diff --git a/hack/dind b/hack/dind
index dfd463731e..9289ba6556 100755
--- a/hack/dind
+++ b/hack/dind
@@ -60,7 +60,7 @@ for HIER in $(cut -d: -f2 /proc/1/cgroup); do
 
 	mkdir -p "$CGROUP/$HIER"
 
-	if ! mountpoint -q $CGROUP/$HIER; then
+	if ! mountpoint -q "$CGROUP/$HIER"; then
 		mount -n -t cgroup -o "$OHIER" cgroup "$CGROUP/$HIER"
 	fi
 
diff --git a/hack/make.sh b/hack/make.sh
index 3bcb265b3c..eeb26cbce0 100755
--- a/hack/make.sh
+++ b/hack/make.sh
@@ -24,10 +24,12 @@ set -e
 set -o pipefail
 
 export DOCKER_PKG='github.com/docker/docker'
+export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+export MAKEDIR="$SCRIPTDIR/make"
 
 # We're a nice, sexy, little shell script, and people might try to run us;
 # but really, they shouldn't. We want to be in a container!
-if [ "$(pwd)" != "/go/src/$DOCKER_PKG" ] || [ -z "$DOCKER_CROSSPLATFORMS" ]; then
+if [ "$PWD" != "/go/src/$DOCKER_PKG" ] || [ -z "$DOCKER_CROSSPLATFORMS" ]; then
 	{
 		echo "# WARNING! I don't seem to be running in the Docker container."
 		echo "# The result of this command might be an incorrect build, and will not be"
@@ -62,7 +64,7 @@ DEFAULT_BUNDLES=(
 	ubuntu
 )
 
-VERSION=$(cat ./VERSION)
+VERSION=$(< ./VERSION)
 if command -v git &> /dev/null && git rev-parse &> /dev/null; then
 	GITCOMMIT=$(git rev-parse --short HEAD)
 	if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
@@ -82,7 +84,7 @@ if [ "$AUTO_GOPATH" ]; then
 	rm -rf .gopath
 	mkdir -p .gopath/src/"$(dirname "${DOCKER_PKG}")"
 	ln -sf ../../../.. .gopath/src/"${DOCKER_PKG}"
-	export GOPATH="$(pwd)/.gopath:$(pwd)/vendor"
+	export GOPATH="${PWD}/.gopath:${PWD}/vendor"
 fi
 
 if [ ! "$GOPATH" ]; then
@@ -110,7 +112,7 @@ fi
 # Use these flags when compiling the tests and final binary
 
 IAMSTATIC='true'
-source "$(dirname "$BASH_SOURCE")/make/.go-autogen"
+source "$SCRIPTDIR/make/.go-autogen"
 LDFLAGS='-w'
 
 LDFLAGS_STATIC='-linkmode external'
@@ -251,7 +253,7 @@ bundle() {
 	bundlescript=$1
 	bundle=$(basename $bundlescript)
 	echo "---> Making bundle: $bundle (in bundles/$VERSION/$bundle)"
-	mkdir -p bundles/$VERSION/$bundle
+	mkdir -p "bundles/$VERSION/$bundle"
 	source "$bundlescript" "$(pwd)/bundles/$VERSION/$bundle"
 }
 
@@ -261,23 +263,22 @@ main() {
 	mkdir -p bundles
 	if [ -e "bundles/$VERSION" ]; then
 		echo "bundles/$VERSION already exists. Removing."
-		rm -fr bundles/$VERSION && mkdir bundles/$VERSION || exit 1
+		rm -fr "bundles/$VERSION" && mkdir "bundles/$VERSION" || exit 1
 		echo
 	fi
 
 	if [ "$(go env GOHOSTOS)" != 'windows' ]; then
 		# Windows and symlinks don't get along well
-		ln -sfT $VERSION bundles/latest
+		ln -sfT "$VERSION" bundles/latest
 	fi
 
-	SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 	if [ $# -lt 1 ]; then
 		bundles=(${DEFAULT_BUNDLES[@]})
 	else
 		bundles=($@)
 	fi
 	for bundle in ${bundles[@]}; do
-		bundle $SCRIPTDIR/make/$bundle
+		bundle "$SCRIPTDIR/make/$bundle"
 		echo
 	done
 }
diff --git a/hack/make/.dockerinit b/hack/make/.dockerinit
index fceba7db92..4a62ee1add 100644
--- a/hack/make/.dockerinit
+++ b/hack/make/.dockerinit
@@ -2,7 +2,7 @@
 set -e
 
 IAMSTATIC="true"
-source "$(dirname "$BASH_SOURCE")/.go-autogen"
+source "${MAKEDIR}/.go-autogen"
 
 # dockerinit still needs to be a static binary, even if docker is dynamic
 go build \
@@ -30,4 +30,4 @@ else
 fi
 
 # sha1 our new dockerinit to ensure separate docker and dockerinit always run in a perfect pair compiled for one another
-export DOCKER_INITSHA1="$($sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
+export DOCKER_INITSHA1=$($sha1sum "$DEST/dockerinit-$VERSION" | cut -d' ' -f1)
diff --git a/hack/make/.dockerinit-gccgo b/hack/make/.dockerinit-gccgo
index 50854b4011..9890863841 100644
--- a/hack/make/.dockerinit-gccgo
+++ b/hack/make/.dockerinit-gccgo
@@ -2,7 +2,7 @@
 set -e
 
 IAMSTATIC="true"
-source "$(dirname "$BASH_SOURCE")/.go-autogen"
+source "${MAKEDIR}/.go-autogen"
 
 # dockerinit still needs to be a static binary, even if docker is dynamic
 go build --compiler=gccgo \
@@ -28,4 +28,4 @@ else
 fi
 
 # sha1 our new dockerinit to ensure separate docker and dockerinit always run in a perfect pair compiled for one another
-export DOCKER_INITSHA1="$($sha1sum $DEST/dockerinit-$VERSION | cut -d' ' -f1)"
+export DOCKER_INITSHA1=$($sha1sum "$DEST/dockerinit-$VERSION" | cut -d' ' -f1)
diff --git a/hack/make/.integration-daemon-stop b/hack/make/.integration-daemon-stop
index 319aaa4a1d..7e4dc2353a 100644
--- a/hack/make/.integration-daemon-stop
+++ b/hack/make/.integration-daemon-stop
@@ -2,8 +2,8 @@
 
 for pidFile in $(find "$DEST" -name docker.pid); do
 	pid=$(set -x; cat "$pidFile")
-	( set -x; kill $pid )
-	if ! wait $pid; then
+	( set -x; kill "$pid" )
+	if ! wait "$pid"; then
 		echo >&2 "warning: PID $pid from $pidFile had a nonzero exit code"
 	fi
 done
diff --git a/hack/make/binary b/hack/make/binary
index 0f57ea0d69..d3ec2939c0 100644
--- a/hack/make/binary
+++ b/hack/make/binary
@@ -11,7 +11,7 @@ if [[ "$(uname -s)" == CYGWIN* ]]; then
 	DEST=$(cygpath -mw $DEST)
 fi
 
-source "$(dirname "$BASH_SOURCE")/.go-autogen"
+source "${MAKEDIR}/.go-autogen"
 
 go build \
 	-o "$DEST/$BINARY_FULLNAME" \
diff --git a/hack/make/build-deb b/hack/make/build-deb
index 657aa04ccb..90c4c16939 100644
--- a/hack/make/build-deb
+++ b/hack/make/build-deb
@@ -5,7 +5,7 @@ DEST=$1
 
 # subshell so that we can export PATH without breaking other things
 (
-	source "$(dirname "$BASH_SOURCE")/.integration-daemon-start"
+	source "${MAKEDIR}/.integration-daemon-start"
 
 	# we need to wrap up everything in between integration-daemon-start and
 	# integration-daemon-stop to make sure we kill the daemon and don't hang,
@@ -76,7 +76,7 @@ DEST=$1
 	# clean up after ourselves
 	rm -f Dockerfile.build
 
-	source "$(dirname "$BASH_SOURCE")/.integration-daemon-stop"
+	source "${MAKEDIR}/.integration-daemon-stop"
 
 	[ -z "$didFail" ] # "set -e" ftw
 ) 2>&1 | tee -a $DEST/test.log
diff --git a/hack/make/cross b/hack/make/cross
index 3c5cb0401d..368ebc5ab9 100644
--- a/hack/make/cross
+++ b/hack/make/cross
@@ -28,6 +28,6 @@ for platform in $DOCKER_CROSSPLATFORMS; do
 			export LDFLAGS_STATIC_DOCKER="" # we just need a simple client for these platforms
 			export BUILDFLAGS=( "${ORIG_BUILDFLAGS[@]/ daemon/}" ) # remove the "daemon" build tag from platforms that aren't supported
 		fi
-		source "$(dirname "$BASH_SOURCE")/binary" "$DEST/$platform"
+		source "${MAKEDIR}/binary" "$DEST/$platform"
 	)
 done
diff --git a/hack/make/dynbinary b/hack/make/dynbinary
index f9b43b0e77..e1b65b48ef 100644
--- a/hack/make/dynbinary
+++ b/hack/make/dynbinary
@@ -4,7 +4,7 @@ set -e
 DEST=$1
 
 if [ -z "$DOCKER_CLIENTONLY" ]; then
-	source "$(dirname "$BASH_SOURCE")/.dockerinit"
+	source "${MAKEDIR}/.dockerinit"
 
 	hash_files "$DEST/dockerinit-$VERSION"
 else
@@ -18,5 +18,5 @@ fi
 	export LDFLAGS_STATIC_DOCKER=''
 	export BUILDFLAGS=( "${BUILDFLAGS[@]/netgo /}" ) # disable netgo, since we don't need it for a dynamic binary
 	export BUILDFLAGS=( "${BUILDFLAGS[@]/static_build /}" ) # we're not building a "static" binary here
-	source "$(dirname "$BASH_SOURCE")/binary"
+	source "${MAKEDIR}/binary"
 )
diff --git a/hack/make/dyngccgo b/hack/make/dyngccgo
index 738e1450ac..7bdd404f10 100644
--- a/hack/make/dyngccgo
+++ b/hack/make/dyngccgo
@@ -4,7 +4,7 @@ set -e
 DEST=$1
 
 if [ -z "$DOCKER_CLIENTONLY" ]; then
-	source "$(dirname "$BASH_SOURCE")/.dockerinit-gccgo"
+	source "${MAKEDIR}/.dockerinit-gccgo"
 
 	hash_files "$DEST/dockerinit-$VERSION"
 else
@@ -19,5 +19,5 @@ fi
 	export LDFLAGS_STATIC_DOCKER=''
 	export BUILDFLAGS=( "${BUILDFLAGS[@]/netgo /}" ) # disable netgo, since we don't need it for a dynamic binary
 	export BUILDFLAGS=( "${BUILDFLAGS[@]/static_build /}" ) # we're not building a "static" binary here
-	source "$(dirname "$BASH_SOURCE")/gccgo"
+	source "${MAKEDIR}/gccgo"
 )
diff --git a/hack/make/gccgo b/hack/make/gccgo
index c3e9a228b8..896c2d46c1 100644
--- a/hack/make/gccgo
+++ b/hack/make/gccgo
@@ -6,7 +6,7 @@ BINARY_NAME="docker-$VERSION"
 BINARY_EXTENSION="$(binary_extension)"
 BINARY_FULLNAME="$BINARY_NAME$BINARY_EXTENSION"
 
-source "$(dirname "$BASH_SOURCE")/.go-autogen"
+source "${MAKEDIR}/.go-autogen"
 
 if [[ "${BUILDFLAGS[@]}" =~ 'netgo ' ]]; then
 	EXTLDFLAGS_STATIC_DOCKER+=' -lnetgo'
diff --git a/hack/make/test-docker-py b/hack/make/test-docker-py
index b95cf40af5..409cee0e4e 100644
--- a/hack/make/test-docker-py
+++ b/hack/make/test-docker-py
@@ -5,7 +5,7 @@ DEST=$1
 
 # subshell so that we can export PATH without breaking other things
 (
-	source "$(dirname "$BASH_SOURCE")/.integration-daemon-start"
+	source "${MAKEDIR}/.integration-daemon-start"
 
 	# we need to wrap up everything in between integration-daemon-start and
 	# integration-daemon-stop to make sure we kill the daemon and don't hang,
@@ -24,7 +24,7 @@ DEST=$1
 		didFail=1
 	fi
 
-	source "$(dirname "$BASH_SOURCE")/.integration-daemon-stop"
+	source "${MAKEDIR}/.integration-daemon-stop"
 
 	[ -z "$didFail" ] # "set -e" ftw
 ) 2>&1 | tee -a $DEST/test.log
diff --git a/hack/make/test-integration b/hack/make/test-integration
index 5cb7102bc8..206e37abf0 100644
--- a/hack/make/test-integration
+++ b/hack/make/test-integration
@@ -5,7 +5,7 @@ DEST=$1
 
 INIT=$DEST/../dynbinary/dockerinit-$VERSION
 [ -x "$INIT" ] || {
-	source "$(dirname "$BASH_SOURCE")/.dockerinit"
+	source "${MAKEDIR}/.dockerinit"
 	INIT="$DEST/dockerinit"
 }
 export TEST_DOCKERINIT_PATH="$INIT"
@@ -22,4 +22,4 @@ bundle_test_integration() {
 # spews when it is given packages that aren't used
 bundle_test_integration 2>&1 \
 	| grep --line-buffered -v '^warning: no packages being tested depend on ' \
-	| tee -a $DEST/test.log
+	| tee -a "$DEST/test.log"
diff --git a/hack/make/test-integration-cli b/hack/make/test-integration-cli
index 3ef41d919e..8e9b975704 100644
--- a/hack/make/test-integration-cli
+++ b/hack/make/test-integration-cli
@@ -9,23 +9,23 @@ bundle_test_integration_cli() {
 
 # subshell so that we can export PATH without breaking other things
 (
-	source "$(dirname "$BASH_SOURCE")/.integration-daemon-start"
+	source "${MAKEDIR}/.integration-daemon-start"
 
 	# we need to wrap up everything in between integration-daemon-start and
 	# integration-daemon-stop to make sure we kill the daemon and don't hang,
 	# even and especially on test failures
 	didFail=
 	if ! {
-		source "$(dirname "$BASH_SOURCE")/.ensure-frozen-images"
-		source "$(dirname "$BASH_SOURCE")/.ensure-httpserver"
-		source "$(dirname "$BASH_SOURCE")/.ensure-emptyfs"
+		source "${MAKEDIR}/.ensure-frozen-images"
+		source "${MAKEDIR}/.ensure-httpserver"
+		source "${MAKEDIR}/.ensure-emptyfs"
 
 		bundle_test_integration_cli
 	}; then
 		didFail=1
 	fi
 
-	source "$(dirname "$BASH_SOURCE")/.integration-daemon-stop"
+	source "${MAKEDIR}/.integration-daemon-stop"
 
 	[ -z "$didFail" ] # "set -e" ftw
-) 2>&1 | tee -a $DEST/test.log
+) 2>&1 | tee -a "$DEST/test.log"
diff --git a/hack/make/test-unit b/hack/make/test-unit
index 7a26428201..7b6ce089e2 100644
--- a/hack/make/test-unit
+++ b/hack/make/test-unit
@@ -39,12 +39,12 @@ bundle_test_unit() {
 				mkdir -p "$HOME/.parallel"
 				touch "$HOME/.parallel/ignored_vars"
 
-				echo "$TESTDIRS" | parallel --jobs "$PARALLEL_JOBS" --env _ "$(dirname "$BASH_SOURCE")/.go-compile-test-dir"
+				echo "$TESTDIRS" | parallel --jobs "$PARALLEL_JOBS" --env _ "${MAKEDIR}/.go-compile-test-dir"
 				rm -rf "$HOME"
 			else
 				# aww, no "parallel" available - fall back to boring
 				for test_dir in $TESTDIRS; do
-					"$(dirname "$BASH_SOURCE")/.go-compile-test-dir" "$test_dir" || true
+					"${MAKEDIR}/.go-compile-test-dir" "$test_dir" || true
 					# don't let one directory that fails to build tank _all_ our tests!
 				done
 			fi
@@ -85,4 +85,4 @@ go_run_test_dir() {
 	fi
 }
 
-bundle_test_unit 2>&1 | tee -a $DEST/test.log
+bundle_test_unit 2>&1 | tee -a "$DEST/test.log"
diff --git a/hack/make/ubuntu b/hack/make/ubuntu
index 5bbca8a89e..7543789a18 100644
--- a/hack/make/ubuntu
+++ b/hack/make/ubuntu
@@ -40,26 +40,26 @@ bundle_ubuntu() {
 	DIR=$DEST/build
 
 	# Include our udev rules
-	mkdir -p $DIR/etc/udev/rules.d
-	cp contrib/udev/80-docker.rules $DIR/etc/udev/rules.d/
+	mkdir -p "$DIR/etc/udev/rules.d"
+	cp contrib/udev/80-docker.rules "$DIR/etc/udev/rules.d/"
 
 	# Include our init scripts
-	mkdir -p $DIR/etc/init
-	cp contrib/init/upstart/docker.conf $DIR/etc/init/
-	mkdir -p $DIR/etc/init.d
-	cp contrib/init/sysvinit-debian/docker $DIR/etc/init.d/
-	mkdir -p $DIR/etc/default
-	cp contrib/init/sysvinit-debian/docker.default $DIR/etc/default/docker
-	mkdir -p $DIR/lib/systemd/system
-	cp contrib/init/systemd/docker.{service,socket} $DIR/lib/systemd/system/
+	mkdir -p "$DIR/etc/init"
+	cp contrib/init/upstart/docker.conf "$DIR/etc/init/"
+	mkdir -p "$DIR/etc/init.d"
+	cp contrib/init/sysvinit-debian/docker "$DIR/etc/init.d/"
+	mkdir -p "$DIR/etc/default"
+	cp contrib/init/sysvinit-debian/docker.default "$DIR/etc/default/docker"
+	mkdir -p "$DIR/lib/systemd/system"
+	cp contrib/init/systemd/docker.{service,socket} "$DIR/lib/systemd/system/"
 
 	# Include contributed completions
-	mkdir -p $DIR/etc/bash_completion.d
-	cp contrib/completion/bash/docker $DIR/etc/bash_completion.d/
-	mkdir -p $DIR/usr/share/zsh/vendor-completions
-	cp contrib/completion/zsh/_docker $DIR/usr/share/zsh/vendor-completions/
-	mkdir -p $DIR/etc/fish/completions
-	cp contrib/completion/fish/docker.fish $DIR/etc/fish/completions/
+	mkdir -p "$DIR/etc/bash_completion.d"
+	cp contrib/completion/bash/docker "$DIR/etc/bash_completion.d/"
+	mkdir -p "$DIR/usr/share/zsh/vendor-completions"
+	cp contrib/completion/zsh/_docker "$DIR/usr/share/zsh/vendor-completions/"
+	mkdir -p "$DIR/etc/fish/completions"
+	cp contrib/completion/fish/docker.fish "$DIR/etc/fish/completions/"
 
 	# Include contributed man pages
 	docs/man/md2man-all.sh -q
@@ -76,11 +76,11 @@ bundle_ubuntu() {
 
 	# Copy the binary
 	# This will fail if the binary bundle hasn't been built
-	mkdir -p $DIR/usr/bin
-	cp $DEST/../binary/docker-$VERSION $DIR/usr/bin/docker
+	mkdir -p "$DIR/usr/bin"
+	cp "$DEST/../binary/docker-$VERSION" "$DIR/usr/bin/docker"
 
 	# Generate postinst/prerm/postrm scripts
-	cat > $DEST/postinst <<'EOF'
+	cat > "$DEST/postinst" <<'EOF'
 #!/bin/sh
 set -e
 set -u
@@ -104,7 +104,7 @@ service docker $_dh_action 2>/dev/null || true
 
 #DEBHELPER#
 EOF
-	cat > $DEST/prerm <<'EOF'
+	cat > "$DEST/prerm" <<'EOF'
 #!/bin/sh
 set -e
 set -u
@@ -113,7 +113,7 @@ service docker stop 2>/dev/null || true
 
 #DEBHELPER#
 EOF
-	cat > $DEST/postrm <<'EOF'
+	cat > "$DEST/postrm" <<'EOF'
 #!/bin/sh
 set -e
 set -u
@@ -131,18 +131,18 @@ fi
 #DEBHELPER#
 EOF
 	# TODO swaths of these were borrowed from debhelper's auto-inserted stuff, because we're still using fpm - we need to use debhelper instead, and somehow reconcile Ubuntu that way
-	chmod +x $DEST/postinst $DEST/prerm $DEST/postrm
+	chmod +x "$DEST/postinst" "$DEST/prerm" "$DEST/postrm"
 
 	(
 		# switch directories so we create *.deb in the right folder
-		cd $DEST
+		cd "$DEST"
 
 		# create lxc-docker-VERSION package
-		fpm -s dir -C $DIR \
-			--name lxc-docker-$VERSION --version "$PKGVERSION" \
-			--after-install $DEST/postinst \
-			--before-remove $DEST/prerm \
-			--after-remove $DEST/postrm \
+		fpm -s dir -C "$DIR" \
+			--name "lxc-docker-$VERSION" --version "$PKGVERSION" \
+			--after-install "$DEST/postinst" \
+			--before-remove "$DEST/prerm" \
+			--after-remove "$DEST/postrm" \
 			--architecture "$PACKAGE_ARCHITECTURE" \
 			--prefix / \
 			--depends iptables \
@@ -184,8 +184,8 @@ EOF
 	)
 
 	# clean up after ourselves so we have a clean output directory
-	rm $DEST/postinst $DEST/prerm $DEST/postrm
-	rm -r $DIR
+	rm "$DEST/postinst" "$DEST/prerm" "$DEST/postrm"
+	rm -r "$DIR"
 }
 
 bundle_ubuntu
diff --git a/hack/make/validate-dco b/hack/make/validate-dco
index 84c47f526d..5ac98728f3 100644
--- a/hack/make/validate-dco
+++ b/hack/make/validate-dco
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-source "$(dirname "$BASH_SOURCE")/.validate"
+source "${MAKEDIR}/.validate"
 
 adds=$(validate_diff --numstat | awk '{ s += $1 } END { print s }')
 dels=$(validate_diff --numstat | awk '{ s += $2 } END { print s }')
diff --git a/hack/make/validate-gofmt b/hack/make/validate-gofmt
index 8fc88cc559..7ad9e85576 100644
--- a/hack/make/validate-gofmt
+++ b/hack/make/validate-gofmt
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-source "$(dirname "$BASH_SOURCE")/.validate"
+source "${MAKEDIR}/.validate"
 
 IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^vendor/' || true) )
diff --git a/hack/make/validate-toml b/hack/make/validate-toml
index 16c228d14e..18f26ee757 100644
--- a/hack/make/validate-toml
+++ b/hack/make/validate-toml
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-source "$(dirname "$BASH_SOURCE")/.validate"
+source "${MAKEDIR}/.validate"
 
 IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- 'MAINTAINERS' || true) )
diff --git a/hack/make/validate-vet b/hack/make/validate-vet
index e88f7549c3..febe93e5c1 100644
--- a/hack/make/validate-vet
+++ b/hack/make/validate-vet
@@ -1,6 +1,6 @@
 #!/bin/bash
 
-source "$(dirname "$BASH_SOURCE")/.validate"
+source "${MAKEDIR}/.validate"
 
 IFS=$'\n'
 files=( $(validate_diff --diff-filter=ACMR --name-only -- '*.go' | grep -v '^vendor/' || true) )
diff --git a/hack/release.sh b/hack/release.sh
index da95808c5a..04772546fd 100755
--- a/hack/release.sh
+++ b/hack/release.sh
@@ -60,7 +60,7 @@ if [ "$1" != '--release-regardless-of-test-failure' ]; then
 	)
 fi
 
-VERSION=$(cat VERSION)
+VERSION=$(< VERSION)
 BUCKET=$AWS_S3_BUCKET
 
 # These are the 2 keys we've used to sign the deb's
@@ -71,23 +71,23 @@ BUCKET=$AWS_S3_BUCKET
 
 setup_s3() {
 	# Try creating the bucket. Ignore errors (it might already exist).
-	s3cmd mb s3://$BUCKET 2>/dev/null || true
+	s3cmd mb "s3://$BUCKET" 2>/dev/null || true
 	# Check access to the bucket.
 	# s3cmd has no useful exit status, so we cannot check that.
 	# Instead, we check if it outputs anything on standard output.
 	# (When there are problems, it uses standard error instead.)
-	s3cmd info s3://$BUCKET | grep -q .
+	s3cmd info "s3://$BUCKET" | grep -q .
 	# Make the bucket accessible through website endpoints.
-	s3cmd ws-create --ws-index index --ws-error error s3://$BUCKET
+	s3cmd ws-create --ws-index index --ws-error error "s3://$BUCKET"
 }
 
 # write_to_s3 uploads the contents of standard input to the specified S3 url.
 write_to_s3() {
 	DEST=$1
 	F=`mktemp`
-	cat > $F
-	s3cmd --acl-public --mime-type='text/plain' put $F $DEST
-	rm -f $F
+	cat > "$F"
+	s3cmd --acl-public --mime-type='text/plain' put "$F" "$DEST"
+	rm -f "$F"
 }
 
 s3_url() {
@@ -246,20 +246,20 @@ release_build() {
 # 1. A full APT repository is published at $BUCKET/ubuntu/
 # 2. Instructions for using the APT repository are uploaded at $BUCKET/ubuntu/index
 release_ubuntu() {
-	[ -e bundles/$VERSION/ubuntu ] || {
+	[ -e "bundles/$VERSION/ubuntu" ] || {
 		echo >&2 './hack/make.sh must be run before release_ubuntu'
 		exit 1
 	}
 
 	# Sign our packages
 	dpkg-sig -g "--passphrase $GPG_PASSPHRASE" -k releasedocker \
-		--sign builder bundles/$VERSION/ubuntu/*.deb
+		--sign builder "bundles/$VERSION/ubuntu/"*.deb
 
 	# Setup the APT repo
 	APTDIR=bundles/$VERSION/ubuntu/apt
-	mkdir -p $APTDIR/conf $APTDIR/db
-	s3cmd sync s3://$BUCKET/ubuntu/db/ $APTDIR/db/ || true
-	cat > $APTDIR/conf/distributions <<EOF
+	mkdir -p "$APTDIR/conf" "$APTDIR/db"
+	s3cmd sync "s3://$BUCKET/ubuntu/db/" "$APTDIR/db/" || true
+	cat > "$APTDIR/conf/distributions" <<EOF
 Codename: docker
 Components: main
 Architectures: amd64 i386
@@ -267,19 +267,19 @@ EOF
 
 	# Add the DEB package to the APT repo
 	DEBFILE=bundles/$VERSION/ubuntu/lxc-docker*.deb
-	reprepro -b $APTDIR includedeb docker $DEBFILE
+	reprepro -b "$APTDIR" includedeb docker "$DEBFILE"
 
 	# Sign
 	for F in $(find $APTDIR -name Release); do
-		gpg -u releasedocker --passphrase $GPG_PASSPHRASE \
+		gpg -u releasedocker --passphrase "$GPG_PASSPHRASE" \
 			--armor --sign --detach-sign \
-			--output $F.gpg $F
+			--output "$F.gpg" "$F"
 	done
 
 	# Upload keys
-	s3cmd sync $HOME/.gnupg/ s3://$BUCKET/ubuntu/.gnupg/
-	gpg --armor --export releasedocker > bundles/$VERSION/ubuntu/gpg
-	s3cmd --acl-public put bundles/$VERSION/ubuntu/gpg s3://$BUCKET/gpg
+	s3cmd sync "$HOME/.gnupg/" "s3://$BUCKET/ubuntu/.gnupg/"
+	gpg --armor --export releasedocker > "bundles/$VERSION/ubuntu/gpg"
+	s3cmd --acl-public put "bundles/$VERSION/ubuntu/gpg" "s3://$BUCKET/gpg"
 
 	local gpgFingerprint=36A1D7869245C8950F966E92D8576A8BA88D21E9
 	if [[ $BUCKET == test* ]]; then
@@ -287,7 +287,7 @@ EOF
 	fi
 
 	# Upload repo
-	s3cmd --acl-public sync $APTDIR/ s3://$BUCKET/ubuntu/
+	s3cmd --acl-public sync "$APTDIR/" "s3://$BUCKET/ubuntu/"
 	cat <<EOF | write_to_s3 s3://$BUCKET/ubuntu/index
 # Check that HTTPS transport is available to APT
 if [ ! -e /usr/lib/apt/methods/https ]; then
@@ -312,14 +312,14 @@ EOF
 
 	# Add redirect at /ubuntu/info for URL-backwards-compatibility
 	rm -rf /tmp/emptyfile && touch /tmp/emptyfile
-	s3cmd --acl-public --add-header='x-amz-website-redirect-location:/ubuntu/' --mime-type='text/plain' put /tmp/emptyfile s3://$BUCKET/ubuntu/info
+	s3cmd --acl-public --add-header='x-amz-website-redirect-location:/ubuntu/' --mime-type='text/plain' put /tmp/emptyfile "s3://$BUCKET/ubuntu/info"
 
 	echo "APT repository uploaded. Instructions available at $(s3_url)/ubuntu"
 }
 
 # Upload binaries and tgz files to S3
 release_binaries() {
-	[ -e bundles/$VERSION/cross/linux/amd64/docker-$VERSION ] || {
+	[ -e "bundles/$VERSION/cross/linux/amd64/docker-$VERSION" ] || {
 		echo >&2 './hack/make.sh must be run before release_binaries'
 		exit 1
 	}
@@ -341,29 +341,29 @@ EOF
 
 	# Add redirect at /builds/info for URL-backwards-compatibility
 	rm -rf /tmp/emptyfile && touch /tmp/emptyfile
-	s3cmd --acl-public --add-header='x-amz-website-redirect-location:/builds/' --mime-type='text/plain' put /tmp/emptyfile s3://$BUCKET/builds/info
+	s3cmd --acl-public --add-header='x-amz-website-redirect-location:/builds/' --mime-type='text/plain' put /tmp/emptyfile "s3://$BUCKET/builds/info"
 
 	if [ -z "$NOLATEST" ]; then
 		echo "Advertising $VERSION on $BUCKET as most recent version"
-		echo $VERSION | write_to_s3 s3://$BUCKET/latest
+		echo "$VERSION" | write_to_s3 "s3://$BUCKET/latest"
 	fi
 }
 
 # Upload the index script
 release_index() {
-	sed "s,url='https://get.docker.com/',url='$(s3_url)/'," hack/install.sh | write_to_s3 s3://$BUCKET/index
+	sed "s,url='https://get.docker.com/',url='$(s3_url)/'," hack/install.sh | write_to_s3 "s3://$BUCKET/index"
 }
 
 release_test() {
 	if [ -e "bundles/$VERSION/test" ]; then
-		s3cmd --acl-public sync bundles/$VERSION/test/ s3://$BUCKET/test/
+		s3cmd --acl-public sync "bundles/$VERSION/test/" "s3://$BUCKET/test/"
 	fi
 }
 
 setup_gpg() {
 	# Make sure that we have our keys
-	mkdir -p $HOME/.gnupg/
-	s3cmd sync s3://$BUCKET/ubuntu/.gnupg/ $HOME/.gnupg/ || true
+	mkdir -p "$HOME/.gnupg/"
+	s3cmd sync "s3://$BUCKET/ubuntu/.gnupg/" "$HOME/.gnupg/" || true
 	gpg --list-keys releasedocker >/dev/null || {
 		gpg --gen-key --batch <<EOF
 Key-Type: RSA