diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
new file mode 100644
index 00000000..6759afb3
--- /dev/null
+++ b/.github/workflows/shellcheck.yaml
@@ -0,0 +1,17 @@
+name: shellcheck
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/shellcheck.yml'
+      - '**.sh'
+
+jobs:
+  shellcheck:
+    name: shellcheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - run: sudo apt update
+      - run: sudo apt install shellcheck
+      - run: shellcheck --exclude=SC1091 --color=always --enable=all $(find meta-lxatac-bsp meta-lxatac-software -name "*.sh")
diff --git a/meta-lxatac-bsp/recipes-bsp/barebox/files/lxatac/env/init/20_splash.sh b/meta-lxatac-bsp/recipes-bsp/barebox/files/lxatac/env/init/20_splash.sh
index 88d9586c..6cdf21ad 100644
--- a/meta-lxatac-bsp/recipes-bsp/barebox/files/lxatac/env/init/20_splash.sh
+++ b/meta-lxatac-bsp/recipes-bsp/barebox/files/lxatac/env/init/20_splash.sh
@@ -2,4 +2,6 @@
 
 # Turn the LCD on with a splash screen
 splash /env/data/splash.png
+
+# shellcheck disable=SC2276
 fb0.enable=1
diff --git a/meta-lxatac-bsp/recipes-core/lxatac-factory-data/files/lxatac-factory-data.sh b/meta-lxatac-bsp/recipes-core/lxatac-factory-data/files/lxatac-factory-data.sh
index 3604add3..9a5a5a32 100644
--- a/meta-lxatac-bsp/recipes-core/lxatac-factory-data/files/lxatac-factory-data.sh
+++ b/meta-lxatac-bsp/recipes-core/lxatac-factory-data/files/lxatac-factory-data.sh
@@ -15,9 +15,10 @@ mkdir -p "${DST_LINK_FILE_BASE}"
 # (The transient hostname is passed via systemd.hostname= commandline)
 # --------------------------------------------------------------------
 
-if [ ! -e /etc/hostname ]
+if [[ ! -e /etc/hostname ]]
 then
-    hostnamectl --static hostname $(hostnamectl --transient hostname)
+    hostname="$(hostnamectl --transient hostname)"
+    hostnamectl --static hostname "${hostname}"
 fi
 
 # Read Factory Data passed to us by barebox via the devicetree
@@ -29,9 +30,9 @@ SERIAL=$(tr -d '\000' < "${SRC_BASEBOARD_BASE}/serial-number")
 mapfile -t MAC_ADDRESSES < <(
     for ADDR_FILE in "${SRC_BASEBOARD_BASE}/ethernet-address/address-"*
     do
-        tr -d '\000' < "${ADDR_FILE}"
+        tr -d '\000' < "${ADDR_FILE}" || true
         echo
-    done | sort
+    done | sort || true
 )
 
 MAC_BRIDGE=${MAC_ADDRESSES[0]}
diff --git a/meta-lxatac-bsp/recipes-core/lxatac-led-setup/files/lxatac-led-setup.sh b/meta-lxatac-bsp/recipes-core/lxatac-led-setup/files/lxatac-led-setup.sh
index 8b941184..6ab79ec6 100644
--- a/meta-lxatac-bsp/recipes-core/lxatac-led-setup/files/lxatac-led-setup.sh
+++ b/meta-lxatac-bsp/recipes-core/lxatac-led-setup/files/lxatac-led-setup.sh
@@ -17,7 +17,7 @@ USB_HOST2="tac:green:usbh2"
 USB_HOST3="tac:green:usbh3"
 
 # RGB Status LED
-if [ -e "${BASE}/${STATUS}/trigger" ]
+if [[ -e "${BASE}/${STATUS}/trigger" ]]
 then
     # Light up in a nice yellow, as the "okay green" is a bit overused by
     # the other LEDs.
@@ -28,7 +28,7 @@ else
 fi
 
 # CAN Interface activity
-if [ -e "${BASE}/${IOBUS}/trigger" ]
+if [[ -e "${BASE}/${IOBUS}/trigger" ]]
 then
     echo netdev > "${BASE}/${IOBUS}/trigger"
     echo can0_iobus > "${BASE}/${IOBUS}/device_name"
@@ -39,7 +39,7 @@ else
     echo "Not setting up IOBus Trigger"
 fi
 
-if [ -e "${BASE}/${CAN}/trigger" ]
+if [[ -e "${BASE}/${CAN}/trigger" ]]
 then
     echo netdev > "${BASE}/${CAN}/trigger"
     echo can1 > "${BASE}/${CAN}/device_name"
@@ -51,7 +51,7 @@ else
 fi
 
 # DUT UART activity
-if [ -e "${BASE}/${UART_RX}/trigger" ]
+if [[ -e "${BASE}/${UART_RX}/trigger" ]]
 then
     echo tty > "${BASE}/${UART_RX}/trigger"
     echo ttySTM1 > "${BASE}/${UART_RX}/ttyname"
@@ -61,7 +61,7 @@ else
     echo "Not setting up UART RX Trigger"
 fi
 
-if [ -e "${BASE}/${UART_TX}/trigger" ]
+if [[ -e "${BASE}/${UART_TX}/trigger" ]]
 then
     echo tty > "${BASE}/${UART_TX}/trigger"
     echo ttySTM1 > "${BASE}/${UART_TX}/ttyname"
@@ -72,7 +72,7 @@ else
 fi
 
 # USB Host ports
-if [ -e "${BASE}/${USB_HOST1}/trigger" ]
+if [[ -e "${BASE}/${USB_HOST1}/trigger" ]]
 then
     echo usbport > "${BASE}/${USB_HOST1}/trigger"
     echo 1 > "${BASE}/${USB_HOST1}/ports/1-1-port1"
@@ -80,7 +80,7 @@ else
     echo "Not setting up USB Host 1 Trigger"
 fi
 
-if [ -e "${BASE}/${USB_HOST2}/trigger" ]
+if [[ -e "${BASE}/${USB_HOST2}/trigger" ]]
 then
     echo usbport > "${BASE}/${USB_HOST2}/trigger"
     echo 1 > "${BASE}/${USB_HOST2}/ports/1-1-port2"
@@ -88,7 +88,7 @@ else
     echo "Not setting up USB Host 2 Trigger"
 fi
 
-if [ -e "${BASE}/${USB_HOST3}/trigger" ]
+if [[ -e "${BASE}/${USB_HOST3}/trigger" ]]
 then
     echo usbport > "${BASE}/${USB_HOST3}/trigger"
     echo 1 > "${BASE}/${USB_HOST3}/ports/1-1-port3"
diff --git a/meta-lxatac-bsp/recipes-core/rauc/files/rauc-disable-cert.sh b/meta-lxatac-bsp/recipes-core/rauc/files/rauc-disable-cert.sh
index 6155edf3..9772b1f0 100644
--- a/meta-lxatac-bsp/recipes-core/rauc/files/rauc-disable-cert.sh
+++ b/meta-lxatac-bsp/recipes-core/rauc/files/rauc-disable-cert.sh
@@ -4,22 +4,22 @@ set -euo pipefail
 
 ENABLED_DIR="/etc/rauc/certificates-enabled"
 
-if [ "$#" -ne 1 ]; then
+if [[ "$#" -ne 1 ]]; then
     echo "Usage: $0 cert.pem"
     echo "Enabled certificates:"
-    ls --hide "*.0" "$ENABLED_DIR"
+    ls --hide "*.0" "${ENABLED_DIR}"
     exit 1
 fi
 
-if [ ! -L "$ENABLED_DIR/$1" ]; then
+if [[ ! -L "${ENABLED_DIR}/$1" ]]; then
     echo "The certificate to deactivate must be stored in:"
-    echo "$ENABLED_DIR"
+    echo "${ENABLED_DIR}"
     exit 1
 fi
 
-rm "$ENABLED_DIR/$1"
+rm "${ENABLED_DIR}/$1"
 
-openssl rehash "$ENABLED_DIR"
+openssl rehash "${ENABLED_DIR}"
 
 # Ask the tacd to update the list of channels
 curl -X PUT -d "true" "http://localhost/v1/tac/update/channels/reload"
diff --git a/meta-lxatac-bsp/recipes-core/rauc/files/rauc-enable-cert.sh b/meta-lxatac-bsp/recipes-core/rauc/files/rauc-enable-cert.sh
index 9b6bc1fc..53c0f277 100644
--- a/meta-lxatac-bsp/recipes-core/rauc/files/rauc-enable-cert.sh
+++ b/meta-lxatac-bsp/recipes-core/rauc/files/rauc-enable-cert.sh
@@ -5,25 +5,25 @@ set -euo pipefail
 AVAILABLE_DIR="/etc/rauc/certificates-available"
 ENABLED_DIR="/etc/rauc/certificates-enabled"
 
-if [ "$#" -ne 1 ]; then
+if [[ "$#" -ne 1 ]]; then
     echo "Usage: $0 cert.pem"
     echo "Available certificates:"
-    ls "$AVAILABLE_DIR"
+    ls "${AVAILABLE_DIR}"
     exit 1
 fi
 
-if [ ! -f "$AVAILABLE_DIR/$1" ]; then
+if [[ ! -f "${AVAILABLE_DIR}/$1" ]]; then
     echo "The certificate to activate must be stored in:"
-    echo "$AVAILABLE_DIR"
+    echo "${AVAILABLE_DIR}"
     exit 1
 fi
 
-if [ -L "$ENABLED_DIR/$1" ]; then
-    rm "$ENABLED_DIR/$1"
+if [[ -L "${ENABLED_DIR}/$1" ]]; then
+    rm "${ENABLED_DIR}/$1"
 fi
 
-ln -s "../certificates-available/$1" "$ENABLED_DIR/$1"
-openssl rehash "$ENABLED_DIR"
+ln -s "../certificates-available/$1" "${ENABLED_DIR}/$1"
+openssl rehash "${ENABLED_DIR}"
 
 # Ask the tacd to update the list of channels
 curl -X PUT -d "true" "http://localhost/v1/tac/update/channels/reload"
diff --git a/meta-lxatac-software/recipes-core/bundles/files/hook.sh b/meta-lxatac-software/recipes-core/bundles/files/hook.sh
index ccd81511..4f252dc3 100644
--- a/meta-lxatac-software/recipes-core/bundles/files/hook.sh
+++ b/meta-lxatac-software/recipes-core/bundles/files/hook.sh
@@ -3,8 +3,9 @@
 set -exu -o pipefail
 
 EXTRA_MIGRATE_LISTS_DIR="/etc/rauc/migrate.d"
-CERT_AVAILABLE_DIR="${RAUC_SLOT_MOUNT_POINT}/etc/rauc/certificates-available"
-CERT_ENABLED_DIR="${RAUC_SLOT_MOUNT_POINT}/etc/rauc/certificates-enabled"
+CERT_AVAILABLE_DIR="${RAUC_SLOT_MOUNT_POINT:?}/etc/rauc/certificates-available"
+CERT_ENABLED_DIR="${RAUC_SLOT_MOUNT_POINT:?}/etc/rauc/certificates-enabled"
+BUNDLE_SPKI_HASHES="${RAUC_BUNDLE_SPKI_HASHES:?}"
 
 function enable_certificates () {
 	# Ignore the enabled certifcates from the bundle
@@ -23,7 +24,7 @@ function enable_certificates () {
 		# This means that a bundle signed with e.g. an official stable
 		# channel certificate will only be able to install other
 		# bundles from the same release channel.
-		for bundle_hash in ${RAUC_BUNDLE_SPKI_HASHES}; do
+		for bundle_hash in ${BUNDLE_SPKI_HASHES}; do
 			if [[ "${bundle_hash}" == "${cert_hash}" ]]; then
 				echo "Enable certificate ${cert_name}"
 				ln -s \
@@ -46,7 +47,7 @@ function migrate () {
 }
 
 function process_migrate_lists () {
-	if [ ! -d "${EXTRA_MIGRATE_LISTS_DIR}" ]; then
+	if [[ ! -d "${EXTRA_MIGRATE_LISTS_DIR}" ]]; then
 		return
 	fi
 
diff --git a/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile.bb b/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile.bb
index f3ed7878..6a806a52 100644
--- a/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile.bb
+++ b/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile.bb
@@ -6,6 +6,8 @@ SRC_URI = "file://01-labgrid.sh"
 
 S = "${WORKDIR}"
 
+RDEPENDS:${PN} = "bash"
+
 do_install () {
 	install -d ${D}${sysconfdir}/profile.d/
 	install -m 0755 ${S}/01-labgrid.sh ${D}${sysconfdir}/profile.d/
diff --git a/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile/01-labgrid.sh b/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile/01-labgrid.sh
index cada5fd8..f1701d89 100644
--- a/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile/01-labgrid.sh
+++ b/meta-lxatac-software/recipes-core/lxatac-profile/lxatac-profile/01-labgrid.sh
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 # export labgrid environment to be used with labgrid-client on the lxatac
 source /etc/labgrid/environment
-export LG_CROSSBAR=ws://${LABGRID_COORDINATOR_IP}:${LABGRID_COORDINATOR_PORT}/ws
+export LG_CROSSBAR="ws://${LABGRID_COORDINATOR_IP:?}:${LABGRID_COORDINATOR_PORT:?}/ws"
diff --git a/meta-lxatac-software/recipes-devtools/containers/files/container-start.sh b/meta-lxatac-software/recipes-devtools/containers/files/container-start.sh
index 973ecdc9..f6fd086d 100644
--- a/meta-lxatac-software/recipes-devtools/containers/files/container-start.sh
+++ b/meta-lxatac-software/recipes-devtools/containers/files/container-start.sh
@@ -8,24 +8,23 @@ if podman ps -a | grep -q debian; then
 else
         echo "INFO: No Debian container present. Starting a new one using Podman."
         echo "ATTENTION: Container installation might require Internet access and correct system time!"
-        podman run -it --name=debian --hostname "${HOSTNAME}-debian" --privileged --network=host --volume=/home/:/home/ --volume=/srv/:/srv/ debian
+        hostname="$(hostname)"
+        podman run -it --name=debian --hostname "${hostname}-debian" --privileged --network=host --volume=/home/:/home/ --volume=/srv/:/srv/ debian
 
 	podmanerr=$?
 
-	if [ $podmanerr -ne 0 ]; then
-		echo "FAIL: Podman run failed with error code" $podmanerr
+	if [ "${podmanerr}" -ne 0 ]; then
+		echo "FAIL: Podman run failed with error code" "${podmanerr}"
 		echo "INFO: Checking the obligatory internet connection..."
-		wget -q --spider https://hub.docker.com
-		
-		if [ $? -eq 0 ]; then
+
+		if wget -q --spider "https://hub.docker.com"; then
 			echo "INFO: Got connection with hub.docker.com"
 			echo "FAIL: Internet connection seems present, but podman failed anyways. Terminate."
 		else
 			echo "FAIL: Can not establish a connection to hub.docker.com"
 			echo "INFO: Try to connect to pengutronix.de"
-			wget -q --spider https://pengutronix.de
-		
-			if [ $? -eq 0 ]; then
+
+			if wget -q --spider "https://pengutronix.de"; then
 				echo "INFO: Got connection with pengutronix.de"
 				echo "FAIL: Internet connection seems present, but hub.docker.com can not be reached to pull an image. Terminate."
 			else
diff --git a/meta-lxatac-software/recipes-devtools/containers/files/container-update.sh b/meta-lxatac-software/recipes-devtools/containers/files/container-update.sh
index d65c3dea..60a159ae 100644
--- a/meta-lxatac-software/recipes-devtools/containers/files/container-update.sh
+++ b/meta-lxatac-software/recipes-devtools/containers/files/container-update.sh
@@ -1,18 +1,15 @@
 #!/bin/sh
-  
-echo "ATTENTION: Container update requires Internet access and correct system time!"
 
+echo "ATTENTION: Container update requires Internet access and correct system time!"
 
-wget -q --spider https://hub.docker.com
 
-if [ $? -eq 0 ]; then
+if wget -q --spider "https://hub.docker.com"; then
 	echo "INFO: Got connection with hub.docker.com"
 else
 	echo "FAIL: Can not establish a connection to hub.docker.com"
 	echo "INFO: Try to connect to pengutronix.de"
-	wget -q --spider https://pengutronix.de
 
-	if [ $? -eq 0 ]; then
+	if wget -q --spider "https://pengutronix.de"; then
 		echo "INFO: Got connection with pengutronix.de"
 		echo "FAIL: Internet connection seems present, but hub.docker.com can not be reached to pull an image. Terminate."
 	else
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-audio.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-audio.sh
index d22c29b1..52cba8ba 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-audio.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-audio.sh
@@ -4,14 +4,14 @@ set -e -u -o pipefail
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-audio
+DEVDIR="${MAINDIR:?}/gadget-audio"
 
 clear_gadget
 setup_gadget
 
 # Set up audio
-mkdir $DEVDIR/functions/uac2.usb0
-ln -s $DEVDIR/functions/uac2.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/uac2.usb0"
+ln -s "${DEVDIR}/functions/uac2.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-common.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-common.sh
index c1a97d39..17d49290 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-common.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-common.sh
@@ -13,29 +13,34 @@ PRODUCTNAME="LXATAC"
 UDC_ADDR="49000000.usb-otg"
 
 clear_gadget () {
-    if [ -s $DEVDIR/UDC ]; then
+    already_set_up="false"
+    for dir in "${MAINDIR}"/*; do
+        test -s "${dir}/UDC" && already_set_up="true"
+    done
+
+    if [[ -s "${DEVDIR}/UDC" ]]; then
         echo "USB Gadget is already set up."
         exit 11
-    elif [ -s $MAINDIR/*/UDC ]; then
+    elif [[ "x${already_set_up}" != "xfalse" ]]; then
         echo "Remove existing USB Gadgets."
         # when removing a gadget we have to reverse the init process
-        for dir in $MAINDIR/*/configs/*/strings/*; do
-            [ -d $dir ] && rmdir $dir
+        for dir in "${MAINDIR}"/*/configs/*/strings/*; do
+            test -d "${dir}" && rmdir "${dir}"
         done
-        for func in $MAINDIR/*/configs/*.*/*.*; do
-            [ -e $func ] && rm $func
+        for func in "${MAINDIR}"/*/configs/*.*/*.*; do
+            test -e "${func}" && rm "${func}"
         done
-        for conf in $MAINDIR/*/configs/*; do
-            [ -d $conf ] && rmdir $conf
+        for conf in "${MAINDIR}"/*/configs/*; do
+            test -d "${conf}" && rmdir "${conf}"
         done
-        for func in $MAINDIR/*/functions/*.*; do
-            [ -d $func ] && rmdir $func
+        for func in "${MAINDIR}"/*/functions/*.*; do
+            test -d "${func}" && rmdir "${func}"
         done
-        for str in $MAINDIR/*/strings/*; do
-            [ -d $str ] && rmdir $str
+        for str in "${MAINDIR}"/*/strings/*; do
+            test -d "${str}" && rmdir "${str}"
         done
-        rmdir $MAINDIR/*
-    elif [ -n $DEVDIR ]; then
+        rmdir "${MAINDIR}"/*
+    elif [[ -n "${DEVDIR}" ]]; then
         modprobe libcomposite
     else
         echo "Nothing to do here."
@@ -45,20 +50,20 @@ clear_gadget () {
 
 setup_gadget () {
     echo "Set up new USB Gadget."
-    mkdir $DEVDIR
-    echo $VENDOR > $DEVDIR/idVendor
-    echo $PRODUCT > $DEVDIR/idProduct
+    mkdir "${DEVDIR}"
+    echo "${VENDOR}" > "${DEVDIR}/idVendor"
+    echo "${PRODUCT}" > "${DEVDIR}/idProduct"
 
-    mkdir $DEVDIR/strings/0x409 # set language to EN-US
-    echo $SERIAL > $DEVDIR/strings/0x409/serialnumber
-    echo $VENDORNAME > $DEVDIR/strings/0x409/manufacturer
-    echo $PRODUCTNAME > $DEVDIR/strings/0x409/product
+    mkdir "${DEVDIR}/strings/0x409" # set language to EN-US
+    echo "${SERIAL:?}" > "${DEVDIR}/strings/0x409/serialnumber"
+    echo "${VENDORNAME}" > "${DEVDIR}/strings/0x409/manufacturer"
+    echo "${PRODUCTNAME}" > "${DEVDIR}/strings/0x409/product"
 
-    mkdir $DEVDIR/configs/c.1
-    mkdir $DEVDIR/configs/c.1/strings/0x409
-    echo Normal > $DEVDIR/configs/c.1/strings/0x409/configuration
+    mkdir "${DEVDIR}/configs/c.1"
+    mkdir "${DEVDIR}/configs/c.1/strings/0x409"
+    echo Normal > "${DEVDIR}/configs/c.1/strings/0x409/configuration"
 }
 
 start_gadget () {
-    echo $UDC_ADDR > $DEVDIR/UDC
+    echo "${UDC_ADDR}" > "${DEVDIR}/UDC"
 }
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-serial.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-serial.sh
index 9dca5727..f5853669 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-serial.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-serial.sh
@@ -4,20 +4,20 @@ set -e -u -o pipefail
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-ethernet-serial
+DEVDIR="${MAINDIR:?}/gadget-ethernet-serial"
 
 clear_gadget
 setup_gadget
 
 # Set up ethernet
-mkdir $DEVDIR/functions/ecm.usb0
-echo $HOST_MAC > $DEVDIR/functions/ecm.usb0/host_addr
-echo $DEV_MAC > $DEVDIR/functions/ecm.usb0/dev_addr
-ln -s $DEVDIR/functions/ecm.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/ecm.usb0"
+echo "${HOST_MAC:?}" > "${DEVDIR}/functions/ecm.usb0/host_addr"
+echo "${DEV_MAC:?}" > "${DEVDIR}/functions/ecm.usb0/dev_addr"
+ln -s "${DEVDIR}/functions/ecm.usb0" "${DEVDIR}/configs/c.1"
 
 # Set up serial
-mkdir $DEVDIR/functions/acm.usb0
-ln -s $DEVDIR/functions/acm.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/acm.usb0"
+ln -s "${DEVDIR}/functions/acm.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 exit 0
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-storage.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-storage.sh
index eb4ac26b..343f5921 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-storage.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet-storage.sh
@@ -3,28 +3,28 @@
 set -e -u -o pipefail
 
 STORAGE=${1:-}
-if [ -z $STORAGE ]; then
+if [[ -z "${STORAGE}" ]]; then
     echo "ERROR: No medium given. Start again with image location attached to command."
     exit 1
 fi
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-ethernet-storage
+DEVDIR="${MAINDIR:?}/gadget-ethernet-storage"
 
 clear_gadget
 setup_gadget
 
 # Set up ethernet
-mkdir $DEVDIR/functions/ecm.usb0
-echo $HOST_MAC > $DEVDIR/functions/ecm.usb0/host_addr
-echo $DEV_MAC > $DEVDIR/functions/ecm.usb0/dev_addr
-ln -s $DEVDIR/functions/ecm.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/ecm.usb0"
+echo "${HOST_MAC:?} > ${DEVDIR}/functions/ecm.usb0/host_addr"
+echo "${DEV_MAC:?} > ${DEVDIR}/functions/ecm.usb0/dev_addr"
+ln -s "${DEVDIR}/functions/ecm.usb0" "${DEVDIR}/configs/c.1"
 
 # Set up storage
-mkdir $DEVDIR/functions/mass_storage.usb0
-echo $STORAGE > $DEVDIR/functions/mass_storage.usb0/lun.0/file
-ln -s $DEVDIR/functions/mass_storage.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/mass_storage.usb0"
+echo "${STORAGE}" > "${DEVDIR}/functions/mass_storage.usb0/lun.0/file"
+ln -s "${DEVDIR}/functions/mass_storage.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 exit 0
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet.sh
index 54fde1f4..c9133f98 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-ethernet.sh
@@ -4,16 +4,16 @@ set -e -u -o pipefail
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-ethernet
+DEVDIR="${MAINDIR:?}/gadget-ethernet"
 
 clear_gadget
 setup_gadget
 
 # Set up ethernet
-mkdir $DEVDIR/functions/ecm.usb0
-echo $HOST_MAC > $DEVDIR/functions/ecm.usb0/host_addr
-echo $DEV_MAC > $DEVDIR/functions/ecm.usb0/dev_addr
-ln -s $DEVDIR/functions/ecm.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/ecm.usb0"
+echo "${HOST_MAC:?}" > "${DEVDIR}/functions/ecm.usb0/host_addr"
+echo "${DEV_MAC:?}" > "${DEVDIR}/functions/ecm.usb0/dev_addr"
+ln -s "${DEVDIR}/functions/ecm.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid-storage.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid-storage.sh
index d2c31cb0..b2c41503 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid-storage.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid-storage.sh
@@ -3,7 +3,7 @@
 set -e -u -o pipefail
 
 STORAGE=${1:-}
-if [ -z $STORAGE ]; then
+if [[ -z "${STORAGE}" ]]; then
     echo "ERROR: No medium given. Start again with image location attached to command."
     exit 1
 fi
@@ -11,23 +11,23 @@ fi
 source /usr/share/gadget/gadget-common
 source /usr/share/gadget/gadget-reports
 
-DEVDIR=$MAINDIR/gadget-hid-storage
+DEVDIR="${MAINDIR:?}/gadget-hid-storage"
 
 clear_gadget
 setup_gadget
 
 # Set up mass storage
-mkdir $DEVDIR/functions/mass_storage.usb0
-echo $STORAGE > $DEVDIR/functions/mass_storage.usb0/lun.0/file
-ln -s $DEVDIR/functions/mass_storage.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/mass_storage.usb0"
+echo "${STORAGE}" > "${DEVDIR}/functions/mass_storage.usb0/lun.0/file"
+ln -s "${DEVDIR}/functions/mass_storage.usb0" "${DEVDIR}/configs/c.1"
 
 # Set up HID
-mkdir $DEVDIR/functions/hid.usb0
-echo 1 > $DEVDIR/functions/hid.usb0/protocol
-echo 1 > $DEVDIR/functions/hid.usb0/subclass
-echo 8 > $DEVDIR/functions/hid.usb0/report_length
-report_keyboard > $DEVDIR/functions/hid.usb0/report_desc
-ln -s $DEVDIR/functions/hid.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/hid.usb0"
+echo 1 > "${DEVDIR}/functions/hid.usb0/protocol"
+echo 1 > "${DEVDIR}/functions/hid.usb0/subclass"
+echo 8 > "${DEVDIR}/functions/hid.usb0/report_length"
+report_keyboard > "${DEVDIR}/functions/hid.usb0/report_desc"
+ln -s "${DEVDIR}/functions/hid.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid.sh
index cb258222..b156c9c0 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-hid.sh
@@ -5,19 +5,19 @@ set -e -u -o pipefail
 source /usr/share/gadget/gadget-common
 source /usr/share/gadget/gadget-reports
 
-DEVDIR=$MAINDIR/gadget-hid
+DEVDIR="${MAINDIR:?}/gadget-hid"
 
 echo "Will export keyboard configuration."
 clear_gadget
 setup_gadget
 
 # Set up HID
-mkdir $DEVDIR/functions/hid.usb0
-echo 1 > $DEVDIR/functions/hid.usb0/protocol
-echo 1 > $DEVDIR/functions/hid.usb0/subclass
-echo 8 > $DEVDIR/functions/hid.usb0/report_length
-report_keyboard > $DEVDIR/functions/hid.usb0/report_desc
-ln -s $DEVDIR/functions/hid.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/hid.usb0"
+echo 1 > "${DEVDIR}/functions/hid.usb0/protocol"
+echo 1 > "${DEVDIR}/functions/hid.usb0/subclass"
+echo 8 > "${DEVDIR}/functions/hid.usb0/report_length"
+report_keyboard > "${DEVDIR}/functions/hid.usb0/report_desc"
+ln -s "${DEVDIR}/functions/hid.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-reports.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-reports.sh
index 588ecb80..8a9c5866 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-reports.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-reports.sh
@@ -1,3 +1,5 @@
+#!/bin/bash
+
 report_keyboard () {
 # sample report descriptor, taken from Documentation/usb/gadget_hid.rst
 echo -ne \\x05\\x01\\x09\\x06\\xa1\\x01\\x05\\x07\\x19\\xe0\\x29\\xe7\\x15\\x00\\x25\\x01\\x75\\x01\\x95\\x08\\x81\\x02\\x95\\x01\\x75\\x08\\x81\\x03\\x95\\x05\\x75\\x01\\x05\\x08\\x19\\x01\\x29\\x05\\x91\\x02\\x95\\x01\\x75\\x03\\x91\\x03\\x95\\x06\\x75\\x08\\x15\\x00\\x25\\x65\\x05\\x07\\x19\\x00\\x29\\x65\\x81\\x00\\xc0
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial-storage.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial-storage.sh
index cdbdd9d2..9d84263d 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial-storage.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial-storage.sh
@@ -3,26 +3,26 @@
 set -e -u -o pipefail
 
 STORAGE=${1:-}
-if [ -z $STORAGE ]; then
+if [[ -z "${STORAGE}" ]]; then
     echo "ERROR: No medium given. Start again with image location attached to command."
     exit 1
 fi
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-serial-storage
+DEVDIR="${MAINDIR:?}/gadget-serial-storage"
 
 clear_gadget
 setup_gadget
 
 # Set up mass storage
-mkdir $DEVDIR/functions/mass_storage.usb0
-echo $STORAGE > $DEVDIR/functions/mass_storage.usb0/lun.0/file
-ln -s $DEVDIR/functions/mass_storage.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/mass_storage.usb0"
+echo "${STORAGE}" > "${DEVDIR}/functions/mass_storage.usb0/lun.0/file"
+ln -s "${DEVDIR}/functions/mass_storage.usb0" "${DEVDIR}/configs/c.1"
 
 # Set up serial
-mkdir $DEVDIR/functions/acm.usb0
-ln -s $DEVDIR/functions/acm.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/acm.usb0"
+ln -s "${DEVDIR}/functions/acm.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial.sh
index a428c1d0..bdfae7a4 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-serial.sh
@@ -4,14 +4,14 @@ set -e -u -o pipefail
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-serial
+DEVDIR="${MAINDIR:?}/gadget-serial"
 
 clear_gadget
 setup_gadget
 
 # Set up serial
-mkdir $DEVDIR/functions/acm.usb0
-ln -s $DEVDIR/functions/acm.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/acm.usb0"
+ln -s "${DEVDIR}/functions/acm.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget
 
diff --git a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-storage.sh b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-storage.sh
index 8ba0bb6a..83eed733 100644
--- a/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-storage.sh
+++ b/meta-lxatac-software/recipes-devtools/tac-gadget/files/gadget-storage.sh
@@ -3,22 +3,22 @@
 set -e -u -o pipefail
 
 STORAGE=${1:-}
-if [ -z $STORAGE ]; then
+if [[ -z "${STORAGE}" ]]; then
     echo "ERROR: No medium given. Start again with image location attached to command."
     exit 1
 fi
 
 source /usr/share/gadget/gadget-common
 
-DEVDIR=$MAINDIR/gadget-storage
+DEVDIR="${MAINDIR:?}/gadget-storage"
 
 clear_gadget
 setup_gadget
 
 # Set up storage
-mkdir $DEVDIR/functions/mass_storage.usb0
-echo $STORAGE > $DEVDIR/functions/mass_storage.usb0/lun.0/file
-ln -s $DEVDIR/functions/mass_storage.usb0 $DEVDIR/configs/c.1
+mkdir "${DEVDIR}/functions/mass_storage.usb0"
+echo "${STORAGE}" > "${DEVDIR}/functions/mass_storage.usb0/lun.0/file"
+ln -s "${DEVDIR}/functions/mass_storage.usb0" "${DEVDIR}/configs/c.1"
 
 start_gadget