diff --git a/src/linux/Packaging.Linux/build.sh b/src/linux/Packaging.Linux/build.sh
index 6672857d2..d375ddfbf 100755
--- a/src/linux/Packaging.Linux/build.sh
+++ b/src/linux/Packaging.Linux/build.sh
@@ -1,4 +1,7 @@
 #!/bin/bash
+
+set -eu
+
 die () {
     echo "$*" >&2
     exit 1
@@ -7,8 +10,8 @@ die () {
 echo "Building Packaging.Linux..."
 
 # Directories
-THISDIR="$( cd "$(dirname "$0")" ; pwd -P )"
-ROOT="$( cd "$THISDIR"/../../.. ; pwd -P )"
+THISDIR="$( cd "$(dirname "$0")" || exit 1 ; pwd -P )"
+ROOT="$( cd "$THISDIR"/../../.. || exit 1 ; pwd -P )"
 SRC="$ROOT/src"
 OUT="$ROOT/out"
 INSTALLER_SRC="$SRC/linux/Packaging.Linux"
@@ -41,7 +44,7 @@ esac
 done
 
 # Ensure install prefix exists
-if [! -d "$INSTALL_PREFIX" ]; then
+if [ ! -d "$INSTALL_PREFIX" ]; then
     mkdir -p "$INSTALL_PREFIX"
 fi
 
@@ -58,7 +61,7 @@ SYMBOLS="$OUTDIR/payload.sym"
 # Lay out payload
 "$INSTALLER_SRC/layout.sh" --configuration="$CONFIGURATION" || exit 1
 
-if [ $INSTALL_FROM_SOURCE = true ]; then
+if [ "$INSTALL_FROM_SOURCE" = true ]; then
     echo "Installing to $INSTALL_PREFIX"
 
     # Install directories
diff --git a/src/linux/Packaging.Linux/install-from-source.sh b/src/linux/Packaging.Linux/install-from-source.sh
index be6ea1579..ef975a662 100755
--- a/src/linux/Packaging.Linux/install-from-source.sh
+++ b/src/linux/Packaging.Linux/install-from-source.sh
@@ -41,7 +41,7 @@ if [ -z $is_ci ]; then
 Git Credential Manager is licensed under the MIT License: https://aka.ms/gcm/license"
 
     while true; do
-        read -p "Do you want to continue? [Y/n] " yn
+        read -rp "Do you want to continue? [Y/n] " yn
         case $yn in
             [Yy]*|"")
                 break
@@ -63,18 +63,18 @@ install_packages() {
 
     for package in $packages; do
         # Ensure we don't stomp on existing installations.
-        if [ ! -z $(which $package) ]; then
+        if [ -n "$(which "$package")" ]; then
             continue
         fi
 
-        if [ $pkg_manager = apk ]; then
-            $sudo_cmd $pkg_manager $install_verb $package
-        elif [ $pkg_manager = zypper ]; then
-            $sudo_cmd $pkg_manager -n $install_verb $package
-        elif [ $pkg_manager = pacman ]; then
-            $sudo_cmd $pkg_manager --noconfirm $install_verb $package
+        if [ "$pkg_manager" = apk ]; then
+            "$sudo_cmd" "$pkg_manager" "$install_verb" "$package"
+        elif [ "$pkg_manager" = zypper ]; then
+            "$sudo_cmd" "$pkg_manager" -n "$install_verb" "$package"
+        elif [ "$pkg_manager" = pacman ]; then
+            "$sudo_cmd" "$pkg_manager" --noconfirm "$install_verb" "$package"
         else
-            $sudo_cmd $pkg_manager $install_verb $package -y
+            "$sudo_cmd" "$pkg_manager" "$install_verb" "$package" -y
         fi
     done
 }
@@ -87,21 +87,21 @@ ensure_dotnet_installed() {
 
         # Since we have to run the dotnet install script with bash, dotnet isn't
         # added to the process PATH, so we manually add it here.
-        cd ~
-        export DOTNET_ROOT=$(pwd)/.dotnet
-        add_to_PATH $DOTNET_ROOT
+        cd ~ # XXX why does the script need to change directory here, and not change back?
+        export DOTNET_ROOT="$HOME/.dotnet"
+        add_to_PATH "$DOTNET_ROOT"
     fi
 }
 
 verify_existing_dotnet_installation() {
     # Get initial pieces of installed sdk version(s).
-    sdks=$(dotnet --list-sdks | cut -c 1-3)
+    sdks="$(dotnet --list-sdks | cut -c 1-3)"
 
     # If we have a supported version installed, return.
     supported_dotnet_versions="8.0"
     for v in $supported_dotnet_versions; do
-        if [ $(echo $sdks | grep "$v") ]; then
-            echo $sdks
+        if echo "$sdks" | grep -q "$v" ; then
+            echo "$sdks"
         fi
     done
 }
@@ -116,22 +116,22 @@ add_to_PATH () {
             break
         ;;
         *)
-            export PATH=$PATH:$directory
+            export PATH="$PATH":"$directory"
         ;;
     esac
   done
 }
 
 apt_install() {
-    pkg_name=$1
+    pkg_name="$1"
 
-    $sudo_cmd apt update
-    $sudo_cmd apt install $pkg_name -y 2>/dev/null
+    "$sudo_cmd" apt update
+    "$sudo_cmd" apt install "$pkg_name" -y 2>/dev/null
 }
 
 print_unsupported_distro() {
-    prefix=$1
-    distro=$2
+    prefix="$1"
+    distro="$2"
 
     echo "$prefix: $distro is not officially supported by the GCM project."
     echo "See https://gh.io/gcm/linux for details."
@@ -146,13 +146,13 @@ sudo_cmd=
 # If the user isn't root, we need to use `sudo` for certain commands
 # (e.g. installing packages).
 if [ -z "$sudo_cmd" ]; then
-    if [ `id -u` != 0 ]; then
+    if [ "$(id -u)" != 0 ]; then
         sudo_cmd=sudo
     fi
 fi
 
-eval "$(sed -n 's/^ID=/distribution=/p' /etc/os-release)"
-eval "$(sed -n 's/^VERSION_ID=/version=/p' /etc/os-release | tr -d '"')"
+distribution="$(grep '^ID=' /etc/os-release | sed 's/^ID=//')"
+version="$(grep '^VERSION_ID=' /etc/os-release | sed -r 's/^VERSION_ID=\"(.*)\"/\1/')"
 case "$distribution" in
     debian | ubuntu)
         $sudo_cmd apt update
@@ -194,7 +194,7 @@ case "$distribution" in
 
         # Install dotnet/GCM dependencies.
         # Alpine 3.14 and earlier need libssl1.1, while later versions need libssl3.
-        if ( version_at_least "3.15" $version ) then
+        if ( version_at_least "3.15" "$version" ) then
             libssl_pkg="libssl3"
         else
             libssl_pkg="libssl1.1"
@@ -247,9 +247,9 @@ if [ "z$script_path" = "z$toplevel_path" ] || [ ! -f "$toplevel_path/Git-Credent
 fi
 
 if [ -z "$DOTNET_ROOT" ]; then
-    DOTNET_ROOT="$(dirname $(which dotnet))"
+    DOTNET_ROOT="$(dirname "$(which dotnet)")"
 fi
 
 cd "$toplevel_path"
-$sudo_cmd env "PATH=$PATH" $DOTNET_ROOT/dotnet build ./src/linux/Packaging.Linux/Packaging.Linux.csproj -c Release -p:InstallFromSource=true -p:installPrefix=$installPrefix
+"$sudo_cmd" env "PATH=$PATH" "$DOTNET_ROOT"/dotnet build ./src/linux/Packaging.Linux/Packaging.Linux.csproj -c Release -p:InstallFromSource=true -p:installPrefix="$installPrefix"
 add_to_PATH "$installPrefix/bin"
diff --git a/src/linux/Packaging.Linux/layout.sh b/src/linux/Packaging.Linux/layout.sh
index 6679c39ca..69458b7e8 100755
--- a/src/linux/Packaging.Linux/layout.sh
+++ b/src/linux/Packaging.Linux/layout.sh
@@ -1,4 +1,7 @@
 #!/bin/bash
+
+set -eu
+
 die () {
     echo "$*" >&2
     exit 1
@@ -30,8 +33,8 @@ esac
 done
 
 # Directories
-THISDIR="$( cd "$(dirname "$0")" ; pwd -P )"
-ROOT="$( cd "$THISDIR"/../../.. ; pwd -P )"
+THISDIR="$( cd "$(dirname "$0")" || exit 1 ; pwd -P )"
+ROOT="$( cd "$THISDIR"/../../.. || exit 1 ; pwd -P )"
 SRC="$ROOT/src"
 OUT="$ROOT/out"
 GCM_SRC="$SRC/shared/Git-Credential-Manager"
@@ -63,13 +66,13 @@ fi
 # Ensure directories exists
 mkdir -p "$PAYLOAD" "$SYMBOLOUT"
 
-if [ -z "$DOTNET_ROOT" ]; then
-    DOTNET_ROOT="$(dirname $(which dotnet))"
+if [ -z "${DOTNET_ROOT+x}" ]; then
+    DOTNET_ROOT="$(dirname "$(which dotnet)")"
 fi
 
 # Publish core application executables
 echo "Publishing core application..."
-$DOTNET_ROOT/dotnet publish "$GCM_SRC" \
+"$DOTNET_ROOT"/dotnet publish "$GCM_SRC" \
 	--configuration="$CONFIGURATION" \
 	--framework="$FRAMEWORK" \
 	--runtime="$RUNTIME" \
diff --git a/src/linux/Packaging.Linux/pack.sh b/src/linux/Packaging.Linux/pack.sh
index 14d26aee5..96e09684f 100755
--- a/src/linux/Packaging.Linux/pack.sh
+++ b/src/linux/Packaging.Linux/pack.sh
@@ -1,16 +1,18 @@
 #!/bin/bash
+
+set -eu
+
 die () {
     echo "$*" >&2
     exit 1
 }
 
 # Directories
-THISDIR="$( cd "$(dirname "$0")" ; pwd -P )"
-ROOT="$( cd "$THISDIR"/../../.. ; pwd -P )"
+THISDIR="$( cd "$(dirname "$0")" || exit 1 ; pwd -P )"
+ROOT="$( cd "$THISDIR"/../../.. || exit 1 ; pwd -P )"
 SRC="$ROOT/src"
 OUT="$ROOT/out"
 PROJ_OUT="$OUT/linux/Packaging.Linux"
-INSTALLER_SRC="$SRC/osx/Installer.Mac"
 
 # Parse script arguments
 for i in "$@"
@@ -52,7 +54,7 @@ if [ -z "$SYMBOLS" ]; then
     die "--symbols was not set"
 fi
 
-ARCH="`dpkg-architecture -q DEB_HOST_ARCH`"
+ARCH="$(dpkg-architecture -q DEB_HOST_ARCH)"
 
 if test -z "$ARCH"; then
     die "Could not determine host architecture!"
@@ -76,7 +78,7 @@ echo "Packing Packaging.Linux..."
 # Cleanup any old archive files
 if [ -e "$TAROUT" ]; then
     echo "Deleteing old archive '$TAROUT'..."
-    rm "$TAROUT"
+    rm -r "$TAROUT"
 fi
 
 # Ensure the parent directory for the archive exists
@@ -85,13 +87,13 @@ mkdir -p "$TAROUT" || exit 1
 # Build binaries tarball
 echo "Building binaries tarball..."
 pushd "$PAYLOAD"
-tar -czvf "$TARBALL" * || exit 1
+tar -czvf "$TARBALL" ./* || exit 1
 popd
 
 # Build symbols tarball
 echo "Building symbols tarball..."
 pushd "$SYMBOLS"
-tar -czvf "$SYMTARBALL" * || exit 1
+tar -czvf "$SYMTARBALL" ./* || exit 1
 popd
 
 # Build .deb
@@ -127,5 +129,3 @@ if [ ! -f "$LINK_TO/git-credential-manager" ]; then
 fi
 
 dpkg-deb -Zxz --root-owner-group --build "$DEBROOT" "$DEBPKG" || exit 1
-
-echo $MESSAGE