diff --git a/debian/bin/fix-shebang b/debian/bin/fix-shebang
index edf551f..7efcd3e 100755
--- a/debian/bin/fix-shebang
+++ b/debian/bin/fix-shebang
@@ -5,8 +5,8 @@
 # policy doesn't specify what to do.
 if ($. == 1 && m|^\#!\s*/usr/bin/env\s+(.+)|) {
     if ($1 eq "perl") {
-	$_ = "#!/usr/bin/perl\n";
+        $_ = "#!/usr/bin/perl\n";
     } else {
-	print STDERR "W: Found #!/usr/bin/env $1 and don't know what to substitute\n";
+        print STDERR "W: Found #!/usr/bin/env $1 and don't know what to substitute\n";
     }
 }
diff --git a/debian/bin/no-depmod b/debian/bin/no-depmod
index ed5a846..5f42375 100755
--- a/debian/bin/no-depmod
+++ b/debian/bin/no-depmod
@@ -6,13 +6,20 @@ set -e
 # postinst, we do not need or want to package the files that it
 # generates.
 
-if [ "x$1" = x-V ]; then
+case "$1" in
+-V )
     # Satisfy version test
     echo 'not really module-init-tools'
-elif [ "x$1" = x-b -a "${2%/depmod.??????}" != "$2" ]; then
-    # Satisfy test of short kernel versions
-    mkdir -p "$2/lib/modules/$3"
-    touch "$2/lib/modules/$3/modules.dep"
-else
-    echo 'skipping depmod'
-fi
+    exit
+;;
+-b )
+    if [ "${2%/depmod.??????}" != "$2" ] ; then
+        # Satisfy test of short kernel versions
+        mkdir -p "$2/lib/modules/$3"
+        touch "$2/lib/modules/$3/modules.dep"
+        exit
+    fi
+;;
+esac
+
+echo 'skipping depmod'
diff --git a/debian/hyperv-daemons.postinst b/debian/hyperv-daemons.postinst
index 9bee3f6..1528ce7 100644
--- a/debian/hyperv-daemons.postinst
+++ b/debian/hyperv-daemons.postinst
@@ -1,9 +1,13 @@
 #!/bin/sh
 set -e
 
-if [ "$1" = "configure" ]; then
-    if [ -d /run/systemd/system ]; then
-        if [ -z "$2" ]; then
+have_systemd=1
+[ -d /run/systemd/system ] || have_systemd=0
+
+case "$1" in
+configure )
+    if [ ${have_systemd} = 1 ] ; then
+        if [ -z "$2" ] ; then
             # On initial install make sure udev notifies systemd
             udevadm trigger || true
         else
@@ -11,7 +15,10 @@ if [ "$1" = "configure" ]; then
             systemctl try-restart hv-kvp-daemon.service hv-vss-daemon.service
         fi
     fi
-fi
+;;
+esac
+
+unset have_systemd
 
 #DEBHELPER#
 
diff --git a/debian/hyperv-daemons.preinst b/debian/hyperv-daemons.preinst
index fc13e51..36b7dac 100644
--- a/debian/hyperv-daemons.preinst
+++ b/debian/hyperv-daemons.preinst
@@ -1,20 +1,29 @@
 #!/bin/sh
 set -e
 
-if [ "$1" = "upgrade" ]; then
+have_systemd=1
+[ -d /run/systemd/system ] || have_systemd=0
+
+case "$1" in
+upgrade )
     services='kvp vss'
-    if dpkg --compare-versions "$2" lt 6.10~rc6-1~exp1; then
-	services="fcopy $services"
+    if dpkg --compare-versions "$2" lt '6.10~rc6-1~exp1' ; then
+        services="fcopy ${services}"
     fi
-    for i in $services; do
-        if [ -d /run/systemd/system ]; then
-            systemctl stop hyperv-daemons.hv-$i-daemon.service 2>/dev/null || true
+    for i in ${services} ; do
+        init_service="hyperv-daemons.hv-$i-daemon"
+        systemd_unit="${init_service}.service"
+        if [ ${have_systemd} = 1 ] ; then
+            systemctl stop "${systemd_unit}" 2>/dev/null || true
         fi
-        deb-systemd-helper purge hyperv-daemons.hv-$i-daemon.service || true
-        invoke-rc.d --skip-systemd-native hyperv-daemons.hv-$i-daemon stop || true
-        update-rc.d hyperv-daemons.hv-$i-daemon remove || true
-    done
-fi
+        deb-systemd-helper purge "${systemd_unit}" || true
+        invoke-rc.d --skip-systemd-native "${init_service}" stop || true
+        update-rc.d "${init_service}" remove || true
+    done ; unset services i init_service systemd_unit
+;;
+esac
+
+unset have_systemd
 
 #DEBHELPER#
 
diff --git a/debian/linux-perf.postinst b/debian/linux-perf.postinst
index d38695a..2c3992c 100644
--- a/debian/linux-perf.postinst
+++ b/debian/linux-perf.postinst
@@ -2,10 +2,11 @@
 
 set -e
 
-old_version_suffix="$(echo "$2" | sed -rn 's/^([0-9]+\.[0-9]+).*/\1/p')"
-if [ "$old_version_suffix" ]; then
+old_version_suffix=$(printf '%s' "$2" | sed -En 's/^([0-9]+\.[0-9]+).*/\1/p')
+if [ -n "${old_version_suffix}" ] ; then
     dpkg-maintscript-helper symlink_to_dir \
-	/usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" 5.16\~rc8-1\~exp1 linux-perf -- "$@"
+      /usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" '5.16~rc8-1~exp1' linux-perf -- "$@"
 fi
+unset old_version_suffix
 
 #DEBHELPER#
diff --git a/debian/linux-perf.postrm b/debian/linux-perf.postrm
index 84a6e3d..6db3546 100644
--- a/debian/linux-perf.postrm
+++ b/debian/linux-perf.postrm
@@ -2,21 +2,24 @@
 
 set -e
 
-old_version_suffix="$(echo "$2" | sed -rn 's/^([0-9]+\.[0-9]+).*/\1/p')"
-if [ "$old_version_suffix" ]; then
+old_version_suffix=$(printf '%s' "$2" | sed -En 's/^([0-9]+\.[0-9]+).*/\1/p')
+if [ -n "${old_version_suffix}" ] ; then
     dpkg-maintscript-helper symlink_to_dir \
-	/usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" 5.16\~rc8-1\~exp1 linux-perf -- "$@"
+      /usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" '5.16~rc8-1~exp1' linux-perf -- "$@"
 fi
+unset old_version_suffix
 
-if [ "$1" = remove ]
-then
-	for wrapper in /usr/bin/perf \
-		       /usr/share/bash-completion/completions/perf \
-		       /usr/share/man/man1/perf.1.gz; do
-	    diversion="${wrapper%/perf*}/perf.wrapper${wrapper#*/perf}"
-	    dpkg-divert --package linux-perf --divert "$diversion" --rename \
-		--remove "$wrapper"
-	done
-fi
+case "$1" in
+remove )
+    for wrapper in \
+      /usr/bin/perf \
+      /usr/share/bash-completion/completions/perf \
+      /usr/share/man/man1/perf.1.gz \
+    ; do
+        diversion="${wrapper%/perf*}/perf.wrapper${wrapper#*/perf}"
+        dpkg-divert --package linux-perf --divert "${diversion}" --rename --remove "${wrapper}"
+    done ; unset wrapper diversion
+;;
+esac
 
 #DEBHELPER#
diff --git a/debian/linux-perf.preinst b/debian/linux-perf.preinst
index 8965a32..3c3aede 100644
--- a/debian/linux-perf.preinst
+++ b/debian/linux-perf.preinst
@@ -2,21 +2,24 @@
 
 set -e
 
-old_version_suffix="$(echo "$2" | sed -rn 's/^([0-9]+\.[0-9]+).*/\1/p')"
-if [ "$old_version_suffix" ]; then
+old_version_suffix=$(printf '%s' "$2" | sed -En 's/^([0-9]+\.[0-9]+).*/\1/p')
+if [ -n "${old_version_suffix}" ] ; then
     dpkg-maintscript-helper symlink_to_dir \
-	/usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" 5.16\~rc8-1\~exp1 linux-perf -- "$@"
+      /usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" '5.16~rc8-1~exp1' linux-perf -- "$@"
 fi
+unset old_version_suffix
 
-if [ "$1" = install ] || [ "$1" = upgrade ]
-then
-	for wrapper in /usr/bin/perf \
-		       /usr/share/bash-completion/completions/perf \
-		       /usr/share/man/man1/perf.1.gz; do
-	    diversion="${wrapper%/perf*}/perf.wrapper${wrapper#*/perf}"
-	    dpkg-divert --package linux-perf --divert "$diversion" --rename \
-		--add "$wrapper"
-	done
-fi
+case "$1" in
+install | upgrade )
+    for wrapper in \
+      /usr/bin/perf \
+      /usr/share/bash-completion/completions/perf \
+      /usr/share/man/man1/perf.1.gz \
+    ; do
+        diversion="${wrapper%/perf*}/perf.wrapper${wrapper#*/perf}"
+        dpkg-divert --package linux-perf --divert "${diversion}" --rename --add "${wrapper}"
+    done ; unset wrapper diversion
+;;
+esac
 
 #DEBHELPER#
diff --git a/debian/linux-perf.prerm b/debian/linux-perf.prerm
index d38695a..2c3992c 100644
--- a/debian/linux-perf.prerm
+++ b/debian/linux-perf.prerm
@@ -2,10 +2,11 @@
 
 set -e
 
-old_version_suffix="$(echo "$2" | sed -rn 's/^([0-9]+\.[0-9]+).*/\1/p')"
-if [ "$old_version_suffix" ]; then
+old_version_suffix=$(printf '%s' "$2" | sed -En 's/^([0-9]+\.[0-9]+).*/\1/p')
+if [ -n "${old_version_suffix}" ] ; then
     dpkg-maintscript-helper symlink_to_dir \
-	/usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" 5.16\~rc8-1\~exp1 linux-perf -- "$@"
+      /usr/share/doc/linux-perf "linux-perf-${old_version_suffix}" '5.16~rc8-1~exp1' linux-perf -- "$@"
 fi
+unset old_version_suffix
 
 #DEBHELPER#
diff --git a/debian/rules b/debian/rules
index fc26c10..d8b28f0 100755
--- a/debian/rules
+++ b/debian/rules
@@ -5,8 +5,6 @@ include /usr/share/dpkg/pkg-info.mk
 
 DEB_VERSION_SOURCE = $(shell echo '$(DEB_VERSION)' | sed -re 's/\+b([0-9]+)$$//')
 
-SHELL    := sh -e
-
 include debian/rules.defs
 
 ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
@@ -90,8 +88,8 @@ clean: debian/control
 	rm -rf $(CLEAN_PATTERNS)
 	dh_clean
 
-CONTROL_FILES = $(BUILD_DIR)/version-info $(wildcard debian/templates/*.in)
-CONTROL_FILES += debian/config/defines.toml $(wildcard debian/config/*/defines.toml)
+CONTROL_FILES = $(BUILD_DIR)/version-info $(sort $(wildcard debian/templates/*.in))
+CONTROL_FILES += debian/config/defines.toml $(sort $(wildcard debian/config/*/defines.toml))
 
 # debian/bin/gencontrol.py uses debian/changelog as input, but the
 # output only depends on the source name and version.  To avoid
@@ -100,7 +98,7 @@ CONTROL_FILES += debian/config/defines.toml $(wildcard debian/config/*/defines.t
 $(BUILD_DIR)/version-info: debian/changelog
 	mkdir -p $(@D)
 # Use DEB_VERSION_SOURCE to allow binNMU
-	printf >$@ 'Source: %s\nVersion: %s\n' $(DEB_SOURCE) $(DEB_VERSION)
+	printf >$@ 'Source: %s\nVersion: %s\n' '$(DEB_SOURCE)' '$(DEB_VERSION)'
 
 debian/control debian/rules.gen: debian/bin/gencontrol.py $(CONTROL_FILES)
 ifeq ($(wildcard debian/control.md5sum),)
@@ -113,6 +111,8 @@ endif
 debian/control-real: debian/bin/gencontrol.py $(CONTROL_FILES)
 # Hash randomisation makes the pickled config unreproducible
 	PYTHONHASHSEED=0 $<
+	find debian/ -name __pycache__ -type d -exec rm -rf {} +
+	find debian/ -name '*.pyc' -type f -exec rm -f {} +
 	md5sum $(sort $^) > debian/control.md5sum
 	@echo
 	@echo This target is made to fail intentionally, to make sure
diff --git a/debian/rules.d/Makefile.inc b/debian/rules.d/Makefile.inc
index 386217b..67dbc3e 100644
--- a/debian/rules.d/Makefile.inc
+++ b/debian/rules.d/Makefile.inc
@@ -10,10 +10,10 @@ CXX = $(CROSS_COMPILE)g++
 PKG_CONFIG = $(CROSS_COMPILE)pkg-config
 CFLAGS := $(shell dpkg-buildflags --get CFLAGS) -Wall
 CPPFLAGS := $(shell dpkg-buildflags --get CPPFLAGS) \
-	-I$(top_srcdir)/$(OUTDIR) \
-	-I$(top_srcdir)/debian/build/build-tools/$(OUTDIR) \
-	-I$(top_srcdir)/scripts/include \
-	-isystem $(top_srcdir)/debian/build/build-tools/include
+  -I$(top_srcdir)/$(OUTDIR) \
+  -I$(top_srcdir)/debian/build/build-tools/$(OUTDIR) \
+  -I$(top_srcdir)/scripts/include \
+  -isystem $(top_srcdir)/debian/build/build-tools/include
 CXXFLAGS := $(shell dpkg-buildflags --get CXXFLAGS) -Wall
 LDFLAGS := $(shell dpkg-buildflags --get LDFLAGS)
 
@@ -24,11 +24,14 @@ clean: clean-recursive
 install: install-local install-recursive
 
 %-recursive:
-	+@list='$(SUBDIRS)'; \
-	for subdir in $$list; do \
-	  echo "Making $* in $$subdir"; \
-	  mkdir -p $$subdir; \
-	  $(MAKE) -C $$subdir -f $(top_rulesdir)/$(OUTDIR)/$$subdir/Makefile OUTDIR=$(OUTDIR)/$$subdir $*; \
+	+@list='$(SUBDIRS)' ; \
+	for i in $$list ; do \
+	    echo "Making $* in $$i" ; \
+	    mkdir -p "$$i" ; \
+	    $(MAKE) -C "$$i" \
+	      -f $(top_rulesdir)/$(OUTDIR)/$$i/Makefile \
+	      OUTDIR=$(OUTDIR)/$$i \
+	      $* ; \
 	done
 
 all-local: $(PROGS)
@@ -36,26 +39,26 @@ all-local: $(PROGS)
 install-local: install-local-progs install-local-scripts install-local-data
 
 install-local-progs: $(PROGS)
-	@for p in $^; do \
-	  echo " install -m755 '$$p' '$(DESTDIR)/$(installdir)'"; \
-	  install -D -m755 "$$p" "$(DESTDIR)/$(installdir)/$$(basename $$p)"; \
+	@for p in $^ ; do \
+	    echo " install -m755 '$$p' '$(DESTDIR)/$(installdir)'" ; \
+	    install -D -m755 "$$p" "$(DESTDIR)/$(installdir)/$$(basename "$$p")" ; \
 	done
 
 SCRIPTS_REAL = $(wildcard $(addprefix $(top_srcdir)/$(OUTDIR)/,$(SCRIPTS)))
 
 install-local-scripts: $(SCRIPTS_REAL)
-	@for p in $^; do \
-	  echo " install -m755 '$$p' '$(DESTDIR)/$(installdir)'"; \
-	  install -D -m755 \
-	    -s --strip-program $(top_srcdir)/debian/bin/fix-shebang \
-	    "$$p" "$(DESTDIR)/$(installdir)/$$(basename $$p)"; \
+	@for p in $^ ; do \
+	    echo " install -m755 '$$p' '$(DESTDIR)/$(installdir)'" ; \
+	    install -D -m755 \
+	      -s --strip-program $(top_srcdir)/debian/bin/fix-shebang \
+	      "$$p" "$(DESTDIR)/$(installdir)/$$(basename "$$p")" ; \
 	done
 
 DATA_REAL = $(wildcard $(addprefix $(top_srcdir)/$(OUTDIR)/,$(DATA)))
 
 install-local-data: $(DATA_REAL)
-	@for p in $^; do \
-	  echo " install -m644 '$$p' '$(DESTDIR)/$(installdir)'"; \
-	  install -D -m644 "$$p" "$(DESTDIR)/$(installdir)/$$(basename $$p)"; \
+	@for p in $^ ; do \
+	    echo " install -m644 '$$p' '$(DESTDIR)/$(installdir)'" ; \
+	    install -D -m644 "$$p" "$(DESTDIR)/$(installdir)/$$(basename "$$p")" ; \
 	done
 
diff --git a/debian/rules.d/tools/objtool/Makefile b/debian/rules.d/tools/objtool/Makefile
index 57bd6ba..6b48701 100644
--- a/debian/rules.d/tools/objtool/Makefile
+++ b/debian/rules.d/tools/objtool/Makefile
@@ -11,13 +11,18 @@ objtool.real-%:
 # these on the command line to make cross-builds work.  But it also
 # builds fixdep which still needs to be native in a cross-build.  Set
 # REALHOSTCC and REALHOSTLD variables which will be used for fixdep.
-	$(MAKE) -C $(top_srcdir)/tools/objtool O=$(CURDIR)/$* \
-		HOSTARCH=$(KERNEL_ARCH) ARCH=$* \
-		HOSTCC=$(CC) KBUILD_HOSTCFLAGS='$(CFLAGS) $(CPPFLAGS)' \
-		HOSTLD=$(CROSS_COMPILE)ld KBUILD_HOSTLDFLAGS='$(LDFLAGS)' \
-		HOSTAR=$(CROSS_COMPILE)ar \
-		REALHOSTCC=gcc REALHOSTLD=ld \
-		V=1
+	$(MAKE) -C $(top_srcdir)/tools/objtool \
+	    O=$(CURDIR)/$* \
+	    HOSTARCH=$(KERNEL_ARCH) \
+	    ARCH=$* \
+	    HOSTCC=$(CC) \
+	    KBUILD_HOSTCFLAGS='$(CFLAGS) $(CPPFLAGS)' \
+	    HOSTLD=$(CROSS_COMPILE)ld \
+	    KBUILD_HOSTLDFLAGS='$(LDFLAGS)' \
+	    HOSTAR=$(CROSS_COMPILE)ar \
+	    REALHOSTCC=gcc \
+	    REALHOSTLD=ld \
+	    V=1
 	ln -f $*/objtool $@
 
 %: %.o
diff --git a/debian/rules.d/tools/perf/Makefile b/debian/rules.d/tools/perf/Makefile
index 24d3bd5..6c36936 100644
--- a/debian/rules.d/tools/perf/Makefile
+++ b/debian/rules.d/tools/perf/Makefile
@@ -50,11 +50,11 @@ all:
 	+$(MAKE_PERF) -C $(top_srcdir)/tools/perf -f Makefile.perf all DESTDIR=dummy
 	+$(MAKE_PERF) -C $(top_srcdir)/tools/perf/Documentation man
 # Check that perf didn't get linked against incompatibly-licensed libraries
-	@if readelf -d $(CURDIR)/perf | sed -rne 's/.*NEEDED.*\[(.*)\]/\1/p' | grep -E '\blib(bfd|crypto)'; then \
-		echo; \
-		echo 'perf linked against incompatibly-licensed libraries'; \
-		echo; \
-		exit 1; \
+	@if readelf -d $(CURDIR)/perf | sed -rne 's/.*NEEDED.*\[(.*)\]/\1/p' | grep -E '\blib(bfd|crypto)' ; then \
+	    echo ; \
+	    echo 'perf linked against incompatibly-licensed libraries' ; \
+	    echo ; \
+	    exit 1 ; \
 	fi
 # Check that it links against abi::__cxa_demangle from libstdc++
 	grep __cxa_demangle $(CURDIR)/perf
@@ -70,5 +70,5 @@ install:
 	rm -f $(DESTDIR)/usr/bin/trace
 	mkdir -p $(DESTDIR)/usr/share/bash-completion/
 	mv $(DESTDIR)/etc/bash_completion.d \
-		$(DESTDIR)/usr/share/bash-completion/completions
+	  $(DESTDIR)/usr/share/bash-completion/completions
 	rmdir --ignore-fail-on-non-empty $(DESTDIR)/etc
diff --git a/debian/rules.d/tools/power/cpupower/Makefile b/debian/rules.d/tools/power/cpupower/Makefile
index e24ee1d..635ba0e 100644
--- a/debian/rules.d/tools/power/cpupower/Makefile
+++ b/debian/rules.d/tools/power/cpupower/Makefile
@@ -1,6 +1,6 @@
 include $(top_rulesdir)/Makefile.inc
 
-MAKE_CPUPOWER := CFLAGS='$(CFLAGS) $(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(MAKE) O=$(CURDIR) CPUFREQ_BENCH=false V=true mandir=/usr/share/man
+MAKE_CPUPOWER := CFLAGS='$(CFLAGS) $(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(MAKE) -C $(top_srcdir)/tools/power/cpupower O=$(CURDIR) CPUFREQ_BENCH=false V=true mandir=/usr/share/man
 
 MAKE_CPUPOWER += DEBUG=$(if $(filter noopt,$(DEB_BUILD_OPTIONS)),true,)
 
@@ -12,10 +12,10 @@ MAKE_CPUPOWER += CROSS='$(CROSS_COMPILE)'
 MAKE_CPUPOWER += libdir=/usr/lib/$(DEB_HOST_MULTIARCH)
 
 all:
-	+$(MAKE_CPUPOWER) -C $(top_srcdir)/tools/power/cpupower
+	+$(MAKE_CPUPOWER)
 
 install:
-	+$(MAKE_CPUPOWER) -C $(top_srcdir)/tools/power/cpupower install DESTDIR=$(DESTDIR)
+	+$(MAKE_CPUPOWER) install DESTDIR=$(DESTDIR)
 
 clean:
-	+$(MAKE_CPUPOWER) -C $(top_srcdir)/tools/power/cpupower clean
+	+$(MAKE_CPUPOWER) clean
diff --git a/debian/rules.d/tools/power/x86/intel-speed-select/Makefile b/debian/rules.d/tools/power/x86/intel-speed-select/Makefile
index b507516..b1fab39 100644
--- a/debian/rules.d/tools/power/x86/intel-speed-select/Makefile
+++ b/debian/rules.d/tools/power/x86/intel-speed-select/Makefile
@@ -1,15 +1,15 @@
 include $(top_rulesdir)/Makefile.inc
 
 # Intel Speed Select Tool (ISST)
-MAKE_ISST := CFLAGS='$(CFLAGS) $(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(MAKE) O=$(CURDIR)
+MAKE_ISST := CFLAGS='$(CFLAGS) $(CPPFLAGS)' LDFLAGS='$(LDFLAGS)' $(MAKE) -C $(top_srcdir)/tools/power/x86/intel-speed-select O=$(CURDIR)
 
 MAKE_ISST += bindir=/usr/sbin V=1
 
 all:
-	$(MAKE_ISST) -C $(top_srcdir)/tools/power/x86/intel-speed-select
+	$(MAKE_ISST)
 
 install:
-	$(MAKE_ISST) -C $(top_srcdir)/tools/power/x86/intel-speed-select install DESTDIR=$(DESTDIR)
+	$(MAKE_ISST) install DESTDIR=$(DESTDIR)
 
 clean:
-	$(MAKE_ISST) -C $(top_srcdir)/tools/power/x86/intel-speed-select clean
+	$(MAKE_ISST) clean
diff --git a/debian/rules.d/tools/power/x86/turbostat/Makefile b/debian/rules.d/tools/power/x86/turbostat/Makefile
index 9f5275c..005e14a 100644
--- a/debian/rules.d/tools/power/x86/turbostat/Makefile
+++ b/debian/rules.d/tools/power/x86/turbostat/Makefile
@@ -4,6 +4,9 @@ installdir = /usr/sbin
 
 include $(top_rulesdir)/Makefile.inc
 
-CPPFLAGS += -I"$(top_srcdir)/tools/include" -DMSRHEADER='"$(top_srcdir)/arch/x86/include/asm/msr-index.h"' -DINTEL_FAMILY_HEADER='"$(top_srcdir)/arch/x86/include/asm/intel-family.h"' -DBUILD_BUG_HEADER='"$(top_srcdir)/include/linux/build_bug.h"'
+CPPFLAGS += -I$(top_srcdir)/tools/include
+CPPFLAGS += -DMSRHEADER='"$(top_srcdir)/arch/x86/include/asm/msr-index.h"'
+CPPFLAGS += -DINTEL_FAMILY_HEADER='"$(top_srcdir)/arch/x86/include/asm/intel-family.h"'
+CPPFLAGS += -DBUILD_BUG_HEADER='"$(top_srcdir)/include/linux/build_bug.h"'
 
 LDLIBS += -lcap -lrt
diff --git a/debian/rules.d/tools/power/x86/x86_energy_perf_policy/Makefile b/debian/rules.d/tools/power/x86/x86_energy_perf_policy/Makefile
index b9ec56c..e8f4471 100644
--- a/debian/rules.d/tools/power/x86/x86_energy_perf_policy/Makefile
+++ b/debian/rules.d/tools/power/x86/x86_energy_perf_policy/Makefile
@@ -4,4 +4,5 @@ installdir = /usr/sbin
 
 include $(top_rulesdir)/Makefile.inc
 
-CPPFLAGS += -I"$(top_srcdir)/tools/include" -DMSRHEADER='"$(top_srcdir)/arch/x86/include/asm/msr-index.h"'
+CPPFLAGS += -I$(top_srcdir)/tools/include
+CPPFLAGS += -DMSRHEADER='"$(top_srcdir)/arch/x86/include/asm/msr-index.h"'
diff --git a/debian/rules.d/tools/usb/usbip/Makefile b/debian/rules.d/tools/usb/usbip/Makefile
index 0956e84..ca5689a 100644
--- a/debian/rules.d/tools/usb/usbip/Makefile
+++ b/debian/rules.d/tools/usb/usbip/Makefile
@@ -5,20 +5,22 @@ srcdir := $(top_srcdir)/tools/usb/usbip
 # sub-make command line.
 unexport MAKEFLAGS
 
-all: export CFLAGS := $(shell dpkg-buildflags --get CFLAGS)
-all: export CPPFLAGS := $(shell dpkg-buildflags --get CPPFLAGS) \
-	-isystem $(top_srcdir)/debian/build/build-tools/include
+CPPFLAGS_COMMON := -Wno-error=address-of-packed-member
+
+all: export CFLAGS := $(shell dpkg-buildflags --get CFLAGS) $(CPPFLAGS_COMMON)
+all: export CPPFLAGS := $(shell dpkg-buildflags --get CPPFLAGS) $(CPPFLAGS_COMMON) \
+  -isystem $(top_srcdir)/debian/build/build-tools/include
 all: export LDFLAGS := $(shell dpkg-buildflags --get LDFLAGS)
 all:
 	rsync -a $(srcdir)/ .
 	./autogen.sh
 	./configure \
-		--prefix=/usr \
-		--with-tcp-wrappers \
-		--with-usbids-dir=/usr/share/misc \
-		--disable-shared \
-		--disable-static \
-		--host=$(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
+	  --prefix=/usr \
+	  --with-tcp-wrappers \
+	  --with-usbids-dir=/usr/share/misc \
+	  --disable-shared \
+	  --disable-static \
+	  --host=$(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
 	$(MAKE) V=1
 
 install:
diff --git a/debian/rules.defs b/debian/rules.defs
index e720ef3..6e402a8 100644
--- a/debian/rules.defs
+++ b/debian/rules.defs
@@ -1,2 +1,21 @@
+ifeq (,$(filter --no-print-directory,$(MAKEFLAGS)))
+  MAKEFLAGS +=--no-print-directory
+endif
+
+define flush_vars=
+$(foreach _____v,$(1),$(eval unexport $(_____v)))
+$(foreach _____v,$(1),$(eval override undefine $(_____v)))
+endef
+
+$(call flush_vars, LANGUAGE LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE )
+$(call flush_vars, LC_MONETARY LC_MESSAGES LC_PAPER LC_NAME LC_ADDRESS )
+$(call flush_vars, LC_TELEPHONE LC_MEASUREMENT LC_IDENTIFICATION )
+$(call flush_vars, GREP_OPTIONS POSIXLY_CORRECT )
+
+export LC_ALL :=C.UTF-8
+export LANG   :=C.UTF-8
+
+SHELL :=sh -e
+
 BUILD_DIR = debian/build
 STAMPS_DIR = debian/stamps
diff --git a/debian/rules.real b/debian/rules.real
index 1cb3baa..3a06688 100644
--- a/debian/rules.real
+++ b/debian/rules.real
@@ -8,7 +8,6 @@
 
 include /usr/share/dpkg/default.mk
 
-SHELL  := bash -e
 MAINTAINER := $(shell sed -ne 's,^Maintainer: .[^<]*<\([^>]*\)>,\1,p' debian/control)
 SOURCE_DATE_UTC_ISO := $(shell date -u -d '@$(SOURCE_DATE_EPOCH)' +%Y-%m-%d)
 
@@ -16,7 +15,7 @@ include debian/rules.defs
 
 ifdef ARCH
   ifneq ($(DEB_HOST_ARCH),$(ARCH))
-    $(error Attempting to build a $(ARCH) target but host architecture is $(DEB_HOST_ARCH).  Use dpkg-architecture to override the host architecture)
+    $(error Attempting to build a $(ARCH) target but host architecture is $(DEB_HOST_ARCH). Use dpkg-architecture to override the host architecture)
   endif
 endif
 
@@ -28,26 +27,27 @@ export DEB_HOST_ARCH DEB_HOST_GNU_TYPE DEB_BUILD_ARCH
 export DEB_BUILD_PATH = $(CURDIR)
 export DEB_RULES_REQUIRES_ROOT ?= no
 
-# Set LANG rather than LC_ALL because upstream wants to override
-# specific categories and may undefine LC_ALL.  To ensure that the
-# build environment does not affect our locale, undefine all other
-# locale variables.
-export LANG = C.UTF-8
-$(foreach var,LC_ALL LANGUAGE LC_ADDRESS LC_COLLATE LC_CTYPE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE LC_TIME,$(eval undefine $(var)))
-
 stamp = [ -d $(dir $@) ] || mkdir $(dir $@); touch $@
 
+cleanup_config = sed -E -e '/CONFIG_(BUILD_SALT|MODULE_SIG_(ALL|KEY)|SYSTEM_TRUSTED_KEYS)[ =]/d'
+
 setup_env := env -u ABINAME -u ARCH -u FEATURESET -u FLAVOUR -u VERSION -u LOCALVERSION
 # XXX: All the tools leak flags between host and build all the time, just don't care.  See #1050991.
 setup_env += -u KBUILD_HOSTCFLAGS -u HOSTCFLAGS -u KBUILD_HOSTLDFLAGS
-setup_env += DISTRIBUTION_OFFICIAL_BUILD=1 DISTRIBUTOR="$(DEB_VENDOR)" DISTRIBUTION_VERSION="$(SOURCEVERSION)" KBUILD_BUILD_TIMESTAMP="@$(SOURCE_DATE_EPOCH)" KBUILD_BUILD_VERSION_TIMESTAMP="$(DEB_VENDOR) $(SOURCEVERSION) ($(SOURCE_DATE_UTC_ISO))" KBUILD_BUILD_USER="$(word 1,$(subst @, ,$(MAINTAINER)))" KBUILD_BUILD_HOST="$(word 2,$(subst @, ,$(MAINTAINER)))"
-setup_env += KBUILD_VERBOSE=1
+setup_env += DISTRIBUTION_OFFICIAL_BUILD=1
+setup_env += DISTRIBUTOR="$(DEB_VENDOR)"
+setup_env += DISTRIBUTION_VERSION="$(SOURCEVERSION)"
+setup_env += KBUILD_BUILD_TIMESTAMP="@$(SOURCE_DATE_EPOCH)"
+setup_env += KBUILD_BUILD_VERSION_TIMESTAMP="$(DEB_VENDOR) $(SOURCEVERSION) ($(SOURCE_DATE_UTC_ISO))"
+setup_env += KBUILD_BUILD_USER="$(word 1,$(subst @, ,$(MAINTAINER)))"
+setup_env += KBUILD_BUILD_HOST="$(word 2,$(subst @, ,$(MAINTAINER)))"
+setup_env += KBUILD_VERBOSE=$(if $(filter verbose,$(DEB_BUILD_OPTIONS)),1,0)
 
 MAKE_CLEAN = $(setup_env) $(MAKE) KCFLAGS=-fdebug-prefix-map=$(CURDIR)/= KAFLAGS=-fdebug-prefix-map=$(CURDIR)/=
 MAKE_SELF := $(MAKE) -f debian/rules.real $(MAKEOVERRIDES)
 MAKEOVERRIDES =
 
-BUILDDEB_ARGS := -Zxz $(if $(filter pkg.linux.quick,$(DEB_BUILD_PROFILES)),-z0)
+BUILDDEB_ARGS := -Zxz $(if $(filter pkg.linux.quick,$(DEB_BUILD_PROFILES)),-z1)
 
 ifneq (,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
   THREAD_COUNT = $(subst parallel=,,$(filter parallel=%,$(DEB_BUILD_OPTIONS)))
@@ -83,30 +83,34 @@ $(BUILD_DIR)/$(SOURCE_BASENAME)-source-$(UPSTREAMVERSION).tar.xz: $(STAMPS_DIR)/
 	rm -rf '$@' '$(DIR)'
 	$(call copy_source,$(DIR))
 	chmod -R u+rw,go=rX '$(DIR)'
-	find '$(DIR)' -depth -newermt '@$(SOURCE_DATE_EPOCH)' -print0 | \
-		xargs -0r touch --no-dereference --date='@$(SOURCE_DATE_EPOCH)'
-	cd '$(BUILD_DIR)'; \
-	find '$(SOURCE_BASENAME)-source-$(UPSTREAMVERSION)' \
-		-name '*.pyc' -prune -o \
-		-print0 | \
-		sort -z | \
-		tar --owner=root --group=root --numeric-owner \
-			--no-recursion --null -T - -c | xz -T$(THREAD_COUNT) > '$(SOURCE_BASENAME)-source-$(UPSTREAMVERSION).tar.xz'
+	find $(DIR)/ -name __pycache__ -type d -exec rm -rf {} +
+	find $(DIR)/ -name '*.pyc' -type f -exec rm -f {} +
+	find $(DIR)/ -depth -newermt '@$(SOURCE_DATE_EPOCH)' -print0 \
+	| xargs -0r touch --no-dereference --date='@$(SOURCE_DATE_EPOCH)'
+	n='$(SOURCE_BASENAME)-source-$(UPSTREAMVERSION)' ; \
+	cd $(BUILD_DIR) ; \
+	find $$n/ -print0 | sort -z \
+	| tar --owner=root --group=root --numeric-owner --no-recursion --null -T - -c \
+	| xz -T$(THREAD_COUNT) > $$n.tar.xz
 	rm -rf '$(DIR)'
 
 $(BUILD_DIR)/linux-patch-$(UPSTREAMVERSION)-%.patch.xz: $(STAMPS_DIR)/source_none $(STAMPS_DIR)/source_%
-	set -o pipefail;						\
-	(cd '$(BUILD_DIR)';						\
-	 set +e;							\
-         diff -urN -p -x debian -x .pc -x .git -x '*.pyc' source_none source_$*; \
-	 test $$? -eq 1) |						\
-	filterdiff --remove-timestamps --strip=1 --addoldprefix=a/ --addnewprefix=b/ | \
-	xz -c >$@ ||							\
-	(rm -f $@; exit 1)
+	( \
+	    cd '$(BUILD_DIR)' ; \
+	    set +e ; \
+	    diff -urN -p -x debian -x .pc -x .git -x '*.pyc' source_none source_$* ; \
+	    test $$? -eq 1 ; \
+	) \
+	| filterdiff --remove-timestamps --strip=1 --addoldprefix=a/ --addnewprefix=b/ \
+	| xz -c >$@ \
+	|| (rm -f $@ ; exit 1 ; )
 
 $(STAMPS_DIR)/source:
 	test -d .pc
-	set +e; QUILT_PC=.pc quilt unapplied --quiltrc - >/dev/null && echo 'Patch series not fully applied'; test $$? -eq 1
+	set +e ; \
+	QUILT_PC=.pc quilt unapplied --quiltrc - >/dev/null \
+	  && echo 'Patch series not fully applied' ; \
+	test $$? -eq 1
 	@$(stamp)
 
 $(STAMPS_DIR)/source_%: SOURCE_DIR=$(BUILD_DIR)/source
@@ -115,7 +119,8 @@ $(STAMPS_DIR)/source_%: $(STAMPS_DIR)/source
 	mkdir -p '$(BUILD_DIR)'
 	rm -rf '$(DIR)'
 	$(call copy_source,$(DIR))
-	cd '$(DIR)' && QUILT_PATCHES='$(CURDIR)/debian/patches-$*' QUILT_PC=.pc quilt push --quiltrc - -a -q --fuzz=0
+	cd '$(DIR)' \
+	  && QUILT_PATCHES='$(CURDIR)/debian/patches-$*' QUILT_PC=.pc quilt push --quiltrc - -a -q --fuzz=0
 	@$(stamp)
 .PRECIOUS: $(STAMPS_DIR)/source_%
 
@@ -214,7 +219,7 @@ define dh_binary_post
 	dh_makeshlibs -Xvmlinux -Xvmlinuz
 	dh_shlibdeps $(DH_SHLIBDEPS_ARGS)
 	dh_installdeb
-	if command -v dh_movetousr >/dev/null; then dh_movetousr; fi
+	if command -v dh_movetousr >/dev/null ; then dh_movetousr ; fi
 	dh_gencontrol -- $(GENCONTROL_ARGS)
 	dh_md5sums
 	dh_builddeb -- $(BUILDDEB_ARGS)
@@ -235,19 +240,18 @@ binary_headers-common: DIR = $(DESTDIR)/$(BASE_DIR)
 binary_headers-common: $(STAMPS_DIR)/source_$(FEATURESET)
 	$(dh_binary_pre)
 
-	set -o pipefail; \
-	cd $(SOURCE_DIR); \
+	cd '$(SOURCE_DIR)' ; \
 	( \
-		echo Makefile; \
-		for arch in $(ALL_KERNEL_ARCHES); do \
-			find arch/$$arch -maxdepth 1 -name 'Makefile*' -print; \
-			find arch/$$arch \( -name 'Kbuild.platforms' -o -name 'Platform' \) -print; \
-			find $$(find arch/$$arch \( -name include -o -name scripts \) -type d -print) -print; \
-		done; \
-		find include -print; \
+	    echo Makefile ; \
+	    for arch in $(ALL_KERNEL_ARCHES) ; do \
+	        find "arch/$$arch/" -maxdepth 1 -name 'Makefile*' -print ; \
+	        find "arch/$$arch/" \( -name 'Kbuild.platforms' -o -name 'Platform' \) -print ; \
+	        find $$(find "arch/$$arch/" \( -name include -o -name scripts \) -type d -printf '%p/\n') -print ; \
+	    done ; \
+	    find include -print ; \
 	) \
-	| \
-	cpio -pd --preserve-modification-time '$(DIR)'
+	| sort -uV \
+	| cpio -pd --preserve-modification-time '$(DIR)'
 
 	dh_link /usr/lib/$(PACKAGE_NAME_KBUILD)/scripts $(BASE_DIR)/scripts
 	dh_link /usr/lib/$(PACKAGE_NAME_KBUILD)/tools $(BASE_DIR)/tools
@@ -268,13 +272,18 @@ binary_headers: $(STAMPS_DIR)/build_$(ARCH)_$(FEATURESET)_$(FLAVOUR)
 	$(dh_binary_pre)
 
 	mkdir -p $(DIR)/arch/$(KERNEL_ARCH)/kernel
-	cp -a $(SOURCE_DIR)/{.config,.kernel*,Module.symvers,include} $(DIR)
+	{ \
+	    cd $(SOURCE_DIR) ; \
+	    tar -cf - .config .kernel* Module.symvers include ; \
+	} | tar -C $(DIR) -xf -
 	cp -a $(SOURCE_DIR)/arch/$(KERNEL_ARCH)/include $(DIR)/arch/$(KERNEL_ARCH)
 	find $(DIR) -name '*.cmd' -delete
 
-	if [ -f $(SOURCE_DIR)/arch/$(KERNEL_ARCH)/lib/crtsavres.o ]; then \
-		mkdir $(DIR)/arch/$(KERNEL_ARCH)/lib; \
-		cp -a $(SOURCE_DIR)/arch/$(KERNEL_ARCH)/lib/crtsavres.o $(DIR)/arch/$(KERNEL_ARCH)/lib; \
+	f='$(SOURCE_DIR)/arch/$(KERNEL_ARCH)/lib/crtsavres.o' ; \
+	d='$(DIR)/arch/$(KERNEL_ARCH)/lib' ; \
+	if [ -f "$$f" ] ; then \
+	    mkdir -p "$$d" ; \
+	    cp -a "$$f" "$$d/" ; \
 	fi
 
 	cp -a $(SOURCE_DIR)/scripts/module.lds $(DIR)/arch/$(KERNEL_ARCH)
@@ -294,9 +303,9 @@ $(STAMPS_DIR)/build_libc-dev: DIR=$(BUILD_DIR)/build_libc-dev
 $(STAMPS_DIR)/build_libc-dev:
 	rm -rf '$(DIR)/output'
 	+$(foreach ARCH,$(ALL_LIBCDEV_KERNELARCHES), \
-	   $(MAKE_CLEAN) O='$(CURDIR)/$(DIR)' headers_install ARCH=$(ARCH) INSTALL_HDR_PATH='output/usr'; \
-	   mkdir -p '$(DIR)/output/usr/lib/linux/uapi/$(ARCH)'; \
-	   mv '$(DIR)/output/usr/include/asm' '$(DIR)/output/usr/lib/linux/uapi/$(ARCH)/asm'; )
+	     $(MAKE_CLEAN) O='$(CURDIR)/$(DIR)' headers_install ARCH=$(ARCH) INSTALL_HDR_PATH='output/usr' ; \
+	     mkdir -p '$(DIR)/output/usr/lib/linux/uapi/$(ARCH)' ; \
+	     mv '$(DIR)/output/usr/include/asm' '$(DIR)/output/usr/lib/linux/uapi/$(ARCH)/asm' ; )
 	@$(stamp)
 
 build_libc-dev: $(STAMPS_DIR)/build_libc-dev
@@ -309,9 +318,10 @@ binary_libc-dev: $(STAMPS_DIR)/build_libc-dev
 	dh_install --all --sourcedir $(DIR) usr
 
 # Generate symlink farms for every supported multiarch identifier
-	for spec in $(ALL_LIBCDEV_MULTIARCHES); do \
-		IFS=: read -r MULTIARCH KERNELARCH <<< "$$spec"; \
-		dh_link --all $$(find $(DIR)/usr/lib/linux/uapi/$$KERNELARCH/asm -type f -name '*.h' -printf "usr/lib/linux/uapi/$$KERNELARCH/asm/%P usr/include/$$MULTIARCH/asm/%P\\n");  \
+	for spec in $(ALL_LIBCDEV_MULTIARCHES) ; do \
+	    MULTIARCH=$${spec%%:*} ; \
+	    KERNELARCH=$${spec#*:} ; \
+	    dh_link --all $$(find "$(DIR)/usr/lib/linux/uapi/$$KERNELARCH/asm/" -type f -name '*.h' -printf "usr/lib/linux/uapi/$$KERNELARCH/asm/%P usr/include/$$MULTIARCH/asm/%P\\n") ; \
 	done
 
 	$(dh_binary_post)
@@ -322,11 +332,11 @@ build_bpf-dev: $(STAMPS_DIR)/build_$(ARCH)_$(FEATURESET)_$(FLAVOUR)
 	mkdir -p $(DIR)/tools/bpf/bpftool
 	+$(MAKE_CLEAN) -C '$(SOURCE_DIR)/tools/bpf/bpftool' O=$(CURDIR)/$(DIR)/tools/bpf/bpftool CROSS_COMPILE= FEATURE_TESTS= FEATURE_DISPLAY=
 
-	if grep -q CONFIG_DEBUG_INFO_BTF=y $(DIR)/.config; then \
-		$(DIR)/tools/bpf/bpftool/bpftool btf dump file $(DIR)/vmlinux format c > $(DIR)/vmlinux.h; \
+	if grep -Fxq CONFIG_DEBUG_INFO_BTF=y $(DIR)/.config ; then \
+	    $(DIR)/tools/bpf/bpftool/bpftool btf dump file $(DIR)/vmlinux format c ; \
 	else \
-		echo '#error "Kernel build without CONFIG_DEBUG_INFO_BTF, no type info available"' > $(DIR)/vmlinux.h; \
-	fi
+	    echo '#error "Kernel build without CONFIG_DEBUG_INFO_BTF, no type info available"' ; \
+	fi > $(DIR)/vmlinux.h
 
 binary_bpf-dev: DH_INSTALL_ARGS = --sourcedir=$(BUILD_DIR)/build_$(ARCH)_$(FEATURESET)_$(FLAVOUR)
 binary_bpf-dev: build_bpf-dev
@@ -339,7 +349,7 @@ binary_support: PACKAGE_ROOT = /usr/share/$(PACKAGE_NAME)
 binary_support:
 	$(dh_binary_pre)
 	dh_installdirs $(PACKAGE_ROOT)/lib/python/debian_linux $(PACKAGE_ROOT)/modules
-	cp debian/lib/python/debian_linux/*.py $(DESTDIR)$(PACKAGE_ROOT)/lib/python/debian_linux
+	cp debian/lib/python/debian_linux/*.py $(DESTDIR)$(PACKAGE_ROOT)/lib/python/debian_linux/
 	dh_python3
 	dh_link $(PACKAGE_ROOT) /usr/src/$(PACKAGE_NAME)
 	$(dh_binary_post)
@@ -362,15 +372,15 @@ binary_image:
 ifneq ($(filter arm64 armel armhf mipsel mips64el mipsr6 mipsr6el mips64r6 mips64r6el riscv64,$(ARCH)),)
 	dh_install --sourcedir=$(DIR2) usr
 endif
-	sed '/CONFIG_\(MODULE_SIG_\(ALL\|KEY\)\|SYSTEM_TRUSTED_KEYS\|BUILD_SALT\)[ =]/d' $(DIR)/.config > $(DESTDIR)/boot/config-$(REAL_VERSION)
+	$(cleanup_config) $(DIR)/.config > $(DESTDIR)/boot/config-$(REAL_VERSION)
 	xz -9k < $(DIR)/System.map > $(DESTDIR)/$(SYSTEM_MAP_PATH)
 	echo "ffffffffffffffff B The real System.map is compressed into /$(SYSTEM_MAP_PATH)" > $(DESTDIR)/boot/System.map-$(REAL_VERSION)
-	rm $(DESTDIR)/lib/firmware -rf
+	rm -rf $(DESTDIR)/lib/firmware
 	$(dh_binary_post)
 
 build_source:
 
-binary_source: BUILDDEB_ARGS = -Zxz -z0
+binary_source: BUILDDEB_ARGS = -Zxz -z1
 binary_source: $(BUILD_DIR)/$(SOURCE_BASENAME)-source-$(UPSTREAMVERSION).tar.xz $(foreach FEATURESET,$(filter-out none,$(ALL_FEATURESETS)),$(BUILD_DIR)/linux-patch-$(UPSTREAMVERSION)-$(FEATURESET).patch.xz)
 	$(dh_binary_pre)
 	dh_install $^ /usr/src
@@ -379,25 +389,37 @@ binary_source: $(BUILD_DIR)/$(SOURCE_BASENAME)-source-$(UPSTREAMVERSION).tar.xz
 build_config:
 
 binary_config: TRIPLETS = $(subst $(BUILD_DIR)/build_,,$(wildcard $(BUILD_DIR)/build_$(ARCH)_*_*))
+binary_config: CONFDIR = usr/src/linux-config-$(UPSTREAMVERSION)
 binary_config:
 	$(dh_binary_pre)
-	dh_installdirs /usr/src/linux-config-$(UPSTREAMVERSION)
+	dh_installdirs /$(CONFDIR)
 # Fix the module signing configuration to work for custom kernels.  Also delete
 # CONFIG_BUILD_SALT which makes no sense for custom kernels.
-	for triplet in $(TRIPLETS); do \
-		sed '/CONFIG_\(MODULE_SIG_\(ALL\|KEY\)\|SYSTEM_TRUSTED_KEYS\|BUILD_SALT\)[ =]/d' $(BUILD_DIR)/build_$$triplet/.config | xz -c >debian/$(PACKAGE_NAME)/usr/src/linux-config-$(UPSTREAMVERSION)/config.$$triplet.xz; \
+	for i in $(TRIPLETS) ; do \
+	    $(cleanup_config) $(BUILD_DIR)/build_$$i/.config \
+	    | xz -c > debian/$(PACKAGE_NAME)/$(CONFDIR)/config.$$i.xz ; \
 	done
 	$(dh_binary_post)
 
 define make-tools
-+mkdir -p $(BUILD_DIR)/build-tools/$(1) && $(MAKE_CLEAN) -C $(BUILD_DIR)/build-tools/$(1) -f $(CURDIR)/debian/rules.d/$(1)/Makefile top_srcdir=$(CURDIR) top_rulesdir=$(CURDIR)/debian/rules.d OUTDIR=$(1) VERSION=$(VERSION) KERNEL_ARCH=$(KERNEL_ARCH)
++mkdir -p $(BUILD_DIR)/build-tools/$(1) \
+&& $(MAKE_CLEAN) \
+     -C $(BUILD_DIR)/build-tools/$(1) \
+     -f $(CURDIR)/debian/rules.d/$(1)/Makefile \
+     top_srcdir=$(CURDIR) \
+     top_rulesdir=$(CURDIR)/debian/rules.d \
+     OUTDIR=$(1) \
+     VERSION=$(VERSION) \
+     KERNEL_ARCH=$(KERNEL_ARCH)
 endef
 
 $(STAMPS_DIR)/build-tools-headers:
 	mkdir -p $(BUILD_DIR)/build-tools/headers-tools
-	$(MAKE) ARCH=$(KERNEL_ARCH) O=$(BUILD_DIR)/build-tools/headers-tools \
-		INSTALL_HDR_PATH=$(CURDIR)/$(BUILD_DIR)/build-tools \
-		headers_install
+	$(MAKE) \
+	  ARCH=$(KERNEL_ARCH) \
+	  O=$(BUILD_DIR)/build-tools/headers-tools \
+	  INSTALL_HDR_PATH=$(CURDIR)/$(BUILD_DIR)/build-tools \
+	  headers_install
 	@$(stamp)
 
 build_bpftool: $(STAMPS_DIR)/build-tools-headers
@@ -464,7 +486,7 @@ binary_perf: DH_SHLIBDEPS_ARGS = -Xperf-read-vdso
 binary_perf: build_perf
 	$(dh_binary_pre)
 	$(call make-tools,tools/perf) install
-	# do not ship python2 script
+	: # do not ship python2 script
 	rm -f $(DIR)/usr/lib/perf-core/scripts/python/call-graph-from-sql.py
 	dh_perl /usr/lib/perf-core/scripts/perl/Perf-Trace-Util/lib/
 	dh_python3 /usr/lib/perf-core/scripts/python/Perf-Trace-Util/lib/
@@ -488,11 +510,11 @@ build_hyperv-daemons: $(STAMPS_DIR)/build-tools-headers
 binary_hyperv-daemons: build_hyperv-daemons
 	$(dh_binary_pre)
 	$(call make-tools,tools/hv) install
-	for service in kvp vss; do \
-		dh_installsystemd --name hv-$$service-daemon --no-enable --no-start \
-			|| break; \
-		dh_installinit --name hv-$$service-daemon \
-			|| break; \
+	for i in kvp vss ; do \
+	    dh_installsystemd --name hv-$$i-daemon --no-enable --no-start \
+	      || break ; \
+	    dh_installinit --name hv-$$i-daemon \
+	      || break ; \
 	done
 	$(dh_binary_post)
 
diff --git a/debian/templates/headers.postinst.in b/debian/templates/headers.postinst.in
index c13e6dc..33971f9 100644
--- a/debian/templates/headers.postinst.in
+++ b/debian/templates/headers.postinst.in
@@ -8,9 +8,8 @@ $|=1;
 my $version  = "@abiname@@localversion@";
 
 if (-d "/etc/kernel/header_postinst.d") {
-  system ("run-parts --report --exit-on-error --arg=$version " .
-          "/etc/kernel/header_postinst.d") &&
-            die "Failed to process /etc/kernel/header_postinst.d";
+    system ("run-parts --report --exit-on-error --arg=$version /etc/kernel/header_postinst.d")
+    && die "Failed to process /etc/kernel/header_postinst.d";
 }
 
 exit 0;
diff --git a/debian/templates/image.postinst.in b/debian/templates/image.postinst.in
index 25e7dd6..bbb107e 100644
--- a/debian/templates/image.postinst.in
+++ b/debian/templates/image.postinst.in
@@ -1,25 +1,27 @@
-#!/bin/sh -e
+#!/bin/sh
+set -e
 
-version=@abiname@@localversion@
-image_path=/boot/@image-stem@-$version
+[ "$1" = configure ] || exit 0
 
-if [ "$1" != configure ]; then
-    exit 0
-fi
+version='@abiname@@localversion@'
+image_path="/boot/@image-stem@-${version}"
 
-depmod $version
+depmod "${version}"
 
-if [ -f /lib/modules/$version/.fresh-install ]; then
+if command -v linux-update-symlinks >/dev/null ; then
     change=install
-else
-    change=upgrade
-fi
-linux-update-symlinks $change $version $image_path
-rm -f /lib/modules/$version/.fresh-install
+    [ -f "/lib/modules/${version}/.fresh-install" ] || change=upgrade
 
-if [ -d /etc/kernel/postinst.d ]; then
-    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
-	      --arg=$image_path /etc/kernel/postinst.d
+    linux-update-symlinks "${change}" "${version}" "${image_path}"
+fi
+rm -f "/lib/modules/${version}/.fresh-install"
+
+if [ -d /etc/kernel/postinst.d ] ; then
+    DEB_MAINT_PARAMS="$*" \
+    run-parts --report --exit-on-error \
+      "--arg=${version}" \
+      "--arg=${image_path}" \
+    /etc/kernel/postinst.d
 fi
 
 exit 0
diff --git a/debian/templates/image.postrm.in b/debian/templates/image.postrm.in
index 3fb22e6..5584b56 100644
--- a/debian/templates/image.postrm.in
+++ b/debian/templates/image.postrm.in
@@ -1,31 +1,54 @@
-#!/bin/sh -e
+#!/bin/sh
+set -e
 
-version=@abiname@@localversion@
-image_path=/boot/@image-stem@-$version
+version='@abiname@@localversion@'
+image_path="/boot/@image-stem@-${version}"
 
-rm -f /lib/modules/$version/.fresh-install
+rm -f "/lib/modules/${version}/.fresh-install"
 
-if [ "$1" != upgrade ] && command -v linux-update-symlinks >/dev/null; then
-    linux-update-symlinks remove $version $image_path
+if [ "$1" != upgrade ] && command -v linux-update-symlinks >/dev/null ; then
+    linux-update-symlinks remove "${version}" "${image_path}"
 fi
 
-if [ -d /etc/kernel/postrm.d ]; then
-    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
-	      --arg=$image_path /etc/kernel/postrm.d
+if [ -d /etc/kernel/postrm.d ] ; then
+    DEB_MAINT_PARAMS="$*" \
+    run-parts --report --exit-on-error \
+      "--arg=${version}" \
+      "--arg=${image_path}" \
+    /etc/kernel/postrm.d
 fi
 
 if [ "$1" = purge ]; then
-    for extra_file in modules.dep modules.isapnpmap modules.pcimap \
-                      modules.usbmap modules.parportmap \
-                      modules.generic_string modules.ieee1394map \
-                      modules.ieee1394map modules.pnpbiosmap \
-                      modules.alias modules.ccwmap modules.inputmap \
-                      modules.symbols modules.ofmap \
-                      modules.seriomap modules.\*.bin \
-                      modules.softdep modules.weakdep modules.devname; do
-	eval rm -f /lib/modules/$version/$extra_file
+    for extra_file in \
+     'modules.*.bin' \
+      modules.alias \
+      modules.ccwmap \
+      modules.dep \
+      modules.devname \
+      modules.generic_string \
+      modules.ieee1394map \
+      modules.inputmap \
+      modules.isapnpmap \
+      modules.ofmap \
+      modules.parportmap \
+      modules.pcimap \
+      modules.pnpbiosmap \
+      modules.seriomap \
+      modules.softdep \
+      modules.symbols \
+      modules.usbmap \
+      modules.weakdep \
+    ; do
+        case "${extra_file}" in
+        *\** | *\?* )
+            find "/lib/modules/${version}/" -mindepth 1 -maxdepth 1 -name "${extra_file}" -exec rm -f {} +
+        ;;
+        * )
+            rm -f "/lib/modules/${version}/${extra_file}"
+        ;;
+        esac
     done
-    rmdir /lib/modules/$version || true
+    rmdir "/lib/modules/${version}" || true
 fi
 
 exit 0
diff --git a/debian/templates/image.preinst.in b/debian/templates/image.preinst.in
index 8a5658e..0fc2b71 100644
--- a/debian/templates/image.preinst.in
+++ b/debian/templates/image.preinst.in
@@ -1,21 +1,23 @@
-#!/bin/sh -e
+#!/bin/sh
+set -e
 
-version=@abiname@@localversion@
-image_path=/boot/@image-stem@-$version
+if [ "$1" = abort-upgrade ] ; then exit 0 ; fi
 
-if [ "$1" = abort-upgrade ]; then
-    exit 0
-fi
+version='@abiname@@localversion@'
+image_path="/boot/@image-stem@-${version}"
 
 if [ "$1" = install ]; then
     # Create a flag file for postinst
-    mkdir -p /lib/modules/$version
-    touch /lib/modules/$version/.fresh-install
+    mkdir -p "/lib/modules/${version}"
+    touch "/lib/modules/${version}/.fresh-install"
 fi
 
-if [ -d /etc/kernel/preinst.d ]; then
-    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
-	      --arg=$image_path /etc/kernel/preinst.d
+if [ -d /etc/kernel/preinst.d ] ; then
+    DEB_MAINT_PARAMS="$*" \
+    run-parts --report --exit-on-error \
+      "--arg=${version}" \
+      "--arg=${image_path}" \
+    /etc/kernel/preinst.d
 fi
 
 exit 0
diff --git a/debian/templates/image.prerm.in b/debian/templates/image.prerm.in
index f1bde29..1b9145a 100644
--- a/debian/templates/image.prerm.in
+++ b/debian/templates/image.prerm.in
@@ -1,17 +1,21 @@
-#!/bin/sh -e
+#!/bin/sh
+set -e
 
-version=@abiname@@localversion@
-image_path=/boot/@image-stem@-$version
+[ "$1" = remove ] || exit 0
 
-if [ "$1" != remove ]; then
-    exit 0
+version='@abiname@@localversion@'
+image_path="/boot/@image-stem@-${version}"
+
+if command -v linux-check-removal >/dev/null ; then
+    linux-check-removal "${version}"
 fi
 
-linux-check-removal $version
-
-if [ -d /etc/kernel/prerm.d ]; then
-    DEB_MAINT_PARAMS="$*" run-parts --report --exit-on-error --arg=$version \
-	      --arg=$image_path /etc/kernel/prerm.d
+if [ -d /etc/kernel/prerm.d ] ; then
+    DEB_MAINT_PARAMS="$*" \
+    run-parts --report --exit-on-error \
+      "--arg=${version}" \
+      "--arg=${image_path}" \
+    /etc/kernel/prerm.d
 fi
 
 exit 0