From 2b327d5ca8fb41a24f3d07b239eede76129e9162 Mon Sep 17 00:00:00 2001
From: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>
Date: Wed, 26 May 2021 21:48:14 -0400
Subject: [PATCH 1/2] Run shellcheck against scripts

---
 components/BUILD.yaml                         |  4 +--
 components/blobserve/telepresence.sh          |  2 +-
 components/common-go/go-get-kubernetes.sh     |  8 +++--
 components/content-service-api/generate.sh    | 11 +++----
 components/dashboard/remove-sources.sh        | 10 ++++---
 components/ide/code/startup.sh                | 10 ++++---
 components/ide/theia/package-libs.sh          | 14 ++++-----
 components/ide/theia/startup.sh               | 10 ++++---
 components/image-builder-api/generate.sh      | 11 +++----
 components/image-builder/debug.sh             |  4 +--
 .../gitpod-layer/alpine/gitpod/layer.sh       |  6 ++--
 .../gitpod-layer/debian/gitpod/layer.sh       |  6 ++--
 .../scripts/generate-dockerfile.sh            |  6 ++--
 .../tests/positive/verify.sh                  |  2 +-
 .../workspace-image-layer/tests/runtests.sh   | 20 ++++++-------
 components/local-app-api/generate.sh          | 19 ++++++------
 .../local-app-api/typescript-grpcweb/build.sh |  4 +--
 components/registry-facade-api/generate.sh    |  9 +++---
 components/registry-facade/telepresence.sh    |  2 +-
 components/supervisor-api/generate.sh         | 20 +++++++------
 .../supervisor-api/typescript-grpc/build.sh   | 29 +++++++++----------
 .../typescript-grpcweb/build.sh               | 14 +++++----
 .../supervisor-api/typescript-rest/build.sh   | 22 ++++++++------
 components/ws-daemon-api/generate.sh          | 23 ++++++++-------
 components/ws-daemon/debug.sh                 |  2 +-
 .../seccomp-profile-installer/generate.sh     |  0
 .../shiftfs-module-loader/entrypoint.sh       |  9 +++---
 components/ws-manager-api/generate.sh         | 13 +++++----
 components/ws-manager-bridge-api/generate.sh  | 11 +++----
 components/ws-manager/telepresence.sh         |  2 +-
 components/ws-proxy/telepresence.sh           |  4 +--
 .../certs/create-letsencrypt-certs.sh         |  3 +-
 .../gitpod-gitlab/gitlab/entrypoint.sh        | 19 +++++++-----
 install/docker/gitpod-image/entrypoint.sh     |  8 +++--
 install/installer/entrypoint.sh               |  6 ++--
 scripts/branch-namespace.sh                   |  6 ++--
 scripts/go-licenses.sh                        | 18 ++++++------
 scripts/protoc-generator.sh                   | 25 ++++++++--------
 test/entrypoint.sh                            |  3 +-
 test/leeway-build.sh                          | 16 +++++-----
 40 files changed, 222 insertions(+), 189 deletions(-)
 mode change 100644 => 100755 components/supervisor-api/typescript-rest/build.sh
 delete mode 100644 components/ws-daemon/seccomp-profile-installer/generate.sh

diff --git a/components/BUILD.yaml b/components/BUILD.yaml
index c1a164eff2e94b..f0b3a2cb50a996 100644
--- a/components/BUILD.yaml
+++ b/components/BUILD.yaml
@@ -99,7 +99,7 @@ scripts:
     srcs:
       - components/**/*
     script: |
-      GO_COMPONENTS=( content-service-api image-builder-api registry-facade-api supervisor-api ws-daemon-api ws-manager-api ws-manager-bridge-api )
+      GO_COMPONENTS=( local-app-api content-service-api image-builder-api registry-facade-api supervisor-api ws-daemon-api ws-manager-api ws-manager-bridge-api )
 
       for COMPONENT in "${GO_COMPONENTS[@]}";do
         echo "Generating code for component $COMPONENT..."
@@ -108,7 +108,7 @@ scripts:
         popd > /dev/null
       done
 
-      WEB_COMPONENTS=( supervisor-api/typescript-grpc supervisor-api/typescript-rest supervisor-api/typescript-grpcweb )
+      WEB_COMPONENTS=( local-app-api/typescript-grpcweb supervisor-api/typescript-grpc supervisor-api/typescript-rest supervisor-api/typescript-grpcweb )
       for COMPONENT in "${WEB_COMPONENTS[@]}";do
         echo "Generating code for component $COMPONENT..."
         pushd $COMPONENT > /dev/null
diff --git a/components/blobserve/telepresence.sh b/components/blobserve/telepresence.sh
index 97f8ef841ba7dc..50c86c1697d789 100755
--- a/components/blobserve/telepresence.sh
+++ b/components/blobserve/telepresence.sh
@@ -11,4 +11,4 @@ if [ "$1" == "intp" ]; then
     exit $?
 fi
 
-telepresence --mount /tmp/c --swap-deployment registry-facade --method vpn-tcp --run $0 dbg-intp
+telepresence --mount /tmp/c --swap-deployment registry-facade --method vpn-tcp --run "$0" dbg-intp
diff --git a/components/common-go/go-get-kubernetes.sh b/components/common-go/go-get-kubernetes.sh
index 5480ec88c85ebd..3cacbf230f4fb9 100755
--- a/components/common-go/go-get-kubernetes.sh
+++ b/components/common-go/go-get-kubernetes.sh
@@ -18,15 +18,16 @@ fi
 set -euo pipefail
 
 echo "Retrieving kubernetes module file"
-GM=$(go mod download -json k8s.io/kubernetes@v1.$VERSION | jq -r .GoMod)
-MODS=($(cat $GM | egrep "^\s+k8s.io/.*v0.0.0$" | tr -d '\t' | cut -d ' ' -f 1))
+GM=$(go mod download -json k8s.io/kubernetes@v1."$VERSION" | jq -r .GoMod)
+# shellcheck disable=SC2002,SC2207
+MODS=($(cat "$GM" | grep -E "^\s+k8s.io/.*v0.0.0$" | tr -d '\t' | cut -d ' ' -f 1))
 
 useSemver=$(echo "console.log(\"1.${VERSION}\" >= \"1.17\")" | node -)
 if [ "$useSemver" = "true" ]; then
     echo "Version is newer than 1.17 - using semver"
 fi
 
-echo "Adding ${MODS[@]}"
+echo Adding "${MODS[@]}"
 for MOD in "${MODS[@]}"; do
     if [ "$useSemver" = "true" ]; then
         V="v0.${VERSION}"
@@ -35,4 +36,5 @@ for MOD in "${MODS[@]}"; do
     fi
     go mod edit "-replace=${MOD}=${MOD}@${V}"
 done
+
 go get -v ./...
diff --git a/components/content-service-api/generate.sh b/components/content-service-api/generate.sh
index 230e38e8caea47..2c8f8b07e17792 100755
--- a/components/content-service-api/generate.sh
+++ b/components/content-service-api/generate.sh
@@ -8,15 +8,16 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
-COMPONENTS_DIR=$ROOT_DIR/components
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
+COMPONENTS_DIR="$ROOT_DIR"/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 install_dependencies
-go_protoc $COMPONENTS_DIR
-typescript_protoc $COMPONENTS_DIR
+go_protoc "$COMPONENTS_DIR"
+typescript_protoc "$COMPONENTS_DIR"
 
 go generate typescript/util/generate-ws-ready.go
 
diff --git a/components/dashboard/remove-sources.sh b/components/dashboard/remove-sources.sh
index 8999260c0714a5..77d1a3d5ba8ce6 100755
--- a/components/dashboard/remove-sources.sh
+++ b/components/dashboard/remove-sources.sh
@@ -4,12 +4,13 @@
 rm -rvf dist/*.map;
 
 # ensure all files using Google Analytics have the proper format
+# shellcheck disable=SC2044
 for i in $(find public/ -name "*.html"); do
-    if grep -q "Global site tag" $i; then
-        if ! grep -q -- "-- gtag end --" $i; then
+    if grep -q "Global site tag" "$i"; then
+        if ! grep -q -- "-- gtag end --" "$i"; then
             echo "$i does not have a gtag end marker. This would break the remove-sources.sh script."
             echo 'Please add <!-- gtag end --> after the Google Analytics block'
-            exit -1
+            exit 1
         fi
     fi
 done
@@ -17,6 +18,7 @@ done
 # remove Google Analytics
 echo "BEWARE: This script actually modifies files in the source tree"
 rm public/google2db8c31aefd7ebbd.html
+# shellcheck disable=SC2044
 for i in $(find public/ -name "*.html"); do
-    sed -i '/<!-- Global site tag/,/gtag end/d' $i;
+    sed -i '/<!-- Global site tag/,/gtag end/d' "$i";
 done
diff --git a/components/ide/code/startup.sh b/components/ide/code/startup.sh
index b85987c54bc328..651cfd4ba2d1ac 100755
--- a/components/ide/code/startup.sh
+++ b/components/ide/code/startup.sh
@@ -9,7 +9,7 @@
  # the bash history.
  set +o history
  history -c
- truncate -s 0 $HISTFILE
+ truncate -s 0 "$HISTFILE"
 
 # This is the main entrypoint to workspace container in Gitpod. It is called (and controlled) by the supervisor
 # container root process.
@@ -27,8 +27,10 @@ export USER=gitpod
 # (+ compatibility period)
 # Also to mitigate compatibility issues let's try to source recently added configuration explicitly
 [ -d "/home/gitpod/.sdkman" ] && [ -z "$SDKMAN_DIR" ] && export SDKMAN_DIR="/home/gitpod/.sdkman"
+# shellcheck disable=SC1090,SC1091
 [ -s /home/gitpod/.sdkman/bin/sdkman-init.sh ] && [ -z "$SDKMAN_VERSION" ] && source "/home/gitpod/.sdkman/bin/sdkman-init.sh"
-[ -s ~/.nvm/nvm-lazy.sh ] && source ~/.nvm/nvm-lazy.sh
+# shellcheck disable=SC1090,SC1091
+[ -s ~/.nvm/nvm-lazy.sh ] && source /home/gitpod/.nvm/nvm-lazy.sh
 
-cd /ide
-exec /ide/node/bin/gitpod-node ./out/gitpod.js $*
\ No newline at end of file
+cd /ide || exit
+exec /ide/node/bin/gitpod-node ./out/gitpod.js "$@"
diff --git a/components/ide/theia/package-libs.sh b/components/ide/theia/package-libs.sh
index a0ebc42a4ce1dd..5f9fe5993c48a3 100755
--- a/components/ide/theia/package-libs.sh
+++ b/components/ide/theia/package-libs.sh
@@ -23,9 +23,9 @@ echo "$BINARY: Starting rewiring libs to $DST"
 
 [ -d "$DST" ] || mkdir -p "$DST"
 
-INTERPRETER_ORIG=$(patchelf --print-interpreter $BINARY 2>/dev/null)
-if [ ! -z "$INTERPRETER_ORIG" ]; then
-    INTERPRETER_DST="${DST}$(basename $INTERPRETER_ORIG)"
+INTERPRETER_ORIG=$(patchelf --print-interpreter "$BINARY" 2>/dev/null)
+if [ -n "$INTERPRETER_ORIG" ]; then
+    INTERPRETER_DST="${DST}$(basename "$INTERPRETER_ORIG")"
     [ -f "${INTERPRETER_DST}" ] || cp "${INTERPRETER_ORIG}" "${INTERPRETER_DST}"
     patchelf --set-interpreter "${INTERPRETER_DST}" "${BINARY}"
     echo "${BINARY}: changed ELF interpreter from ${INTERPRETER_ORIG} to ${INTERPRETER_DST}"
@@ -39,8 +39,8 @@ do
         continue
     fi
     if [ -f "${LIB_ORIG}" ]; then
-        LIB_DST="${DST}$(basename $LIB_ORIG)"
-        if [ ! -f $LIB_DST ]; then
+        LIB_DST="${DST}$(basename "$LIB_ORIG")"
+        if [ ! -f "$LIB_DST" ]; then
             cp "${LIB_ORIG}" "${LIB_DST}"
             "$0" "${LIB_DST}"
         fi
@@ -49,6 +49,6 @@ do
     else
         echo "${BINARY}: library $LIB_ORIG not found."
     fi
-done < <(ldd $BINARY 2>/dev/null)
+done < <(ldd "$BINARY" 2>/dev/null)
 
-echo "$BINARY: Finished rewiring libs to $DST"
\ No newline at end of file
+echo "$BINARY: Finished rewiring libs to $DST"
diff --git a/components/ide/theia/startup.sh b/components/ide/theia/startup.sh
index bb7671db1bf980..a19832b99f356d 100755
--- a/components/ide/theia/startup.sh
+++ b/components/ide/theia/startup.sh
@@ -9,7 +9,7 @@
  # the bash history.
  set +o history
  history -c
- truncate -s 0 $HISTFILE
+ truncate -s 0 "$HISTFILE"
 
 # This is the main entrypoint to workspace container in Gitpod. It is called (and controlled) by the supervisor
 # container root process.
@@ -27,8 +27,10 @@ export USER=gitpod
 # (+ compatibility period)
 # Also to mitigate compatibility issues let's try to source recently added configuration explicitly
 [ -d "/home/gitpod/.sdkman" ] && [ -z "$SDKMAN_DIR" ] && export SDKMAN_DIR="/home/gitpod/.sdkman"
+# shellcheck disable=SC1090,SC1091
 [ -s /home/gitpod/.sdkman/bin/sdkman-init.sh ] && [ -z "$SDKMAN_VERSION" ] && source "/home/gitpod/.sdkman/bin/sdkman-init.sh"
-[ -s ~/.nvm/nvm-lazy.sh ] && source ~/.nvm/nvm-lazy.sh
+# shellcheck disable=SC1090,SC1091
+[ -s ~/.nvm/nvm-lazy.sh ] && source /home/gitpod/.nvm/nvm-lazy.sh
 
-cd /theia/theia-app/app
-exec /theia/node/bin/gitpod-node ./src-gen/backend/main.js --vscode-api-version=1.53.2 $*
+cd /theia/theia-app/app || exit
+exec /theia/node/bin/gitpod-node ./src-gen/backend/main.js --vscode-api-version=1.53.2 "$@"
diff --git a/components/image-builder-api/generate.sh b/components/image-builder-api/generate.sh
index 9be157e085b16a..f5238bd41a7477 100755
--- a/components/image-builder-api/generate.sh
+++ b/components/image-builder-api/generate.sh
@@ -8,15 +8,16 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
 COMPONENTS_DIR=$ROOT_DIR/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 install_dependencies
-go_protoc $COMPONENTS_DIR
-typescript_protoc $COMPONENTS_DIR
+go_protoc "$COMPONENTS_DIR"
+typescript_protoc "$COMPONENTS_DIR"
 
 go generate typescript/util/generate-ws-ready.go
 
@@ -31,7 +32,7 @@ mockgen \
 popd
 
 pushd typescript/src
-node $COMPONENTS_DIR/content-service-api/typescript/patch-grpc-js.ts
+node "$COMPONENTS_DIR"/content-service-api/typescript/patch-grpc-js.ts
 popd
 
 update_license
diff --git a/components/image-builder/debug.sh b/components/image-builder/debug.sh
index 22e83207f1dcc0..10d98ceb7602b5 100755
--- a/components/image-builder/debug.sh
+++ b/components/image-builder/debug.sh
@@ -2,11 +2,11 @@
 
 # This script builds the image builder and replaces the current deployment with it.
 
-docker ps &> /dev/null || (echo "You need a working Docker daemon. Maybe set DOCKER_HOST?"; exit -1)
+docker ps &> /dev/null || (echo "You need a working Docker daemon. Maybe set DOCKER_HOST?"; exit 1)
 gcloud auth list | grep typefox &>/dev/null || (echo "Login using 'gcloud auth login' for the docker push to work"; exit 1)
 
 leeway build .:docker -Dversion=dev
 devImage=eu.gcr.io/gitpod-dev/image-builder:dev
 
 kubectl patch deployment image-builder --patch '{"spec": {"template": {"spec": {"containers": [{"name": "service","image": "'$devImage'"}]}}}}'
-kubectl get pods --no-headers -o=custom-columns=:metadata.name | grep image-builder | xargs kubectl delete pod
\ No newline at end of file
+kubectl get pods --no-headers -o=custom-columns=:metadata.name | grep image-builder | xargs kubectl delete pod
diff --git a/components/image-builder/workspace-image-layer/gitpod-layer/alpine/gitpod/layer.sh b/components/image-builder/workspace-image-layer/gitpod-layer/alpine/gitpod/layer.sh
index 24a60b4e796f05..7bb5ba38a72f95 100755
--- a/components/image-builder/workspace-image-layer/gitpod-layer/alpine/gitpod/layer.sh
+++ b/components/image-builder/workspace-image-layer/gitpod-layer/alpine/gitpod/layer.sh
@@ -10,7 +10,7 @@ set -e;
 
 # Install necessary tools only if they are not yet installed
 INSTALLED_PACKAGES=$(apk list -I git bash | wc -l)
-if [ $INSTALLED_PACKAGES != 2 ]; then
+if [ "$INSTALLED_PACKAGES" != 2 ]; then
     # Install
     apk add --no-cache --update \
         git \
@@ -44,13 +44,13 @@ if ! id -u gitpod; then
     chown -R gitpod:gitpod /home/gitpod/;
 else
     USER_ID=$(id -u gitpod)
-    if [ $USER_ID -eq 33333 ]; then
+    if [ "$USER_ID" -eq 33333 ]; then
         # users exists and has user id 33333. We hope that the user does not have ID 0, because that grants root privileges
         echo "Found user 'gitpod'. Reusing it.";
         echo "gitpod:gitpod" | chpasswd;
     else
         # error
-        echo "Error: User 'gitpod' exists but does not have user-id 33333. The user-id is $UID";
+        echo "Error: User 'gitpod' exists but does not have user-id 33333. The user-id is $(id -u)";
         exit 1;
     fi
 fi
diff --git a/components/image-builder/workspace-image-layer/gitpod-layer/debian/gitpod/layer.sh b/components/image-builder/workspace-image-layer/gitpod-layer/debian/gitpod/layer.sh
index b9adcee929a6ef..3bf62f25eb497e 100755
--- a/components/image-builder/workspace-image-layer/gitpod-layer/debian/gitpod/layer.sh
+++ b/components/image-builder/workspace-image-layer/gitpod-layer/debian/gitpod/layer.sh
@@ -10,7 +10,7 @@ set -e;
 
 # Install necessary tools only if they are not yet installed
 INSTALLED_PACKAGES=$(dpkg-query -f '${Package} ${Status}\n' -W bash-completion git | wc -l)
-if [ $INSTALLED_PACKAGES != 2 ]; then
+if [ "$INSTALLED_PACKAGES" != 2 ]; then
     # The first 'clean' is needed to avoid apt-get detecting package meta data changes
     # (like changed labels) which result in errors and broken builds/workspaces!
     apt-get clean && rm -rf /var/lib/apt/lists/*;
@@ -52,13 +52,13 @@ if ! id -u gitpod; then
     chown -R gitpod:gitpod /home/gitpod/;
 else
     USER_ID=$(id -u gitpod)
-    if [ $USER_ID -eq 33333 ]; then
+    if [ "$USER_ID" -eq 33333 ]; then
         # users exists and has user id 33333. We hope that the user does not have ID 0, because that grants root privileges
         echo "Found user 'gitpod'. Reusing it.";
         echo "gitpod:gitpod" | chpasswd;
     else
         # error
-        echo "Error: User 'gitpod' exists but does not have user-id 33333. The user-id is $UID";
+        echo "Error: User 'gitpod' exists but does not have user-id 33333. The user-id is $(id -u)";
         exit 1;
     fi
 fi
diff --git a/components/image-builder/workspace-image-layer/scripts/generate-dockerfile.sh b/components/image-builder/workspace-image-layer/scripts/generate-dockerfile.sh
index 4467658812e14c..24e60ffbfcf5a8 100755
--- a/components/image-builder/workspace-image-layer/scripts/generate-dockerfile.sh
+++ b/components/image-builder/workspace-image-layer/scripts/generate-dockerfile.sh
@@ -5,7 +5,7 @@
 
 # Parameters:
 #   $1: BASE_IMAGE
-BASE_DIR="$( cd "$( dirname $0 )/.." >/dev/null 2>&1 && pwd )"
+BASE_DIR="$( cd "$( dirname "$0" )/.." >/dev/null 2>&1 && pwd )"
 BASE_IMAGE=$1
 
 # 1. Read distro value
@@ -24,10 +24,10 @@ rm -f $DISTRO_IN_FILE
 
 # 2. Copy distro-specific files into workspace (default path in Google Cloud Container builder: /workspace)
 DISTRO_PATH="$BASE_DIR/gitpod-layer/$DISTRO"
-cp -R $DISTRO_PATH/. ./
+cp -R "$DISTRO_PATH"/. ./
 
 # 3. Copy the gitpod-cli into the workspaace
-cp $BASE_DIR/gitpod-cli gitpod-cli
+cp "$BASE_DIR"/gitpod-cli gitpod-cli
 
 # 4. Create Dockerfile in /workspace starting from BASE_IMAGE and append the distro-specific part
 echo "FROM $BASE_IMAGE" > Dockerfile
diff --git a/components/image-builder/workspace-image-layer/tests/positive/verify.sh b/components/image-builder/workspace-image-layer/tests/positive/verify.sh
index 2b7f3e3a7c865c..6cc34f8e017b0e 100755
--- a/components/image-builder/workspace-image-layer/tests/positive/verify.sh
+++ b/components/image-builder/workspace-image-layer/tests/positive/verify.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
 USER_ID=$(id -u gitpod)
-if [ $USER_ID -ne 33333 ]; then
+if [ "$USER_ID" -ne 33333 ]; then
     echo "user 'gitpod' not present or wrong user-id."
     exit 1
 fi
diff --git a/components/image-builder/workspace-image-layer/tests/runtests.sh b/components/image-builder/workspace-image-layer/tests/runtests.sh
index 541ef09b99ba33..34436f287050f7 100755
--- a/components/image-builder/workspace-image-layer/tests/runtests.sh
+++ b/components/image-builder/workspace-image-layer/tests/runtests.sh
@@ -7,28 +7,28 @@ BASE=$(pwd)
 
 cd positive
 
-for DOCKERFILE in $(ls *.dockerfile); do
+for DOCKERFILE in ls *.dockerfile; do
     echo "********* BEGIN TEST $DOCKERFILE ************"
     BASE_IMG="$DOCKERFILE:test"
     WORKSPACE_IMG="$DOCKERFILE:layered"
     WORKSPACE="$(sudo rm -rf .tmp; mkdir .tmp; cd .tmp; pwd)"
 
-    cp "$BASE/"../scripts/* $WORKSPACE
-    cp "$BASE/positive/verify.sh" $WORKSPACE
-    docker build -f $DOCKERFILE -t $BASE_IMG .
-    docker run -v $WORKSPACE:/workspace $BASE_IMG /workspace/detect-distro.sh
+    cp "$BASE/"../scripts/* "$WORKSPACE"
+    cp "$BASE/positive/verify.sh" "$WORKSPACE"
+    docker build -f "$DOCKERFILE" -t "$BASE_IMG" .
+    docker run -v "$WORKSPACE":/workspace "$BASE_IMG" /workspace/detect-distro.sh
     # Fake-satisfy generate-dockerfile.sh dependency
     touch "$BASE/../gitpod-cli"
-    docker run -v $WORKSPACE:/workspace -v "$BASE/..":/base $BASE_IMG sh -c "cd /workspace && /base/scripts/generate-dockerfile.sh $BASE_IMG"
+    docker run -v "$WORKSPACE":/workspace -v "$BASE/..":/base "$BASE_IMG" sh -c "cd /workspace && /base/scripts/generate-dockerfile.sh $BASE_IMG"
 
-    docker build -f "$WORKSPACE/Dockerfile" -t $WORKSPACE_IMG $WORKSPACE
+    docker build -f "$WORKSPACE/Dockerfile" -t "$WORKSPACE_IMG" "$WORKSPACE"
 
     echo "docker run -v $WORKSPACE:/workspace $WORKSPACE_IMG /workspace/verify.sh"
-    if ! docker run -v $WORKSPACE:/workspace --entrypoint="" $WORKSPACE_IMG /workspace/verify.sh; then
+    if ! docker run -v "$WORKSPACE:/workspace" --entrypoint="" "$WORKSPACE_IMG" /workspace/verify.sh; then
         echo "verify.sh failed."
         exit 1
     fi
-    sudo rm -rf $WORKSPACE
+    sudo rm -rf "$WORKSPACE"
     rm -f "$BASE/../gitpod-cli"
     echo "********* END TEST $DOCKERFILE ************"
-done
\ No newline at end of file
+done
diff --git a/components/local-app-api/generate.sh b/components/local-app-api/generate.sh
index 8a1ceebbcb6573..7b479057a9b474 100755
--- a/components/local-app-api/generate.sh
+++ b/components/local-app-api/generate.sh
@@ -8,16 +8,17 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
-COMPONENTS_DIR=$ROOT_DIR/components
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
+COMPONENTS_DIR="$ROOT_DIR"/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 THIRD_PARTY_INCLUDES=${PROTOLOC:-$COMPONENTS_DIR/supervisor-api/third_party}
-if [ ! -d $THIRD_PARTY_INCLUDES/google/api ]; then
+if [ ! -d "$THIRD_PARTY_INCLUDES"/google/api ]; then
     echo "missing $THIRD_PARTY_INCLUDES/google/api"
-    exit -1
+    exit 1
 fi
 
 # TODO (aledbf): refactor to avoid duplication
@@ -25,14 +26,14 @@ local_go_protoc() {
     local ROOT_DIR=$1
 
     protoc \
-        -I /usr/lib/protoc/include -I$COMPONENTS_DIR -I. -I$THIRD_PARTY_INCLUDES \
+        -I /usr/lib/protoc/include -I"$COMPONENTS_DIR" -I. -I"$THIRD_PARTY_INCLUDES" \
         --go_out=go \
         --go_opt=paths=source_relative \
         --go-grpc_out=go \
         --go-grpc_opt=paths=source_relative \
-        *.proto
+        ./*.proto
 }
 
 install_dependencies
-local_go_protoc $COMPONENTS_DIR
-update_license
\ No newline at end of file
+local_go_protoc "$COMPONENTS_DIR"
+update_license
diff --git a/components/local-app-api/typescript-grpcweb/build.sh b/components/local-app-api/typescript-grpcweb/build.sh
index ebb542fdb1aa7f..fec9ab7924dea3 100644
--- a/components/local-app-api/typescript-grpcweb/build.sh
+++ b/components/local-app-api/typescript-grpcweb/build.sh
@@ -3,7 +3,7 @@
 # Licensed under the GNU Affero General Public License (AGPL).
 # See License-AGPL.txt in the project root for license information.
 
-DIR=$(cd "$(dirname "${BASH_SOURCE}")" && pwd -P)
+DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
 
 PROTO_DIR=${PROTOLOC:-$DIR/..}
 
@@ -30,4 +30,4 @@ protoc \
     "$PROTO_DIR"/*.proto
 
 sed -i 's/\.\/supervisor-api/\@gitpod\/supervisor-api-grpcweb\/lib/g' lib/*.js
-sed -i 's/\.\/supervisor-api/\@gitpod\/supervisor-api-grpcweb\/lib/g' lib/*.d.ts
\ No newline at end of file
+sed -i 's/\.\/supervisor-api/\@gitpod\/supervisor-api-grpcweb\/lib/g' lib/*.d.ts
diff --git a/components/registry-facade-api/generate.sh b/components/registry-facade-api/generate.sh
index 3ff0e963f4643f..4f26f15ed56b00 100755
--- a/components/registry-facade-api/generate.sh
+++ b/components/registry-facade-api/generate.sh
@@ -8,11 +8,12 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
-COMPONENTS_DIR=$ROOT_DIR/components
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
+COMPONENTS_DIR="$ROOT_DIR"/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 install_dependencies
-go_protoc $COMPONENTS_DIR
+go_protoc "$COMPONENTS_DIR"
diff --git a/components/registry-facade/telepresence.sh b/components/registry-facade/telepresence.sh
index 97f8ef841ba7dc..50c86c1697d789 100755
--- a/components/registry-facade/telepresence.sh
+++ b/components/registry-facade/telepresence.sh
@@ -11,4 +11,4 @@ if [ "$1" == "intp" ]; then
     exit $?
 fi
 
-telepresence --mount /tmp/c --swap-deployment registry-facade --method vpn-tcp --run $0 dbg-intp
+telepresence --mount /tmp/c --swap-deployment registry-facade --method vpn-tcp --run "$0" dbg-intp
diff --git a/components/supervisor-api/generate.sh b/components/supervisor-api/generate.sh
index fff37811d5795b..10efcfc892d536 100755
--- a/components/supervisor-api/generate.sh
+++ b/components/supervisor-api/generate.sh
@@ -8,24 +8,25 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../..
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../..
 COMPONENTS_DIR=$ROOT_DIR/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 THIRD_PARTY_INCLUDES=${PROTOLOC:-$PWD/third_party}
-if [ ! -d $THIRD_PARTY_INCLUDES/google/api ]; then
+if [ ! -d "$THIRD_PARTY_INCLUDES"/google/api ]; then
     echo "missing $THIRD_PARTY_INCLUDES/google/api"
-    exit -1
+    exit 1
 fi
 
 # TODO (aledbf): refactor to avoid duplication
 local_go_protoc() {
     local ROOT_DIR=$1
-
+    # shellcheck disable=2035
     protoc \
-        -I /usr/lib/protoc/include -I$COMPONENTS_DIR -I. -I$THIRD_PARTY_INCLUDES \
+        -I/usr/lib/protoc/include -I"$COMPONENTS_DIR" -I. -I"$THIRD_PARTY_INCLUDES" \
         --go_out=go \
         --go_opt=paths=source_relative \
         --go-grpc_out=go \
@@ -34,13 +35,14 @@ local_go_protoc() {
 }
 
 go_protoc_gateway() {
+    # shellcheck disable=2035
     protoc \
-        -I /usr/lib/protoc/include -I$COMPONENTS_DIR -I. -I$THIRD_PARTY_INCLUDES \
+        -I/usr/lib/protoc/include -I"$COMPONENTS_DIR" -I. -I"$THIRD_PARTY_INCLUDES" \
         --grpc-gateway_out=logtostderr=true,paths=source_relative:go \
         *.proto
 }
 
 install_dependencies
-local_go_protoc $COMPONENTS_DIR
-go_protoc_gateway $COMPONENTS_DIR
+local_go_protoc "$COMPONENTS_DIR"
+go_protoc_gateway "$COMPONENTS_DIR"
 update_license
diff --git a/components/supervisor-api/typescript-grpc/build.sh b/components/supervisor-api/typescript-grpc/build.sh
index 2ad302eaf997ca..3b8939be7b9f2d 100755
--- a/components/supervisor-api/typescript-grpc/build.sh
+++ b/components/supervisor-api/typescript-grpc/build.sh
@@ -5,30 +5,29 @@
 
 set -e
 
-THIRD_PARTY_INCLUDES=${PROTOLOC:-..}
-if [ ! -d $THIRD_PARTY_INCLUDES/third_party/google/api ]; then
+THIRD_PARTY_INCLUDES="${PROTOLOC:-..}"
+if [ ! -d "$THIRD_PARTY_INCLUDES"/third_party/google/api ]; then
     echo "missing $THIRD_PARTY_INCLUDES/third_party/google/api"
-    exit -1
+    exit 1
 fi
 
 mkdir -p lib
-export PROTO_INCLUDE="-I$THIRD_PARTY_INCLUDES/third_party -I /usr/lib/protoc/include"
 
-DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)
+DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
 
-/usr/bin/protoc \
-    $PROTO_INCLUDE  \
-    -I${PROTOLOC:-..} \
-    --plugin=protoc-gen-grpc=$DIR/node_modules/.bin/grpc_tools_node_protoc_plugin \
+protoc \
+    -I"$THIRD_PARTY_INCLUDES"/third_party -I/usr/lib/protoc/include \
+    -I"${PROTOLOC:-..}" \
+    --plugin=protoc-gen-grpc="$DIR"/node_modules/.bin/grpc_tools_node_protoc_plugin \
     --js_out=import_style=commonjs,binary:lib \
     --grpc_out=grpc_js:lib \
-    ${PROTOLOC:-..}/*.proto
+    "${PROTOLOC:-..}"/*.proto
 
-/usr/bin/protoc \
-    $PROTO_INCLUDE \
-    -I${PROTOLOC:-..} \
-    --plugin=protoc-gen-ts=$DIR/node_modules/.bin/protoc-gen-ts \
+protoc \
+    -I"$THIRD_PARTY_INCLUDES"/third_party -I/usr/lib/protoc/include \
+    -I"${PROTOLOC:-..}" \
+    --plugin=protoc-gen-ts="$DIR"/node_modules/.bin/protoc-gen-ts \
     --ts_out=grpc_js:lib \
-    ${PROTOLOC:-..}/*.proto
+    "${PROTOLOC:-..}"/*.proto
 
 sed -i '/google_api_annotations_pb/d' lib/*.js
diff --git a/components/supervisor-api/typescript-grpcweb/build.sh b/components/supervisor-api/typescript-grpcweb/build.sh
index 45c17fe7f9532f..84a96da388e1a1 100755
--- a/components/supervisor-api/typescript-grpcweb/build.sh
+++ b/components/supervisor-api/typescript-grpcweb/build.sh
@@ -3,23 +3,25 @@
 # Licensed under the GNU Affero General Public License (AGPL).
 # See License-AGPL.txt in the project root for license information.
 
-DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)
+DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)
 
 THIRD_PARTY_INCLUDES=${PROTOLOC:-$DIR/..}
-if [ ! -d $THIRD_PARTY_INCLUDES/third_party/google/api ]; then
+if [ ! -d "$THIRD_PARTY_INCLUDES"/third_party/google/api ]; then
     echo "missing $THIRD_PARTY_INCLUDES/third_party/google/api"
-    exit -1
+    exit 1
 fi
 
 
 mkdir -p lib
 export PROTO_INCLUDE="-I$THIRD_PARTY_INCLUDES/third_party -I /usr/lib/protoc/include"
 
-protoc $PROTO_INCLUDE \
+protoc -I"$THIRD_PARTY_INCLUDES"/third_party -I/usr/lib/protoc/include \
     --plugin="protoc-gen-ts=$DIR/node_modules/.bin/protoc-gen-ts" \
     --js_out="import_style=commonjs,binary:lib" \
     --ts_out="service=grpc-web:lib" \
-    -I${PROTOLOC:-..} ${PROTOLOC:-..}/*.proto
+    -I"${PROTOLOC:-..}" "${PROTOLOC:-..}"/*.proto
 
+# shellcheck disable=SC2038
 find lib -iname '*.js' -or -iname '*.ts' | xargs sed -i '\/google\/api\/annotations_pb/d'
-find lib -iname '*.js' -or -iname '*.ts' | xargs sed -i '/google_api_annotations_pb/d'
\ No newline at end of file
+# shellcheck disable=SC2038
+find lib -iname '*.js' -or -iname '*.ts' | xargs sed -i '/google_api_annotations_pb/d'
diff --git a/components/supervisor-api/typescript-rest/build.sh b/components/supervisor-api/typescript-rest/build.sh
old mode 100644
new mode 100755
index 16f42e0269a133..c7eff67135f1d7
--- a/components/supervisor-api/typescript-rest/build.sh
+++ b/components/supervisor-api/typescript-rest/build.sh
@@ -3,19 +3,23 @@
 # Licensed under the GNU Affero General Public License (AGPL).
 # See License-AGPL.txt in the project root for license information.
 
+set -e
+
 go get -v github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2
+
 THIRD_PARTY_INCLUDES=${PROTOLOC:-..}
-if [ ! -d $THIRD_PARTY_INCLUDES/third_party/google/api ]; then
+if [ ! -d "$THIRD_PARTY_INCLUDES"/third_party/google/api ]; then
     echo "missing $THIRD_PARTY_INCLUDES/third_party/google/api"
-    exit -1
+    exit 1
 fi
 
-
 mkdir -p lib
-export PROTO_INCLUDE="-I$THIRD_PARTY_INCLUDES/third_party -I /usr/lib/protoc/include"
 
-protoc $PROTO_INCLUDE --openapiv2_out=logtostderr=true:. -I${PROTOLOC:-..} ${PROTOLOC:-..}/*.proto && \
-mv *.swagger.json lib && \
-for f in $(ls lib/*.swagger.json); do
-    yarn dtsgen -o ${f%.swagger.json}.dt.ts $f
-done
\ No newline at end of file
+protoc \
+    -I"$THIRD_PARTY_INCLUDES"/third_party -I/usr/lib/protoc/include \
+    --openapiv2_out=logtostderr=true:. -I"${PROTOLOC:-..}" "${PROTOLOC:-..}"/*.proto
+
+mv "*.swagger.json" lib 2> /dev/null
+for f in lib/*.swagger.json; do
+    yarn dtsgen -o "${f%.swagger.json}".dt.ts "$f"
+done
diff --git a/components/ws-daemon-api/generate.sh b/components/ws-daemon-api/generate.sh
index 94c301680a663c..22e68a99506382 100755
--- a/components/ws-daemon-api/generate.sh
+++ b/components/ws-daemon-api/generate.sh
@@ -8,15 +8,16 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
-COMPONENTS_DIR=$ROOT_DIR/components
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
+COMPONENTS_DIR="$ROOT_DIR"/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 install_dependencies
-go_protoc $COMPONENTS_DIR
-typescript_protoc $COMPONENTS_DIR
+go_protoc "$COMPONENTS_DIR"
+typescript_protoc "$COMPONENTS_DIR"
 
 # cd go
 pushd go
@@ -28,20 +29,22 @@ mockgen \
 echo "updating JSON tags"
 go get github.com/fatih/gomodifytags
 # remove depreated json tags
-gomodifytags -line 0,$(cat daemon.pb.go|wc -l) -file daemon.pb.go -remove-tags json -w >/dev/null
+# shellcheck disable=SC2002
+gomodifytags -line 0,"$(cat daemon.pb.go|wc -l)" -file daemon.pb.go -remove-tags json -w >/dev/null
 # add new JSON tags
-gomodifytags -line 0,$(cat daemon.pb.go|wc -l) -file daemon.pb.go -add-tags json -transform camelcase -add-options json=omitempty -w >/dev/null
+# shellcheck disable=SC2002
+gomodifytags -line 0,"$(cat daemon.pb.go|wc -l)" -file daemon.pb.go -add-tags json -transform camelcase -add-options json=omitempty -w >/dev/null
 # remove JSON tags for XXX_
 for line in $(grep -n xxx daemon.pb.go | cut -f1 -d: | paste -sd " " -); do
-    gomodifytags -line $line -file daemon.pb.go -remove-tags json -w >/dev/null
-    gomodifytags -line $line -file daemon.pb.go -add-tags json:"-" -w >/dev/null
+    gomodifytags -line "$line" -file daemon.pb.go -remove-tags json -w >/dev/null
+    gomodifytags -line "$line" -file daemon.pb.go -add-tags json:"-" -w >/dev/null
 done
 
 # return to previous directory
 popd
 
 pushd typescript/src
-node $COMPONENTS_DIR/content-service-api/typescript/patch-grpc-js.ts
+node "$COMPONENTS_DIR"/content-service-api/typescript/patch-grpc-js.ts
 popd
 
 update_license
diff --git a/components/ws-daemon/debug.sh b/components/ws-daemon/debug.sh
index b89d40815aed9c..31c1db9a7338db 100755
--- a/components/ws-daemon/debug.sh
+++ b/components/ws-daemon/debug.sh
@@ -8,7 +8,7 @@
 #
 # BEWARE: the properly built version of ws-daemon may behave differently.
 
-docker ps &> /dev/null || (echo "You need a working Docker daemon. Maybe set DOCKER_HOST?"; exit -1)
+docker ps &> /dev/null || (echo "You need a working Docker daemon. Maybe set DOCKER_HOST?"; exit 1)
 gcloud auth list | grep typefox &>/dev/null || (echo "Login using 'gcloud auth login' for the docker push to work"; exit 1)
 
 leeway build .:docker -Dversion=dev
diff --git a/components/ws-daemon/seccomp-profile-installer/generate.sh b/components/ws-daemon/seccomp-profile-installer/generate.sh
deleted file mode 100644
index e69de29bb2d1d6..00000000000000
diff --git a/components/ws-daemon/shiftfs-module-loader/entrypoint.sh b/components/ws-daemon/shiftfs-module-loader/entrypoint.sh
index d47913ec237dfa..657f7b08be2d57 100755
--- a/components/ws-daemon/shiftfs-module-loader/entrypoint.sh
+++ b/components/ws-daemon/shiftfs-module-loader/entrypoint.sh
@@ -8,7 +8,6 @@ DRIVER_NAME=shiftfs
 DRIVER_VERSION=1.2
 ARCH=$(uname -m)
 KERNEL_RELEASE=$(uname -r)
-KERNEL_VERSION=$(uname -v | sed 's/#\([[:digit:]]\+\).*/\1/')
 
 if lsmod | grep $DRIVER_NAME; then
     echo "shiftfs is already loaded - nothing to do here"
@@ -16,7 +15,7 @@ if lsmod | grep $DRIVER_NAME; then
 fi
 
 set -ex
-mkdir -p /lib/modules/${KERNEL_RELEASE}
-ln -s /usr/src_node/linux-headers-${KERNEL_RELEASE} /lib/modules/${KERNEL_RELEASE}/build
-dkms install -m ${DRIVER_NAME} -v ${DRIVER_VERSION} -k $KERNEL_RELEASE --kernelsourcedir /usr/src_node/linux-headers-${KERNEL_RELEASE}
-insmod /var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/${KERNEL_RELEASE}/${ARCH}/module/${DRIVER_NAME}.ko
+mkdir -p /lib/modules/"${KERNEL_RELEASE}"
+ln -s /usr/src_node/linux-headers-"${KERNEL_RELEASE}" /lib/modules/"${KERNEL_RELEASE}"/build
+dkms install -m ${DRIVER_NAME} -v ${DRIVER_VERSION} -k "${KERNEL_RELEASE}" --kernelsourcedir /usr/src_node/linux-headers-"${KERNEL_RELEASE}"
+insmod /var/lib/dkms/${DRIVER_NAME}/${DRIVER_VERSION}/"${KERNEL_RELEASE}"/"${ARCH}"/module/${DRIVER_NAME}.ko
diff --git a/components/ws-manager-api/generate.sh b/components/ws-manager-api/generate.sh
index 42b25ff841fbc6..7ba3fe45c6d71c 100755
--- a/components/ws-manager-api/generate.sh
+++ b/components/ws-manager-api/generate.sh
@@ -8,15 +8,16 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
-COMPONENTS_DIR=$ROOT_DIR/components
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
+COMPONENTS_DIR="$ROOT_DIR"/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 install_dependencies
-go_protoc $COMPONENTS_DIR
-typescript_protoc $COMPONENTS_DIR
+go_protoc "$COMPONENTS_DIR"
+typescript_protoc "$COMPONENTS_DIR"
 
 # cd go
 pushd go
@@ -30,7 +31,7 @@ mockgen \
 popd
 
 pushd typescript/src
-node $COMPONENTS_DIR/content-service-api/typescript/patch-grpc-js.ts
+node "$COMPONENTS_DIR"/content-service-api/typescript/patch-grpc-js.ts
 popd
 
 update_license
diff --git a/components/ws-manager-bridge-api/generate.sh b/components/ws-manager-bridge-api/generate.sh
index e1db19d6ba39d1..839b0a79d49038 100755
--- a/components/ws-manager-bridge-api/generate.sh
+++ b/components/ws-manager-bridge-api/generate.sh
@@ -8,14 +8,15 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-ROOT_DIR=$(cd $(dirname "${BASH_SOURCE}") && pwd -P)/../../
-COMPONENTS_DIR=$ROOT_DIR/components
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd -P)/../../
+COMPONENTS_DIR="$ROOT_DIR"/components
 
 # include protoc bash functions
-source $ROOT_DIR/scripts/protoc-generator.sh
+# shellcheck disable=SC1090,SC1091
+source "$ROOT_DIR"/scripts/protoc-generator.sh
 
 install_dependencies
-go_protoc $COMPONENTS_DIR
-typescript_protoc $COMPONENTS_DIR
+go_protoc "$COMPONENTS_DIR"
+typescript_protoc "$COMPONENTS_DIR"
 
 update_license
diff --git a/components/ws-manager/telepresence.sh b/components/ws-manager/telepresence.sh
index 87bc66e4f2e204..0744a651fbe33f 100755
--- a/components/ws-manager/telepresence.sh
+++ b/components/ws-manager/telepresence.sh
@@ -12,4 +12,4 @@ for h in $(kubectl get pods -l component=ws-daemon --no-headers -o=custom-column
     alsoProxy="${alsoProxy} --also-proxy ${h}"
 done
 
-telepresence ${alsoProxy} --mount /tmp/c --swap-deployment ws-manager --method vpn-tcp --run $0 intp
+telepresence "${alsoProxy}" --mount /tmp/c --swap-deployment ws-manager --method vpn-tcp --run "$0" intp
diff --git a/components/ws-proxy/telepresence.sh b/components/ws-proxy/telepresence.sh
index 4ddf84fc7b8462..1ce00d6b78d0de 100755
--- a/components/ws-proxy/telepresence.sh
+++ b/components/ws-proxy/telepresence.sh
@@ -12,7 +12,7 @@ if [ "$1" == "intp" ]; then
 fi
 
 if [ "$1" == "debug" ]; then
-    telepresence --mount /tmp/c --swap-deployment ws-proxy --method vpn-tcp --run $0 dbg-intp
+    telepresence --mount /tmp/c --swap-deployment ws-proxy --method vpn-tcp --run "$0" dbg-intp
     exit $?
 fi
-telepresence --mount /tmp/c --swap-deployment ws-proxy --method vpn-tcp --run $0 intp
\ No newline at end of file
+telepresence --mount /tmp/c --swap-deployment ws-proxy --method vpn-tcp --run "$0" intp
\ No newline at end of file
diff --git a/install/docker/examples/gitpod-gitlab/certs/create-letsencrypt-certs.sh b/install/docker/examples/gitpod-gitlab/certs/create-letsencrypt-certs.sh
index 68979afc4bc212..66850b47259b4b 100644
--- a/install/docker/examples/gitpod-gitlab/certs/create-letsencrypt-certs.sh
+++ b/install/docker/examples/gitpod-gitlab/certs/create-letsencrypt-certs.sh
@@ -3,7 +3,8 @@
 DOMAIN=example.com
 EMAIL=info@example.com
 
-docker run -it --rm -v $(pwd)/letsencrypt:/letsencrypt --user $(id -u):$(id -g) certbot/certbot certonly \
+# shellcheck disable=SC2035
+docker run -it --rm -v "$(pwd)"/letsencrypt:/letsencrypt --user "$(id -u)":"$(id -g)" certbot/certbot certonly \
     --config-dir /letsencrypt/config \
     --work-dir /letsencrypt/work \
     --logs-dir /letsencrypt/logs \
diff --git a/install/docker/examples/gitpod-gitlab/gitlab/entrypoint.sh b/install/docker/examples/gitpod-gitlab/gitlab/entrypoint.sh
index 416232354993fe..7e2fcf2317e2c6 100755
--- a/install/docker/examples/gitpod-gitlab/gitlab/entrypoint.sh
+++ b/install/docker/examples/gitpod-gitlab/gitlab/entrypoint.sh
@@ -56,6 +56,7 @@ EOF
 
 insertoauth () {
     echo "Waiting for GitLab DB migrations ..."
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get pods | grep gitlab-migrations | grep Completed)" ]; do sleep 10; done
 
     echo "Adding OAuth application to DB ..."
@@ -67,6 +68,7 @@ insertoauth () {
 insertoauth &
 
 installation_completed_hook() {
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get pods --all-namespaces | grep helm-install-gitlab | grep Completed)" ]; do sleep 10; done
 
     echo "Removing installer manifest ..."
@@ -75,23 +77,23 @@ installation_completed_hook() {
 
     echo "Backup secrets ..."
     mkdir -p /var/gitlab/secrets-backup && cd /var/gitlab/secrets-backup
-
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get secrets gitlab-rails-secret | grep Opaque)" ]; do sleep 10; done
-    [ -f gitlab-rails-secret ] && cp gitlab-rails-secret .gitlab-rails-secret_$(date -Iseconds).backup
+    [ -f gitlab-rails-secret ] && cp gitlab-rails-secret .gitlab-rails-secret_"$(date -Iseconds)".backup
     printf "secrets.yml: %s\n" "$(kubectl get secrets gitlab-rails-secret -o jsonpath="{.data['secrets\.yml']}")" > gitlab-rails-secret
-
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get secrets gitlab-postgresql-password | grep Opaque)" ]; do sleep 10; done
-    [ -f gitlab-postgresql-password ] && cp gitlab-postgresql-password .gitlab-postgresql-password_$(date -Iseconds).backup
+    [ -f gitlab-postgresql-password ] && cp gitlab-postgresql-password .gitlab-postgresql-password_"$(date -Iseconds)".backup
     printf "postgresql-password: %s\n" "$(kubectl get secrets gitlab-postgresql-password -o jsonpath='{.data.postgresql-password}')" > gitlab-postgresql-password
     printf "postgresql-postgres-password: %s\n" "$(kubectl get secrets gitlab-postgresql-password -o jsonpath='{.data.postgresql-postgres-password}')" >> gitlab-postgresql-password
-
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get secrets gitlab-gitlab-runner-secret | grep Opaque)" ]; do sleep 10; done
-    [ -f gitlab-gitlab-runner-secret ] && cp gitlab-gitlab-runner-secret .gitlab-gitlab-runner-secret_$(date -Iseconds).backup
+    [ -f gitlab-gitlab-runner-secret ] && cp gitlab-gitlab-runner-secret .gitlab-gitlab-runner-secret_"$(date -Iseconds)".backup
     printf "runner-registration-token: %s\n" "$(kubectl get secrets gitlab-gitlab-runner-secret -o jsonpath='{.data.runner-registration-token}')" > gitlab-gitlab-runner-secret
     printf "runner-token: %s\n" "$(kubectl get secrets gitlab-gitlab-runner-secret -o jsonpath='{.data.runner-token}')" >> gitlab-gitlab-runner-secret
-
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get secrets gitlab-gitlab-initial-root-password | grep Opaque)" ]; do sleep 10; done
-    [ -f gitlab-gitlab-initial-root-password ] && cp gitlab-gitlab-initial-root-password .gitlab-gitlab-initial-root-password_$(date -Iseconds).backup
+    [ -f gitlab-gitlab-initial-root-password ] && cp gitlab-gitlab-initial-root-password .gitlab-gitlab-initial-root-password_"$(date -Iseconds)".backup
     printf "password: %s\n" "$(kubectl get secrets gitlab-gitlab-initial-root-password -o jsonpath='{.data.password}')" > gitlab-gitlab-initial-root-password
 }
 installation_completed_hook &
@@ -115,6 +117,7 @@ EOF
 # restore secrets
 if [ -d /var/gitlab/secrets-backup ]; then
     cd /var/gitlab/secrets-backup
+    # shellcheck disable=SC2045
     for s in $(ls); do
         echo "Restoring secret $s ..."
         cat << EOF > "/var/lib/rancher/k3s/server/manifests/$s.yaml"
diff --git a/install/docker/gitpod-image/entrypoint.sh b/install/docker/gitpod-image/entrypoint.sh
index 037ce242412c29..ea9e98afbfe854 100755
--- a/install/docker/gitpod-image/entrypoint.sh
+++ b/install/docker/gitpod-image/entrypoint.sh
@@ -17,12 +17,12 @@ HELMIMAGE=${HELMIMAGE:-alpine/helm:3.2.4}           # Image that is used for the
 mkdir -p /values
 
 
-if [ ! -z "$BASEDOMAIN" ] && [ -z "$DOMAIN" ]; then
+if [ -n "$BASEDOMAIN" ] && [ -z "$DOMAIN" ]; then
     DOMAIN="gitpod.$BASEDOMAIN"
     export DOMAIN
 fi
 
-if [ -z "$BASEDOMAIN" ] && [ ! -z "$DOMAIN" ]; then
+if [ -z "$BASEDOMAIN" ] && [ -n "$DOMAIN" ]; then
     BASEDOMAIN="$DOMAIN"
     export BASEDOMAIN
 fi
@@ -69,7 +69,7 @@ add_nameserver() {
 TCP_DNS_ADDR=$(iptables-save | grep DOCKER_OUTPUT | grep tcp | grep -o '127\.0\.0\.11:.*$' || printf '')
 UDP_DNS_ADDR=$(iptables-save | grep DOCKER_OUTPUT | grep udp | grep -o '127\.0\.0\.11:.*$' || printf '')
 
-if [ ! -z "$TCP_DNS_ADDR" ] && [ ! -z "$UDP_DNS_ADDR" ]; then
+if [ -n "$TCP_DNS_ADDR" ] && [ -n "$UDP_DNS_ADDR" ]; then
     iptables -t nat -A PREROUTING -p tcp --dport 53 -j DNAT --to "$TCP_DNS_ADDR"
     iptables -t nat -A PREROUTING -p udp --dport 53 -j DNAT --to "$UDP_DNS_ADDR"
 
@@ -161,6 +161,7 @@ configs:
 EOF
 
     echo "Waiting for builtin-registry-certs secrets ..."
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get secrets builtin-registry-certs |  grep builtin-registry-certs | grep Opaque)" ]; do sleep 10; done
 
     # save registry certs for k3s
@@ -188,6 +189,7 @@ kubeconfig_replaceip() {
 kubeconfig_replaceip &
 
 installation_completed_hook() {
+    # shellcheck disable=SC2143
     while [ -z "$(kubectl get pods | grep gitpod-helm-installer | grep Completed)" ]; do sleep 10; done
 
     echo "Removing installer manifest ..."
diff --git a/install/installer/entrypoint.sh b/install/installer/entrypoint.sh
index c129d96e9eca90..8161a71a5b0e45 100755
--- a/install/installer/entrypoint.sh
+++ b/install/installer/entrypoint.sh
@@ -3,7 +3,7 @@
 # Licensed under the GNU Affero General Public License (AGPL).
 # See License-AGPL.txt in the project root for license information.
 
+# shellcheck disable=SC1090,SC1091
+source "$HOME"/google-cloud-sdk/path.bash.inc
 
-source $HOME/google-cloud-sdk/path.bash.inc
-
-gp-install $*
\ No newline at end of file
+gp-install "$@"
diff --git a/scripts/branch-namespace.sh b/scripts/branch-namespace.sh
index 2362741035b044..ed8a5601207a7b 100755
--- a/scripts/branch-namespace.sh
+++ b/scripts/branch-namespace.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 
-branch=`git symbolic-ref HEAD 2>&1` || error "cannot set kubectl namespace: no branch"
-currentContext=`kubectl config current-context 2>&1` || error "cannot set kubectl namespace: no current context"
-namespace=staging-`echo "$branch" | awk '{ sub(/^refs\/heads\//, ""); $0 = tolower($0); gsub(/[^-a-z0-9]/, "-"); print }'`
+branch=$(git symbolic-ref HEAD 2>&1) || error "cannot set kubectl namespace: no branch"
+currentContext=$(kubectl config current-context 2>&1) || error "cannot set kubectl namespace: no current context"
+namespace=staging-$(echo "$branch" | awk '{ sub(/^refs\/heads\//, ""); $0 = tolower($0); gsub(/[^-a-z0-9]/, "-"); print }')
 
 echo "Setting kubectl namespace: $namespace"
 kubectl config set-context "$currentContext" --namespace "$namespace"
diff --git a/scripts/go-licenses.sh b/scripts/go-licenses.sh
index b53cb33ca0e697..11ce0bbbf68bdc 100755
--- a/scripts/go-licenses.sh
+++ b/scripts/go-licenses.sh
@@ -5,25 +5,25 @@ if [ "A$GITHUB_TOKEN" = "A" ]; then
     exit 1
 fi
 
-cd $(dirname "$0")/..
+cd "$(dirname "$0")/.." || exit
 out=$PWD
 
 tmpdir=$(mktemp -d)
-(cd $tmpdir; curl -L https://github.com/mitchellh/golicense/releases/download/v0.1.1/golicense_0.1.1_linux_x86_64.tar.gz | tar xzv)
-golicense=$tmpdir/golicense
+(cd "$tmpdir" || exit; curl -L https://github.com/mitchellh/golicense/releases/download/v0.1.1/golicense_0.1.1_linux_x86_64.tar.gz | tar xzv)
+golicense="$tmpdir"/golicense
 
-for i in $(ls components); do
+for i in ls components; do
     if [ -f "components/$i/go.mod" ]; then
         echo "building $i"
-        cd components/$i
+        cd components/"$i" || exit
         go build -o exec
 
         echo "checking $i"
-        timeout 60 $golicense -plain -license=true exec >> $out/licenses.$i.txt
+        timeout 60 "$golicense" -plain -license=true exec >> "$out"/licenses.$i.txt
         rm exec
-        cd -
+        cd - || exit
     fi
 done
 
-cat licenses.*.txt | sort | tr -s ' ' | uniq | sed -r 's/\s+/,/' | column -s , -t > $out/License.third-party.go.txt
-echo "Output written to $out/License.third-party.go.txt"
\ No newline at end of file
+cat licenses.*.txt | sort | tr -s ' ' | uniq | sed -r 's/\s+/,/' | column -s , -t > "$out"/License.third-party.go.txt
+echo "Output written to $out/License.third-party.go.txt"
diff --git a/scripts/protoc-generator.sh b/scripts/protoc-generator.sh
index c21925e8034a50..4f16331ab1c340 100755
--- a/scripts/protoc-generator.sh
+++ b/scripts/protoc-generator.sh
@@ -16,9 +16,9 @@ install_dependencies() {
 
 go_protoc() {
     local ROOT_DIR=$1
-
+    # shellcheck disable=2035
     protoc \
-        -I /usr/lib/protoc/include -I$ROOT_DIR -I. \
+        -I /usr/lib/protoc/include -I"$ROOT_DIR" -I. \
         --go_out=go \
         --go_opt=paths=source_relative \
         --go-grpc_out=go \
@@ -34,28 +34,29 @@ typescript_protoc() {
     # Should be done in a separate line.
     MODULE_DIR=$(pwd)
 
-    pushd typescript > /dev/null
+    pushd typescript > /dev/null || exit
 
     yarn install
 
-    rm -rf $MODULE_DIR/typescript/src/*pb*.*
+    rm -rf "$MODULE_DIR"/typescript/src/*pb*.*
 
     protoc \
-        --plugin=protoc-gen-grpc=$MODULE_DIR/typescript/node_modules/.bin/grpc_tools_node_protoc_plugin \
+        --plugin=protoc-gen-grpc="$MODULE_DIR"/typescript/node_modules/.bin/grpc_tools_node_protoc_plugin \
         --js_out=import_style=commonjs,binary:src \
         --grpc_out=grpc_js:src \
-        -I /usr/lib/protoc/include -I$ROOT_DIR -I. -I$MODULE_DIR \
-        $MODULE_DIR/*.proto
+        -I /usr/lib/protoc/include -I"$ROOT_DIR" -I. -I"$MODULE_DIR" \
+        "$MODULE_DIR"/*.proto
 
     protoc \
-        --plugin=protoc-gen-ts=$MODULE_DIR/typescript/node_modules/.bin/protoc-gen-ts \
+        --plugin=protoc-gen-ts="$MODULE_DIR"/typescript/node_modules/.bin/protoc-gen-ts \
         --ts_out=grpc_js:src \
-        -I /usr/lib/protoc/include -I$ROOT_DIR -I. -I$MODULE_DIR \
-        $MODULE_DIR/*.proto
+        -I /usr/lib/protoc/include -I"$ROOT_DIR" -I. -I"$MODULE_DIR" \
+        "$MODULE_DIR"/*.proto
 
-    ls -1 $MODULE_DIR/typescript/src/*_pb.d.ts | xargs sed -i -e "s/[[:space:]]*$//"
+    # shellcheck disable=SC2011
+    ls -1 "$MODULE_DIR"/typescript/src/*_pb.d.ts | xargs sed -i -e "s/[[:space:]]*$//" || exit
 
-    popd > /dev/null
+    popd > /dev/null || exit
 }
 
 update_license() {
diff --git a/test/entrypoint.sh b/test/entrypoint.sh
index 4f705caa1bdd12..b29d88399cd636 100755
--- a/test/entrypoint.sh
+++ b/test/entrypoint.sh
@@ -5,6 +5,7 @@
 
 set -ex
 
+# shellcheck disable=SC2045
 for i in $(ls /tests/*.test); do
-    $i $*;
+    "$i" "$@";
 done
diff --git a/test/leeway-build.sh b/test/leeway-build.sh
index 29bb7333a32824..41372480e6e8e7 100755
--- a/test/leeway-build.sh
+++ b/test/leeway-build.sh
@@ -6,14 +6,16 @@
 
 mkdir -p bin
 
+# shellcheck disable=SC2044
 for i in $(find . -type d -name "*_agent"); do
-    echo building agent $i
-    base=$(basename $i)
-    CGO_ENABLED=0 go build -o bin/gitpod-integration-test-${base%_agent}-agent $i
+    echo building agent "$i"
+    base=$(basename "$i")
+    CGO_ENABLED=0 go build -o bin/gitpod-integration-test-"${base%_agent}"-agent "$i"
 done
 
+# shellcheck disable=SC2045
 for i in $(ls tests/); do
-    echo building test $i
-    CGO_ENABLED=0 go test -c ./tests/$i
-    mv $i.test bin
-done
\ No newline at end of file
+    echo building test "$i"
+    CGO_ENABLED=0 go test -c ./tests/"$i"
+    mv "$i".test bin
+done

From f6fa84e6b4691aa9456e4536acf51e2f18fc97d9 Mon Sep 17 00:00:00 2001
From: Manuel Alejandro de Brito Fontes <aledbf@gmail.com>
Date: Thu, 3 Jun 2021 21:59:06 -0400
Subject: [PATCH 2/2] Remove unused module for swagger generation

---
 components/BUILD.yaml                         |  2 +-
 .../supervisor-api/typescript-rest/.gitignore |  1 -
 .../supervisor-api/typescript-rest/BUILD.yaml | 29 -------------------
 .../supervisor-api/typescript-rest/build.sh   | 25 ----------------
 .../typescript-rest/package.json              | 15 ----------
 .../typescript-rest/tsconfig.json             | 28 ------------------
 6 files changed, 1 insertion(+), 99 deletions(-)
 delete mode 100644 components/supervisor-api/typescript-rest/.gitignore
 delete mode 100644 components/supervisor-api/typescript-rest/BUILD.yaml
 delete mode 100755 components/supervisor-api/typescript-rest/build.sh
 delete mode 100644 components/supervisor-api/typescript-rest/package.json
 delete mode 100644 components/supervisor-api/typescript-rest/tsconfig.json

diff --git a/components/BUILD.yaml b/components/BUILD.yaml
index f0b3a2cb50a996..947ce3d136e778 100644
--- a/components/BUILD.yaml
+++ b/components/BUILD.yaml
@@ -108,7 +108,7 @@ scripts:
         popd > /dev/null
       done
 
-      WEB_COMPONENTS=( local-app-api/typescript-grpcweb supervisor-api/typescript-grpc supervisor-api/typescript-rest supervisor-api/typescript-grpcweb )
+      WEB_COMPONENTS=( local-app-api/typescript-grpcweb supervisor-api/typescript-grpc supervisor-api/typescript-grpcweb )
       for COMPONENT in "${WEB_COMPONENTS[@]}";do
         echo "Generating code for component $COMPONENT..."
         pushd $COMPONENT > /dev/null
diff --git a/components/supervisor-api/typescript-rest/.gitignore b/components/supervisor-api/typescript-rest/.gitignore
deleted file mode 100644
index f1ff06d608f039..00000000000000
--- a/components/supervisor-api/typescript-rest/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-lib/
\ No newline at end of file
diff --git a/components/supervisor-api/typescript-rest/BUILD.yaml b/components/supervisor-api/typescript-rest/BUILD.yaml
deleted file mode 100644
index fd13f434d83f39..00000000000000
--- a/components/supervisor-api/typescript-rest/BUILD.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-packages:
-  - name: lib
-    type: yarn
-    srcs:
-      - package.json
-      - build.sh
-    deps:
-      - components/supervisor-api:proto
-    env:
-      - PROTOLOC=components-supervisor-api--proto
-    config:
-      packaging: library
-      dontTest: true
-      commands:
-        build: ["yarn", "build"]
-      yarnLock: ${coreYarnLockBase}/../yarn.lock
-      tsconfig: tsconfig.json
-  - name: publish
-    type: generic
-    env:
-      - DO_PUBLISH=${publishToNPM}
-    argdeps:
-      - npmPublishTrigger
-    deps:
-      - :lib
-      - components/gitpod-protocol:scripts
-    config:
-      commands:
-        - ["node", "components-gitpod-protocol--scripts/publish.js", "${version}", "components-supervisor-api-typescript-rest--lib/package"]
diff --git a/components/supervisor-api/typescript-rest/build.sh b/components/supervisor-api/typescript-rest/build.sh
deleted file mode 100755
index c7eff67135f1d7..00000000000000
--- a/components/supervisor-api/typescript-rest/build.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/bin/bash
-# Copyright (c) 2020 Gitpod GmbH. All rights reserved.
-# Licensed under the GNU Affero General Public License (AGPL).
-# See License-AGPL.txt in the project root for license information.
-
-set -e
-
-go get -v github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-openapiv2
-
-THIRD_PARTY_INCLUDES=${PROTOLOC:-..}
-if [ ! -d "$THIRD_PARTY_INCLUDES"/third_party/google/api ]; then
-    echo "missing $THIRD_PARTY_INCLUDES/third_party/google/api"
-    exit 1
-fi
-
-mkdir -p lib
-
-protoc \
-    -I"$THIRD_PARTY_INCLUDES"/third_party -I/usr/lib/protoc/include \
-    --openapiv2_out=logtostderr=true:. -I"${PROTOLOC:-..}" "${PROTOLOC:-..}"/*.proto
-
-mv "*.swagger.json" lib 2> /dev/null
-for f in lib/*.swagger.json; do
-    yarn dtsgen -o "${f%.swagger.json}".dt.ts "$f"
-done
diff --git a/components/supervisor-api/typescript-rest/package.json b/components/supervisor-api/typescript-rest/package.json
deleted file mode 100644
index 2e80823e44ebfe..00000000000000
--- a/components/supervisor-api/typescript-rest/package.json
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-  "name": "@gitpod/supervisor-api-rest",
-  "version": "0.1.5",
-  "license": "UNLICENSED",
-  "scripts": {
-    "build": "sh build.sh"
-  },
-  "files": [
-    "lib"
-  ],
-  "dependencies": {},
-  "devDependencies": {
-    "dtsgenerator": "~3.3.0"
-  }
-}
diff --git a/components/supervisor-api/typescript-rest/tsconfig.json b/components/supervisor-api/typescript-rest/tsconfig.json
deleted file mode 100644
index 3078b28e5b67c9..00000000000000
--- a/components/supervisor-api/typescript-rest/tsconfig.json
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-    "compilerOptions": {
-        "rootDir": "src",
-        "experimentalDecorators": true,
-        "outDir": "lib",
-        "lib": [
-            "es6",
-            "esnext.asynciterable"
-        ],
-        "strict": true,
-        "noEmitOnError": false,
-        "noUnusedLocals": true,
-        "emitDecoratorMetadata": true,
-        "strictPropertyInitialization": false,
-        "downlevelIteration": true,
-        "module": "commonjs",
-        "moduleResolution": "node",
-        "target": "es5",
-        "jsx": "react",
-        "sourceMap": true,
-        "declaration": true,
-        "declarationMap": true,
-        "skipLibCheck": true
-    },
-    "include": [
-        "src"
-    ]
-}
\ No newline at end of file