https://download.docker.com/linux/${os}/gpg" --state ${state}
+        --uri "https://download.docker.com/linux/${os}/gpg" --state "${state}"
       export CDIST_ORDER_DEPENDENCY=on
       __apt_source docker \
          --uri "https://download.docker.com/linux/${os}" \
          --distribution "$(cat "$__global/explorer/lsb_codename")" \
-         --state ${state} \
+         --state "${state}" \
          --component "stable"
-      __package docker-ce --state ${state}
+      __package docker-ce --state "${state}"
       unset CDIST_ORDER_DEPENDENCY
    ;;
    *)
diff --git a/cdist/conf/type/__docker_compose/gencode-remote b/cdist/conf/type/__docker_compose/gencode-remote
index 2b8267a9..396c93ac 100755
--- a/cdist/conf/type/__docker_compose/gencode-remote
+++ b/cdist/conf/type/__docker_compose/gencode-remote
@@ -22,9 +22,9 @@
 version="$(cat "$__object/parameter/version")"
 state="$(cat "$__object/parameter/state")"
 
-if [ ${state} = "present" ]; then
+if [ "${state}" = "present" ]; then
     # Download docker-compose file
-        echo 'curl -L "https://github.com/docker/compose/releases/download/'${version}'/docker-compose-$(uname -s)-$(uname -m)" -o /tmp/docker-compose'
+        echo 'curl -L "https://github.com/docker/compose/releases/download/'"${version}"'/docker-compose-$(uname -s)-$(uname -m)" -o /tmp/docker-compose'
         echo 'mv /tmp/docker-compose /usr/local/bin/docker-compose'
     # Change permissions
     echo 'chmod +x /usr/local/bin/docker-compose'
diff --git a/cdist/conf/type/__docker_compose/manifest b/cdist/conf/type/__docker_compose/manifest
index c17f0f33..f7de3a76 100755
--- a/cdist/conf/type/__docker_compose/manifest
+++ b/cdist/conf/type/__docker_compose/manifest
@@ -22,10 +22,10 @@
 state="$(cat "$__object/parameter/state")"
 
 # Needed packages
-if [ ${state} = "present" ]; then
+if [ "${state}" = "present" ]; then
     __docker
     __package curl
-elif [ ${state} = "absent" ]; then
+elif [ "${state}" = "absent" ]; then
     __file /usr/local/bin/docker-compose --state absent
 else
     echo "Unknown state: ${state}" >&2
diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote
index 9dfd1833..ebc30fd9 100755
--- a/cdist/conf/type/__file/gencode-remote
+++ b/cdist/conf/type/__file/gencode-remote
@@ -43,18 +43,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \"$1\" \"$destination\"
-    echo chgrp $1 >> "$__messages_out"
+    echo chgrp \""$1"\" \""$destination"\"
+    echo chgrp "$1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \"$1\" \"$destination\"
-    echo chown $1 >> "$__messages_out"
+    echo chown \""$1"\" \""$destination"\"
+    echo chown "$1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \"$1\" \"$destination\"
-   echo chmod $1 >> "$__messages_out"
+   echo chmod \""$1"\" \""$destination"\"
+   echo chmod "$1" >> "$__messages_out"
 }
 
 set_attributes=
@@ -68,7 +68,7 @@ case "$state_should" in
 
             # change 0xxx format to xxx format => same as stat returns
             if [ "$attribute" = mode ]; then
-                value_should="$(echo $value_should | sed 's/^0\(...\)/\1/')"
+                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
             fi
             
             value_is="$(get_current_value "$attribute" "$value_should")"
@@ -82,7 +82,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \"$destination\"
+            echo rm -f \""$destination"\"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__firewalld_rule/explorer/rule b/cdist/conf/type/__firewalld_rule/explorer/rule
index 5a0e0265..0234e5b6 100644
--- a/cdist/conf/type/__firewalld_rule/explorer/rule
+++ b/cdist/conf/type/__firewalld_rule/explorer/rule
@@ -25,7 +25,7 @@ chain="$(cat "$__object/parameter/chain")"
 priority="$(cat "$__object/parameter/priority")"
 rule="$(cat "$__object/parameter/rule")"
 
-if firewall-cmd --permanent --direct --query-rule "$protocol" "$table" "$chain" "$priority" $rule >/dev/null; then
+if firewall-cmd --permanent --direct --query-rule "$protocol" "$table" "$chain" "$priority" "$rule" >/dev/null; then
     echo present
 else
     echo absent
diff --git a/cdist/conf/type/__firewalld_rule/gencode-remote b/cdist/conf/type/__firewalld_rule/gencode-remote
index 4c824d39..bc218d9a 100755
--- a/cdist/conf/type/__firewalld_rule/gencode-remote
+++ b/cdist/conf/type/__firewalld_rule/gencode-remote
@@ -33,13 +33,13 @@ rule="$(cat "$__object/parameter/rule")"
 
 case "$state_should" in
     present)
-        echo firewall-cmd --quiet --permanent --direct --add-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
-        echo firewall-cmd --quiet --direct --add-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
+        echo "firewall-cmd --quiet --permanent --direct --add-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule"
+        echo "firewall-cmd --quiet --direct --add-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule"
     ;;
 
     absent)
-        echo firewall-cmd --quiet --permanent --direct --remove-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
-        echo firewall-cmd --quiet --direct --remove-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
+        echo "firewall-cmd --quiet --permanent --direct --remove-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule"
+        echo "firewall-cmd --quiet --direct --remove-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule"
     ;;
     *)
         echo "Unknown state $state_should" >&2
diff --git a/cdist/conf/type/__git/explorer/group b/cdist/conf/type/__git/explorer/group
index 1308c710..3ddf9656 100644
--- a/cdist/conf/type/__git/explorer/group
+++ b/cdist/conf/type/__git/explorer/group
@@ -2,4 +2,4 @@
 
 destination="/$__object_id/.git"
 
-stat --print "%G" ${destination} 2>/dev/null || exit 0
+stat --print "%G" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__git/explorer/owner b/cdist/conf/type/__git/explorer/owner
index 8c36b035..4c3cd431 100644
--- a/cdist/conf/type/__git/explorer/owner
+++ b/cdist/conf/type/__git/explorer/owner
@@ -2,4 +2,4 @@
 
 destination="/$__object_id/.git"
 
-stat --print "%U" ${destination} 2>/dev/null || exit 0
+stat --print "%U" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest
index 308af59a..2e9bd115 100755
--- a/cdist/conf/type/__grafana_dashboard/manifest
+++ b/cdist/conf/type/__grafana_dashboard/manifest
@@ -1,7 +1,7 @@
 #!/bin/sh -e
 
-os=$(cat $__global/explorer/os)
-os_version=$(cat $__global/explorer/os_version)
+os=$(cat "$__global/explorer/os")
+os_version=$(cat "$__global/explorer/os_version")
 
 case $os in
     debian|devuan)
diff --git a/cdist/conf/type/__group/explorer/gshadow b/cdist/conf/type/__group/explorer/gshadow
index 2e2ab29d..ef40b7bc 100755
--- a/cdist/conf/type/__group/explorer/gshadow
+++ b/cdist/conf/type/__group/explorer/gshadow
@@ -22,7 +22,7 @@
 #
 
 name=$__object_id
-os="$($__explorer/os)"
+os="$("$__explorer/os")"
 
 case "$os" in
     "freebsd"|"netbsd")
diff --git a/cdist/conf/type/__group/gencode-remote b/cdist/conf/type/__group/gencode-remote
index 68475178..5b3947dc 100755
--- a/cdist/conf/type/__group/gencode-remote
+++ b/cdist/conf/type/__group/gencode-remote
@@ -63,8 +63,8 @@ if [ "$state" = "present" ]; then
                ;;
             esac
             if [ "$new_value" != "$current_value" ]; then
-               set -- "$@" "$(shorten_property $property)" \'$new_value\'
-               echo change $property $new_value $current_value >> "$__messages_out"
+               set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
+               echo "change $property $new_value $current_value" >> "$__messages_out"
             fi
          fi
       done
@@ -83,9 +83,9 @@ if [ "$state" = "present" ]; then
             new_value="$(cat "$__object/parameter/$property")"
             if [ -z "$new_value" ]; then
                # Boolean parameters have no value
-               set -- "$@" "$(shorten_property $property)"
+               set -- "$@" "$(shorten_property "$property")"
             else
-               set -- "$@" "$(shorten_property $property)" \'$new_value\'
+               set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
             fi
          fi
       done
diff --git a/cdist/conf/type/__install_bootloader_grub/gencode-remote b/cdist/conf/type/__install_bootloader_grub/gencode-remote
index 6e6e5e85..1caebbbf 100755
--- a/cdist/conf/type/__install_bootloader_grub/gencode-remote
+++ b/cdist/conf/type/__install_bootloader_grub/gencode-remote
@@ -28,7 +28,7 @@ install_script="$__object/files/install_script"
 # Link file descriptor #6 with stdout
 exec 6>&1
 # Link stdout with $install_script
-exec > $install_script
+exec > "$install_script"
 
 # Generate script to install bootloader on distro
 printf '#!/bin/sh -l\n'
diff --git a/cdist/conf/type/__install_generate_fstab/gencode-local b/cdist/conf/type/__install_generate_fstab/gencode-local
index 5cc7d877..d0f99f61 100755
--- a/cdist/conf/type/__install_generate_fstab/gencode-local
+++ b/cdist/conf/type/__install_generate_fstab/gencode-local
@@ -23,7 +23,7 @@ cat "$__type/files/fstab.header" > "$destination"
 
 mkdir "$__object/files"
 # get current UUID's from target_host
-$__remote_exec $__target_host blkid > "$__object/files/blkid"
+$__remote_exec "$__target_host" blkid > "$__object/files/blkid"
 
 for object in $(find "$__global/object/__install_mount" -type d -name "$__cdist_object_marker"); do
    device="$(cat "$object/parameter/device")"
@@ -54,7 +54,7 @@ for object in $(find "$__global/object/__install_mount" -type d -name "$__cdist_
       ;;
    esac
    if [ -f "$__object/parameter/uuid" ]; then
-      uuid="$(grep -w $device "$__object/files/blkid" | awk '{print $2}')"
+      uuid="$(grep -w "$device" "$__object/files/blkid" | awk '{print $2}')"
       if [ -n "$uuid" ]; then
          echo "# $dir was on $device during installation" >> "$destination"
          device="$uuid"
diff --git a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
index 9e5fcd00..b8100c52 100755
--- a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
+++ b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
@@ -34,9 +34,9 @@ size_to_mb() {
    size=$1
    available_size="$2"
 
-   number_suffix="$(echo ${size} | sed -e 's:\.[0-9]\+::' -e 's:\([0-9]\+\)\([KkMmGg%]\)[Bb]\?:\1|\2:')"
-   number="$(echo ${number_suffix} | cut -d '|' -f1)"
-   suffix="$(echo ${number_suffix} | cut -d '|' -f2)"
+   number_suffix="$(echo "${size}" | sed -e 's:\.[0-9]\+::' -e 's:\([0-9]\+\)\([KkMmGg%]\)[Bb]\?:\1|\2:')"
+   number="$(echo "${number_suffix}" | cut -d '|' -f1)"
+   suffix="$(echo "${number_suffix}" | cut -d '|' -f2)"
 
    case "$suffix" in
       K|k)
@@ -62,10 +62,10 @@ get_objects() {
    for object in $(find "$__global/object/__install_partition_msdos" -type d -name "$__cdist_object_marker"); do
       object_device="$(cat "$object/parameter/device")"
       object_minor="$(cat "$object/parameter/minor")"
-      echo "$object_device $object_minor $object" >> $objects_file
+      echo "$object_device $object_minor $object" >> "$objects_file"
    done
-   sort -k 1,2 $objects_file | cut -d' ' -f 3
-   rm $objects_file
+   sort -k 1,2 "$objects_file" | cut -d' ' -f 3
+   rm "$objects_file"
    unset objects_file
    unset object
    unset object_device
@@ -87,7 +87,7 @@ for object in $objects; do
    if [ "$current_device" != "$device" ]; then
       echo "create_disklabel \"$device\" || die 'Failed to create disklabel for $device'"
       current_device="$device"
-      device_name=$(echo ${device} | sed -e 's:^/dev/::;s:/:\\/:g')
+      device_name=$(echo "${device}" | sed -e 's:^/dev/::;s:/:\\/:g')
       available_device_size=$(( $(awk "/${device_name}\$/ { print \$3; }" "$partitions") / 1024))
       # make sure we don't go past the end of the drive
       available_device_size=$((available_device_size - 2))
diff --git a/cdist/conf/type/__jail/manifest b/cdist/conf/type/__jail/manifest
index 7564be26..222cb859 100755
--- a/cdist/conf/type/__jail/manifest
+++ b/cdist/conf/type/__jail/manifest
@@ -35,7 +35,7 @@ fi
 
 jaildir="$(cat "$__object/parameter/jaildir")"
 
-__directory ${jaildir} --parents
+__directory "${jaildir}" --parents
 
 set -- "$@" "$__object_id" "--state" "$state"
 cd "$__object/parameter"
diff --git a/cdist/conf/type/__link/explorer/type b/cdist/conf/type/__link/explorer/type
index 579fd081..48a79bf0 100755
--- a/cdist/conf/type/__link/explorer/type
+++ b/cdist/conf/type/__link/explorer/type
@@ -32,7 +32,7 @@ elif [ -f "$destination" ]; then
    case "$type" in
       hard)
          link_count=$(ls -l "$destination" | awk '{ print $2 }')
-         if [ $link_count -gt 1 ]; then
+         if [ "$link_count" -gt 1 ]; then
             echo hardlink
             exit 0
          fi
diff --git a/cdist/conf/type/__package/explorer/pkgng_exists b/cdist/conf/type/__package/explorer/pkgng_exists
index 355c5d65..6d69ba14 100755
--- a/cdist/conf/type/__package/explorer/pkgng_exists
+++ b/cdist/conf/type/__package/explorer/pkgng_exists
@@ -21,7 +21,7 @@
 # Retrieve the status of a package - parsed dpkg output
 #
 
-if [ "$($__explorer/os)" = "freebsd" ]; then
+if [ "$("$__explorer/os")" = "freebsd" ]; then
    command -v pkg
 fi
 
diff --git a/cdist/conf/type/__package_luarocks/gencode-remote b/cdist/conf/type/__package_luarocks/gencode-remote
index cae06b22..e14d7a8e 100755
--- a/cdist/conf/type/__package_luarocks/gencode-remote
+++ b/cdist/conf/type/__package_luarocks/gencode-remote
@@ -42,10 +42,10 @@ fi
 
 case "$state_should" in
     present)
-        echo luarocks install \"$name\"
+        echo luarocks install \""$name"\"
     ;;
     absent)
-        echo luarocks remove \"$name\"
+        echo luarocks remove \""$name"\"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_opkg/gencode-remote b/cdist/conf/type/__package_opkg/gencode-remote
index 09fe69a4..53f154a5 100755
--- a/cdist/conf/type/__package_opkg/gencode-remote
+++ b/cdist/conf/type/__package_opkg/gencode-remote
@@ -45,10 +45,10 @@ case "$state_should" in
         if [ "$present" = "notpresent" ]; then
             echo opkg --verbosity=0 update
         fi
-        echo opkg --verbosity=0 install \"$name\"
+        echo opkg --verbosity=0 install \""$name"\"
     ;;
     absent)
-        echo opkg --verbosity=0 remove \"$name\"
+        echo opkg --verbosity=0 remove \""$name"\"
     ;;
     *)
         echo "Unknown state: $state" >&2
diff --git a/cdist/conf/type/__package_pacman/gencode-remote b/cdist/conf/type/__package_pacman/gencode-remote
index 69a5d62a..43649124 100755
--- a/cdist/conf/type/__package_pacman/gencode-remote
+++ b/cdist/conf/type/__package_pacman/gencode-remote
@@ -45,10 +45,10 @@ fi
 
 case "$state_should" in
    present)
-         echo pacman --needed --noconfirm --noprogressbar -S \"$name\"
+         echo pacman --needed --noconfirm --noprogressbar -S \""$name"\"
    ;;
    absent)
-         echo pacman --noconfirm --noprogressbar -R \"$name\"
+         echo pacman --noconfirm --noprogressbar -R \""$name"\"
    ;;
    *)
       echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_pkg_freebsd/gencode-remote b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
index 012bf2ad..6c6e15b1 100755
--- a/cdist/conf/type/__package_pkg_freebsd/gencode-remote
+++ b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
@@ -33,7 +33,7 @@ assert ()                 #  If condition false,
 
 	lineno=$2
 
-	if [ ! $1 ] 
+	if [ ! "$1" ]
 	then
 		echo "Assertion failed:  \"$1\""
 		echo "File \"$0\", line $lineno, called by $(caller 0)"
diff --git a/cdist/conf/type/__package_rubygem/gencode-remote b/cdist/conf/type/__package_rubygem/gencode-remote
index 6d793ac0..d474db20 100755
--- a/cdist/conf/type/__package_rubygem/gencode-remote
+++ b/cdist/conf/type/__package_rubygem/gencode-remote
@@ -39,10 +39,10 @@ fi
 
 case "$state_should" in
     present)
-        echo gem install \"$name\" --no-ri --no-rdoc
+        echo gem install \""$name"\" --no-ri --no-rdoc
     ;;
     absent)
-        echo gem uninstall \"$name\"
+        echo gem uninstall \""$name"\"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_update_index/explorer/currage b/cdist/conf/type/__package_update_index/explorer/currage
index 50474fb3..3539b8e1 100644
--- a/cdist/conf/type/__package_update_index/explorer/currage
+++ b/cdist/conf/type/__package_update_index/explorer/currage
@@ -17,7 +17,7 @@
 # You should have received a copy of the GNU General Public License
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 
-type="$($__type_explorer/type)"
+type="$("$__type_explorer/type")"
 
 case "$type" in
     apt)
diff --git a/cdist/conf/type/__package_update_index/explorer/type b/cdist/conf/type/__package_update_index/explorer/type
index 805b9f04..35254c5f 100644
--- a/cdist/conf/type/__package_update_index/explorer/type
+++ b/cdist/conf/type/__package_update_index/explorer/type
@@ -21,7 +21,7 @@ if [ -f "$__object/parameter/type" ]; then
     cat "$__object/parameter/type"
 else
     # By default determine package manager based on operating system
-    os="$($__explorer/os)"
+    os="$("$__explorer/os")"
     case "$os" in
         amazon|scientific|centos|fedora|redhat) echo "yum" ;;
         debian|ubuntu|devuan) echo "apt" ;;
diff --git a/cdist/conf/type/__package_update_index/gencode-remote b/cdist/conf/type/__package_update_index/gencode-remote
index 8589c6d1..738d38eb 100755
--- a/cdist/conf/type/__package_update_index/gencode-remote
+++ b/cdist/conf/type/__package_update_index/gencode-remote
@@ -31,7 +31,7 @@ if [ -n "$maxage" ]; then
     if [ "$type" != "apt" ] && [ "$type" != "pacman" ]; then
         echo "ERROR: \"--maxage\" only supported for \"apt\" or \"pacman\" pkg-manager." >&2
         exit 1
-    elif [ $currage -lt $maxage ]; then
+    elif [ "$currage" -lt "$maxage" ]; then
         exit 0 # no need to update
     fi
 fi
diff --git a/cdist/conf/type/__package_upgrade_all/gencode-remote b/cdist/conf/type/__package_upgrade_all/gencode-remote
index bcad8a43..38aa001e 100755
--- a/cdist/conf/type/__package_upgrade_all/gencode-remote
+++ b/cdist/conf/type/__package_upgrade_all/gencode-remote
@@ -53,8 +53,8 @@ case "$type" in
         ;;
     apt)
         if [ -f "$apt_dist_upgrade" ]
-        then echo $aptget dist-upgrade
-        else echo $aptget upgrade
+        then echo "$aptget dist-upgrade"
+        else echo "$aptget upgrade"
         fi
 
         if [ -f "$apt_clean" ]
diff --git a/cdist/conf/type/__package_yum/gencode-remote b/cdist/conf/type/__package_yum/gencode-remote
index e1323dea..d860c48c 100755
--- a/cdist/conf/type/__package_yum/gencode-remote
+++ b/cdist/conf/type/__package_yum/gencode-remote
@@ -60,10 +60,10 @@ fi
 
 case "$state_should" in
     present)
-        echo yum $opts install \"$install_name\"
+        echo "yum $opts install \"$install_name\""
     ;;
     absent)
-        echo yum $opts remove \"$name\"
+        echo "yum $opts remove \"$name\""
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_zypper/gencode-remote b/cdist/conf/type/__package_zypper/gencode-remote
index d9372b6d..5b1b763e 100755
--- a/cdist/conf/type/__package_zypper/gencode-remote
+++ b/cdist/conf/type/__package_zypper/gencode-remote
@@ -61,15 +61,15 @@ case "$state_should" in
     present)
         if [ -z "$version_should" ]; then
             [ "$state_is" = "present" ] && exit 0 # if state is present, we dont need to do anything
-            echo zypper $globalopts install --type \"$ptype\" --auto-agree-with-licenses \"$name\" ">/dev/null"
+            echo "zypper $globalopts install --type \"$ptype\" --auto-agree-with-licenses \"$name\" >/dev/null"
         else
             [ "$state_is" = "present" ] && [ "$version_should" = "$version_is" ] && exit 0 # if state is present and version is correct, we dont need to do anything
-            echo zypper $globalopts install --oldpackage --type \"$ptype\" --auto-agree-with-licenses \"$name\" = \"$version_should\" ">/dev/null"
+            echo "zypper $globalopts install --oldpackage --type \"$ptype\" --auto-agree-with-licenses \"$name\" = \"$version_should\" >/dev/null"
         fi
     ;;
     absent)
         [ "$state_is" = "absent" ] && exit 0 # if state is absent, we dont need to do anything
-        echo zypper $globalopts remove --type \"$ptype\" \"$name\" ">/dev/null"
+        echo "zypper $globalopts remove --type \"$ptype\" \"$name\" >/dev/null"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__pacman_conf/manifest b/cdist/conf/type/__pacman_conf/manifest
index 1561d613..a43f18a1 100755
--- a/cdist/conf/type/__pacman_conf/manifest
+++ b/cdist/conf/type/__pacman_conf/manifest
@@ -59,13 +59,13 @@ if [ "${file}" ]; then
 
     if [ "${state}" = "present" ]; then
 
-        require="__file/${sec_path}/plain_file_${file}" __key_value ${file}_${key}\
-            --file ${sec_path}/plain_file_${file} --key ${key} --value ${value} --delimiter ' = '
+        require="__file/${sec_path}/plain_file_${file}" __key_value "${file}_${key}" \
+            --file "${sec_path}/plain_file_${file}" --key "${key}" --value "${value}" --delimiter ' = '
 
         exit 0
 
     elif [ "${state}" = "absent" ]; then
-        require="__file/${sec_path}/plain_file_${file}" __key_value ${file}_${key}\
+        require="__file/${sec_path}/plain_file_${file}" __key_value "${file}_${key}" \
                 --state absent
         exit 0
 
@@ -87,19 +87,19 @@ eof
 
     if [ "${MATCH}" -eq 1 ]; then
         if [ "${value}" = "on" ]; then
-            require="__file/${sec_path}/${section}" __line ${key}_${value}\
-                --file ${sec_path}/${section} --line ${key}
+            require="__file/${sec_path}/${section}" __line "${key}_${value}" \
+                --file "${sec_path}/${section}" --line "${key}"
         elif [ "${value}" = "off" ]; then
-            require="__file/${sec_path}/${section}" __line ${key}_${value}\
-                --file ${sec_path}/${section} --line ${key} --state absent
+            require="__file/${sec_path}/${section}" __line "${key}_${value}" \
+                --file "${sec_path}/${section}" --line "${key}" --state absent
         fi
         
     else
         contains_element "${key}" "${allowed_option_keys}"
 
         if [ "${MATCH}" -eq 1 ]; then
-            require="__file/${sec_path}/${section}" __key_value ${section}_${key}\
-                    --file ${sec_path}/${section} --key ${key} --value ${value} --delimiter ' = '
+            require="__file/${sec_path}/${section}" __key_value "${section}_${key}" \
+                    --file "${sec_path}/${section}" --key "${key}" --value "${value}" --delimiter ' = '
         else
             echo "Key: ${key} is not valid. Have a look at man pacman.conf" >&2
         fi
@@ -118,12 +118,12 @@ eof
             exit
         fi
     
-        require="__file/${sec_path}/repo_${section}" __key_value ${section}_${key}\
-                --file ${sec_path}/repo_${section} --key ${key} --value ${value} --delimiter ' = '
+        require="__file/${sec_path}/repo_${section}" __key_value "${section}_${key}" \
+                --file "${sec_path}/repo_${section}" --key "${key}" --value "${value}" --delimiter ' = '
 
     elif [ "${state}" = "absent" ]; then
 
-        require="__file/${sec_path}/repo_${section}" __key_value ${section}_${key}\
+        require="__file/${sec_path}/repo_${section}" __key_value "${section}_${key}" \
             --state absent
 
     else
diff --git a/cdist/conf/type/__pacman_conf_integrate/manifest b/cdist/conf/type/__pacman_conf_integrate/manifest
index b26bca50..884af74d 100755
--- a/cdist/conf/type/__pacman_conf_integrate/manifest
+++ b/cdist/conf/type/__pacman_conf_integrate/manifest
@@ -18,16 +18,16 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-state=$(cat $__object/parameter/state 2>/dev/null)
+state=$(cat "$__object/parameter/state" 2>/dev/null)
 
 path="/etc/"
 
 if [ "${state}" = "present" ]; then
     __file /etc/pacman.conf\
-        --owner root --group root --mode 644 --source $__type/files/pacman.conf.cdist
+        --owner root --group root --mode 644 --source "$__type/files/pacman.conf.cdist"
 
     __file /etc/pacman.d/options\
-        --owner root --group root --mode 644 --source $__type/files/options
+        --owner root --group root --mode 644 --source "$__type/files/options"
 
     __file /etc/pacman.d/repo_empty_placeholder\
         --owner root --group root --mode 644
@@ -38,10 +38,10 @@ if [ "${state}" = "present" ]; then
 elif [ "${state}" = "absent" ]; then
 
     __file /etc/pacman.conf\
-        --owner root --group root --mode 644 --source $__type/files/pacman.conf.pacman
+        --owner root --group root --mode 644 --source "$__type/files/pacman.conf.pacman"
 
     __file /etc/pacman.d/mirrorlist\
-        --owner root --group root --mode 644 --source $__type/files/mirrorlist
+        --owner root --group root --mode 644 --source "$__type/files/mirrorlist"
 
     __file /etc/pacman.d/options\
         --state absent
diff --git a/cdist/conf/type/__pf_apply/explorer/rcvar b/cdist/conf/type/__pf_apply/explorer/rcvar
index 20e9dfcc..7c8d535f 100755
--- a/cdist/conf/type/__pf_apply/explorer/rcvar
+++ b/cdist/conf/type/__pf_apply/explorer/rcvar
@@ -29,7 +29,7 @@
 
 RC="/etc/rc.conf"
 PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
-echo ${PFCONF:-"/etc/pf.conf"}
+echo "${PFCONF:-"/etc/pf.conf"}"
 
 # Debug
 #set +x
diff --git a/cdist/conf/type/__pf_ruleset/explorer/cksum b/cdist/conf/type/__pf_ruleset/explorer/cksum
index f8679836..9be6c901 100755
--- a/cdist/conf/type/__pf_ruleset/explorer/cksum
+++ b/cdist/conf/type/__pf_ruleset/explorer/cksum
@@ -33,7 +33,7 @@ TMP="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
 PFCONF="${TMP:-"/etc/pf.conf"}"
 
 if [ -f "${PFCONF}" ]; then	# The pf config file exists, find its cksum.
-	cksum -o 1 ${PFCONF} | cut -d= -f2 | awk '{print $1}'
+	cksum -o 1 "${PFCONF}" | cut -d= -f2 | awk '{print $1}'
 fi
 
 # Debug
diff --git a/cdist/conf/type/__pf_ruleset/explorer/rcvar b/cdist/conf/type/__pf_ruleset/explorer/rcvar
index 20e9dfcc..7c8d535f 100755
--- a/cdist/conf/type/__pf_ruleset/explorer/rcvar
+++ b/cdist/conf/type/__pf_ruleset/explorer/rcvar
@@ -29,7 +29,7 @@
 
 RC="/etc/rc.conf"
 PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
-echo ${PFCONF:-"/etc/pf.conf"}
+echo "${PFCONF:-"/etc/pf.conf"}"
 
 # Debug
 #set +x
diff --git a/cdist/conf/type/__prometheus_alertmanager/manifest b/cdist/conf/type/__prometheus_alertmanager/manifest
index 054e44cb..3f417526 100755
--- a/cdist/conf/type/__prometheus_alertmanager/manifest
+++ b/cdist/conf/type/__prometheus_alertmanager/manifest
@@ -57,7 +57,7 @@ __key_value alertmanager_args --file /etc/default/prometheus-alertmanager \
 
 require="$require __directory/$storage_path $require_pkg" \
 __config_file $CONF \
-	--source $config \
+	--source "$config" \
 	--group prometheus --mode 640 \
 	--onchange "service prometheus-alertmanager reload"  # TODO when a config-check tool is available, check config here
 
diff --git a/cdist/conf/type/__prometheus_exporter/manifest b/cdist/conf/type/__prometheus_exporter/manifest
index ae4ed94a..35e654e2 100644
--- a/cdist/conf/type/__prometheus_exporter/manifest
+++ b/cdist/conf/type/__prometheus_exporter/manifest
@@ -2,7 +2,7 @@
 
 export GOBIN=/opt/gocode/bin  # where to find go binaries
 
-exporter="$(cat $__object/parameter/exporter)"
+exporter="$(cat "$__object/parameter/exporter")"
 [ -z "$exporter" ] && exporter="$__object_id"
 
 __user prometheus --system
@@ -18,7 +18,7 @@ case $exporter in
 	;;
 	blackbox)
 		require="$require __daemontools_service/${exporter}-exporter __user/prometheus" __config_file "/service/${exporter}-exporter/blackbox.yml" \
-			--source $__type/files/blackbox.yml \
+			--source "$__type/files/blackbox.yml" \
 			--group prometheus --mode 640 \
 			--onchange "svc -h /service/${exporter}-exporter"
 		require="$require __golang_from_vendor" __go_get github.com/prometheus/blackbox_exporter
@@ -39,9 +39,9 @@ case $exporter in
 	;;
 esac
 
-require="$require __daemontools" __daemontools_service ${exporter}-exporter --run "$run"
+require="$require __daemontools" __daemontools_service "${exporter}-exporter" --run "$run"
 if [ -f "$__object/parameter/add-consul-service" ]; then
-	__consul_service ${exporter}-exporter --port $port --check-http "http://localhost:$port/metrics" --check-interval 10s
+	__consul_service "${exporter}-exporter" --port "$port" --check-http "http://localhost:$port/metrics" --check-interval 10s
 fi
 
 #__daemontools --install-init-script
diff --git a/cdist/conf/type/__prometheus_server/manifest b/cdist/conf/type/__prometheus_server/manifest
index e2f32fd5..63b7b438 100755
--- a/cdist/conf/type/__prometheus_server/manifest
+++ b/cdist/conf/type/__prometheus_server/manifest
@@ -13,7 +13,7 @@ storage_path="$(cat "$__object/parameter/storage-path")"
 rule_files="$(cat "$__object/parameter/rule-files")"
 
 # explorer in kB => convert; by default we go with 1/2 RAM
-[ "$target_heap_size" = "auto" ] && target_heap_size=$(($(cat $__global/explorer/memory)*1024/2))
+[ "$target_heap_size" = "auto" ] && target_heap_size=$(($(cat "$__global/explorer/memory")*1024/2))
 
 ##### INSTALL THE PACKAGE ###################################################
 
@@ -55,12 +55,12 @@ __key_value prometheus_args --file /etc/default/prometheus \
 
 require="$require __directory/$storage_path $require_pkg" \
 __config_file $CONF \
-	--source $config \
+	--source "$config" \
 	--group prometheus --mode 640 \
 	--onchange "promtool check config $CONF && service prometheus reload"
 
 for file in $rule_files; do
-	dest=$CONF_DIR/$(basename $file)
+	dest=$CONF_DIR/$(basename "$file")
 	require="$require $require_pkg" \
 	__config_file "$dest" \
 		--source "$file" \
diff --git a/cdist/conf/type/__pyvenv/explorer/group b/cdist/conf/type/__pyvenv/explorer/group
index ff072c5e..a655bda7 100755
--- a/cdist/conf/type/__pyvenv/explorer/group
+++ b/cdist/conf/type/__pyvenv/explorer/group
@@ -2,4 +2,4 @@
 
 destination="/$__object_id"
 
-stat --print "%G" ${destination} 2>/dev/null || exit 0
+stat --print "%G" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__pyvenv/explorer/owner b/cdist/conf/type/__pyvenv/explorer/owner
index b77e3c6e..8b3c7f8e 100755
--- a/cdist/conf/type/__pyvenv/explorer/owner
+++ b/cdist/conf/type/__pyvenv/explorer/owner
@@ -2,4 +2,4 @@
 
 destination="/$__object_id"
 
-stat --print "%U" ${destination} 2>/dev/null || exit 0
+stat --print "%U" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__pyvenv/gencode-remote b/cdist/conf/type/__pyvenv/gencode-remote
index 4cba5987..04700683 100755
--- a/cdist/conf/type/__pyvenv/gencode-remote
+++ b/cdist/conf/type/__pyvenv/gencode-remote
@@ -47,7 +47,7 @@ fi
 case $state_should in
     present)
         if [ "$state_should" != "$state_is" ]; then
-            echo $pyvenv $venvparams "$destination"
+            echo "$pyvenv $venvparams $destination"
         fi
         if { [ -n "$owner" ] && [ "$owner_is" != "$owner" ]; } || \
            { [ -n "$group" ] && [ "$group_is" != "$group" ]; }; then
diff --git a/cdist/conf/type/__qemu_img/gencode-remote b/cdist/conf/type/__qemu_img/gencode-remote
index 9127e5ef..95d07b7a 100755
--- a/cdist/conf/type/__qemu_img/gencode-remote
+++ b/cdist/conf/type/__qemu_img/gencode-remote
@@ -18,4 +18,4 @@ format="$(cat "$__object/parameter/format")"
 size="$(cat "$__object/parameter/size")"
 diskimage="/$__object_id"
 
-echo qemu-img create -f \"$format\" \"$diskimage\" \"$size\"
+echo "qemu-img create -f \"$format\" \"$diskimage\" \"$size\""
diff --git a/cdist/conf/type/__rsync/gencode-local b/cdist/conf/type/__rsync/gencode-local
index 155f3a3a..c7196175 100755
--- a/cdist/conf/type/__rsync/gencode-local
+++ b/cdist/conf/type/__rsync/gencode-local
@@ -31,7 +31,7 @@ set --
 if [ -f "$__object/parameter/rsync-opts" ]; then
     while read opts; do
         set -- "$@" "--$opts"
-    done < $__object/parameter/rsync-opts
+    done < "$__object/parameter/rsync-opts"
 fi
 
 echo rsync -a \
diff --git a/cdist/conf/type/__rvm/explorer/state b/cdist/conf/type/__rvm/explorer/state
index f43f5509..74d17048 100755
--- a/cdist/conf/type/__rvm/explorer/state
+++ b/cdist/conf/type/__rvm/explorer/state
@@ -28,7 +28,7 @@ if [ "$user" = "root" ]; then
         echo absent
     fi
 else
-    if su - $user -c "[ -d \"\$HOME/.rvm\" ]" ; then
+    if su - "$user" -c "[ -d \"\$HOME/.rvm\" ]" ; then
        echo "present"
     else
        echo "absent"
diff --git a/cdist/conf/type/__ssh_authorized_key/explorer/entry b/cdist/conf/type/__ssh_authorized_key/explorer/entry
index 157d70f1..b528b26e 100755
--- a/cdist/conf/type/__ssh_authorized_key/explorer/entry
+++ b/cdist/conf/type/__ssh_authorized_key/explorer/entry
@@ -24,7 +24,7 @@ type_and_key="$(tr ' ' '\n' < "$__object/parameter/key"| awk '/^(ssh|ecdsa)-[^ ]
 # in greping everything in file and all entries from file are removed.
 if [ -n "${type_and_key}" ]
 then
-    file="$(cat $__object/parameter/file)"
+    file="$(cat "$__object/parameter/file")"
 
     # get any entries that match the type and key
     grep ".*$type_and_key\([ \n]\|$\)" "$file" || true
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 333dfa03..325854c2 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -88,7 +88,7 @@ fi
 entry="$(cat "$__object/files/should")"
 state_should="$(cat "$__object/parameter/state")"
 num_existing_entries=$(grep -c -F -x "$entry" "$__object/explorer/entry" || true)
-if [ $num_existing_entries -eq 1 ]; then
+if [ "$num_existing_entries" -eq 1 ]; then
    state_is="present"
 else
    # Posix grep does not define the -m option, so we can not remove a single
diff --git a/cdist/conf/type/__start_on_boot/gencode-remote b/cdist/conf/type/__start_on_boot/gencode-remote
index 14ee7dab..0ecea85b 100755
--- a/cdist/conf/type/__start_on_boot/gencode-remote
+++ b/cdist/conf/type/__start_on_boot/gencode-remote
@@ -59,11 +59,11 @@ case "$state_should" in
                 ;;
 
                 gentoo)
-                    echo rc-update add \"$name\" \"$target_runlevel\"
+                    echo "rc-update add \"$name\" \"$target_runlevel\""
                 ;;
 
                 amazon|scientific|centos|fedora|owl|redhat|suse)
-                    echo chkconfig \"$name\" on
+                    echo "chkconfig \"$name\" on"
                 ;;
 
                 openwrt)
@@ -98,15 +98,15 @@ case "$state_should" in
         else
             case "$os" in
                 debian|ubuntu|devuan)
-                    echo update-rc.d -f \"$name\" remove
+                    echo "update-rc.d -f \"$name\" remove"
                 ;;
 
                 gentoo)
-                    echo rc-update del \"$name\"  \"$target_runlevel\"
+                    echo "rc-update del \"$name\"  \"$target_runlevel\""
                 ;;
 
                 centos|fedora|owl|redhat|suse)
-                    echo chkconfig \"$name\" off
+                    echo "chkconfig \"$name\" off"
                 ;;
 
                 openwrt)
diff --git a/cdist/conf/type/__start_on_boot/manifest b/cdist/conf/type/__start_on_boot/manifest
index b9ee20e2..c1c983ec 100644
--- a/cdist/conf/type/__start_on_boot/manifest
+++ b/cdist/conf/type/__start_on_boot/manifest
@@ -16,7 +16,7 @@ case "$os" in
 	else
 	    value='NO'
 	fi
-	__key_value rcconf-$name-enable \
+	__key_value "rcconf-$name-enable" \
 	    --file /etc/rc.conf \
 	    --key "${name}_enable" \
 	    --value "\"$value\"" \
diff --git a/cdist/conf/type/__user/explorer/shadow b/cdist/conf/type/__user/explorer/shadow
index 1e6658d4..c49992d5 100755
--- a/cdist/conf/type/__user/explorer/shadow
+++ b/cdist/conf/type/__user/explorer/shadow
@@ -22,7 +22,7 @@
 #
 
 name=$__object_id
-os="$($__explorer/os)"
+os="$("$__explorer/os")"
 # Default to using shadow passwords
 database="shadow"
 
diff --git a/cdist/conf/type/__user/gencode-remote b/cdist/conf/type/__user/gencode-remote
index 332e93f1..23f01114 100755
--- a/cdist/conf/type/__user/gencode-remote
+++ b/cdist/conf/type/__user/gencode-remote
@@ -97,7 +97,7 @@ if [ "$state" = "present" ]; then
           fi
 
           if [ "$new_value" != "$current_value" ]; then
-              set -- "$@" "$(shorten_property $property)" \'$new_value\'
+              set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
           fi
        done
 
@@ -118,9 +118,9 @@ if [ "$state" = "present" ]; then
             [ "$property" = "remove-home" ] && continue
             new_value="$(cat "$property")"
             if [ -z "$new_value" ];then       # Boolean values have no value
-              set -- "$@" "$(shorten_property $property)"
+              set -- "$@" "$(shorten_property "$property")"
             else
-              set -- "$@" "$(shorten_property $property)" \'$new_value\'
+              set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
             fi
         done
 
diff --git a/cdist/conf/type/__zypper_repo/gencode-remote b/cdist/conf/type/__zypper_repo/gencode-remote
index 94c3f146..b8eeef0f 100755
--- a/cdist/conf/type/__zypper_repo/gencode-remote
+++ b/cdist/conf/type/__zypper_repo/gencode-remote
@@ -70,25 +70,25 @@ case "$state" in
          fi
          if [ -z "$repo_id" ]; then
              # Repo not present, so we need to create it 
-             echo zypper $zypper_def_opts addrepo "'$uri'" "'$desc'"
+             echo "zypper $zypper_def_opts addrepo '$uri' '$desc'"
          fi
    ;;
    absent)
          if [ ! -z "$act_id" ]; then
              # Repo present (act_id not ""), so we ned to delete it
-             echo zypper $zypper_def_opts removerepo "$act_id"
+             echo "zypper $zypper_def_opts removerepo $act_id"
          fi
    ;;
    enabled)
          if [ ! -z "$act_id" ] && [ "$repostate" = "disabled" ]; then
              # Repo present (act_id not "") and repostate not enabled, so a enable call is needed
-             echo zypper $zypper_def_opts modifyrepo -e "$act_id"
+             echo "zypper $zypper_def_opts modifyrepo -e $act_id"
          fi
    ;;
    disabled)
          if [ ! -z "$act_id" ] && [ "$repostate" = "enabled" ]; then
              # Repo present (act_id not "") and repostate enabled, so a disable call is needed
-             echo zypper $zypper_def_opts modifyrepo -d "$act_id"
+             echo "zypper $zypper_def_opts modifyrepo -d $act_id"
          fi
    ;;
    *)
diff --git a/cdist/conf/type/__zypper_service/explorer/service_uri b/cdist/conf/type/__zypper_service/explorer/service_uri
index b8de0dcd..2476ab71 100644
--- a/cdist/conf/type/__zypper_service/explorer/service_uri
+++ b/cdist/conf/type/__zypper_service/explorer/service_uri
@@ -25,4 +25,4 @@ if [ -f "$__object/parameter/uri" ]; then
 else
    uri="/$__object_id"
 fi
-zypper ls -u | awk 'BEGIN { FS = "[ ]+\\|[ ]+" } ; $4 == "Yes" && $NF == "'$uri'" {print $NF}'
+zypper ls -u | awk 'BEGIN { FS = "[ ]+\\|[ ]+" } ; $4 == "Yes" && $NF == "'"$uri"'" {print $NF}'
diff --git a/cdist/conf/type/__zypper_service/gencode-remote b/cdist/conf/type/__zypper_service/gencode-remote
index 955698d1..6701347f 100755
--- a/cdist/conf/type/__zypper_service/gencode-remote
+++ b/cdist/conf/type/__zypper_service/gencode-remote
@@ -59,10 +59,10 @@ if [ -f "$__object/parameter/remove-all-other-services" ]; then
    # file exists -> True
    for i in $exp_ids; do
      if [ "$i" != "$exp_id" ] ; then
-       echo zypper $zypper_def_opts  removeservice "$i" "&>/dev/null"
+       echo "zypper $zypper_def_opts  removeservice $i &>/dev/null"
      fi
    done 
-   echo zypper $zypper_def_opts refs "&>/dev/null"
+   echo "zypper $zypper_def_opts refs &>/dev/null"
 fi
 
 
@@ -71,14 +71,14 @@ fi
 
 case "$state_should" in
    present)
-         echo zypper $zypper_def_opts addservice -t "$stype" "$uri" \"$desc\"
-         echo zypper $zypper_def_opts refs
-         echo zypper $zypper_def_opts ref
+         echo "zypper $zypper_def_opts addservice -t $stype $uri \"$desc\""
+         echo "zypper $zypper_def_opts refs"
+         echo "zypper $zypper_def_opts ref"
    ;;
    absent)
-         echo zypper $zypper_def_opts removeservice "$service_id"
-         echo zypper $zypper_def_opts refs
-         echo zypper $zypper_def_opts ref
+         echo "zypper $zypper_def_opts removeservice $service_id"
+         echo "zypper $zypper_def_opts refs"
+         echo "zypper $zypper_def_opts ref"
    ;;
    *)
       echo "Unknown state: $state_should" >&2