From b371c42d53be71da78f0f84966e01d8a9c1cf45d Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Tue, 26 Sep 2017 21:04:46 +0200
Subject: [PATCH 01/12] shellcheck

---
 cdist/conf/explorer/cpu_cores                 |  4 +--
 cdist/conf/explorer/cpu_sockets               |  6 ++--
 cdist/conf/explorer/disks                     |  2 +-
 cdist/conf/explorer/lsb_codename              |  2 +-
 cdist/conf/explorer/lsb_description           |  2 +-
 cdist/conf/explorer/lsb_id                    |  2 +-
 cdist/conf/explorer/lsb_release               |  2 +-
 cdist/conf/explorer/machine                   |  2 +-
 cdist/conf/explorer/machine_type              |  4 +--
 cdist/conf/explorer/os_version                |  2 +-
 cdist/conf/type/__apt_ppa/gencode-remote      |  4 +--
 cdist/conf/type/__block/manifest              |  2 +-
 .../type/__ccollect_source/gencode-remote     | 19 ++++++-----
 cdist/conf/type/__ccollect_source/manifest    |  2 +-
 cdist/conf/type/__config_file/manifest        |  2 +-
 cdist/conf/type/__consul_agent/manifest       |  4 +--
 cdist/conf/type/__consul_check/manifest       |  4 +--
 cdist/conf/type/__consul_service/manifest     |  8 ++---
 cdist/conf/type/__consul_template/manifest    |  2 +-
 .../type/__consul_template_template/manifest  |  6 ++--
 .../conf/type/__consul_watch_checks/manifest  |  4 +--
 cdist/conf/type/__consul_watch_event/manifest |  2 +-
 cdist/conf/type/__consul_watch_key/manifest   |  2 +-
 .../type/__consul_watch_keyprefix/manifest    |  2 +-
 cdist/conf/type/__consul_watch_nodes/manifest |  2 +-
 .../type/__consul_watch_services/manifest     |  2 +-
 cdist/conf/type/__cron/explorer/entry         |  4 +--
 cdist/conf/type/__daemontools/manifest        |  4 +--
 .../conf/type/__daemontools_service/manifest  |  4 +--
 cdist/conf/type/__directory/gencode-remote    | 16 +++++-----
 .../conf/type/__docker_compose/gencode-remote |  4 +--
 cdist/conf/type/__docker_compose/manifest     |  4 +--
 cdist/conf/type/__file/gencode-local          |  8 ++---
 cdist/conf/type/__file/gencode-remote         | 19 ++++++-----
 .../conf/type/__firewalld_rule/explorer/rule  |  2 +-
 .../conf/type/__firewalld_rule/gencode-remote |  8 ++---
 cdist/conf/type/__git/explorer/group          |  2 +-
 cdist/conf/type/__git/explorer/owner          |  2 +-
 cdist/conf/type/__git/gencode-remote          | 12 +++----
 .../type/__golang_from_vendor/gencode-remote  |  2 +-
 cdist/conf/type/__grafana_dashboard/manifest  |  4 +--
 cdist/conf/type/__group/explorer/gshadow      |  2 +-
 cdist/conf/type/__group/gencode-remote        | 16 ++++------
 cdist/conf/type/__hostname/gencode-remote     |  6 ++--
 cdist/conf/type/__hostname/manifest           |  4 +--
 .../__install_bootloader_grub/gencode-remote  |  2 +-
 .../__install_generate_fstab/gencode-local    |  5 ++-
 .../gencode-remote                            | 32 +++++++++----------
 .../conf/type/__install_reboot/gencode-remote |  2 +-
 cdist/conf/type/__jail/manifest               |  6 ++--
 .../conf/type/__jail_freebsd10/gencode-local  |  2 +-
 .../conf/type/__jail_freebsd10/gencode-remote | 10 +++---
 cdist/conf/type/__jail_freebsd9/gencode-local |  2 +-
 .../conf/type/__jail_freebsd9/gencode-remote  | 10 +++---
 cdist/conf/type/__key_value/manifest          |  2 +-
 cdist/conf/type/__link/explorer/type          |  2 +-
 cdist/conf/type/__link/gencode-remote         |  2 +-
 .../conf/type/__package/explorer/pkgng_exists |  2 +-
 cdist/conf/type/__package/manifest            |  4 +--
 .../conf/type/__package_emerge/gencode-remote |  4 +--
 .../type/__package_luarocks/gencode-remote    |  4 +--
 cdist/conf/type/__package_opkg/gencode-remote |  4 +--
 .../conf/type/__package_pacman/gencode-remote |  4 +--
 .../explorer/pkg_version                      |  2 +-
 .../type/__package_pkg_freebsd/gencode-remote | 16 +++-------
 .../type/__package_pkg_openbsd/gencode-remote |  2 +-
 .../explorer/pkg_version                      |  2 +-
 .../__package_pkgng_freebsd/gencode-remote    |  2 +-
 .../type/__package_rubygem/gencode-remote     |  4 +--
 .../type/__package_upgrade_all/gencode-remote |  4 +--
 cdist/conf/type/__package_yum/gencode-remote  |  4 +--
 .../conf/type/__package_zypper/gencode-remote |  6 ++--
 cdist/conf/type/__pacman_conf/manifest        | 24 +++++++-------
 .../type/__pacman_conf_integrate/manifest     | 12 +++----
 cdist/conf/type/__pf_apply/explorer/rcvar     |  2 +-
 cdist/conf/type/__pf_ruleset/explorer/cksum   |  2 +-
 cdist/conf/type/__pf_ruleset/explorer/rcvar   |  2 +-
 cdist/conf/type/__pf_ruleset/gencode-local    |  2 +-
 cdist/conf/type/__postfix_master/manifest     |  2 +-
 .../conf/type/__prometheus_exporter/manifest  |  8 ++---
 cdist/conf/type/__prometheus_server/manifest  |  4 +--
 cdist/conf/type/__pyvenv/explorer/group       |  2 +-
 cdist/conf/type/__pyvenv/explorer/owner       |  2 +-
 cdist/conf/type/__pyvenv/gencode-remote       | 14 ++++----
 cdist/conf/type/__qemu_img/gencode-remote     |  2 +-
 cdist/conf/type/__qemu_img/manifest           |  2 +-
 cdist/conf/type/__rsync/gencode-local         |  2 +-
 cdist/conf/type/__rvm/explorer/state          |  2 +-
 cdist/conf/type/__rvm_gem/gencode-remote      |  2 --
 cdist/conf/type/__rvm_gemset/explorer/state   |  4 +--
 cdist/conf/type/__rvm_ruby/gencode-remote     |  1 -
 .../type/__ssh_authorized_key/explorer/entry  |  4 +--
 .../type/__ssh_authorized_key/gencode-remote  |  4 +--
 .../conf/type/__ssh_authorized_keys/manifest  |  2 +-
 cdist/conf/type/__staged_file/gencode-local   |  3 +-
 cdist/conf/type/__staged_file/manifest        |  8 ++---
 .../conf/type/__start_on_boot/gencode-remote  | 10 +++---
 cdist/conf/type/__user/explorer/shadow        |  2 +-
 cdist/conf/type/__user/gencode-remote         | 12 +++----
 .../type/__zypper_repo/explorer/all_repo_ids  |  2 +-
 .../__zypper_repo/explorer/enabled_repo_ids   |  2 +-
 .../conf/type/__zypper_repo/explorer/repo_id  |  2 +-
 .../type/__zypper_service/explorer/repo_ids   |  2 +-
 .../type/__zypper_service/explorer/service_id |  2 +-
 .../__zypper_service/explorer/service_ids     |  2 +-
 .../__zypper_service/explorer/service_uri     |  2 +-
 .../conf/type/__zypper_service/gencode-remote |  2 +-
 cdist/conf/type/__zypper_service/manifest     |  2 +-
 108 files changed, 248 insertions(+), 265 deletions(-)

diff --git a/cdist/conf/explorer/cpu_cores b/cdist/conf/explorer/cpu_cores
index 7f7a955e..27cc6800 100755
--- a/cdist/conf/explorer/cpu_cores
+++ b/cdist/conf/explorer/cpu_cores
@@ -25,13 +25,13 @@
 os=$("$__explorer/os")
 case "$os" in
     "macosx")
-        echo "$(sysctl -n hw.physicalcpu)"
+        sysctl -n hw.physicalcpu
     ;;
 
     *)
         if [ -r /proc/cpuinfo ]; then
             cores="$(grep "core id" /proc/cpuinfo | sort | uniq | wc -l)"
-            if [ ${cores} -eq 0 ]; then
+            if [ "${cores}" -eq 0 ]; then
                 cores="1"
             fi
             echo "$cores"
diff --git a/cdist/conf/explorer/cpu_sockets b/cdist/conf/explorer/cpu_sockets
index 8a8194df..afb7b6b0 100755
--- a/cdist/conf/explorer/cpu_sockets
+++ b/cdist/conf/explorer/cpu_sockets
@@ -25,14 +25,14 @@
 os=$("$__explorer/os")
 case "$os" in
     "macosx")
-        echo "$(system_profiler SPHardwareDataType | grep "Number of Processors" | awk -F': ' '{print $2}')"
+        system_profiler SPHardwareDataType | grep "Number of Processors" | awk -F': ' '{print $2}'
     ;;
 
     *)
     if [ -r /proc/cpuinfo ]; then
         sockets="$(grep "physical id" /proc/cpuinfo | sort | uniq | wc -l)"
-        if [ ${sockets} -eq 0 ]; then
-            sockets="$(cat /proc/cpuinfo | grep "processor" | wc -l)"
+        if [ "${sockets}" -eq 0 ]; then
+            sockets="$(grep -c "processor" /proc/cpuinfo)"
         fi
         echo "${sockets}"
     fi
diff --git a/cdist/conf/explorer/disks b/cdist/conf/explorer/disks
index 52fef81e..25dfa5ad 100644
--- a/cdist/conf/explorer/disks
+++ b/cdist/conf/explorer/disks
@@ -1,2 +1,2 @@
-cd /dev
+cd /dev || exit 0
 echo sd? hd? vd?
diff --git a/cdist/conf/explorer/lsb_codename b/cdist/conf/explorer/lsb_codename
index eebd3e0f..d27c48a9 100755
--- a/cdist/conf/explorer/lsb_codename
+++ b/cdist/conf/explorer/lsb_codename
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("${__explorer}"/os)" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_CODENAME")
    ;;
diff --git a/cdist/conf/explorer/lsb_description b/cdist/conf/explorer/lsb_description
index 23f45421..d435d0e2 100755
--- a/cdist/conf/explorer/lsb_description
+++ b/cdist/conf/explorer/lsb_description
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("${__explorer}"/os)" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_DESCRIPTION")
    ;;
diff --git a/cdist/conf/explorer/lsb_id b/cdist/conf/explorer/lsb_id
index 9754eb63..6a249412 100755
--- a/cdist/conf/explorer/lsb_id
+++ b/cdist/conf/explorer/lsb_id
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("${__explorer}"/os)" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_ID")
    ;;
diff --git a/cdist/conf/explorer/lsb_release b/cdist/conf/explorer/lsb_release
index 35b5547c..fee3c050 100755
--- a/cdist/conf/explorer/lsb_release
+++ b/cdist/conf/explorer/lsb_release
@@ -20,7 +20,7 @@
 #
 
 set +e
-case "$($__explorer/os)" in
+case "$("${__explorer}"/os)" in
    openwrt)
       (. /etc/openwrt_release && echo "$DISTRIB_RELEASE")
    ;;
diff --git a/cdist/conf/explorer/machine b/cdist/conf/explorer/machine
index d4a0e106..080867ac 100755
--- a/cdist/conf/explorer/machine
+++ b/cdist/conf/explorer/machine
@@ -22,6 +22,6 @@
 #
 #
 
-if command -v uname 2>&1 >/dev/null; then
+if command -v uname > /dev/null 2>&1; then
    uname -m
 fi
diff --git a/cdist/conf/explorer/machine_type b/cdist/conf/explorer/machine_type
index 3b4f0308..bb21f69c 100755
--- a/cdist/conf/explorer/machine_type
+++ b/cdist/conf/explorer/machine_type
@@ -22,13 +22,13 @@
 
 # FIXME: other system types (not linux ...)
 
-if [ -d "/proc/vz" -a ! -d "/proc/bc" ]; then
+if [ -d "/proc/vz" ] && [ ! -d "/proc/bc" ]; then
     echo openvz
     exit
 fi
 
 if [ -e "/proc/1/environ" ] &&
-    cat "/proc/1/environ" | tr '\000' '\n' | grep -Eiq '^container='; then
+    tr '\000' '\n' < "/proc/1/environ" | grep -Eiq '^container='; then
     echo lxc
     exit
 fi
diff --git a/cdist/conf/explorer/os_version b/cdist/conf/explorer/os_version
index 380782cc..2012257b 100755
--- a/cdist/conf/explorer/os_version
+++ b/cdist/conf/explorer/os_version
@@ -22,7 +22,7 @@
 #
 #
 
-case "$($__explorer/os)" in
+case "$("${__explorer}"/os)" in
    amazon)
       cat /etc/system-release
    ;;
diff --git a/cdist/conf/type/__apt_ppa/gencode-remote b/cdist/conf/type/__apt_ppa/gencode-remote
index f60cb7ac..41a6dc07 100755
--- a/cdist/conf/type/__apt_ppa/gencode-remote
+++ b/cdist/conf/type/__apt_ppa/gencode-remote
@@ -29,9 +29,9 @@ fi
 
 case "$state_should" in
    present)
-      echo add-apt-repository \"$name\"
+      echo add-apt-repository \""$name"\"
    ;;
    absent)
-      echo remove-apt-repository \"$name\"
+      echo remove-apt-repository \""$name"\"
    ;;
 esac
diff --git a/cdist/conf/type/__block/manifest b/cdist/conf/type/__block/manifest
index 8fea3e83..191b857e 100755
--- a/cdist/conf/type/__block/manifest
+++ b/cdist/conf/type/__block/manifest
@@ -19,7 +19,7 @@
 #
 
 
-file="$(cat "$__object/parameter/file" 2>/dev/null || echo "/$__object_id")"
+# file="$(cat "$__object/parameter/file" 2>/dev/null || echo "/$__object_id")"
 prefix=$(cat "$__object/parameter/prefix" 2>/dev/null || echo "#cdist:__block/$__object_id")
 suffix=$(cat "$__object/parameter/suffix" 2>/dev/null || echo "#/cdist:__block/$__object_id")
 text=$(cat "$__object/parameter/text")
diff --git a/cdist/conf/type/__ccollect_source/gencode-remote b/cdist/conf/type/__ccollect_source/gencode-remote
index 56003fef..4ae74bc6 100755
--- a/cdist/conf/type/__ccollect_source/gencode-remote
+++ b/cdist/conf/type/__ccollect_source/gencode-remote
@@ -42,21 +42,20 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \"$1\" \"$destination\"
-    echo chgrp $1 >> "$__messages_out"
+    echo chgrp \""$1"\" \""$destination"\"
+    echo chgrp "$1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \"$1\" \"$destination\"
-    echo chown $1 >> "$__messages_out"
+    echo chown \""$1"\" \""$destination"\"
+    echo chown "$1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \"$1\" \"$destination\"
-   echo chmod $1 >> "$__messages_out"
+   echo chmod \""$1"\" \""$destination"\"
+   echo chmod "$1" >> "$__messages_out"
 }
 
-set_attributes=
 case "$state_should" in
     present|exists)
     # Note: Mode - needs to happen last as a chown/chgrp can alter mode by
@@ -67,11 +66,11 @@ case "$state_should" in
 
             # change 0xxx format to xxx format => same as stat returns
             if [ "$attribute" = mode ]; then
-                value_should="$(echo $value_should | sed 's/^0\(...\)/\1/')"
+                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
             fi
             
             value_is="$(get_current_value "$attribute" "$value_should")"
-            if [ -f "$__object/files/set-attributes" -o "$value_should" != "$value_is" ]; then
+            if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then
                 "set_$attribute" "$value_should"
             fi
         fi
@@ -81,7 +80,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \"$destination\"
+            echo rm -f \""$destination"\"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__ccollect_source/manifest b/cdist/conf/type/__ccollect_source/manifest
index 238c7e76..26c6cc99 100755
--- a/cdist/conf/type/__ccollect_source/manifest
+++ b/cdist/conf/type/__ccollect_source/manifest
@@ -22,7 +22,7 @@ name="$__object_id"
 state="$(cat "$__object/parameter/state")"
 source="$(cat "$__object/parameter/source")"
 destination="$(cat "$__object/parameter/destination")"
-ccollectconf="$(cat "$__object/parameter/ccollectconf" | sed 's,/$,,')"
+ccollectconf="$(sed 's,/$,,' "$__object/parameter/ccollectconf")"
 
 sourcedir="$ccollectconf/sources"
 basedir="$sourcedir/$name"
diff --git a/cdist/conf/type/__config_file/manifest b/cdist/conf/type/__config_file/manifest
index 3155f79b..2e077db5 100755
--- a/cdist/conf/type/__config_file/manifest
+++ b/cdist/conf/type/__config_file/manifest
@@ -19,7 +19,7 @@
 #
 
 set -- "/${__object_id}"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       source)
          source="$(cat "$__object/parameter/source")"
diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index 820018c9..19db1582 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -66,7 +66,7 @@ require="__directory/etc/consul" \
    __directory "$conf_dir" \
       --owner root --group "$group" --mode 750 --state "$state"
 
-if [ -f "$__object/parameter/ca-file-source" -o -f "$__object/parameter/cert-file-source" -o -f "$__object/parameter/key-file-source" ]; then
+if [ -f "$__object/parameter/ca-file-source" ] || [ -f "$__object/parameter/cert-file-source" ] || [ -f "$__object/parameter/key-file-source" ]; then
    # create directory for ssl certs
    require="__directory/etc/consul" \
       __directory /etc/consul/ssl \
@@ -84,7 +84,7 @@ echo "{"
 # parameters we define ourself
 printf '   "data_dir": "%s"\n' "$data_dir"
 
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state|user|group|json-config) continue ;;
       ca-file-source|cert-file-source|key-file-source)
diff --git a/cdist/conf/type/__consul_check/manifest b/cdist/conf/type/__consul_check/manifest
index 8149b130..52878767 100755
--- a/cdist/conf/type/__consul_check/manifest
+++ b/cdist/conf/type/__consul_check/manifest
@@ -40,7 +40,7 @@ if [ ! -f "$__object/parameter/interval" ]; then
       fi
    done
 fi
-if [ -f "$__object/parameter/docker-container-id" -a ! -f "$__object/parameter/script" ]; then
+if [ -f "$__object/parameter/docker-container-id" ] && [ ! -f "$__object/parameter/script" ]; then
    echo "When using --docker-container-id you must also define --script." >&2
    exit 1
 fi
@@ -50,7 +50,7 @@ fi
 echo "{"
 printf '   "check": {\n'
 printf '      "name": "%s"\n' "$name"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state|name) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_service/manifest b/cdist/conf/type/__consul_service/manifest
index d7a1b6e3..58872128 100755
--- a/cdist/conf/type/__consul_service/manifest
+++ b/cdist/conf/type/__consul_service/manifest
@@ -24,15 +24,15 @@ conf_file="service_${name}.json"
 state="$(cat "$__object/parameter/state")"
 
 # Sanity checks
-if [ -f "$__object/parameter/check-script" -a -f "$__object/parameter/check-ttl" ]; then
+if [ -f "$__object/parameter/check-script" ] && [ -f "$__object/parameter/check-ttl" ]; then
    echo "Use either --check-script together with --check-interval OR --check-ttl, but not both" >&2
    exit 1
 fi
-if [ -f "$__object/parameter/check-script" -a ! -f "$__object/parameter/check-interval" ]; then
+if [ -f "$__object/parameter/check-script" ] && [ ! -f "$__object/parameter/check-interval" ]; then
    echo "When using --check-script you must also define --check-interval" >&2
    exit 1
 fi
-if [ -f "$__object/parameter/check-http" -a ! -f "$__object/parameter/check-interval" ]; then
+if [ -f "$__object/parameter/check-http" ] && [ ! -f "$__object/parameter/check-interval" ]; then
    echo "When using --check-http you must also define --check-interval" >&2
    exit 1
 fi
@@ -42,7 +42,7 @@ fi
 echo "{"
 printf '   "service": {\n'
 printf '      "name": "%s"\n' "$name"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state|name|check-interval) continue ;;
       check-script)
diff --git a/cdist/conf/type/__consul_template/manifest b/cdist/conf/type/__consul_template/manifest
index 2236e5bd..8fa6c31a 100755
--- a/cdist/conf/type/__consul_template/manifest
+++ b/cdist/conf/type/__consul_template/manifest
@@ -75,7 +75,7 @@ require="__directory/etc/consul-template" \
 
 # Generate hcl config file
 (
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       auth-password|state|ssl-*|syslog-*|version|vault-token|vault-ssl*) continue ;;
       auth-username)
diff --git a/cdist/conf/type/__consul_template_template/manifest b/cdist/conf/type/__consul_template_template/manifest
index 5fe657d0..3931e3e3 100755
--- a/cdist/conf/type/__consul_template_template/manifest
+++ b/cdist/conf/type/__consul_template_template/manifest
@@ -26,11 +26,11 @@ template_dir="/etc/consul-template/template"
 require=""
 
 # Sanity checks
-if [ -f "$__object/parameter/source" -a -f "$__object/parameter/source-file" ]; then
+if [ -f "$__object/parameter/source" ] && [ -f "$__object/parameter/source-file" ]; then
    echo "Use either --source OR --source-file, but not both." >&2
    exit 1
 fi
-if [ ! -f "$__object/parameter/source" -a ! -f "$__object/parameter/source-file" ]; then
+if [ ! -f "$__object/parameter/source" ] && [ ! -f "$__object/parameter/source-file" ]; then
    echo "Either --source OR --source-file must be given." >&2
    exit 1
 fi
@@ -38,7 +38,7 @@ fi
 # Generate hcl config file
 (
 printf 'template {\n'
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       source-file)
          source="$(cat "$__object/parameter/$param")"
diff --git a/cdist/conf/type/__consul_watch_checks/manifest b/cdist/conf/type/__consul_watch_checks/manifest
index ebb49e2e..0f0ff6be 100755
--- a/cdist/conf/type/__consul_watch_checks/manifest
+++ b/cdist/conf/type/__consul_watch_checks/manifest
@@ -25,7 +25,7 @@ conf_file="watch_${watch_type}_${__object_id}.json"
 state="$(cat "$__object/parameter/state")"
 
 # Sanity checks
-if [ -f "$__object/parameter/filter-service" -a -f "$__object/parameter/filter-state" ]; then
+if [ -f "$__object/parameter/filter-service" ] && [ -f "$__object/parameter/filter-state" ]; then
    echo "Use either --filter-service or --filter-state but not both." >&2
    exit 1
 fi
@@ -35,7 +35,7 @@ fi
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state) continue ;;
       filter-*)
diff --git a/cdist/conf/type/__consul_watch_event/manifest b/cdist/conf/type/__consul_watch_event/manifest
index 099054a5..7ee4f9ac 100755
--- a/cdist/conf/type/__consul_watch_event/manifest
+++ b/cdist/conf/type/__consul_watch_event/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_key/manifest b/cdist/conf/type/__consul_watch_key/manifest
index 099054a5..7ee4f9ac 100755
--- a/cdist/conf/type/__consul_watch_key/manifest
+++ b/cdist/conf/type/__consul_watch_key/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_keyprefix/manifest b/cdist/conf/type/__consul_watch_keyprefix/manifest
index 099054a5..7ee4f9ac 100755
--- a/cdist/conf/type/__consul_watch_keyprefix/manifest
+++ b/cdist/conf/type/__consul_watch_keyprefix/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_nodes/manifest b/cdist/conf/type/__consul_watch_nodes/manifest
index 099054a5..7ee4f9ac 100755
--- a/cdist/conf/type/__consul_watch_nodes/manifest
+++ b/cdist/conf/type/__consul_watch_nodes/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_services/manifest b/cdist/conf/type/__consul_watch_services/manifest
index 099054a5..7ee4f9ac 100755
--- a/cdist/conf/type/__consul_watch_services/manifest
+++ b/cdist/conf/type/__consul_watch_services/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in "$__object/parameter/*"; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__cron/explorer/entry b/cdist/conf/type/__cron/explorer/entry
index 2167e045..801861a3 100644
--- a/cdist/conf/type/__cron/explorer/entry
+++ b/cdist/conf/type/__cron/explorer/entry
@@ -24,7 +24,7 @@ user="$(cat "$__object/parameter/user")"
 
 if [ -f "$__object/parameter/raw_command" ]; then
     command="$(cat "$__object/parameter/command")"
-    crontab -u $user -l 2>/dev/null | grep "^$command\$" || true
+    crontab -u "$user" -l 2>/dev/null | grep "^$command\$" || true
 else
-    crontab -u $user -l 2>/dev/null | grep "# $name\$" || true
+    crontab -u "$user" -l 2>/dev/null | grep "# $name\$" || true
 fi
diff --git a/cdist/conf/type/__daemontools/manifest b/cdist/conf/type/__daemontools/manifest
index 45ce3df6..656f4984 100755
--- a/cdist/conf/type/__daemontools/manifest
+++ b/cdist/conf/type/__daemontools/manifest
@@ -3,8 +3,8 @@
 pkg=$(cat "$__object/parameter/from-package")
 servicedir=$(cat "$__object/parameter/servicedir")
 
-__package $pkg
-__directory $servicedir --mode 700
+__package "$pkg"
+__directory "$servicedir" --mode 700
 
 os=$(cat "$__global/explorer/os")
 init=$(cat "$__global/explorer/init")
diff --git a/cdist/conf/type/__daemontools_service/manifest b/cdist/conf/type/__daemontools_service/manifest
index 9e8e0bee..78bae285 100755
--- a/cdist/conf/type/__daemontools_service/manifest
+++ b/cdist/conf/type/__daemontools_service/manifest
@@ -25,14 +25,14 @@ badusage() {
 [ -z "$run$runfile" ] && badusage
 [ -n "$run" ] && [ -n "$runfile" ] && badusage
 
-__directory $servicedir/$name/log/main --parents
+__directory "$servicedir/$name/log/main" --parents
 
 echo "$RUN_PREFIX$run" | require="__directory/$servicedir/$name/log/main" __config_file "$servicedir/$name/run" \
 	--onchange "svc -t '$servicedir/$name' 2>/dev/null" \
 	--mode 755 \
 	--source "${runfile:--}"
 
-echo "$RUN_PREFIX$logrun" | require="__directory/$servicedir/$name/log/main" __config_file $servicedir/$name/log/run \
+echo "$RUN_PREFIX$logrun" | require="__directory/$servicedir/$name/log/main" __config_file "$servicedir/$name/log/run" \
 	--onchange "svc -t '$servicedir/$name/log' 2>/dev/null" \
 	--mode 755 \
 	--source "-"
diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote
index cced4624..35866eb4 100755
--- a/cdist/conf/type/__directory/gencode-remote
+++ b/cdist/conf/type/__directory/gencode-remote
@@ -57,18 +57,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp $recursive \"$1\" \"$destination\"
-    echo chgrp $recursive $1 >> "$__messages_out"
+    echo chgrp "$recursive" \""$1"\" \""$destination"\"
+    echo chgrp "$recursive" "$1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown $recursive \"$1\" \"$destination\"
-    echo chown $recursive $1 >> "$__messages_out"
+    echo chown "$recursive" \""$1"\" \""$destination"\"
+    echo chown "$recursive" "$1" >> "$__messages_out"
 }
 
 set_mode() {
-    echo chmod $recursive \"$1\" \"$destination\"
-    echo chmod $recursive $1 >> "$__messages_out"
+    echo chmod "$recursive" \""$1"\" \""$destination"\"
+    echo chmod "$recursive" "$1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -94,7 +94,7 @@ case "$state_should" in
 
             # change 0xxx format to xxx format => same as stat returns
             if [ "$attribute" = mode ]; then
-                value_should="$(echo $value_should | sed 's/^0\(...\)/\1/')"
+                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
             fi
 
             if [ "$set_attributes" = 1 ] || [ "$value_should" != "$value_is" ]; then
@@ -105,7 +105,7 @@ case "$state_should" in
    ;;
    absent)
         if [ "$type" = "directory" ]; then
-            echo rm -rf \"$destination\"
+            echo rm -rf \""$destination"\"
             echo remove >> "$__messages_out"
         fi
    ;;
diff --git a/cdist/conf/type/__docker_compose/gencode-remote b/cdist/conf/type/__docker_compose/gencode-remote
index 2b8267a9..396c93ac 100755
--- a/cdist/conf/type/__docker_compose/gencode-remote
+++ b/cdist/conf/type/__docker_compose/gencode-remote
@@ -22,9 +22,9 @@
 version="$(cat "$__object/parameter/version")"
 state="$(cat "$__object/parameter/state")"
 
-if [ ${state} = "present" ]; then
+if [ "${state}" = "present" ]; then
     # Download docker-compose file
-        echo 'curl -L "https://github.com/docker/compose/releases/download/'${version}'/docker-compose-$(uname -s)-$(uname -m)" -o /tmp/docker-compose'
+        echo 'curl -L "https://github.com/docker/compose/releases/download/'"${version}"'/docker-compose-$(uname -s)-$(uname -m)" -o /tmp/docker-compose'
         echo 'mv /tmp/docker-compose /usr/local/bin/docker-compose'
     # Change permissions
     echo 'chmod +x /usr/local/bin/docker-compose'
diff --git a/cdist/conf/type/__docker_compose/manifest b/cdist/conf/type/__docker_compose/manifest
index c17f0f33..f7de3a76 100755
--- a/cdist/conf/type/__docker_compose/manifest
+++ b/cdist/conf/type/__docker_compose/manifest
@@ -22,10 +22,10 @@
 state="$(cat "$__object/parameter/state")"
 
 # Needed packages
-if [ ${state} = "present" ]; then
+if [ "${state}" = "present" ]; then
     __docker
     __package curl
-elif [ ${state} = "absent" ]; then
+elif [ "${state}" = "absent" ]; then
     __file /usr/local/bin/docker-compose --state absent
 else
     echo "Unknown state: ${state}" >&2
diff --git a/cdist/conf/type/__file/gencode-local b/cdist/conf/type/__file/gencode-local
index 15a9ee0e..fb9f9a92 100755
--- a/cdist/conf/type/__file/gencode-local
+++ b/cdist/conf/type/__file/gencode-local
@@ -23,7 +23,7 @@ destination="/$__object_id"
 state_should="$(cat "$__object/parameter/state")"
 type="$(cat "$__object/explorer/type")"
 
-[ "$state_should" = "exists" -a "$type" = "file" ] && exit 0 # nothing to do
+[ "$state_should" = "exists" ] && [ "$type" = "file" ] && exit 0 # nothing to do
 
 if [ "$state_should" = "pre-exists" ]; then
    if [ -f "$__object/parameter/source" ]; then
@@ -41,7 +41,7 @@ fi
 
 upload_file=
 create_file=
-if [ "$state_should" = "present" -o "$state_should" = "exists" ]; then
+if [ "$state_should" = "present" ] || [ "$state_should" = "exists" ]; then
    if [ ! -f "$__object/parameter/source" ]; then
       remote_stat="$(cat "$__object/explorer/stat")"
       if [ -z "$remote_stat" ]; then
@@ -70,7 +70,7 @@ if [ "$state_should" = "present" -o "$state_should" = "exists" ]; then
          fi
       fi
    fi
-   if [ "$create_file" -o "$upload_file" ]; then
+   if [ "$create_file" ] || [ "$upload_file" ]; then
       # tell gencode-remote that we created or uploaded a file and that it must
       # set all attributes no matter what the explorer retreived
       mkdir "$__object/files"
@@ -84,7 +84,7 @@ DONE
       if [ "$upload_file" ]; then
          echo upload >> "$__messages_out"
          # IPv6 fix
-         if $(echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$')
+         if echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$'
          then
              my_target_host="[${__target_host}]"
          else
diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote
index c90be0be..c98e6e76 100755
--- a/cdist/conf/type/__file/gencode-remote
+++ b/cdist/conf/type/__file/gencode-remote
@@ -43,21 +43,20 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \"$1\" \"$destination\"
-    echo chgrp $1 >> "$__messages_out"
+    echo chgrp \""$1"\" \""$destination"\"
+    echo chgrp "$1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \"$1\" \"$destination\"
-    echo chown $1 >> "$__messages_out"
+    echo chown \""$1"\" \""$destination"\"
+    echo chown "$1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \"$1\" \"$destination\"
-   echo chmod $1 >> "$__messages_out"
+   echo chmod \""$1"\" \""$destination"\"
+   echo chmod "$1" >> "$__messages_out"
 }
 
-set_attributes=
 case "$state_should" in
     present|exists|pre-exists)
     # Note: Mode - needs to happen last as a chown/chgrp can alter mode by
@@ -68,11 +67,11 @@ case "$state_should" in
 
             # change 0xxx format to xxx format => same as stat returns
             if [ "$attribute" = mode ]; then
-                value_should="$(echo $value_should | sed 's/^0\(...\)/\1/')"
+                value_should="$(echo "$value_should" | sed 's/^0\(...\)/\1/')"
             fi
             
             value_is="$(get_current_value "$attribute" "$value_should")"
-            if [ -f "$__object/files/set-attributes" -o "$value_should" != "$value_is" ]; then
+            if [ -f "$__object/files/set-attributes" ] || [ "$value_should" != "$value_is" ]; then
                 "set_$attribute" "$value_should"
             fi
         fi
@@ -82,7 +81,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \"$destination\"
+            echo rm -f \""$destination"\"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__firewalld_rule/explorer/rule b/cdist/conf/type/__firewalld_rule/explorer/rule
index 5a0e0265..0234e5b6 100644
--- a/cdist/conf/type/__firewalld_rule/explorer/rule
+++ b/cdist/conf/type/__firewalld_rule/explorer/rule
@@ -25,7 +25,7 @@ chain="$(cat "$__object/parameter/chain")"
 priority="$(cat "$__object/parameter/priority")"
 rule="$(cat "$__object/parameter/rule")"
 
-if firewall-cmd --permanent --direct --query-rule "$protocol" "$table" "$chain" "$priority" $rule >/dev/null; then
+if firewall-cmd --permanent --direct --query-rule "$protocol" "$table" "$chain" "$priority" "$rule" >/dev/null; then
     echo present
 else
     echo absent
diff --git a/cdist/conf/type/__firewalld_rule/gencode-remote b/cdist/conf/type/__firewalld_rule/gencode-remote
index 4c824d39..f5252145 100755
--- a/cdist/conf/type/__firewalld_rule/gencode-remote
+++ b/cdist/conf/type/__firewalld_rule/gencode-remote
@@ -33,13 +33,13 @@ rule="$(cat "$__object/parameter/rule")"
 
 case "$state_should" in
     present)
-        echo firewall-cmd --quiet --permanent --direct --add-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
-        echo firewall-cmd --quiet --direct --add-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
+        echo firewall-cmd --quiet --permanent --direct --add-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
+        echo firewall-cmd --quiet --direct --add-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
     ;;
 
     absent)
-        echo firewall-cmd --quiet --permanent --direct --remove-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
-        echo firewall-cmd --quiet --direct --remove-rule \"$protocol\" \"$table\" \"$chain\" \"$priority\" $rule
+        echo firewall-cmd --quiet --permanent --direct --remove-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
+        echo firewall-cmd --quiet --direct --remove-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
     ;;
     *)
         echo "Unknown state $state_should" >&2
diff --git a/cdist/conf/type/__git/explorer/group b/cdist/conf/type/__git/explorer/group
index 1308c710..3ddf9656 100644
--- a/cdist/conf/type/__git/explorer/group
+++ b/cdist/conf/type/__git/explorer/group
@@ -2,4 +2,4 @@
 
 destination="/$__object_id/.git"
 
-stat --print "%G" ${destination} 2>/dev/null || exit 0
+stat --print "%G" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__git/explorer/owner b/cdist/conf/type/__git/explorer/owner
index 8c36b035..4c3cd431 100644
--- a/cdist/conf/type/__git/explorer/owner
+++ b/cdist/conf/type/__git/explorer/owner
@@ -2,4 +2,4 @@
 
 destination="/$__object_id/.git"
 
-stat --print "%U" ${destination} 2>/dev/null || exit 0
+stat --print "%U" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__git/gencode-remote b/cdist/conf/type/__git/gencode-remote
index d0d0d4ed..d6644e5b 100755
--- a/cdist/conf/type/__git/gencode-remote
+++ b/cdist/conf/type/__git/gencode-remote
@@ -35,10 +35,10 @@ owner="$(cat "$__object/parameter/owner")"
 group="$(cat "$__object/parameter/group")"
 mode="$(cat "$__object/parameter/mode")"
 
-[  "$state_should" = "$state_is" -a \
-   "$owner" = "$owner_is" -a \
-   "$group" = "$group_is" -a \
-   -n "$mode" ] && exit 0
+[  "$state_should" = "$state_is" ] && \
+   [ "$owner" = "$owner_is" ] && \
+   [ "$group" = "$group_is" ] && \
+   [ -n "$mode" ] && exit 0
 
 case $state_should in
     present)
@@ -46,8 +46,8 @@ case $state_should in
         if [ "$state_should" != "$state_is" ]; then
             echo git clone --quiet --branch "$branch" "$source" "$destination"
         fi
-        if [ \( -n "$owner" -a "$owner_is" != "$owner" \) -o \
-             \( -n "$group" -a "$group_is" != "$group" \) ]; then
+        if ([ -n "$owner" ] && [ "$owner_is" != "$owner" ]) || \
+            ([ -n "$group" ] && [ "$group_is" != "$group" ]); then
             echo chown -R "${owner}:${group}" "$destination"
         fi
         if [ -n "$mode" ]; then
diff --git a/cdist/conf/type/__golang_from_vendor/gencode-remote b/cdist/conf/type/__golang_from_vendor/gencode-remote
index 1654978b..b1eeb6f4 100755
--- a/cdist/conf/type/__golang_from_vendor/gencode-remote
+++ b/cdist/conf/type/__golang_from_vendor/gencode-remote
@@ -2,7 +2,7 @@
 
 version=$(cat "$__object/parameter/version")
 
-kernel_name=$(cat "$__global/explorer/kernel_name" | tr '[:upper:]' '[:lower:]')
+kernel_name=$(tr '[:upper:]' '[:lower:]' "$__global/explorer/kernel_name")
 machine=$(cat "$__global/explorer/machine")
 case $machine in
 	x86_64|amd64)
diff --git a/cdist/conf/type/__grafana_dashboard/manifest b/cdist/conf/type/__grafana_dashboard/manifest
index 308af59a..727356e5 100755
--- a/cdist/conf/type/__grafana_dashboard/manifest
+++ b/cdist/conf/type/__grafana_dashboard/manifest
@@ -1,7 +1,7 @@
 #!/bin/sh -e
 
-os=$(cat $__global/explorer/os)
-os_version=$(cat $__global/explorer/os_version)
+os="$(cat "$__global/explorer/os")"
+os_version="$(cat "$__global/explorer/os_version")"
 
 case $os in
     debian|devuan)
diff --git a/cdist/conf/type/__group/explorer/gshadow b/cdist/conf/type/__group/explorer/gshadow
index 2e2ab29d..2f63b31b 100755
--- a/cdist/conf/type/__group/explorer/gshadow
+++ b/cdist/conf/type/__group/explorer/gshadow
@@ -22,7 +22,7 @@
 #
 
 name=$__object_id
-os="$($__explorer/os)"
+os="$("${__explorer}"/os)"
 
 case "$os" in
     "freebsd"|"netbsd")
diff --git a/cdist/conf/type/__group/gencode-remote b/cdist/conf/type/__group/gencode-remote
index 5847cb66..5b053f48 100755
--- a/cdist/conf/type/__group/gencode-remote
+++ b/cdist/conf/type/__group/gencode-remote
@@ -30,9 +30,9 @@ state="$(cat "$__object/parameter/state")"
 # Use short option names for portability
 shorten_property() {
    case "$1" in
-      gid) echo "-g";;
-      password) echo "-p";;
-      system) echo "-r";;
+      gid) printf -- "-g\n";;
+      password) printf -- "-p\n";;
+      system) printf -- "-r\n";;
    esac
 }
 
@@ -40,11 +40,9 @@ shorten_property() {
 if [ "$state" = "present" ]; then
    case "$os" in
       freebsd)
-         supported_add_properties="gid"
          supported_change_properties="gid"
       ;;
       *)
-         supported_add_properties="gid password system"
          supported_change_properties="gid password"
       ;;
    esac
@@ -63,8 +61,8 @@ if [ "$state" = "present" ]; then
                ;;
             esac
             if [ "$new_value" != "$current_value" ]; then
-               set -- "$@" "$(shorten_property $property)" \'$new_value\'
-               echo change $property $new_value $current_value >> "$__messages_out"
+               set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
+               echo change "$property" "$new_value" "$current_value" >> "$__messages_out"
             fi
          fi
       done
@@ -83,9 +81,9 @@ if [ "$state" = "present" ]; then
             new_value="$(cat "$__object/parameter/$property")"
             if [ -z "$new_value" ]; then
                # Boolean parameters have no value
-               set -- "$@" "$(shorten_property $property)"
+               set -- "$@" "$(shorten_property "$property")"
             else
-               set -- "$@" "$(shorten_property $property)" \'$new_value\'
+               set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
             fi
          fi
       done
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 89bf7b3f..b729b667 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -22,7 +22,7 @@
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
-    name_should="$(echo "${__target_host%%.*}")"
+    name_should="${__target_host%%.*}"
 fi
 
 os=$(cat "$__global/explorer/os")
@@ -36,12 +36,12 @@ has_hostnamectl=$(cat "$__object/explorer/has_hostnamectl")
 #
 case "$os" in
     archlinux|debian|suse|ubuntu|devuan|coreos)
-        if [ "$name_config" = "$name_should" -a "$name_running" = "$name_should" ]; then
+        if [ "$name_config" = "$name_should" ] && [ "$name_running" = "$name_should" ]; then
             exit 0
         fi
     ;;
     scientific|centos|freebsd|openbsd)
-        if [ "$name_sysconfig" = "$name_should" -a "$name_running" = "$name_should" ]; then
+        if [ "$name_sysconfig" = "$name_should" ] && [ "$name_running" = "$name_should" ]; then
             exit 0
         fi
     ;;
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 74664aa7..c03b2eac 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -25,10 +25,10 @@ if [ -f "$__object/parameter/name" ]; then
 else
     case "$os" in
     openbsd)
-        name_should="$(echo "${__target_host}")"
+        name_should="${__target_host}"
     ;;
     *)
-        name_should="$(echo "${__target_host%%.*}")"
+        name_should="${__target_host%%.*}"
     ;;
     esac
 fi
diff --git a/cdist/conf/type/__install_bootloader_grub/gencode-remote b/cdist/conf/type/__install_bootloader_grub/gencode-remote
index 6e6e5e85..1caebbbf 100755
--- a/cdist/conf/type/__install_bootloader_grub/gencode-remote
+++ b/cdist/conf/type/__install_bootloader_grub/gencode-remote
@@ -28,7 +28,7 @@ install_script="$__object/files/install_script"
 # Link file descriptor #6 with stdout
 exec 6>&1
 # Link stdout with $install_script
-exec > $install_script
+exec > "$install_script"
 
 # Generate script to install bootloader on distro
 printf '#!/bin/sh -l\n'
diff --git a/cdist/conf/type/__install_generate_fstab/gencode-local b/cdist/conf/type/__install_generate_fstab/gencode-local
index 5cc7d877..aca42761 100755
--- a/cdist/conf/type/__install_generate_fstab/gencode-local
+++ b/cdist/conf/type/__install_generate_fstab/gencode-local
@@ -23,12 +23,11 @@ cat "$__type/files/fstab.header" > "$destination"
 
 mkdir "$__object/files"
 # get current UUID's from target_host
-$__remote_exec $__target_host blkid > "$__object/files/blkid"
+$__remote_exec "$__target_host" blkid > "$__object/files/blkid"
 
 for object in $(find "$__global/object/__install_mount" -type d -name "$__cdist_object_marker"); do
    device="$(cat "$object/parameter/device")"
    dir="$(cat "$object/parameter/dir")"
-   prefix="$(cat "$object/parameter/prefix")"
    type="$(cat "$object/parameter/type")"
    if [ -f "$object/parameter/options" ]; then
       options="$(cat "$object/parameter/options")"
@@ -54,7 +53,7 @@ for object in $(find "$__global/object/__install_mount" -type d -name "$__cdist_
       ;;
    esac
    if [ -f "$__object/parameter/uuid" ]; then
-      uuid="$(grep -w $device "$__object/files/blkid" | awk '{print $2}')"
+      uuid="$(grep -w "$device" "$__object/files/blkid" | awk '{print $2}')"
       if [ -n "$uuid" ]; then
          echo "# $dir was on $device during installation" >> "$destination"
          device="$uuid"
diff --git a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
index 090a5d86..72c65201 100755
--- a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
+++ b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
@@ -21,7 +21,7 @@
 #set -x
 
 die() {
-   echo "[__install_partition_msdos_apply] $@" >&2
+   echo "[__install_partition_msdos_apply]" "$@" >&2
    exit 1
 }
 debug() {
@@ -31,25 +31,25 @@ debug() {
 
 # Convert a size specifier 1G 100M or 50% into the corresponding numeric MB.
 size_to_mb() {
-   local size=$1
-   local available_size="$2"
+   size=$1
+   available_size="$2"
 
-   local number_suffix="$(echo ${size} | sed -e 's:\.[0-9]\+::' -e 's:\([0-9]\+\)\([KkMmGg%]\)[Bb]\?:\1|\2:')"
-   local number="$(echo ${number_suffix} | cut -d '|' -f1)"
-   local suffix="$(echo ${number_suffix} | cut -d '|' -f2)"
+   number_suffix="$(echo "${size}" | sed -e 's:\.[0-9]\+::' -e 's:\([0-9]\+\)\([KkMmGg%]\)[Bb]\?:\1|\2:')"
+   number="$(echo "${number_suffix}" | cut -d '|' -f1)"
+   suffix="$(echo "${number_suffix}" | cut -d '|' -f2)"
 
    case "$suffix" in
       K|k)
-         size="$(( $number / 1024 ))"
+         size="$(( number / 1024 ))"
          ;;
       M|m)
          size="$number"
          ;;
       G|g)
-         size="$(( $number * 1024 ))"
+         size="$(( number * 1024 ))"
          ;;
       %)
-         size="$(( $available_size * $number / 100 ))"
+         size="$(( available_size * number / 100 ))"
          ;;
       *)
          size="-1"
@@ -62,10 +62,10 @@ get_objects() {
    for object in $(find "$__global/object/__install_partition_msdos" -type d -name "$__cdist_object_marker"); do
       object_device="$(cat "$object/parameter/device")"
       object_minor="$(cat "$object/parameter/minor")"
-      echo "$object_device $object_minor $object" >> $objects_file
+      echo "$object_device $object_minor $object" >> "$objects_file"
    done
-   sort -k 1,2 $objects_file | cut -d' ' -f 3
-   rm $objects_file
+   sort -k 1,2 "$objects_file" | cut -d' ' -f 3
+   rm "$objects_file"
    unset objects_file
    unset object
    unset object_device
@@ -87,7 +87,7 @@ for object in $objects; do
    if [ "$current_device" != "$device" ]; then
       echo "create_disklabel \"$device\" || die 'Failed to create disklabel for $device'"
       current_device="$device"
-      device_name=$(echo ${device} | sed -e 's:^/dev/::;s:/:\\/:g')
+      device_name=$(echo "${device}" | sed -e 's:^/dev/::;s:/:\\/:g')
       available_device_size=$(( $(awk "/${device_name}\$/ { print \$3; }" "$partitions") / 1024))
       # make sure we don't go past the end of the drive
       available_device_size=$((available_device_size - 2))
@@ -108,7 +108,7 @@ for object in $objects; do
 
    if [ "${minor}" -lt "5" ]; then
       # Primary partitions
-      primary_count=$(( $primary_count + 1 ))
+      primary_count=$(( primary_count + 1 ))
       available_size=$available_device_size
    else
       # Logical partitions
@@ -121,13 +121,13 @@ for object in $objects; do
       available_size=0
    else
       partition_size=$(size_to_mb "$size" "$available_size")
-      available_size="$(( $available_size - $partition_size ))"
+      available_size="$(( available_size - partition_size ))"
    fi
 
    if [ "${minor}" -lt "5" ]; then
       # Primary partitions
       available_device_size=$available_size
-      if [ "$type" = "extended" -o "$type" = "5" ]; then
+      if [ "$type" = "extended" ] || [ "$type" = "5" ]; then
          # Extended partition
          available_extended_size=$partition_size
       fi
diff --git a/cdist/conf/type/__install_reboot/gencode-remote b/cdist/conf/type/__install_reboot/gencode-remote
index 00c04523..2f67d4d4 100755
--- a/cdist/conf/type/__install_reboot/gencode-remote
+++ b/cdist/conf/type/__install_reboot/gencode-remote
@@ -18,7 +18,7 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-options="$(cat "$__object/parameter/options")"
+# options="$(cat "$__object/parameter/options")"
 
 #echo "reboot $options"
 cat << DONE
diff --git a/cdist/conf/type/__jail/manifest b/cdist/conf/type/__jail/manifest
index c3d9dfbe..63a2fab2 100755
--- a/cdist/conf/type/__jail/manifest
+++ b/cdist/conf/type/__jail/manifest
@@ -35,16 +35,16 @@ fi
 
 jaildir="$(cat "$__object/parameter/jaildir")"
 
-__directory ${jaildir} --parents
+__directory "${jaildir}" --parents
 
 set -- "$@" "$__object_id" "--state" "$state"
 cd "$__object/parameter"
-for property in $(ls .); do
+for property in *; do
 	set -- "$@" "--$property" "$(cat "$property")"
 done
 
 ver="$(cat "$__global/explorer/os_version")"
-if [ -n "$(echo "$ver" | grep '^10\.' )" ]; then   # Version is 10.x
+if "$(echo "$ver" | grep -q '^10\.' )"; then   # Version is 10.x
    __jail_freebsd10 "$@"
 else
    __jail_freebsd9 "$@"
diff --git a/cdist/conf/type/__jail_freebsd10/gencode-local b/cdist/conf/type/__jail_freebsd10/gencode-local
index b2016f86..f163cad3 100755
--- a/cdist/conf/type/__jail_freebsd10/gencode-local
+++ b/cdist/conf/type/__jail_freebsd10/gencode-local
@@ -44,7 +44,7 @@ basepresent="$(cat "$__object/explorer/basepresent")"
 if [ "$state" = "present" ]; then
    if [ "$basepresent" = "NONE" ]; then
      # IPv6 fix
-     if $(echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$')
+     if echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$'
      then
          my_target_host="[${__target_host}]"
      else
diff --git a/cdist/conf/type/__jail_freebsd10/gencode-remote b/cdist/conf/type/__jail_freebsd10/gencode-remote
index 76241e0e..fa821994 100755
--- a/cdist/conf/type/__jail_freebsd10/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd10/gencode-remote
@@ -36,7 +36,7 @@ state="$(cat "$__object/parameter/state")"
 
 started="true"
 # If the user wants the jail gone, it implies it shouldn't be started.
-[ -f "$__object/parameter/stopped" -o "$state" = "absent" ] && started="false"
+([ -f "$__object/parameter/stopped" ] || [ "$state" = "absent" ]) && started="false"
 
 if [ -f "$__object/parameter/ip" ]; then
    ip="$(cat "$__object/parameter/ip")"
@@ -66,7 +66,7 @@ devfsruleset="$(cat "$__object/parameter/devfs-ruleset")"
 
 # devfs_ruleset being defined without devfs_enable being true
 #     is pointless. Treat this as an error.
-if [ -n "$devfsruleset" -a "$devfsenable" = "false" ]; then
+if [ -n "$devfsruleset" ] && [ "$devfsenable" = "false" ]; then
    exec >&2
    echo "Can't have --devfs-ruleset defined with --devfs-disable"
    exit 1
@@ -83,13 +83,13 @@ present="$(cat "$__object/explorer/present")"
 status="$(cat "$__object/explorer/status")"
 
 # Handle ip="addr, addr" format
-if [ $(expr "${ip}" : ".*, .*") -gt "0" ]; then
+if [ "$(expr "${ip}" : ".*, .*")" -gt "0" ]; then
    SAVE_IFS="$IFS"
    IFS=", "
-   for cur_ip in ${ip}; do
+   # for cur_ip in ${ip}; do
       # Just get the last IP address for SSH to listen on
       mgmt_ip=$(echo "${ip}" | cut '-d ' -f1)   # In case using "ip netmask" format rather than CIDR
-   done
+   # done
    IFS="$SAVE_IFS"
 else
    mgmt_ip=$(echo "${ip}" | cut '-d ' -f1) # In case using "ip netmask" format rather than CIDR
diff --git a/cdist/conf/type/__jail_freebsd9/gencode-local b/cdist/conf/type/__jail_freebsd9/gencode-local
index 1ab7ff1a..bbdc9fcc 100755
--- a/cdist/conf/type/__jail_freebsd9/gencode-local
+++ b/cdist/conf/type/__jail_freebsd9/gencode-local
@@ -40,7 +40,7 @@ basepresent="$(cat "$__object/explorer/basepresent")"
 if [ "$state" = "present" ]; then
    if [ "$basepresent" = "NONE" ]; then
      # IPv6 fix
-     if $(echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$')
+     if echo "${__target_host}" | grep -q -E '^[0-9a-fA-F:]+$'
      then
          my_target_host="[${__target_host}]"
      else
diff --git a/cdist/conf/type/__jail_freebsd9/gencode-remote b/cdist/conf/type/__jail_freebsd9/gencode-remote
index 63b48e5c..95404f4f 100755
--- a/cdist/conf/type/__jail_freebsd9/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd9/gencode-remote
@@ -36,7 +36,7 @@ state="$(cat "$__object/parameter/state")"
 
 started="true"
 # If the user wants the jail gone, it implies it shouldn't be started.
-[ -f "$__object/parameter/stopped" -o "$state" = "absent" ] && started="false"
+([ -f "$__object/parameter/stopped" ] || [ "$state" = "absent" ]) && started="false"
 
 if [ -f "$__object/parameter/ip" ]; then
    ip="$(cat "$__object/parameter/ip")"
@@ -70,7 +70,7 @@ devfsruleset="$(cat "$__object/parameter/devfs-ruleset")"
 
 # devfs_ruleset being defined without devfs_enable being true
 #     is pointless. Treat this as an error.
-if [ -n "$devfsruleset" -a "$devfsenable" = "false" ]; then
+if [ -n "$devfsruleset" ] && [ "$devfsenable" = "false" ]; then
    exec >&2
    echo "Can't have --devfs-ruleset defined with --devfs-disable"
    exit 1
@@ -86,15 +86,15 @@ present="$(cat "$__object/explorer/present")"
 status="$(cat "$__object/explorer/status")"
 
 # Handle ip="iface|addr, iface|addr" format
-if [ $(expr "${ip}" : ".*|.*") -gt "0" ]; then
+if [ "$(expr "${ip}" : ".*|.*")" -gt "0" ]; then
    # If we have multiple IPs defined, $interface doesn't make sense because ip="iface|addr, iface|addr" implies it
    interface=""
    SAVE_IFS="$IFS"
    IFS=", "
-   for cur_ip in ${ip}; do
+   # for cur_ip in ${ip}; do
       # Just get the last IP address for SSH to listen on
       mgmt_ip=$(echo "${ip}" | sed -E -e 's/^.*\|(.*)\/[0-9]+$/\1/')
-   done
+   # done
    IFS="$SAVE_IFS"
 else
    mgmt_ip=$(echo "${ip}" | cut '-d ' -f1)
diff --git a/cdist/conf/type/__key_value/manifest b/cdist/conf/type/__key_value/manifest
index c7801c89..5a91f60c 100755
--- a/cdist/conf/type/__key_value/manifest
+++ b/cdist/conf/type/__key_value/manifest
@@ -21,7 +21,7 @@
 
 state_should="$(cat "$__object/parameter/state")"
 
-if [ "$state_should" = "present" -a ! -f "$__object/parameter/value" ]; then
+if [ "$state_should" = "present" ] && [ ! -f "$__object/parameter/value" ]; then
    echo "Missing required parameter 'value'" >&2
    exit 1
 fi 
diff --git a/cdist/conf/type/__link/explorer/type b/cdist/conf/type/__link/explorer/type
index 579fd081..48a79bf0 100755
--- a/cdist/conf/type/__link/explorer/type
+++ b/cdist/conf/type/__link/explorer/type
@@ -32,7 +32,7 @@ elif [ -f "$destination" ]; then
    case "$type" in
       hard)
          link_count=$(ls -l "$destination" | awk '{ print $2 }')
-         if [ $link_count -gt 1 ]; then
+         if [ "$link_count" -gt 1 ]; then
             echo hardlink
             exit 0
          fi
diff --git a/cdist/conf/type/__link/gencode-remote b/cdist/conf/type/__link/gencode-remote
index 4467fb8e..dc7f3193 100755
--- a/cdist/conf/type/__link/gencode-remote
+++ b/cdist/conf/type/__link/gencode-remote
@@ -61,7 +61,7 @@ case "$state_should" in
     ;;
     absent)
         # only delete if it is a sym/hard link
-        if [ "$file_type" = "symlink" -o "$file_type" = "hardlink" ]; then
+        if [ "$file_type" = "symlink" ] || [ "$file_type" = "hardlink" ]; then
             printf 'rm -f "%s"\n' "$destination"
         fi
     ;;
diff --git a/cdist/conf/type/__package/explorer/pkgng_exists b/cdist/conf/type/__package/explorer/pkgng_exists
index 355c5d65..8c666465 100755
--- a/cdist/conf/type/__package/explorer/pkgng_exists
+++ b/cdist/conf/type/__package/explorer/pkgng_exists
@@ -21,7 +21,7 @@
 # Retrieve the status of a package - parsed dpkg output
 #
 
-if [ "$($__explorer/os)" = "freebsd" ]; then
+if [ "$("${__explorer}"/os)" = "freebsd" ]; then
    command -v pkg
 fi
 
diff --git a/cdist/conf/type/__package/manifest b/cdist/conf/type/__package/manifest
index fe7abedc..f9de1145 100755
--- a/cdist/conf/type/__package/manifest
+++ b/cdist/conf/type/__package/manifest
@@ -55,8 +55,8 @@ state="$(cat "$__object/parameter/state")"
 
 set -- "$@" "$__object_id" "--state" "$state"
 cd "$__object/parameter"
-for property in $(ls .); do
-   if [ "$property" != "type" -a "$property" != "state" ]; then
+for property in *; do
+   if [ "$property" != "type" ] && [ "$property" != "state" ]; then
       set -- "$@" "--$property" "$(cat "$property")"
    fi
 done
diff --git a/cdist/conf/type/__package_emerge/gencode-remote b/cdist/conf/type/__package_emerge/gencode-remote
index 6abe2d61..01c91bcc 100755
--- a/cdist/conf/type/__package_emerge/gencode-remote
+++ b/cdist/conf/type/__package_emerge/gencode-remote
@@ -38,11 +38,11 @@ fi
 pkg_version="$(cat "$__object/explorer/pkg_version")"
 if [ -z "$pkg_version" ]; then
     state_is="absent"
-elif [ -z "$version" -a $(echo "$pkg_version" | wc -l) -gt 1 ]; then
+elif [ -z "$version" ] && [ "$(echo "$pkg_version" | wc -l)" -gt 1 ]; then
     echo "Package name is not unique! The following packages are installed:"
     echo "$pkg_version"
     exit 1
-elif [ -n "$version" -a $(echo "$pkg_version" | cut -d " " -f 1 | sort | uniq | wc -l) -gt 1 ]; then
+elif [ -n "$version" ] && [ "$(echo "$pkg_version" | cut -d " " -f 1 | sort | uniq | wc -l)" -gt 1 ]; then
     echo "Package name is not unique! The following packages are installed:"
     echo "$pkg_version"
     exit 1
diff --git a/cdist/conf/type/__package_luarocks/gencode-remote b/cdist/conf/type/__package_luarocks/gencode-remote
index cae06b22..e14d7a8e 100755
--- a/cdist/conf/type/__package_luarocks/gencode-remote
+++ b/cdist/conf/type/__package_luarocks/gencode-remote
@@ -42,10 +42,10 @@ fi
 
 case "$state_should" in
     present)
-        echo luarocks install \"$name\"
+        echo luarocks install \""$name"\"
     ;;
     absent)
-        echo luarocks remove \"$name\"
+        echo luarocks remove \""$name"\"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_opkg/gencode-remote b/cdist/conf/type/__package_opkg/gencode-remote
index 09fe69a4..53f154a5 100755
--- a/cdist/conf/type/__package_opkg/gencode-remote
+++ b/cdist/conf/type/__package_opkg/gencode-remote
@@ -45,10 +45,10 @@ case "$state_should" in
         if [ "$present" = "notpresent" ]; then
             echo opkg --verbosity=0 update
         fi
-        echo opkg --verbosity=0 install \"$name\"
+        echo opkg --verbosity=0 install \""$name"\"
     ;;
     absent)
-        echo opkg --verbosity=0 remove \"$name\"
+        echo opkg --verbosity=0 remove \""$name"\"
     ;;
     *)
         echo "Unknown state: $state" >&2
diff --git a/cdist/conf/type/__package_pacman/gencode-remote b/cdist/conf/type/__package_pacman/gencode-remote
index 69a5d62a..43649124 100755
--- a/cdist/conf/type/__package_pacman/gencode-remote
+++ b/cdist/conf/type/__package_pacman/gencode-remote
@@ -45,10 +45,10 @@ fi
 
 case "$state_should" in
    present)
-         echo pacman --needed --noconfirm --noprogressbar -S \"$name\"
+         echo pacman --needed --noconfirm --noprogressbar -S \""$name"\"
    ;;
    absent)
-         echo pacman --noconfirm --noprogressbar -R \"$name\"
+         echo pacman --noconfirm --noprogressbar -R \""$name"\"
    ;;
    *)
       echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version b/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version
index 1335ba79..0a1ab75c 100755
--- a/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version
+++ b/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version
@@ -30,7 +30,7 @@ fi
 # Don't produce "no pkgs installed" output -- breaks things
 PKG_OUTPUT=$(pkg_info 2>&1)
 if [ ! "$PKG_OUTPUT" = "pkg_info: no packages installed" ]; then
-	echo -n "$(echo "$PKG_OUTPUT" \
+	printf "%s" "$(echo "$PKG_OUTPUT" \
 		| awk '{print $1}' \
 		| sed 's/^\(.*\)-\([^-]*\)$/name:\1 ver:\2/g' \
 		| grep "name:$name ver:" \
diff --git a/cdist/conf/type/__package_pkg_freebsd/gencode-remote b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
index b51c3153..e0980296 100755
--- a/cdist/conf/type/__package_pkg_freebsd/gencode-remote
+++ b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
@@ -23,20 +23,12 @@
 
 assert ()                 #  If condition false,
 {                         #+ exit from script with error message.
-	E_PARAM_ERR=98
 	E_ASSERT_FAILED=99
 
-	if [ -z "$2" ]          # Not enough parameters passed.
-	then
-		return $E_PARAM_ERR   # No damage done.
-	fi
-
-	lineno=$2
-
-	if [ ! $1 ] 
+	if [ ! "$1" ] 
 	then
 		echo "Assertion failed:  \"$1\""
-		echo "File \"$0\", line $lineno, called by $(caller 0)"
+		echo "File \"$0\""
 		exit $E_ASSERT_FAILED
 	fi  
 }
@@ -66,7 +58,7 @@ cmd=""
 # FIXME: This is ugly.
 execcmd(){
 	# Set the PACKAGESITE if we're ADDing a new package
-	if [ "$1" = "add" -a -n "$pkgsite" ]; then
+	if [ "$1" = "add" ] && [ -n "$pkgsite" ]; then
 		# Use http.../All/ if we know the exact version we want, use .../Latest/ otherwise
 		pkgsite="export PACKAGESITE=${pkgsite}"
 		[ -n "$version" ] && pkgsite="${pkgsite}/All/" || pkgsite="${pkgsite}/Latest/"
@@ -95,7 +87,7 @@ if [ -n "$curr_version" ]; then	# PKG *is* installed
 				exit 0
 			else	# Current version is wrong, fix
 				#updatepkg "$name" "$version"
-				assert "! ${version} = ${curr_version}" $LINENO
+				assert "! ${version} = ${curr_version}"
 				cmd="${rm_cmd} ${name}-${curr_version}"
 				execcmd "remove" "${cmd}"
 				cmd="${add_cmd} -r ${name}-${version}"
diff --git a/cdist/conf/type/__package_pkg_openbsd/gencode-remote b/cdist/conf/type/__package_pkg_openbsd/gencode-remote
index 4a6763cd..61383edb 100755
--- a/cdist/conf/type/__package_pkg_openbsd/gencode-remote
+++ b/cdist/conf/type/__package_pkg_openbsd/gencode-remote
@@ -46,7 +46,7 @@ else
    name="$__object_id"
 fi
 
-if [ -n "$version" -a -n "$flavor" ]; then
+if [ -n "$version" ] && [ -n "$flavor" ]; then
    pkgid="$name-$version-$flavor"
 elif [ -n "$version" ]; then
    pkgid="$name-$version"
diff --git a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version
index 947857b9..92ce0623 100755
--- a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version
+++ b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version
@@ -29,7 +29,7 @@ fi
 
 # Don't produce "no pkgs installed" output -- breaks things
 PKG_OUTPUT=$(pkg info 2>&1)
-echo -n "$(echo "$PKG_OUTPUT" \
+printf "%s" "$(echo "$PKG_OUTPUT" \
    | awk '{print $1}' \
    | sed 's/^\(.*\)-\([^-]*\)$/name:\1 ver:\2/g' \
    | grep "name:$name ver:" \
diff --git a/cdist/conf/type/__package_pkgng_freebsd/gencode-remote b/cdist/conf/type/__package_pkgng_freebsd/gencode-remote
index d21e9e2a..b59e3648 100755
--- a/cdist/conf/type/__package_pkgng_freebsd/gencode-remote
+++ b/cdist/conf/type/__package_pkgng_freebsd/gencode-remote
@@ -52,7 +52,7 @@ cmd=""
 # Parms: $1 -- mode, "rm", "add", or "upg"
 #        $2 -- the command to be echoed
 execcmd(){
-   local _cmd=""
+   _cmd=""
 
    case "$1" in
       add)
diff --git a/cdist/conf/type/__package_rubygem/gencode-remote b/cdist/conf/type/__package_rubygem/gencode-remote
index 6d793ac0..d474db20 100755
--- a/cdist/conf/type/__package_rubygem/gencode-remote
+++ b/cdist/conf/type/__package_rubygem/gencode-remote
@@ -39,10 +39,10 @@ fi
 
 case "$state_should" in
     present)
-        echo gem install \"$name\" --no-ri --no-rdoc
+        echo gem install \""$name"\" --no-ri --no-rdoc
     ;;
     absent)
-        echo gem uninstall \"$name\"
+        echo gem uninstall \""$name"\"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_upgrade_all/gencode-remote b/cdist/conf/type/__package_upgrade_all/gencode-remote
index bcad8a43..38aa001e 100755
--- a/cdist/conf/type/__package_upgrade_all/gencode-remote
+++ b/cdist/conf/type/__package_upgrade_all/gencode-remote
@@ -53,8 +53,8 @@ case "$type" in
         ;;
     apt)
         if [ -f "$apt_dist_upgrade" ]
-        then echo $aptget dist-upgrade
-        else echo $aptget upgrade
+        then echo "$aptget dist-upgrade"
+        else echo "$aptget upgrade"
         fi
 
         if [ -f "$apt_clean" ]
diff --git a/cdist/conf/type/__package_yum/gencode-remote b/cdist/conf/type/__package_yum/gencode-remote
index e1323dea..60dc376d 100755
--- a/cdist/conf/type/__package_yum/gencode-remote
+++ b/cdist/conf/type/__package_yum/gencode-remote
@@ -60,10 +60,10 @@ fi
 
 case "$state_should" in
     present)
-        echo yum $opts install \"$install_name\"
+        echo yum $opts install \""$install_name"\"
     ;;
     absent)
-        echo yum $opts remove \"$name\"
+        echo yum $opts remove \""$name"\"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_zypper/gencode-remote b/cdist/conf/type/__package_zypper/gencode-remote
index d9372b6d..caf15397 100755
--- a/cdist/conf/type/__package_zypper/gencode-remote
+++ b/cdist/conf/type/__package_zypper/gencode-remote
@@ -61,15 +61,15 @@ case "$state_should" in
     present)
         if [ -z "$version_should" ]; then
             [ "$state_is" = "present" ] && exit 0 # if state is present, we dont need to do anything
-            echo zypper $globalopts install --type \"$ptype\" --auto-agree-with-licenses \"$name\" ">/dev/null"
+            echo zypper $globalopts install --type \""$ptype"\" --auto-agree-with-licenses \""$name"\" ">/dev/null"
         else
             [ "$state_is" = "present" ] && [ "$version_should" = "$version_is" ] && exit 0 # if state is present and version is correct, we dont need to do anything
-            echo zypper $globalopts install --oldpackage --type \"$ptype\" --auto-agree-with-licenses \"$name\" = \"$version_should\" ">/dev/null"
+            echo zypper $globalopts install --oldpackage --type \""$ptype"\" --auto-agree-with-licenses \""$name"\" = \""$version_should"\" ">/dev/null"
         fi
     ;;
     absent)
         [ "$state_is" = "absent" ] && exit 0 # if state is absent, we dont need to do anything
-        echo zypper $globalopts remove --type \"$ptype\" \"$name\" ">/dev/null"
+        echo zypper $globalopts remove --type \""$ptype"\" \""$name"\" ">/dev/null"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__pacman_conf/manifest b/cdist/conf/type/__pacman_conf/manifest
index 1561d613..31358274 100755
--- a/cdist/conf/type/__pacman_conf/manifest
+++ b/cdist/conf/type/__pacman_conf/manifest
@@ -59,13 +59,13 @@ if [ "${file}" ]; then
 
     if [ "${state}" = "present" ]; then
 
-        require="__file/${sec_path}/plain_file_${file}" __key_value ${file}_${key}\
-            --file ${sec_path}/plain_file_${file} --key ${key} --value ${value} --delimiter ' = '
+        require="__file/${sec_path}/plain_file_${file}" __key_value "${file}_${key}"\
+            --file "${sec_path}/plain_file_${file}" --key "${key}" --value "${value}" --delimiter ' = '
 
         exit 0
 
     elif [ "${state}" = "absent" ]; then
-        require="__file/${sec_path}/plain_file_${file}" __key_value ${file}_${key}\
+        require="__file/${sec_path}/plain_file_${file}" __key_value "${file}_${key}"\
                 --state absent
         exit 0
 
@@ -87,19 +87,19 @@ eof
 
     if [ "${MATCH}" -eq 1 ]; then
         if [ "${value}" = "on" ]; then
-            require="__file/${sec_path}/${section}" __line ${key}_${value}\
-                --file ${sec_path}/${section} --line ${key}
+            require="__file/${sec_path}/${section}" __line "${key}_${value}"\
+                --file "${sec_path}/${section}" --line "${key}"
         elif [ "${value}" = "off" ]; then
-            require="__file/${sec_path}/${section}" __line ${key}_${value}\
-                --file ${sec_path}/${section} --line ${key} --state absent
+            require="__file/${sec_path}/${section}" __line "${key}_${value}"\
+                --file "${sec_path}/${section}" --line "${key}" --state absent
         fi
         
     else
         contains_element "${key}" "${allowed_option_keys}"
 
         if [ "${MATCH}" -eq 1 ]; then
-            require="__file/${sec_path}/${section}" __key_value ${section}_${key}\
-                    --file ${sec_path}/${section} --key ${key} --value ${value} --delimiter ' = '
+            require="__file/${sec_path}/${section}" __key_value "${section}_${key}"\
+                    --file "${sec_path}/${section}" --key "${key}" --value "${value}" --delimiter ' = '
         else
             echo "Key: ${key} is not valid. Have a look at man pacman.conf" >&2
         fi
@@ -118,12 +118,12 @@ eof
             exit
         fi
     
-        require="__file/${sec_path}/repo_${section}" __key_value ${section}_${key}\
-                --file ${sec_path}/repo_${section} --key ${key} --value ${value} --delimiter ' = '
+        require="__file/${sec_path}/repo_${section}" __key_value "${section}_${key}"\
+                --file "${sec_path}/repo_${section}" --key "${key}" --value "${value}" --delimiter ' = '
 
     elif [ "${state}" = "absent" ]; then
 
-        require="__file/${sec_path}/repo_${section}" __key_value ${section}_${key}\
+        require="__file/${sec_path}/repo_${section}" __key_value "${section}_${key}"\
             --state absent
 
     else
diff --git a/cdist/conf/type/__pacman_conf_integrate/manifest b/cdist/conf/type/__pacman_conf_integrate/manifest
index b26bca50..cc081eed 100755
--- a/cdist/conf/type/__pacman_conf_integrate/manifest
+++ b/cdist/conf/type/__pacman_conf_integrate/manifest
@@ -18,16 +18,16 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-state=$(cat $__object/parameter/state 2>/dev/null)
+state="$(cat "$__object/parameter/state" 2>/dev/null)"
 
-path="/etc/"
+# path="/etc/"
 
 if [ "${state}" = "present" ]; then
     __file /etc/pacman.conf\
-        --owner root --group root --mode 644 --source $__type/files/pacman.conf.cdist
+        --owner root --group root --mode 644 --source "$__type/files/pacman.conf.cdist"
 
     __file /etc/pacman.d/options\
-        --owner root --group root --mode 644 --source $__type/files/options
+        --owner root --group root --mode 644 --source "$__type/files/options"
 
     __file /etc/pacman.d/repo_empty_placeholder\
         --owner root --group root --mode 644
@@ -38,10 +38,10 @@ if [ "${state}" = "present" ]; then
 elif [ "${state}" = "absent" ]; then
 
     __file /etc/pacman.conf\
-        --owner root --group root --mode 644 --source $__type/files/pacman.conf.pacman
+        --owner root --group root --mode 644 --source "$__type/files/pacman.conf.pacman"
 
     __file /etc/pacman.d/mirrorlist\
-        --owner root --group root --mode 644 --source $__type/files/mirrorlist
+        --owner root --group root --mode 644 --source "$__type/files/mirrorlist"
 
     __file /etc/pacman.d/options\
         --state absent
diff --git a/cdist/conf/type/__pf_apply/explorer/rcvar b/cdist/conf/type/__pf_apply/explorer/rcvar
index 20e9dfcc..7c8d535f 100755
--- a/cdist/conf/type/__pf_apply/explorer/rcvar
+++ b/cdist/conf/type/__pf_apply/explorer/rcvar
@@ -29,7 +29,7 @@
 
 RC="/etc/rc.conf"
 PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
-echo ${PFCONF:-"/etc/pf.conf"}
+echo "${PFCONF:-"/etc/pf.conf"}"
 
 # Debug
 #set +x
diff --git a/cdist/conf/type/__pf_ruleset/explorer/cksum b/cdist/conf/type/__pf_ruleset/explorer/cksum
index f8679836..9be6c901 100755
--- a/cdist/conf/type/__pf_ruleset/explorer/cksum
+++ b/cdist/conf/type/__pf_ruleset/explorer/cksum
@@ -33,7 +33,7 @@ TMP="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
 PFCONF="${TMP:-"/etc/pf.conf"}"
 
 if [ -f "${PFCONF}" ]; then	# The pf config file exists, find its cksum.
-	cksum -o 1 ${PFCONF} | cut -d= -f2 | awk '{print $1}'
+	cksum -o 1 "${PFCONF}" | cut -d= -f2 | awk '{print $1}'
 fi
 
 # Debug
diff --git a/cdist/conf/type/__pf_ruleset/explorer/rcvar b/cdist/conf/type/__pf_ruleset/explorer/rcvar
index 20e9dfcc..7c8d535f 100755
--- a/cdist/conf/type/__pf_ruleset/explorer/rcvar
+++ b/cdist/conf/type/__pf_ruleset/explorer/rcvar
@@ -29,7 +29,7 @@
 
 RC="/etc/rc.conf"
 PFCONF="$(grep '^pf_rules=' ${RC} | cut -d= -f2 | sed 's/"//g')"
-echo ${PFCONF:-"/etc/pf.conf"}
+echo "${PFCONF:-"/etc/pf.conf"}"
 
 # Debug
 #set +x
diff --git a/cdist/conf/type/__pf_ruleset/gencode-local b/cdist/conf/type/__pf_ruleset/gencode-local
index b4bded98..b9de1bce 100755
--- a/cdist/conf/type/__pf_ruleset/gencode-local
+++ b/cdist/conf/type/__pf_ruleset/gencode-local
@@ -54,7 +54,7 @@ case $uname in
       currentSum=\$(cksum -o 1 ${source} | cut -d= -f2 | sed 's/ //g')
       ;;
    *)
-      echo "Sorry, I do not know how to find a cksum on ${UNAME}." >&2
+      echo "Sorry, I do not know how to find a cksum on ${uname}." >&2
       exit 1
       ;;
 esac
diff --git a/cdist/conf/type/__postfix_master/manifest b/cdist/conf/type/__postfix_master/manifest
index 4991a13d..058dc6ba 100755
--- a/cdist/conf/type/__postfix_master/manifest
+++ b/cdist/conf/type/__postfix_master/manifest
@@ -36,7 +36,7 @@ __postfix
 
 # Default to object_id
 service="$(cat "$__object/parameter/service" 2>/dev/null || echo "$__object_id")"
-state="$(cat "$__object/parameter/state")"
+# state="$(cat "$__object/parameter/state")"
 
 # NOTE: keep variables in sync in manifest,explorer,gencode-*
 prefix="#cdist:$__object_name"
diff --git a/cdist/conf/type/__prometheus_exporter/manifest b/cdist/conf/type/__prometheus_exporter/manifest
index ae4ed94a..35e654e2 100644
--- a/cdist/conf/type/__prometheus_exporter/manifest
+++ b/cdist/conf/type/__prometheus_exporter/manifest
@@ -2,7 +2,7 @@
 
 export GOBIN=/opt/gocode/bin  # where to find go binaries
 
-exporter="$(cat $__object/parameter/exporter)"
+exporter="$(cat "$__object/parameter/exporter")"
 [ -z "$exporter" ] && exporter="$__object_id"
 
 __user prometheus --system
@@ -18,7 +18,7 @@ case $exporter in
 	;;
 	blackbox)
 		require="$require __daemontools_service/${exporter}-exporter __user/prometheus" __config_file "/service/${exporter}-exporter/blackbox.yml" \
-			--source $__type/files/blackbox.yml \
+			--source "$__type/files/blackbox.yml" \
 			--group prometheus --mode 640 \
 			--onchange "svc -h /service/${exporter}-exporter"
 		require="$require __golang_from_vendor" __go_get github.com/prometheus/blackbox_exporter
@@ -39,9 +39,9 @@ case $exporter in
 	;;
 esac
 
-require="$require __daemontools" __daemontools_service ${exporter}-exporter --run "$run"
+require="$require __daemontools" __daemontools_service "${exporter}-exporter" --run "$run"
 if [ -f "$__object/parameter/add-consul-service" ]; then
-	__consul_service ${exporter}-exporter --port $port --check-http "http://localhost:$port/metrics" --check-interval 10s
+	__consul_service "${exporter}-exporter" --port "$port" --check-http "http://localhost:$port/metrics" --check-interval 10s
 fi
 
 #__daemontools --install-init-script
diff --git a/cdist/conf/type/__prometheus_server/manifest b/cdist/conf/type/__prometheus_server/manifest
index 84ba53cf..2bdcb43e 100755
--- a/cdist/conf/type/__prometheus_server/manifest
+++ b/cdist/conf/type/__prometheus_server/manifest
@@ -13,7 +13,7 @@ storage_path="$(cat "$__object/parameter/storage-path")"
 rule_files="$(cat "$__object/parameter/rule-files")"
 
 # explorer in kB => convert; by default we go with 1/2 RAM
-[ "$target_heap_size" = "auto" ] && target_heap_size=$(($(cat $__global/explorer/memory)*1024/2))
+[ "$target_heap_size" = "auto" ] && target_heap_size=$(( "$(cat "$__global/explorer/memory")" * 1024 / 2 ))
 
 ##### INSTALL THE PACKAGE ###################################################
 
@@ -55,7 +55,7 @@ __key_value prometheus_args --file /etc/default/prometheus \
 
 require="$require __directory/$storage_path $require_pkg" \
 __config_file $CONF \
-	--source $config \
+	--source "$config" \
 	--group prometheus --mode 640 \
 	--onchange "promtool check config $CONF && service prometheus reload"
 
diff --git a/cdist/conf/type/__pyvenv/explorer/group b/cdist/conf/type/__pyvenv/explorer/group
index ff072c5e..a655bda7 100755
--- a/cdist/conf/type/__pyvenv/explorer/group
+++ b/cdist/conf/type/__pyvenv/explorer/group
@@ -2,4 +2,4 @@
 
 destination="/$__object_id"
 
-stat --print "%G" ${destination} 2>/dev/null || exit 0
+stat --print "%G" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__pyvenv/explorer/owner b/cdist/conf/type/__pyvenv/explorer/owner
index b77e3c6e..8b3c7f8e 100755
--- a/cdist/conf/type/__pyvenv/explorer/owner
+++ b/cdist/conf/type/__pyvenv/explorer/owner
@@ -2,4 +2,4 @@
 
 destination="/$__object_id"
 
-stat --print "%U" ${destination} 2>/dev/null || exit 0
+stat --print "%U" "${destination}" 2>/dev/null || exit 0
diff --git a/cdist/conf/type/__pyvenv/gencode-remote b/cdist/conf/type/__pyvenv/gencode-remote
index a4f078c5..0f8b2822 100755
--- a/cdist/conf/type/__pyvenv/gencode-remote
+++ b/cdist/conf/type/__pyvenv/gencode-remote
@@ -29,10 +29,10 @@ owner="$(cat "$__object/parameter/owner")"
 group="$(cat "$__object/parameter/group")"
 mode="$(cat "$__object/parameter/mode")"
 
-[  "$state_should" = "$state_is" -a \
-   "$owner" = "$owner_is" -a \
-   "$group" = "$group_is" -a \
-   -n "$mode" ] && exit 0
+[  "$state_should" = "$state_is" ] && \
+   [ "$owner" = "$owner_is" ] && \
+   [ "$group" = "$group_is" ] && \
+   [ -n "$mode" ] && exit 0
 
 destination="/$__object_id"
 venvparams="$(cat "$__object/parameter/venvparams")"
@@ -47,10 +47,10 @@ fi
 case $state_should in
     present)
         if [ "$state_should" != "$state_is" ]; then
-            echo $pyvenv $venvparams "$destination"
+            echo "$pyvenv" "$venvparams" "$destination"
         fi
-        if [ \( -n "$owner" -a "$owner_is" != "$owner" \) -o \
-             \( -n "$group" -a "$group_is" != "$group" \) ]; then
+        if ([ -n "$owner" ] && [ "$owner_is" != "$owner" ]) || \
+             ([ -n "$group" ] && [ "$group_is" != "$group" ]); then
             echo chown -R "${owner}:${group}" "$destination"
         fi
         if [ -n "$mode" ]; then
diff --git a/cdist/conf/type/__qemu_img/gencode-remote b/cdist/conf/type/__qemu_img/gencode-remote
index 9127e5ef..62442eee 100755
--- a/cdist/conf/type/__qemu_img/gencode-remote
+++ b/cdist/conf/type/__qemu_img/gencode-remote
@@ -18,4 +18,4 @@ format="$(cat "$__object/parameter/format")"
 size="$(cat "$__object/parameter/size")"
 diskimage="/$__object_id"
 
-echo qemu-img create -f \"$format\" \"$diskimage\" \"$size\"
+echo qemu-img create -f \""$format"\" \""$diskimage"\" \""$size"\"
diff --git a/cdist/conf/type/__qemu_img/manifest b/cdist/conf/type/__qemu_img/manifest
index e7417389..7cf21238 100755
--- a/cdist/conf/type/__qemu_img/manifest
+++ b/cdist/conf/type/__qemu_img/manifest
@@ -4,7 +4,7 @@
 # Default settings
 #
 
-format="$(cat "$__object/parameter/format")"
+# format="$(cat "$__object/parameter/format")"
 state_should="$(cat "$__object/parameter/state")"
 
 diskimage="/$__object_id"
diff --git a/cdist/conf/type/__rsync/gencode-local b/cdist/conf/type/__rsync/gencode-local
index 155f3a3a..c7196175 100755
--- a/cdist/conf/type/__rsync/gencode-local
+++ b/cdist/conf/type/__rsync/gencode-local
@@ -31,7 +31,7 @@ set --
 if [ -f "$__object/parameter/rsync-opts" ]; then
     while read opts; do
         set -- "$@" "--$opts"
-    done < $__object/parameter/rsync-opts
+    done < "$__object/parameter/rsync-opts"
 fi
 
 echo rsync -a \
diff --git a/cdist/conf/type/__rvm/explorer/state b/cdist/conf/type/__rvm/explorer/state
index f43f5509..74d17048 100755
--- a/cdist/conf/type/__rvm/explorer/state
+++ b/cdist/conf/type/__rvm/explorer/state
@@ -28,7 +28,7 @@ if [ "$user" = "root" ]; then
         echo absent
     fi
 else
-    if su - $user -c "[ -d \"\$HOME/.rvm\" ]" ; then
+    if su - "$user" -c "[ -d \"\$HOME/.rvm\" ]" ; then
        echo "present"
     else
        echo "absent"
diff --git a/cdist/conf/type/__rvm_gem/gencode-remote b/cdist/conf/type/__rvm_gem/gencode-remote
index 1fe6e78e..9212de91 100755
--- a/cdist/conf/type/__rvm_gem/gencode-remote
+++ b/cdist/conf/type/__rvm_gem/gencode-remote
@@ -20,8 +20,6 @@
 
 gem="$__object_id"
 gemset="$(cat "$__object/parameter/gemset")"
-ruby="$(echo "$gemset" | cut -d '@' -f 1)"
-gemsetname="$(echo "$gemset" | cut -d '@' -f 2)"
 state_is="$(cat "$__object/explorer/state")"
 user="$(cat "$__object/parameter/user")"
 state_should="$(cat "$__object/parameter/state")"
diff --git a/cdist/conf/type/__rvm_gemset/explorer/state b/cdist/conf/type/__rvm_gemset/explorer/state
index fa643a6e..1556c22c 100755
--- a/cdist/conf/type/__rvm_gemset/explorer/state
+++ b/cdist/conf/type/__rvm_gemset/explorer/state
@@ -28,8 +28,8 @@ if [ ! -e "~$user/.rvm/scripts/rvm" ] ; then
    exit 0
 fi
 
-if su - "$user" -c 'source ~/.rvm/scripts/rvm; rvm list strings | grep -q "^$ruby\$"'; then
-    if su - "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$ruby" > /dev/null; rvm gemset list strings | cut -f 1 -d " " | grep -q "^$gemsetname\$"'; then
+if su - "$user" -c "source ~/.rvm/scripts/rvm; rvm list strings | grep -q \"^$ruby\$\""; then
+    if su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use \"$ruby\" > /dev/null; rvm gemset list strings | cut -f 1 -d " " | grep -q \"^$gemsetname\$\""; then
       echo "present"
       exit 0
   fi
diff --git a/cdist/conf/type/__rvm_ruby/gencode-remote b/cdist/conf/type/__rvm_ruby/gencode-remote
index 9bbc6031..f2fd41ef 100755
--- a/cdist/conf/type/__rvm_ruby/gencode-remote
+++ b/cdist/conf/type/__rvm_ruby/gencode-remote
@@ -21,7 +21,6 @@
 ruby="$__object_id"
 state_is="$(cat "$__object/explorer/state")"
 user="$(cat "$__object/parameter/user")"
-default="$(cat "$__object/parameter/default" 2>/dev/null || true)"
 state_should="$(cat "$__object/parameter/state")"
 
 [ "$state_is" = "$state_should" ] && exit 0
diff --git a/cdist/conf/type/__ssh_authorized_key/explorer/entry b/cdist/conf/type/__ssh_authorized_key/explorer/entry
index 1535d348..a6b849ce 100755
--- a/cdist/conf/type/__ssh_authorized_key/explorer/entry
+++ b/cdist/conf/type/__ssh_authorized_key/explorer/entry
@@ -19,12 +19,12 @@
 #
 
 # extract the keytype and base64 encoded key ignoring any options and comment
-type_and_key="$(cat "$__object/parameter/key" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
+type_and_key="$(tr ' ' '\n' < "$__object/parameter/key" | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
 # If type_and_key is empty, which is the case with an invalid key, do not grep $file because it results
 # in greping everything in file and all entries from file are removed.
 if [ -n "${type_and_key}" ]
 then
-    file="$(cat $__object/parameter/file)"
+    file="$(cat "$__object/parameter/file")"
 
     # get any entries that match the type and key
     grep ".*$type_and_key\([ \n]\|$\)" "$file" || true
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 7ded7dc6..3b5b0bb1 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -59,7 +59,7 @@ mkdir "$__object/files"
 (
    if [ -f "$__object/parameter/option" ]; then
       # comma seperated list of options
-      options="$(cat "$__object/parameter/option" | tr '\n' ',')"
+      options="$(tr '\n' ',' "$__object/parameter/option")"
       printf '%s ' "${options%*,}"
    fi
    if [ -f "$__object/parameter/comment" ]; then
@@ -88,7 +88,7 @@ fi
 entry="$(cat "$__object/files/should")"
 state_should="$(cat "$__object/parameter/state")"
 num_existing_entries=$(grep -c -F -x "$entry" "$__object/explorer/entry" || true)
-if [ $num_existing_entries -eq 1 ]; then
+if [ "$num_existing_entries" -eq 1 ]; then
    state_is="present"
 else
    # Posix grep does not define the -m option, so we can not remove a single
diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest
index 9fad8896..8cac3449 100755
--- a/cdist/conf/type/__ssh_authorized_keys/manifest
+++ b/cdist/conf/type/__ssh_authorized_keys/manifest
@@ -23,7 +23,7 @@ owner="$(cat "$__object/parameter/owner" 2>/dev/null || echo "$__object_id")"
 state="$(cat "$__object/parameter/state" 2>/dev/null)"
 file="$(cat "$__object/explorer/file")"
 
-if [ ! -f "$__object/parameter/noparent" -o ! -f "$__object/parameter/nofile" ]; then
+if [ ! -f "$__object/parameter/noparent" ] || [ ! -f "$__object/parameter/nofile" ]; then
    group="$(cut -d':' -f 1 "$__object/explorer/group")"
    if [ -z "$group" ]; then
       echo "Failed to get owners group from explorer." >&2
diff --git a/cdist/conf/type/__staged_file/gencode-local b/cdist/conf/type/__staged_file/gencode-local
index 8e2003af..851970e8 100755
--- a/cdist/conf/type/__staged_file/gencode-local
+++ b/cdist/conf/type/__staged_file/gencode-local
@@ -23,7 +23,6 @@
 
 destination="$__object_id"
 source="$(cat "$__object/parameter/source")"
-cksum="$(cat "$__object/parameter/cksum")"
 stage_dir="$(cat "$__object/parameter/stage-dir")"
 state="$(cat "$__object/parameter/state")"
 fetch_command="$(cat "$__object/parameter/fetch-command")"
@@ -74,7 +73,7 @@ fetch_and_prepare_file() {
 cat << DONE
 verify_cksum() {
    cksum_is="\$(cksum "$stage_file" | cut -d' ' -f1,2)"
-   cksum_should="$(cat "$__object/parameter/cksum" | cut -d' ' -f1,2)"
+   cksum_should="$(cut -d' ' -f1,2 "$__object/parameter/cksum")"
    if [ "\$cksum_is" = "\$cksum_should" ]; then
       return 0
    else
diff --git a/cdist/conf/type/__staged_file/manifest b/cdist/conf/type/__staged_file/manifest
index 1654e1d9..4d843275 100755
--- a/cdist/conf/type/__staged_file/manifest
+++ b/cdist/conf/type/__staged_file/manifest
@@ -19,11 +19,11 @@
 #
 
 destination="$__object_id"
-source="$(cat "$__object/parameter/source")"
-cksum="$(cat "$__object/parameter/cksum")"
+# source="$(cat "$__object/parameter/source")"
+# cksum="$(cat "$__object/parameter/cksum")"
 stage_dir="$(cat "$__object/parameter/stage-dir")"
-state="$(cat "$__object/parameter/state")"
-fetch_command="$(cat "$__object/parameter/fetch-command")"
+# state="$(cat "$__object/parameter/state")"
+# fetch_command="$(cat "$__object/parameter/fetch-command")"
 stage_file="${stage_dir}/${destination}"
 
 set -- "/${destination}"
diff --git a/cdist/conf/type/__start_on_boot/gencode-remote b/cdist/conf/type/__start_on_boot/gencode-remote
index 14ee7dab..0ecea85b 100755
--- a/cdist/conf/type/__start_on_boot/gencode-remote
+++ b/cdist/conf/type/__start_on_boot/gencode-remote
@@ -59,11 +59,11 @@ case "$state_should" in
                 ;;
 
                 gentoo)
-                    echo rc-update add \"$name\" \"$target_runlevel\"
+                    echo "rc-update add \"$name\" \"$target_runlevel\""
                 ;;
 
                 amazon|scientific|centos|fedora|owl|redhat|suse)
-                    echo chkconfig \"$name\" on
+                    echo "chkconfig \"$name\" on"
                 ;;
 
                 openwrt)
@@ -98,15 +98,15 @@ case "$state_should" in
         else
             case "$os" in
                 debian|ubuntu|devuan)
-                    echo update-rc.d -f \"$name\" remove
+                    echo "update-rc.d -f \"$name\" remove"
                 ;;
 
                 gentoo)
-                    echo rc-update del \"$name\"  \"$target_runlevel\"
+                    echo "rc-update del \"$name\"  \"$target_runlevel\""
                 ;;
 
                 centos|fedora|owl|redhat|suse)
-                    echo chkconfig \"$name\" off
+                    echo "chkconfig \"$name\" off"
                 ;;
 
                 openwrt)
diff --git a/cdist/conf/type/__user/explorer/shadow b/cdist/conf/type/__user/explorer/shadow
index 1e6658d4..32d0d56a 100755
--- a/cdist/conf/type/__user/explorer/shadow
+++ b/cdist/conf/type/__user/explorer/shadow
@@ -22,7 +22,7 @@
 #
 
 name=$__object_id
-os="$($__explorer/os)"
+os="$("$__explorer"/os)"
 # Default to using shadow passwords
 database="shadow"
 
diff --git a/cdist/conf/type/__user/gencode-remote b/cdist/conf/type/__user/gencode-remote
index 23762065..b908874b 100755
--- a/cdist/conf/type/__user/gencode-remote
+++ b/cdist/conf/type/__user/gencode-remote
@@ -52,7 +52,7 @@ shorten_property() {
 if [ "$state" = "present" ]; then
     cd "$__object/parameter"
     if grep -q "^${name}:" "$__object/explorer/passwd"; then
-       for property in $(ls .); do
+       for property in *; do
           new_value="$(cat "$property")"
           unset current_value
 
@@ -60,7 +60,7 @@ if [ "$state" = "present" ]; then
 
           case "$property" in
              gid)
-                if $(echo "$new_value" | grep -q '^[0-9][0-9]*$'); then
+                if echo "$new_value" | grep -q '^[0-9][0-9]*$'; then
                    field=4
                 else
                    # We were passed a group name.  Compare the gid in
@@ -97,7 +97,7 @@ if [ "$state" = "present" ]; then
           fi
 
           if [ "$new_value" != "$current_value" ]; then
-              set -- "$@" "$(shorten_property $property)" \'$new_value\'
+              set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
           fi
        done
 
@@ -113,14 +113,14 @@ if [ "$state" = "present" ]; then
        fi
     else
         echo add >> "$__messages_out"
-        for property in $(ls .); do
+        for property in *; do
             [ "$property" = "state" ] && continue
             [ "$property" = "remove-home" ] && continue
             new_value="$(cat "$property")"
             if [ -z "$new_value" ];then       # Boolean values have no value
-              set -- "$@" "$(shorten_property $property)"
+              set -- "$@" "$(shorten_property "$property")"
             else
-              set -- "$@" "$(shorten_property $property)" \'$new_value\'
+              set -- "$@" "$(shorten_property "$property")" \'"$new_value"\'
             fi
         done
 
diff --git a/cdist/conf/type/__zypper_repo/explorer/all_repo_ids b/cdist/conf/type/__zypper_repo/explorer/all_repo_ids
index b37d8ac5..dde6d554 100644
--- a/cdist/conf/type/__zypper_repo/explorer/all_repo_ids
+++ b/cdist/conf/type/__zypper_repo/explorer/all_repo_ids
@@ -21,4 +21,4 @@
 # Retrieve all repo id nummbers - parsed zypper output
 #
 #
-echo $(zypper lr | cut -d'|' -f 1 | grep -E '^[0-9]')
+zypper lr | cut -d'|' -f 1 | grep -E '^[0-9]'
diff --git a/cdist/conf/type/__zypper_repo/explorer/enabled_repo_ids b/cdist/conf/type/__zypper_repo/explorer/enabled_repo_ids
index 2dfb946f..b011c258 100644
--- a/cdist/conf/type/__zypper_repo/explorer/enabled_repo_ids
+++ b/cdist/conf/type/__zypper_repo/explorer/enabled_repo_ids
@@ -23,4 +23,4 @@
 #
 # simpler command which works only on SLES11 SP3 or newer:
 # echo $(zypper lr -E | cut -d'|' -f 1 | grep -E '^[0-9]')
-echo $(zypper lr |  grep -E '^[0-9]([^|]+\|){3,3} Yes' | cut -d'|' -f 1)
+zypper lr |  grep -E '^[0-9]([^|]+\|){3,3} Yes' | cut -d'|' -f 1
diff --git a/cdist/conf/type/__zypper_repo/explorer/repo_id b/cdist/conf/type/__zypper_repo/explorer/repo_id
index 6a4791e6..114c6fe7 100644
--- a/cdist/conf/type/__zypper_repo/explorer/repo_id
+++ b/cdist/conf/type/__zypper_repo/explorer/repo_id
@@ -26,4 +26,4 @@ if [ -f "$__object/parameter/uri" ]; then
 else
    uri="$__object_id"
 fi
-echo $(zypper lr -u | grep -F "$uri" | cut -d'|' -f 1 | grep -E '^[0-9]' )
+zypper lr -u | grep -F "$uri" | cut -d'|' -f 1 | grep -E '^[0-9]'
diff --git a/cdist/conf/type/__zypper_service/explorer/repo_ids b/cdist/conf/type/__zypper_service/explorer/repo_ids
index e831b76c..787e9869 100644
--- a/cdist/conf/type/__zypper_service/explorer/repo_ids
+++ b/cdist/conf/type/__zypper_service/explorer/repo_ids
@@ -24,4 +24,4 @@
 # simpler command which works only on SLES11 SP3 or newer:
 # echo $(zypper lr -u -E | cut -d'|' -f 1 | grep -E '^[0-9]')
 # on older systems, zypper doesn't know the parameter -E 
-echo $(zypper lr -u | grep -E '^([^|]+\|){3,3} Yes' | cut -d'|' -f 1 | grep -E '^[0-9]')
+zypper lr -u | grep -E '^([^|]+\|){3,3} Yes' | cut -d'|' -f 1 | grep -E '^[0-9]'
diff --git a/cdist/conf/type/__zypper_service/explorer/service_id b/cdist/conf/type/__zypper_service/explorer/service_id
index bf5f0260..91858d84 100644
--- a/cdist/conf/type/__zypper_service/explorer/service_id
+++ b/cdist/conf/type/__zypper_service/explorer/service_id
@@ -27,4 +27,4 @@ else
 fi
 # simpler command which works only on SLES11 SP3 or newer:
 # echo $(zypper ls -u -E | grep -E "\<$uri\>" | cut -d'|' -f 1 )
-echo $(zypper ls -u | grep -E '^([^|]+\|){3,3} Yes' | grep -E "\<$uri\>" | cut -d'|' -f 1 )
+zypper ls -u | grep -E '^([^|]+\|){3,3} Yes' | grep -E "\<$uri\>" | cut -d'|' -f 1
diff --git a/cdist/conf/type/__zypper_service/explorer/service_ids b/cdist/conf/type/__zypper_service/explorer/service_ids
index 0f1f4186..6491ab90 100644
--- a/cdist/conf/type/__zypper_service/explorer/service_ids
+++ b/cdist/conf/type/__zypper_service/explorer/service_ids
@@ -22,4 +22,4 @@
 #
 # simpler command which works only on SLES11 SP3 or newer:
 # echo $(zypper ls -u -E | cut -d'|' -f 1 | grep -E '^[0-9]')
-echo $(zypper ls -u | grep -E '^([^|]+\|){3,3} Yes' | cut -d'|' -f 1 | grep -E '^[0-9]')
+zypper ls -u | grep -E '^([^|]+\|){3,3} Yes' | cut -d'|' -f 1 | grep -E '^[0-9]'
diff --git a/cdist/conf/type/__zypper_service/explorer/service_uri b/cdist/conf/type/__zypper_service/explorer/service_uri
index 6eee47fb..2476ab71 100644
--- a/cdist/conf/type/__zypper_service/explorer/service_uri
+++ b/cdist/conf/type/__zypper_service/explorer/service_uri
@@ -25,4 +25,4 @@ if [ -f "$__object/parameter/uri" ]; then
 else
    uri="/$__object_id"
 fi
-echo $(zypper ls -u | awk 'BEGIN { FS = "[ ]+\\|[ ]+" } ; $4 == "Yes" && $NF == "'$uri'" {print $NF}')
+zypper ls -u | awk 'BEGIN { FS = "[ ]+\\|[ ]+" } ; $4 == "Yes" && $NF == "'"$uri"'" {print $NF}'
diff --git a/cdist/conf/type/__zypper_service/gencode-remote b/cdist/conf/type/__zypper_service/gencode-remote
index e5b41cc6..955698d1 100755
--- a/cdist/conf/type/__zypper_service/gencode-remote
+++ b/cdist/conf/type/__zypper_service/gencode-remote
@@ -46,7 +46,7 @@ exp_uri="$(cat "$__object/explorer/service_uri")"
 exp_id="$(cat "$__object/explorer/service_id")"
 
 # we need this list to remove ids, but we must do this in reverse order
-exp_ids="$(cat "$__object/explorer/service_ids" | rev)"
+exp_ids="$(rev "$__object/explorer/service_ids")"
 
 if [ "$uri" = "$exp_uri" ] ; then
     state_is="present"
diff --git a/cdist/conf/type/__zypper_service/manifest b/cdist/conf/type/__zypper_service/manifest
index e4f0bcf6..42a56830 100755
--- a/cdist/conf/type/__zypper_service/manifest
+++ b/cdist/conf/type/__zypper_service/manifest
@@ -47,7 +47,7 @@ fi
 [ "$state_is" = "$state_should" ] && exit 0
 
 # we need this list to remove ids, but we must do this in reverse order
-exp_repos="$(cat "$__object/explorer/repo_ids" | rev)"
+exp_repos="$(rev "$__object/explorer/repo_ids")"
 
 # boolean parameter
 if [ -f "$__object/parameter/remove-all-repos" ]; then

From 3759a37fbdf15c202c768add0323608f797d3c4f Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Tue, 26 Sep 2017 21:20:42 +0200
Subject: [PATCH 02/12] Fix tr reading from file.

---
 cdist/conf/type/__golang_from_vendor/gencode-remote | 2 +-
 cdist/conf/type/__ssh_authorized_key/gencode-remote | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__golang_from_vendor/gencode-remote b/cdist/conf/type/__golang_from_vendor/gencode-remote
index b1eeb6f4..5200e9e3 100755
--- a/cdist/conf/type/__golang_from_vendor/gencode-remote
+++ b/cdist/conf/type/__golang_from_vendor/gencode-remote
@@ -2,7 +2,7 @@
 
 version=$(cat "$__object/parameter/version")
 
-kernel_name=$(tr '[:upper:]' '[:lower:]' "$__global/explorer/kernel_name")
+kernel_name=$(tr '[:upper:]' '[:lower:]' < "$__global/explorer/kernel_name")
 machine=$(cat "$__global/explorer/machine")
 case $machine in
 	x86_64|amd64)
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 3b5b0bb1..325854c2 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -59,7 +59,7 @@ mkdir "$__object/files"
 (
    if [ -f "$__object/parameter/option" ]; then
       # comma seperated list of options
-      options="$(tr '\n' ',' "$__object/parameter/option")"
+      options="$(tr '\n' ',' < "$__object/parameter/option")"
       printf '%s ' "${options%*,}"
    fi
    if [ -f "$__object/parameter/comment" ]; then

From 6d0e1a2e73db00aef6b686fb17e6f3fa3e48f71c Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Thu, 28 Sep 2017 21:47:20 +0200
Subject: [PATCH 03/12] --tmpdir -> TMPDIR env var

---
 cdist/conf/type/__staged_file/gencode-local | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__staged_file/gencode-local b/cdist/conf/type/__staged_file/gencode-local
index 851970e8..255f30ed 100755
--- a/cdist/conf/type/__staged_file/gencode-local
+++ b/cdist/conf/type/__staged_file/gencode-local
@@ -61,7 +61,7 @@ fetch_file() {
 }
 
 fetch_and_prepare_file() {
-   printf 'tmpdir="$(mktemp -d --tmpdir="/tmp" "%s")"\n' "${__type##*/}.XXXXXXXXXX"
+   printf 'tmpdir="$(TMPDIR="/tmp" mktemp -d "%s")"\n' "${__type##*/}.XXXXXXXXXX"
    printf 'cd "$tmpdir"\n'
    printf "$fetch_command > \"%s\"\n" "$source" "$source_file_name"
    prepare_command="$(cat "$__object/parameter/prepare-command")"

From 309315910e587db429433d4f59e3a57d641eeeb7 Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Fri, 29 Sep 2017 19:34:43 +0200
Subject: [PATCH 04/12] Add shellcheck makefile target.

---
 Makefile | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/Makefile b/Makefile
index 3a1819be..70d80f99 100644
--- a/Makefile
+++ b/Makefile
@@ -39,6 +39,8 @@ PYTHON_VERSION=cdist/version.py
 SPHINXM=make -C $(DOCS_SRC_DIR) man
 SPHINXH=make -C $(DOCS_SRC_DIR) html
 SPHINXC=make -C $(DOCS_SRC_DIR) clean
+
+SHELLCHECKCMD=shellcheck -s sh -f gcc -x -e SC2154,SC1091
 ################################################################################
 # Manpages
 #
@@ -253,3 +255,22 @@ test-remote:
 
 pep8:
 	$(helper) $@
+
+shellcheck-global-explorers:
+	@find cdist/conf/explorer -type f -exec $(SHELLCHECKCMD) {} + || exit 0
+
+shellcheck-manifests:
+	@find cdist/conf/type -type f -name manifest -exec $(SHELLCHECKCMD) {} + || exit 0
+
+shellcheck-local-gencodes:
+	@find cdist/conf/type -type f -name gencode-local -exec $(SHELLCHECKCMD) {} + || exit 0
+
+shellcheck-remote-gencodes:
+	@find cdist/conf/type -type f -name gencode-remote -exec $(SHELLCHECKCMD) {} + || exit 0
+
+shellcheck-gencodes: shellcheck-local-gencodes shellcheck-remote-gencodes
+
+shellcheck-types: shellcheck-manifests shellcheck-gencodes
+
+shellcheck: shellcheck-global-explorers shellcheck-types
+

From 775d3dfc2ca36c06c97ab4059dd80e252331c6ed Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Fri, 29 Sep 2017 19:34:52 +0200
Subject: [PATCH 05/12] shellcheck fixes

---
 cdist/conf/type/__apt_ppa/manifest            |  2 +-
 cdist/conf/type/__config_file/manifest        |  2 +-
 cdist/conf/type/__consul_agent/manifest       |  2 +-
 cdist/conf/type/__consul_check/manifest       |  2 +-
 cdist/conf/type/__consul_service/manifest     |  2 +-
 cdist/conf/type/__consul_template/manifest    |  2 +-
 .../type/__consul_template_template/manifest  |  2 +-
 .../conf/type/__consul_watch_checks/manifest  |  2 +-
 cdist/conf/type/__consul_watch_event/manifest |  2 +-
 cdist/conf/type/__consul_watch_key/manifest   |  2 +-
 .../type/__consul_watch_keyprefix/manifest    |  2 +-
 cdist/conf/type/__consul_watch_nodes/manifest |  2 +-
 .../conf/type/__consul_watch_service/manifest |  2 +-
 .../type/__consul_watch_services/manifest     |  2 +-
 .../conf/type/__firewalld_rule/gencode-remote |  2 +-
 .../__install_generate_fstab/gencode-local    |  4 +++-
 cdist/conf/type/__install_mkfs/manifest       | 19 ++++++++++++-------
 .../conf/type/__install_mount/gencode-remote  |  4 +++-
 .../gencode-remote                            |  4 +++-
 cdist/conf/type/__install_reboot/manifest     |  5 +++--
 cdist/conf/type/__install_umount/manifest     |  5 +++--
 cdist/conf/type/__jail/manifest               |  2 +-
 .../conf/type/__postgres_role/gencode-remote  |  2 +-
 cdist/conf/type/__rsync/gencode-local         |  2 +-
 .../type/__ssh_authorized_key/gencode-remote  |  2 +-
 .../conf/type/__ssh_authorized_keys/manifest  |  2 +-
 26 files changed, 47 insertions(+), 34 deletions(-)

diff --git a/cdist/conf/type/__apt_ppa/manifest b/cdist/conf/type/__apt_ppa/manifest
index e1af21bd..7d637ad4 100755
--- a/cdist/conf/type/__apt_ppa/manifest
+++ b/cdist/conf/type/__apt_ppa/manifest
@@ -18,7 +18,7 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-name="$__object_id"
+# name="$__object_id"
 
 __package software-properties-common
 
diff --git a/cdist/conf/type/__config_file/manifest b/cdist/conf/type/__config_file/manifest
index 2e077db5..5381ded6 100755
--- a/cdist/conf/type/__config_file/manifest
+++ b/cdist/conf/type/__config_file/manifest
@@ -19,7 +19,7 @@
 #
 
 set -- "/${__object_id}"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       source)
          source="$(cat "$__object/parameter/source")"
diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index 19db1582..e9c240d9 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -84,7 +84,7 @@ echo "{"
 # parameters we define ourself
 printf '   "data_dir": "%s"\n' "$data_dir"
 
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state|user|group|json-config) continue ;;
       ca-file-source|cert-file-source|key-file-source)
diff --git a/cdist/conf/type/__consul_check/manifest b/cdist/conf/type/__consul_check/manifest
index 52878767..85f9615c 100755
--- a/cdist/conf/type/__consul_check/manifest
+++ b/cdist/conf/type/__consul_check/manifest
@@ -50,7 +50,7 @@ fi
 echo "{"
 printf '   "check": {\n'
 printf '      "name": "%s"\n' "$name"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state|name) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_service/manifest b/cdist/conf/type/__consul_service/manifest
index 58872128..1d495b94 100755
--- a/cdist/conf/type/__consul_service/manifest
+++ b/cdist/conf/type/__consul_service/manifest
@@ -42,7 +42,7 @@ fi
 echo "{"
 printf '   "service": {\n'
 printf '      "name": "%s"\n' "$name"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state|name|check-interval) continue ;;
       check-script)
diff --git a/cdist/conf/type/__consul_template/manifest b/cdist/conf/type/__consul_template/manifest
index 8fa6c31a..59cefd5d 100755
--- a/cdist/conf/type/__consul_template/manifest
+++ b/cdist/conf/type/__consul_template/manifest
@@ -75,7 +75,7 @@ require="__directory/etc/consul-template" \
 
 # Generate hcl config file
 (
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       auth-password|state|ssl-*|syslog-*|version|vault-token|vault-ssl*) continue ;;
       auth-username)
diff --git a/cdist/conf/type/__consul_template_template/manifest b/cdist/conf/type/__consul_template_template/manifest
index 3931e3e3..946df8d6 100755
--- a/cdist/conf/type/__consul_template_template/manifest
+++ b/cdist/conf/type/__consul_template_template/manifest
@@ -38,7 +38,7 @@ fi
 # Generate hcl config file
 (
 printf 'template {\n'
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       source-file)
          source="$(cat "$__object/parameter/$param")"
diff --git a/cdist/conf/type/__consul_watch_checks/manifest b/cdist/conf/type/__consul_watch_checks/manifest
index 0f0ff6be..80cefefd 100755
--- a/cdist/conf/type/__consul_watch_checks/manifest
+++ b/cdist/conf/type/__consul_watch_checks/manifest
@@ -35,7 +35,7 @@ fi
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       filter-*)
diff --git a/cdist/conf/type/__consul_watch_event/manifest b/cdist/conf/type/__consul_watch_event/manifest
index 7ee4f9ac..b660e962 100755
--- a/cdist/conf/type/__consul_watch_event/manifest
+++ b/cdist/conf/type/__consul_watch_event/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_key/manifest b/cdist/conf/type/__consul_watch_key/manifest
index 7ee4f9ac..b660e962 100755
--- a/cdist/conf/type/__consul_watch_key/manifest
+++ b/cdist/conf/type/__consul_watch_key/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_keyprefix/manifest b/cdist/conf/type/__consul_watch_keyprefix/manifest
index 7ee4f9ac..b660e962 100755
--- a/cdist/conf/type/__consul_watch_keyprefix/manifest
+++ b/cdist/conf/type/__consul_watch_keyprefix/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_nodes/manifest b/cdist/conf/type/__consul_watch_nodes/manifest
index 7ee4f9ac..b660e962 100755
--- a/cdist/conf/type/__consul_watch_nodes/manifest
+++ b/cdist/conf/type/__consul_watch_nodes/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_service/manifest b/cdist/conf/type/__consul_watch_service/manifest
index 2825c716..6a8fe0ff 100755
--- a/cdist/conf/type/__consul_watch_service/manifest
+++ b/cdist/conf/type/__consul_watch_service/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $(ls "$__object/parameter/"); do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       passingonly)
diff --git a/cdist/conf/type/__consul_watch_services/manifest b/cdist/conf/type/__consul_watch_services/manifest
index 7ee4f9ac..b660e962 100755
--- a/cdist/conf/type/__consul_watch_services/manifest
+++ b/cdist/conf/type/__consul_watch_services/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in "$__object/parameter/*"; do
+for param in $__object/parameter/*; do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__firewalld_rule/gencode-remote b/cdist/conf/type/__firewalld_rule/gencode-remote
index f5252145..e1441234 100755
--- a/cdist/conf/type/__firewalld_rule/gencode-remote
+++ b/cdist/conf/type/__firewalld_rule/gencode-remote
@@ -19,7 +19,7 @@
 #
 #
 
-name="$__object_id"
+# name="$__object_id"
 state_should="$(cat "$__object/parameter/state")"
 state_is="$(cat "$__object/explorer/rule")"
 
diff --git a/cdist/conf/type/__install_generate_fstab/gencode-local b/cdist/conf/type/__install_generate_fstab/gencode-local
index aca42761..80455aaa 100755
--- a/cdist/conf/type/__install_generate_fstab/gencode-local
+++ b/cdist/conf/type/__install_generate_fstab/gencode-local
@@ -25,7 +25,9 @@ mkdir "$__object/files"
 # get current UUID's from target_host
 $__remote_exec "$__target_host" blkid > "$__object/files/blkid"
 
-for object in $(find "$__global/object/__install_mount" -type d -name "$__cdist_object_marker"); do
+find "$__global/object/__install_mount" -type d -name "$__cdist_object_marker" |
+while IFS= read -r object
+do
    device="$(cat "$object/parameter/device")"
    dir="$(cat "$object/parameter/dir")"
    type="$(cat "$object/parameter/type")"
diff --git a/cdist/conf/type/__install_mkfs/manifest b/cdist/conf/type/__install_mkfs/manifest
index eb65757f..9d0e05f6 100755
--- a/cdist/conf/type/__install_mkfs/manifest
+++ b/cdist/conf/type/__install_mkfs/manifest
@@ -19,13 +19,18 @@
 #
 
 # set defaults
-if [ -f "$__object/parameter/device" ]; then
-   device="(cat "$__object/parameter/device")"
-else
+# if [ -f "$__object/parameter/device" ]; then
+#    device="(cat "$__object/parameter/device")"
+# else
+#    device="/$__object_id"
+#    echo "$device" > "$__object/parameter/device"
+# fi
+
+# type="(cat "$__object/parameter/type")"
+
+# options="(cat "$__object/parameter/options")"
+
+if [ ! -f "$__object/parameter/device" ]; then
    device="/$__object_id"
    echo "$device" > "$__object/parameter/device"
 fi
-
-type="(cat "$__object/parameter/type")"
-
-options="(cat "$__object/parameter/options")"
diff --git a/cdist/conf/type/__install_mount/gencode-remote b/cdist/conf/type/__install_mount/gencode-remote
index ce96279a..4415f0ff 100755
--- a/cdist/conf/type/__install_mount/gencode-remote
+++ b/cdist/conf/type/__install_mount/gencode-remote
@@ -20,7 +20,9 @@
 
 get_type_from_mkfs() {
    _device="$1"
-   for mkfs_object in $(find "$__global/object/__install_mkfs" -type d -name "$__cdist_object_marker"); do
+   find "$__global/object/__install_mkfs" -type d -name "$__cdist_object_marker" |
+   while IFS= read -r mkfs_object
+   do
       mkfs_device="$(cat "$mkfs_object/parameter/device")"
       if [ "$_device" = "$mkfs_device" ]; then
          cat "$mkfs_object/parameter/type"
diff --git a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
index 72c65201..b4298c7c 100755
--- a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
+++ b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
@@ -59,7 +59,9 @@ size_to_mb() {
 
 get_objects() {
    objects_file=$(mktemp)
-   for object in $(find "$__global/object/__install_partition_msdos" -type d -name "$__cdist_object_marker"); do
+   find "$__global/object/__install_partition_msdos" -type d -name "$__cdist_object_marker" |
+   while IFS= read -r object
+   do
       object_device="$(cat "$object/parameter/device")"
       object_minor="$(cat "$object/parameter/minor")"
       echo "$object_device $object_minor $object" >> "$objects_file"
diff --git a/cdist/conf/type/__install_reboot/manifest b/cdist/conf/type/__install_reboot/manifest
index 02689d82..86ae797c 100755
--- a/cdist/conf/type/__install_reboot/manifest
+++ b/cdist/conf/type/__install_reboot/manifest
@@ -19,5 +19,6 @@
 #
 
 # set defaults
-options="$(cat "$__object/parameter/options" 2>/dev/null \
-   || echo "" | tee "$__object/parameter/options")"
+# options="$(cat "$__object/parameter/options" 2>/dev/null \
+#   || echo "" | tee "$__object/parameter/options")"
+cat "$__object/parameter/options" 2>/dev/null 1>/dev/null || echo "" > "$__object/parameter/options"
diff --git a/cdist/conf/type/__install_umount/manifest b/cdist/conf/type/__install_umount/manifest
index 42cd19bf..07753ac9 100755
--- a/cdist/conf/type/__install_umount/manifest
+++ b/cdist/conf/type/__install_umount/manifest
@@ -19,5 +19,6 @@
 #
 
 # set defaults
-target="$(cat "$__object/parameter/target" 2>/dev/null \
-   || echo "/target" | tee "$__object/parameter/target")"
+# target="$(cat "$__object/parameter/target" 2>/dev/null \
+#    || echo "/target" | tee "$__object/parameter/target")"
+cat "$__object/parameter/target" 2>/dev/null 1>/dev/null || echo "/target" > "$__object/parameter/target"
diff --git a/cdist/conf/type/__jail/manifest b/cdist/conf/type/__jail/manifest
index 63a2fab2..6fb4a306 100755
--- a/cdist/conf/type/__jail/manifest
+++ b/cdist/conf/type/__jail/manifest
@@ -44,7 +44,7 @@ for property in *; do
 done
 
 ver="$(cat "$__global/explorer/os_version")"
-if "$(echo "$ver" | grep -q '^10\.' )"; then   # Version is 10.x
+if echo "$ver" | grep -q '^10\.'; then   # Version is 10.x
    __jail_freebsd10 "$@"
 else
    __jail_freebsd9 "$@"
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index 14240992..f977e73e 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -34,7 +34,7 @@ case "$state_should" in
             if [ ! -f "$__object/parameter/$boolean" ]; then
                 boolean="no${boolean}"
             fi
-            upper=$(echo $boolean | tr '[a-z]' '[A-Z]')
+            upper=$(echo $boolean | tr '[:lower:]' '[:upper:]')
             booleans="$booleans $upper"
         done
 
diff --git a/cdist/conf/type/__rsync/gencode-local b/cdist/conf/type/__rsync/gencode-local
index c7196175..e36ded2f 100755
--- a/cdist/conf/type/__rsync/gencode-local
+++ b/cdist/conf/type/__rsync/gencode-local
@@ -29,7 +29,7 @@ fi
 
 set --
 if [ -f "$__object/parameter/rsync-opts" ]; then
-    while read opts; do
+    while read -r opts; do
         set -- "$@" "--$opts"
     done < "$__object/parameter/rsync-opts"
 fi
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 325854c2..82c90d61 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -78,7 +78,7 @@ if [ -s "$__object/explorer/entry" ]; then
    # Note that the files have to be sorted for comparison with `comm`.
    sort "$__object/explorer/entry" > "$__object/files/is"
    comm -13 "$__object/files/should" "$__object/files/is" | {
-      while read entry; do
+      while read -r entry; do
          remove_line "$file" "$entry"
       done
    }
diff --git a/cdist/conf/type/__ssh_authorized_keys/manifest b/cdist/conf/type/__ssh_authorized_keys/manifest
index 8cac3449..f6ff74c3 100755
--- a/cdist/conf/type/__ssh_authorized_keys/manifest
+++ b/cdist/conf/type/__ssh_authorized_keys/manifest
@@ -61,7 +61,7 @@ _cksum() {
    echo "$1" | cksum | cut -d' ' -f 1
 }
 
-while read key; do
+while read -r key; do
    type_and_key="$(echo "$key" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
    object_id="$(_cksum "$file")-$(_cksum "$type_and_key")"
    set -- "$object_id"

From b55520e9871e3bf2796b775573c5b7c105e0eab8 Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Tue, 21 Nov 2017 23:32:04 +0100
Subject: [PATCH 06/12] Applying uqam-fob's suggestions.

---
 cdist/conf/explorer/cpu_sockets                             | 6 +++---
 cdist/conf/type/__ccollect_source/manifest                  | 2 +-
 cdist/conf/type/__docker_compose/gencode-remote             | 4 ++--
 cdist/conf/type/__install_reboot/manifest                   | 2 +-
 .../conf/type/__package_pkgng_freebsd/explorer/pkg_version  | 4 ++--
 cdist/conf/type/__rvm/explorer/state                        | 2 +-
 cdist/conf/type/__staged_file/gencode-local                 | 2 +-
 7 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/cdist/conf/explorer/cpu_sockets b/cdist/conf/explorer/cpu_sockets
index afb7b6b0..1e75182b 100755
--- a/cdist/conf/explorer/cpu_sockets
+++ b/cdist/conf/explorer/cpu_sockets
@@ -25,14 +25,14 @@
 os=$("$__explorer/os")
 case "$os" in
     "macosx")
-        system_profiler SPHardwareDataType | grep "Number of Processors" | awk -F': ' '{print $2}'
+        system_profiler SPHardwareDataType | grep "Number of Processors" | awk -F ': ' '/Number of Processors/ {print $2}'
     ;;
 
     *)
     if [ -r /proc/cpuinfo ]; then
-        sockets="$(grep "physical id" /proc/cpuinfo | sort | uniq | wc -l)"
+        sockets=$(grep "physical id" /proc/cpuinfo | sort -u | wc -l)
         if [ "${sockets}" -eq 0 ]; then
-            sockets="$(grep -c "processor" /proc/cpuinfo)"
+            sockets=$(grep -cE "^processor\s+:" /proc/cpuinfo)
         fi
         echo "${sockets}"
     fi
diff --git a/cdist/conf/type/__ccollect_source/manifest b/cdist/conf/type/__ccollect_source/manifest
index 26c6cc99..b3694722 100755
--- a/cdist/conf/type/__ccollect_source/manifest
+++ b/cdist/conf/type/__ccollect_source/manifest
@@ -22,7 +22,7 @@ name="$__object_id"
 state="$(cat "$__object/parameter/state")"
 source="$(cat "$__object/parameter/source")"
 destination="$(cat "$__object/parameter/destination")"
-ccollectconf="$(sed 's,/$,,' "$__object/parameter/ccollectconf")"
+ccollectconf="$(sed -E 's,/+$,,' "$__object/parameter/ccollectconf")"
 
 sourcedir="$ccollectconf/sources"
 basedir="$sourcedir/$name"
diff --git a/cdist/conf/type/__docker_compose/gencode-remote b/cdist/conf/type/__docker_compose/gencode-remote
index 396c93ac..4872d83d 100755
--- a/cdist/conf/type/__docker_compose/gencode-remote
+++ b/cdist/conf/type/__docker_compose/gencode-remote
@@ -24,8 +24,8 @@ state="$(cat "$__object/parameter/state")"
 
 if [ "${state}" = "present" ]; then
     # Download docker-compose file
-        echo 'curl -L "https://github.com/docker/compose/releases/download/'"${version}"'/docker-compose-$(uname -s)-$(uname -m)" -o /tmp/docker-compose'
-        echo 'mv /tmp/docker-compose /usr/local/bin/docker-compose'
+    echo "curl -L 'https://github.com/docker/compose/releases/download/${version}/docker-compose-$(uname -s)-$(uname -m)' -o /tmp/docker-compose"
+    echo 'mv /tmp/docker-compose /usr/local/bin/docker-compose'
     # Change permissions
     echo 'chmod +x /usr/local/bin/docker-compose'
 fi
diff --git a/cdist/conf/type/__install_reboot/manifest b/cdist/conf/type/__install_reboot/manifest
index 86ae797c..6255d525 100755
--- a/cdist/conf/type/__install_reboot/manifest
+++ b/cdist/conf/type/__install_reboot/manifest
@@ -21,4 +21,4 @@
 # set defaults
 # options="$(cat "$__object/parameter/options" 2>/dev/null \
 #   || echo "" | tee "$__object/parameter/options")"
-cat "$__object/parameter/options" 2>/dev/null 1>/dev/null || echo "" > "$__object/parameter/options"
+[ -f "$__object/parameter/options" ] || touch "$__object/parameter/options"
diff --git a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version
index 92ce0623..9ab32f2e 100755
--- a/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version
+++ b/cdist/conf/type/__package_pkgng_freebsd/explorer/pkg_version
@@ -29,9 +29,9 @@ fi
 
 # Don't produce "no pkgs installed" output -- breaks things
 PKG_OUTPUT=$(pkg info 2>&1)
-printf "%s" "$(echo "$PKG_OUTPUT" \
+printf "%s" "$PKG_OUTPUT" \
    | awk '{print $1}' \
    | sed 's/^\(.*\)-\([^-]*\)$/name:\1 ver:\2/g' \
    | grep "name:$name ver:" \
-   | sed 's/^.*ver:\(.*\)/\1/g')"
+   | sed 's/^.*ver:\(.*\)/\1/g'
 
diff --git a/cdist/conf/type/__rvm/explorer/state b/cdist/conf/type/__rvm/explorer/state
index 74d17048..67e1c27c 100755
--- a/cdist/conf/type/__rvm/explorer/state
+++ b/cdist/conf/type/__rvm/explorer/state
@@ -28,7 +28,7 @@ if [ "$user" = "root" ]; then
         echo absent
     fi
 else
-    if su - "$user" -c "[ -d \"\$HOME/.rvm\" ]" ; then
+    if su -l "$user" -c "[ -d \"\$HOME/.rvm\" ]" ; then
        echo "present"
     else
        echo "absent"
diff --git a/cdist/conf/type/__staged_file/gencode-local b/cdist/conf/type/__staged_file/gencode-local
index 255f30ed..b953c40a 100755
--- a/cdist/conf/type/__staged_file/gencode-local
+++ b/cdist/conf/type/__staged_file/gencode-local
@@ -61,7 +61,7 @@ fetch_file() {
 }
 
 fetch_and_prepare_file() {
-   printf 'tmpdir="$(TMPDIR="/tmp" mktemp -d "%s")"\n' "${__type##*/}.XXXXXXXXXX"
+   printf 'tmpdir="$(TMPDIR=${TMPDIR:-/tmp} mktemp -d "%s")"\n' "${__type##*/}.XXXXXXXXXX"
    printf 'cd "$tmpdir"\n'
    printf "$fetch_command > \"%s\"\n" "$source" "$source_file_name"
    prepare_command="$(cat "$__object/parameter/prepare-command")"

From 62f1e1db005af8571846935faa3e1ff9b3aedadb Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Tue, 21 Nov 2017 23:35:25 +0100
Subject: [PATCH 07/12] Applying uqam-fob's suggestions.

---
 cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version b/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version
index 0a1ab75c..1ceaebe3 100755
--- a/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version
+++ b/cdist/conf/type/__package_pkg_freebsd/explorer/pkg_version
@@ -30,10 +30,10 @@ fi
 # Don't produce "no pkgs installed" output -- breaks things
 PKG_OUTPUT=$(pkg_info 2>&1)
 if [ ! "$PKG_OUTPUT" = "pkg_info: no packages installed" ]; then
-	printf "%s" "$(echo "$PKG_OUTPUT" \
+	printf "%s" "$PKG_OUTPUT" \
 		| awk '{print $1}' \
 		| sed 's/^\(.*\)-\([^-]*\)$/name:\1 ver:\2/g' \
 		| grep "name:$name ver:" \
-		| sed 's/^.*ver:\(.*\)/\1/g')"
+		| sed 's/^.*ver:\(.*\)/\1/g'
 fi
 

From 1388487199c78ef25586f8370da543661308f47e Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Wed, 22 Nov 2017 13:13:35 +0100
Subject: [PATCH 08/12] Clean quotes; su - -> su -l

---
 cdist/conf/type/__apt_key/gencode-remote      |  4 +--
 cdist/conf/type/__apt_ppa/gencode-remote      |  4 +--
 .../type/__ccollect_source/gencode-remote     | 14 +++++-----
 cdist/conf/type/__cron/gencode-remote         | 22 ++++++++++------
 cdist/conf/type/__directory/gencode-remote    | 18 ++++++-------
 cdist/conf/type/__file/gencode-local          |  4 +--
 cdist/conf/type/__file/gencode-remote         | 14 +++++-----
 .../conf/type/__firewalld_rule/gencode-remote |  8 +++---
 .../type/__firewalld_start/gencode-remote     | 16 ++++++------
 .../gencode-remote                            |  2 +-
 .../conf/type/__jail_freebsd10/gencode-remote |  6 ++---
 .../conf/type/__jail_freebsd9/gencode-remote  |  6 ++---
 cdist/conf/type/__keyboard/manifest           |  4 +--
 cdist/conf/type/__package_apt/gencode-remote  |  2 +-
 .../conf/type/__package_emerge/gencode-remote |  4 +--
 .../type/__package_luarocks/gencode-remote    |  4 +--
 cdist/conf/type/__package_opkg/gencode-remote |  6 ++---
 .../conf/type/__package_pacman/gencode-remote |  4 +--
 cdist/conf/type/__package_pip/gencode-remote  |  4 +--
 .../type/__package_pkg_freebsd/gencode-remote | 18 +++++++------
 .../type/__package_rubygem/gencode-remote     |  4 +--
 .../type/__package_upgrade_all/gencode-remote |  2 +-
 cdist/conf/type/__package_yum/gencode-remote  |  4 +--
 .../conf/type/__package_zypper/gencode-remote |  6 ++---
 .../type/__postgres_database/explorer/state   |  2 +-
 .../type/__postgres_database/gencode-remote   |  4 +--
 .../type/__postgres_extension/gencode-remote  |  4 +--
 .../conf/type/__postgres_role/explorer/state  |  2 +-
 .../conf/type/__postgres_role/gencode-remote  |  4 +--
 cdist/conf/type/__qemu_img/gencode-remote     |  2 +-
 cdist/conf/type/__rvm/gencode-remote          |  4 +--
 cdist/conf/type/__rvm_gem/explorer/state      |  6 ++---
 cdist/conf/type/__rvm_gem/gencode-remote      |  4 +--
 cdist/conf/type/__rvm_gemset/explorer/state   |  4 +--
 cdist/conf/type/__rvm_gemset/gencode-remote   |  6 ++---
 cdist/conf/type/__rvm_ruby/explorer/state     |  4 +--
 cdist/conf/type/__rvm_ruby/gencode-remote     |  6 ++---
 .../type/__ssh_authorized_key/gencode-remote  |  2 +-
 .../conf/type/__start_on_boot/gencode-remote  | 26 +++++++++----------
 cdist/conf/type/__timezone/gencode-remote     |  2 +-
 cdist/conf/type/__timezone/manifest           |  2 +-
 cdist/conf/type/__user_groups/gencode-remote  | 14 +++++-----
 .../conf/type/__zypper_service/gencode-remote | 12 ++++-----
 43 files changed, 149 insertions(+), 141 deletions(-)

diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote
index 9c4fa00c..66494466 100755
--- a/cdist/conf/type/__apt_key/gencode-remote
+++ b/cdist/conf/type/__apt_key/gencode-remote
@@ -34,9 +34,9 @@ fi
 case "$state_should" in
    present)
       keyserver="$(cat "$__object/parameter/keyserver")"
-      echo "apt-key adv --keyserver \"$keyserver\" --recv-keys \"$keyid\""
+      echo "apt-key adv --keyserver '$keyserver' --recv-keys '$keyid'"
    ;;
    absent)
-      echo "apt-key del \"$keyid\""
+      echo "apt-key del '$keyid'"
    ;;
 esac
diff --git a/cdist/conf/type/__apt_ppa/gencode-remote b/cdist/conf/type/__apt_ppa/gencode-remote
index 41a6dc07..84ebebfe 100755
--- a/cdist/conf/type/__apt_ppa/gencode-remote
+++ b/cdist/conf/type/__apt_ppa/gencode-remote
@@ -29,9 +29,9 @@ fi
 
 case "$state_should" in
    present)
-      echo add-apt-repository \""$name"\"
+      echo "add-apt-repository '$name'"
    ;;
    absent)
-      echo remove-apt-repository \""$name"\"
+      echo "remove-apt-repository '$name'"
    ;;
 esac
diff --git a/cdist/conf/type/__ccollect_source/gencode-remote b/cdist/conf/type/__ccollect_source/gencode-remote
index 4ae74bc6..d22a0394 100755
--- a/cdist/conf/type/__ccollect_source/gencode-remote
+++ b/cdist/conf/type/__ccollect_source/gencode-remote
@@ -42,18 +42,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \""$1"\" \""$destination"\"
-    echo chgrp "$1" >> "$__messages_out"
+    echo "chgrp '$1' '$destination'"
+    echo "chgrp $1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \""$1"\" \""$destination"\"
-    echo chown "$1" >> "$__messages_out"
+    echo "chown '$1' '$destination'"
+    echo "chown $1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \""$1"\" \""$destination"\"
-   echo chmod "$1" >> "$__messages_out"
+   echo "chmod '$1' '$destination'"
+   echo "chmod $1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -80,7 +80,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \""$destination"\"
+            echo "rm -f '$destination'"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__cron/gencode-remote b/cdist/conf/type/__cron/gencode-remote
index f58896af..7b7f8512 100755
--- a/cdist/conf/type/__cron/gencode-remote
+++ b/cdist/conf/type/__cron/gencode-remote
@@ -79,18 +79,24 @@ DONE
 case "$state_should" in
     present)
         # if we insert new entry, filter also all entrys out with the same id 
-        echo "("
-        echo "crontab -u $user -l 2>/dev/null | grep -v -E \"$filter\" | grep -v \"# $name\\$\" 2>/dev/null || true"
-        echo "echo '$entry'"
-        echo ") | crontab -u $user -"
+        cat <<EOF
+(
+crontab -u $user -l 2>/dev/null | grep -v -E '$filter' | grep -v '# $name\\$' 2>/dev/null || true
+echo '$entry'
+) | crontab -u $user -
+EOF
     ;;
     absent)
         if [ -f "$__object/parameter/raw_command" ]; then
-            echo "( crontab -u $user -l 2>/dev/null | grep -v -E \"$filter\" 2>/dev/null || true ) | \\"
-            echo "grep -v \"^$entry\\$\" | crontab -u $user -"
+            cat <<EOF
+( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '^$entry\\$' | crontab -u $user -
+EOF
         else
-            echo "( crontab -u $user -l 2>/dev/null | grep -v -E \"$filter\" 2>/dev/null || true ) | \\"
-            echo "grep -v \"# $name\\$\" | crontab -u $user -"
+            cat <<EOF
+( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '# $name\\$' | crontab -u $user -
+EOF
         fi
     ;;
 esac
diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote
index 35866eb4..fd1ff9ff 100755
--- a/cdist/conf/type/__directory/gencode-remote
+++ b/cdist/conf/type/__directory/gencode-remote
@@ -57,18 +57,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp "$recursive" \""$1"\" \""$destination"\"
-    echo chgrp "$recursive" "$1" >> "$__messages_out"
+    echo "chgrp '$recursive' '$1' '$destination'"
+    echo "chgrp $recursive $1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown "$recursive" \""$1"\" \""$destination"\"
-    echo chown "$recursive" "$1" >> "$__messages_out"
+    echo "chown '$recursive' '$1' '$destination'"
+    echo "chown $recursive $1" >> "$__messages_out"
 }
 
 set_mode() {
-    echo chmod "$recursive" \""$1"\" \""$destination"\"
-    echo chmod "$recursive" "$1" >> "$__messages_out"
+    echo "chmod '$recursive' '$1' '$destination'"
+    echo "chmod $recursive $1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -78,10 +78,10 @@ case "$state_should" in
          if [ "$type" != "none" ]; then
             # our destination is not a directory, remove whatever is there
             # and then create our directory and set all attributes
-            echo rm -f "\"$destination\""
+            echo "rm -f '$destination'"
             echo "remove non directory" >> "$__messages_out"
          fi
-         echo "mkdir $mkdiropt \"$destination\""
+         echo "mkdir $mkdiropt '$destination'"
          echo "create" >> "$__messages_out"
       fi
 
@@ -105,7 +105,7 @@ case "$state_should" in
    ;;
    absent)
         if [ "$type" = "directory" ]; then
-            echo rm -rf \""$destination"\"
+            echo "rm -rf '$destination'"
             echo remove >> "$__messages_out"
         fi
    ;;
diff --git a/cdist/conf/type/__file/gencode-local b/cdist/conf/type/__file/gencode-local
index fb9f9a92..7ca5941f 100755
--- a/cdist/conf/type/__file/gencode-local
+++ b/cdist/conf/type/__file/gencode-local
@@ -54,7 +54,7 @@ if [ "$state_should" = "present" ] || [ "$state_should" = "exists" ]; then
          source="$__object/stdin"
       fi
       if [ ! -f "$source" ]; then
-         echo "Source \"$source\" does not exist." >&2
+         echo "Source '$source' does not exist." >&2
          exit 1
       else
          if [ "$type" != "file" ]; then
@@ -96,7 +96,7 @@ DONE
       fi
 # move uploaded file into place
 cat << DONE
-$__remote_exec $__target_host "rm -rf \"$destination\"; mv \"\$destination_upload\" \"$destination\""
+$__remote_exec $__target_host "rm -rf '$destination'; mv \"\$destination_upload\" '$destination'"
 DONE
    fi
 fi
diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote
index c98e6e76..8c8b426d 100755
--- a/cdist/conf/type/__file/gencode-remote
+++ b/cdist/conf/type/__file/gencode-remote
@@ -43,18 +43,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \""$1"\" \""$destination"\"
-    echo chgrp "$1" >> "$__messages_out"
+    echo "chgrp '$1' '$destination'"
+    echo "chgrp $1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \""$1"\" \""$destination"\"
-    echo chown "$1" >> "$__messages_out"
+    echo "chown '$1' '$destination'"
+    echo "chown $1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \""$1"\" \""$destination"\"
-   echo chmod "$1" >> "$__messages_out"
+   echo "chmod '$1' '$destination'"
+   echo "chmod $1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -81,7 +81,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \""$destination"\"
+            echo "rm -f '$destination'"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__firewalld_rule/gencode-remote b/cdist/conf/type/__firewalld_rule/gencode-remote
index e1441234..35835635 100755
--- a/cdist/conf/type/__firewalld_rule/gencode-remote
+++ b/cdist/conf/type/__firewalld_rule/gencode-remote
@@ -33,13 +33,13 @@ rule="$(cat "$__object/parameter/rule")"
 
 case "$state_should" in
     present)
-        echo firewall-cmd --quiet --permanent --direct --add-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
-        echo firewall-cmd --quiet --direct --add-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
+        echo "firewall-cmd --quiet --permanent --direct --add-rule '$protocol' '$table' '$chain' '$priority' $rule"
+        echo "firewall-cmd --quiet --direct --add-rule '$protocol' '$table' '$chain' '$priority' $rule"
     ;;
 
     absent)
-        echo firewall-cmd --quiet --permanent --direct --remove-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
-        echo firewall-cmd --quiet --direct --remove-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
+        echo "firewall-cmd --quiet --permanent --direct --remove-rule '$protocol' '$table' '$chain' '$priority' $rule"
+        echo "firewall-cmd --quiet --direct --remove-rule '$protocol' '$table' '$chain' '$priority' $rule"
     ;;
     *)
         echo "Unknown state $state_should" >&2
diff --git a/cdist/conf/type/__firewalld_start/gencode-remote b/cdist/conf/type/__firewalld_start/gencode-remote
index 3e767f68..771007af 100755
--- a/cdist/conf/type/__firewalld_start/gencode-remote
+++ b/cdist/conf/type/__firewalld_start/gencode-remote
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+"#!/bin/sh -2
 #
 # 2016 Darko Poljak(darko.poljak at ungleich.ch)
 #
@@ -42,16 +42,16 @@ esac
 if [ "$init" = 'systemd' ]; then
     # this handles ALL linux distros with systemd
     # e.g. archlinux, gentoo in some cases, new RHEL and SLES versions
-    echo "systemctl \"$cmd\" \"$name\""
+    echo "systemctl '$cmd' '$name'"
 else
     case "$os" in
         debian)
             case "$os_version" in
                 [1-7]*)
-                    echo "service \"$name\" \"$cmd\""
+                    echo "service '$name' '$cmd'"
                 ;;
                 8*)
-                    echo "systemctl \"$cmd\" \"$name\""
+                    echo "systemctl '$cmd' '$name'"
                 ;;
                 *)
                     echo "Unsupported version $os_version of $os" >&2
@@ -61,19 +61,19 @@ else
         ;;
 
         gentoo)
-            echo service \"$name\" \"$cmd\"
+            echo "service '$name' '$cmd'"
         ;;
 
         amazon|scientific|centos|fedora|owl|redhat|suse)
-            echo service \"$name\" \"$cmd\"
+            echo "service '$name' '$cmd'"
         ;;
 
         openwrt)
-            echo "/etc/init.d/\"$name\" \"$cmd\""
+            echo "'/etc/init.d/$name' '$cmd'"
         ;;
 
         ubuntu)
-            echo "service \"$name\" \"$cmd\""
+            echo "service '$name' '$cmd'"
         ;;
 
         *)
diff --git a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
index b4298c7c..240ae00b 100755
--- a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
+++ b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
@@ -87,7 +87,7 @@ primary_count=0
 for object in $objects; do
    device="$(cat "$object/parameter/device")"
    if [ "$current_device" != "$device" ]; then
-      echo "create_disklabel \"$device\" || die 'Failed to create disklabel for $device'"
+      echo "create_disklabel '$device' || die 'Failed to create disklabel for $device'"
       current_device="$device"
       device_name=$(echo "${device}" | sed -e 's:^/dev/::;s:/:\\/:g')
       available_device_size=$(( $(awk "/${device_name}\$/ { print \$3; }" "$partitions") / 1024))
diff --git a/cdist/conf/type/__jail_freebsd10/gencode-remote b/cdist/conf/type/__jail_freebsd10/gencode-remote
index fa821994..33ba9cc4 100755
--- a/cdist/conf/type/__jail_freebsd10/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd10/gencode-remote
@@ -130,11 +130,11 @@ deleteJail() {
       fi
 EOF
 # Remove the jail's rw mountpoints
-   echo "rm -rf \"${jaildir}/rw/${name}\""
+   echo "rm -rf '${jaildir}/rw/${name}'"
 # Remove the jail directory
-   echo "rm -rf \"${jaildir}/${name}\""
+   echo "rm -rf '${jaildir}/${name}'"
 # Remove the jail's fstab
-   echo "rm -f \"/etc/fstab.${name}\""
+   echo "rm -f '/etc/fstab.${name}'"
 # Remove jail entry from jail.conf
    cat <<EOF
       sed -i .bak -E -e "/^${name} {\$/,/^}\\\$/d" /etc/jail.conf
diff --git a/cdist/conf/type/__jail_freebsd9/gencode-remote b/cdist/conf/type/__jail_freebsd9/gencode-remote
index 95404f4f..7be9ce35 100755
--- a/cdist/conf/type/__jail_freebsd9/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd9/gencode-remote
@@ -135,11 +135,11 @@ deleteJail() {
       fi
 EOF
 # Remove the jail's rw mountpoints
-   echo "rm -rf \"${jaildir}/rw/${name}\""
+   echo "rm -rf '${jaildir}/rw/${name}'"
 # Remove the jail directory
-   echo "rm -rf \"${jaildir}/${name}\""
+   echo "rm -rf '${jaildir}/${name}'"
 # Remove the jail's fstab
-   echo "rm -f \"/etc/fstab.${name}\""
+   echo "rm -f '/etc/fstab.${name}'"
 # Remove jail_$name_* lines from rc.conf
    cat <<EOF
       sed -i '.bak' "/^jail_${name}_/d" /etc/rc.conf
diff --git a/cdist/conf/type/__keyboard/manifest b/cdist/conf/type/__keyboard/manifest
index 80cd4819..e7591cbc 100755
--- a/cdist/conf/type/__keyboard/manifest
+++ b/cdist/conf/type/__keyboard/manifest
@@ -34,13 +34,13 @@ case "$os" in
             __key_value KEYTABLE \
                 --file /etc/sysconfig/keyboard \
                 --delimiter '=' \
-                --value "\"$keyboard_type\""
+                --value "'$keyboard_type'"
         
         require="__file/etc/sysconfig/keyboard" \
             __key_value LAYOUT \
                 --file /etc/sysconfig/keyboard \
                 --delimiter '=' \
-                --value "\"$keyboard_type\""
+                --value "'$keyboard_type'"
     ;;
     *)
       echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
diff --git a/cdist/conf/type/__package_apt/gencode-remote b/cdist/conf/type/__package_apt/gencode-remote
index cbe14787..e1477db4 100755
--- a/cdist/conf/type/__package_apt/gencode-remote
+++ b/cdist/conf/type/__package_apt/gencode-remote
@@ -64,7 +64,7 @@ esac
 
 # Hint if we need to avoid questions at some point:
 # DEBIAN_PRIORITY=critical can reduce the number of questions
-aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\""
+aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
 
 if [ "$state_is" = "$state_should" ]; then
     if [ -z "$version" ] || [ "$version" = "$version_is" ]; then
diff --git a/cdist/conf/type/__package_emerge/gencode-remote b/cdist/conf/type/__package_emerge/gencode-remote
index 01c91bcc..c8a79c1f 100755
--- a/cdist/conf/type/__package_emerge/gencode-remote
+++ b/cdist/conf/type/__package_emerge/gencode-remote
@@ -63,10 +63,10 @@ fi
 
 case "$state_should" in
    present)
-        echo "emerge \"$name\" &>/dev/null || exit 1"
+        echo "emerge '$name' &>/dev/null || exit 1"
         ;;
    absent)
-        echo "emerge -C \"$name\" &>/dev/null || exit 1"
+        echo "emerge -C '$name' &>/dev/null || exit 1"
         ;;
    *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_luarocks/gencode-remote b/cdist/conf/type/__package_luarocks/gencode-remote
index e14d7a8e..60b9bfea 100755
--- a/cdist/conf/type/__package_luarocks/gencode-remote
+++ b/cdist/conf/type/__package_luarocks/gencode-remote
@@ -42,10 +42,10 @@ fi
 
 case "$state_should" in
     present)
-        echo luarocks install \""$name"\"
+        echo "luarocks install '$name'"
     ;;
     absent)
-        echo luarocks remove \""$name"\"
+        echo "luarocks remove '$name'"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_opkg/gencode-remote b/cdist/conf/type/__package_opkg/gencode-remote
index 53f154a5..94dc2808 100755
--- a/cdist/conf/type/__package_opkg/gencode-remote
+++ b/cdist/conf/type/__package_opkg/gencode-remote
@@ -43,12 +43,12 @@ esac
 case "$state_should" in
     present)
         if [ "$present" = "notpresent" ]; then
-            echo opkg --verbosity=0 update
+            echo "opkg --verbosity=0 update"
         fi
-        echo opkg --verbosity=0 install \""$name"\"
+        echo "opkg --verbosity=0 install '$name'"
     ;;
     absent)
-        echo opkg --verbosity=0 remove \""$name"\"
+        echo "opkg --verbosity=0 remove '$name'"
     ;;
     *)
         echo "Unknown state: $state" >&2
diff --git a/cdist/conf/type/__package_pacman/gencode-remote b/cdist/conf/type/__package_pacman/gencode-remote
index 43649124..7ba85479 100755
--- a/cdist/conf/type/__package_pacman/gencode-remote
+++ b/cdist/conf/type/__package_pacman/gencode-remote
@@ -45,10 +45,10 @@ fi
 
 case "$state_should" in
    present)
-         echo pacman --needed --noconfirm --noprogressbar -S \""$name"\"
+         echo "pacman --needed --noconfirm --noprogressbar -S '$name'"
    ;;
    absent)
-         echo pacman --noconfirm --noprogressbar -R \""$name"\"
+         echo "pacman --noconfirm --noprogressbar -R '$name'"
    ;;
    *)
       echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_pip/gencode-remote b/cdist/conf/type/__package_pip/gencode-remote
index 933406f2..33556bec 100755
--- a/cdist/conf/type/__package_pip/gencode-remote
+++ b/cdist/conf/type/__package_pip/gencode-remote
@@ -53,7 +53,7 @@ case "$state_should" in
     present)
         if [ "$runas" ]
         then
-            echo "su -c \"$pip install -q $name\" $runas"
+            echo "su -c '$pip install -q $name' $runas"
         else
             echo $pip install -q "$name"
         fi
@@ -61,7 +61,7 @@ case "$state_should" in
     absent)
         if [ "$runas" ]
         then
-            echo "su -c \"$pip uninstall -q -y $name\" $runas"
+            echo "su -c '$pip uninstall -q -y $name' $runas"
         else
             echo $pip uninstall -q -y "$name"
         fi
diff --git a/cdist/conf/type/__package_pkg_freebsd/gencode-remote b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
index e0980296..a01ddc2f 100755
--- a/cdist/conf/type/__package_pkg_freebsd/gencode-remote
+++ b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
@@ -27,8 +27,8 @@ assert ()                 #  If condition false,
 
 	if [ ! "$1" ] 
 	then
-		echo "Assertion failed:  \"$1\""
-		echo "File \"$0\""
+		echo "Assertion failed:  '$1'"
+		echo "File '$0'"
 		exit $E_ASSERT_FAILED
 	fi  
 }
@@ -64,12 +64,14 @@ execcmd(){
 		[ -n "$version" ] && pkgsite="${pkgsite}/All/" || pkgsite="${pkgsite}/Latest/"
 		echo "${pkgsite}"
 	fi
-	echo "${2} 2>&- >&-"	# Silence the output of the command
-	echo "status=\$?"
-	echo "if [ \"\$status\" -ne \"0\" ]; then"
-	echo "	echo \"Error: ${cmd} exited nonzero with \$status\"'!' >&2"
-	echo "	exit 1"
-	echo "fi"
+    cat <<EOF
+${2} 2>&- >&-  # Silence the output of the command
+status=\$?
+if [ "\$status" -ne "0" ]; then
+	echo "Error: ${cmd} exited nonzero with \$status!" >&2
+	exit 1
+fi
+EOF
 }
 
 if [ -n "$curr_version" ]; then	# PKG *is* installed
diff --git a/cdist/conf/type/__package_rubygem/gencode-remote b/cdist/conf/type/__package_rubygem/gencode-remote
index d474db20..ee563ef8 100755
--- a/cdist/conf/type/__package_rubygem/gencode-remote
+++ b/cdist/conf/type/__package_rubygem/gencode-remote
@@ -39,10 +39,10 @@ fi
 
 case "$state_should" in
     present)
-        echo gem install \""$name"\" --no-ri --no-rdoc
+        echo "gem install '$name' --no-ri --no-rdoc"
     ;;
     absent)
-        echo gem uninstall \""$name"\"
+        echo "gem uninstall '$name'"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_upgrade_all/gencode-remote b/cdist/conf/type/__package_upgrade_all/gencode-remote
index 38aa001e..0bf86c99 100755
--- a/cdist/conf/type/__package_upgrade_all/gencode-remote
+++ b/cdist/conf/type/__package_upgrade_all/gencode-remote
@@ -44,7 +44,7 @@ else
     esac
 fi
 
-aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\""
+aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
 
 case "$type" in
     yum)
diff --git a/cdist/conf/type/__package_yum/gencode-remote b/cdist/conf/type/__package_yum/gencode-remote
index 60dc376d..97265827 100755
--- a/cdist/conf/type/__package_yum/gencode-remote
+++ b/cdist/conf/type/__package_yum/gencode-remote
@@ -60,10 +60,10 @@ fi
 
 case "$state_should" in
     present)
-        echo yum $opts install \""$install_name"\"
+        echo "yum $opts install '$install_name'"
     ;;
     absent)
-        echo yum $opts remove \""$name"\"
+        echo "yum $opts remove '$name'"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_zypper/gencode-remote b/cdist/conf/type/__package_zypper/gencode-remote
index caf15397..1f15c531 100755
--- a/cdist/conf/type/__package_zypper/gencode-remote
+++ b/cdist/conf/type/__package_zypper/gencode-remote
@@ -61,15 +61,15 @@ case "$state_should" in
     present)
         if [ -z "$version_should" ]; then
             [ "$state_is" = "present" ] && exit 0 # if state is present, we dont need to do anything
-            echo zypper $globalopts install --type \""$ptype"\" --auto-agree-with-licenses \""$name"\" ">/dev/null"
+            echo "zypper $globalopts install --type '$ptype' --auto-agree-with-licenses '$name' >/dev/null"
         else
             [ "$state_is" = "present" ] && [ "$version_should" = "$version_is" ] && exit 0 # if state is present and version is correct, we dont need to do anything
-            echo zypper $globalopts install --oldpackage --type \""$ptype"\" --auto-agree-with-licenses \""$name"\" = \""$version_should"\" ">/dev/null"
+            echo "zypper $globalopts install --oldpackage --type '$ptype' --auto-agree-with-licenses '$name' = '$version_should' >/dev/null"
         fi
     ;;
     absent)
         [ "$state_is" = "absent" ] && exit 0 # if state is absent, we dont need to do anything
-        echo zypper $globalopts remove --type \""$ptype"\" \""$name"\" ">/dev/null"
+        echo "zypper $globalopts remove --type '$ptype' '$name' >/dev/null"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__postgres_database/explorer/state b/cdist/conf/type/__postgres_database/explorer/state
index dc9659e2..7a7c40a3 100755
--- a/cdist/conf/type/__postgres_database/explorer/state
+++ b/cdist/conf/type/__postgres_database/explorer/state
@@ -20,7 +20,7 @@
 
 name="$__object_id"
 
-if su - postgres -c "echo '\q' | psql '$name'" 2>/dev/null; then
+if su -l postgres -c "echo '\q' | psql '$name'" 2>/dev/null; then
    echo "present"
 else
    echo "absent"
diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote
index 92301fb8..32fe08cf 100755
--- a/cdist/conf/type/__postgres_database/gencode-remote
+++ b/cdist/conf/type/__postgres_database/gencode-remote
@@ -29,10 +29,10 @@ if [ "$state_should" != "$state_is" ]; then
          if [ -f "$__object/parameter/owner" ]; then
             owner="-O '$(cat "$__object/parameter/owner")'"
          fi
-         echo "su - postgres -c \"createdb $owner '$name'\""
+         echo "su -l postgres -c \"createdb $owner '$name'\""
       ;;
       absent)
-         echo "su - postgres -c \"dropdb '$name'\""
+         echo "su -l postgres -c \"dropdb '$name'\""
       ;;
    esac
 fi
diff --git a/cdist/conf/type/__postgres_extension/gencode-remote b/cdist/conf/type/__postgres_extension/gencode-remote
index f7895103..60072994 100755
--- a/cdist/conf/type/__postgres_extension/gencode-remote
+++ b/cdist/conf/type/__postgres_extension/gencode-remote
@@ -30,10 +30,10 @@ state_should=$( cat "$__object/parameter/state" )
 case "$state_should" in
     present)
          cmd="CREATE EXTENSION IF NOT EXISTS $extension"
-         echo "su - postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
+         echo "su -l postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
     ;;
     absent)
          cmd="DROP   EXTENSION IF     EXISTS $extenstion"
-         echo "su - postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
+         echo "su -l postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
     ;;
 esac
diff --git a/cdist/conf/type/__postgres_role/explorer/state b/cdist/conf/type/__postgres_role/explorer/state
index 8c102df9..6f7e2955 100755
--- a/cdist/conf/type/__postgres_role/explorer/state
+++ b/cdist/conf/type/__postgres_role/explorer/state
@@ -20,7 +20,7 @@
 
 name="$__object_id"
 
-if su - postgres -c "psql -c '\du' | grep -q '^ *$name *|'"; then
+if su -l postgres -c "psql -c '\du' | grep -q '^ *$name *|'"; then
    echo "present"
 else
    echo "absent"
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index f977e73e..901390e9 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -41,9 +41,9 @@ case "$state_should" in
          [ -n "$password" ] && password="PASSWORD '$password'"
 
          cmd="CREATE ROLE $name WITH $password $booleans"
-         echo "su - postgres -c \"psql -c \\\"$cmd\\\"\""
+         echo "su -l postgres -c \"psql -c \\\"$cmd\\\"\""
     ;;
     absent)
-        echo "su - postgres -c \"dropuser \\\"$name\\\"\""
+        echo "su -l postgres -c \"dropuser \\\"$name\\\"\""
     ;;
 esac
diff --git a/cdist/conf/type/__qemu_img/gencode-remote b/cdist/conf/type/__qemu_img/gencode-remote
index 62442eee..94816f58 100755
--- a/cdist/conf/type/__qemu_img/gencode-remote
+++ b/cdist/conf/type/__qemu_img/gencode-remote
@@ -18,4 +18,4 @@ format="$(cat "$__object/parameter/format")"
 size="$(cat "$__object/parameter/size")"
 diskimage="/$__object_id"
 
-echo qemu-img create -f \""$format"\" \""$diskimage"\" \""$size"\"
+echo "qemu-img create -f '$format' '$diskimage' '$size'"
diff --git a/cdist/conf/type/__rvm/gencode-remote b/cdist/conf/type/__rvm/gencode-remote
index 494c8fd8..3016e648 100755
--- a/cdist/conf/type/__rvm/gencode-remote
+++ b/cdist/conf/type/__rvm/gencode-remote
@@ -28,12 +28,12 @@ state_should="$(cat "$__object/parameter/state")"
 case "$state_should" in
     present)
         cat << DONE
-su - $user -c "unset rvm_path; unset rvm_bin_path; unset rvm_prefix; unset rvm_version; curl -L get.rvm.io | bash -s stable"
+su -l $user -c "unset rvm_path; unset rvm_bin_path; unset rvm_prefix; unset rvm_version; curl -L get.rvm.io | bash -s stable"
 DONE
     ;;
     absent)
         cat << DONE
-su - $user -c "rm -Rf \"\\\$HOME/.rvm\";
+su -l $user -c "rm -Rf \"\\\$HOME/.rvm\";
 sed '/rvm\/scripts\/rvm/d' \"\\\$HOME/.bashrc\" > \"\\\$HOME/.bashrc.cdist-tmp\"
 mv \"\\\$HOME/.bashrc.cdist-tmp\" \"\\\$HOME/.bashrc\""
 DONE
diff --git a/cdist/conf/type/__rvm_gem/explorer/state b/cdist/conf/type/__rvm_gem/explorer/state
index 4146d666..b0b40a0a 100755
--- a/cdist/conf/type/__rvm_gem/explorer/state
+++ b/cdist/conf/type/__rvm_gem/explorer/state
@@ -24,13 +24,13 @@ gemset="$(cat "$__object/parameter/gemset")"
 ruby="$(echo "$gemset" | cut -d '@' -f 1)"
 gemsetname="$(echo "$gemset" | cut -d '@' -f2)"
 user="$(cat "$__object/parameter/user")"
-if su - "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
+if su -l "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
    echo "absent"
    exit 0
 fi
-if su - "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
+if su -l "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
 rvm list | grep -q $ruby"; then
-   if su - "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
+   if su -l "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
 rvm use $ruby > /dev/null 2>&1; rvm gemset list | grep -q $gemsetname &&
 rvm use $gemset > /dev/null 2>&1 && gem list | grep -q $gem"; then
       echo "present"
diff --git a/cdist/conf/type/__rvm_gem/gencode-remote b/cdist/conf/type/__rvm_gem/gencode-remote
index 9212de91..ace05df6 100755
--- a/cdist/conf/type/__rvm_gem/gencode-remote
+++ b/cdist/conf/type/__rvm_gem/gencode-remote
@@ -29,12 +29,12 @@ state_should="$(cat "$__object/parameter/state")"
 case "$state_should" in
     present)
         cat << DONE
-su - "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem install "$gem"'
+su -l "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem install "$gem"'
 DONE
     ;;
     absent)
         cat << DONE
-su - "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem uninstall "$gem"'
+su -l "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem uninstall "$gem"'
 DONE
     ;;
 esac
diff --git a/cdist/conf/type/__rvm_gemset/explorer/state b/cdist/conf/type/__rvm_gemset/explorer/state
index 1556c22c..1b4738b6 100755
--- a/cdist/conf/type/__rvm_gemset/explorer/state
+++ b/cdist/conf/type/__rvm_gemset/explorer/state
@@ -28,8 +28,8 @@ if [ ! -e "~$user/.rvm/scripts/rvm" ] ; then
    exit 0
 fi
 
-if su - "$user" -c "source ~/.rvm/scripts/rvm; rvm list strings | grep -q \"^$ruby\$\""; then
-    if su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use \"$ruby\" > /dev/null; rvm gemset list strings | cut -f 1 -d " " | grep -q \"^$gemsetname\$\""; then
+if su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm list strings | grep -q \"^$ruby\$\""; then
+    if su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm use \"$ruby\" > /dev/null; rvm gemset list strings | cut -f 1 -d " " | grep -q \"^$gemsetname\$\""; then
       echo "present"
       exit 0
   fi
diff --git a/cdist/conf/type/__rvm_gemset/gencode-remote b/cdist/conf/type/__rvm_gemset/gencode-remote
index 78851f9a..a902b9fb 100755
--- a/cdist/conf/type/__rvm_gemset/gencode-remote
+++ b/cdist/conf/type/__rvm_gemset/gencode-remote
@@ -31,18 +31,18 @@ state_should="$(cat "$__object/parameter/state")"
 case "$state_should" in
     present)
         cat << DONE
-su - "$user" -c "source ~/.rvm/scripts/rvm; rvm $gemset --create"
+su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm $gemset --create"
 DONE
         if -f "$__object/parameter/default"; then
             cat << DONE
-su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use --default $gemset"
+su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm use --default $gemset"
 DONE
         fi
 
     ;;
     absent)
         cat << DONE
-su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use $ruby; rvm --force gemset delete $gemsetname"
+su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm use $ruby; rvm --force gemset delete $gemsetname"
 DONE
     ;;
 esac
diff --git a/cdist/conf/type/__rvm_ruby/explorer/state b/cdist/conf/type/__rvm_ruby/explorer/state
index 43dafd4f..7ee8863a 100755
--- a/cdist/conf/type/__rvm_ruby/explorer/state
+++ b/cdist/conf/type/__rvm_ruby/explorer/state
@@ -20,11 +20,11 @@
 
 ruby="$__object_id"
 user="$(cat "$__object/parameter/user")"
-if su - "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
+if su -l "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
     echo "absent"
     exit 0
 fi
-if su - "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
+if su -l "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
 rvm list | grep -q $ruby"; then
    echo "present"
 else
diff --git a/cdist/conf/type/__rvm_ruby/gencode-remote b/cdist/conf/type/__rvm_ruby/gencode-remote
index f2fd41ef..012c84c2 100755
--- a/cdist/conf/type/__rvm_ruby/gencode-remote
+++ b/cdist/conf/type/__rvm_ruby/gencode-remote
@@ -27,15 +27,15 @@ state_should="$(cat "$__object/parameter/state")"
 
 case "$state_should" in
     present)
-        echo "su - \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
+        echo "su -l \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
             "rvm install $ruby\""
         if [ -f "$__object/parameter/default" ]; then
-            echo "su - \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
+            echo "su -l \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
                 "rvm use --default $ruby\""
         fi
     ;;
     absent)
-        echo "su - \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
+        echo "su -l \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
             "rvm remove $ruby\""
     ;;
 
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 82c90d61..e1273028 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -25,7 +25,7 @@ the_key="$(cat "$__object/parameter/key")"
 validated_key="$(echo "${the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
 if [ -z "${validated_key}" ]
 then
-    echo "Key is invalid: \"${the_key}\"" >&2
+    echo "Key is invalid: '${the_key}'" >&2
     exit 1
 fi
 
diff --git a/cdist/conf/type/__start_on_boot/gencode-remote b/cdist/conf/type/__start_on_boot/gencode-remote
index 0ecea85b..bd343c9a 100755
--- a/cdist/conf/type/__start_on_boot/gencode-remote
+++ b/cdist/conf/type/__start_on_boot/gencode-remote
@@ -37,16 +37,16 @@ case "$state_should" in
         if [ "$init" = 'systemd' ]; then
             # this handles ALL linux distros with systemd
             # e.g. archlinux, gentoo in some cases, new RHEL and SLES versions
-            echo "systemctl -q enable \"$name\""
+            echo "systemctl -q enable '$name'"
         else
             case "$os" in
                 debian)
                     case "$os_version" in
                         [1-7]*)
-                            echo "update-rc.d \"$name\" defaults >/dev/null"
+                            echo "update-rc.d '$name' defaults >/dev/null"
                         ;;
                         8*)
-                            echo "systemctl enable \"$name\""
+                            echo "systemctl enable '$name'"
                         ;;
                         *)
                             echo "Unsupported version $os_version of $os" >&2
@@ -55,26 +55,26 @@ case "$state_should" in
                     esac
                 ;;
                 devuan)
-                    echo "update-rc.d \"$name\" defaults >/dev/null"
+                    echo "update-rc.d '$name' defaults >/dev/null"
                 ;;
 
                 gentoo)
-                    echo "rc-update add \"$name\" \"$target_runlevel\""
+                    echo "rc-update add '$name' '$target_runlevel'"
                 ;;
 
                 amazon|scientific|centos|fedora|owl|redhat|suse)
-                    echo "chkconfig \"$name\" on"
+                    echo "chkconfig '$name' on"
                 ;;
 
                 openwrt)
                     # 'enable' can be successful and still return a non-zero exit
                     # code, deal with it by checking for success ourselves in that
                     # case (the || ... part).
-                    echo "/etc/init.d/\"$name\" enable || [ -f /etc/rc.d/S??\"$name\" ]"
+                    echo "/etc/init.d/$name enable || [ -f /etc/rc.d/S??$name ]"
                 ;;
 
                 ubuntu)
-                    echo "update-rc.d \"$name\" defaults >/dev/null"
+                    echo "update-rc.d '$name' defaults >/dev/null"
                 ;;
 
                 freebsd)
@@ -93,24 +93,24 @@ case "$state_should" in
         if [ "$init" = 'systemd' ]; then
             # this handles ALL linux distros with systemd
             # e.g. archlinux, gentoo in some cases, new RHEL and SLES versions
-            echo "systemctl -q disable \"$name\""
+            echo "systemctl -q disable '$name'"
 
         else
             case "$os" in
                 debian|ubuntu|devuan)
-                    echo "update-rc.d -f \"$name\" remove"
+                    echo "update-rc.d -f '$name' remove"
                 ;;
 
                 gentoo)
-                    echo "rc-update del \"$name\"  \"$target_runlevel\""
+                    echo "rc-update del '$name'  '$target_runlevel'"
                 ;;
 
                 centos|fedora|owl|redhat|suse)
-                    echo "chkconfig \"$name\" off"
+                    echo "chkconfig '$name' off"
                 ;;
 
                 openwrt)
-                    echo "\"/etc/init.d/$name\" disable"
+                    echo "'/etc/init.d/$name' disable"
                 ;;
 
                 *)
diff --git a/cdist/conf/type/__timezone/gencode-remote b/cdist/conf/type/__timezone/gencode-remote
index 1f3f0196..1f5066b7 100755
--- a/cdist/conf/type/__timezone/gencode-remote
+++ b/cdist/conf/type/__timezone/gencode-remote
@@ -30,6 +30,6 @@ fi
 
 case "$os" in
    ubuntu|debian|devuan|coreos)
-      echo "echo \"$timezone_should\" > /etc/timezone"
+      echo "echo '$timezone_should' > /etc/timezone"
    ;;
 esac
diff --git a/cdist/conf/type/__timezone/manifest b/cdist/conf/type/__timezone/manifest
index a20f5d32..f2017449 100755
--- a/cdist/conf/type/__timezone/manifest
+++ b/cdist/conf/type/__timezone/manifest
@@ -48,7 +48,7 @@ case "$os" in
             __key_value ZONE \
                 --file /etc/sysconfig/clock \
                 --delimiter '=' \
-                --value "\"$timezone\""
+                --value "'$timezone'"
     ;;
     *)
         echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
diff --git a/cdist/conf/type/__user_groups/gencode-remote b/cdist/conf/type/__user_groups/gencode-remote
index 8120761a..df84faaf 100755
--- a/cdist/conf/type/__user_groups/gencode-remote
+++ b/cdist/conf/type/__user_groups/gencode-remote
@@ -44,23 +44,23 @@ fi
 for group in $changed_groups; do
    if [ "$os" = "netbsd" ] || [ "$os" = "openbsd" ]; then
       case "$state_should" in
-         present) echo "usermod -G \"$group\" \"$user\"" ;;
+         present) echo "usermod -G '$group' '$user'" ;;
          absent) echo 'NetBSD and OpenBSD do not have a command to remove a user from a group' >&2 ; exit 1 ;;
       esac
    elif [ "$os" = "freebsd" ]; then
       case "$state_should" in
-         present) echo "pw groupmod \"$group\" -m \"$user\"" ;;
-         absent) echo "pw groupmod \"$group\" -d \"$user\"" ;;
+         present) echo "pw groupmod '$group' -m '$user'" ;;
+         absent) echo "pw groupmod '$group' -d '$user'" ;;
       esac
    elif [ "$oldusermod" = "true" ]; then
       case "$state_should" in
-         present) echo "usermod -A \"$group\" \"$user\"" ;;
-         absent) echo "usermod -R \"$group\" \"$user\"" ;;
+         present) echo "usermod -A '$group' '$user'" ;;
+         absent) echo "usermod -R '$group' '$user'" ;;
       esac
    else
       case "$state_should" in
-         present) echo "gpasswd -a \"$user\" \"$group\"" ;;
-         absent) echo "gpasswd -d \"$user\" \"$group\"" ;;
+         present) echo "gpasswd -a '$user' '$group'" ;;
+         absent) echo "gpasswd -d '$user' '$group'" ;;
       esac
    fi
 done
diff --git a/cdist/conf/type/__zypper_service/gencode-remote b/cdist/conf/type/__zypper_service/gencode-remote
index 955698d1..413a43ab 100755
--- a/cdist/conf/type/__zypper_service/gencode-remote
+++ b/cdist/conf/type/__zypper_service/gencode-remote
@@ -71,14 +71,14 @@ fi
 
 case "$state_should" in
    present)
-         echo zypper $zypper_def_opts addservice -t "$stype" "$uri" \"$desc\"
-         echo zypper $zypper_def_opts refs
-         echo zypper $zypper_def_opts ref
+         echo "zypper $zypper_def_opts addservice -t '$stype' '$uri' '$desc'"
+         echo "zypper $zypper_def_opts refs"
+         echo "zypper $zypper_def_opts ref"
    ;;
    absent)
-         echo zypper $zypper_def_opts removeservice "$service_id"
-         echo zypper $zypper_def_opts refs
-         echo zypper $zypper_def_opts ref
+         echo "zypper $zypper_def_opts removeservice '$service_id'"
+         echo "zypper $zypper_def_opts refs"
+         echo "zypper $zypper_def_opts ref"
    ;;
    *)
       echo "Unknown state: $state_should" >&2

From 33a0e05e3dc33a4d190e331327d047e55b98018f Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Wed, 22 Nov 2017 13:26:37 +0100
Subject: [PATCH 09/12] Revert changes in for loop because param value is
 changed.

---
 cdist/conf/type/__config_file/manifest              | 2 +-
 cdist/conf/type/__consul_agent/manifest             | 2 +-
 cdist/conf/type/__consul_check/manifest             | 2 +-
 cdist/conf/type/__consul_service/manifest           | 2 +-
 cdist/conf/type/__consul_template/manifest          | 2 +-
 cdist/conf/type/__consul_template_template/manifest | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cdist/conf/type/__config_file/manifest b/cdist/conf/type/__config_file/manifest
index 5381ded6..3155f79b 100755
--- a/cdist/conf/type/__config_file/manifest
+++ b/cdist/conf/type/__config_file/manifest
@@ -19,7 +19,7 @@
 #
 
 set -- "/${__object_id}"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       source)
          source="$(cat "$__object/parameter/source")"
diff --git a/cdist/conf/type/__consul_agent/manifest b/cdist/conf/type/__consul_agent/manifest
index e9c240d9..a696894b 100755
--- a/cdist/conf/type/__consul_agent/manifest
+++ b/cdist/conf/type/__consul_agent/manifest
@@ -84,7 +84,7 @@ echo "{"
 # parameters we define ourself
 printf '   "data_dir": "%s"\n' "$data_dir"
 
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state|user|group|json-config) continue ;;
       ca-file-source|cert-file-source|key-file-source)
diff --git a/cdist/conf/type/__consul_check/manifest b/cdist/conf/type/__consul_check/manifest
index 85f9615c..554c0680 100755
--- a/cdist/conf/type/__consul_check/manifest
+++ b/cdist/conf/type/__consul_check/manifest
@@ -50,7 +50,7 @@ fi
 echo "{"
 printf '   "check": {\n'
 printf '      "name": "%s"\n' "$name"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state|name) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_service/manifest b/cdist/conf/type/__consul_service/manifest
index 1d495b94..f6d29b4a 100755
--- a/cdist/conf/type/__consul_service/manifest
+++ b/cdist/conf/type/__consul_service/manifest
@@ -42,7 +42,7 @@ fi
 echo "{"
 printf '   "service": {\n'
 printf '      "name": "%s"\n' "$name"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state|name|check-interval) continue ;;
       check-script)
diff --git a/cdist/conf/type/__consul_template/manifest b/cdist/conf/type/__consul_template/manifest
index 59cefd5d..2236e5bd 100755
--- a/cdist/conf/type/__consul_template/manifest
+++ b/cdist/conf/type/__consul_template/manifest
@@ -75,7 +75,7 @@ require="__directory/etc/consul-template" \
 
 # Generate hcl config file
 (
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       auth-password|state|ssl-*|syslog-*|version|vault-token|vault-ssl*) continue ;;
       auth-username)
diff --git a/cdist/conf/type/__consul_template_template/manifest b/cdist/conf/type/__consul_template_template/manifest
index 946df8d6..488a0f5d 100755
--- a/cdist/conf/type/__consul_template_template/manifest
+++ b/cdist/conf/type/__consul_template_template/manifest
@@ -38,7 +38,7 @@ fi
 # Generate hcl config file
 (
 printf 'template {\n'
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       source-file)
          source="$(cat "$__object/parameter/$param")"

From 4bec22d7262c4c554175997f437c586cf322024e Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Wed, 22 Nov 2017 13:29:13 +0100
Subject: [PATCH 10/12] Revert changes in for loop because param value is
 changed.

---
 cdist/conf/type/__consul_watch_checks/manifest    | 2 +-
 cdist/conf/type/__consul_watch_event/manifest     | 2 +-
 cdist/conf/type/__consul_watch_key/manifest       | 2 +-
 cdist/conf/type/__consul_watch_keyprefix/manifest | 2 +-
 cdist/conf/type/__consul_watch_nodes/manifest     | 2 +-
 cdist/conf/type/__consul_watch_service/manifest   | 2 +-
 cdist/conf/type/__consul_watch_services/manifest  | 2 +-
 7 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/cdist/conf/type/__consul_watch_checks/manifest b/cdist/conf/type/__consul_watch_checks/manifest
index 80cefefd..146f609e 100755
--- a/cdist/conf/type/__consul_watch_checks/manifest
+++ b/cdist/conf/type/__consul_watch_checks/manifest
@@ -35,7 +35,7 @@ fi
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       filter-*)
diff --git a/cdist/conf/type/__consul_watch_event/manifest b/cdist/conf/type/__consul_watch_event/manifest
index b660e962..099054a5 100755
--- a/cdist/conf/type/__consul_watch_event/manifest
+++ b/cdist/conf/type/__consul_watch_event/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_key/manifest b/cdist/conf/type/__consul_watch_key/manifest
index b660e962..099054a5 100755
--- a/cdist/conf/type/__consul_watch_key/manifest
+++ b/cdist/conf/type/__consul_watch_key/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_keyprefix/manifest b/cdist/conf/type/__consul_watch_keyprefix/manifest
index b660e962..099054a5 100755
--- a/cdist/conf/type/__consul_watch_keyprefix/manifest
+++ b/cdist/conf/type/__consul_watch_keyprefix/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_nodes/manifest b/cdist/conf/type/__consul_watch_nodes/manifest
index b660e962..099054a5 100755
--- a/cdist/conf/type/__consul_watch_nodes/manifest
+++ b/cdist/conf/type/__consul_watch_nodes/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       *)
diff --git a/cdist/conf/type/__consul_watch_service/manifest b/cdist/conf/type/__consul_watch_service/manifest
index 6a8fe0ff..2825c716 100755
--- a/cdist/conf/type/__consul_watch_service/manifest
+++ b/cdist/conf/type/__consul_watch_service/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       passingonly)
diff --git a/cdist/conf/type/__consul_watch_services/manifest b/cdist/conf/type/__consul_watch_services/manifest
index b660e962..099054a5 100755
--- a/cdist/conf/type/__consul_watch_services/manifest
+++ b/cdist/conf/type/__consul_watch_services/manifest
@@ -29,7 +29,7 @@ state="$(cat "$__object/parameter/state")"
 echo "{"
 printf '   "watches": [{\n'
 printf '      "type": "%s"\n' "$watch_type"
-for param in $__object/parameter/*; do
+for param in $(ls "$__object/parameter/"); do
    case "$param" in
       state) continue ;;
       *)

From 9e0cfd5df5dcd7dfea977fe33f4d134fdad87ed0 Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Thu, 23 Nov 2017 00:09:52 +0100
Subject: [PATCH 11/12] Fix vim typo.

---
 cdist/conf/type/__firewalld_start/gencode-remote | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cdist/conf/type/__firewalld_start/gencode-remote b/cdist/conf/type/__firewalld_start/gencode-remote
index 771007af..dd675749 100755
--- a/cdist/conf/type/__firewalld_start/gencode-remote
+++ b/cdist/conf/type/__firewalld_start/gencode-remote
@@ -1,4 +1,4 @@
-"#!/bin/sh -2
+#!/bin/sh -e
 #
 # 2016 Darko Poljak(darko.poljak at ungleich.ch)
 #

From ecc1dccd035dbb2a5eb81bade62a7eb43c287ead Mon Sep 17 00:00:00 2001
From: Darko Poljak <darko.poljak@gmail.com>
Date: Thu, 23 Nov 2017 10:20:03 +0100
Subject: [PATCH 12/12] quoting; posix sed;

---
 cdist/conf/type/__cron/gencode-remote           | 16 ++++++++--------
 cdist/conf/type/__jail_freebsd10/gencode-remote | 12 ++++++++----
 cdist/conf/type/__jail_freebsd9/gencode-remote  | 12 ++++++++----
 cdist/conf/type/__package_pip/gencode-remote    |  4 ++--
 4 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/cdist/conf/type/__cron/gencode-remote b/cdist/conf/type/__cron/gencode-remote
index 7b7f8512..2045ae6d 100755
--- a/cdist/conf/type/__cron/gencode-remote
+++ b/cdist/conf/type/__cron/gencode-remote
@@ -60,7 +60,7 @@ prefix="#cdist:__cron/$__object_id"
 suffix="#/cdist:__cron/$__object_id"
 filter="^# DO NOT EDIT THIS FILE|^# \(.* installed on |^# \(Cron version V|^# \(Cronie version .\..\)$"
 cat << DONE
-crontab -u $user -l 2>/dev/null | grep -v -E "$filter" | awk -v prefix="$prefix" -v suffix="$suffix" '
+crontab -u '$user' -l 2>/dev/null | grep -v -E "$filter" | awk -v prefix="$prefix" -v suffix="$suffix" '
 {
    if (index(\$0,prefix)) {
       triggered=1
@@ -73,7 +73,7 @@ crontab -u $user -l 2>/dev/null | grep -v -E "$filter" | awk -v prefix="$prefix"
       print
    }
 }
-' | crontab -u $user -
+' | crontab -u '$user' -
 DONE
 
 case "$state_should" in
@@ -81,21 +81,21 @@ case "$state_should" in
         # if we insert new entry, filter also all entrys out with the same id 
         cat <<EOF
 (
-crontab -u $user -l 2>/dev/null | grep -v -E '$filter' | grep -v '# $name\\$' 2>/dev/null || true
+crontab -u '$user' -l 2>/dev/null | grep -v -E '$filter' | grep -v '# $name\\$' 2>/dev/null || true
 echo '$entry'
-) | crontab -u $user -
+) | crontab -u '$user' -
 EOF
     ;;
     absent)
         if [ -f "$__object/parameter/raw_command" ]; then
             cat <<EOF
-( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
-grep -v '^$entry\\$' | crontab -u $user -
+( crontab -u '$user' -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '^$entry\\$' | crontab -u '$user' -
 EOF
         else
             cat <<EOF
-( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
-grep -v '# $name\\$' | crontab -u $user -
+( crontab -u '$user' -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '# $name\\$' | crontab -u '$user' -
 EOF
         fi
     ;;
diff --git a/cdist/conf/type/__jail_freebsd10/gencode-remote b/cdist/conf/type/__jail_freebsd10/gencode-remote
index 33ba9cc4..9be33b6d 100755
--- a/cdist/conf/type/__jail_freebsd10/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd10/gencode-remote
@@ -137,7 +137,8 @@ EOF
    echo "rm -f '/etc/fstab.${name}'"
 # Remove jail entry from jail.conf
    cat <<EOF
-      sed -i .bak -E -e "/^${name} {\$/,/^}\\\$/d" /etc/jail.conf
+      mv /etc/jail.conf /etc/jail.conf.bak
+      sed -E -e "/^${name} {\$/,/^}\\\$/d" /etc/jail.conf.bak > /etc/jail.conf
       if [ -f "/etc/jail.conf.bak" ]; then
          rm -f "/etc/jail.conf.bak"
       fi
@@ -153,7 +154,8 @@ EOF
       done
       jail_list="\${new_list}"
       
-      sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
       unset jail_list
       if [ -f "/etc/rc.conf.bak" ]; then
          rm -f /etc/rc.conf.bak
@@ -239,7 +241,8 @@ cat <<EOF
    if [ -z "\$jail_enable" ]; then	# no jail_enable line in rc.conf at all
       echo "jail_enable=\"YES\"" >>/etc/rc.conf
    elif [ ! "\$(echo \$jail_enable | tr '[a-z]' '[A-Z]' | tr -d '"')" = "YES" ]; then	# jail_enable="NO"
-      sed -i '.bak' 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf	# fix this -^
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf.bak > /etc/rc.conf	# fix this -^
       rm -f /etc/rc.conf.bak
    fi
 
@@ -313,7 +316,8 @@ if [ "$onboot" = "yes" ]; then
          echo "jail_list=\"${name}\"" >>/etc/rc.conf
       else
          jail_list="\${jail_list} ${name}"
-         sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+         mv /etc/rc.conf /etc/rc.conf.bak
+         sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
          rm -f /etc/rc.conf.bak
       fi
       unset jail_list
diff --git a/cdist/conf/type/__jail_freebsd9/gencode-remote b/cdist/conf/type/__jail_freebsd9/gencode-remote
index 7be9ce35..1f99dcac 100755
--- a/cdist/conf/type/__jail_freebsd9/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd9/gencode-remote
@@ -142,7 +142,8 @@ EOF
    echo "rm -f '/etc/fstab.${name}'"
 # Remove jail_$name_* lines from rc.conf
    cat <<EOF
-      sed -i '.bak' "/^jail_${name}_/d" /etc/rc.conf
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed "/^jail_${name}_/d" /etc/rc.conf.bak > /etc/rc.conf
       if [ -f "/etc/rc.conf.bak" ]; then
          rm -f /etc/rc.conf.bak
       fi
@@ -158,7 +159,8 @@ EOF
       done
       jail_list="\${new_list}"
       
-      sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
       unset jail_list
       if [ -f "/etc/rc.conf.bak" ]; then
          rm -f /etc/rc.conf.bak
@@ -241,7 +243,8 @@ cat <<EOF
    if [ -z "\$jail_enable" ]; then	# no jail_enable line in rc.conf at all
       echo "jail_enable=\"YES\"" >>/etc/rc.conf
    elif [ ! "\$(echo \$jail_enable | tr '[a-z]' '[A-Z]')" = "YES" ]; then	# jail_enable="NO"
-      sed -i '.bak' 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf	# fix this -^
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf.bak > /etc/rc.conf	# fix this -^
       rm -f /etc/rc.conf.bak
    fi
    cat >>/etc/rc.conf <<END
@@ -309,7 +312,8 @@ if [ "$onboot" = "yes" ]; then
          echo "jail_list=\"${name}\"" >>/etc/rc.conf
       else
          jail_list="\${jail_list} ${name}"
-         sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+         mv /etc/rc.conf /etc/rc.conf.bak
+         sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
          rm -f /etc/rc.conf.bak
       fi
       unset jail_list
diff --git a/cdist/conf/type/__package_pip/gencode-remote b/cdist/conf/type/__package_pip/gencode-remote
index 33556bec..3390faeb 100755
--- a/cdist/conf/type/__package_pip/gencode-remote
+++ b/cdist/conf/type/__package_pip/gencode-remote
@@ -53,7 +53,7 @@ case "$state_should" in
     present)
         if [ "$runas" ]
         then
-            echo "su -c '$pip install -q $name' $runas"
+            echo "su -c '$pip install -q $name' '$runas'"
         else
             echo $pip install -q "$name"
         fi
@@ -61,7 +61,7 @@ case "$state_should" in
     absent)
         if [ "$runas" ]
         then
-            echo "su -c '$pip uninstall -q -y $name' $runas"
+            echo "su -c '$pip uninstall -q -y $name' '$runas'"
         else
             echo $pip uninstall -q -y "$name"
         fi