diff --git a/auto/build b/auto/build
index ed0fa95d856d36abd5918bac357809592b6c10c2..72648a9a614b1a0bc919ada2ba79fe0630f0646a 100755
--- a/auto/build
+++ b/auto/build
@@ -155,7 +155,7 @@ if [ -d "$WORKAROUNDS_SRC" ]; then
 fi
 
 echo "I: Building ISO image ${BUILD_ISO_FILENAME}..."
-time lb build noauto ${@}
+time lb build noauto "${@}"
 [ -e binary.iso ] || fatal "lb build failed ($?)."
 
 echo "I: ISO image was successfully created"
diff --git a/auto/clean b/auto/clean
index c93b7ed5e3cce95216d8f9fb4c05d30b743ef38b..b347603e907ad75929f7904e296064a6f777c759 100755
--- a/auto/clean
+++ b/auto/clean
@@ -10,7 +10,7 @@ for dir in chroot/{dev/pts,proc,sys,var/lib/dpkg} ; do
    fi
 done
 
-lb clean noauto ${@}
+lb clean noauto "${@}"
 
 # rm -f build-*.log
 
diff --git a/auto/config b/auto/config
index 7c1cc56d0c37f2628689167432e4ea57febaae70..88faf2bf542e5a73357e3f446eb772e9e54085f7 100755
--- a/auto/config
+++ b/auto/config
@@ -91,7 +91,7 @@ export LB_BOOTSTRAP_INCLUDE="gnupg"
 RUN_LB_CONFIG="lb config noauto"
 
 # init config/ with defaults for the target distribution
-$RUN_LB_CONFIG --distribution buster ${@}
+$RUN_LB_CONFIG --distribution buster "${@}"
 
 # set up everything for time-based snapshots:
 if [ -n "${APT_SNAPSHOTS_SERIALS:-}" ]; then
@@ -159,7 +159,7 @@ $RUN_LB_CONFIG \
    --syslinux-splash data/splash.png \
    --syslinux-timeout 4 \
    --initramfs=live-boot \
-   ${@}
+   "${@}"
 
 install -d config/chroot_local-includes/etc/amnesia/
 
diff --git a/auto/scripts/tails-custom-apt-sources b/auto/scripts/tails-custom-apt-sources
index b3c1856923f88d89d3f62ed3ba70e604bbd6d3ed..8d1c4a74c8de956908f544d9c6d825420a2aa7ae 100755
--- a/auto/scripts/tails-custom-apt-sources
+++ b/auto/scripts/tails-custom-apt-sources
@@ -16,9 +16,14 @@ output_apt_binary_source() {
 }
 
 output_overlay_apt_binary_sources() {
-	for suite in $(ls config/APT_overlays.d) ; do
+	cd config/APT_overlays.d/
+	for suite in * ; do
+		# handle the case when no APT overlay is enabled
+		[[ -e "$suite" ]] || break
+
 		output_apt_binary_source "$suite"
 	done
+	cd ../../
 }
 
 ### Sanity checks
diff --git a/auto/scripts/utils.sh b/auto/scripts/utils.sh
index 0b791fb9c9b4976b474826a342ac341aec0b8b94..6a6546c0249631e42b0ea17ab8de4b752ee4fe47 100755
--- a/auto/scripts/utils.sh
+++ b/auto/scripts/utils.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=bash
 # This library is meant to be used in bash, with "set -e" and "set -u".
 
 BASE_BRANCHES="stable testing devel"
diff --git a/config/chroot_local-hooks/50-dkms b/config/chroot_local-hooks/50-dkms
index 513a092f8466f258eca14590519cd464189f2256..bb6bcd4b365c6159bf7828ec96120237e05aa8b8 100755
--- a/config/chroot_local-hooks/50-dkms
+++ b/config/chroot_local-hooks/50-dkms
@@ -18,7 +18,8 @@ ensure_hook_dependency_is_installed dkms
 ensure_hook_dependency_is_installed \
    virtualbox-guest-dkms
 
-for log in $(ls /var/lib/dkms/*/*/build/make.log); do
+for log in /var/lib/dkms/*/*/build/make.log; do
+   [ -e "$log" ] || break  # handle the case when no file matched the glob
    echo "---- $log"
    cat "$log"
 done
diff --git a/config/chroot_local-includes/usr/local/bin/tails-delete-persistent-volume b/config/chroot_local-includes/usr/local/bin/tails-delete-persistent-volume
index 1da2f5992d699146c0e20fb9f57800fdbdc84a8e..515c99161c5ba47c133bf60600e6a37818f3f93a 100755
--- a/config/chroot_local-includes/usr/local/bin/tails-delete-persistent-volume
+++ b/config/chroot_local-includes/usr/local/bin/tails-delete-persistent-volume
@@ -6,5 +6,5 @@ RUN_AS_USER=tails-persistence-setup
 
 cd /
 xhost +SI:localuser:"$RUN_AS_USER"
-sudo -u "$RUN_AS_USER" /usr/bin/tails-persistence-setup --step delete $@
+sudo -u "$RUN_AS_USER" /usr/bin/tails-persistence-setup --step delete "$@"
 xhost -SI:localuser:"$RUN_AS_USER"
diff --git a/config/chroot_local-includes/usr/local/bin/tails-persistence-setup.wrapper b/config/chroot_local-includes/usr/local/bin/tails-persistence-setup.wrapper
index 22777cada09cc44c5bc8c878b1a60d005ca2163b..09119672380fa6b00ae1364573c08ac92267a5c5 100755
--- a/config/chroot_local-includes/usr/local/bin/tails-persistence-setup.wrapper
+++ b/config/chroot_local-includes/usr/local/bin/tails-persistence-setup.wrapper
@@ -6,5 +6,5 @@ RUN_AS_USER=tails-persistence-setup
 
 cd /
 xhost +SI:localuser:"$RUN_AS_USER"
-sudo -u "$RUN_AS_USER" /usr/bin/tails-persistence-setup $@
+sudo -u "$RUN_AS_USER" /usr/bin/tails-persistence-setup "$@"
 xhost -SI:localuser:"$RUN_AS_USER"
diff --git a/config/chroot_local-includes/usr/local/lib/tails-shell-library/gnome.sh b/config/chroot_local-includes/usr/local/lib/tails-shell-library/gnome.sh
index b3a26d6a004ec12fcde7b55aa8d2f48fa6161d2d..0ae63e0d8da0a9dc7321f945dceb5c003e643d8d 100644
--- a/config/chroot_local-includes/usr/local/lib/tails-shell-library/gnome.sh
+++ b/config/chroot_local-includes/usr/local/lib/tails-shell-library/gnome.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=sh
 GNOME_ENV_VARS="
 DBUS_SESSION_BUS_ADDRESS
 DISPLAY
diff --git a/config/chroot_local-includes/usr/local/lib/tails-shell-library/hardware.sh b/config/chroot_local-includes/usr/local/lib/tails-shell-library/hardware.sh
index 0f63022fdb768ec4895ec256ada6bbfd96d23690..d148cf82487184e780da0ef5c5ddc695ee8bfb0e 100644
--- a/config/chroot_local-includes/usr/local/lib/tails-shell-library/hardware.sh
+++ b/config/chroot_local-includes/usr/local/lib/tails-shell-library/hardware.sh
@@ -56,7 +56,7 @@ get_name_of_nic() {
 mod_rev_dep_aux() {
   local mod
   local rev_deps
-  for mod in ${@}; do
+  for mod in "${@}"; do
     if echo ${MOD_REV_DEP_VISITED} | grep -qw ${mod}; then
         continue
     fi
diff --git a/config/chroot_local-includes/usr/local/lib/tails-shell-library/po.sh b/config/chroot_local-includes/usr/local/lib/tails-shell-library/po.sh
index 05a56680718e865b970f80d76398c6c15ba2a864..8563a90c3b250e6eb0e284726968f3ddd32d7d25 100644
--- a/config/chroot_local-includes/usr/local/lib/tails-shell-library/po.sh
+++ b/config/chroot_local-includes/usr/local/lib/tails-shell-library/po.sh
@@ -1,3 +1,4 @@
+# shellcheck shell=sh
 # This shell library is meant to be used with `set -e` and `set -u`.
 
 po_languages () {
diff --git a/config/chroot_local-includes/usr/local/sbin/live-persist b/config/chroot_local-includes/usr/local/sbin/live-persist
index ce0c6d9dd46628a25a6d0401c880cf53a176b260..85389ca0d2f3e16efe6e23098902b59cc1c6e210 100755
--- a/config/chroot_local-includes/usr/local/sbin/live-persist
+++ b/config/chroot_local-includes/usr/local/sbin/live-persist
@@ -2,13 +2,13 @@
 
 error ()
 {
-	echo "error: ${@}" >&2
+	echo "error: ${*}" >&2
 	exit 1
 }
 
 warning ()
 {
-	echo "warning: ${@}" >&2
+	echo "warning: ${*}" >&2
 }
 
 # import Cmdline_old()
@@ -131,13 +131,13 @@ migrate_persistence_preset()
 # We override live-boot's logging facilities to get more useful error messages
 log_warning_msg ()
 {
-	warning ${@}
+	warning "${@}"
 }
 
 # We override live-boot's panic() since it does a lot of crazy stuff
 panic ()
 {
-	error ${@}
+	error "${@}"
 }
 
 list_gpt_volumes ()
@@ -567,7 +567,7 @@ main ()
 			list_gpt_volumes ${labels}
 			;;
 		activate|close)
-			if ! echo ${@} | grep -qe "[^[:space:]]"
+			if ! echo "${@}" | grep -qe "[^[:space:]]"
 			then
 				error "you must specify at least one volume"
 			fi
@@ -582,4 +582,4 @@ main ()
 	esac
 }
 
-main ${@}
+main "${@}"
diff --git a/debian/changelog b/debian/changelog
index ec8a0d2282b8d70c79e46feed348bd53e8c475da..df97e114a1e525d0988030cda48f460b4dc67322 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+tails (4.9) UNRELEASED; urgency=medium
+
+  * Dummy entry for next release.
+
+ -- anonym <anonym@riseup.net>  Wed, 01 Jul 2020 11:05:21 +0200
+
 tails (4.8) unstable; urgency=medium
 
   * Major changes
diff --git a/release b/release
index 3cde1070278d38e70064eb1912bd29ec35daa0a9..7d1ebdd874e1b04ea053af6c428c95d0e3f8debe 100755
--- a/release
+++ b/release
@@ -28,7 +28,7 @@ fi
 ### helper functions
 
 fatal () {
-   echo "Fatal: $@" >&2
+   echo "Fatal: $*" >&2
    exit 2
 }
 
@@ -56,7 +56,7 @@ export DEBEMAIL="${AMNESIA_DEV_EMAIL}"
 echo "Updating debian/changelog from Git history..."
 gbp dch \
    `if [ ${SNAPSHOT} = yes ]; then echo '--snapshot --auto' ; fi` \
-   `if [ ${SNAPSHOT} = no -a -n ${SINCE} ]; then echo "--since=${SINCE}" ; fi` \
+   `if [ ${SNAPSHOT} = no -a -n "${SINCE}" ]; then echo "--since=${SINCE}" ; fi` \
    `if [ ${SNAPSHOT} = no -a -z ${SINCE} ]; then echo "--auto" ; fi` \
    --new-version="${NEW_VERSION}" \
    --ignore-branch \
diff --git a/wiki/src/contribute/how/mirror/automatically_download_and_seed_Tails_over_BitTorrent/rtorrent b/wiki/src/contribute/how/mirror/automatically_download_and_seed_Tails_over_BitTorrent/rtorrent
index db952bfffcc469311f0d8cdec8154bcb20f4901a..6b3fdcd6dff516c2a0171b35177feccb50c05b9f 100644
--- a/wiki/src/contribute/how/mirror/automatically_download_and_seed_Tails_over_BitTorrent/rtorrent
+++ b/wiki/src/contribute/how/mirror/automatically_download_and_seed_Tails_over_BitTorrent/rtorrent
@@ -1,146 +1,146 @@
-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:          rtorrent_autostart
-# Required-Start:    $local_fs $remote_fs $network $syslog $netdaemons
-# Required-Stop:     $local_fs $remote_fs
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: rtorrent script using screen(1)
-# Description:       rtorrent script using screen(1) to keep torrents working without the user logging in
-### END INIT INFO
-#############
-###<Notes>###
-#############
-# This script depends on screen.
-# For the stop function to work, you must set an
-# explicit session directory using ABSOLUTE paths (no, ~ is not absolute) in your rtorrent.rc.
-# If you typically just start rtorrent with just "rtorrent" on the
-# command line, all you need to change is the "user" option.
-# Attach to the screen session as your user with 
-# "screen -dr rtorrent". Change "rtorrent" with srnname option.
-# Licensed under the GPLv2 by lostnihilist: lostnihilist _at_ gmail _dot_ com
-##############
-###</Notes>###
-##############
-
-#######################
-##Start Configuration##
-#######################
-# You can specify your configuration in a different file 
-# (so that it is saved with upgrades, saved in your home directory,
-# or whateve reason you want to)
-# by commenting out/deleting the configuration lines and placing them
-# in a text file (say /home/user/.rtorrent.init.conf) exactly as you would
-# have written them here (you can leave the comments if you desire
-# and then uncommenting the following line correcting the path/filename 
-# for the one you used. note the space after the ".".
-# . /etc/rtorrent.init.conf
-
-#Do not put a space on either side of the equal signs e.g.
-# user = user 
-# will not work
-# system user to run as
-user="USERNAME"
-
-# the system group to run as, not implemented, see d_start for beginning implementation
-# group=`id -ng "$user"`
-
-# the full path to the filename where you store your rtorrent configuration
-config="`su -c 'echo $HOME' $user`/.rtorrent.rc"
-
-# set of options to run with
-options=""
-
-# default directory for screen, needs to be an absolute path
-base="`su -c 'echo $HOME' $user`/.rtorrent"
-
-# name of screen session
-srnname="rtorrent"
-
-# file to log to (makes for easier debugging if something goes wrong)
-logfile="/var/log/rtorrentInit.log"
-#######################
-###END CONFIGURATION###
-#######################
-PATH=/usr/bin:/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin
-DESC="rtorrent"
-NAME=rtorrent
-DAEMON=$NAME
-SCRIPTNAME=/etc/init.d/$NAME
-
-checkcnfg() {
-    exists=0
-    for i in `echo "$PATH" | tr ':' '\n'` ; do
-        if [ -f $i/$NAME ] ; then
-            exists=1
-            break
-        fi
-    done
-    if [ $exists -eq 0 ] ; then
-        echo "cannot find rtorrent binary in PATH $PATH" | tee -a "$logfile" >&2
-        exit 3
-    fi
-    if ! [ -r "${config}" ] ; then 
-        echo "cannot find readable config ${config}. check that it is there and permissions are appropriate" | tee -a "$logfile" >&2
-        exit 3 
-    fi 
-    session=`getsession "$config"` 
-    if ! [ -d "${session}" ] ; then
-        echo "cannot find readable session directory ${session} from config ${config}. check permissions" | tee -a "$logfile" >&2
-        exit 3
-    fi
-}
-
-d_start() {
-  [ -d "${base}" ] && cd "${base}"
-  stty stop undef && stty start undef
-  su -c "screen -ls | grep -sq "\.${srnname}[[:space:]]" " ${user} || su -c "screen -dm -S ${srnname} 2>&1 1>/dev/null" ${user} | tee -a "$logfile" >&2
-  # this works for the screen command, but starting rtorrent below adopts screen session gid
-  # even if it is not the screen session we started (e.g. running under an undesirable gid
-  #su -c "screen -ls | grep -sq "\.${srnname}[[:space:]]" " ${user} || su -c "sg \"$group\" -c \"screen -fn -dm -S ${srnname} 2>&1 1>/dev/null\"" ${user} | tee -a "$logfile" >&2
-  su -c "screen -S "${srnname}" -X screen rtorrent ${options} 2>&1 1>/dev/null" ${user} | tee -a "$logfile" >&2
-}
-
-d_stop() {
-    session=`getsession "$config"`
-    if ! [ -s ${session}/rtorrent.lock ] ; then
-        return
-    fi
-    pid=`cat ${session}/rtorrent.lock | awk -F: '{print($2)}' | sed "s/[^0-9]//g"`
-    if ps -A | grep -sq ${pid}.*rtorrent ; then # make sure the pid doesn't belong to another process
-        kill -s INT ${pid}
-    fi
-}
-
-getsession() { 
-    session=`cat "$1" | grep "^[[:space:]]*session[[:space:]]*=" | sed "s/^[[:space:]]*session[[:space:]]*=[[:space:]]*//" `
-    echo $session
-}
-
-checkcnfg
-
-case "$1" in
-  start)
-    echo -n "Starting $DESC: $NAME"
-    d_start
-    echo "."
-    ;;
-  stop)
-    echo -n "Stopping $DESC: $NAME"
-    d_stop
-    echo "."
-    ;;
-  restart|force-reload)
-    echo -n "Restarting $DESC: $NAME"
-    d_stop
-    sleep 1
-    d_start
-    echo "."
-    ;;
-  *)
-    echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
-    exit 1
-    ;;
-esac
-
-exit 0
\ No newline at end of file
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides:          rtorrent_autostart
+# Required-Start:    $local_fs $remote_fs $network $syslog $netdaemons
+# Required-Stop:     $local_fs $remote_fs
+# Default-Start:     2 3 4 5
+# Default-Stop:      0 1 6
+# Short-Description: rtorrent script using screen(1)
+# Description:       rtorrent script using screen(1) to keep torrents working without the user logging in
+### END INIT INFO
+#############
+###<Notes>###
+#############
+# This script depends on screen.
+# For the stop function to work, you must set an
+# explicit session directory using ABSOLUTE paths (no, ~ is not absolute) in your rtorrent.rc.
+# If you typically just start rtorrent with just "rtorrent" on the
+# command line, all you need to change is the "user" option.
+# Attach to the screen session as your user with
+# "screen -dr rtorrent". Change "rtorrent" with srnname option.
+# Licensed under the GPLv2 by lostnihilist: lostnihilist _at_ gmail _dot_ com
+##############
+###</Notes>###
+##############
+
+#######################
+##Start Configuration##
+#######################
+# You can specify your configuration in a different file
+# (so that it is saved with upgrades, saved in your home directory,
+# or whateve reason you want to)
+# by commenting out/deleting the configuration lines and placing them
+# in a text file (say /home/user/.rtorrent.init.conf) exactly as you would
+# have written them here (you can leave the comments if you desire
+# and then uncommenting the following line correcting the path/filename
+# for the one you used. note the space after the ".".
+# . /etc/rtorrent.init.conf
+
+#Do not put a space on either side of the equal signs e.g.
+# user = user
+# will not work
+# system user to run as
+user="USERNAME"
+
+# the system group to run as, not implemented, see d_start for beginning implementation
+# group=`id -ng "$user"`
+
+# the full path to the filename where you store your rtorrent configuration
+config="`su -c 'echo $HOME' $user`/.rtorrent.rc"
+
+# set of options to run with
+options=""
+
+# default directory for screen, needs to be an absolute path
+base="`su -c 'echo $HOME' $user`/.rtorrent"
+
+# name of screen session
+srnname="rtorrent"
+
+# file to log to (makes for easier debugging if something goes wrong)
+logfile="/var/log/rtorrentInit.log"
+#######################
+###END CONFIGURATION###
+#######################
+PATH=/usr/bin:/usr/local/bin:/usr/local/sbin:/sbin:/bin:/usr/sbin
+DESC="rtorrent"
+NAME=rtorrent
+DAEMON=$NAME
+SCRIPTNAME=/etc/init.d/$NAME
+
+checkcnfg() {
+    exists=0
+    for i in `echo "$PATH" | tr ':' '\n'` ; do
+        if [ -f $i/$NAME ] ; then
+            exists=1
+            break
+        fi
+    done
+    if [ $exists -eq 0 ] ; then
+        echo "cannot find rtorrent binary in PATH $PATH" | tee -a "$logfile" >&2
+        exit 3
+    fi
+    if ! [ -r "${config}" ] ; then
+        echo "cannot find readable config ${config}. check that it is there and permissions are appropriate" | tee -a "$logfile" >&2
+        exit 3
+    fi
+    session=`getsession "$config"`
+    if ! [ -d "${session}" ] ; then
+        echo "cannot find readable session directory ${session} from config ${config}. check permissions" | tee -a "$logfile" >&2
+        exit 3
+    fi
+}
+
+d_start() {
+  [ -d "${base}" ] && cd "${base}"
+  stty stop undef && stty start undef
+  su -c "screen -ls | grep -sq "\.${srnname}[[:space:]]" " ${user} || su -c "screen -dm -S ${srnname} 2>&1 1>/dev/null" ${user} | tee -a "$logfile" >&2
+  # this works for the screen command, but starting rtorrent below adopts screen session gid
+  # even if it is not the screen session we started (e.g. running under an undesirable gid
+  #su -c "screen -ls | grep -sq "\.${srnname}[[:space:]]" " ${user} || su -c "sg \"$group\" -c \"screen -fn -dm -S ${srnname} 2>&1 1>/dev/null\"" ${user} | tee -a "$logfile" >&2
+  su -c "screen -S "${srnname}" -X screen rtorrent ${options} 2>&1 1>/dev/null" ${user} | tee -a "$logfile" >&2
+}
+
+d_stop() {
+    session=`getsession "$config"`
+    if ! [ -s ${session}/rtorrent.lock ] ; then
+        return
+    fi
+    pid=`cat ${session}/rtorrent.lock | awk -F: '{print($2)}' | sed "s/[^0-9]//g"`
+    if ps -A | grep -sq ${pid}.*rtorrent ; then # make sure the pid doesn't belong to another process
+        kill -s INT ${pid}
+    fi
+}
+
+getsession() {
+    session=`cat "$1" | grep "^[[:space:]]*session[[:space:]]*=" | sed "s/^[[:space:]]*session[[:space:]]*=[[:space:]]*//" `
+    echo $session
+}
+
+checkcnfg
+
+case "$1" in
+  start)
+    echo -n "Starting $DESC: $NAME"
+    d_start
+    echo "."
+    ;;
+  stop)
+    echo -n "Stopping $DESC: $NAME"
+    d_stop
+    echo "."
+    ;;
+  restart|force-reload)
+    echo -n "Restarting $DESC: $NAME"
+    d_stop
+    sleep 1
+    d_start
+    echo "."
+    ;;
+  *)
+    echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2
+    exit 1
+    ;;
+esac
+
+exit 0