diff --git a/arch-nspawn.in b/arch-nspawn.in
index 548ebec..2d42e3a 100644
--- a/arch-nspawn.in
+++ b/arch-nspawn.in
@@ -71,7 +71,7 @@ build_mount_args() {
 
 	mount_args+=("--bind=${cache_dirs[0]}")
 
-	for cache_dir in ${cache_dirs[@]:1}; do
+	for cache_dir in "${cache_dirs[@]:1}"; do
 		mount_args+=("--bind-ro=$cache_dir")
 	done
 }
@@ -80,8 +80,8 @@ copy_hostconf () {
 	cp -a /etc/pacman.d/gnupg "$working_dir/etc/pacman.d"
 	echo "Server = $host_mirror" >"$working_dir/etc/pacman.d/mirrorlist"
 
-	[[ -n $pac_conf ]] && cp $pac_conf "$working_dir/etc/pacman.conf"
-	[[ -n $makepkg_conf ]] && cp $makepkg_conf "$working_dir/etc/makepkg.conf"
+	[[ -n $pac_conf ]] && cp "$pac_conf" "$working_dir/etc/pacman.conf"
+	[[ -n $makepkg_conf ]] && cp "$makepkg_conf" "$working_dir/etc/makepkg.conf"
 
 	local file
 	for file in "${files[@]}"; do
@@ -89,7 +89,7 @@ copy_hostconf () {
 		cp -T "$file" "$working_dir$file"
 	done
 
-	sed -r "s|^#?\\s*CacheDir.+|CacheDir = $(echo -n ${cache_dirs[@]})|g" -i "$working_dir/etc/pacman.conf"
+	sed -r "s|^#?\\s*CacheDir.+|CacheDir = $(echo -n "${cache_dirs[@]}")|g" -i "$working_dir/etc/pacman.conf"
 }
 # }}}
 
@@ -98,14 +98,14 @@ umask 0022
 # Sanity check
 if [[ ! -f "$working_dir/.arch-chroot" ]]; then
 	die "'%s' does not appear to be an Arch chroot." "$working_dir"
-elif [[ $(cat "$working_dir/.arch-chroot") != $CHROOT_VERSION ]]; then
+elif [[ $(cat "$working_dir/.arch-chroot") != "$CHROOT_VERSION" ]]; then
 	die "chroot '%s' is not at version %s. Please rebuild." "$working_dir" "$CHROOT_VERSION"
 fi
 
 build_mount_args
 copy_hostconf
 
-eval $(grep '^CARCH=' "$working_dir/etc/makepkg.conf")
+eval "$(grep '^CARCH=' "$working_dir/etc/makepkg.conf")"
 
 [[ -z $nosetarch ]] || unset CARCH
 
diff --git a/archrelease.in b/archrelease.in
index 3b11652..2ba9d48 100644
--- a/archrelease.in
+++ b/archrelease.in
@@ -74,7 +74,7 @@ for tag in "$@"; do
 	fi
 
 	# copy all files at once from trunk to the subdirectory in repos/
-	svn copy -q -r HEAD ${known_files[@]/#/$trunk/} "repos/$tag/"
+	svn copy -q -r HEAD "${known_files[@]/#/$trunk/}" "repos/$tag/"
 
 	stat_done
 done
diff --git a/archrm.in b/archrm.in
index 3173131..6f4dfc3 100644
--- a/archrm.in
+++ b/archrm.in
@@ -13,4 +13,4 @@ fi
 #
 #popd
 
-rm -rf $1
+rm -rf "$1"
diff --git a/bash_completion.in b/bash_completion.in
index f0a6bd0..9feef74 100644
--- a/bash_completion.in
+++ b/bash_completion.in
@@ -5,8 +5,8 @@ _devtools_compgen() {
   local i r
   COMPREPLY=($(compgen -W '$*' -- "$cur"))
   for ((i=1; i < ${#COMP_WORDS[@]}-1; i++)); do
-    for r in ${!COMPREPLY[@]}; do
-      if [[ ${COMP_WORDS[i]} = ${COMPREPLY[r]} ]]; then
+    for r in "${!COMPREPLY[@]}"; do
+      if [[ ${COMP_WORDS[i]} = "${COMPREPLY[r]}" ]]; then
         unset 'COMPREPLY[r]'; break
       fi
     done
diff --git a/checkpkg.in b/checkpkg.in
index 03e29f7..20920be 100644
--- a/checkpkg.in
+++ b/checkpkg.in
@@ -44,7 +44,7 @@ for _pkgname in "${pkgname[@]}"; do
 
 	oldpkg=${pkgurl##*://*/}
 
-	if [[ ${oldpkg##*/} = ${pkgfile##*/} ]]; then
+	if [[ ${oldpkg##*/} = "${pkgfile##*/}" ]]; then
 		die "The built package (%s) is the one in the repo right now!" "$_pkgname"
 	fi
 
diff --git a/commitpkg.in b/commitpkg.in
index 87f5b8b..0482170 100644
--- a/commitpkg.in
+++ b/commitpkg.in
@@ -50,7 +50,7 @@ done
 for i in 'changelog' 'install'; do
 	while read -r file; do
 		# evaluate any bash variables used
-		eval file=\"$(sed "s/^\(['\"]\)\(.*\)\1\$/\2/" <<< "$file")\"
+		eval "file=\"$(sed "s/^\(['\"]\)\(.*\)\1\$/\2/" <<< "$file")\""
 		needsversioning+=("$file")
 	done < <(sed -n "s/^[[:space:]]*$i=//p" PKGBUILD)
 done
@@ -79,12 +79,12 @@ done
 shift $(( OPTIND - 1 ))
 
 # check packages have the packager field set
-for _arch in ${arch[@]}; do
+for _arch in "${arch[@]}"; do
 	if [[ -n $commit_arch && ${_arch} != "$commit_arch" ]]; then
 		continue
 	fi
-	for _pkgname in ${pkgname[@]}; do
-		fullver=$(get_full_version $_pkgname)
+	for _pkgname in "${pkgname[@]}"; do
+		fullver=$(get_full_version "$_pkgname")
 
 		if pkgfile=$(find_cached_package "$_pkgname" "$_arch" "$fullver"); then
 			if grep -q "packager = Unknown Packager" <(bsdtar -xOqf "$pkgfile" .PKGINFO); then
@@ -128,18 +128,18 @@ declare -a uploads
 declare -a commit_arches
 declare -a skip_arches
 
-for _arch in ${arch[@]}; do
+for _arch in "${arch[@]}"; do
 	if [[ -n $commit_arch && ${_arch} != "$commit_arch" ]]; then
-		skip_arches+=($_arch)
+		skip_arches+=("$_arch")
 		continue
 	fi
 
-	for _pkgname in ${pkgname[@]}; do
-		fullver=$(get_full_version $_pkgname)
+	for _pkgname in "${pkgname[@]}"; do
+		fullver=$(get_full_version "$_pkgname")
 
 		if ! pkgfile=$(find_cached_package "$_pkgname" "$fullver" "${_arch}"); then
 			warning "Skipping %s: failed to locate package file" "$_pkgname-$fullver-$_arch"
-			skip_arches+=($_arch)
+			skip_arches+=("$_arch")
 			continue 2
 		fi
 		uploads+=("$pkgfile")
@@ -159,9 +159,9 @@ for _arch in ${arch[@]}; do
 	done
 done
 
-for _arch in ${arch[@]}; do
-	if ! in_array $_arch ${skip_arches[@]}; then
-		commit_arches+=($_arch)
+for _arch in "${arch[@]}"; do
+	if ! in_array "$_arch" "${skip_arches[@]}"; then
+		commit_arches+=("$_arch")
 	fi
 done
 
@@ -187,8 +187,8 @@ if [[ "${arch[*]}" == 'any' ]]; then
 	if [[ -d ../repos/$repo-i686 && -d ../repos/$repo-x86_64 ]]; then
 		pushd ../repos/ >/dev/null
 		stat_busy "Removing %s and %s" "$repo-i686" "$repo-x86_64"
-		svn rm -q $repo-i686
-		svn rm -q $repo-x86_64
+		svn rm -q "$repo-i686"
+		svn rm -q "$repo-x86_64"
 		svn commit -q -m "Removed $repo-i686 and $repo-x86_64 for $pkgname"
 		stat_done
 		popd >/dev/null
@@ -197,7 +197,7 @@ else
 	if [[ -d ../repos/$repo-any ]]; then
 		pushd ../repos/ >/dev/null
 		stat_busy "Removing %s" "$repo-any"
-		svn rm -q $repo-any
+		svn rm -q "$repo-any"
 		svn commit -q -m "Removed $repo-any for $pkgname"
 		stat_done
 		popd >/dev/null
diff --git a/crossrepomove.in b/crossrepomove.in
index 14c264e..ffc4507 100644
--- a/crossrepomove.in
+++ b/crossrepomove.in
@@ -38,7 +38,7 @@ target_dbscripts="/srv/repos/svn-${target_name}/dbscripts"
 
 setup_workdir
 
-pushd $WORKDIR >/dev/null
+pushd "$WORKDIR" >/dev/null
 
 msg "Downloading sources for %s" "${pkgbase}"
 svn -q checkout -N "${target_svn}" target_checkout
@@ -47,14 +47,14 @@ svn -q export "${source_svn}/${pkgbase}/trunk" "target_checkout/${pkgbase}/trunk
 . "target_checkout/${pkgbase}/trunk/PKGBUILD"
 
 msg "Downloading packages for %s" "${pkgbase}"
-for _arch in ${arch[@]}; do
+for _arch in "${arch[@]}"; do
 	if [[ "${_arch[*]}" == 'any' ]]; then
 		repo_arch='x86_64'
 	else
 		repo_arch=${_arch}
 	fi
-	for _pkgname in ${pkgname[@]}; do
-		fullver=$(get_full_version $_pkgname)
+	for _pkgname in "${pkgname[@]}"; do
+		fullver=$(get_full_version "$_pkgname")
 		pkgpath="/srv/ftp/$source_repo/os/$repo_arch/$_pkgname-$fullver-${_arch}.pkg.tar.*"
 		ssh "$server" "cp $pkgpath staging/$target_repo" || die
 	done
@@ -71,7 +71,7 @@ popd >/dev/null
 ssh "${server}" "${target_dbscripts}/db-update" || die
 
 msg "Removing %s from %s" "${pkgbase}" "${source_repo}"
-for _arch in ${arch[@]}; do
+for _arch in "${arch[@]}"; do
 	ssh "${server}" "${source_dbscripts}/db-remove ${source_repo} ${_arch} ${pkgbase}"
 done
 svn -q checkout -N "${source_svn}" source_checkout
diff --git a/find-libdeps.in b/find-libdeps.in
index c596f48..04adebf 100644
--- a/find-libdeps.in
+++ b/find-libdeps.in
@@ -28,7 +28,7 @@ if [[ -z $1 ]]; then
 fi
 
 if [[ -d $1 ]]; then
-	pushd $1 >/dev/null
+	pushd "$1" >/dev/null
 else
 	setup_workdir
 
@@ -48,7 +48,7 @@ process_sofile() {
 	if [[ "$soversion" = "$sofile" ]] && ((IGNORE_INTERNAL)); then
 		continue
 	fi
-	if ! in_array "${soname}=${soversion}-${soarch}" ${soobjects[@]}; then
+	if ! in_array "${soname}=${soversion}-${soarch}" "${soobjects[@]}"; then
 		# libfoo.so=1-64
 		echo "${soname}=${soversion}-${soarch}"
 		soobjects+=("${soname}=${soversion}-${soarch}")
diff --git a/finddeps.in b/finddeps.in
index 03e5501..c71f151 100644
--- a/finddeps.in
+++ b/finddeps.in
@@ -24,17 +24,17 @@ find . -type d | while read d; do
 		for dep in "${depends[@]}"; do
 			# lose the version comparator, if any
 			depname=${dep%%[<>=]*}
-			[[ $depname = $match ]] && echo "$d (depends)"
+			[[ $depname = "$match" ]] && echo "$d (depends)"
 		done
 		for dep in "${makedepends[@]}"; do
 			# lose the version comparator, if any
 			depname=${dep%%[<>=]*}
-			[[ $depname = $match ]] && echo "$d (makedepends)"
+			[[ $depname = "$match" ]] && echo "$d (makedepends)"
 		done
 		for dep in "${optdepends[@]/:*}"; do
 			# lose the version comaparator, if any
 			depname=${dep%%[<>=]*}
-			[[ $depname = $match ]] && echo "$d (optdepends)"
+			[[ $depname = "$match" ]] && echo "$d (optdepends)"
 		done
 	fi
 done
diff --git a/lddd.in b/lddd.in
index f01ebf9..d83c3e6 100644
--- a/lddd.in
+++ b/lddd.in
@@ -20,7 +20,7 @@ for tree in $PATH $libdirs $extras; do
 	msg2 "DIR %s" "$tree"
 
 	#  Get list of files in tree.
-	files=$(find $tree -type f ! -name '*.a' ! -name '*.la' ! -name '*.py*' ! -name '*.txt' ! -name '*.h' ! -name '*.ttf' ! \
+	files=$(find "$tree" -type f ! -name '*.a' ! -name '*.la' ! -name '*.py*' ! -name '*.txt' ! -name '*.h' ! -name '*.ttf' ! \
 	-name '*.rb' ! -name '*.ko' ! -name '*.pc' ! -name '*.enc' ! -name '*.cf' ! -name '*.def' ! -name '*.rules' ! -name \
 	'*.cmi' ! -name  '*.mli' ! -name '*.ml' ! -name '*.cma' ! -name '*.cmx' ! -name '*.cmxa' ! -name '*.pod' ! -name '*.pm' \
 	! -name '*.pl' ! -name '*.al' ! -name '*.tcl' ! -name '*.bs' ! -name '*.o' ! -name '*.png' ! -name '*.gif' ! -name '*.cmo' \
@@ -28,22 +28,22 @@ for tree in $PATH $libdirs $extras; do
 	-name '*.mcopclass' ! -name '*.mcoptype')
 	IFS=$ifs
 	for i in $files; do
-		if (( $(file $i | grep -c 'ELF') != 0 )); then
+		if (( $(file "$i" | grep -c 'ELF') != 0 )); then
 			#  Is an ELF binary.
-			if (( $(ldd $i 2>/dev/null | grep -c 'not found') != 0 )); then
+			if (( $(ldd "$i" 2>/dev/null | grep -c 'not found') != 0 )); then
 				#  Missing lib.
-				echo "$i:" >> $TEMPDIR/raw.txt
-				ldd $i 2>/dev/null | grep 'not found' >> $TEMPDIR/raw.txt
+				echo "$i:" >> "$TEMPDIR/raw.txt"
+				ldd "$i" 2>/dev/null | grep 'not found' >> "$TEMPDIR/raw.txt"
 			fi
 		fi
 	done
 done
-grep '^/' $TEMPDIR/raw.txt | sed -e 's/://g' >> $TEMPDIR/affected-files.txt
+grep '^/' "$TEMPDIR/raw.txt" | sed -e 's/://g' >> "$TEMPDIR/affected-files.txt"
 # invoke pacman
 for i in $(cat $TEMPDIR/affected-files.txt); do
-	pacman -Qo $i | awk '{print $4,$5}' >> $TEMPDIR/pacman.txt
+	pacman -Qo "$i" | awk '{print $4,$5}' >> "$TEMPDIR/pacman.txt"
 done
 # clean list
-sort -u $TEMPDIR/pacman.txt >> $TEMPDIR/possible-rebuilds.txt
+sort -u "$TEMPDIR/pacman.txt" >> "$TEMPDIR/possible-rebuilds.txt"
 
 msg "Files saved to %s" "$TEMPDIR"
diff --git a/lib/common.sh b/lib/common.sh
index 8f043e8..4a15d9a 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -79,7 +79,7 @@ cleanup() {
 	if [[ -n ${WORKDIR:-} ]] && $_setup_workdir; then
 		rm -rf "$WORKDIR"
 	fi
-	exit ${1:-0}
+	exit "${1:-0}"
 }
 
 abort() {
@@ -112,7 +112,7 @@ in_array() {
 	local needle=$1; shift
 	local item
 	for item in "$@"; do
-		[[ $item = $needle ]] && return 0 # Found
+		[[ $item = "$needle" ]] && return 0 # Found
 	done
 	return 1 # Not Found
 }
@@ -134,7 +134,7 @@ get_full_version() {
 	else
 		for i in pkgver pkgrel epoch; do
 			local indirect="${i}_override"
-			eval $(declare -f package_$1 | sed -n "s/\(^[[:space:]]*$i=\)/${i}_override=/p")
+			eval "$(declare -f "package_$1" | sed -n "s/\(^[[:space:]]*$i=\)/${i}_override=/p")"
 			[[ -z ${!indirect} ]] && eval ${indirect}=\"${!i}\"
 		done
 		if (( ! epoch_override )); then
@@ -155,9 +155,9 @@ lock() {
 		eval "exec $1>"'"$2"'
 	fi
 
-	if ! flock -n $1; then
+	if ! flock -n "$1"; then
 		stat_busy "${@:3}"
-		flock $1
+		flock "$1"
 		stat_done
 	fi
 }
@@ -172,9 +172,9 @@ slock() {
 		eval "exec $1>"'"$2"'
 	fi
 
-	if ! flock -sn $1; then
+	if ! flock -sn "$1"; then
 		stat_busy "${@:3}"
-		flock -s $1
+		flock -s "$1"
 		stat_done
 	fi
 }
@@ -184,6 +184,8 @@ slock() {
 ##
 lock_close() {
 	local fd=$1
+	# https://github.com/koalaman/shellcheck/issues/862
+	# shellcheck disable=2034
 	exec {fd}>&-
 }
 
diff --git a/makechrootpkg.in b/makechrootpkg.in
index f8e8505..2dd160a 100644
--- a/makechrootpkg.in
+++ b/makechrootpkg.in
@@ -92,7 +92,7 @@ load_vars() {
 	[[ -f $makepkg_conf ]] || return 1
 
 	for var in {SRC,SRCPKG,PKG,LOG}DEST MAKEFLAGS PACKAGER; do
-		[[ -z ${!var:-} ]] && eval $(grep "^${var}=" "$makepkg_conf")
+		[[ -z ${!var:-} ]] && eval "$(grep "^${var}=" "$makepkg_conf")"
 	done
 
 	return 0
@@ -200,8 +200,8 @@ prepare_chroot() {
 	# which we might not be able to load (i.e. when building i686 packages on
 	# an x86_64 host).
 	sed -e '/^builduser:/d' -i "$copydir"/etc/{passwd,group}
-	printf >>"$copydir/etc/group"  'builduser:x:%d:\n' $builduser_gid
-	printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' $builduser_uid $builduser_gid
+	printf >>"$copydir/etc/group"  'builduser:x:%d:\n' "$builduser_gid"
+	printf >>"$copydir/etc/passwd" 'builduser:x:%d:%d:builduser:/build:/bin/bash\n' "$builduser_uid" "$builduser_gid"
 
 	$install -d "$copydir"/{build,build/.gnupg,startdir,{pkg,srcpkg,src,log}dest}
 
diff --git a/mkarchroot.in b/mkarchroot.in
index 152d323..52e363f 100644
--- a/mkarchroot.in
+++ b/mkarchroot.in
@@ -46,13 +46,13 @@ shift $((OPTIND - 1))
 
 check_root
 
-working_dir="$(readlink -f $1)"
+working_dir="$(readlink -f "$1")"
 shift 1
 
 [[ -z $working_dir ]] && die 'Please specify a working directory.'
 
 if [[ -z $cache_dir ]]; then
-	cache_dirs=($(pacman -v $cache_conf 2>&1 | grep '^Cache Dirs:' | sed 's/Cache Dirs:\s*//g'))
+	cache_dirs=($(pacman -v "$cache_conf" 2>&1 | grep '^Cache Dirs:' | sed 's/Cache Dirs:\s*//g'))
 else
 	cache_dirs=(${cache_dir})
 fi