diff --git a/scripts/apt-clean.sh b/scripts/apt-clean.sh
index 4365a7c..270b574 100755
--- a/scripts/apt-clean.sh
+++ b/scripts/apt-clean.sh
@@ -23,24 +23,28 @@ find /var/cache/debconf/ ! -type d -wholename '/var/cache/debconf/*-old' -delete
 
 __t=$(mktemp) ; : "${__t:?}"
 debconf_trim_i18n() {
-    mawk 'BEGIN { m = 0 }
-    $0 == "" { print }
-    /^[^[:space:]]/ {
-        if ($1 ~ "\.[Uu][Tt][Ff]-?8:") { m = 1; next; }
-        m = 0; print $0;
-    }
-    /^[[:space:]]/ {
-        if (m == 1) next;
-        print $0;
-    }' < "$1" > "${__t}"
-    cat < "${__t}" > "$1"
+	mawk 'BEGIN { m = 0; }
+	$0 == "" { print; }
+	/^[^[:space:]]/ {
+	    if ($1 ~ "\.[Uu][Tt][Ff]-?8:") {
+	        m = 1;
+	        next;
+	    }
+	    m = 0;
+	    print $0;
+	}
+	/^[[:space:]]/ {
+	    if (m == 1) next;
+	    print $0;
+	}' < "$1" > "${__t}"
+	cat < "${__t}" > "$1"
 }
 
 debconf_trim_i18n /var/cache/debconf/templates.dat
 while read -r tmpl ; do
-    [ -n "${tmpl}" ] || continue
-    [ -s "${tmpl}" ] || continue
-    debconf_trim_i18n "${tmpl}"
+	[ -n "${tmpl}" ] || continue
+	[ -s "${tmpl}" ] || continue
+	debconf_trim_i18n "${tmpl}"
 done <<EOF
 $(find "${DPKG_ADMINDIR}/info/" -type f -name '*.templates' | sort -V)
 EOF
diff --git a/scripts/apt-install-angie-mod.sh b/scripts/apt-install-angie-mod.sh
index 433b377..199372b 100755
--- a/scripts/apt-install-angie-mod.sh
+++ b/scripts/apt-install-angie-mod.sh
@@ -37,16 +37,15 @@ normalize_list() {
 	[ -n "$1" ] || return 0
 
 	printf '%s' "$1" \
-	| tr -s '[:space:]' ' ' \
-	| sed -zE 's/^ //;s/ $//'
+	| sed -zE 's/[[:space:]]+/ /g;s/^ //;s/ $//'
 }
 
 sort_dedup_list() {
 	[ -n "$1" ] || return 0
 
 	printf '%s' "$1" \
-	| tr -s '[:space:]' '\n' | sort -uV | paste -sd ' ' \
-	| sed -zE 's/^\s+//;s/\s+$//'
+	| tr -s '[:space:]' '\n' | sort -uV \
+	| sed -zE 's/[[:space:]]+/ /g;s/^ //;s/ $//'
 }
 
 pkgs=$(sort_dedup_list "${pkgs}")
diff --git a/scripts/apt-install.sh b/scripts/apt-install.sh
index 7859e80..f98abb6 100755
--- a/scripts/apt-install.sh
+++ b/scripts/apt-install.sh
@@ -22,8 +22,9 @@ _apt_update() {
 }
 
 _dpkg_avail_hack() {
+	: "${DPKG_ADMINDIR:=/var/lib/dpkg}"
 	VERSION_CODENAME=$(. /etc/os-release ; printf '%s' "${VERSION_CODENAME}") || :
-	f="${DPKG_ADMINDIR:-/var/lib/dpkg}/available"
+	f="${DPKG_ADMINDIR}/available"
 	# if ${VERSION_CODENAME} is empty then we're on Debian sid or so :)
 	case "${VERSION_CODENAME}" in
 	stretch | buster | bionic | focal )
@@ -31,7 +32,7 @@ _dpkg_avail_hack() {
 		if [ -s "$f" ] ; then
 			return
 		fi
-		/usr/lib/dpkg/methods/apt/update "${DPKG_ADMINDIR:-/var/lib/dpkg}" apt apt
+		/usr/lib/dpkg/methods/apt/update "${DPKG_ADMINDIR}" apt apt
 	;;
 	* )
 		touch "$f"
diff --git a/scripts/envsubst-args.sh b/scripts/envsubst-args.sh
index 27dbaef..7e780c8 100755
--- a/scripts/envsubst-args.sh
+++ b/scripts/envsubst-args.sh
@@ -1,19 +1,17 @@
 #!/bin/sh
 set -f
 
-sed -znE '/^([^=]+)=.*$/s,,\1,p' /proc/self/environ \
+sed -znE '/^([^=]+)=.*$/s,,\1,p' /proc/$$/environ \
 | sed -zE \
     -e '/^_$/d;/^ENVSUBST_/d;' \
     -e '/^__IEP_/d;/^IEP_$/d' \
 | {
 	if [ -n "${ENVSUBST_EXCLUDE_REGEX:-}" ] ; then
 		grep -zEv -e "${ENVSUBST_EXCLUDE_REGEX}"
+	elif [ -n "${ENVSUBST_INCLUDE_REGEX:-}" ] ; then
+		grep -zE -e "${ENVSUBST_INCLUDE_REGEX}"
 	else
-		if [ -n "${ENVSUBST_INCLUDE_REGEX:-}" ] ; then
-			grep -zE -e "${ENVSUBST_INCLUDE_REGEX}"
-		else
-			cat
-		fi
+		cat
 	fi
 } \
 | sort -zV \
diff --git a/scripts/openssl-cert-auto-pem.sh b/scripts/openssl-cert-auto-pem.sh
index 3487e88..d4f31b0 100755
--- a/scripts/openssl-cert-auto-pem.sh
+++ b/scripts/openssl-cert-auto-pem.sh
@@ -20,11 +20,16 @@ w_cleanup() {
 }
 
 bundle_offsets() {
-	awk '
-	BEGIN { OFS = "," ; i_begin = 0 ; }
-	$0 == "-----BEGIN CERTIFICATE-----" { i_begin = NR ; }
-	$0 == "-----END CERTIFICATE-----"   { if (i_begin > 0) { print i_begin,NR ; i_begin = 0 ; } }
-	' "$1"
+	mawk 'BEGIN { OFS = ","; i_begin = 0; }
+	$0 == "-----BEGIN CERTIFICATE-----" {
+	    i_begin = NR;
+	}
+	$0 == "-----END CERTIFICATE-----" {
+	    if (i_begin > 0) {
+	        print i_begin, NR;
+	        i_begin = 0;
+	    }
+	}' "$1"
 }
 
 bundle_fingerprints() {
diff --git a/scripts/python-rm-cache.sh b/scripts/python-rm-cache.sh
index 039b846..a1b887e 100755
--- a/scripts/python-rm-cache.sh
+++ b/scripts/python-rm-cache.sh
@@ -1,7 +1,9 @@
 #!/bin/sh
 set -f
 for i ; do
-    find "$i/" -name __pycache__ -exec rm -rf {} +
-    find "$i/" ! -type d -name '*.py[co]' -exec rm -f {} +
+	[ -n "$i" ] || continue
+	[ -d "$i" ] || continue
+	find "$i/" -name __pycache__ -exec rm -rf {} +
+	find "$i/" ! -type d -name '*.py[co]' -exec rm -f {} +
 done
 exit 0
diff --git a/scripts/static-compress.sh b/scripts/static-compress.sh
index 5b8c829..a5ac425 100755
--- a/scripts/static-compress.sh
+++ b/scripts/static-compress.sh
@@ -1,52 +1,41 @@
 #!/bin/sh
 set -f
 
-COMPRESS_MIN_RATIO=90
-
 if command -V gzip   >/dev/null ; then has_gzip=1   ; fi
 if command -V brotli >/dev/null ; then has_brotli=1 ; fi
 if command -V zstd   >/dev/null ; then has_zstd=1   ; fi
 
-do_gzip()   { [ -s "$1.gz"  ] || gzip   -1kf "$1" ; comp_fixup "$1" "$1.gz"  ; }
-do_brotli() { [ -s "$1.br"  ] || brotli -1kf "$1" ; comp_fixup "$1" "$1.br"  ; }
-do_zstd()   { [ -s "$1.zst" ] || zstd  -q1kf "$1" ; comp_fixup "$1" "$1.zst" ; }
+do_gzip()   { [ -s "$1.gz"  ] || gzip   -1kf "$1" || return ; comp_fixup "$1" "$1.gz"  || rm -f "$1.gz" ; }
+do_brotli() { [ -s "$1.br"  ] || brotli -1kf "$1" || return ; comp_fixup "$1" "$1.br"  || rm -f "$1.br" ; }
+do_zstd()   { [ -s "$1.zst" ] || zstd  -q1kf "$1" || return ; comp_fixup "$1" "$1.zst" || rm -f "$1.zst" ; }
+
+float_div() {
+	mawk -v "a=$1" -v "b=$2" 'BEGIN{print a/b;exit;}' </dev/null
+}
 
 comp_fixup() {
-	size1=$(env stat -c '%s' "$1") || return
+	[ -f "$1" ] || return 1
+	size1=$(env stat -Lc '%s' "$1") || return 1
+	[ -n "${size1}" ] || return 1
+	[ "${size1}" != 0 ] || return 1
 
-	[ -f "$2" ] || return
-	[ -s "$2" ] || { rm -f "$2" ; return ; }
-	size2=$(env stat -c '%s' "$2") || return
+	[ -f "$2" ] || return 1
+	size2=$(env stat -c '%s' "$2") || return 1
+	[ -n "${size2}" ] || return 1
+	[ "${size2}" != 0 ] || return 1
 
-	pow1=${#size1} ; pow2=${#size2}
+	ratio=$(float_div "${size2}" "${size1}") || return 1
+	case "${ratio}" in
+	[0-9]*e-[0-9]* )
+		## doubtful but okay (c) Oleg Tinkov
+	;;
+	0.[0-8]* | 0.90* )
+		## compression ratio below 90% is fine
+	;;
+	* ) return 1 ;;
+	esac
 
-	## if size2 is _longer_ than size1 - compression did something wrong (file is bigger)
-	if [ ${pow2} -gt ${pow1} ] ; then
-		rm -f "$2" ; return
-	fi
-
-	## if size1 is _longer_ size2 more than 2 digits - compression was done very successful
-	## doubtful but okay (c) Oleg Tinkov
-	if [ $(( pow1 - pow2 )) -gt 2 ] ; then
-		return
-	fi
-
-	## math hack!
-	if [ ${pow1} -gt 7 ] ; then
-		skew=$(( pow1 - 4 ))
-		pow1=$(( pow1 - skew ))
-		pow2=$(( pow2 - skew ))
-		size1=$(printf '%s' "${size1}" | cut -c 1-${pow1})
-		size2=$(printf '%s' "${size2}" | cut -c 1-${pow2})
-	fi
-
-	ratio=$(( (100 * size2) / size1 ))
-	if [ ${ratio} -ge ${COMPRESS_MIN_RATIO} ] ; then
-		rm -f "$2"
-	else
-		## seems to be excessive
-		: touch -r "$1" -m "$2"
-	fi
+	return 0
 }
 
 for i ; do