diff --git a/tools/build/beinstall.sh b/tools/build/beinstall.sh
--- a/tools/build/beinstall.sh
+++ b/tools/build/beinstall.sh
@@ -7,7 +7,7 @@
 # modification, are permitted provided that the following conditions
 # are met:
 # 1. Redistributions of source code must retain the above copyright
-#    notice, this list of conditions and the following disclaimer 
+#    notice, this list of conditions and the following disclaimer
 #    in this position and unchanged.
 # 2. Redistributions in binary form must reproduce the above copyright
 #    notice, this list of conditions and the following disclaimer in the
@@ -67,17 +67,17 @@
 
 errx() {
 	cleanup
-	echo "error: $@"
+	echo "error: ${*}"
 	exit 1
 }
 
 rmdir_be() {
-	chflags -R noschg ${BE_MNTPT}
-	rm -rf ${BE_MNTPT}
+	chflags -R noschg "${BE_MNTPT}"
+	rm -rf "${BE_MNTPT}"
 }
 
 unmount_be() {
-	mount | grep " on ${BE_MNTPT}" | awk '{print $3}' | sort -r | xargs -t umount -f
+	mount | awk '/ on ${BE_MNTPT}/ {print $3}' | sort -r | xargs -t umount -f
 }
 
 copy_pkgs() {
@@ -85,7 +85,7 @@
 	# speed up future updates.  This is only called on the error path;
 	# no need to run on success.
 	echo "Rsyncing back newly saved packages..."
-	rsync -av --progress ${BE_MNTPT}/var/cache/pkg/. /var/cache/pkg/.
+	rsync -av --progress "${BE_MNTPT}/var/cache/pkg/." /var/cache/pkg/.
 }
 
 cleanup_be() {
@@ -96,50 +96,50 @@
 	# Finally, clean up any directories that were created by the
 	# operation, via cleanup_be_dirs().
 	if [ -n "${created_be_dirs}" ]; then
-		chroot ${BE_MNTPT} /bin/rm -rf ${created_be_dirs}
+		chroot "${BE_MNTPT}" /bin/rm -rf "${created_be_dirs}"
 	fi
-	${BE_UTILITY} destroy -F ${BENAME}
+	"${BE_UTILITY}" destroy -F "${BENAME}"
 }
 
 create_be_dirs() {
-	echo "${BE_MNTPT}: Inspecting dirs $*"
-	for dir in $*; do
+	echo "${BE_MNTPT}: Inspecting dirs ${*}"
+	for dir in "${@}"; do
 		curdir="$dir"
 		topdir="$dir"
 		while :; do
 			[ -e "${BE_MNTPT}${curdir}" ] && break
-			topdir=$curdir
-			curdir=$(dirname ${curdir})
+			topdir=${curdir}
+			curdir=$(dirname "${curdir}")
 		done
-		[ "$curdir" = "$dir" ] && continue
+		[ "${curdir}" = "${dir}" ] && continue
 
 		# Add the top-most nonexistent directory to the list, then
 		# mkdir -p the innermost directory specified by the argument.
 		# This way the least number of directories are rm'd directly.
 		created_be_dirs="${topdir} ${created_be_dirs}"
 		echo "${BE_MNTPT}: Created ${dir}"
-		mkdir -p ${BE_MNTPT}${dir} || return $?
+		mkdir -p "${BE_MNTPT}${dir}" || return ${?}
 	done
 	return 0
 }
 
 update_mergemaster_pre() {
-	${MERGEMASTER_CMD} -p -m ${srcdir} -D ${BE_MNTPT} -t ${BE_MM_ROOT} ${MERGEMASTER_FLAGS}
+	${MERGEMASTER_CMD} -p -m "${srcdir}" -D "${BE_MNTPT}" -t "${BE_MM_ROOT}" "${MERGEMASTER_FLAGS}"
 }
 
 update_mergemaster() {
-	${MERGEMASTER_CMD} -m ${srcdir} -D ${BE_MNTPT} -t ${BE_MM_ROOT} ${MERGEMASTER_FLAGS}
+	${MERGEMASTER_CMD} -m "${srcdir}" -D "${BE_MNTPT}" -t "${BE_MM_ROOT}" "${MERGEMASTER_FLAGS}"
 }
 
 update_etcupdate_pre() {
-	${ETCUPDATE_CMD} -p -s ${srcdir} -D ${BE_MNTPT} ${ETCUPDATE_FLAGS} || return $?
-	${ETCUPDATE_CMD} resolve -D ${BE_MNTPT} || return $?
+	${ETCUPDATE_CMD} -p -s "${srcdir}" -D "${BE_MNTPT}" "${ETCUPDATE_FLAGS}" || return ${?}
+	${ETCUPDATE_CMD} resolve -D "${BE_MNTPT}" || return ${?}
 }
 
 update_etcupdate() {
-	chroot ${BE_MNTPT} \
-		${ETCUPDATE_CMD} -s ${srcdir} ${ETCUPDATE_FLAGS} || return $?
-	chroot ${BE_MNTPT} ${ETCUPDATE_CMD} resolve
+	chroot "${BE_MNTPT}" \
+		"${ETCUPDATE_CMD}" -s "${srcdir}" "${ETCUPDATE_FLAGS}" || return ${?}
+	chroot "${BE_MNTPT}" "${ETCUPDATE_CMD}" resolve
 }
 
 
@@ -157,7 +157,7 @@
 }
 
 if [ -n "$BEINSTALL_CMD" ]; then
-	${BEINSTALL_CMD} $*
+	${BEINSTALL_CMD} "${@}"
 	exit $?
 fi
 
@@ -182,8 +182,8 @@
 # May be a worktree, in which case .git is a file, not a directory.
 if [ -e .git ] ; then
     commit_time=$(git show -s --format='%ct' 2>/dev/null)
-    [ $? -ne 0 ] && errx "Can't lookup git commit timestamp"
-    commit_ts=$(date -r ${commit_time} '+%Y%m%d.%H%M%S')
+    [ ${?} -ne 0 ] && errx "Can't lookup git commit timestamp"
+    commit_ts=$(date -r "${commit_time}" '+%Y%m%d.%H%M%S')
 elif [ -d .svn ] ; then
       if [ -e /usr/bin/svnlite ]; then
         svn=/usr/bin/svnlite
@@ -193,33 +193,33 @@
         errx "Unable to find subversion"
       fi
       commit_ts="$( "$svn" info --show-item last-changed-date | sed -e 's/\..*//' -e 's/T/./' -e 's/-//g' -e s'/://g' )"
-    [ $? -ne 0 ] && errx "Can't lookup Subversion commit timestamp"
+    [ ${?} -ne 0 ] && errx "Can't lookup Subversion commit timestamp"
 else
     errx "Unable to determine source control type"
 fi
 
-commit_ver=$(${objdir}/bin/freebsd-version/freebsd-version -u 2>/dev/null)
+commit_ver="$("${objdir}/bin/freebsd-version/freebsd-version -u 2>/dev/null")"
 [ -z "${commit_ver}" ] && errx "Unable to determine FreeBSD version"
 
 BENAME="${commit_ver}-${commit_ts}"
 
 BE_TMP=$(mktemp -d /tmp/beinstall.XXXXXX)
-[ $? -ne 0 -o ! -d ${BE_TMP} ] && errx "Unable to create mountpoint"
-[ -z "$NO_CLEANUP_BE" ] && cleanup_commands="rmdir_be ${cleanup_commands}"
-BE_MNTPT=${BE_TMP}/mnt
-BE_MM_ROOT=${BE_TMP}/mergemaster # mergemaster will create
-mkdir -p ${BE_MNTPT}
+[ ${?} -ne 0 ] || [ ! -d "${BE_TMP}" ] && errx "Unable to create mountpoint"
+[ -z "${NO_CLEANUP_BE}" ] && cleanup_commands="rmdir_be ${cleanup_commands}"
+BE_MNTPT="${BE_TMP}/mnt"
+BE_MM_ROOT="${BE_TMP}/mergemaster" # mergemaster will create
+mkdir -p "${BE_MNTPT}"
 
-${BE_UTILITY} create ${BENAME} >/dev/null || errx "Unable to create BE ${BENAME}"
-[ -z "$NO_CLEANUP_BE" ] && cleanup_commands="cleanup_be ${cleanup_commands}"
+${BE_UTILITY} create "${BENAME}" >/dev/null || errx "Unable to create BE ${BENAME}"
+[ -z "${NO_CLEANUP_BE}" ] && cleanup_commands="cleanup_be ${cleanup_commands}"
 
-${BE_UTILITY} mount ${BENAME} ${BE_TMP}/mnt || errx "Unable to mount BE ${BENAME}."
+${BE_UTILITY} mount "${BENAME}" "${BE_TMP}/mnt" || errx "Unable to mount BE ${BENAME}."
 
 echo "Mounted ${BENAME} to ${BE_MNTPT}, performing install/update ..."
-make "$@" DESTDIR=${BE_MNTPT} installkernel || errx "Installkernel failed!"
+make "$@" DESTDIR="${BE_MNTPT}" installkernel || errx "Installkernel failed!"
 if [ -n "${CONFIG_UPDATER}" ]; then
 	"update_${CONFIG_UPDATER}_pre"
-	[ $? -ne 0 ] && errx "${CONFIG_UPDATER} (pre-world) failed!"
+	[ ${?} -ne 0 ] && errx "${CONFIG_UPDATER} (pre-world) failed!"
 fi
 
 # Mount the source and object tree within the BE in order to account for any
@@ -230,12 +230,12 @@
 mount -t nullfs "${objdir}" "${BE_MNTPT}${objdir}" || errx "Unable to mount obj"
 mount -t devfs devfs "${BE_MNTPT}/dev" || errx "Unable to mount devfs"
 
-chroot ${BE_MNTPT} make "$@" -C ${srcdir} installworld || \
+chroot "${BE_MNTPT}" make "$@" -C "${srcdir}" installworld || \
 	errx "Installworld failed!"
 
 if [ -n "${CONFIG_UPDATER}" ]; then
 	"update_${CONFIG_UPDATER}"
-	[ $? -ne 0 ] && errx "${CONFIG_UPDATER} (post-world) failed!"
+	[ ${?} -ne 0 ] && errx "${CONFIG_UPDATER} (post-world) failed!"
 fi
 
 if which rsync >/dev/null 2>&1; then
@@ -248,7 +248,7 @@
 	${BE_PKG} upgrade || errx "Unable to upgrade pkgs"
 fi
 
-if [ -n "$NO_CLEANUP_BE" ]; then
+if [ -n "${NO_CLEANUP_BE}" ]; then
 	echo "Boot Environment ${BENAME} may be examined in ${BE_MNTPT}."
 	echo "Afterwards, run this to cleanup:"
 	echo "  env BENAME=${BENAME} BE_MNTPT=${BE_MNTPT} BEINSTALL_CMD=postmortem $0"
@@ -257,7 +257,7 @@
 
 unmount_be || errx "Unable to unmount BE"
 rmdir_be || errx "Unable to cleanup BE"
-${BE_UTILITY} activate ${BENAME} || errx "Unable to activate BE"
+${BE_UTILITY} activate "${BENAME}" || errx "Unable to activate BE"
 echo
 ${BE_UTILITY} list
 echo