From 4f5567e2c10afe16d7af7e47882f607ca7170ce9 Mon Sep 17 00:00:00 2001
From: Andrew Bettison <andrew@servalproject.org>
Date: Tue, 27 Mar 2018 17:16:11 +1030
Subject: [PATCH] Use rigorous quoting throughout test scripts

This makes it much easier to refactor test fixtures and utilities.
---
 tests/compatibility     |   8 +-
 tests/directory_service |  28 ++--
 tests/jni               |   2 +-
 tests/keyring           |  18 +--
 tests/mdp               |  36 ++---
 tests/meshms            | 112 +++++++-------
 tests/meshmsjava        |  94 ++++++------
 tests/meshmsrestful     | 106 ++++++-------
 tests/msp               |  30 ++--
 tests/rhizomejava       |  26 ++--
 tests/rhizomeops        | 324 ++++++++++++++++++++--------------------
 tests/rhizomeprotocol   |  74 ++++-----
 tests/rhizomerestful    |  46 +++---
 tests/routing           | 140 ++++++++---------
 tests/vomp              |   4 +-
 15 files changed, 524 insertions(+), 524 deletions(-)

diff --git a/tests/compatibility b/tests/compatibility
index 69dc36a3..532b6af7 100755
--- a/tests/compatibility
+++ b/tests/compatibility
@@ -48,7 +48,7 @@ start_servald_090() {
    extract_stdout_keyvalue SIDA sid "$rexp_sid"
    DIDA=5550001
    NAMEA="Agent A. Smith"
-   executeOk_servald set did $SIDA $DIDA "$NAMEA"
+   executeOk_servald set did "$SIDA" "$DIDA" "$NAMEA"
    SERVALD_SERVER_CHDIR="$instance_dir" SERVALD_LOG_FILE="$instance_servald_log" executeOk_servald start
    wait_until grep "[Ii]nterface .* is up" "$instance_servald_log"
 }
@@ -78,12 +78,12 @@ test_dna_090_version() {
    executeOk_servald route print
    tfw_cat --stdout --stderr
    assertStdoutGrep --stdout --matches=1 "^${SIDB}:BROADCAST :0*\$"
-   executeOk_servald mdp ping $SIDB 1
+   executeOk_servald mdp ping "$SIDB" 1
    tfw_cat --stdout --stderr
    set_instance +B
-   executeOk_servald mdp ping $SIDA 1
+   executeOk_servald mdp ping "$SIDA" 1
    tfw_cat --stdout --stderr
-   executeOk_servald dna lookup $DIDA
+   executeOk_servald dna lookup "$DIDA"
    tfw_cat --stdout --stderr
 }
 
diff --git a/tests/directory_service b/tests/directory_service
index 6dde5fff..974a9460 100755
--- a/tests/directory_service
+++ b/tests/directory_service
@@ -50,27 +50,27 @@ setup_publish() {
    assert_no_servald_processes
    foreach_instance +A +B +C +D create_single_identity
    set_instance +D
-   executeOk_servald keyring set did $SIDD $DIDC "Agent D Smith"
-   DIDD1=$DIDC
+   executeOk_servald keyring set did "$SIDD" "$DIDC" "Agent D Smith"
+   DIDD1="$DIDC"
    NAMED1="Agent D Smith"
-   DIDD=$DIDC1
-   NAMED=$NAMED1
+   DIDD="$DIDC1"
+   NAMED="$NAMED1"
    set_instance +A
    executeOk_servald config \
       set dna.helper.executable "$servald_build_root/directory_service" \
       set debug.dnahelper on
-   foreach_instance +B +C +D executeOk_servald config set directory.service $SIDA
+   foreach_instance +B +C +D executeOk_servald config set directory.service "$SIDA"
    foreach_instance +A +B +C +D add_servald_interface
    start_servald_instances +A +B +C +D
 }
 
 doc_publish="Publish and retrieve a directory entry"
 test_publish() {
-   wait_until grep "DNAHELPER got STARTED ACK" $LOGA
+   wait_until grep "DNAHELPER got STARTED ACK" "$LOGA"
    foreach_instance +B +C +D wait_until sent_directory_request
-   wait_until is_published $SIDB
-   wait_until is_published $SIDC
-   wait_until is_published $SIDD
+   wait_until is_published "$SIDB"
+   wait_until is_published "$SIDC"
+   wait_until is_published "$SIDD"
    stop_servald_server +B
    stop_servald_server +C
    stop_servald_server +D
@@ -129,8 +129,8 @@ setup_routing() {
       set debug.dnahelper on
    foreach_instance +B +C \
       executeOk_servald config \
-         set directory.service $SIDA \
-         set hosts.$SIDA.address 10.0.1.1
+         set directory.service "$SIDA" \
+         set "hosts.$SIDA.address" 10.0.1.1
    set_instance +A
    start_routing_instance
    wait_until grep "DNAHELPER got STARTED ACK" $instance_servald_log
@@ -142,8 +142,8 @@ test_routing() {
    foreach_instance +B +C \
       wait_until sent_directory_request
    set_instance +A
-   wait_until is_published $SIDB
-   wait_until is_published $SIDC
+   wait_until is_published "$SIDB"
+   wait_until is_published "$SIDC"
    set_instance +B
    executeOk_servald route print
    assertStdoutGrep --matches=1 "^$SIDA:UNICAST:"
@@ -158,7 +158,7 @@ test_routing() {
    executeOk_servald dna lookup "$DIDB"
    assertStdoutLineCount '==' 3
    assertStdoutGrep --matches=1 "^sid://$SIDB/local/$DIDB:$DIDB:$NAMEB\$"
-   executeOk_servald mdp ping $SIDB 3
+   executeOk_servald mdp ping "$SIDB" 3
    tfw_cat --stdout --stderr
    executeOk_servald route print
    tfw_cat --stdout
diff --git a/tests/jni b/tests/jni
index d7a4d654..db80f423 100755
--- a/tests/jni
+++ b/tests/jni
@@ -155,7 +155,7 @@ test_serviceDiscovery() {
    assertStdoutGrep "$SIDB"
    assertStdoutGrep "\<test_name\.msp\.port=512\>"
    tfw_cat --stdout --stderr
-   executeOk_servald --timeout=20 msp connect $SIDB 512 <<EOF
+   executeOk_servald --timeout=20 msp connect "$SIDB" 512 <<EOF
 Hi!
 EOF
    fork_wait %service
diff --git a/tests/keyring b/tests/keyring
index 14444829..8e4987e7 100755
--- a/tests/keyring
+++ b/tests/keyring
@@ -38,7 +38,7 @@ teardown_servald() {
 
 setup_instances() {
    for arg; do
-      set_instance $arg
+      set_instance "$arg"
       executeOk_servald config \
          set rhizome.enable off \
          set log.console.level debug \
@@ -287,8 +287,8 @@ test_KeyringPinServer() {
    start_servald_server --keyring-pin=yellow
    executeOk_servald id self
    unpack_stdout_list X
-   assert --stdout --stderr [ $XNROWS -eq 1 ]
-   assert --stdout --stderr [ ${XSID[0]} = $SIDA ]
+   assert --stdout --stderr [ "$XNROWS" -eq 1 ]
+   assert --stdout --stderr [ "${XSID[0]}" = "$SIDA" ]
 }
 finally_KeyringPinServer() {
    stop_servald_server
@@ -306,8 +306,8 @@ test_EntryPinServer() {
    start_servald_server --entry-pin=yodel
    executeOk_servald id self
    unpack_stdout_list X
-   assert --stdout --stderr [ $XNROWS -eq 1 ]
-   assert --stdout --stderr [ ${XSID[0]} = $SIDA ]
+   assert --stdout --stderr [ "$XNROWS" -eq 1 ]
+   assert --stdout --stderr [ "${XSID[0]}" = "$SIDA" ]
 }
 finally_EntryPinServer() {
    stop_servald_server
@@ -325,8 +325,8 @@ test_KeyringEntryPinServer() {
    start_servald_server --keyring-pin=yellow --entry-pin=yodel
    executeOk_servald id self
    unpack_stdout_list X
-   assert --stdout --stderr [ $XNROWS -eq 1 ]
-   assert --stdout --stderr [ ${XSID[0]} = $SIDA ]
+   assert --stdout --stderr [ "$XNROWS" -eq 1 ]
+   assert --stdout --stderr [ "${XSID[0]}" = "$SIDA" ]
 }
 finally_KeyringKeyringPinServer() {
    stop_servald_server
@@ -461,7 +461,7 @@ setup_LoadAtomic() {
 }
 test_LoadAtomic() {
    set_instance +B
-   execute --exit-status=255 $servald keyring load dA
+   execute --exit-status=255 "$servald" keyring load dA
    executeOk_servald keyring dump --secret dB2
    tfw_cat dB2
    assert cmp dB2 dB
@@ -589,7 +589,7 @@ setup_ReadOnlyEnv() {
 }
 test_ReadOnlyEnv() {
     export SERVALD_KEYRING_READONLY="true"
-    execute --exit-status=255 $servald keyring add ''
+    execute --exit-status=255 "$servald" keyring add ''
     tfw_cat --stderr
     executeOk_servald keyring list
     assert_keyring_list 1
diff --git a/tests/mdp b/tests/mdp
index 46f0b430..e6cc4959 100755
--- a/tests/mdp
+++ b/tests/mdp
@@ -46,14 +46,14 @@ setup_mdp_filters_ping() {
    start_servald_instances +A +B +C
    # Ensure that pings all work.
    set_instance +A
-   fork executeOk_servald mdp ping --timeout=10 $SIDB 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDC 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDB" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDC" 1
    set_instance +B
-   fork executeOk_servald mdp ping --timeout=10 $SIDA 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDC 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDA" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDC" 1
    set_instance +C
-   fork executeOk_servald mdp ping --timeout=10 $SIDA 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDB 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDA" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDB" 1
    fork_wait_all
 }
 
@@ -70,14 +70,14 @@ test_MDPFilterRulesDrop() {
    echo "drop *:7 >$SIDC" >>rulesA
    tfw_cat rulesA
    executeOk_servald config sync
-   fork execute_servald --exit-status=1 mdp ping --timeout=10 $SIDB 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDC 1
+   fork execute_servald --exit-status=1 mdp ping --timeout=10 "$SIDB" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDC" 1
    set_instance +B
-   fork executeOk_servald mdp ping --timeout=10 $SIDA 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDC 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDA" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDC" 1
    set_instance +C
-   fork execute_servald --exit-status=1 mdp ping --timeout=10 $SIDA 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDB 1
+   fork execute_servald --exit-status=1 mdp ping --timeout=10 "$SIDA" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDB" 1
    fork_wait_all
 }
 
@@ -97,14 +97,14 @@ test_MDPFilterRulesAllow() {
    echo "drop all" >>rulesA
    tfw_cat rulesA
    executeOk_servald config sync
-   fork executeOk_servald mdp ping --timeout=10 $SIDB 1
-   fork execute_servald --exit-status=1 mdp ping --timeout=10 $SIDC 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDB" 1
+   fork execute_servald --exit-status=1 mdp ping --timeout=10 "$SIDC" 1
    set_instance +B
-   fork executeOk_servald mdp ping --timeout=10 $SIDA 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDC 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDA" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDC" 1
    set_instance +C
-   fork execute_servald --exit-status=1 mdp ping --timeout=10 $SIDA 1
-   fork executeOk_servald mdp ping --timeout=10 $SIDB 1
+   fork execute_servald --exit-status=1 mdp ping --timeout=10 "$SIDA" 1
+   fork executeOk_servald mdp ping --timeout=10 "$SIDB" 1
    fork_wait_all
 }
 
diff --git a/tests/meshms b/tests/meshms
index deb91832..cd2ffd55 100755
--- a/tests/meshms
+++ b/tests/meshms
@@ -41,7 +41,7 @@ setup_logging() {
 setup_common() {
    setup_servald
    set_instance +A
-   create_identities $1
+   create_identities "$1"
    setup_logging
 }
 
@@ -50,7 +50,7 @@ setup_InitiallyEmpty() {
    setup_common 2
 }
 test_InitiallyEmpty() {
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    tfw_cat --stdout
    assertStdoutIs --stdout --line=1 -e '6\n'
    assertStdoutIs --stdout --line=2 -e '_id:my_offset:their_offset:age:type:message\n'
@@ -63,27 +63,27 @@ setup_SendAndList() {
 }
 test_SendAndList() {
    # create a single message and list it back
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message 1"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message 1"
    tfw_cat --stderr
-   executeOk_servald meshms send message $SIDA1 $SIDA3 "Message 1"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA3" "Message 1"
    tfw_cat --stderr
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    tfw_cat --stderr
    assertStdoutGrep --stdout --matches=1 "^0:12:0:$rexp_age:>:Message 1\$"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message 2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message 2"
    tfw_cat --stderr
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    tfw_cat --stderr
    assertStdoutGrep --stdout --matches=1 "^0:30:0:$rexp_age:>:Message 2\$"
    assertStdoutGrep --stdout --matches=1 "^1:12:0:$rexp_age:>:Message 1\$"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message 3"
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message 3"
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    tfw_cat --stdout
    assertStdoutGrep --stdout --matches=1 "^0:48:0:$rexp_age:>:Message 3\$"
    assertStdoutGrep --stdout --matches=1 "^1:30:0:$rexp_age:>:Message 2\$"
    assertStdoutGrep --stdout --matches=1 "^2:12:0:$rexp_age:>:Message 1\$"
    assertStdoutLineCount '==' 5
-   executeOk_servald meshms list messages $SIDA2 $SIDA1
+   executeOk_servald meshms list messages "$SIDA2" "$SIDA1"
    tfw_cat --stdout
    assertStdoutGrep --stdout --matches=1 "^0:3:48:$rexp_age:<:Message 3\$"
    assertStdoutGrep --stdout --matches=1 "^1:3:30:$rexp_age:<:Message 2\$"
@@ -96,31 +96,31 @@ check_meshms_bundles() {
    # The only "file" bundle should be the conversation list
    executeOk_servald rhizome list file
    unpack_stdout_list X
-   assert --stdout --stderr [ $XNROWS -eq 1 ]
-   assert --stdout --stderr [ ${XID[0]} = $CONV_BID ]
-   executeOk_servald rhizome extract bundle $CONV_BID manifest.conv payload.conv $CONV_SECRET
+   assert --stdout --stderr [ "$XNROWS" -eq 1 ]
+   assert --stdout --stderr [ "${XID[0]}" = "$CONV_BID" ]
+   executeOk_servald rhizome extract bundle "$CONV_BID" manifest.conv payload.conv "$CONV_SECRET"
    tfw_cat -v manifest.conv --hexdump payload.conv
    # The only "MeshMS2" bundles should be the two ply bundles
    executeOk_servald rhizome list MeshMS2
    unpack_stdout_list X
-   assert --stdout [ $XNROWS -eq 2 ]
+   assert --stdout [ "$XNROWS" -eq 2 ]
    local bid
    for bid in ${XID[*]}; do
-      executeOk_servald rhizome extract bundle $bid manifest.$bid payload.$bid
-      tfw_cat -v manifest.$bid --hexdump payload.$bid
+      executeOk_servald rhizome extract bundle "$bid" "manifest.$bid" "payload.$bid"
+      tfw_cat -v "manifest.$bid" --hexdump "payload.$bid"
    done
 }
 
 has_unread_messages() {
-   executeOk_servald meshms list conversations $1
-   if ! grep ":unread:" $_tfw_tmp/stdout; then
+   executeOk_servald meshms list conversations "$1"
+   if ! grep ":unread:" "$_tfw_tmp/stdout"; then
      return 1
    fi
 }
 
 messages_delivered() {
-   executeOk_servald meshms list messages $1 $2
-   if ! grep ":ACK:" $_tfw_tmp/stdout; then
+   executeOk_servald meshms list messages "$1" "$2"
+   if ! grep ":ACK:" "$_tfw_tmp/stdout"; then
      return 1
    fi
 }
@@ -131,26 +131,26 @@ setup_MessageThreading() {
    foreach_instance +A +B create_single_identity
    foreach_instance +A +B setup_logging
    set_instance +A
-   executeOk_servald meshms send message $SIDA $SIDB "Hello can you hear me"
-   executeOk_servald meshms send message $SIDA $SIDB "Still waiting"
+   executeOk_servald meshms send message "$SIDA" "$SIDB" "Hello can you hear me"
+   executeOk_servald meshms send message "$SIDA" "$SIDB" "Still waiting"
    set_instance +B
-   executeOk_servald meshms send message $SIDB $SIDA "Help Im trapped in a test case factory"
-   executeOk_servald meshms send message $SIDB $SIDA "Never mind"
+   executeOk_servald meshms send message "$SIDB" "$SIDA" "Help Im trapped in a test case factory"
+   executeOk_servald meshms send message "$SIDB" "$SIDA" "Never mind"
    start_servald_instances +A +B
 }
 test_MessageThreading() {
    set_instance +B
-   wait_until has_unread_messages $SIDB
-   executeOk_servald meshms list messages $SIDB $SIDA
+   wait_until has_unread_messages "$SIDB"
+   executeOk_servald meshms list messages "$SIDB" "$SIDA"
    assertStdoutGrep --stdout --matches=1 "^0:69:46:$rexp_age:<:Still waiting\$"
    assertStdoutGrep --stdout --matches=1 "^1:69:24:$rexp_age:<:Hello can you hear me\$"
    assertStdoutGrep --stdout --matches=1 "^2:60:0:$rexp_age:>:Never mind\$"
    assertStdoutGrep --stdout --matches=1 "^3:41:0:$rexp_age:>:Help Im trapped in a test case factory\$"
    assertStdoutLineCount '==' 6
    set_instance +A
-   wait_until has_unread_messages $SIDA
-   wait_until messages_delivered $SIDA $SIDB
-   executeOk_servald meshms list messages $SIDA $SIDB
+   wait_until has_unread_messages "$SIDA"
+   wait_until messages_delivered "$SIDA" "$SIDB"
+   executeOk_servald meshms list messages "$SIDA" "$SIDB"
    assertStdoutGrep --stdout --matches=1 "^0:55:60:$rexp_age:<:Never mind\$"
    assertStdoutGrep --stdout --matches=1 "^1:55:41:$rexp_age:<:Help Im trapped in a test case factory\$"
    assertStdoutGrep --stdout --matches=1 "^2:46:69:$rexp_age:ACK:delivered\$"
@@ -166,26 +166,26 @@ setup_reorderList() {
    create_identities 5
    setup_logging
    # ensure conversations are known
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Start"
-   executeOk_servald meshms send message $SIDA1 $SIDA3 "Start"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Start"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Start"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA3" "Start"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Start"
 }
 test_reorderList() {
    # new incoming messages should bump to the top
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Bump"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Bump"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 "^0:$SIDA4:unread:"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Bump"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Bump"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 "^0:$SIDA3:unread:"
    assertStdoutGrep --stderr --matches=1 "^1:$SIDA4:unread:"
-   executeOk_servald meshms send message $SIDA2 $SIDA1 "Bump"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA2" "$SIDA1" "Bump"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 "^0:$SIDA2:unread:"
    assertStdoutGrep --stderr --matches=1 "^1:$SIDA3:unread:"
    assertStdoutGrep --stderr --matches=1 "^2:$SIDA4:unread:"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Bump"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Bump"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 "^0:$SIDA4:unread:"
    assertStdoutGrep --stderr --matches=1 "^1:$SIDA2:unread:"
    assertStdoutGrep --stderr --matches=1 "^2:$SIDA3:unread:"
@@ -198,13 +198,13 @@ setup_listConversations() {
    create_identities 5
    setup_logging
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message3"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message4"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message3"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message4"
 }
 test_listConversations() {
-   executeOk_servald meshms list conversations --include-message $SIDA1
+   executeOk_servald meshms list conversations --include-message "$SIDA1"
    tfw_cat --stdout
    assertStdoutIs --stderr --line=1 -e '6\n'
    assertStdoutIs --stderr --line=2 -e '_id:recipient:read:last_message:read_offset:message\n'
@@ -212,21 +212,21 @@ test_listConversations() {
    assertStdoutGrep --stderr --matches=1 ":$SIDA3:unread:11:0:Message2\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA4:unread:14:0:Message4\$"
    assertStdoutLineCount '==' 5
-   executeOk_servald meshms list conversations $SIDA1 1
+   executeOk_servald meshms list conversations "$SIDA1" 1
    assertStdoutLineCount '==' 4
-   executeOk_servald meshms list conversations $SIDA1 1 1
+   executeOk_servald meshms list conversations "$SIDA1" 1 1
    assertStdoutLineCount '==' 3
    # mark all incoming messages as read
-   executeOk_servald meshms read messages $SIDA1
+   executeOk_servald meshms read messages "$SIDA1"
    # explicitly mark sida3 as known
-   executeOk_servald meshms read messages $SIDA1 $SIDA3
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms read messages "$SIDA1" "$SIDA3"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2::0:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA3::11:11\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA4::14:14\$"
    assertStdoutLineCount '==' 5
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
-   executeOk_servald meshms list messages $SIDA1 $SIDA4
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA4"
 }
 
 doc_sendNoIdentity="Send message from unknown identity"
@@ -238,11 +238,11 @@ setup_sendNoIdentity() {
    SIDX=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
 }
 test_sendNoIdentity() {
-   executeOk_servald meshms send message $SIDA1 $SIDX "First message"
-   execute $servald meshms send message $SIDX $SIDA1 "First reply"
+   executeOk_servald meshms send message "$SIDA1" "$SIDX" "First message"
+   execute "$servald" meshms send message "$SIDX" "$SIDA1" "First reply"
    assertExitStatus --stderr == 2
-   executeOk_servald meshms list messages $SIDA1 $SIDX
-   execute $servald meshms list messages $SIDX $SIDA1
+   executeOk_servald meshms list messages "$SIDA1" "$SIDX"
+   execute "$servald" meshms list messages "$SIDX" "$SIDA1"
    assertExitStatus --stderr == 2
 }
 
diff --git a/tests/meshmsjava b/tests/meshmsjava
index 684192af..bb50eb3f 100755
--- a/tests/meshmsjava
+++ b/tests/meshmsjava
@@ -55,7 +55,7 @@ setup_MeshmsDisabled() {
    executeOk_servald config set rhizome.enable off sync
 }
 test_MeshmsDisabled() {
-   executeJava org.servalproject.test.Meshms meshms-list-conversations $SIDA1
+   executeJava org.servalproject.test.Meshms meshms-list-conversations "$SIDA1"
    tfw_cat --stdout --stderr
    assertExitStatus != 0
    assertStderrGrep ServalDFailureException
@@ -66,20 +66,20 @@ doc_MeshmsListConversations="Java API list MeshMS conversations"
 setup_MeshmsListConversations() {
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message One"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message Two"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message Three"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message Four"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message One"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message Two"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message Three"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message Four"
 }
 test_MeshmsListConversations() {
-   executeJavaOk org.servalproject.test.Meshms meshms-list-conversations $SIDA1
+   executeJavaOk org.servalproject.test.Meshms meshms-list-conversations "$SIDA1"
    tfw_cat --stderr
    assertStdoutLineCount '==' 3
    assertStdoutGrep "my_sid=$SIDA1, their_sid=$SIDA2, read=true, last_message=0, read_offset=0"
    assertStdoutGrep "my_sid=$SIDA1, their_sid=$SIDA3, read=false, last_message=14, read_offset=0"
    assertStdoutGrep "my_sid=$SIDA1, their_sid=$SIDA4, read=false, last_message=18, read_offset=0"
-   executeOk_servald meshms read messages $SIDA1
-   executeJavaOk org.servalproject.test.Meshms meshms-list-conversations $SIDA1
+   executeOk_servald meshms read messages "$SIDA1"
+   executeJavaOk org.servalproject.test.Meshms meshms-list-conversations "$SIDA1"
    assertStdoutLineCount '==' 3
    assertStdoutGrep "my_sid=$SIDA1, their_sid=$SIDA2, read=true, last_message=0, read_offset=0"
    assertStdoutGrep "my_sid=$SIDA1, their_sid=$SIDA3, read=true, last_message=14, read_offset=14"
@@ -89,9 +89,9 @@ test_MeshmsListConversations() {
 doc_MeshmsListMessages="Java API list MeshMS messages in one conversation"
 setup_MeshmsListMessages() {
    setup
-   meshms_add_messages $SIDA1 $SIDA2 '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
+   meshms_add_messages "$SIDA1" "$SIDA2" '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
    let NROWS=NSENT+NRECV+(NACK?1:0)
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    delivered_offset=$(sed -n -e '/^[0-9]\+:[0-9]\+:[0-9]\+:[0-9]\+:ACK:delivered$/{n;s/^[0-9]\+:\([0-9]\+\):[0-9]\+:[0-9]\+:>:.*/\1/p;q}' "$TFWSTDOUT")
    [ -z "$delivered_offset" ] && delivered_offset=0
    read_offset=$(sed -n -e 's/^[0-9]\+:[0-9]\+:\([0-9]\+\):[0-9]\+:MARK:read$/\1/p' "$TFWSTDOUT")
@@ -99,7 +99,7 @@ setup_MeshmsListMessages() {
    tfw_log delivered_offset="$delivered_offset" read_offset="$read_offset"
 }
 test_MeshmsListMessages() {
-   executeJavaOk org.servalproject.test.Meshms meshms-list-messages $SIDA1 $SIDA2
+   executeJavaOk org.servalproject.test.Meshms meshms-list-messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' $(($NROWS + 2))
    assertStdoutIs --line=1 -e "read_offset=$read_offset\n"
    assertStdoutIs --line=2 -e "latest_ack_offset=$delivered_offset\n"
@@ -163,7 +163,7 @@ setup_MeshmsListMessagesNewSince() {
       executeOk_servald config set api.restful.newsince_timeout 1s
    }
    setup
-   meshms_add_messages $SIDA1 $SIDA2 '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
+   meshms_add_messages "$SIDA1" "$SIDA2" '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
    let NROWS=NSENT+NRECV+(NACK?1:0)
    executeJavaOk org.servalproject.test.Meshms meshms-list-messages "$SIDA1" "$SIDA2"
    tfw_cat --stdout --stderr
@@ -218,7 +218,7 @@ setup_MeshmsListMessagesNewSinceArrival() {
    # Use REST interface to send messages, not CLI, in order to avoid a database
    # locking storm
    meshms_use_restful harry potter
-   meshms_add_messages $SIDA1 $SIDA2 '><>A>'
+   meshms_add_messages "$SIDA1" "$SIDA2" '><>A>'
    let NROWS=NSENT+NRECV+(NACK?1:0)
    executeJavaOk org.servalproject.test.Meshms meshms-list-messages "$SIDA1" "$SIDA2"
    tfw_cat --stdout --stderr
@@ -235,7 +235,7 @@ test_MeshmsListMessagesNewSinceArrival() {
    done
    wait_until [ -e messages1 -a -e messages2 -a -e messages3 ]
    for message in '>Rumplestiltskin' 'A' '<Howdydoody' '>Eulenspiegel'; do
-      meshms_add_messages $SIDA1 $SIDA2 "${message:0:1}" "${message:1}"
+      meshms_add_messages "$SIDA1" "$SIDA2" "${message:0:1}" "${message:1}"
       case ${message:0:1} in
       '<'|'>') waitfor="${message:1}";;
       'A') waitfor="ACK";;
@@ -254,18 +254,18 @@ teardown_MeshmsListMessagesNewSinceArrival() {
 doc_MeshmsListMessagesNoIdentity="Java API list MeshMS messages from unknown identity"
 test_MeshmsListMessagesNoIdentity() {
    SIDX=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-   executeJavaOk org.servalproject.test.Meshms meshms-list-messages $SIDX $SIDA2
+   executeJavaOk org.servalproject.test.Meshms meshms-list-messages "$SIDX" "$SIDA2"
    assertStdoutGrep 'MeshMSUnknownIdentityException'
    tfw_cat --stdout --stderr
 }
 
 doc_MeshmsSend="Java API send MeshMS message"
 test_MeshmsSend() {
-   executeJavaOk org.servalproject.test.Meshms meshms-send-message $SIDA1 $SIDA2 "Hello World"
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeJavaOk org.servalproject.test.Meshms meshms-send-message "$SIDA1" "$SIDA2" "Hello World"
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutGrep --matches=1 ':>:Hello World'
-   executeJavaOk org.servalproject.test.Meshms meshms-send-message $SIDA2 $SIDA1 "Hello Back!"
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeJavaOk org.servalproject.test.Meshms meshms-send-message "$SIDA2" "$SIDA1" "Hello Back!"
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutGrep --matches=1 ':>:Hello World$'
    assertStdoutGrep --matches=1 ':<:Hello Back!$'
 }
@@ -273,7 +273,7 @@ test_MeshmsSend() {
 doc_MeshmsSendNoIdentity="Java API send MeshMS message from unknown identity"
 test_MeshmsSendNoIdentity() {
    SIDX=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
-   executeJavaOk org.servalproject.test.Meshms meshms-send-message $SIDX $SIDA2 "Hello World"
+   executeJavaOk org.servalproject.test.Meshms meshms-send-message "$SIDX" "$SIDA2" "Hello World"
    assertStdoutGrep 'MeshMSUnknownIdentityException'
    tfw_cat --stdout --stderr
 }
@@ -282,19 +282,19 @@ doc_MeshmsReadAllConversations="Java API MeshMS mark all conversations read"
 setup_MeshmsReadAllConversations() {
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message3"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message4"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message3"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message4"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2::0:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA3:unread:11:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA4:unread:14:0\$"
 }
 test_MeshmsReadAllConversations() {
-   executeJavaOk org.servalproject.test.Meshms meshms-mark-all-conversations-read $SIDA1
+   executeJavaOk org.servalproject.test.Meshms meshms-mark-all-conversations-read "$SIDA1"
    assertStdoutIs -e 'UPDATED\n'
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2::0:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA3::11:11\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA4::14:14\$"
@@ -304,19 +304,19 @@ doc_MeshmsReadAllMessages="Java API MeshMS mark all conversations read"
 setup_MeshmsReadAllMessages() {
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message3"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message4"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message5"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message6"
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message3"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message4"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message5"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message6"
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:0\$"
 }
 test_MeshmsReadAllMessages() {
-   executeJavaOk org.servalproject.test.Meshms meshms-mark-all-messages-read $SIDA2 $SIDA1
+   executeJavaOk org.servalproject.test.Meshms meshms-mark-all-messages-read "$SIDA2" "$SIDA1"
    assertStdoutIs -e 'UPDATED\n'
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1::45:45\$"
 }
 
@@ -324,23 +324,23 @@ doc_MeshmsReadMessage="Java API MeshMS mark a message as read"
 setup_MeshmsReadMessage() {
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message3"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message4"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message5"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message6"
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message3"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message4"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message5"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message6"
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:0\$"
 }
 test_MeshmsReadMessage() {
-   executeJavaOk org.servalproject.test.Meshms meshms-advance-read-offset $SIDA2 $SIDA1 22
+   executeJavaOk org.servalproject.test.Meshms meshms-advance-read-offset "$SIDA2" "$SIDA1" 22
    assertStdoutIs -e 'UPDATED\n'
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:22\$"
-   executeJavaOk org.servalproject.test.Meshms meshms-advance-read-offset $SIDA2 $SIDA1 11
+   executeJavaOk org.servalproject.test.Meshms meshms-advance-read-offset "$SIDA2" "$SIDA1" 11
    assertStdoutIs -e 'OK\n'
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:22\$"
 }
 
diff --git a/tests/meshmsrestful b/tests/meshmsrestful
index 61ea265c..f35a233e 100755
--- a/tests/meshmsrestful
+++ b/tests/meshmsrestful
@@ -27,14 +27,14 @@ source "${0%/*}/../testdefs_meshms.sh"
 shopt -s extglob
 
 setup_instance() {
-   set_instance $1
+   set_instance "$1"
    setup_rest_config
    set_meshms_config
    set_extra_config
    if [ -z "$IDENTITY_COUNT" ]; then
       create_single_identity
    else
-      create_identities $IDENTITY_COUNT
+      create_identities "$IDENTITY_COUNT"
    fi
 }
 
@@ -102,10 +102,10 @@ setup_MeshmsListConversations() {
    IDENTITY_COUNT=5
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message3"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message4"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message3"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message4"
 }
 test_MeshmsListConversations() {
    rest_request GET "/restful/meshms/$SIDA1/conversationlist.json"
@@ -140,8 +140,8 @@ test_MeshmsListConversations() {
                }
             ])"
    # mark all incoming messages as read
-   executeOk_servald meshms read messages $SIDA1
-   executeOk_servald meshms read messages $SIDA1 $SIDA3
+   executeOk_servald meshms read messages "$SIDA1"
+   executeOk_servald meshms read messages "$SIDA1" "$SIDA3"
    tfw_cat --stderr
    rest_request GET "/restful/meshms/$SIDA1/conversationlist.json"
    assert [ "$(jq '.rows | length' response.json)" = 3 ]
@@ -180,9 +180,9 @@ doc_MeshmsListMessages="REST API list MeshMS messages in one conversation as JSO
 setup_MeshmsListMessages() {
    IDENTITY_COUNT=2
    setup
-   meshms_add_messages $SIDA1 $SIDA2 '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
+   meshms_add_messages "$SIDA1" "$SIDA2" '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
    let NROWS=NSENT+NRECV+(NACK?1:0)
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    tfw_cat --stdout
    delivered_offset=$($SED -n -e '/^[0-9]\+:[0-9]\+:[0-9]\+:[0-9]\+:ACK:delivered$/{n;s/^[0-9]\+:\([0-9]\+\):[0-9]\+:[0-9]\+:>:.*/\1/p;q}' "$TFWSTDOUT")
    [ -z "$delivered_offset" ] && delivered_offset=0
@@ -260,7 +260,7 @@ setup_MeshmsListMessagesNewSince() {
       executeOk_servald config set api.restful.newsince_timeout 1s
    }
    setup
-   meshms_add_messages $SIDA1 $SIDA2 '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
+   meshms_add_messages "$SIDA1" "$SIDA2" '><>>A>A<>><><><>>>A>A><<<<<>><>>A<<>'
    let NROWS=NSENT+NRECV+(NACK?1:0)
    rest_request GET "/restful/meshms/$SIDA1/$SIDA2/messagelist.json"
    assert [ "$(jq '.rows | length' response.json)" = $NROWS ]
@@ -308,7 +308,7 @@ setup_MeshmsListMessagesNewSinceArrival() {
    # Use REST interface to send messages, not CLI, in order to avoid a database
    # locking storm
    meshms_use_restful harry potter
-   meshms_add_messages $SIDA1 $SIDA2 '><>A>'
+   meshms_add_messages "$SIDA1" "$SIDA2" '><>A>'
    let NROWS=NSENT+NRECV+(NACK?1:0)
    rest_request GET "/restful/meshms/$SIDA1/$SIDA2/messagelist.json"
    assert [ "$(jq '.rows | length' response.json)" = $NROWS ]
@@ -326,7 +326,7 @@ test_MeshmsListMessagesNewSinceArrival() {
    done
    wait_until [ -e response1.json -a -e response2.json -a -e response3.json ]
    for message in '>Rumplestiltskin' 'A' '<Howdydoody' '>Eulenspiegel'; do
-      meshms_add_messages $SIDA1 $SIDA2 "${message:0:1}" "${message:1}"
+      meshms_add_messages "$SIDA1" "$SIDA2" "${message:0:1}" "${message:1}"
       case ${message:0:1} in
       '<'|'>') waitfor="${message:1}";;
       'A') waitfor="ACK";;
@@ -345,11 +345,11 @@ setup_MeshmsSend() {
 test_MeshmsSend() {
    rest_request POST "/restful/meshms/$SIDA1/$SIDA2/sendmessage" 201 \
          --form-part="message=Hello World;type=text/plain;charset=utf-8"
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutGrep --matches=1 ':>:Hello World'
    rest_request POST "/restful/meshms/$SIDA2/$SIDA1/sendmessage" 201 \
          --form-part="message=Hello back!;type=text/plain;charset=utf-8"
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutGrep --matches=1 ':>:Hello World$'
    assertStdoutGrep --matches=1 ':<:Hello back!$'
 }
@@ -363,7 +363,7 @@ test_MeshmsSendMissingMessage() {
    rest_request POST "/restful/meshms/$SIDA2/$SIDA1/sendmessage" 400 --data=''
    assertJq response.json 'contains({"http_status_code": 400})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'missing.*message.*form.*part'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' 2
 }
 
@@ -378,7 +378,7 @@ test_MeshmsSendDuplicateMessage() {
          --form-part="message=Hello two;type=text/plain;charset=utf-8"
    assertJq response.json 'contains({"http_status_code": 400})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'duplicate.*message.*form.*part'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' 2
 }
 
@@ -392,7 +392,7 @@ test_MeshmsSendMessageMissingContentType() {
          --form-part="message=Hello there"
    assertJq response.json 'contains({"http_status_code": 400})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'missing.*content.*type'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' 2
 }
 
@@ -406,7 +406,7 @@ test_MeshmsSendMessageUnsupportedContentType() {
          --form-part="message=Hello there;type=text/rich"
    assertJq response.json 'contains({"http_status_code": 415})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'unsupported.*content.*type'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' 2
 }
 
@@ -420,7 +420,7 @@ test_MeshmsSendMessageMissingCharset() {
          --form-part="message=Hello there;type=text/plain"
    assertJq response.json 'contains({"http_status_code": 400})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'missing.*charset'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' 2
 }
 
@@ -434,7 +434,7 @@ test_MeshmsSendMessageUnsupportedCharset() {
          --form-part="message=Hello there;type=text/plain;charset=latin-1"
    assertJq response.json 'contains({"http_status_code": 415})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'unsupported.*charset'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    assertStdoutLineCount '==' 2
 }
 
@@ -457,18 +457,18 @@ setup_MeshmsReadAllConversations() {
    IDENTITY_COUNT=5
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message3"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message4"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message3"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message4"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2::0:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA3:unread:11:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA4:unread:14:0\$"
 }
 test_MeshmsReadAllConversations() {
    rest_request POST "/restful/meshms/$SIDA1/readall" 201
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2::0:0\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA3::11:11\$"
    assertStdoutGrep --stderr --matches=1 ":$SIDA4::14:14\$"
@@ -479,18 +479,18 @@ setup_MeshmsPostSpuriousContent() {
    IDENTITY_COUNT=2
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA2 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message3"
-   executeOk_servald meshms send message $SIDA2 $SIDA1 "Message4"
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA2" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message3"
+   executeOk_servald meshms send message "$SIDA2" "$SIDA1" "Message4"
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2:unread:35:0\$"
 }
 test_MeshmsPostSpuriousContent() {
    rest_request POST "/restful/meshms/$SIDA1/readall" 400 --form-part="offset=0"
    assertJq response.json 'contains({"http_status_code": 400})'
    assertJqGrep --ignore-case response.json '.http_status_message' 'content length'
-   executeOk_servald meshms list conversations $SIDA1
+   executeOk_servald meshms list conversations "$SIDA1"
    assertStdoutGrep --stderr --matches=1 ":$SIDA2:unread:35:0\$"
 }
 
@@ -499,20 +499,20 @@ setup_MeshmsReadAllMessages() {
    IDENTITY_COUNT=5
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message3"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message4"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message5"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message6"
-   executeOk_servald meshms list messages $SIDA2 $SIDA1
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message3"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message4"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message5"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message6"
+   executeOk_servald meshms list messages "$SIDA2" "$SIDA1"
    tfw_cat --stdout
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:0\$"
 }
 test_MeshmsReadAllMessages() {
    rest_request POST "/restful/meshms/$SIDA2/$SIDA1/readall" 201
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1::45:45\$"
 }
 
@@ -521,21 +521,21 @@ setup_MeshmsReadMessage() {
    IDENTITY_COUNT=5
    setup
    # create 3 threads, with all permutations of incoming and outgoing messages
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message1"
-   executeOk_servald meshms send message $SIDA3 $SIDA1 "Message2"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message3"
-   executeOk_servald meshms send message $SIDA1 $SIDA4 "Message4"
-   executeOk_servald meshms send message $SIDA4 $SIDA1 "Message5"
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "Message6"
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message1"
+   executeOk_servald meshms send message "$SIDA3" "$SIDA1" "Message2"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message3"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA4" "Message4"
+   executeOk_servald meshms send message "$SIDA4" "$SIDA1" "Message5"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "Message6"
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:0\$"
 }
 test_MeshmsReadMessage() {
    rest_request POST "/restful/meshms/$SIDA2/$SIDA1/recv/22/read" 201
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:22\$"
    rest_request POST "/restful/meshms/$SIDA2/$SIDA1/recv/11/read" 200
-   executeOk_servald meshms list conversations $SIDA2
+   executeOk_servald meshms list conversations "$SIDA2"
    assertStdoutGrep --stderr --matches=1 ":$SIDA1:unread:45:22\$"
 }
 
@@ -585,13 +585,13 @@ setup_unicode() {
 test_unicode() {
    SMILEY1=`echo -e "\xf0\x9f\x98\x80\x0a"`
    SMILEY2=`echo -e "\xf0\x9f\x98\x90\x0a"`
-   executeOk_servald meshms send message $SIDA1 $SIDA2 "$SMILEY1"
+   executeOk_servald meshms send message "$SIDA1" "$SIDA2" "$SMILEY1"
    rest_request POST "/restful/meshms/$SIDA2/$SIDA1/sendmessage" 201 \
          --form-part="message=$SMILEY2;type=text/plain;charset=utf-8"
    rest_request GET "/restful/meshms/$SIDA1/$SIDA2/messagelist.json"
    assertGrep --matches=1 response.json '\\uD83D\\uDE10'
    assertGrep --matches=1 response.json '\\uD83D\\uDE00'
-   executeOk_servald meshms list messages $SIDA1 $SIDA2
+   executeOk_servald meshms list messages "$SIDA1" "$SIDA2"
    tfw_cat --stdout
    assertStdoutGrep --matches=1 "$SMILEY1"
    assertStdoutGrep --matches=1 "$SMILEY2"
diff --git a/tests/msp b/tests/msp
index 73d4edb0..b506de41 100755
--- a/tests/msp
+++ b/tests/msp
@@ -24,7 +24,7 @@ source "${0%/*}/../testdefs.sh"
 
 _simulator() {
    # TODO timeout & failure reporting?
-   $servald_build_root/simulator <&8 >$SIM_OUT
+   "$servald_build_root/simulator" <&8 >$SIM_OUT
 }
 start_simulator() {
   SIM_IN="$PWD/SIM_IN"
@@ -78,7 +78,7 @@ setup_connect_fail() {
 }
 test_connect_fail() {
    set_instance +A
-   execute --exit-status=1 --timeout=20 $servald msp connect $SIDB 512 <<EOF
+   execute --exit-status=1 --timeout=20 "$servald" msp connect "$SIDB" 512 <<EOF
 Hello from the client
 EOF
    tfw_cat --stderr
@@ -101,7 +101,7 @@ test_hello() {
    set_instance +A
    fork %listen server_hello
    set_instance +B
-   executeOk_servald --timeout=20 msp connect $SIDA 512 <<EOF
+   executeOk_servald --timeout=20 msp connect "$SIDA" 512 <<EOF
 Hello from the client
 EOF
    assertStdoutGrep --matches=1 "^Hello from the server$"
@@ -124,7 +124,7 @@ test_client_no_data() {
    set_instance +A
    fork %listen server_client_no_data
    set_instance +B
-   executeOk_servald --timeout=20 msp connect $SIDA 512 <<EOF
+   executeOk_servald --timeout=20 msp connect "$SIDA" 512 <<EOF
 EOF
    assertStderrGrep --matches=1 " Connection with .* closed gracefully$"
    tfw_cat --stderr
@@ -149,7 +149,7 @@ test_server_no_data() {
    set_instance +A
    fork %listen server_server_no_data
    set_instance +B
-   executeOk_servald --timeout=20 msp connect $SIDA 512 <file1
+   executeOk_servald --timeout=20 msp connect "$SIDA" 512 <file1
    assertStderrGrep --matches=1 " Connection with .* closed gracefully$"
    tfw_cat --stderr
    fork_wait %listen
@@ -166,7 +166,7 @@ listen_pipe() {
    tfw_cat --stdout --stderr
 }
 connect_pipe() {
-   executeOk_servald msp connect $1 512 < <(echo "START" && sleep 20 && echo "END")
+   executeOk_servald msp connect "$1" 512 < <(echo "START" && sleep 20 && echo "END")
    assertStderrGrep --matches=1 " Connection with .* closed gracefully$"
    tfw_cat --stdout --stderr
 }
@@ -174,7 +174,7 @@ test_keep_alive() {
    set_instance +A
    fork %listen listen_pipe
    set_instance +B
-   fork %connect connect_pipe $SIDA
+   fork %connect connect_pipe "$SIDA"
    fork_wait %listen %connect
 }
 
@@ -185,7 +185,7 @@ setup_forward() {
    start_servald_instances +A +B
 }
 client_forward() {
-   executeOk --timeout=20 $servald msp connect --once --forward=$1 $2 512
+   executeOk --timeout=20 "$servald" msp connect --once --forward="$1" "$2" 512
    assertStderrGrep --matches=1 " Connection with .* closed gracefully$"
    tfw_cat --stdout --stderr
 }
@@ -193,7 +193,7 @@ test_forward() {
    set_instance +A
    fork %listen server_hello
    set_instance +B
-   fork %connect client_forward 2048 $SIDA
+   fork %connect client_forward 2048 "$SIDA"
    sleep 1
    executeOk nc6 -q 30 -v 127.0.0.1 2048 < <(echo "Hello from the client")
    assertStdoutGrep --matches=1 "^Hello from the server$"
@@ -212,7 +212,7 @@ server_forward() {
    tfw_cat --stderr
 }
 nc_listen() {
-   execute nc6 -q -1 -v -l -p $1 < <(echo "Hello from the server")
+   execute nc6 -q -1 -v -l -p "$1" < <(echo "Hello from the server")
    tfw_cat --stdout --stderr
 }
 test_tcp_tunnel() {
@@ -220,7 +220,7 @@ test_tcp_tunnel() {
    set_instance +A
    fork %server server_forward 6000
    set_instance +B
-   fork %client client_forward 6001 $SIDA
+   fork %client client_forward 6001 "$SIDA"
    sleep 1
    executeOk nc6 -q 10 -v 127.0.0.1 6001 < <(echo "Hello from the client")
    tfw_cat --stdout --stderr
@@ -256,7 +256,7 @@ test_slow_unreliable() {
    set_instance +A
    fork %listen slow_listen
    set_instance +B
-   executeOk_servald msp connect $SIDA 512 < file1
+   executeOk_servald msp connect "$SIDA" 512 < file1
    assertStderrGrep --matches=1 " Connection with .* closed gracefully$"
    tfw_log "execution time (ms); $realtime_ms"
    tfw_cat --stderr
@@ -270,7 +270,7 @@ setup_refused(){
    start_servald_instances +A +B
 }
 server_refused(){
-   executeOk $servald msp listen --once --forward=4001 512
+   executeOk "$servald" msp listen --once --forward=4001 512
    assertStderrGrep --matches=1 " Connection refused"
    tfw_cat --stderr
 }
@@ -278,7 +278,7 @@ test_refused(){
    set_instance +A
    fork %listen server_refused
    set_instance +B
-   executeOk_servald msp connect $SIDA 512 < <(echo "Hello")
+   executeOk_servald msp connect "$SIDA" 512 < <(echo "Hello")
    assertStderrGrep --matches=1 " Connection with .* closed suddenly$"
    tfw_cat --stdout --stderr
    fork_wait %listen
@@ -291,7 +291,7 @@ setup_terminate() {
    start_servald_instances +A +B
 }
 client_terminate() {
-   executeOk_servald msp connect --once --forward=3001 $SIDA 512
+   executeOk_servald msp connect --once --forward=3001 "$SIDA" 512
    assertStderrGrep --matches=1 " Connection with .* closed gracefully$"
    tfw_cat --stdout --stderr
 }
diff --git a/tests/rhizomejava b/tests/rhizomejava
index 36622eb8..6aeacaa2 100755
--- a/tests/rhizomejava
+++ b/tests/rhizomejava
@@ -54,7 +54,7 @@ doc_RhizomeList="Java API Rhizome list 100 bundles"
 setup_RhizomeList() {
    setup
    NBUNDLES=100
-   rhizome_add_bundles $SIDA1 0 $((NBUNDLES-1))
+   rhizome_add_bundles "$SIDA1" 0 $((NBUNDLES-1))
    assert [ "$ROWID_MAX" -ge "$NBUNDLES" ]
 }
 test_RhizomeList() {
@@ -96,7 +96,7 @@ setup_RhizomeListNewSince() {
    # Use REST interface to add bundles, not CLI, in order to avoid a database
    # locking storm
    rhizome_use_restful harry potter
-   rhizome_add_bundles $SIDA1 0 5
+   rhizome_add_bundles "$SIDA1" 0 5
    executeJavaOk --stderr org.servalproject.test.Rhizome rhizome-list
    assertStdoutLineCount == 6
    unset_vars_with_prefix XX_
@@ -112,7 +112,7 @@ test_RhizomeListNewSince() {
       fork %list$i rhizome_list_newsince
    done
    wait_until [ -e newsince1 -a -e newsince2 -a -e newsince3 ]
-   rhizome_add_bundles $SIDA1 6 10
+   rhizome_add_bundles "$SIDA1" 6 10
    for i in 1 2 3; do
       wait_until --timeout=10 grep "${BID[10]}" newsince$i
    done
@@ -161,7 +161,7 @@ assert_metadata() {
 doc_RhizomeManifest="Java API fetch Rhizome manifest"
 setup_RhizomeManifest() {
    setup
-   rhizome_add_bundles $SIDA1 0 2
+   rhizome_add_bundles "$SIDA1" 0 2
 }
 test_RhizomeManifest() {
    for n in 0 1 2; do
@@ -188,8 +188,8 @@ test_RhizomeManifestNonexist() {
 doc_RhizomePayloadRaw="Java API fetch Rhizome raw payload"
 setup_RhizomePayloadRaw() {
    setup
-   rhizome_add_bundles $SIDA1 0 1
-   rhizome_add_bundles --encrypted $SIDA1 2 3
+   rhizome_add_bundles "$SIDA1" 0 1
+   rhizome_add_bundles --encrypted "$SIDA1" 2 3
 }
 test_RhizomePayloadRaw() {
    for n in 0 1 2 3; do
@@ -219,7 +219,7 @@ setup_RhizomePayloadRawNonexistPayload() {
       executeOk_servald config set rhizome.max_blob_size 0
    }
    setup
-   rhizome_add_bundles $SIDA1 0 0
+   rhizome_add_bundles "$SIDA1" 0 0
    rhizome_delete_payload_blobs "${HASH[0]}"
 }
 test_RhizomePayloadRawNonexistPayload() {
@@ -232,8 +232,8 @@ test_RhizomePayloadRawNonexistPayload() {
 doc_RhizomePayloadDecrypted="Java API fetch Rhizome decrypted payload"
 setup_RhizomePayloadDecrypted() {
    setup
-   rhizome_add_bundles $SIDA1 0 1
-   rhizome_add_bundles --encrypted $SIDA1 2 3
+   rhizome_add_bundles "$SIDA1" 0 1
+   rhizome_add_bundles --encrypted "$SIDA1" 2 3
 }
 test_RhizomePayloadDecrypted() {
    for n in 0 1 2 3; do
@@ -252,7 +252,7 @@ setup_RhizomePayloadDecryptedNonexistManifest() {
       executeOk_servald config set rhizome.max_blob_size 0
    }
    setup
-   rhizome_add_bundles $SIDA1 0 0
+   rhizome_add_bundles "$SIDA1" 0 0
    rhizome_delete_payload_blobs "${HASH[0]}"
 }
 test_RhizomePayloadDecryptedNonexistManifest() {
@@ -265,10 +265,10 @@ test_RhizomePayloadDecryptedNonexistManifest() {
 doc_RhizomePayloadDecryptedForeign="Java API cannot fetch foreign Rhizome decrypted payload"
 setup_RhizomePayloadDecryptedForeign() {
    setup
-   rhizome_add_bundles --encrypted $SIDA1 0 0
+   rhizome_add_bundles --encrypted "$SIDA1" 0 0
    set_instance +B
    create_single_identity
-   rhizome_add_bundles --encrypted $SIDB 1 1
+   rhizome_add_bundles --encrypted "$SIDB" 1 1
    executeOk_servald rhizome export manifest "${BID[1]}" file1.manifest
    set_instance +A
    executeOk_servald rhizome import bundle raw1 file1.manifest
@@ -366,7 +366,7 @@ setup_RhizomeImport() {
    setup
    set_instance +B
    create_single_identity
-   rhizome_add_bundles $SIDB 1 1
+   rhizome_add_bundles "$SIDB" 1 1
    executeOk_servald rhizome export manifest "${BID[1]}" file1.manifest
    set_instance +A
 }
diff --git a/tests/rhizomeops b/tests/rhizomeops
index 4a414f0a..fbd079e1 100755
--- a/tests/rhizomeops
+++ b/tests/rhizomeops
@@ -33,7 +33,7 @@ setup_rhizome() {
       set_rhizome_config
       if [ $A_IDENTITY_COUNT -eq 1 ]; then
          create_single_identity
-         echo $SIDA >>sids
+         echo "$SIDA" >>sids
       else
          create_identities $A_IDENTITY_COUNT
          for ((i=0; i!=A_IDENTITY_COUNT; ++i)); do
@@ -97,9 +97,9 @@ setup_AddNoManifest() {
    echo "Another test file" >file2
 }
 test_AddNoManifest() {
-   executeOk_servald rhizome add file $SIDA file1
+   executeOk_servald rhizome add file "$SIDA" file1
    assert_stdout_add_file file1
-   executeOk_servald rhizome add file $SIDA "$PWD/file2"
+   executeOk_servald rhizome add file "$SIDA" "$PWD/file2"
    assert_stdout_add_file file2
 }
 
@@ -114,7 +114,7 @@ setup_AddManifestFieldUnsupported() {
    echo "bogus=one" >file1.manifest
 }
 test_AddManifestFieldUnsupported() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    assert_stdout_add_file file1
    tfw_cat -v file1.manifest
    assert_manifest_complete file1.manifest
@@ -131,7 +131,7 @@ setup_AddManifestFieldUnsupportedArgs() {
    echo "Another test file" >file2
 }
 test_AddManifestFieldUnsupportedArgs() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest '' bogus=two
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest '' bogus=two
    assert_stdout_add_file file1
    tfw_cat -v file1.manifest
    assert_manifest_complete file1.manifest
@@ -157,7 +157,7 @@ setup_AddInvalidAuthor() {
    echo "A test file" >file1
 }
 test_AddInvalidAuthor() {
-   execute $servald rhizome add file 'not_a_valid_SID' file1
+   execute "$servald" rhizome add file 'not_a_valid_SID' file1
    assertExitStatus '==' 255
    assertStderrGrep '^ERROR:.*[Ii]nvalid .*[Ss][Ii][Dd]'
 }
@@ -175,7 +175,7 @@ test_AddNoAuthorEncrypted() {
    assert_manifest_fields file1.manifest !BK
    assert_stdout_add_file file1 !.author !BK
    extract_stdout_secret file1_secret
-   executeOk_servald rhizome extract file $re_manifestid file1x $file1_secret
+   executeOk_servald rhizome extract file "$re_manifestid" file1x $file1_secret
    tfw_cat --stdout --stderr
    assert diff file1 file1x
 }
@@ -191,13 +191,13 @@ setup_AddNonExistManifest() {
 }
 test_AddNonExistManifest() {
    assert --error-on-fail [ ! -e file1.manifest ]
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    assert_stdout_add_file file1
    assert [ -r file1.manifest ]
    assert_manifest_complete file1.manifest
    assert_manifest_fields file1.manifest service=file name=file1
    assert --error-on-fail [ ! -e file2.manifest ]
-   executeOk_servald rhizome add file $SIDA "$PWD/file2" file2.manifest
+   executeOk_servald rhizome add file "$SIDA" "$PWD/file2" file2.manifest
    assert_stdout_add_file file2
    assert [ -r file2.manifest ]
    assert_manifest_complete file2.manifest
@@ -214,7 +214,7 @@ setup_AddManifest() {
    echo -e 'name=wah\ndate=12345' >file1.manifest
 }
 test_AddManifest() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr -v file1.manifest
    assert_stdout_add_file file1 name=wah
    assert_manifest_complete file1.manifest
@@ -230,7 +230,7 @@ setup_AddManifestArgs() {
    echo "A test file" >file1
 }
 test_AddManifestArgs() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest '' name=wah date=12345
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest '' name=wah date=12345
    tfw_cat --stdout --stderr -v file1.manifest
    assert_stdout_add_file file1 name=wah
    assert_manifest_complete file1.manifest
@@ -245,13 +245,13 @@ setup_AddEmpty() {
    assert_rhizome_list
 }
 test_AddEmpty() {
-   executeOk_servald rhizome add file $SIDA '' empty.manifest
+   executeOk_servald rhizome add file "$SIDA" '' empty.manifest
    tfw_cat --stdout --stderr -v empty.manifest
    assert_stdout_add_file --manifest=empty.manifest ''
    assert_manifest_complete empty.manifest
    assert_manifest_fields empty.manifest service=file name= filesize=0
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA --manifest=empty.manifest ''
+   assert_rhizome_list --fromhere=1 --author="$SIDA" --manifest=empty.manifest ''
 }
 
 doc_AddMissing="Attempt to add a file and manifest that don't exist"
@@ -260,7 +260,7 @@ setup_AddMissing() {
    setup_rhizome
 }
 test_AddMissing() {
-   execute $servald rhizome add file $SIDA 'file1' 'file1.manifest'
+   execute "$servald" rhizome add file "$SIDA" 'file1' 'file1.manifest'
    tfw_cat --stdout --stderr
    assertExitStatus '==' 255
 }
@@ -276,13 +276,13 @@ setup_AddThenList() {
 }
 test_AddThenList() {
    # Add first file
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1
    # Add second file
-   executeOk_servald rhizome add file $SIDA file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA" file2 file2.manifest
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
 }
 
 doc_CleanVerify="Verify all bundles"
@@ -316,10 +316,10 @@ setup_ExtractManifestAfterAdd() {
    setup_servald
    setup_rhizome
    echo "A test file" >file1
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_stdout_rowid rowid
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
    extract_manifest_filehash filehash file1.manifest
@@ -327,7 +327,7 @@ setup_ExtractManifestAfterAdd() {
    extract_manifest_date date file1.manifest
 }
 test_ExtractManifestAfterAdd() {
-   executeOk_servald rhizome export manifest $manifestid file1x.manifest
+   executeOk_servald rhizome export manifest "$manifestid" file1x.manifest
    tfw_cat --stdout --stderr
    local size=$(( $(cat file1 | wc -c) + 0 ))
    assertStdoutGrep --matches=1 "^manifestid:$manifestid\$"
@@ -353,10 +353,10 @@ setup_ExtractManifestFileAfterAdd() {
    setup_servald
    setup_rhizome
    echo "A test file" >file1
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_stdout_rowid rowid
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
    extract_manifest_filehash filehash file1.manifest
@@ -364,7 +364,7 @@ setup_ExtractManifestFileAfterAdd() {
    extract_manifest_date date file1.manifest
 }
 test_ExtractManifestFileAfterAdd() {
-   executeOk_servald rhizome export bundle $manifestid file1x.manifest file1x
+   executeOk_servald rhizome export bundle "$manifestid" file1x.manifest file1x
    tfw_cat --stdout --stderr
    assertStdoutLineCount '==' 13
    local size=$(( $(cat file1 | wc -c) + 0 ))
@@ -393,14 +393,14 @@ setup_ExtractManifestFileFromExtBlob() {
    setup_rhizome
    executeOk_servald config set rhizome.max_blob_size 0
    echo "A test file" >file1
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_stdout_rowid rowid1
    executeOk_servald config set rhizome.max_blob_size 1000
    echo "Another test file" >file2
-   executeOk_servald rhizome add file $SIDA file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA" file2 file2.manifest
    extract_stdout_rowid rowid2
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
    extract_manifest_id manifestid1 file1.manifest
    extract_manifest_version version1 file1.manifest
    extract_manifest_filehash filehash1 file1.manifest
@@ -465,7 +465,7 @@ setup_LargePayload() {
 }
 test_LargePayload() {
    rhizome_add_file file1 100000
-   executeOk_servald rhizome export bundle $BID file1x.manifest file1x
+   executeOk_servald rhizome export bundle "$BID" file1x.manifest file1x
    assert [ -e file1x.manifest ]
    assert diff file1.manifest file1x.manifest
    assert [ -e file1x ]
@@ -478,14 +478,14 @@ setup_CorruptExternalBlob() {
    setup_rhizome
    executeOk_servald config set rhizome.max_blob_size 0
    echo "A test file" >file1
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_manifest_id manifestid file1.manifest
    extract_manifest_filehash filehash file1.manifest
    assert cmp file1 "$SERVALINSTANCE_PATH/blob/$filehash"
    echo "Replacement" >"$SERVALINSTANCE_PATH/blob/$filehash"
 }
 test_CorruptExternalBlob() {
-   execute --exit-status=255 $servald rhizome extract file $manifestid file1a
+   execute --exit-status=255 "$servald" rhizome extract file "$manifestid" file1a
    tfw_cat --stderr
 }
 
@@ -494,7 +494,7 @@ setup_ExtractManifestToStdout() {
    setup_servald
    setup_rhizome
    echo "A test file" >file1
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_stdout_rowid rowid
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
@@ -503,7 +503,7 @@ setup_ExtractManifestToStdout() {
    extract_manifest_date date file1.manifest
 }
 test_ExtractManifestToStdout() {
-   executeOk_servald rhizome export manifest $manifestid -
+   executeOk_servald rhizome export manifest "$manifestid" -
    assertStdoutLineCount '>=' 14
    local size=$(( $(cat file1 | wc -c) + 0 ))
    assertStdoutGrep --line=..13 --matches=1 "^manifestid:$manifestid\$"
@@ -543,7 +543,7 @@ setup_ExtractManifestAfterAddNoAuthor() {
    extract_manifest_date date file1.manifest
 }
 test_ExtractManifestAfterAddNoAuthor() {
-   executeOk_servald rhizome export manifest $manifestid file1x.manifest
+   executeOk_servald rhizome export manifest "$manifestid" file1x.manifest
    assert diff file1.manifest file1x.manifest
    assertStdoutLineCount '==' 10
    local size=$(( $(cat file1 | wc -c) + 0 ))
@@ -566,7 +566,7 @@ setup_ExtractManifestNonExistent() {
    manifestid=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
 }
 test_ExtractManifestNonExistent() {
-   execute --exit-status=1 $servald rhizome export manifest $manifestid foo.manifest
+   execute --exit-status=1 "$servald" rhizome export manifest "$manifestid" foo.manifest
    assertStdoutLineCount '==' 0
    assert [ ! -e foo.manifest ]
 }
@@ -577,13 +577,13 @@ setup_ExtractManifestInvalidID() {
    setup_rhizome
 }
 test_ExtractManifestInvalidID() {
-   execute --exit-status=255 $servald rhizome export manifest 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEx foo.manifest
+   execute --exit-status=255 "$servald" rhizome export manifest 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEx foo.manifest
    assertStdoutLineCount '==' 0
    assert [ ! -e foo.manifest ]
-   execute --exit-status=255 $servald rhizome export manifest 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE foo.manifest
+   execute --exit-status=255 "$servald" rhizome export manifest 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE foo.manifest
    assertStdoutLineCount '==' 0
    assert [ ! -e foo.manifest ]
-   execute --exit-status=255 $servald rhizome export manifest foo.manifest
+   execute --exit-status=255 "$servald" rhizome export manifest foo.manifest
    assertStdoutLineCount '==' 0
    assert [ ! -e foo.manifest ]
 }
@@ -593,11 +593,11 @@ setup_ExtractFileAfterAdd() {
    setup_servald
    setup_rhizome
    echo "A test file" >file1
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stderr
    extract_stdout_rowid rowid
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
    extract_manifest_filehash filehash file1.manifest
@@ -605,7 +605,7 @@ setup_ExtractFileAfterAdd() {
    extract_manifest_date date file1.manifest
 }
 test_ExtractFileAfterAdd() {
-   executeOk_servald rhizome extract file $manifestid file1x
+   executeOk_servald rhizome extract file "$manifestid" file1x
    tfw_cat --stderr
    assert diff file1 file1x
    local size=$(( $(cat file1 | wc -c) + 0 ))
@@ -633,11 +633,11 @@ setup_ExtractFileMissing() {
    filehash=0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF
 }
 test_ExtractFileMissing() {
-   execute --exit-status=1 $servald rhizome extract file $BID foo
+   execute --exit-status=1 "$servald" rhizome extract file "$BID" foo
    tfw_cat --stderr
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
-   execute --exit-status=1 $servald rhizome export file $filehash foo
+   execute --exit-status=1 "$servald" rhizome export file "$filehash" foo
    tfw_cat --stderr
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
@@ -649,22 +649,22 @@ setup_ExtractFileInvalidID() {
    setup_rhizome
 }
 test_ExtractFileInvalidID() {
-   execute --exit-status=255 $servald rhizome extract file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEx foo
+   execute --exit-status=255 "$servald" rhizome extract file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEx foo
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
-   execute --exit-status=255 $servald rhizome extract file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE foo
+   execute --exit-status=255 "$servald" rhizome extract file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE foo
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
-   execute --exit-status=255 $servald rhizome extract file foo
+   execute --exit-status=255 "$servald" rhizome extract file foo
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
-   execute --exit-status=255 $servald rhizome export file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEx foo
+   execute --exit-status=255 "$servald" rhizome export file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEx foo
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
-   execute --exit-status=255 $servald rhizome export file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE foo
+   execute --exit-status=255 "$servald" rhizome export file 0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDE foo
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
-   execute --exit-status=255 $servald rhizome export file foo
+   execute --exit-status=255 "$servald" rhizome export file foo
    assertStdoutLineCount '==' 0
    assert [ ! -e foo ]
 }
@@ -679,34 +679,34 @@ setup_AddDeDuplicate() {
    echo "Another test file" >file2
    echo "A test file, second version" >file1_2
    # Add first file
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_stdout_secret file1_secret
    # Add second file
-   executeOk_servald rhizome add file $SIDA file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA" file2 file2.manifest
    extract_stdout_secret file2_secret
    # Make sure they are both in the list.
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
 }
 test_AddDeDuplicate() {
    # Add first file again - should return a "duplicate" status code and nothing
    # should change in its manifests.
-   execute --exit-status=2 --stderr --core-backtrace $servald rhizome add file $SIDA file1 file1.manifestA
+   execute --exit-status=2 --stderr --core-backtrace "$servald" rhizome add file "$SIDA" file1 file1.manifestA
    assert [ -s file1.manifestA ]
    assert_stdout_add_file file1
    extract_stdout_secret file1_dup_secret
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
    strip_signatures file1.manifest file1.manifestA
    assert diff file1.manifest file1.manifestA
    assert [ $file1_secret = $file1_dup_secret ]
    # Repeat for second file.
-   execute --exit-status=2 --stderr $servald rhizome add file $SIDA file2 file2.manifestA
+   execute --exit-status=2 --stderr "$servald" rhizome add file "$SIDA" file2 file2.manifestA
    assert [ -s file2.manifestA ]
    assert_stdout_add_file file2
    extract_stdout_secret file2_dup_secret
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
    strip_signatures file2.manifest file2.manifestA
    assert diff file2.manifest file2.manifestA
    assert [ $file2_secret = $file2_dup_secret ]
@@ -719,22 +719,22 @@ setup_AddForceDuplicate() {
 test_AddForceDuplicate() {
    # Add first file again with the --force-new option.  A new manifest
    # should be created with a new ID.
-   executeOk_servald rhizome add file --force-new $SIDA file1 file1.manifestA
+   executeOk_servald rhizome add file --force-new "$SIDA" file1 file1.manifestA
    assert [ -s file1.manifestA ]
    assert_stdout_add_file --manifest=file1.manifestA file1
    extract_stdout_secret file1_dup_secret
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2 --manifest=file1.manifestA file1
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2 --manifest=file1.manifestA file1
    strip_signatures file1.manifest file1.manifestA
    assert ! diff file1.manifest file1.manifestA
    assert [ $file1_secret != $file1_dup_secret ]
    # Repeat for second file.
-   executeOk_servald rhizome add file --force-new $SIDA file2 file2.manifestA
+   executeOk_servald rhizome add file --force-new "$SIDA" file2 file2.manifestA
    assert [ -s file2.manifestA ]
    assert_stdout_add_file --manifest=file2.manifestA file2
    extract_stdout_secret file2_dup_secret
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2 --manifest=file1.manifestA file1 --manifest=file2.manifestA file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2 --manifest=file1.manifestA file1 --manifest=file2.manifestA file2
    strip_signatures file2.manifest file2.manifestA
    assert ! diff file2.manifest file2.manifestA
    assert [ $file2_secret != $file2_dup_secret ]
@@ -749,13 +749,13 @@ test_AddMismatched() {
    # code indicating inconsistency.
    cp file1.manifest file1_2.manifest
    # Exit status 6 means manifest and payload do not match (filesize/filehash).
-   execute --exit-status=6 --stderr --core-backtrace $servald rhizome add file $SIDA file1_2 file1_2.manifest
+   execute --exit-status=6 --stderr --core-backtrace "$servald" rhizome add file "$SIDA" file1_2 file1_2.manifest
    tfw_cat file1.manifest file1_2.manifest
    # Output manifest should be the same as the re-used manigfest
    assert --stderr cmp file1.manifest file1_2.manifest
    # And rhizome store should be unchanged.
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
 }
 
 doc_AddUpdateSameVersion="Add new payload to existing manifest with same version fails"
@@ -772,13 +772,13 @@ test_AddUpdateSameVersion() {
    # Try to add another file using an existing manifest Id and Version, should
    # fail and update the manifest file to show existing bundle's manifest.
    tfw_cat -v file1_2.manifest
-   execute $servald rhizome add file $SIDA file1_2 file1_2.manifest
+   execute "$servald" rhizome add file "$SIDA" file1_2 file1_2.manifest
    assertExitStatus --stderr '==' 1
    tfw_cat -v file1_2.manifest file1.manifest
    assert cmp file1_2.manifest file1.manifest
    # And rhizome store should be unchanged.
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1 file2
 }
 
 doc_AddUpdateNewVersion="Add new payload to existing manifest with new version"
@@ -791,13 +791,13 @@ setup_AddUpdateNewVersion() {
 }
 test_AddUpdateNewVersion() {
    tfw_cat -v file1_2.manifest
-   executeOk_servald rhizome add file $SIDA file1_2 file1_2.manifest
+   executeOk_servald rhizome add file "$SIDA" file1_2 file1_2.manifest
    tfw_cat --stderr
    assert_stdout_add_file file1_2 name=file1
    assert_manifest_newer file1.manifest file1_2.manifest
    # Rhizome store contents reflect new payload.
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1_2 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1_2 file2
 }
 
 doc_AddUpdateDiscoverAuthor="Add new payload to manifest with author discovery"
@@ -810,7 +810,7 @@ test_AddUpdateDiscoverAuthor() {
    tfw_cat --stderr
    # Rhizome store contents have new payload.
    executeOk_servald rhizome list
-   assert_rhizome_list --fromhere=1 --author=$SIDA file1_2 file2
+   assert_rhizome_list --fromhere=1 --author="$SIDA" file1_2 file2
 }
 
 doc_AddUpdateNoAuthor="Cannot add new payload to authorless manifest"
@@ -832,7 +832,7 @@ setup_AddUpdateNoAuthor() {
    tfw_cat -v file1_2.manifest
 }
 test_AddUpdateNoAuthor() {
-   execute $servald rhizome add file $SIDA file1_2 file1_2.manifest
+   execute "$servald" rhizome add file "$SIDA" file1_2 file1_2.manifest
    tfw_cat --stderr
    assertExitStatus '!=' 0
    # Rhizome store contents still have old payload
@@ -862,7 +862,7 @@ setup_AddUpdateAutoVersion() {
 test_AddUpdateAutoVersion() {
    tfw_cat -v file1_2.manifest
    sleep 0.001 # Ensure that at least one millisecond has elapsed
-   executeOk_servald rhizome add file $SIDA file1_2 file1_2.manifest
+   executeOk_servald rhizome add file "$SIDA" file1_2 file1_2.manifest
    assert_manifest_newer file1.manifest file1_2.manifest
    # Rhizome store contents reflect new payload.
    executeOk_servald rhizome list
@@ -877,11 +877,11 @@ setup_AddUpdateArgs() {
 }
 test_AddUpdateArgs() {
    sleep 0.001 # Ensure that at least one millisecond has elapsed
-   executeOk_servald rhizome add file $SIDA file1_2 file1_2.manifest '' !version !filesize !filehash !date
+   executeOk_servald rhizome add file "$SIDA" file1_2 file1_2.manifest '' !version !filesize !filehash !date
    assert_stdout_add_file file1_2 name=file1
    assert_manifest_fields file1_2.manifest name=file1
    extract_manifest_id BID2 file1_2.manifest
-   assert [ $BID = $BID2 ]
+   assert [ "$BID" = "$BID2" ]
    assert_manifest_newer file1.manifest file1_2.manifest
    # Rhizome store contents reflect new payload.
    executeOk_servald rhizome list
@@ -896,7 +896,7 @@ setup_AddServiceInvalid() {
    echo 'service=Fubar!' >file1.manifest
 }
 test_AddServiceInvalid() {
-   execute $servald rhizome add file $SIDA file1 file1.manifest
+   execute "$servald" rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr
    assertExitStatus '!=' 0
 }
@@ -909,7 +909,7 @@ setup_AddServiceUnsupported() {
    echo 'service=Fubar' >file1.manifest
 }
 test_AddServiceUnsupported() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr
 }
 
@@ -935,7 +935,7 @@ test_AddUpdateNoAuthorWithPassphrase() {
    assert_manifest_complete file1_2.manifest
    extract_manifest_id BID2 file1.manifest
    assert [ "$BID" = "$BID2" ]
-   executeOk_servald rhizome extract file $BID file1x
+   executeOk_servald rhizome extract file "$BID" file1x
    tfw_cat --stdout --stderr
    assert diff file1_2 file1x
 }
@@ -949,22 +949,22 @@ setup_AddUpdateWithPassphrase() {
    pass='On the Ning Nang Nong'
 }
 test_AddUpdateWithPassphrase() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest "#$pass"
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest "#$pass"
    tfw_cat --stdout --stderr
-   assert_stdout_add_file file1 .author=$SIDA
+   assert_stdout_add_file file1 .author="$SIDA"
    assert_manifest_complete file1.manifest
    extract_manifest_id BID file1.manifest
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 file1
-   executeOk_servald rhizome add file $SIDA file1_2 file1_2.manifest "#$pass"
+   executeOk_servald rhizome add file "$SIDA" file1_2 file1_2.manifest "#$pass"
    tfw_cat --stdout --stderr
-   assert_stdout_add_file file1_2 .author=$SIDA
+   assert_stdout_add_file file1_2 .author="$SIDA"
    assert_manifest_complete file1_2.manifest
    extract_manifest_id BID2 file1.manifest
    assert [ "$BID" = "$BID2" ]
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 file1_2
-   executeOk_servald rhizome extract file $BID file1x
+   executeOk_servald rhizome extract file "$BID" file1x
    tfw_cat --stdout --stderr
    assert diff file1_2 file1x
 }
@@ -977,18 +977,18 @@ setup_EncryptedPayload() {
    echo -e "service=file\nname=private\ncrypt=1" >file1.manifest
 }
 test_EncryptedPayload() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    assert_manifest_complete file1.manifest
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 file1
    extract_manifest_id BID file1.manifest
-   executeOk_servald rhizome extract file $BID file1x
+   executeOk_servald rhizome extract file "$BID" file1x
    tfw_cat --stdout --stderr
    assert diff file1 file1x
    extract_manifest_filehash filehash file1.manifest
-   executeOk_servald rhizome export file $filehash file1y
+   executeOk_servald rhizome export file "$filehash" file1y
    assert ! diff file1 file1y
 }
 
@@ -1004,13 +1004,13 @@ setup_RecipientIsEncrypted() {
 }
 test_RecipientIsEncrypted() {
 # add file with sender & recipient
-   executeOk_servald rhizome add file $SIDA1 file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA1" file1 file1.manifest
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    assert_manifest_complete file1.manifest
    assertGrep file1.manifest "crypt=1"
 # add file sith only recipient
-   executeOk_servald rhizome add file $SIDA1 file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA1" file2 file2.manifest
    tfw_cat --stdout --stderr
    assert_stdout_add_file file2
    assert_manifest_complete file2.manifest
@@ -1020,17 +1020,17 @@ test_RecipientIsEncrypted() {
    extract_manifest_filehash filehash1 file1.manifest
    extract_manifest_id BID2 file2.manifest
    extract_manifest_filehash filehash2 file2.manifest
-   executeOk_servald rhizome extract file $BID1 file1x
+   executeOk_servald rhizome extract file "$BID1" file1x
    tfw_cat --stdout --stderr
    assert diff file1 file1x
-   executeOk_servald rhizome extract file $BID2 file2x
+   executeOk_servald rhizome extract file "$BID2" file2x
    tfw_cat --stdout --stderr
    assert diff file2 file2x
 # and that the stored files are obscured
-   executeOk_servald rhizome export file $filehash1 file1y
+   executeOk_servald rhizome export file "$filehash1" file1y
    tfw_cat file1 -v file1y
    assert ! diff file1 file1y
-   executeOk_servald rhizome export file $filehash2 file2y
+   executeOk_servald rhizome export file "$filehash2" file2y
    tfw_cat file2 -v file2y
    assert ! diff file2 file2y
 }
@@ -1043,14 +1043,14 @@ setup_BroadcastNotEncrypted() {
    echo -e "service=file\nsender=$SIDA\nrecipient=FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" >file1.manifest
 }
 test_BroadcastNotEncrypted() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    assert_manifest_complete file1.manifest
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 file1
    extract_manifest_filehash filehash file1.manifest
-   executeOk_servald rhizome export file $filehash file1y
+   executeOk_servald rhizome export file "$filehash" file1y
    assert diff file1 file1y
 }
 
@@ -1062,15 +1062,15 @@ setup_AddReuseManifest() {
    echo "First content" >file1
    echo "Second content" >file1a
    echo -e "service=wazoo\nunexpected=true\nsender=$SIDB1\nnothing=here" >file1.manifest
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stderr
    extract_stdout_manifestid BID
 }
 test_AddReuseManifest() {
-   executeOk_servald rhizome add file --bundle=$BID $SIDA file1a file1a.manifest '' !nothing something=there
+   executeOk_servald rhizome add file --bundle=$BID "$SIDA" file1a file1a.manifest '' !nothing something=there
    tfw_cat --stderr
    assert_manifest_fields file1a.manifest service=wazoo unexpected=true sender=$SIDB1 !nothing something=there
-   executeOk_servald rhizome export bundle $BID file1ax.manifest file1ax
+   executeOk_servald rhizome export bundle "$BID" file1ax.manifest file1ax
    assert diff file1a file1ax
 }
 
@@ -1083,13 +1083,13 @@ setup_JournalAppend() {
    cat file1 file2 > file
 }
 test_JournalAppend() {
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    extract_stdout_manifestid BID
-   executeOk_servald rhizome journal append $SIDA $BID file2
+   executeOk_servald rhizome journal append "$SIDA" "$BID" file2
    tfw_cat --stdout --stderr
-   executeOk_servald rhizome extract file $BID filex
+   executeOk_servald rhizome extract file "$BID" filex
    tfw_cat --stdout --stderr
    assert diff file filex
 }
@@ -1106,20 +1106,20 @@ setup_JournalAppendNoHash() {
    cat file1 file2 > file
 }
 test_JournalAppendNoHash() {
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    extract_stdout_manifestid BID
    extract_stdout_filehash HASH
    assert [ $(ls "$SERVALINSTANCE_PATH/hash" | wc -l) -eq 1 ]
-   executeOk_servald rhizome journal append $SIDA $BID file2
+   executeOk_servald rhizome journal append "$SIDA" "$BID" file2
    tfw_cat --stdout --stderr
    assert [ $(ls "$SERVALINSTANCE_PATH/hash" | wc -l) -eq 2 ]
    assertStderrGrep 'Reusing journal'
-   executeOk_servald rhizome extract file $BID filex
+   executeOk_servald rhizome extract file "$BID" filex
    tfw_cat --stdout --stderr
    assert diff file filex
-   executeOk_servald rhizome export file $HASH file1x
+   executeOk_servald rhizome export file "$HASH" file1x
    tfw_cat --stdout --stderr
    assert diff file1 file1x
 }
@@ -1143,18 +1143,18 @@ setup_JournalAppendSharedPayload() {
    assert [ $(ls "$SERVALINSTANCE_PATH/blob" | wc -l) -eq 2 ]
 }
 test_JournalAppendSharedPayload() {
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    extract_stdout_filehash addedhash
-   assert [ $addedhash = $HASH1 ]
+   assert [ "$addedhash" = "$HASH1" ]
    assert [ $(ls "$SERVALINSTANCE_PATH/blob" | wc -l) -eq 2 ]
    extract_stdout_manifestid BID
-   executeOk_servald rhizome journal append $SIDA $BID file2
+   executeOk_servald rhizome journal append "$SIDA" "$BID" file2
    tfw_cat --stdout --stderr
    assert_stdout_add_file file12 !name
    extract_stdout_filehash addedhash
-   assert [ $addedhash = $HASH12 ]
+   assert [ "$addedhash" = "$HASH12" ]
    assert [ $(ls "$SERVALINSTANCE_PATH/blob" | wc -l) -eq 2 ]
 }
 
@@ -1168,7 +1168,7 @@ setup_JournalAddCreate() {
 test_JournalAddCreate() {
    # TODO: servald should return a status code reserved for this case, instead
    # of the 4 error (which means "invalid manifest")
-   execute --exit-status=4 --stderr $servald rhizome add file $SIDA file1 file1.manifest
+   execute --exit-status=4 --stderr "$servald" rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr
 }
 
@@ -1177,10 +1177,10 @@ setup_JournalAddUpdate() {
    setup_servald
    setup_rhizome
    echo "Part One" > file1
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    assert_stdout_add_file file1
    extract_stdout_manifestid BID
-   executeOk_servald rhizome extract bundle $BID file1x.manifest file1x
+   executeOk_servald rhizome extract bundle "$BID" file1x.manifest file1x
    assert diff file1 file1x
    extract_manifest_version version file1x.manifest
    let version=version+1
@@ -1190,7 +1190,7 @@ setup_JournalAddUpdate() {
 test_JournalAddUpdate() {
    # TODO: servald should return a status code reserved for this case, instead
    # of the 4 error (which means "invalid manifest")
-   execute --exit-status=4 $servald rhizome add file $SIDA file1x file1x.manifest
+   execute --exit-status=4 "$servald" rhizome add file "$SIDA" file1x file1x.manifest
    tfw_cat --stdout --stderr
 }
 
@@ -1200,7 +1200,7 @@ setup_AppendFile() {
    setup_rhizome
    echo "Part One" > file1
    echo "Part Two" > file2
-   executeOk_servald rhizome add file $SIDA file1
+   executeOk_servald rhizome add file "$SIDA" file1
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    extract_stdout_manifestid BID
@@ -1208,7 +1208,7 @@ setup_AppendFile() {
 test_AppendFile() {
    # TODO: servald should return a status code reserved for this case, instead
    # of the 4 error (which means "invalid manifest")
-   execute --exit-status=4 $servald rhizome journal append $SIDA $BID file2
+   execute --exit-status=4 "$servald" rhizome journal append "$SIDA" "$BID" file2
    tfw_cat --stdout --stderr
 }
 
@@ -1221,15 +1221,15 @@ setup_MeshMSAddCreate() {
    echo -e "service=MeshMS1\nsender=$SIDA\nrecipient=$SIDB1" >file1.manifest
 }
 test_MeshMSAddCreate() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    assert_stdout_add_file file1
    assert_manifest_complete file1.manifest
    extract_manifest_crypt crypt file1.manifest
-   assert [ $crypt = 1 ]
+   assert [ "$crypt" = 1 ]
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 file1
    extract_manifest_id BID file1.manifest
-   executeOk_servald rhizome extract file $BID file1x
+   executeOk_servald rhizome extract file "$BID" file1x
    assert diff file1 file1x
 }
 
@@ -1244,7 +1244,7 @@ setup_MeshMSAddGrow() {
    echo -e "service=MeshMS1\nsender=$SIDA\nrecipient=$SIDB1" >file1.manifest
 }
 test_MeshMSAddGrow() {
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    assert_stdout_add_file file1
    assert_manifest_complete file1.manifest
    executeOk_servald rhizome list
@@ -1257,7 +1257,7 @@ test_MeshMSAddGrow() {
       ofilehashes+=("$filehash")
       echo -e "id=$id\nBK=$bk\nservice=MeshMS1\nsender=$SIDA\nrecipient=$SIDB1" >file1.manifest
       echo "Message$m" >>file1
-      executeOk_servald rhizome add file $SIDA file1 file1.manifest
+      executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
       executeOk_servald rhizome list
       assert_rhizome_list --fromhere=1 file1
       extract_manifest_id idx file1.manifest
@@ -1269,7 +1269,7 @@ test_MeshMSAddGrow() {
       executeOk_servald rhizome extract file "$id" file1x
       assert --message="extracted payload is correct" diff file1 file1x
       for ofilehash in "${ofilehashes[@]}"; do
-         execute --exit-status=1 --stderr $servald rhizome export file "$ofilehash"
+         execute --exit-status=1 --stderr "$servald" rhizome export file "$ofilehash"
       done
       filehash="$filehashx"
    done
@@ -1284,7 +1284,7 @@ setup_MeshMSAddMissingSender() {
    echo -e "service=MeshMS1\nrecipient=$SIDB1" >file1.manifest
 }
 test_MeshMSAddMissingSender() {
-   execute $servald rhizome add file $SIDA file1 file1.manifest
+   execute "$servald" rhizome add file "$SIDA" file1 file1.manifest
    assertExitStatus --stdout --stderr '!=' 0
 }
 
@@ -1298,7 +1298,7 @@ setup_MeshMSAddMissingRecipient() {
    echo -e "service=MeshMS1\nsender=$SIDA" >file1.manifest
 }
 test_MeshMSAddMissingRecipient() {
-   execute $servald rhizome add file $SIDA file1 file1.manifest
+   execute "$servald" rhizome add file "$SIDA" file1 file1.manifest
    assertExitStatus '!=' 0
 }
 
@@ -1377,29 +1377,29 @@ test_MeshMSListFilter() {
    assert_rhizome_list
    executeOk_servald rhizome list MeshMS1
    assert_rhizome_list --fromhere=1 file1 file2 file3 file4
-   executeOk_servald rhizome list '' '' $SIDA1
+   executeOk_servald rhizome list '' '' "$SIDA1"
    assert_rhizome_list --fromhere=1 file1 file2 file3
-   executeOk_servald rhizome list '' '' $SIDA2
+   executeOk_servald rhizome list '' '' "$SIDA2"
    assert_rhizome_list --fromhere=1 file4
-   executeOk_servald rhizome list '' '' $SIDA3
+   executeOk_servald rhizome list '' '' "$SIDA3"
    assert_rhizome_list
-   executeOk_servald rhizome list '' '' $SIDA4
+   executeOk_servald rhizome list '' '' "$SIDA4"
    assert_rhizome_list
-   executeOk_servald rhizome list '' '' '' $SIDA1
+   executeOk_servald rhizome list '' '' '' "$SIDA1"
    assert_rhizome_list
-   executeOk_servald rhizome list '' '' '' $SIDA2
+   executeOk_servald rhizome list '' '' '' "$SIDA2"
    assert_rhizome_list --fromhere=1 file1
-   executeOk_servald rhizome list '' '' '' $SIDA3
+   executeOk_servald rhizome list '' '' '' "$SIDA3"
    assert_rhizome_list --fromhere=1 file2 file4
-   executeOk_servald rhizome list file '' '' $SIDA3
+   executeOk_servald rhizome list file '' '' "$SIDA3"
    assert_rhizome_list
-   executeOk_servald rhizome list '' '' '' $SIDA4
+   executeOk_servald rhizome list '' '' '' "$SIDA4"
    assert_rhizome_list --fromhere=1 file3
-   executeOk_servald rhizome list '' '' $SIDA1 $SIDA4
+   executeOk_servald rhizome list '' '' "$SIDA1" "$SIDA4"
    assert_rhizome_list --fromhere=1 file3
-   executeOk_servald rhizome list '' '' $SIDA2 $SIDA4
+   executeOk_servald rhizome list '' '' "$SIDA2" "$SIDA4"
    assert_rhizome_list
-   executeOk_servald rhizome list '' '' $SIDA2 $SIDA3
+   executeOk_servald rhizome list '' '' "$SIDA2" "$SIDA3"
    assert_rhizome_list --fromhere=1 file4
 }
 
@@ -1410,7 +1410,7 @@ setup_ImportForeignBundle() {
    setup_rhizome
    set_instance +A
    echo "Hello from A" >fileA
-   executeOk_servald rhizome add file $SIDA fileA fileA.manifest
+   executeOk_servald rhizome add file "$SIDA" fileA fileA.manifest
    assert_stdout_add_file fileA
    set_instance +B
 }
@@ -1418,7 +1418,7 @@ test_ImportForeignBundle() {
    executeOk_servald rhizome import bundle fileA fileA.manifest
    assert_stdout_import_bundle fileA
    # Exit status 1 means bundle is already in store
-   execute --exit-status=1 --stdout --stderr $servald rhizome import bundle fileA fileA.manifest
+   execute --exit-status=1 --stdout --stderr "$servald" rhizome import bundle fileA fileA.manifest
    assert_stdout_import_bundle fileA
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 fileA
@@ -1452,7 +1452,7 @@ test_ImportOwnBundle() {
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 fileB
    # Extracting the manifest discovers that it is ours.
-   executeOk_servald rhizome extract bundle $manifestid fileBx.manifest fileBx
+   executeOk_servald rhizome extract bundle "$manifestid" fileBx.manifest fileBx
    tfw_cat --stderr
    assert cmp fileB.manifest fileBx.manifest
    assert cmp fileB fileBx
@@ -1485,7 +1485,7 @@ setup_ImportSelfSigned(){
 }
 test_ImportSelfSigned(){
    set_instance +A
-   executeOk_servald rhizome add file $SIDA file file.manifest '' id=$IDA sender=$SIDA
+   executeOk_servald rhizome add file "$SIDA" file file.manifest '' id="$IDA" sender="$SIDA"
    extract_stdout_manifestid BID
    assert [ "$BID" = "$IDA" ]
    executeOk_servald rhizome list
@@ -1493,7 +1493,7 @@ test_ImportSelfSigned(){
    executeOk_servald rhizome import bundle file file.manifest
    executeOk_servald rhizome list
    tfw_cat --stdout --stderr
-   #TODO assert that .author == $SIDA
+   #TODO assert that .author == "$SIDA"
 }
 
 doc_ImportCombinedBundle="Create and import combined bundle"
@@ -1503,7 +1503,7 @@ setup_ImportCombinedBundle() {
    setup_servald
    setup_rhizome
    echo "Hello from A" >fileA
-   executeOk_servald rhizome add file $SIDA fileA fileA.manifest
+   executeOk_servald rhizome add file "$SIDA" fileA fileA.manifest
    assert_stdout_add_file fileA
    extract_manifest_id manifestid fileA.manifest
    extract_manifest_filehash filehash fileA.manifest
@@ -1521,7 +1521,7 @@ test_ImportCombinedBundle() {
    assertStdoutGrep --matches=1 "^filesize:$filesize\$"
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 fileA
-   executeOk_servald rhizome export bundle $manifestid fileAx fileAx
+   executeOk_servald rhizome export bundle "$manifestid" fileAx fileAx
    assert diff fileA fileAx
 }
 
@@ -1536,7 +1536,7 @@ setup_ImportCombinedZipBundle() {
 }
 test_ImportCombinedZipBundle() {
    # Create the combined bundle
-   executeOk_servald rhizome add file --zip-comment $SIDA fileA.zip fileA.manifest
+   executeOk_servald rhizome add file --zip-comment "$SIDA" fileA.zip fileA.manifest
    extract_manifest_id manifestid fileA.manifest
    extract_manifest_filehash filehash fileA.manifest
    extract_manifest_filesize filesize fileA.manifest
@@ -1549,7 +1549,7 @@ test_ImportCombinedZipBundle() {
    assertStdoutGrep --matches=1 "^filesize:$filesize\$"
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 fileA.zip
-   executeOk_servald rhizome export bundle --zip-comment $manifestid fileAx.zip fileAx.zip
+   executeOk_servald rhizome export bundle --zip-comment "$manifestid" fileAx.zip fileAx.zip
    assert diff fileA.zip fileAx.zip
 }
 
@@ -1561,10 +1561,10 @@ setup_ImportJournal() {
    echo "Part One" > file1
    echo "Part Two2" > file2
    cat file1 file2 >file3
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    assert_stdout_add_file file1
    extract_stdout_manifestid BID
-   executeOk_servald rhizome extract bundle $BID file1x.manifest file1x
+   executeOk_servald rhizome extract bundle "$BID" file1x.manifest file1x
    assert diff file1 file1x
 }
 test_ImportJournal() {
@@ -1576,16 +1576,16 @@ test_ImportJournal() {
    assert_rhizome_list --fromhere=0 file1x
    # Try to import the same journal bundle again, exit status 1 means bundle is
    # already in store.
-   execute --exit-status=1 --stdout --stderr $servald rhizome import bundle file1x file1x.manifest
+   execute --exit-status=1 --stdout --stderr "$servald" rhizome import bundle file1x file1x.manifest
    assert_stdout_import_bundle file1x
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 file1x
    # Grow the journal and import it again.
    begin_fixture
    set_instance +A
-   executeOk_servald rhizome journal append $SIDA $BID file2
+   executeOk_servald rhizome journal append "$SIDA" "$BID" file2
    assert_stdout_add_file file3 manifestid=$BID name=file1
-   executeOk_servald rhizome extract bundle $BID file3x.manifest file3x
+   executeOk_servald rhizome extract bundle "$BID" file3x.manifest file3x
    assert diff file3 file3x
    end_fixture
    set_instance +B
@@ -1621,13 +1621,13 @@ test_DeleteManifest() {
    tfw_cat --stderr
    executeOk_servald rhizome list
    assert_rhizome_list file{1,3,4}
-   execute --exit-status=1 --stderr $servald rhizome export manifest "$BID2"
+   execute --exit-status=1 --stderr "$servald" rhizome export manifest "$BID2"
    executeOk_servald rhizome export file "$HASH2" file2x
    assert diff file2 file2x
    rhizome_clean
-   assert [ $deleted_files = 1 ]
-   assert [ $deleted_fileblobs = 0 ]
-   assert [ $deleted_manifests = 0 ]
+   assert [ "$deleted_files" = 1 ]
+   assert [ "$deleted_fileblobs" = 0 ]
+   assert [ "$deleted_manifests" = 0 ]
 }
 
 doc_DeletePayload="Delete a payload from store"
@@ -1640,7 +1640,7 @@ test_DeletePayload() {
    executeOk_servald rhizome list
    assert_rhizome_list file{1..4}
    executeOk_servald rhizome export manifest "$BID3"
-   execute --exit-status=1 --stderr $servald rhizome export file "$HASH3" file3x
+   execute --exit-status=1 --stderr "$servald" rhizome export file "$HASH3" file3x
    rhizome_clean
    assert [ $deleted_files = 0 ]
    assert [ $deleted_fileblobs = 0 ]
@@ -1658,8 +1658,8 @@ test_DeleteBundle() {
    tfw_cat --stderr
    executeOk_servald rhizome list
    assert_rhizome_list file{1..3}
-   execute --exit-status=1 --stderr $servald rhizome export manifest "$BID4"
-   execute --exit-status=1 --stderr $servald rhizome export file "$HASH4" file4x
+   execute --exit-status=1 --stderr "$servald" rhizome export manifest "$BID4"
+   execute --exit-status=1 --stderr "$servald" rhizome export file "$HASH4" file4x
    rhizome_clean
    assert [ $deleted_files = 0 ]
    assert [ $deleted_fileblobs = 0 ]
@@ -1676,7 +1676,7 @@ test_DeleteFile() {
    executeOk_servald rhizome list
    assert_rhizome_list file{1..4}
    executeOk_servald rhizome export manifest "$BID1"
-   execute --exit-status=1 --stderr $servald rhizome export file "$HASH1" file1x
+   execute --exit-status=1 --stderr "$servald" rhizome export file "$HASH1" file1x
    rhizome_clean
    assert [ $deleted_files = 0 ]
    assert [ $deleted_fileblobs = 0 ]
@@ -1693,7 +1693,7 @@ setup_payloadTooBig() {
 }
 test_payloadTooBig(){
    create_file file1 32K
-   execute $servald rhizome add file $SIDA file1 file1.manifest
+   execute "$servald" rhizome add file "$SIDA" file1 file1.manifest
    assertExitStatus '==' 7
 }
 
@@ -1711,8 +1711,8 @@ setup_payloadUninteresting() {
 test_payloadUninteresting(){
    create_file file1 32K
    create_file file2 32K
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
-   execute $servald rhizome add file $SIDA file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
+   execute "$servald" rhizome add file "$SIDA" file2 file2.manifest
    assertExitStatus '==' 7
 }
 
@@ -1727,10 +1727,10 @@ setup_evictUninteresting() {
    create_file file4 128K
 }
 test_evictUninteresting(){
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
-   executeOk_servald rhizome add file $SIDA file2 file2.manifest
-   executeOk_servald rhizome add file $SIDA file3 file3.manifest
-   executeOk_servald rhizome add file $SIDA file4 file4.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA" file3 file3.manifest
+   executeOk_servald rhizome add file "$SIDA" file4 file4.manifest
    tfw_cat --stderr
    rhizome_clean
    assert [ $deleted_files = 0 ]
@@ -1748,10 +1748,10 @@ setup_evictFreeSpace() {
    create_file file2 256K
    create_file file3 128K
    create_file file4 128K
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
-   executeOk_servald rhizome add file $SIDA file2 file2.manifest
-   executeOk_servald rhizome add file $SIDA file3 file3.manifest
-   executeOk_servald rhizome add file $SIDA file4 file4.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file2 file2.manifest
+   executeOk_servald rhizome add file "$SIDA" file3 file3.manifest
+   executeOk_servald rhizome add file "$SIDA" file4 file4.manifest
 }
 test_evictFreeSpace() {
    executeOk_servald config \
diff --git a/tests/rhizomeprotocol b/tests/rhizomeprotocol
index fbe86789..2866a962 100755
--- a/tests/rhizomeprotocol
+++ b/tests/rhizomeprotocol
@@ -64,7 +64,7 @@ setup_common() {
 }
 
 receive_and_update_bundle() {
-   wait_until "$@" bundle_received_by $BID:$VERSION +B
+   wait_until "$@" bundle_received_by "$BID:$VERSION" +B
    set_instance +B
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 file1
@@ -72,7 +72,7 @@ receive_and_update_bundle() {
    set_instance +A
    rhizome_update_file file1 file2
    set_instance +B
-   wait_until "$@" bundle_received_by $BID:$VERSION +B
+   wait_until "$@" bundle_received_by "$BID:$VERSION" +B
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 file2
    assert_rhizome_received file2
@@ -110,7 +110,7 @@ setup_EncryptedTransfer() {
    set_instance +A
    echo "Clear Text" >file1
    echo -e "service=MeshMS1\nsender=$SIDA\nrecipient=$SIDB" >file1.manifest
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    extract_manifest_id BID file1.manifest
    extract_manifest_version VERSION file1.manifest
    start_servald_instances +A +B
@@ -118,9 +118,9 @@ setup_EncryptedTransfer() {
    foreach_instance +B assert_peers_are_instances +A
 }
 test_EncryptedTransfer() {
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +B
-   executeOk_servald rhizome extract file $BID file1x
+   executeOk_servald rhizome extract file "$BID" file1x
    assert diff file1 file1x
 }
 
@@ -139,7 +139,7 @@ setup_NoFetch() {
    start_servald_instances +A +B
 }
 test_NoFetch() {
-   wait_until bundle_received_by $BID2:$VERSION2 +A
+   wait_until bundle_received_by "$BID2:$VERSION2" +A
    set_instance +A
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 file1 --fromhere=0 file2
@@ -242,7 +242,7 @@ setup_journalMDP() {
    set_instance +A
    create_file file1 2048
    create_file file2 2048
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    extract_stdout_manifestid BID
    extract_stdout_version VERSION
    start_servald_instances +A +B
@@ -250,13 +250,13 @@ setup_journalMDP() {
    foreach_instance +B assert_peers_are_instances +A
 }
 test_journalMDP() {
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +A
-   executeOk_servald rhizome journal append $SIDA $BID file2
+   executeOk_servald rhizome journal append "$SIDA" "$BID" file2
    extract_stdout_version VERSION2
    set_instance +B
-   wait_until bundle_received_by $BID:$VERSION2 +B
-   assertGrep $instance_servald_log "Copying [0-9]\+ bytes from previous journal"
+   wait_until bundle_received_by "$BID:$VERSION2" +B
+   assertGrep "$instance_servald_log" "Copying [0-9]\+ bytes from previous journal"
 }
 
 doc_journalHTTP="Transfer and update a journal bundle via HTTP"
@@ -268,7 +268,7 @@ setup_journalHTTP() {
    set_instance +A
    create_file file1 2048
    create_file file2 2048
-   executeOk_servald rhizome journal append $SIDA "" file1
+   executeOk_servald rhizome journal append "$SIDA" "" file1
    extract_stdout_manifestid BID
    extract_stdout_version VERSION
    start_servald_instances +A +B
@@ -276,13 +276,13 @@ setup_journalHTTP() {
    foreach_instance +B assert_peers_are_instances +A
 }
 test_journalHTTP() {
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +A
-   executeOk_servald rhizome journal append $SIDA $BID file2
+   executeOk_servald rhizome journal append "$SIDA" "$BID" file2
    extract_stdout_version VERSION2
    set_instance +B
-   wait_until bundle_received_by $BID:$VERSION2 +B
-   assertGrep $instance_servald_log "Copying [0-9]\+ bytes from previous journal"
+   wait_until bundle_received_by "$BID:$VERSION2" +B
+   assertGrep "$instance_servald_log" "Copying [0-9]\+ bytes from previous journal"
 }
 
 #common setup and test routines for transferring a 1MB file
@@ -298,7 +298,7 @@ setup_bigfile_common() {
 }
 bigfile_common_test() {
    set_instance +B
-   wait_until --timeout=120 bundle_received_by $BID:$VERSION +B
+   wait_until --timeout=120 bundle_received_by "$BID:$VERSION" +B
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 file1
    assert_rhizome_received file1
@@ -388,7 +388,7 @@ setup_multitransfer_common() {
    assert_peers_are_instances +A +B +C +D
 }
 multitransfer_common_test() {
-   wait_until bundle_received_by $BID:$VERSION +B +C +D +E
+   wait_until bundle_received_by "$BID:$VERSION" +B +C +D +E
    for i in B C D E; do
       set_instance +$i
       executeOk_servald rhizome list
@@ -455,13 +455,13 @@ setup_FileTransferDelete() {
    start_servald_instances +A +B
    foreach_instance +A assert_peers_are_instances +B
    foreach_instance +B assert_peers_are_instances +A
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +A
    >file1_2
    rhizome_update_file file1 file1_2
 }
 test_FileTransferDelete() {
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +B
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=0 file1_2
@@ -477,22 +477,22 @@ setup_CorruptPayload() {
       set debug.rhizome_store 1
    rhizome_add_file file1 1024
    start_servald_instances +A +B
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +A
    stop_servald_server
    assert cmp file1 "$SERVALINSTANCE_PATH/blob/$FILEHASH"
    create_file file2 1024
    assert --error-on-fail ! cmp file1 file2
    cp file2 "$SERVALINSTANCE_PATH/blob/$FILEHASH"
-   execute --exit-status=255 $servald rhizome extract file $BID file1a
+   execute --exit-status=255 "$servald" rhizome extract file "$BID" file1a
    # TODO at the moment, the re-fetch is only triggered by restarting the
    # daemon.  Eventually (when the Rhizome Rank is implemented), the re-fetch
    # shoud be automatic and immediate without restarting the daemon.
    start_servald_server
 }
 test_CorruptPayload() {
-   wait_until grep -i "Stored file $FILEHASH" $LOGA
-   executeOk $servald rhizome extract file $BID file1a
+   wait_until grep -i "Stored file $FILEHASH" "$LOGA"
+   executeOk "$servald" rhizome extract file "$BID" file1a
 }
 
 doc_MissingPayload="A missing payload should be re-fetched"
@@ -505,19 +505,19 @@ setup_MissingPayload() {
    rhizome_add_file file1 1024
    assert cmp file1 "$SERVALINSTANCE_PATH/blob/$FILEHASH"
    start_servald_instances +A +B
-   wait_until bundle_received_by $BID:$VERSION +B
+   wait_until bundle_received_by "$BID:$VERSION" +B
    set_instance +A
    stop_servald_server
    rm -f "$SERVALINSTANCE_PATH/blob/$FILEHASH"
-   execute --exit-status=1 --stderr $servald rhizome extract file $BID file1a
+   execute --exit-status=1 --stderr "$servald" rhizome extract file "$BID" file1a
    # TODO at the moment, the re-fetch is only triggered by restarting the
    # daemon.  Eventually (when the Rhizome Rank is implemented), the re-fetch
    # shoud be automatic and immediate without restarting the daemon.
    start_servald_server
 }
 test_MissingPayload() {
-   wait_until grep -i "Stored file $FILEHASH" $LOGA
-   executeOk $servald rhizome extract file $BID file1a
+   wait_until grep -i "Stored file $FILEHASH" "$LOGA"
+   executeOk "$servald" rhizome extract file "$BID" file1a
 }
 
 doc_ConnectOnEnable="Enable and disable rhizome while fetching"
@@ -599,7 +599,7 @@ name. We decided against this approach as the VOMP channel driver was written
 in time to avoid it.
 EOF
    set_instance +B
-   executeOk_servald rhizome add file $SIDB README.WHYNOTSIPS README.WHYNOTSIPS.manifest
+   executeOk_servald rhizome add file "$SIDB" README.WHYNOTSIPS README.WHYNOTSIPS.manifest
    assert_manifest_complete README.WHYNOTSIPS.manifest
    assert_stdout_add_file README.WHYNOTSIPS
    set_instance +A
@@ -629,7 +629,7 @@ setup_HttpAddLocal() {
    set_instance +A
    executeOk_servald config \
       set rhizome.api.addfile.uri_path "/rhizome/secretaddfile" \
-      set rhizome.api.addfile.default_author $SIDA
+      set rhizome.api.addfile.default_author "$SIDA"
    start_servald_instances +A
    wait_until rhizome_http_server_started +A
    get_rhizome_server_port PORTA +A
@@ -698,7 +698,7 @@ test_DirectPush() {
    set_instance +B
    executeOk_servald rhizome direct push
    tfw_cat --stdout --stderr
-   assert bundle_received_by $BID_B1:$VERSION_B1 $BID_B2:$VERSION_B2 $BID_B3:$VERSION_B3 +A
+   assert bundle_received_by "$BID_B1:$VERSION_B1" "$BID_B2:$VERSION_B2" "$BID_B3:$VERSION_B3" +A
    set_instance +A
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 fileA1 fileA2 fileA3 --fromhere=0 fileB1 fileB2 fileB3
@@ -719,7 +719,7 @@ test_DirectPushArg() {
    set_instance +B
    executeOk_servald rhizome direct push "http://${addr_localhost}:${PORTA}"
    tfw_cat --stdout --stderr
-   assert bundle_received_by $BID_B1:$VERSION_B1 $BID_B2:$VERSION_B2 $BID_B3:$VERSION_B3 +A
+   assert bundle_received_by "$BID_B1:$VERSION_B1" "$BID_B2:$VERSION_B2" "$BID_B3:$VERSION_B3" +A
    set_instance +A
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 fileA1 fileA2 fileA3 --fromhere=0 fileB1 fileB2 fileB3
@@ -741,7 +741,7 @@ test_DirectPull() {
    set_instance +B
    executeOk_servald rhizome direct pull
    tfw_cat --stdout --stderr
-   assert bundle_received_by $BID_A1:$VERSION_A1 $BID_A2:$VERSION_A2 $BID_A3:$VERSION_A3 --stderr
+   assert bundle_received_by "$BID_A1:$VERSION_A1" "$BID_A2:$VERSION_A2" "$BID_A3:$VERSION_A3" --stderr
    set_instance +A
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 fileA1 fileA2 fileA3
@@ -763,7 +763,7 @@ test_DirectSync() {
    set_instance +B
    executeOk_servald rhizome direct sync
    tfw_cat --stdout --stderr
-   assert bundle_received_by $BID_A1:$VERSION_A1 $BID_A2:$VERSION_A2 $BID_A3:$VERSION_A3 --stderr
+   assert bundle_received_by "$BID_A1:$VERSION_A1" "$BID_A2:$VERSION_A2" "$BID_A3:$VERSION_A3" --stderr
    set_instance +A
    executeOk_servald rhizome list
    assert_rhizome_list --fromhere=1 fileA1 fileA2 fileA3 --fromhere=0 fileB1 fileB2 fileB3
@@ -779,7 +779,7 @@ test_DirectSync() {
 }
 
 interface_up() {
-   $GREP "Interface .* is up" $instance_servald_log || return 1
+   $GREP "Interface .* is up" "$instance_servald_log" || return 1
    return 0
 }
 start_radio_instance() {
@@ -804,7 +804,7 @@ start_radio_instance() {
 }
 
 start_fakeradio() {
-   $servald_build_root/fakeradio $1 $2 > "$SERVALD_VAR/radioout" 2> "$SERVALD_VAR/radioerr" &
+   "$servald_build_root/fakeradio" "$1" "$2" > "$SERVALD_VAR/radioout" 2> "$SERVALD_VAR/radioerr" &
    FAKERADIO_PID=$!
    wait_until $GREP "^right:" "$SERVALD_VAR/radioout"
    local _line=`head "$SERVALD_VAR/radioout" -n 1`
@@ -897,7 +897,7 @@ setup_ManyFiles() {
       for j in {1..10}
       do
          tfw_log "Adding file$i-$j"
-         create_file file$i-$j $(( $j * 500 ))
+         create_file file$i-$j $((j * 500))
          sidvar=SID${i}1
          tfw_nolog executeOk_servald rhizome add file "${!sidvar}" file$i-$j file$i-$j.manifest
          tfw_nolog extract_stdout_manifestid BID
diff --git a/tests/rhizomerestful b/tests/rhizomerestful
index ba2883f0..7a162a7d 100755
--- a/tests/rhizomerestful
+++ b/tests/rhizomerestful
@@ -36,7 +36,7 @@ setup() {
    if [ -z "$IDENTITY_COUNT" ]; then
       create_single_identity
    else
-      create_identities $IDENTITY_COUNT
+      create_identities "$IDENTITY_COUNT"
    fi
    export SERVALD_RHIZOME_DB_RETRY_LIMIT_MS=60000
    start_servald_instances +A
@@ -102,7 +102,7 @@ doc_RhizomeList="REST API list 100 Rhizome bundles as JSON"
 setup_RhizomeList() {
    setup
    NBUNDLES=100
-   rhizome_add_bundles $SIDA 0 $((NBUNDLES-1))
+   rhizome_add_bundles "$SIDA" 0 $((NBUNDLES-1))
    assert [ "$ROWID_MAX" -ge "$NBUNDLES" ]
 }
 test_RhizomeList() {
@@ -144,7 +144,7 @@ setup_RhizomeListNewSince() {
    # Use REST interface to add bundles, not CLI, in order to avoid a database
    # locking storm
    rhizome_use_restful harry potter
-   rhizome_add_bundles $SIDA 0 5
+   rhizome_add_bundles "$SIDA" 0 5
    rest_request GET "/restful/rhizome/bundlelist.json"
    assert [ "$(jq '.rows | length' response.json)" = 6 ]
    transform_list_json response.json array_of_objects.json
@@ -158,7 +158,7 @@ test_RhizomeListNewSince() {
             --no-buffer
    done
    wait_until [ -e newsince1.json -a -e newsince2.json -a -e newsince3.json ]
-   rhizome_add_bundles $SIDA 6 10
+   rhizome_add_bundles "$SIDA" 6 10
    for i in 1 2 3; do
       wait_until grep "${BID[10]}" newsince$i.json
    done
@@ -212,7 +212,7 @@ assert_http_response_headers() {
 doc_RhizomeManifest="REST API fetch Rhizome manifest"
 setup_RhizomeManifest() {
    setup
-   rhizome_add_bundles $SIDA 0 2
+   rhizome_add_bundles "$SIDA" 0 2
 }
 test_RhizomeManifest() {
    for n in 0 1 2; do
@@ -242,8 +242,8 @@ test_RhizomeManifestNonexist() {
 doc_RhizomePayloadRaw="REST API fetch Rhizome raw payload"
 setup_RhizomePayloadRaw() {
    setup
-   rhizome_add_bundles $SIDA 0 1
-   rhizome_add_bundles --encrypted $SIDA 2 3
+   rhizome_add_bundles "$SIDA" 0 1
+   rhizome_add_bundles --encrypted "$SIDA" 2 3
 }
 test_RhizomePayloadRaw() {
    for n in 0 1 2 3; do
@@ -280,7 +280,7 @@ setup_RhizomePayloadRawNonexistPayload() {
       executeOk_servald config set rhizome.max_blob_size 0
    }
    setup
-   rhizome_add_bundles $SIDA 0 0
+   rhizome_add_bundles "$SIDA" 0 0
    rhizome_delete_payload_blobs "${HASH[0]}"
 }
 test_RhizomePayloadRawNonexistPayload() {
@@ -300,8 +300,8 @@ test_RhizomePayloadRawNonexistPayload() {
 doc_RhizomePayloadDecrypted="REST API fetch Rhizome decrypted payload"
 setup_RhizomePayloadDecrypted() {
    setup
-   rhizome_add_bundles $SIDA 0 1
-   rhizome_add_bundles --encrypted $SIDA 2 3
+   rhizome_add_bundles "$SIDA" 0 1
+   rhizome_add_bundles --encrypted "$SIDA" 2 3
 }
 test_RhizomePayloadDecrypted() {
    for n in 0 1 2 3; do
@@ -322,10 +322,10 @@ test_RhizomePayloadDecrypted() {
 doc_RhizomePayloadDecryptedForeign="REST API cannot fetch foreign Rhizome decrypted payload"
 setup_RhizomePayloadDecryptedForeign() {
    setup
-   rhizome_add_bundles --encrypted $SIDA 0 0
+   rhizome_add_bundles --encrypted "$SIDA" 0 0
    set_instance +B
    create_single_identity
-   rhizome_add_bundles --encrypted $SIDB 1 1
+   rhizome_add_bundles --encrypted "$SIDB" 1 1
    executeOk_servald rhizome export manifest "${BID[1]}" file1.manifest
    set_instance +A
    executeOk_servald rhizome import bundle raw1 file1.manifest
@@ -357,7 +357,7 @@ setup_RhizomePayloadDecryptedNonexistPayload() {
       executeOk_servald config set rhizome.max_blob_size 0
    }
    setup
-   rhizome_add_bundles $SIDA 0 0
+   rhizome_add_bundles "$SIDA" 0 0
    rhizome_delete_payload_blobs "${HASH[0]}"
 }
 test_RhizomePayloadDecryptedNonexistPayload() {
@@ -631,7 +631,7 @@ test_RhizomeInsertEmpty() {
    extract_manifest_id BID empty.manifest
    executeOk_servald rhizome list
    assert_rhizome_list empty
-   executeOk_servald rhizome extract bundle $BID xempty.manifest xempty
+   executeOk_servald rhizome extract bundle "$BID" xempty.manifest xempty
    assert [ ! -e xempty ]
    assert diff xempty.manifest empty.manifest
 }
@@ -642,7 +642,7 @@ setup_RhizomeUpdateToEmpty() {
    >empty
    assert [ ! -s empty ]
    create_file nonempty 101
-   executeOk_servald rhizome add file $SIDA nonempty nonempty.manifest
+   executeOk_servald rhizome add file "$SIDA" nonempty nonempty.manifest
    executeOk_servald rhizome list
    assert_rhizome_list nonempty
    extract_manifest_id BID nonempty.manifest
@@ -659,7 +659,7 @@ test_RhizomeUpdateToEmpty() {
    assertGrep --matches=1 --ignore-case response.headers "^Serval-Rhizome-Result-Payload-Status-Message: .*payload empty.*$CR\$"
    executeOk_servald rhizome list
    assert_rhizome_list empty
-   executeOk_servald rhizome extract bundle $BID xempty.manifest xempty
+   executeOk_servald rhizome extract bundle "$BID" xempty.manifest xempty
    assert [ ! -e xempty ]
    assert diff xempty.manifest empty.manifest
 }
@@ -682,7 +682,7 @@ test_RhizomeInsertLarge() {
    extract_manifest_id BID file1.manifest
    executeOk_servald rhizome list
    assert_rhizome_list file1
-   executeOk_servald rhizome extract bundle $BID xfile1.manifest xfile1
+   executeOk_servald rhizome extract bundle "$BID" xfile1.manifest xfile1
    assert diff xfile1.manifest file1.manifest
    assert cmp file1 xfile1
 }
@@ -899,7 +899,7 @@ setup_RhizomeImport() {
    set_instance +B
    create_single_identity
    create_file file1 100
-   executeOk_servald rhizome add file $SIDB file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDB" file1 file1.manifest
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
    extract_manifest_filehash filehash file1.manifest
@@ -959,7 +959,7 @@ setup_RhizomeImportLarge() {
    set_instance +B
    create_single_identity
    create_file file1 50m
-   executeOk_servald rhizome add file $SIDB file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDB" file1 file1.manifest
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
    executeOk_servald rhizome export manifest "$manifestid" file1.manifest
@@ -982,7 +982,7 @@ setup_RhizomeImportParamsBad() {
    set_instance +B
    create_single_identity
    create_file file1 100
-   executeOk_servald rhizome add file $SIDB file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDB" file1 file1.manifest
    extract_manifest_id manifestid file1.manifest
    extract_manifest_version version file1.manifest
    executeOk_servald rhizome export manifest "$manifestid" file1.manifest
@@ -1047,10 +1047,10 @@ test_RhizomeJournalAppend() {
    http_unquote_string H_NAME
    extract_http_header H_BK response.headers Serval-Rhizome-Bundle-BK "$rexp_bundlekey"
    extract_http_header H_AUTHOR response.headers Serval-Rhizome-Bundle-Author "$rexp_bundlekey"
-   assert [ $H_SIZE -eq $file1_size ]
+   assert [ "$H_SIZE" -eq "$file1_size" ]
    assert [ "$H_SERVICE" = anything ]
    assert [ "$H_NAME" = hoopla ]
-   assert [ "$H_AUTHOR" = $SIDA ]
+   assert [ "$H_AUTHOR" = "$SIDA" ]
    extract_manifest_id BID file1.manifest
    extract_manifest_version VERSION file1.manifest
    extract_manifest_filesize SIZE file1.manifest
@@ -1136,7 +1136,7 @@ setup_RhizomeAppendNonJournalForbidden() {
    echo "File One" > file1
    echo "File Two" > file2
    >file2.manifest
-   executeOk_servald rhizome add file $SIDA file1 file1.manifest
+   executeOk_servald rhizome add file "$SIDA" file1 file1.manifest
    tfw_cat --stdout --stderr
    assert_stdout_add_file file1
    extract_stdout_manifestid BID
diff --git a/tests/routing b/tests/routing
index 99a3c7df..f22fa3f9 100755
--- a/tests/routing
+++ b/tests/routing
@@ -124,9 +124,9 @@ test_single_link() {
    wait_until --timeout=10 path_exists +A +B
    wait_until --timeout=5 path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDA 1
+   executeOk_servald mdp ping --timeout=3 "$SIDA" 1
    tfw_cat --stdout --stderr
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -142,17 +142,17 @@ setup_multiple_ids() {
 }
 test_multiple_ids() {
    set_instance +A
-   wait_until has_link --any $SIDB1
-   wait_until has_link --any $SIDB2
+   wait_until has_link --any "$SIDB1"
+   wait_until has_link --any "$SIDB2"
    set_instance +B
-   wait_until has_link --any $SIDA1
-   wait_until has_link --any $SIDA2
+   wait_until has_link --any "$SIDA1"
+   wait_until has_link --any "$SIDA2"
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB1 1
-   executeOk_servald mdp ping --timeout=3 $SIDB2 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB1" 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB2" 1
    set_instance +B
-   executeOk_servald mdp ping --timeout=3 $SIDA1 1
-   executeOk_servald mdp ping --timeout=3 $SIDA2 1
+   executeOk_servald mdp ping --timeout=3 "$SIDA1" 1
+   executeOk_servald mdp ping --timeout=3 "$SIDA2" 1
 }
 
 doc_unlock_ids="Routes appear and disappear as identities are [un]locked"
@@ -172,11 +172,11 @@ test_unlock_ids() {
    set_instance +A
    executeOk_servald id enter pin 'entry-pin'
    set_instance +B
-   wait_until has_link --via $SIDA $SIDX
+   wait_until has_link --via "$SIDA" "$SIDX"
    set_instance +A
    executeOk_servald id relinquish pin 'entry-pin'
    set_instance +B
-   wait_until --timeout=30 has_no_link $SIDX
+   wait_until --timeout=30 has_no_link "$SIDX"
 }
 
 doc_migrate_id="Unlocking the same identity triggers migration"
@@ -200,11 +200,11 @@ test_migrate_id() {
    set_instance +A
    executeOk_servald id enter pin 'entry-pin'
    set_instance +B
-   wait_until --timeout=10 has_link --via $SIDA $SIDX
+   wait_until --timeout=10 has_link --via "$SIDA" "$SIDX"
    set_instance +B
    executeOk_servald id enter pin 'entry-pin'
    set_instance +A
-   wait_until --timeout=10 has_link --via $SIDB $SIDX
+   wait_until --timeout=10 has_link --via "$SIDB" "$SIDX"
 }
 
 doc_single_mdp="Use single MDP per packet encapsulation"
@@ -222,7 +222,7 @@ test_single_mdp() {
    wait_until path_exists +A +B
    wait_until path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -241,7 +241,7 @@ test_mismatched_encap() {
    wait_until path_exists +A +B
    wait_until path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -263,12 +263,12 @@ test_single_p2p() {
    wait_until path_exists +B +A
    assertGrep "$instance_servald_log" 'Established point to point link'
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
 start_fakeradio() {
-   $servald_build_root/fakeradio 4 1 > "$SERVALD_VAR/radioout" 2> "$SERVALD_VAR/radioerr" &
+   "$servald_build_root/fakeradio" 4 1 > "$SERVALD_VAR/radioout" 2> "$SERVALD_VAR/radioerr" &
    FAKERADIO_PID=$!
    wait_until $GREP "^right:" "$SERVALD_VAR/radioout"
    local _line=`head -n 1 "$SERVALD_VAR/radioout"`
@@ -306,7 +306,7 @@ test_simulate_extender() {
    wait_until path_exists +A +B
    wait_until path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 teardown_simulate_extender() {
@@ -333,15 +333,15 @@ setup_lowband_broadcast() {
 }
 test_lowband_broadcast() {
    set_instance +A
-   executeOk_servald mdp ping --interval=3 --timeout=6 $SIDB 3
+   executeOk_servald mdp ping --interval=3 --timeout=6 "$SIDB" 3
    tfw_cat --stdout --stderr
 }
 
 _simulator() {
    # TODO timeout & failure reporting?
-   executeOk --timeout=120 --error-on-fail $servald_build_root/simulator <$SIM_IN
+   executeOk --timeout=120 --error-on-fail "$servald_build_root/simulator" <$SIM_IN
    tfw_cat --stdout --stderr
-   rm $SIM_IN
+   rm "$SIM_IN"
 }
 start_simulator() {
   SIM_IN="$PWD/SIM_IN"
@@ -382,13 +382,13 @@ test_multiple_nodes() {
    wait_until --timeout=5 path_exists +C +A
    wait_until --timeout=5 path_exists +D +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
    simulator_command set "net" "latency" "150"
-   executeOk_servald mdp ping --timeout=3 $SIDC 1
+   executeOk_servald mdp ping --timeout=3 "$SIDC" 1
    tfw_cat --stdout --stderr
    simulator_command set "net" "latency" "200"
-   executeOk_servald mdp ping --timeout=3 $SIDD 1
+   executeOk_servald mdp ping --timeout=3 "$SIDD" 1
    tfw_cat --stdout --stderr
 }
 finally_multiple_nodes() {
@@ -418,16 +418,16 @@ test_scan() {
    set_instance +A
    wait_until --timeout=10 has_seen_instances +B +C
    executeOk_servald route print
-   link_matches --unicast $SIDB
-   link_matches --unicast $SIDC
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   link_matches --unicast "$SIDB"
+   link_matches --unicast "$SIDC"
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 
    set_instance +B
    executeOk_servald route print
-   link_matches --unicast $SIDA
-   link_matches --via $SIDA $SIDC
-   executeOk_servald mdp ping --timeout=3 $SIDC 1
+   link_matches --unicast "$SIDA"
+   link_matches --via "$SIDA" "$SIDC"
+   executeOk_servald mdp ping --timeout=3 "$SIDC" 1
    tfw_cat --stdout --stderr
 }
 
@@ -441,9 +441,9 @@ test_scan_one() {
    wait_until scan_completed
    wait_until --timeout=10 has_seen_instances +B
    executeOk_servald route print
-   link_matches --unicast $SIDB
+   link_matches --unicast "$SIDB"
    assertStdoutGrep --matches=0 "^$SIDC:"
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -475,13 +475,13 @@ setup_fixedAddress() {
 doc_fixedAddress="Establish a link from a configured fixed address"
 test_fixedAddress() {
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 5
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 5
    tfw_cat --stdout
    wait_until path_exists +A +B
 }
 
 scan_completed() {
-  $GREP "Scan completed" $instance_servald_log || return 1
+  $GREP "Scan completed" "$instance_servald_log" || return 1
   return 0
 }
 
@@ -501,11 +501,11 @@ setup_single_filter() {
 }
 test_single_filter() {
    set_instance +A
-   wait_until --timeout=10 has_link --unicast $SIDB
+   wait_until --timeout=10 has_link --unicast "$SIDB"
    set_instance +B
-   wait_until --timeout=5 has_link --broadcast $SIDA
+   wait_until --timeout=5 has_link --broadcast "$SIDA"
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -523,11 +523,11 @@ setup_broadcast_only() {
 test_broadcast_only() {
    simulator_command up "net"
    set_instance +A
-   wait_until has_link --broadcast $SIDB
+   wait_until has_link --broadcast "$SIDB"
    set_instance +B
-   wait_until has_link --broadcast $SIDA
+   wait_until has_link --broadcast "$SIDA"
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 finally_broadcast_only() {
@@ -548,13 +548,13 @@ setup_prefer_unicast() {
 }
 test_prefer_unicast() {
    set_instance +A
-   wait_until has_link --unicast $SIDB
+   wait_until has_link --unicast "$SIDB"
    set_instance +B
-   wait_until has_link --unicast $SIDA
+   wait_until has_link --unicast "$SIDA"
    wait_until path_exists +A +B
    wait_until path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -572,13 +572,13 @@ setup_prefer_broadcast() {
 }
 test_prefer_broadcast() {
    set_instance +A
-   wait_until has_link --broadcast $SIDB
+   wait_until has_link --broadcast "$SIDB"
    set_instance +B
-   wait_until has_link --broadcast $SIDA
+   wait_until has_link --broadcast "$SIDA"
    wait_until path_exists +A +B
    wait_until path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDB 1
+   executeOk_servald mdp ping --timeout=3 "$SIDB" 1
    tfw_cat --stdout --stderr
 }
 
@@ -596,9 +596,9 @@ test_multihop_linear() {
    wait_until path_exists +A +B +C +D
    wait_until path_exists +D +C +B +A
    set_instance +A
-   executeOk_servald --stdout --stderr mdp ping --timeout=3 $SIDD 1
+   executeOk_servald --stdout --stderr mdp ping --timeout=3 "$SIDD" 1
    tfw_cat --stdout --stderr
-   executeOk_servald mdp trace $SIDD
+   executeOk_servald mdp trace "$SIDD"
    tfw_cat --stdout --stderr
    assertStdoutGrep --matches=1 "^0:$SIDA\$"
    assertStdoutGrep --matches=1 "^1:$SIDB\$"
@@ -630,7 +630,7 @@ test_unicast_route() {
    wait_until --timeout=20 path_exists +A +B +C +D
    wait_until --timeout=5 path_exists +D +C +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 $SIDD 1
+   executeOk_servald mdp ping --timeout=3 "$SIDD" 1
    tfw_cat --stdout --stderr
 }
 
@@ -646,12 +646,12 @@ setup_offline() {
 instance_offline() {
    local I N
    for I; do
-      [ $I = $instance_arg ] && continue
+      [ "$I" = "$instance_arg" ] && continue
       for ((N=1; 1; ++N)); do
-         local sidvar=SID${I#+}$N
+         local sidvar="SID${I#+}$N"
          [ -n "${!sidvar}" ] || break
          tfw_log "Checking if $I is offline for $instance_arg"
-         has_no_link ${!sidvar} || return 1
+         has_no_link "${!sidvar}" || return 1
       done
    done
 }
@@ -770,19 +770,19 @@ doc_multi_interface="Multiple links of different types to the same neighbour"
 test_multi_interface() {
    simulator_command up "wlan0" "eth0"
    set_instance +A
-   wait_until has_link --interface "dummy2.*" $SIDB
+   wait_until has_link --interface "dummy2.*" "$SIDB"
    set_instance +B
-   wait_until has_link --interface "dummy2.*" $SIDA
+   wait_until has_link --interface "dummy2.*" "$SIDA"
    set_instance +A
    simulator_command down "eth0"
-   wait_until has_link --interface "dummy1.*" $SIDB
+   wait_until has_link --interface "dummy1.*" "$SIDB"
    set_instance +B
-   wait_until has_link --interface "dummy1.*" $SIDA
+   wait_until has_link --interface "dummy1.*" "$SIDA"
    set_instance +A
    simulator_command up "eth0"
-   wait_until has_link --interface "dummy2.*" $SIDB
+   wait_until has_link --interface "dummy2.*" "$SIDB"
    set_instance +B
-   wait_until has_link --interface "dummy2.*" $SIDA
+   wait_until has_link --interface "dummy2.*" "$SIDA"
 }
 finally_multi_interface() {
    simulator_quit
@@ -804,7 +804,7 @@ test_ping_unreliable_1hop() {
    wait_until --timeout=10 path_exists +A +B
    wait_until --timeout=5 path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates $SIDB 100
+   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates "$SIDB" 100
    tfw_cat --stdout --stderr
    received=$($SED -n -e 's/.*\<\([0-9][0-9]*\) packets received.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
    duplicates=$($SED -n -e 's/.*\<\([0-9][0-9]*\) duplicates.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
@@ -834,7 +834,7 @@ test_ping_unreliable_2hop() {
    wait_until path_exists +A +B +C
    wait_until path_exists +C +B +A
    set_instance +A
-   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates $SIDC 100
+   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates "$SIDC" 100
    tfw_cat --stdout --stderr
    received=$($SED -n -e 's/.*\<\([0-9]\+\) packets received.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
    duplicates=$($SED -n -e 's/.*\<\([0-9]\+\) duplicates.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
@@ -865,7 +865,7 @@ test_ping_congested() {
    wait_until --timeout=10 path_exists +A +B
    wait_until --timeout=5 path_exists +B +A
    set_instance +A
-   executeOk_servald mdp ping --interval=0.100 --timeout=3 $SIDB 100
+   executeOk_servald mdp ping --interval=0.100 --timeout=3 "$SIDB" 100
    tfw_cat --stdout --stderr
 }
 finally_ping_congested() {
@@ -917,7 +917,7 @@ test_unreliable_links() {
    wait_until path_exists +A +B +C
    wait_until path_exists +C +B +A
    set_instance +A
-   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates $SIDC 50
+   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates "$SIDC" 50
    tfw_cat --stdout --stderr
    received=$($SED -n -e 's/.*\<\([0-9]\+\) packets received.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
    duplicates=$($SED -n -e 's/.*\<\([0-9]\+\) duplicates.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
@@ -963,7 +963,7 @@ test_unreliable_links2() {
    wait_until --timeout=20 path_exists +A +B +C +D
    wait_until --timeout=20 path_exists +D +C +B +A
    set_instance +A
-   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates $SIDD 50
+   executeOk_servald mdp ping --interval=0.100 --timeout=3 --wait-for-duplicates "$SIDD" 50
    tfw_cat --stdout --stderr
    received=$($SED -n -e 's/.*\<\([0-9]\+\) packets received.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
    duplicates=$($SED -n -e 's/.*\<\([0-9]\+\) duplicates.*/\1/p' "$TFWSTDOUT") || error "malformed ping output"
@@ -998,7 +998,7 @@ test_circle() {
    wait_until path_exists +A +B +C
    wait_until path_exists +C +B +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 --wait-for-duplicates $SIDC 1
+   executeOk_servald mdp ping --timeout=3 --wait-for-duplicates "$SIDC" 1
    tfw_cat --stdout --stderr
    stop_servald_server +B
    foreach_instance +A +C \
@@ -1006,7 +1006,7 @@ test_circle() {
    wait_until path_exists +A +H +G +F +E +D +C
    wait_until path_exists +C +D +E +F +G +H +A
    set_instance +A
-   executeOk_servald mdp ping --timeout=3 --wait-for-duplicates $SIDC 1
+   executeOk_servald mdp ping --timeout=3 --wait-for-duplicates "$SIDC" 1
    tfw_cat --stdout --stderr
 }
 
@@ -1028,13 +1028,13 @@ setup_crowded_mess() {
 doc_crowded_mess="Multiple possible paths"
 test_crowded_mess() {
    set_instance +H
-   wait_until has_link --via "[0-9A-F]*" $SIDA
+   wait_until has_link --via "[0-9A-F]*" "$SIDA"
    set_instance +A
-   wait_until has_link --via "[0-9A-F]*" $SIDH
-   executeOk_servald mdp trace $SIDD
+   wait_until has_link --via "[0-9A-F]*" "$SIDH"
+   executeOk_servald mdp trace "$SIDD"
    assertStdoutGrep --matches=1 "^[0-9]:${SIDD}\$"
    tfw_cat --stdout
-   executeOk_servald mdp ping --timeout=3 --wait-for-duplicates $SIDH 3
+   executeOk_servald mdp ping --timeout=3 --wait-for-duplicates "$SIDH" 3
    tfw_cat --stdout --stderr
 }
 
diff --git a/tests/vomp b/tests/vomp
index 535ba406..a09931a8 100755
--- a/tests/vomp
+++ b/tests/vomp
@@ -215,14 +215,14 @@ setup_stun() {
 has_unicast_link() {
    executeOk_servald route print
    tfw_cat --stdout
-   if ! grep "^${SIDB}:UNICAST:dummy1:" $_tfw_tmp/stdout; then
+   if ! grep "^${SIDB}:UNICAST:dummy1:" "$_tfw_tmp/stdout"; then
       return 1
    fi
 }
 test_stun() {
    set_instance +A
    executeOk_servald route print
-   assertGrep --matches=1 $_tfw_tmp/stdout "^${SIDB}:INDIRECT::${SIDC}"
+   assertGrep --matches=1 "$_tfw_tmp/stdout" "^${SIDB}:INDIRECT::${SIDC}"
    test_call_lifecycle
    set_instance +A
    wait_until --timeout=10 has_unicast_link