diff --git a/archrelease.in b/archrelease.in
index 2ba9d48..6b4f1be 100644
--- a/archrelease.in
+++ b/archrelease.in
@@ -38,7 +38,7 @@ trunk=${PWD##*/}
 # Normally this should be trunk, but it may be something
 # such as 'gnome-unstable'
 IFS='/' read -r -d '' -a parts <<< "$PWD"
-if [[ "${parts[@]:(-2):1}" == "repos" ]]; then
+if [[ "${parts[*]:(-2):1}" == "repos" ]]; then
 	die 'archrelease: Should not be in repos dir (try from trunk/)'
 fi
 unset parts
@@ -67,7 +67,7 @@ for tag in "$@"; do
 		while read -r file; do
 			trash+=("repos/$tag/$file")
 		done < <(svn ls "repos/$tag")
-		[[ $trash ]] && svn rm -q "${trash[@]/%/@}"
+		[[ ${#trash[@]} == 0 ]] || svn rm -q "${trash[@]/%/@}"
 	else
 		mkdir -p "repos/$tag"
 		svn add --parents -q "repos/$tag"
diff --git a/commitpkg.in b/commitpkg.in
index 0482170..90210e5 100644
--- a/commitpkg.in
+++ b/commitpkg.in
@@ -148,9 +148,9 @@ for _arch in "${arch[@]}"; do
 		if [[ ! -f $sigfile ]]; then
 			msg "Signing package %s..." "${pkgfile}"
 			if [[ -n $GPGKEY ]]; then
-				SIGNWITHKEY="-u ${GPGKEY}"
+				SIGNWITHKEY=(-u "${GPGKEY}")
 			fi
-			gpg --detach-sign --use-agent --no-armor ${SIGNWITHKEY} "${pkgfile}" || die
+			gpg --detach-sign --use-agent --no-armor "${SIGNWITHKEY[@]}" "${pkgfile}" || die
 		fi
 		if ! gpg --verify "$sigfile" >/dev/null 2>&1; then
 			die "Signature %s.sig is incorrect!" "$pkgfile"
diff --git a/find-libdeps.in b/find-libdeps.in
index 04adebf..1fb1fdf 100644
--- a/find-libdeps.in
+++ b/find-libdeps.in
@@ -60,7 +60,7 @@ case $script_mode in
   provides) find_args=(-name '*.so*');;
 esac
 
-find . -type f "${find_args[@]}" | while read filename; do
+find . -type f "${find_args[@]}" | while read -r filename; do
 	if [[ $script_mode = "provides" ]]; then
 		# ignore if we don't have a shared object
 		if ! LC_ALL=C readelf -h "$filename" 2>/dev/null | grep -q '.*Type:.*DYN (Shared object file).*'; then
diff --git a/finddeps.in b/finddeps.in
index c71f151..80774bb 100644
--- a/finddeps.in
+++ b/finddeps.in
@@ -17,7 +17,7 @@ if [[ -z $match ]]; then
 	exit 1
 fi
 
-find . -type d | while read d; do
+find . -type d | while read -r d; do
 	if [[ -f "$d/PKGBUILD" ]]; then
 		pkgname=() depends=() makedepends=() optdepends=()
 		. "$d/PKGBUILD"
diff --git a/lddd.in b/lddd.in
index d83c3e6..908923b 100644
--- a/lddd.in
+++ b/lddd.in
@@ -40,9 +40,9 @@ for tree in $PATH $libdirs $extras; do
 done
 grep '^/' "$TEMPDIR/raw.txt" | sed -e 's/://g' >> "$TEMPDIR/affected-files.txt"
 # invoke pacman
-for i in $(cat $TEMPDIR/affected-files.txt); do
+while read -r i; do
 	pacman -Qo "$i" | awk '{print $4,$5}' >> "$TEMPDIR/pacman.txt"
-done
+done < "$TEMPDIR/affected-files.txt"
 # clean list
 sort -u "$TEMPDIR/pacman.txt" >> "$TEMPDIR/possible-rebuilds.txt"
 
diff --git a/lib/common.sh b/lib/common.sh
index 4a15d9a..ad6194d 100644
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -123,24 +123,27 @@ in_array() {
 ##
 get_full_version() {
 	# set defaults if they weren't specified in buildfile
-	pkgbase=${pkgbase:-${pkgname[0]}}
-	epoch=${epoch:-0}
+	local pkgbase=${pkgbase:-${pkgname[0]}}
+	local epoch=${epoch:-0}
+	local pkgver=${pkgver}
+	local pkgrel=${pkgrel}
 	if [[ -z $1 ]]; then
 		if (( ! epoch )); then
-			echo $pkgver-$pkgrel
+			printf '%s\n' "$pkgver-$pkgrel"
 		else
-			echo $epoch:$pkgver-$pkgrel
+			printf '%s\n' "$epoch:$pkgver-$pkgrel"
 		fi
 	else
+		local pkgver_override='' pkgrel_override='' epoch_override=''
 		for i in pkgver pkgrel epoch; do
 			local indirect="${i}_override"
 			eval "$(declare -f "package_$1" | sed -n "s/\(^[[:space:]]*$i=\)/${i}_override=/p")"
 			[[ -z ${!indirect} ]] && eval ${indirect}=\"${!i}\"
 		done
 		if (( ! epoch_override )); then
-			echo $pkgver_override-$pkgrel_override
+			printf '%s\n' "$pkgver_override-$pkgrel_override"
 		else
-			echo $epoch_override:$pkgver_override-$pkgrel_override
+			printf '%s\n' "$epoch_override:$pkgver_override-$pkgrel_override"
 		fi
 	fi
 }
diff --git a/rebuildpkgs.in b/rebuildpkgs.in
index be3fd33..a0e8250 100644
--- a/rebuildpkgs.in
+++ b/rebuildpkgs.in
@@ -40,7 +40,7 @@ bump_pkgrel() {
 	oldrel=$(grep 'pkgrel=' $pbuild | cut -d= -f2)
 
 	#remove decimals
-	rel=$(echo $oldrel | cut -d. -f1)
+	rel=${oldrel%%.*}
 
 	newrel=$((rel + 1))
 
@@ -54,7 +54,7 @@ pkg_from_pkgbuild() {
 }
 
 chrootdir="$1"; shift
-pkgs="$@"
+pkgs=("$@")
 
 SVNPATH='svn+ssh://repos.archlinux.org/srv/repos/svn-packages/svn'
 
@@ -67,7 +67,7 @@ cd "$REBUILD_ROOT"
 /usr/bin/svn co -N $SVNPATH
 
 FAILED=""
-for pkg in $pkgs; do
+for pkg in "${pkgs[@]}"; do
 	cd "$REBUILD_ROOT/svn-packages"
 
 	msg2 "Building '%s'" "$pkg"