diff --git a/cdist/conf/type/__consul_template_template/manifest b/cdist/conf/type/__consul_template_template/manifest
index 7834ae9c..1eae1fad 100755
--- a/cdist/conf/type/__consul_template_template/manifest
+++ b/cdist/conf/type/__consul_template_template/manifest
@@ -35,8 +35,13 @@ if [ ! -f "$__object/parameter/source" ] && [ ! -f "$__object/parameter/source-f
    exit 1
 fi
 
+if [ -f "$__object/parameter/source-file" ]; then
+    destination="${template_dir}/${name}"
+    require="__file${destination}"
+fi
+
 # Generate hcl config file
-(
+{
 printf 'template {\n'
 cd "$__object/parameter/"
 for param in *; do
@@ -46,13 +51,11 @@ for param in *; do
          if [ "$source" = "-" ]; then
             source="$__object/stdin"
          fi
-         destination="${template_dir}/${name}"
          require="__directory${template_dir}" \
             __file "$destination" \
                --owner root --group root --mode 640 \
                --source "$source" \
                --state "$state"
-         export require="__file${destination}"
          printf '   source = "%s"\n' "$destination"
 
       ;;
@@ -66,7 +69,7 @@ for param in *; do
    esac
 done
 printf '}\n'
-) | \
+} | \
 require="$require __directory${conf_dir}" \
    __config_file "${conf_dir}/${conf_file}" \
       --owner root --group root --mode 640 \
diff --git a/cdist/conf/type/__docker/manifest b/cdist/conf/type/__docker/manifest
index 35760cef..8f26feec 100755
--- a/cdist/conf/type/__docker/manifest
+++ b/cdist/conf/type/__docker/manifest
@@ -24,6 +24,7 @@ state=$(cat "$__object/parameter/state")
 
 case "$os" in
     centos)
+        # shellcheck source=/dev/null
         if (. "$__global/explorer/os_release" && [ "${VERSION_ID}" = "7" ]); then
           __yum_repo docker-ce-stable \
             --name 'Docker CE Stable' \
diff --git a/cdist/conf/type/__dot_file/explorer/home b/cdist/conf/type/__dot_file/explorer/home
index 132cfc71..08d941bf 100755
--- a/cdist/conf/type/__dot_file/explorer/home
+++ b/cdist/conf/type/__dot_file/explorer/home
@@ -19,7 +19,7 @@ set -eu
 
 user="$(cat "${__object}/parameter/user")"
 
-if which getent >/dev/null 2>&1; then
+if command -v getent >/dev/null 2>&1; then
 	line=$(getent passwd "${user}")
 else
 	line=$(grep "^${user}:" /etc/passwd)
diff --git a/cdist/conf/type/__hostname/gencode-remote b/cdist/conf/type/__hostname/gencode-remote
index 3f784188..fc50b651 100755
--- a/cdist/conf/type/__hostname/gencode-remote
+++ b/cdist/conf/type/__hostname/gencode-remote
@@ -22,7 +22,7 @@
 if [ -f "$__object/parameter/name" ]; then
     name_should="$(cat "$__object/parameter/name")"
 else
-    name_should="$(echo "${__target_host%%.*}")"
+    name_should="${__target_host%%.*}"
 fi
 
 os=$(cat "$__global/explorer/os")
@@ -59,7 +59,7 @@ echo changed >> "$__messages_out"
 # Use the good old way to set the hostname even on machines running systemd.
 case "$os" in
     archlinux|debian|ubuntu|devuan|centos|coreos)
-        echo "printf '%s\n' '$name_should' > /etc/hostname"
+        printf "printf '%s\\n' '$name_should' > /etc/hostname\\n"
         echo "hostname -F /etc/hostname"
     ;;
     freebsd|openbsd)
@@ -67,7 +67,7 @@ case "$os" in
     ;;
     suse)
         echo "hostname '$name_should'"
-        echo "printf '%s\n' '$name_should' > /etc/HOSTNAME"
+        printf "printf '%s\\n' '$name_should' > /etc/HOSTNAME\\n"
     ;;
 esac
 
diff --git a/cdist/conf/type/__hostname/manifest b/cdist/conf/type/__hostname/manifest
index 74664aa7..c03b2eac 100755
--- a/cdist/conf/type/__hostname/manifest
+++ b/cdist/conf/type/__hostname/manifest
@@ -25,10 +25,10 @@ if [ -f "$__object/parameter/name" ]; then
 else
     case "$os" in
     openbsd)
-        name_should="$(echo "${__target_host}")"
+        name_should="${__target_host}"
     ;;
     *)
-        name_should="$(echo "${__target_host%%.*}")"
+        name_should="${__target_host%%.*}"
     ;;
     esac
 fi
diff --git a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
index 69be8daf..a0b46b2d 100755
--- a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
+++ b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
@@ -21,11 +21,11 @@
 #set -x
 
 die() {
-   echo "[__install_partition_msdos_apply] $@" >&2
+   echo "[__install_partition_msdos_apply] $*" >&2
    exit 1
 }
 debug() {
-   #echo "[__install_partition_msdos_apply] $@" >&2
+   #echo "[__install_partition_msdos_apply] $*" >&2
    :
 }
 
diff --git a/cdist/conf/type/__jail/manifest b/cdist/conf/type/__jail/manifest
index 222cb859..adf9bd99 100755
--- a/cdist/conf/type/__jail/manifest
+++ b/cdist/conf/type/__jail/manifest
@@ -43,8 +43,7 @@ for property in *; do
 	set -- "$@" "--$property" "$(cat "$property")"
 done
 
-ver="$(cat "$__global/explorer/os_version")"
-if [ -n "$(echo "$ver" | grep '^10\.' )" ]; then   # Version is 10.x
+if grep -q '^10\.' "$(cat "$__global/explorer/os_version")" ; then   # Version is 10.x
    __jail_freebsd10 "$@"
 else
    __jail_freebsd9 "$@"
diff --git a/cdist/conf/type/__jail_freebsd10/gencode-remote b/cdist/conf/type/__jail_freebsd10/gencode-remote
index 5be04bc6..230370c2 100755
--- a/cdist/conf/type/__jail_freebsd10/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd10/gencode-remote
@@ -83,7 +83,7 @@ present="$(cat "$__object/explorer/present")"
 status="$(cat "$__object/explorer/status")"
 
 # Handle ip="addr, addr" format
-if [ $(expr "${ip}" : ".*, .*") -gt "0" ]; then
+if [ "$(expr "${ip}" : ".*, .*")" -gt "0" ]; then
    SAVE_IFS="$IFS"
    IFS=", "
    for cur_ip in ${ip}; do
@@ -121,12 +121,12 @@ deleteJail() {
       output="\$(mount | grep "\/rw\/${name}\/")" || true
       if [ -n "\${output}" ]; then # >=1 rw mount is mounted still
          for DIR in "${output}"; do
-            umount -F "/etc/fstab.${name}" "\$(echo "${DIR}" | awk '{print $3}')"
+            umount -F "/etc/fstab.${name}" "\$(echo "${DIR}" | awk '{print \$3}')"
          done
       fi
       output="\$(mount | grep "\/${name} (")" || true
       if [ -n "\${output}" ]; then # ro mount is mounted still
-         umount -F "/etc/fstab.${name}" "\$(echo "${output}" | awk '{print $3}')"
+         umount -F "/etc/fstab.${name}" "\$(echo "${output}" | awk '{print \$3}')"
       fi
 EOF
 # Remove the jail's rw mountpoints
@@ -298,7 +298,7 @@ END
    fi
 
 EOF
-
+   # shellcheck disable=SC2028
    echo "printf \"%s\\n%s\n%s\n\" \"\$jailheader\" \"\$jaildata\" \"\$jailtrailer\" >>\"\$jailfile\""
 
 # Add $name to jail_list if $onboot=yes
diff --git a/cdist/conf/type/__jail_freebsd9/gencode-remote b/cdist/conf/type/__jail_freebsd9/gencode-remote
index 177bdf74..13c237a9 100755
--- a/cdist/conf/type/__jail_freebsd9/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd9/gencode-remote
@@ -86,7 +86,7 @@ present="$(cat "$__object/explorer/present")"
 status="$(cat "$__object/explorer/status")"
 
 # Handle ip="iface|addr, iface|addr" format
-if [ $(expr "${ip}" : ".*|.*") -gt "0" ]; then
+if [ "$(expr "${ip}" : ".*|.*")" -gt "0" ]; then
    # If we have multiple IPs defined, $interface doesn't make sense because ip="iface|addr, iface|addr" implies it
    interface=""
    SAVE_IFS="$IFS"
@@ -126,12 +126,12 @@ deleteJail() {
       output="\$(mount | grep "\/rw\/${name}\/")" || true
       if [ -n "\${output}" ]; then # >=1 rw mount is mounted still
          for DIR in "${output}"; do
-            umount -F "/etc/fstab.${name}" "\$(echo "${DIR}" | awk '{print $3}')"
+            umount -F "/etc/fstab.${name}" "\$(echo "${DIR}" | awk '{print \$3}')"
          done
       fi
       output="\$(mount | grep "\/${name} (")" || true
       if [ -n "\${output}" ]; then # ro mount is mounted still
-         umount -F "/etc/fstab.${name}" "\$(echo "${output}" | awk '{print $3}')"
+         umount -F "/etc/fstab.${name}" "\$(echo "${output}" | awk '{print \$3}')"
       fi
 EOF
 # Remove the jail's rw mountpoints
diff --git a/cdist/conf/type/__package_emerge/gencode-remote b/cdist/conf/type/__package_emerge/gencode-remote
index 8abcb5b1..48462bde 100755
--- a/cdist/conf/type/__package_emerge/gencode-remote
+++ b/cdist/conf/type/__package_emerge/gencode-remote
@@ -38,11 +38,11 @@ fi
 pkg_version="$(cat "$__object/explorer/pkg_version")"
 if [ -z "$pkg_version" ]; then
     state_is="absent"
-elif [ -z "$version" ] && [ $(echo "$pkg_version" | wc -l) -gt 1 ]; then
+elif [ -z "$version" ] && [ "$(echo "$pkg_version" | wc -l)" -gt 1 ]; then
     echo "Package name is not unique! The following packages are installed:"
     echo "$pkg_version"
     exit 1
-elif [ -n "$version" ] && [ $(echo "$pkg_version" | cut -d " " -f 1 | sort | uniq | wc -l) -gt 1 ]; then
+elif [ -n "$version" ] && [ "$(echo "$pkg_version" | cut -d " " -f 1 | sort | uniq | wc -l)" -gt 1 ]; then
     echo "Package name is not unique! The following packages are installed:"
     echo "$pkg_version"
     exit 1
@@ -57,7 +57,7 @@ fi
 
 
 # Exit if nothing is needed to be done
-[ "$state_is" = "$state_should" ] && ( [ -z "$version" ] || [ "$installed_version" = "$version" ] ) && exit 0
+[ "$state_is" = "$state_should" ] && { [ -z "$version" ] || [ "$installed_version" = "$version" ]; } && exit 0
 [ "$state_should" = "absent" ] && [ ! -z "$version" ] && [ "$installed_version" != "$version" ] && exit 0
 
 
diff --git a/cdist/conf/type/__package_luarocks/explorer/pkg_status b/cdist/conf/type/__package_luarocks/explorer/pkg_status
index 3eb73298..e83e8ce6 100755
--- a/cdist/conf/type/__package_luarocks/explorer/pkg_status
+++ b/cdist/conf/type/__package_luarocks/explorer/pkg_status
@@ -28,4 +28,4 @@ else
 fi
 
 # Accept luarocks failing if package is not known/installed
-luarocks list "$name" | egrep -A1 "^$name$" || exit 0
+luarocks list "$name" | grep -E -A1 "^$name$" || exit 0
diff --git a/cdist/conf/type/__package_pkg_freebsd/gencode-remote b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
index 6c6e15b1..fd02d939 100755
--- a/cdist/conf/type/__package_pkg_freebsd/gencode-remote
+++ b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
@@ -36,6 +36,7 @@ assert ()                 #  If condition false,
 	if [ ! "$1" ]
 	then
 		echo "Assertion failed:  \"$1\""
+		# shellcheck disable=SC2039
 		echo "File \"$0\", line $lineno, called by $(caller 0)"
 		exit $E_ASSERT_FAILED
 	fi  
@@ -95,6 +96,7 @@ if [ -n "$curr_version" ]; then	# PKG *is* installed
 				exit 0
 			else	# Current version is wrong, fix
 				#updatepkg "$name" "$version"
+				# shellcheck disable=SC2039
 				assert "! ${version} = ${curr_version}" $LINENO
 				cmd="${rm_cmd} ${name}-${curr_version}"
 				execcmd "remove" "${cmd}"
diff --git a/cdist/conf/type/__pf_ruleset/gencode-local b/cdist/conf/type/__pf_ruleset/gencode-local
index b4bded98..b9de1bce 100755
--- a/cdist/conf/type/__pf_ruleset/gencode-local
+++ b/cdist/conf/type/__pf_ruleset/gencode-local
@@ -54,7 +54,7 @@ case $uname in
       currentSum=\$(cksum -o 1 ${source} | cut -d= -f2 | sed 's/ //g')
       ;;
    *)
-      echo "Sorry, I do not know how to find a cksum on ${UNAME}." >&2
+      echo "Sorry, I do not know how to find a cksum on ${uname}." >&2
       exit 1
       ;;
 esac
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index 14240992..f977e73e 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -34,7 +34,7 @@ case "$state_should" in
             if [ ! -f "$__object/parameter/$boolean" ]; then
                 boolean="no${boolean}"
             fi
-            upper=$(echo $boolean | tr '[a-z]' '[A-Z]')
+            upper=$(echo $boolean | tr '[:lower:]' '[:upper:]')
             booleans="$booleans $upper"
         done
 
diff --git a/cdist/conf/type/__rsync/gencode-local b/cdist/conf/type/__rsync/gencode-local
index c7196175..e36ded2f 100755
--- a/cdist/conf/type/__rsync/gencode-local
+++ b/cdist/conf/type/__rsync/gencode-local
@@ -29,7 +29,7 @@ fi
 
 set --
 if [ -f "$__object/parameter/rsync-opts" ]; then
-    while read opts; do
+    while read -r opts; do
         set -- "$@" "--$opts"
     done < "$__object/parameter/rsync-opts"
 fi
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 325854c2..82c90d61 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -78,7 +78,7 @@ if [ -s "$__object/explorer/entry" ]; then
    # Note that the files have to be sorted for comparison with `comm`.
    sort "$__object/explorer/entry" > "$__object/files/is"
    comm -13 "$__object/files/should" "$__object/files/is" | {
-      while read entry; do
+      while read -r entry; do
          remove_line "$file" "$entry"
       done
    }