Merge branch 'NixOS:master' into breno.rename_syms

32 files changed, 275 insertions, 282 deletions

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c180417..f330171 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -47,7 +47,7 @@ jobs:
     needs: [build_windows]
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: actions/download-artifact@v3
         with:
           name: patchelf
diff --git a/tests/add-debug-tag.sh b/tests/add-debug-tag.sh
index 4fbbfa4..37bf957 100755
--- a/tests/add-debug-tag.sh
+++ b/tests/add-debug-tag.sh
@@ -1,14 +1,14 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 READELF=${READELF:-readelf}
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp libsimple.so ${SCRATCH}/
+cp libsimple.so "${SCRATCH}"/
 
 # check there is no DT_DEBUG tag
-debugTag=$($READELF -d ${SCRATCH}/libsimple.so)
+debugTag=$($READELF -d "${SCRATCH}/libsimple.so")
 echo ".dynamic before: $debugTag"
 if echo "$debugTag" | grep -q DEBUG; then
     echo "failed --add-debug-tag test. Expected no line with (DEBUG), got: $debugTag"
@@ -16,10 +16,10 @@ if echo "$debugTag" | grep -q DEBUG; then
 fi
 
 # set DT_DEBUG
-../src/patchelf --add-debug-tag ${SCRATCH}/libsimple.so
+../src/patchelf --add-debug-tag "${SCRATCH}/libsimple.so"
 
 # check there is DT_DEBUG tag
-debugTag=$($READELF -d ${SCRATCH}/libsimple.so)
+debugTag=$($READELF -d "${SCRATCH}/libsimple.so")
 echo ".dynamic before: $debugTag"
 if ! echo "$debugTag" | grep -q DEBUG; then
     echo "failed --add-debug-tag test. Expected line with (DEBUG), got: $debugTag"
diff --git a/tests/add-rpath.sh b/tests/add-rpath.sh
index 3368708..1f9f7f9 100755
--- a/tests/add-rpath.sh
+++ b/tests/add-rpath.sh
@@ -1,24 +1,25 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}/libsA"
+mkdir -p "${SCRATCH}/libsB"
 
-cp main ${SCRATCH}/
-cp libfoo.so ${SCRATCH}/libsA/
-cp libbar.so ${SCRATCH}/libsB/
+cp main "${SCRATCH}"/
+cp libfoo.so "${SCRATCH}/libsA/"
+cp libbar.so "${SCRATCH}/libsB/"
 
-../src/patchelf --force-rpath --add-rpath $(pwd)/${SCRATCH}/libsA ${SCRATCH}/main
-../src/patchelf --force-rpath --add-rpath $(pwd)/${SCRATCH}/libsB ${SCRATCH}/main
+../src/patchelf --force-rpath --add-rpath "$(pwd)/${SCRATCH}/libsA" "${SCRATCH}/main"
+../src/patchelf --force-rpath --add-rpath "$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/main"
 
 if test "$(uname)" = FreeBSD; then
-    export LD_LIBRARY_PATH=$(pwd)/${SCRATCH}/libsB
+    LD_LIBRARY_PATH="$(pwd)/${SCRATCH}/libsB"
+    export LD_LIBRARY_PATH
 fi
 
 exitCode=0
-(cd ${SCRATCH} && ./main) || exitCode=$?
+(cd "${SCRATCH}" && ./main) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/args-from-file.sh b/tests/args-from-file.sh
index c0d1a54..107031e 100755
--- a/tests/args-from-file.sh
+++ b/tests/args-from-file.sh
@@ -1,16 +1,16 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp main ${SCRATCH}/
-RANDOM_PATH=$(pwd)/${SCRATCH}/$RANDOM
-echo -n ${RANDOM_PATH} >> ${SCRATCH}/add-rpath
+cp main "${SCRATCH}"/
+SOME_PATH=$(pwd)/${SCRATCH}/some-path
+printf "%s" "$SOME_PATH" >> "${SCRATCH}"/add-rpath
 
-! ../src/patchelf --print-rpath ${SCRATCH}/main | grep $RANDOM_PATH
-../src/patchelf --add-rpath @${SCRATCH}/add-rpath ${SCRATCH}/main
-../src/patchelf --print-rpath ${SCRATCH}/main | grep $RANDOM_PATH
+ ../src/patchelf --print-rpath "${SCRATCH}"/main | grep "$SOME_PATH" && exit 1
+../src/patchelf --add-rpath @"${SCRATCH}"/add-rpath "${SCRATCH}"/main
+../src/patchelf --print-rpath "${SCRATCH}"/main | grep "$SOME_PATH"
 
 # should print error message and fail
-../src/patchelf --set-rpath @${SCRATCH}/does-not-exist ${SCRATCH}/main 2>&1 | grep "getting info about"
+../src/patchelf --set-rpath @"${SCRATCH}"/does-not-exist "${SCRATCH}"/main 2>&1 | grep "getting info about"
diff --git a/tests/big-dynstr.sh b/tests/big-dynstr.sh
index 19adad1..89c5355 100755
--- a/tests/big-dynstr.sh
+++ b/tests/big-dynstr.sh
@@ -1,25 +1,26 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}/libsA"
+mkdir -p "${SCRATCH}/libsB"
 
-cp big-dynstr ${SCRATCH}/
-cp libfoo.so ${SCRATCH}/libsA/
-cp libbar.so ${SCRATCH}/libsB/
+cp big-dynstr "${SCRATCH}/"
+cp libfoo.so "${SCRATCH}/libsA/"
+cp libbar.so "${SCRATCH}/libsB/"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/big-dynstr)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/big-dynstr")
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
-../src/patchelf --force-rpath --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/big-dynstr
+../src/patchelf --force-rpath --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/big-dynstr"
 
 if test "$(uname)" = FreeBSD; then
-    export LD_LIBRARY_PATH=$(pwd)/${SCRATCH}/libsB
+    LD_LIBRARY_PATH="$(pwd)/${SCRATCH}/libsB"
+    export LD_LIBRARY_PATH
 fi
 
 exitCode=0
-cd ${SCRATCH} && ./big-dynstr || exitCode=$?
+cd "${SCRATCH}" && ./big-dynstr || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/build-id.sh b/tests/build-id.sh
index dc44a7a..c9bf712 100755
--- a/tests/build-id.sh
+++ b/tests/build-id.sh
@@ -1,5 +1,5 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 READELF=${READELF:-readelf}
 
 rm -rf "${SCRATCH}"
diff --git a/tests/change-abi.sh b/tests/change-abi.sh
index 26a151d..03c5f9b 100755
--- a/tests/change-abi.sh
+++ b/tests/change-abi.sh
@@ -1,44 +1,29 @@
 #! /bin/sh -e
 
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp simple-pie ${SCRATCH}/simple-pie
+cp simple-pie "${SCRATCH}/simple-pie"
 
 # Save the old OS ABI
-OLDABI=`../src/patchelf --print-os-abi ${SCRATCH}/simple-pie`
+OLDABI=$(../src/patchelf --print-os-abi "${SCRATCH}/simple-pie")
 # Ensure it's not empty
 test -n "$OLDABI"
 
 # Change OS ABI and verify it has been changed
-{
-  echo "System V"
-  echo "HP-UX"
-  echo "NetBSD"
-  echo "Linux"
-  echo "GNU Hurd"
-  echo "Solaris"
-  echo "AIX"
-  echo "IRIX"
-  echo "FreeBSD"
-  echo "Tru64"
-  echo "OpenBSD"
-  echo "OpenVMS"
-} | {
-  while IFS="\n" read ABI; do
-    echo "Set OS ABI to '$ABI'..."
-    ../src/patchelf --set-os-abi "$ABI" ${SCRATCH}/simple-pie
-
-    echo "Check is OS ABI is '$ABI'..."
-    NEWABI=`../src/patchelf --print-os-abi ${SCRATCH}/simple-pie`
-    test "$NEWABI" = "$ABI"
-  done
-}
+for ABI in "System V" "HP-UX" "NetBSD" "Linux" "GNU Hurd" "Solaris" "AIX" "IRIX" "FreeBSD" "Tru64" "OpenBSD" "OpenVMS"; do
+  echo "Set OS ABI to '$ABI'..."
+  ../src/patchelf --set-os-abi "$ABI" "${SCRATCH}/simple-pie"
+
+  echo "Check is OS ABI is '$ABI'..."
+  NEWABI=$(../src/patchelf --print-os-abi "${SCRATCH}/simple-pie")
+  test "$NEWABI" = "$ABI"
+done
 
 # Reset OS ABI to the saved one
-../src/patchelf --set-os-abi "$OLDABI" ${SCRATCH}/simple-pie
+../src/patchelf --set-os-abi "$OLDABI" "${SCRATCH}/simple-pie"
 
 # Verify we still can run the executable
-${SCRATCH}/simple-pie
+"${SCRATCH}/simple-pie"
diff --git a/tests/contiguous-note-sections.sh b/tests/contiguous-note-sections.sh
index 65abf0c..aa1f84a 100755
--- a/tests/contiguous-note-sections.sh
+++ b/tests/contiguous-note-sections.sh
@@ -1,6 +1,6 @@
 #! /bin/sh -e
 
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
 rm -rf "${SCRATCH}"
 mkdir -p "${SCRATCH}"
@@ -10,4 +10,4 @@ cp contiguous-note-sections "${SCRATCH}/"
 # Running --set-interpreter on this binary should not produce the following
 # error:
 # patchelf: cannot normalize PT_NOTE segment: non-contiguous SHT_NOTE sections
-../src/patchelf --set-interpreter ld-linux-x86-64.so.2 ${SCRATCH}/contiguous-note-sections
+../src/patchelf --set-interpreter ld-linux-x86-64.so.2 "${SCRATCH}/contiguous-note-sections"
diff --git a/tests/empty-note.sh b/tests/empty-note.sh
index c127d8c..57656fb 100755
--- a/tests/empty-note.sh
+++ b/tests/empty-note.sh
@@ -1,12 +1,12 @@
 #! /bin/sh -e
 
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-cp $(dirname $(readlink -f $0))/empty-note ${SCRATCH}/
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+cp "$(dirname "$(readlink -f "$0")")/empty-note" "${SCRATCH}/"
 
 # Running --set-interpreter on this binary should not produce the following
 # error:
 # patchelf: cannot normalize PT_NOTE segment: non-contiguous SHT_NOTE sections
-../src/patchelf --set-interpreter ld-linux-x86-64.so.2 ${SCRATCH}/empty-note
+../src/patchelf --set-interpreter ld-linux-x86-64.so.2 "${SCRATCH}/empty-note"
diff --git a/tests/endianness.sh b/tests/endianness.sh
index 4f84a08..fc2994b 100755
--- a/tests/endianness.sh
+++ b/tests/endianness.sh
@@ -1,23 +1,23 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 PATCHELF="../src/patchelf"
 
 for arch in ppc64 ppc64le; do
-    rm -rf ${SCRATCH}
-    mkdir -p ${SCRATCH}
+    rm -rf "${SCRATCH}"
+    mkdir -p "${SCRATCH}"
 
-    cp ${srcdir}/endianness/${arch}/main ${srcdir}/endianness/${arch}/libtest.so ${SCRATCH}/
+    cp "${srcdir}/endianness/${arch}/main" "${srcdir}/endianness/${arch}/libtest.so" "${SCRATCH}/"
 
     rpath="${PWD}/${SCRATCH}"
 
     # set rpath to scratch dir
-    ${PATCHELF} --output ${SCRATCH}/main-rpath --set-rpath $rpath ${SCRATCH}/main
+    ${PATCHELF} --output "${SCRATCH}/main-rpath" --set-rpath "$rpath" "${SCRATCH}/main"
 
     # attempt to shrink rpath, should not result in empty rpath
-    ${PATCHELF} --output ${SCRATCH}/main-shrunk --shrink-rpath --debug ${SCRATCH}/main-rpath 
+    ${PATCHELF} --output "${SCRATCH}/main-shrunk" --shrink-rpath --debug "${SCRATCH}/main-rpath"
 
     # check whether rpath is still present
-    if ! ${PATCHELF} --print-rpath ${SCRATCH}/main-shrunk | grep -q "$rpath"; then
+    if ! ${PATCHELF} --print-rpath "${SCRATCH}/main-shrunk" | grep -q "$rpath"; then
         echo "rpath was removed for ${arch}"
         exit 1
     fi
diff --git a/tests/force-rpath.sh b/tests/force-rpath.sh
index c9b9a5d..a673f20 100755
--- a/tests/force-rpath.sh
+++ b/tests/force-rpath.sh
@@ -1,29 +1,33 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 OBJDUMP=${OBJDUMP:-objdump}
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
 SCRATCHFILE=${SCRATCH}/libfoo.so
-cp libfoo.so $SCRATCHFILE
+cp libfoo.so "$SCRATCHFILE"
 
 doit() {
-    echo patchelf $*
-    ../src/patchelf $* $SCRATCHFILE
+    set +x
+    ../src/patchelf "$@" "$SCRATCHFILE"
+    set -x
 }
 
 expect() {
-    out=$(echo $($OBJDUMP -x $SCRATCHFILE | grep PATH))
+    out=$("$OBJDUMP" -x "$SCRATCHFILE" | grep PATH || true)
 
-    if [ "$out" != "$*" ]; then
-        echo "Expected '$*' but got '$out'"
-        exit 1
-    fi
+    for i in $out; do
+        if [ "$i" != "$1" ]; then
+            echo "Expected '$*' but got '$out'"
+            exit 1
+        fi
+        shift
+    done
 }
 
 doit --remove-rpath
-expect
+expect ""
 doit --set-rpath foo
 expect RUNPATH foo
 doit --force-rpath --set-rpath foo
diff --git a/tests/grow-file.sh b/tests/grow-file.sh
index 4c405df..ec5957d 100755
--- a/tests/grow-file.sh
+++ b/tests/grow-file.sh
@@ -1,16 +1,16 @@
 #! /bin/sh -e
 
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp simple-pie ${SCRATCH}/simple-pie
+cp simple-pie "${SCRATCH}/simple-pie"
 
 # Add a 40MB rpath
-tr -cd 'a-z0-9' < /dev/urandom | dd count=40 bs=1000000 > ${SCRATCH}/foo.bin
+tr -cd 'a-z0-9' < /dev/urandom | dd count=40 bs=1000000 > "${SCRATCH}/foo.bin"
 
 # Grow the file
-../src/patchelf --add-rpath @${SCRATCH}/foo.bin ${SCRATCH}/simple-pie
+../src/patchelf --add-rpath @"${SCRATCH}/foo.bin" "${SCRATCH}/simple-pie"
 # Make sure we can still run it
-${SCRATCH}/simple-pie
+"${SCRATCH}/simple-pie"
diff --git a/tests/invalid-elf.sh b/tests/invalid-elf.sh
index 0f020e8..c124501 100755
--- a/tests/invalid-elf.sh
+++ b/tests/invalid-elf.sh
@@ -6,12 +6,12 @@
 # by a signal. This works because the exit code of processes that were
 # killed by a signal is 128 plus the signal number.
 killed_by_signal() {
-    [ $1 -ge 128 ]
+    [ "$1" -ge 128 ]
 }
 
 
 # The directory containing all our input files.
-TEST_DIR=$(dirname $(readlink -f $0))/invalid-elf
+TEST_DIR=$(dirname "$(readlink -f "$0")")/invalid-elf
 
 # Each test case is listed here. The names should roughly indicate
 # what makes the given ELF file invalid.
diff --git a/tests/no-gnu-hash.sh b/tests/no-gnu-hash.sh
index 0ce93f4..b12542e 100755
--- a/tests/no-gnu-hash.sh
+++ b/tests/no-gnu-hash.sh
@@ -1,14 +1,14 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 STRIP=${STRIP:-strip}
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp simple ${SCRATCH}/
+cp simple "${SCRATCH}/"
 
-${STRIP} --remove-section=.gnu.hash ${SCRATCH}/simple
+${STRIP} --remove-section=.gnu.hash "${SCRATCH}/simple"
 
 # Check if patchelf handles binaries with GNU_HASH in dynamic section but
 # without .gnu.hash section
-../src/patchelf --set-interpreter /oops ${SCRATCH}/simple
+../src/patchelf --set-interpreter /oops "${SCRATCH}/simple"
diff --git a/tests/no-rpath-pie-powerpc.sh b/tests/no-rpath-pie-powerpc.sh
index b469f9b..963797c 100755
--- a/tests/no-rpath-pie-powerpc.sh
+++ b/tests/no-rpath-pie-powerpc.sh
@@ -30,7 +30,7 @@ fi
 # Tests for powerpc PIE endianness regressions
 readelfData=$(${READELF} -l ${SCRATCH}/no-rpath 2>&1)
 
-if [ $(echo "$readelfData" | grep --count "PHDR") != 1 ]; then
+if [ $(echo "$readelfData" | grep "PHDR" | wc -l) != 1 ]; then
   # Triggered if PHDR errors appear on stderr
   echo "Unexpected number of occurences of PHDR in readelf results"
   exit 1
diff --git a/tests/no-rpath-prebuild.sh b/tests/no-rpath-prebuild.sh
index c58cf8e..143c55c 100755
--- a/tests/no-rpath-prebuild.sh
+++ b/tests/no-rpath-prebuild.sh
@@ -4,35 +4,35 @@ ARCH="$1"
 PAGESIZE=4096
 
 if [ -z "$ARCH" ]; then
-  ARCH=$(basename $0 .sh | sed -e 's/^no-rpath-//')
+  ARCH=$(basename "$0" .sh | sed -e 's/^no-rpath-//')
 fi
 
 SCRATCH=scratch/no-rpath-$ARCH
 
-if [ -z "$ARCH" ] || [ $ARCH = prebuild ] ; then
+if [ -z "$ARCH" ] || [ "$ARCH" = prebuild ] ; then
   echo "Architecture required"
   exit 1
 fi
 
 no_rpath_bin="${srcdir}/no-rpath-prebuild/no-rpath-$ARCH"
 
-if [ ! -f $no_rpath_bin ]; then
+if [ ! -f "$no_rpath_bin" ]; then
   echo "no 'no-rpath' binary for '$ARCH' in '${srcdir}/no-rpath-prebuild'"
   exit 1
 fi
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp $no_rpath_bin ${SCRATCH}/no-rpath
+cp "$no_rpath_bin" "${SCRATCH}"/no-rpath
 
-oldRPath=$(../src/patchelf --page-size ${PAGESIZE} --print-rpath ${SCRATCH}/no-rpath)
+oldRPath=$(../src/patchelf --page-size "${PAGESIZE}" --print-rpath "${SCRATCH}/no-rpath")
 if test -n "$oldRPath"; then exit 1; fi
-../src/patchelf --page-size ${PAGESIZE} \
-  --set-interpreter "$(../src/patchelf --page-size ${PAGESIZE} --print-interpreter ../src/patchelf)" \
-  --set-rpath /foo:/bar:/xxxxxxxxxxxxxxx ${SCRATCH}/no-rpath
+../src/patchelf --page-size "${PAGESIZE}" \
+  --set-interpreter "$(../src/patchelf --page-size "${PAGESIZE}" --print-interpreter ../src/patchelf)" \
+  --set-rpath /foo:/bar:/xxxxxxxxxxxxxxx "${SCRATCH}"/no-rpath
 
-newRPath=$(../src/patchelf --page-size ${PAGESIZE} --print-rpath ${SCRATCH}/no-rpath)
+newRPath=$(../src/patchelf --page-size "${PAGESIZE}" --print-rpath "${SCRATCH}/no-rpath")
 if ! echo "$newRPath" | grep -q '/foo:/bar'; then
     echo "incomplete RPATH"
     exit 1
diff --git a/tests/no-rpath.sh b/tests/no-rpath.sh
index 3efa7f1..7fe0372 100755
--- a/tests/no-rpath.sh
+++ b/tests/no-rpath.sh
@@ -1,21 +1,21 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp no-rpath ${SCRATCH}/
+cp no-rpath "${SCRATCH}/"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/no-rpath)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/no-rpath")
 if test -n "$oldRPath"; then exit 1; fi
 ../src/patchelf \
   --set-interpreter "$(../src/patchelf --print-interpreter ../src/patchelf)" \
-  --set-rpath /foo:/bar:/xxxxxxxxxxxxxxx ${SCRATCH}/no-rpath
+  --set-rpath /foo:/bar:/xxxxxxxxxxxxxxx "${SCRATCH}/no-rpath"
 
-newRPath=$(../src/patchelf --print-rpath ${SCRATCH}/no-rpath)
+newRPath=$(../src/patchelf --print-rpath "${SCRATCH}/no-rpath")
 if ! echo "$newRPath" | grep -q '/foo:/bar'; then
     echo "incomplete RPATH"
     exit 1
 fi
 
-cd ${SCRATCH} && ./no-rpath
+cd "${SCRATCH}" && ./no-rpath
diff --git a/tests/output-flag.sh b/tests/output-flag.sh
index 5da26b5..26e8782 100755
--- a/tests/output-flag.sh
+++ b/tests/output-flag.sh
@@ -1,28 +1,29 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}/libsA"
+mkdir -p "${SCRATCH}/libsB"
 
-cp main ${SCRATCH}/
-cp libfoo.so ${SCRATCH}/libsA/
-cp libbar.so ${SCRATCH}/libsB/
+cp main "${SCRATCH}"/
+cp libfoo.so "${SCRATCH}/libsA/"
+cp libbar.so "${SCRATCH}/libsB/"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/main)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/main")
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
 
-../src/patchelf --force-rpath --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/main --output ${SCRATCH}/main2
+../src/patchelf --force-rpath --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/main" --output "${SCRATCH}/main2"
 # make sure it copies even when there is nothing to do (because rpath is already set)
-../src/patchelf --force-rpath --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/main2 --output ${SCRATCH}/main3
+../src/patchelf --force-rpath --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/main2" --output "${SCRATCH}/main3"
 
 if test "$(uname)" = FreeBSD; then
-    export LD_LIBRARY_PATH=$(pwd)/${SCRATCH}/libsB
+    LD_LIBRARY_PATH="$(pwd)/${SCRATCH}/libsB"
+    export LD_LIBRARY_PATH
 fi
 
 exitCode=0
-(cd ${SCRATCH} && ./main2) || exitCode=$?
+(cd "${SCRATCH}" && ./main2) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
@@ -30,7 +31,7 @@ if test "$exitCode" != 46; then
 fi
 
 exitCode=0
-(cd ${SCRATCH} && ./main3) || exitCode=$?
+(cd "${SCRATCH}" && ./main3) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/phdr-corruption.sh b/tests/phdr-corruption.sh
index 1e62101..4f6e901 100755
--- a/tests/phdr-corruption.sh
+++ b/tests/phdr-corruption.sh
@@ -2,7 +2,7 @@
 
 PATCHELF="../src/patchelf"
 SONAME="phdr-corruption.so"
-SCRATCH="scratch/$(basename $0 .sh)"
+SCRATCH="scratch/$(basename "$0" .sh)"
 SCRATCH_SO="${SCRATCH}/${SONAME}"
 READELF=${READELF:-readelf}
 
@@ -15,7 +15,7 @@ cp "${SONAME}" "${SCRATCH}"
 # Check for PT_PHDR entry VirtAddr corruption
 readelfData=$(${READELF} -l "${SCRATCH_SO}" 2>&1)
 
-if [ $(echo "$readelfData" | grep --count "PHDR") != 1 ]; then
+if [ "$(echo "$readelfData" | grep "PHDR" | wc -l)" != 1 ]; then
   # Triggered if PHDR errors appear on stderr
   echo "ERROR: Unexpected number of occurences of PHDR in readelf results!"
   exit 1
diff --git a/tests/plain-needed.sh b/tests/plain-needed.sh
index 8967303..e44293b 100755
--- a/tests/plain-needed.sh
+++ b/tests/plain-needed.sh
@@ -1,14 +1,14 @@
 #! /bin/sh
 set -e
 
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 MAIN_ELF="${SCRATCH}/main"
 
 PATCHELF="../src/patchelf"
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-cp main ${SCRATCH}/
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+cp main "${SCRATCH}"/
 
 echo "Confirming main requires libfoo"
 ${PATCHELF} --print-needed "${MAIN_ELF}" | grep -q libfoo.so
diff --git a/tests/replace-add-needed.sh b/tests/replace-add-needed.sh
index e2cb255..701cb95 100755
--- a/tests/replace-add-needed.sh
+++ b/tests/replace-add-needed.sh
@@ -1,15 +1,15 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 PATCHELF=$(readlink -f "../src/patchelf")
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp simple ${SCRATCH}/
-cp libfoo.so ${SCRATCH}/
-cp libbar.so ${SCRATCH}/
+cp simple "${SCRATCH}"/
+cp libfoo.so "${SCRATCH}"/
+cp libbar.so "${SCRATCH}"/
 
-cd ${SCRATCH}
+cd "${SCRATCH}"
 
 libcldd=$(ldd ./simple | awk '/ => / { print $3 }' | grep -E "(libc(-[0-9.]*)*.so|ld-musl)")
 
@@ -22,11 +22,11 @@ ${PATCHELF} --add-needed libbar.so ./simple
 # Make the NEEDED in libfoo the same as simple
 # This is a current "bug" in musl
 # https://www.openwall.com/lists/musl/2021/12/21/1
-${PATCHELF} --replace-needed libbar.so $(readlink -f ./libbar.so) ./libfoo.so
+${PATCHELF} --replace-needed libbar.so "$(readlink -f ./libbar.so)" ./libfoo.so
 
-${PATCHELF} --replace-needed libc.so.6 ${libcldd} \
-            --replace-needed libbar.so $(readlink -f ./libbar.so) \
-            --add-needed $(readlink -f ./libfoo.so) \
+${PATCHELF} --replace-needed libc.so.6 "${libcldd}" \
+            --replace-needed libbar.so "$(readlink -f ./libbar.so)" \
+            --add-needed "$(readlink -f ./libfoo.so)" \
             ./simple
 
 exitCode=0
@@ -35,4 +35,4 @@ exitCode=0
 if test "$exitCode" != 0; then
     ldd ./simple
     exit 1
-fi
\ No newline at end of file
+fi
diff --git a/tests/replace-needed.sh b/tests/replace-needed.sh
index 0a5581c..6099d93 100755
--- a/tests/replace-needed.sh
+++ b/tests/replace-needed.sh
@@ -1,21 +1,20 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-oldNeeded=$(../src/patchelf --print-needed big-dynstr)
 oldLibc=$(../src/patchelf --print-needed big-dynstr | grep -v 'foo\.so')
-../src/patchelf --output ${SCRATCH}/big-needed --replace-needed ${oldLibc} long_long_very_long_libc.so.6 --replace-needed libfoo.so lf.so big-dynstr
+../src/patchelf --output "${SCRATCH}/big-needed" --replace-needed "${oldLibc}" long_long_very_long_libc.so.6 --replace-needed libfoo.so lf.so big-dynstr
 
-if [ -z "$(../src/patchelf --print-needed ${SCRATCH}/big-needed | grep -Fx "long_long_very_long_libc.so.6")" ]; then
+if ! ../src/patchelf --print-needed "${SCRATCH}/big-needed" | grep -Fxq "long_long_very_long_libc.so.6"; then
 	echo "library long_long_very_long_libc.so.6 not found as NEEDED"
-	../src/patchelf --print-needed ${SCRATCH}/big-needed
+	../src/patchelf --print-needed "${SCRATCH}/big-needed"
 	exit 1
 fi
 
-if [ -z "$(../src/patchelf --print-needed ${SCRATCH}/big-needed | grep -Fx "lf.so")" ]; then
+if ! ../src/patchelf --print-needed "${SCRATCH}/big-needed" | grep -Fxq "lf.so"; then
 	echo "library lf.so not found as NEEDED"
-	../src/patchelf --print-needed ${SCRATCH}/big-needed
+	../src/patchelf --print-needed "${SCRATCH}/big-needed"
 	exit 1
 fi
diff --git a/tests/set-empty-rpath.sh b/tests/set-empty-rpath.sh
index de846a2..b640822 100755
--- a/tests/set-empty-rpath.sh
+++ b/tests/set-empty-rpath.sh
@@ -1,11 +1,11 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp simple ${SCRATCH}/simple
+cp simple "${SCRATCH}"/simple
 
-../src/patchelf --force-rpath --set-rpath "" ${SCRATCH}/simple
+../src/patchelf --force-rpath --set-rpath "" "${SCRATCH}/simple"
 
-${SCRATCH}/simple
+"${SCRATCH}"/simple
diff --git a/tests/set-interpreter-long.sh b/tests/set-interpreter-long.sh
index 058ccd2..f1e0d2f 100755
--- a/tests/set-interpreter-long.sh
+++ b/tests/set-interpreter-long.sh
@@ -1,5 +1,5 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
 ./simple
 
@@ -11,24 +11,24 @@ if test "$(uname)" = Linux; then
     "$oldInterpreter" ./simple
 fi
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-newInterpreter=$(pwd)/${SCRATCH}/iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii
-cp simple ${SCRATCH}/
-../src/patchelf --set-interpreter "$newInterpreter" ${SCRATCH}/simple
+newInterpreter="$(pwd)/${SCRATCH}/iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii"
+cp simple "${SCRATCH}/"
+../src/patchelf --set-interpreter "$newInterpreter" "${SCRATCH}/simple"
 
 echo "running with missing interpreter..."
-if ${SCRATCH}/simple; then
+if "${SCRATCH}"/simple; then
     echo "simple works, but it shouldn't"
     exit 1
 fi
 
 echo "running with new interpreter..."
 ln -s "$oldInterpreter" "$newInterpreter"
-${SCRATCH}/simple
+"${SCRATCH}"/simple
 
 if test "$(uname)" = Linux; then
     echo "running with explicit interpreter..."
-    "$oldInterpreter" ${SCRATCH}/simple
+    "$oldInterpreter" "${SCRATCH}/simple"
 fi
diff --git a/tests/set-interpreter-short.sh b/tests/set-interpreter-short.sh
index 2c9f4eb..69746da 100755
--- a/tests/set-interpreter-short.sh
+++ b/tests/set-interpreter-short.sh
@@ -1,19 +1,19 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
 ./simple
 
 oldInterpreter=$(../src/patchelf --print-interpreter ./simple)
 echo "current interpreter is $oldInterpreter"
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp simple ${SCRATCH}/
-../src/patchelf --set-interpreter /oops ${SCRATCH}/simple
+cp simple "${SCRATCH}"/
+../src/patchelf --set-interpreter /oops "${SCRATCH}/simple"
 
 echo "running with missing interpreter..."
-if ${SCRATCH}/simple; then
+if "${SCRATCH}/simple"; then
     echo "simple works, but it shouldn't"
     exit 1
 fi
diff --git a/tests/set-rpath-library.sh b/tests/set-rpath-library.sh
index a5c8ca7..55661a1 100755
--- a/tests/set-rpath-library.sh
+++ b/tests/set-rpath-library.sh
@@ -1,40 +1,40 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
 if test "$(uname)" = FreeBSD; then
     echo "skipping on FreeBSD"
     exit 0
 fi
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}/libsA"
+mkdir -p "${SCRATCH}/libsB"
 
-cp main-scoped ${SCRATCH}/
-cp libfoo-scoped.so ${SCRATCH}/libsA/
-cp libbar-scoped.so ${SCRATCH}/libsB/
+cp main-scoped "${SCRATCH}/"
+cp libfoo-scoped.so "${SCRATCH}/libsA/"
+cp libbar-scoped.so "${SCRATCH}/libsB/"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/main-scoped)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}"/main-scoped)
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
-../src/patchelf --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/main-scoped
+../src/patchelf --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/main-scoped"
 
 # "main" contains libbar in its RUNPATH, but that's ignored when
 # resolving libfoo.  So libfoo won't find libbar and this will fail.
 exitCode=0
-(cd ${SCRATCH} && ./main-scoped) || exitCode=$?
+(cd "${SCRATCH}" && ./main-scoped) || exitCode=$?
 
 if test "$exitCode" = 46; then
     echo "expected failure"
 fi
 
 # So set an RUNPATH on libfoo as well.
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/libsA/libfoo-scoped.so)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/libsA/libfoo-scoped.so")
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
-../src/patchelf --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/libsA/libfoo-scoped.so
+../src/patchelf --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/libsA/libfoo-scoped.so"
 
 exitCode=0
-(cd ${SCRATCH} && ./main-scoped) || exitCode=$?
+(cd "${SCRATCH}" && ./main-scoped) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
@@ -42,15 +42,15 @@ if test "$exitCode" != 46; then
 fi
 
 # Remove the libbar PATH from main using --shrink-rpath.
-../src/patchelf --shrink-rpath ${SCRATCH}/main-scoped
-if ../src/patchelf --print-rpath ${SCRATCH}/main-scoped | grep /libsB; then
+../src/patchelf --shrink-rpath "${SCRATCH}/main-scoped"
+if ../src/patchelf --print-rpath "${SCRATCH}/main-scoped" | grep /libsB; then
     echo "shrink failed"
     exit 1
 fi
 
 # And it should still run.
 exitCode=0
-(cd ${SCRATCH} && ./main-scoped) || exitCode=$?
+(cd "${SCRATCH}" && ./main-scoped) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/set-rpath-rel-map.sh b/tests/set-rpath-rel-map.sh
index 48bc361..2f890f2 100755
--- a/tests/set-rpath-rel-map.sh
+++ b/tests/set-rpath-rel-map.sh
@@ -1,6 +1,6 @@
 #! /bin/sh -e
 
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 OBJDUMP=${OBJDUMP:-objdump}
 OBJCOPY=${OBJCOPY:-objcopy}
 
@@ -9,29 +9,30 @@ if ! $OBJDUMP -p main | grep -q MIPS_RLD_MAP_REL; then
     exit 0
 fi
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}/libsA"
+mkdir -p "${SCRATCH}/libsB"
 
-cp main ${SCRATCH}/
-cp libfoo.so ${SCRATCH}/libsA/
-cp libbar.so ${SCRATCH}/libsB/
+cp main "${SCRATCH}/"
+cp libfoo.so "${SCRATCH}/libsA/"
+cp libbar.so "${SCRATCH}/libsB/"
 
 # break the main executable by removing .rld_map section
-${OBJCOPY} --remove-section .rld_map ${SCRATCH}/main
+${OBJCOPY} --remove-section .rld_map "${SCRATCH}/main"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/main)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/main")
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
-../src/patchelf --force-rpath --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/main
+../src/patchelf --force-rpath --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/main"
 
 if test "$(uname)" = FreeBSD; then
-    export LD_LIBRARY_PATH=$(pwd)/${SCRATCH}/libsB
+    LD_LIBRARY_PATH=$(pwd)/"${SCRATCH}"/libsB
+    export LD_LIBRARY_PATH
 fi
 
 exitCode=0
 
-(cd ${SCRATCH} && ./main) || exitCode=$?
+(cd "${SCRATCH}" && ./main) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/set-rpath.sh b/tests/set-rpath.sh
index 90452f9..565582a 100755
--- a/tests/set-rpath.sh
+++ b/tests/set-rpath.sh
@@ -1,25 +1,26 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}"/libsA
+mkdir -p "${SCRATCH}"/libsB
 
-cp main ${SCRATCH}/
-cp libfoo.so ${SCRATCH}/libsA/
-cp libbar.so ${SCRATCH}/libsB/
+cp main "${SCRATCH}"/
+cp libfoo.so "${SCRATCH}/libsA/"
+cp libbar.so "${SCRATCH}/libsB/"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/main)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/main")
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
-../src/patchelf --force-rpath --set-rpath $oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB ${SCRATCH}/main
+../src/patchelf --force-rpath --set-rpath "$oldRPath:$(pwd)/${SCRATCH}/libsA:$(pwd)/${SCRATCH}/libsB" "${SCRATCH}/main"
 
 if test "$(uname)" = FreeBSD; then
-    export LD_LIBRARY_PATH=$(pwd)/${SCRATCH}/libsB
+    LD_LIBRARY_PATH="$(pwd)/${SCRATCH}/libsB"
+    export LD_LIBRARY_PATH
 fi
 
 exitCode=0
-(cd ${SCRATCH} && ./main) || exitCode=$?
+(cd "${SCRATCH}" && ./main) || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/shrink-rpath-with-allowed-prefixes.sh b/tests/shrink-rpath-with-allowed-prefixes.sh
index db24da2..aca8d06 100755
--- a/tests/shrink-rpath-with-allowed-prefixes.sh
+++ b/tests/shrink-rpath-with-allowed-prefixes.sh
@@ -1,47 +1,47 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-mkdir -p ${SCRATCH}/libsA
-mkdir -p ${SCRATCH}/libsB
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+mkdir -p "${SCRATCH}/libsA"
+mkdir -p "${SCRATCH}/libsB"
 
-cp main ${SCRATCH}/
-cp libfoo.so libbar.so ${SCRATCH}/libsA/
-cp libfoo.so libbar.so ${SCRATCH}/libsB/
+cp main "${SCRATCH}"/
+cp libfoo.so libbar.so "${SCRATCH}/libsA/"
+cp libfoo.so libbar.so "${SCRATCH}/libsB/"
 
-oldRPath=$(../src/patchelf --print-rpath ${SCRATCH}/main)
+oldRPath=$(../src/patchelf --print-rpath "${SCRATCH}/main")
 if test -z "$oldRPath"; then oldRPath="/oops"; fi
 pathA="$(pwd)/${SCRATCH}/libsA"
 pathB="$(pwd)/${SCRATCH}/libsB"
-../src/patchelf --force-rpath --set-rpath $oldRPath:$pathA:$pathB ${SCRATCH}/main
+../src/patchelf --force-rpath --set-rpath "$oldRPath:$pathA:$pathB" "${SCRATCH}/main"
 
-cp ${SCRATCH}/main ${SCRATCH}/mainA
-cp ${SCRATCH}/main ${SCRATCH}/mainB
+cp "${SCRATCH}"/main "${SCRATCH}/mainA"
+cp "${SCRATCH}"/main "${SCRATCH}/mainB"
 
-../src/patchelf --shrink-rpath ${SCRATCH}/main
-../src/patchelf --shrink-rpath --allowed-rpath-prefixes $oldRPath:$pathA ${SCRATCH}/mainA
-../src/patchelf --shrink-rpath --allowed-rpath-prefixes $oldRPath:$pathB ${SCRATCH}/mainB
+../src/patchelf --shrink-rpath "${SCRATCH}/main"
+../src/patchelf --shrink-rpath --allowed-rpath-prefixes "$oldRPath:$pathA" "${SCRATCH}/mainA"
+../src/patchelf --shrink-rpath --allowed-rpath-prefixes "$oldRPath:$pathB" "${SCRATCH}/mainB"
 
 check() {
     exe=$1
     mustContain=$2
     mustNotContain=$3
 
-    rpath=$(../src/patchelf --print-rpath $exe)
+    rpath=$(../src/patchelf --print-rpath "$exe")
     echo "RPATH of $exe after: $rpath"
 
-    if ! echo "$rpath" | grep -q $mustContain; then
+    if ! echo "$rpath" | grep -q "$mustContain"; then
         echo "RPATH didn't contain '$mustContain' when it should have"
         exit 1
     fi
 
-    if echo "$rpath" | grep -q $mustNotContain; then
+    if echo "$rpath" | grep -q "$mustNotContain"; then
         echo "RPATH contained '$mustNotContain' when it shouldn't have"
         exit 1
     fi
 }
 
-check ${SCRATCH}/main  $pathA $pathB
-check ${SCRATCH}/mainA $pathA $pathB
-check ${SCRATCH}/mainB $pathB $pathA
+check "${SCRATCH}/main"  "$pathA" "$pathB"
+check "${SCRATCH}/mainA" "$pathA" "$pathB"
+check "${SCRATCH}/mainB" "$pathB" "$pathA"
diff --git a/tests/shrink-rpath.sh b/tests/shrink-rpath.sh
index 3adc846..6944a44 100755
--- a/tests/shrink-rpath.sh
+++ b/tests/shrink-rpath.sh
@@ -1,5 +1,5 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
 rpath=$(../src/patchelf --print-rpath ./libbar.so)
 echo "RPATH before: $rpath"
@@ -8,22 +8,22 @@ if ! echo "$rpath" | grep -q /no-such-path; then
     exit 1
 fi
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
-cp libbar.so ${SCRATCH}/
-../src/patchelf --shrink-rpath ${SCRATCH}/libbar.so
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
+cp libbar.so "${SCRATCH}"/
+../src/patchelf --shrink-rpath "${SCRATCH}/libbar.so"
 
-rpath=$(../src/patchelf --print-rpath ${SCRATCH}/libbar.so)
+rpath=$(../src/patchelf --print-rpath "${SCRATCH}/libbar.so")
 echo "RPATH after: $rpath"
 if echo "$rpath" | grep -q /no-such-path; then
     echo "RPATH not shrunk"
     exit 1
 fi
 
-cp libfoo.so ${SCRATCH}/
+cp libfoo.so "${SCRATCH}/"
 
 exitCode=0
-cd ${SCRATCH} && LD_LIBRARY_PATH=. ../../main || exitCode=$?
+cd "${SCRATCH}" && LD_LIBRARY_PATH=. ../../main || exitCode=$?
 
 if test "$exitCode" != 46; then
     echo "bad exit code!"
diff --git a/tests/soname.sh b/tests/soname.sh
index 4a8fb96..683e481 100755
--- a/tests/soname.sh
+++ b/tests/soname.sh
@@ -1,29 +1,29 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp libsimple.so ${SCRATCH}/
+cp libsimple.so "${SCRATCH}/"
 
 # set an initial DT_SONAME entry
-../src/patchelf --set-soname libsimple.so.1.0 ${SCRATCH}/libsimple.so
-newSoname=$(../src/patchelf --print-soname ${SCRATCH}/libsimple.so)
+../src/patchelf --set-soname libsimple.so.1.0 "${SCRATCH}/libsimple.so"
+newSoname=$(../src/patchelf --print-soname "${SCRATCH}/libsimple.so")
 if test "$newSoname" != libsimple.so.1.0; then
     echo "failed --set-soname test. Expected newSoname: libsimple.so.1.0, got: $newSoname"
     exit 1
 fi
 
 # print DT_SONAME
-soname=$(../src/patchelf --print-soname ${SCRATCH}/libsimple.so)
+soname=$(../src/patchelf --print-soname "${SCRATCH}/libsimple.so")
 if test "$soname" != libsimple.so.1.0; then
     echo "failed --print-soname test. Expected soname: libsimple.so.1.0, got: $soname"
     exit 1
 fi
 
 # replace DT_SONAME entry
-../src/patchelf --set-soname libsimple.so.1.1 ${SCRATCH}/libsimple.so
-newSoname=$(../src/patchelf --print-soname ${SCRATCH}/libsimple.so)
+../src/patchelf --set-soname libsimple.so.1.1 "${SCRATCH}/libsimple.so"
+newSoname=$(../src/patchelf --print-soname "${SCRATCH}/libsimple.so")
 if test "$newSoname" != libsimple.so.1.1; then
     echo "failed --set-soname test. Expected newSoname: libsimple.so.1.1, got: $newSoname"
     exit 1
diff --git a/tests/too-many-strtab.sh b/tests/too-many-strtab.sh
index 3ef158f..96006a4 100755
--- a/tests/too-many-strtab.sh
+++ b/tests/too-many-strtab.sh
@@ -1,19 +1,19 @@
 #! /bin/sh -e
-SCRATCH=scratch/$(basename $0 .sh)
+SCRATCH=scratch/$(basename "$0" .sh)
 
-rm -rf ${SCRATCH}
-mkdir -p ${SCRATCH}
+rm -rf "${SCRATCH}"
+mkdir -p "${SCRATCH}"
 
-cp libtoomanystrtab.so ${SCRATCH}/
+cp libtoomanystrtab.so "${SCRATCH}"/
 
 # Set a RUNPATH on the library
-../src/patchelf --set-rpath '$ORIGIN' ${SCRATCH}/libtoomanystrtab.so
+../src/patchelf --set-rpath "\$ORIGIN" "${SCRATCH}/libtoomanystrtab.so"
 
 # Check that patchelf is able to patch it again without crashing. Previously,
 # it will wrongly identify the lib as a static object because there was no
 # .dynamic section
 exitCode=0
-(../src/patchelf --set-rpath '$ORIGIN' ${SCRATCH}/libtoomanystrtab.so) || exitCode=$?
+(../src/patchelf --set-rpath "\$ORIGIN" "${SCRATCH}/libtoomanystrtab.so") || exitCode=$?
 if test "$exitCode" != 0; then
     echo "bad exit code!"
     exit 1