diff --git a/lib/functions/cli/utils-cli.sh b/lib/functions/cli/utils-cli.sh
index 87d9ff8457..9db2f425a5 100644
--- a/lib/functions/cli/utils-cli.sh
+++ b/lib/functions/cli/utils-cli.sh
@@ -154,9 +154,9 @@ function parse_each_cmdline_arg_as_command_param_or_config() {
 		exit_with_error "You cannot have a configuration file named '${config_file}'. '${argument}' is a command name and is reserved for internal Armbian usage. Sorry. Please rename your config file and pass its name it an argument, and I'll use it. PS: You don't need a config file for 'docker' anymore, Docker is all managed by Armbian now."
 	elif [[ "${is_config}" == "yes" ]]; then # we have a config only
 		display_alert "Adding config file to list" "${config_file}" "debug"
-		ARMBIAN_CONFIG_FILES+=("${config_file}")    # full path to be sourced
-		ARMBIAN_CLI_RELAUNCH_CONFIGS+="${argument}" # name reference to be relaunched
-	elif [[ "${is_command}" == "yes" ]]; then    # we have a command, only.
+		ARMBIAN_CONFIG_FILES+=("${config_file}")      # full path to be sourced
+		ARMBIAN_CLI_RELAUNCH_CONFIGS+=("${argument}") # name reference to be relaunched
+	elif [[ "${is_command}" == "yes" ]]; then      # we have a command, only.
 		# sanity check. we can't have more than one command. decide!
 		if [[ -n "${ARMBIAN_COMMAND}" ]]; then
 			exit_with_error "You cannot specify more than one command. You have '${ARMBIAN_COMMAND}' and '${argument}'. Please decide which one you want to run and pass only that one."
@@ -179,7 +179,7 @@ function produce_relaunch_parameters() {
 		ARMBIAN_CLI_RELAUNCH_ARGS+=("${param}=${ARMBIAN_CLI_RELAUNCH_PARAMS[${param}]}")
 	done
 	# add the running configs
-	for config in ${ARMBIAN_CLI_RELAUNCH_CONFIGS}; do
+	for config in "${ARMBIAN_CLI_RELAUNCH_CONFIGS[@]}"; do
 		ARMBIAN_CLI_RELAUNCH_ARGS+=("${config}")
 	done
 	# add the command; defaults to the last command, but can be changed by the last pre-run.
diff --git a/lib/functions/compilation/kernel-debs.sh b/lib/functions/compilation/kernel-debs.sh
index eb5a6b2689..91f6fa2296 100644
--- a/lib/functions/compilation/kernel-debs.sh
+++ b/lib/functions/compilation/kernel-debs.sh
@@ -247,13 +247,11 @@ function kernel_package_callback_linux_image() {
 
 			# @TODO: only if u-boot, only for postinst. Gotta find a hook scheme for these...
 			if [[ "${script}" == "postinst" ]]; then
-				if [[ "yes" == "yes" ]]; then
-					cat <<- HOOK_FOR_LINK_TO_LAST_INSTALLED_KERNEL
-						echo "Armbian: update last-installed kernel symlink to '$image_name'..."
-						ln -sfv $(basename "${installed_image_path}") /boot/$image_name || mv -v /${installed_image_path} /boot/${image_name}
-						touch /boot/.next
-					HOOK_FOR_LINK_TO_LAST_INSTALLED_KERNEL
-				fi
+				cat <<- HOOK_FOR_LINK_TO_LAST_INSTALLED_KERNEL
+					echo "Armbian: update last-installed kernel symlink to '$image_name'..."
+					ln -sfv $(basename "${installed_image_path}") /boot/$image_name || mv -v /${installed_image_path} /boot/${image_name}
+					touch /boot/.next
+				HOOK_FOR_LINK_TO_LAST_INSTALLED_KERNEL
 			fi
 		)
 	done
diff --git a/lib/functions/compilation/uboot.sh b/lib/functions/compilation/uboot.sh
index 2e4b3f0335..7cdf0f5e8d 100644
--- a/lib/functions/compilation/uboot.sh
+++ b/lib/functions/compilation/uboot.sh
@@ -369,8 +369,8 @@ function compile_uboot() {
 	# This is set to `uboot_name="${CHOSEN_UBOOT}_${REVISION}_${ARCH}"` in outer scope...
 	display_alert "Building u-boot deb" "(version: ${package_version}) ${uboot_name}.deb"
 	fakeroot_dpkg_deb_build "$uboottempdir/${uboot_name}" "$uboottempdir/${uboot_name}.deb"
-	rm -rf "$uboottempdir/${uboot_name}"
-	[[ -n $atftempdir ]] && rm -rf "${atftempdir}"
+	rm -rf "${uboottempdir:?}/${uboot_name:?}"
+	[[ -n $atftempdir ]] && rm -rf "${atftempdir:?}"
 
 	[[ ! -f $uboottempdir/${uboot_name}.deb ]] && exit_with_error "Building u-boot package failed"
 
diff --git a/lib/functions/general/cleaning.sh b/lib/functions/general/cleaning.sh
index 2b2ae6fc93..0209fb8f4c 100644
--- a/lib/functions/general/cleaning.sh
+++ b/lib/functions/general/cleaning.sh
@@ -49,7 +49,7 @@ function general_cleaning() {
 			;;
 
 		alldebs) # delete output/debs
-			[[ -d "${DEB_STORAGE}" ]] && display_alert "Cleaning" "${DEB_STORAGE}" "info" && rm -rf "${DEB_STORAGE}"/*
+			[[ -d "${DEB_STORAGE}" ]] && display_alert "Cleaning" "${DEB_STORAGE}" "info" && rm -rf "${DEB_STORAGE:?}"/*
 			;;
 
 		cache) # delete output/cache
diff --git a/lib/functions/general/downloads.sh b/lib/functions/general/downloads.sh
index e2a0fc6067..280b68e73a 100644
--- a/lib/functions/general/downloads.sh
+++ b/lib/functions/general/downloads.sh
@@ -189,7 +189,7 @@ function download_and_verify_internal() {
 		fi
 
 		if [[ $verified != true ]]; then
-			rm -rf "${localdir}/${filename}"* # We also delete asc file
+			rm -rf "${localdir:?}/${filename:?}"* # We also delete asc file
 			exit_with_error "verification failed"
 		fi
 
diff --git a/lib/functions/host/external-toolchains.sh b/lib/functions/host/external-toolchains.sh
index e7dfcd21c1..af57a1ee0f 100644
--- a/lib/functions/host/external-toolchains.sh
+++ b/lib/functions/host/external-toolchains.sh
@@ -56,6 +56,7 @@ function download_external_toolchains() {
 			for dir in "${existing_dirs[@]}"; do
 				local found=no
 				for toolchain in "${toolchains[@]}"; do
+					# shellcheck disable=SC2053 # legacy code, won't fix
 					[[ $dir == ${toolchain%.tar.*} ]] && found=yes
 				done
 				if [[ $found == no ]]; then
diff --git a/lib/functions/image/partitioning.sh b/lib/functions/image/partitioning.sh
index 8f50713cd2..4872fa463d 100644
--- a/lib/functions/image/partitioning.sh
+++ b/lib/functions/image/partitioning.sh
@@ -102,7 +102,8 @@ function prepare_partitions() {
 	display_alert "calculated rootpart" "rootpart: ${rootpart}" "debug"
 
 	# stage: calculate rootfs size
-	export rootfs_size=$(du -sm $SDCARD/ | cut -f1) # MiB
+	declare -g -i rootfs_size
+	rootfs_size=$(du -sm "${SDCARD}"/ | cut -f1) # MiB
 	display_alert "Current rootfs size" "$rootfs_size MiB" "info"
 
 	call_extension_method "prepare_image_size" "config_prepare_image_size" <<- 'PREPARE_IMAGE_SIZE'