diff --git a/type/__dma/gencode-remote b/type/__dma/gencode-remote
index bcd4530..e254323 100755
--- a/type/__dma/gencode-remote
+++ b/type/__dma/gencode-remote
@@ -23,18 +23,18 @@ drop_awk_comments() { sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@"; }
 CONF_PATH=/etc/dma  # set in Makefile
 
 # Determine mailname
-if test -f "${__object}/parameter/mailname"
+if test -f "${__object:?}/parameter/mailname"
 then
-	mailname=$(cat "${__object}/parameter/mailname")
+	mailname=$(cat "${__object:?}/parameter/mailname")
 else
-	case $(cat "${__global}/explorer/os")
+	case $(cat "${__global:?}/explorer/os")
 	in
 		(debian|devuan|ubuntu)
 			# On Debian-like systems use /etc/mailname unless --mailname is used
 			mailname='/etc/mailname'
 			;;
 		(*)
-			mailname=$__target_fqdn
+			mailname=${__target_fqdn:?}
 			;;
 	esac
 fi
@@ -42,19 +42,19 @@ fi
 
 # Generate "should" values for config
 conf_should=$(
-	if test -s "${__object}/parameter/smarthost"
+	if test -s "${__object:?}/parameter/smarthost"
 	then
-		printf 'SMARTHOST %s\n' "$(cat "${__object}/parameter/smarthost")"
+		printf 'SMARTHOST %s\n' "$(cat "${__object:?}/parameter/smarthost")"
 	fi
 
 	printf 'MAILNAME %s\n' "${mailname}"
 
-	if test -s "${__object}/explorer/auth_conf"
+	if test -s "${__object:?}/explorer/auth_conf"
 	then
-		printf "AUTHPATH %s\n" "$(cat "${__object}/explorer/auth_conf")"
+		printf "AUTHPATH %s\n" "$(cat "${__object:?}/explorer/auth_conf")"
 	fi
 
-	case $(cat "${__object}/parameter/security")
+	case $(cat "${__object:?}/parameter/security")
 	in
 		(ssl|tls)
 			default_smtp_port=465
@@ -77,35 +77,35 @@ conf_should=$(
 			;;
 	esac
 
-	if test -s "${__object}/parameter/port"
+	if test -s "${__object:?}/parameter/port"
 	then
-		printf 'PORT %u\n' "$(cat "${__object}/parameter/port")"
+		printf 'PORT %u\n' "$(cat "${__object:?}/parameter/port")"
 	elif test "${default_smtp_port}" -ne 25  # DMA uses port 25 by default
 	then
 		printf 'PORT %u\n' "${default_smtp_port}"
 	fi
 
-	if test -f "${__object}/parameter/masquerade"
+	if test -f "${__object:?}/parameter/masquerade"
 	then
 		while read -r line
 		do
 			printf 'MASQUERADE %s\n' "${line}"
-		done <"${__object}/parameter/masquerade"
+		done <"${__object:?}/parameter/masquerade"
 	fi
 
-	if test -f "${__object}/parameter/defer"
+	if test -f "${__object:?}/parameter/defer"
 	then
 		echo 'DEFER'
 	fi
 
-	if test -f "${__object}/parameter/fullbounce"
+	if test -f "${__object:?}/parameter/fullbounce"
 	then
 		echo 'FULLBOUNCE'
 	fi
 
-	if test -f "${__object}/parameter/nullclient"
+	if test -f "${__object:?}/parameter/nullclient"
 	then
-		test -s "${__object}/parameter/smarthost" || {
+		test -s "${__object:?}/parameter/smarthost" || {
 			echo '--nullclient requires a --smarthost to be defined' >&2
 			exit 1
 		}
@@ -114,10 +114,10 @@ conf_should=$(
 	fi
 )
 # Sort conf_should to compare against "conf_is"
-conf_should=$(echo "$conf_should" | sort -s -k 1,1)
+conf_should=$(echo "${conf_should}" | sort -s -k 1,1)
 
 config_updated=false
-if ! echo "$conf_should" | cmp -s "${__object}/explorer/conf" -
+if ! echo "${conf_should}" | cmp -s "${__object:?}/explorer/conf" -
 then
 	# config needs to be updated
 	dma_conf="${CONF_PATH:?}/dma.conf"
@@ -140,7 +140,7 @@ then
 	#    at the end of the file.
 
 	cat <<CODE
-awk '$(drop_awk_comments "${__type}/files/update_dma_conf.awk")' '${dma_conf}' '${dma_conf}' <<'EOF' >'${dma_conf}.tmp' \
+awk '$(drop_awk_comments "${__type:?}/files/update_dma_conf.awk")' '${dma_conf}' '${dma_conf}' <<'EOF' >'${dma_conf}.tmp' \
 && cat '${dma_conf}.tmp' >'${dma_conf}'
 ${conf_should}
 EOF
@@ -148,28 +148,28 @@ rm '${dma_conf}.tmp'
 CODE
 
 	config_updated=true
-	echo 'config updated' >>"${__messages_out}"
+	echo 'config updated' >>"${__messages_out:?}"
 fi
 
 
-if test -f "${__object}/parameter/send-test-email"
+if test -f "${__object:?}/parameter/send-test-email"
 then
-	if grep -q '^__mail_alias/root:' "${__messages_in}" \
-	|| grep -q '^__dma_auth/' "${__messages_in}" \
+	if grep -q '^__mail_alias/root:' "${__messages_in:?}" \
+	|| grep -q '^__dma_auth/' "${__messages_in:?}" \
 	|| $config_updated
 	then
-		cat <<-EOF
-		sendmail root <<EOM
-		Subject: [cdist] Test mail from '${__target_fqdn}'
+		cat <<-CODE
+		sendmail root <<'EOF'
+		Subject: [cdist] Test mail from '${__target_fqdn:?}'
 
 		Hi,
 
 		you can ignore this message.
-		Its sole purpose is to notify you that root mail on ${__target_fqdn}
+		Its sole purpose is to notify you that root mail on ${__target_fqdn:?}
 		will be redirected to you.
 
 		Enjoy!
-		EOM
 		EOF
+		CODE
 	fi
 fi
diff --git a/type/__dma/manifest b/type/__dma/manifest
index df62308..2cbd1a5 100755
--- a/type/__dma/manifest
+++ b/type/__dma/manifest
@@ -18,7 +18,7 @@
 # along with cdist. If not, see <http://www.gnu.org/licenses/>.
 #
 
-os=$(cat "${__global}/explorer/os")
+os=$(cat "${__global:?}/explorer/os")
 
 # Install DMA
 case $os
diff --git a/type/__dma_auth/gencode-remote b/type/__dma_auth/gencode-remote
index d8be7e8..aee4d7f 100755
--- a/type/__dma_auth/gencode-remote
+++ b/type/__dma_auth/gencode-remote
@@ -20,14 +20,14 @@
 
 drop_awk_comments() { sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@"; }
 
-state_is=$(cat "${__object}/explorer/state")
-state_should=$(cat "${__object}/parameter/state")
+state_is=$(cat "${__object:?}/explorer/state")
+state_should=$(cat "${__object:?}/parameter/state")
 
-server=$__object_id
-login=$(cat "${__object}/parameter/login")
+server=${__object_id:?}
+login=$(cat "${__object:?}/parameter/login")
 
 
-auth_conf=$(cat "${__object}/explorer/auth_conf")
+auth_conf=$(cat "${__object:?}/explorer/auth_conf")
 test -n "${auth_conf}" || {
 	echo 'Cannot determine path of dma auth.conf' >&2
 	exit 1
@@ -46,13 +46,13 @@ in
 
 		if test "${state_is}" = 'absent'
 		then
-			printf 'add authuser %s on %s\n' "${login}" "${server}" >>"${__messages_out}"
+			printf 'add authuser %s on %s\n' "${login}" "${server}" >>"${__messages_out:?}"
 		else
-			printf 'set authuser %s on %s\n' "${login}" "${server}" >>"${__messages_out}"
+			printf 'set authuser %s on %s\n' "${login}" "${server}" >>"${__messages_out:?}"
 		fi
 		;;
 	(absent)
-		printf 'delete authuser %s on %s\n' "${login}" "${server}" >>"${__messages_out}"
+		printf 'delete authuser %s on %s\n' "${login}" "${server}" >>"${__messages_out:?}"
 		;;
 	(*)
 		printf 'Invalid --state: %s.\n' "${state_should}" >&2
@@ -65,7 +65,7 @@ esac
 cat <<EOF
 test -f "${auth_conf}" || touch "${auth_conf}"
 
-awk '$(drop_awk_comments "${__type}/files/update_dma_auth.awk")' <'${auth_conf}' >'${auth_conf}.tmp' \
+awk '$(drop_awk_comments "${__type:?}/files/update_dma_auth.awk")' <'${auth_conf}' >'${auth_conf}.tmp' \
 && cat '${auth_conf}.tmp' >'${auth_conf}'
 rm -f '${auth_conf}.tmp'
 EOF
diff --git a/type/__mail_alias/explorer/aliases b/type/__mail_alias/explorer/aliases
index 4fffd3b..5b5d68d 100755
--- a/type/__mail_alias/explorer/aliases
+++ b/type/__mail_alias/explorer/aliases
@@ -20,9 +20,11 @@
 # Find aliases for a given user name and print the aliases (each one on a
 # separate line)
 
-aliases_file=$("${__type_explorer}/aliases_file")
+aliases_file=$("${__type_explorer:?}/aliases_file")
 test -r "${aliases_file}" || exit 0
 
+: "${__object_id:?}"  # assert __object_id is set, because it is used in AWK
+
 awk -F ':[ \t]*' '
 function print_aliases(aliases,    matches) {
 	# prints comma-separated aliases (one per line)
diff --git a/type/__mail_alias/explorer/aliases_file b/type/__mail_alias/explorer/aliases_file
index a59bb99..7f09f88 100755
--- a/type/__mail_alias/explorer/aliases_file
+++ b/type/__mail_alias/explorer/aliases_file
@@ -28,7 +28,7 @@ check_file() {
 	fi
 }
 
-case $("${__explorer}/os")
+case $("${__explorer:?}/os")
 in
 	(freebsd|openbsd|solaris)
 		check_file /etc/mail/aliases
diff --git a/type/__mail_alias/gencode-remote b/type/__mail_alias/gencode-remote
index e5bc2b7..7ef2f7c 100755
--- a/type/__mail_alias/gencode-remote
+++ b/type/__mail_alias/gencode-remote
@@ -20,7 +20,7 @@
 
 drop_awk_comments() { sed '/^[[:blank:]]*#.*$/d;/^$/d' "$@"; }
 
-aliases_file=$(cat "${__object}/explorer/aliases_file")
+aliases_file=$(cat "${__object:?}/explorer/aliases_file")
 
 test -n "${aliases_file}" || {
 	echo 'Could not determine aliases file path.' >&2
@@ -28,29 +28,29 @@ test -n "${aliases_file}" || {
 }
 
 
-state_should=$(cat "${__object}/parameter/state")
+state_should=$(cat "${__object:?}/parameter/state")
 
 case $state_should
 in
 	(present)
-		if cmp -s "${__object}/explorer/aliases" "${__object}/parameter/alias"
+		if cmp -s "${__object:?}/explorer/aliases" "${__object:?}/parameter/alias"
 		then
 			# all good!
 			exit 0
 		fi
 
-		if test -s "${__object}/explorer/aliases"
+		if test -s "${__object:?}/explorer/aliases"
 		then
-			echo "update aliases" >>"$__messages_out"
+			echo "update aliases" >>"${__messages_out:?}"
 		else
-			echo "add aliases" >>"$__messages_out"
+			echo "add aliases" >>"${__messages_out:?}"
 		fi
 		;;
 	(absent)
 		# nothing to do if no aliases found.
-		test -s "${__object}/explorer/aliases" || exit 0
+		test -s "${__object:?}/explorer/aliases" || exit 0
 
-		echo "delete aliases" >>"$__messages_out"
+		echo "delete aliases" >>"${__messages_out:?}"
 		;;
 	(*)
 		printf 'Invalid --state: %s.\n' "${state_should}" >&2
@@ -61,7 +61,7 @@ esac
 cat <<EOF
 test -f '${aliases_file}' || touch '${aliases_file}'
 
-awk '$(drop_awk_comments "${__type}/files/update_aliases.awk")' <'${aliases_file}' >'${aliases_file}.tmp' \
+awk '$(drop_awk_comments "${__type:?}/files/update_aliases.awk")' <'${aliases_file}' >'${aliases_file}.tmp' \
 || {
 	rm -f '${aliases_file}.tmp'
 	echo 'Generating new aliases file failed!' >&2