diff --git a/board/common/busybox.config b/board/common/busybox.config
index f70c01fc58..5e4ecca396 100644
--- a/board/common/busybox.config
+++ b/board/common/busybox.config
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.29.2
-# Fri Feb  1 22:19:53 2019
+# Busybox version: 1.29.3
+# Thu Oct 31 23:22:38 2019
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -266,7 +266,7 @@ CONFIG_FEATURE_MD5_SHA1_SUM_CHECK=y
 CONFIG_MKDIR=y
 CONFIG_MKFIFO=y
 CONFIG_MKNOD=y
-# CONFIG_MKTEMP is not set
+CONFIG_MKTEMP=y
 CONFIG_MV=y
 CONFIG_NICE=y
 CONFIG_NL=y
@@ -500,7 +500,7 @@ CONFIG_FEATURE_SHADOWPASSWDS=y
 # CONFIG_USE_BB_PWD_GRP is not set
 # CONFIG_USE_BB_SHADOW is not set
 CONFIG_USE_BB_CRYPT=y
-# CONFIG_USE_BB_CRYPT_SHA is not set
+CONFIG_USE_BB_CRYPT_SHA=y
 # CONFIG_ADDGROUP is not set
 # CONFIG_FEATURE_ADDUSER_TO_GROUP is not set
 # CONFIG_ADD_SHELL is not set
diff --git a/board/common/overlay/etc/crontabs/root b/board/common/overlay/etc/crontabs/root
index b106e1c3a3..b67d28d62d 100644
--- a/board/common/overlay/etc/crontabs/root
+++ b/board/common/overlay/etc/crontabs/root
@@ -1,2 +1,3 @@
 14 3 * * * /usr/sbin/logrotate /etc/logrotate.conf
-
+0 2 * * 0 /usr/sbin/https-update
+*/15 * * * * /usr/sbin/dyndns-update
diff --git a/board/common/overlay/etc/dehydrated/config b/board/common/overlay/etc/dehydrated/config
new file mode 100644
index 0000000000..fa322f8dd2
--- /dev/null
+++ b/board/common/overlay/etc/dehydrated/config
@@ -0,0 +1,6 @@
+BASEDIR="/var/lib/dehydrated"
+DOMAINS_TXT="/data/etc/ssl/domain"
+WELLKNOWN="/tmp/dehydrated"
+HOOK="/usr/libexec/dehydrated-hook"
+CONTACT_EMAIL="$(</data/etc/ssl/email)"
+AUTO_CLEANUP="yes"
diff --git a/board/common/overlay/etc/init.d/S97dyndns b/board/common/overlay/etc/init.d/S97dyndns
new file mode 100755
index 0000000000..4b8e515315
--- /dev/null
+++ b/board/common/overlay/etc/init.d/S97dyndns
@@ -0,0 +1,27 @@
+#!/bin/bash
+
+PROG="/usr/sbin/dyndns-update"
+SCRIPT="/data/etc/dyndns-update.sh"
+
+
+test -s ${SCRIPT} || exit 0
+
+test -n "${OS_VERSION}" || source /etc/init.d/base
+
+case "$1" in
+    start)
+        msg_begin "Updating dynamic DNS"
+        ${PROG} &>/dev/null
+        test $? == 0 && msg_done || msg_fail
+        ;;
+
+    stop)
+        true
+        ;;
+
+    *)
+        echo "Usage: $0 {start}"
+        exit 1
+esac
+
+exit $?
diff --git a/board/common/overlay/etc/ntp.conf b/board/common/overlay/etc/ntp.conf
index 1e0978560e..55e387c0a8 100644
--- a/board/common/overlay/etc/ntp.conf
+++ b/board/common/overlay/etc/ntp.conf
@@ -1,3 +1,5 @@
+tinker panic 0
+
 server 0.pool.ntp.org iburst
 server 1.pool.ntp.org iburst
 server 2.pool.ntp.org iburst
@@ -10,4 +12,3 @@ restrict 127.0.0.1
 restrict ::1
 
 driftfile /var/lib/ntp/ntp.drift
-
diff --git a/board/common/overlay/sbin/fwupdate b/board/common/overlay/sbin/fwupdate
index a1674df615..a5c8afd63e 100755
--- a/board/common/overlay/sbin/fwupdate
+++ b/board/common/overlay/sbin/fwupdate
@@ -60,6 +60,7 @@ EXTRACT_DONE_FILE=${FW_DIR}/extract_done
 FLASH_BOOT_STARTED_FILE=${FW_DIR}/flash_boot_started
 FLASH_BOOT_DONE_FILE=${FW_DIR}/flash_boot_done
 FLASH_REBOOT_STARTED_FILE=${FW_DIR}/flash_reboot_started
+ERROR_FILE=${FW_DIR}/error
 
 TMP_BOOT_DIR=/tmp/fwupdate_boot
 TMP_ROOT_DIR=/tmp/fwupdate_root
@@ -255,6 +256,7 @@ function do_download() {
     rm -f ${FLASH_BOOT_STARTED_FILE}
     rm -f ${FLASH_BOOT_DONE_FILE}
     rm -f ${FLASH_REBOOT_STARTED_FILE}
+    rm -f ${ERROR_FILE}
     touch ${DOWNLOAD_STARTED_FILE}
 
     echo "downloading..."
@@ -288,13 +290,15 @@ function do_download() {
     fi
 
     if [[ -z "${url}" ]]; then
-        echo "no such version" 1>&2
+        echo "no such version" | tee 1>&2 ${ERROR_FILE}
+        rm ${DOWNLOAD_STARTED_FILE}
         exit 1
     fi
 
     free_disk=$(df /data | tail -n 1 | tr -s ' ' | cut -d ' ' -f 4)
     if [[ "${free_disk}" -lt $((MIN_FREE_DISK * 1024)) ]]; then
-        echo "not enough disk space" 1>&2
+        echo "not enough disk space" | tee 1>&2 ${ERROR_FILE}
+        rm ${DOWNLOAD_STARTED_FILE}
         exit 1
     fi
 
@@ -319,7 +323,8 @@ function do_download() {
     wait ${pid}
 
     if [[ "$?" != 0 ]]; then
-        cat ${CURL_LOG_FILE}
+        echo "download failed" | tee 1>&2 ${ERROR_FILE}
+        rm ${DOWNLOAD_STARTED_FILE}
         exit 1
     fi
 
@@ -351,7 +356,7 @@ function run_pre_upgrade() {
                 # non-zero exit status of pre-upgrade script indicates that
                 # the upgrade process must not be continued
 
-                echo "aborted by pre-upgrade script"
+                echo "aborted by pre-upgrade script" | tee 1>&2 ${ERROR_FILE}
                 return 1
             fi
         done
@@ -365,7 +370,7 @@ function run_pre_upgrade() {
 
 function do_extract() {
     if ! [[ -f ${FW_FILE_GZ} || -f ${FW_FILE_XZ} ]] || ! [[ -f ${DOWNLOAD_DONE_FILE} ]]; then
-        echo "firmware file not downloaded" 1>&2
+        echo "firmware file not downloaded" | tee 1>&2 ${ERROR_FILE}
         exit 1
     fi
 
@@ -373,6 +378,7 @@ function do_extract() {
     rm -f ${FLASH_BOOT_STARTED_FILE}
     rm -f ${FLASH_BOOT_DONE_FILE}
     rm -f ${FLASH_REBOOT_STARTED_FILE}
+    rm -f ${ERROR_FILE}
     rm -f ${FW_FILE_EXTR}
     touch ${EXTRACT_STARTED_FILE}
 
@@ -397,7 +403,7 @@ function do_extract() {
         DECOMPRESS_PID_FILE=${GUNZIP_PID_FILE}
         gunzip -k -c ${FW_FILE_GZ} > ${FW_FILE_EXTR} 2>${GUNZIP_LOG_FILE} &
     else
-        echo "firmware compression format ${format} not supported" 1>&2
+        echo "firmware compression format ${format} not supported" 1>&2 | tee 1>&2 ${ERROR_FILE}
         exit 1
     fi
 
@@ -437,12 +443,13 @@ function do_extract() {
 
 function do_flash_boot() {
     if ! [[ -f ${FW_FILE_EXTR} ]] || ! [[ -f ${EXTRACT_DONE_FILE} ]]; then
-        echo "extracted firmware not present"
+        echo "extracted firmware not present" | tee 1>&2 ${ERROR_FILE}
         return 1
     fi
 
     rm -f ${FLASH_BOOT_DONE_FILE}
     rm -f ${FLASH_REBOOT_STARTED_FILE}
+    rm -f ${ERROR_FILE}
     touch ${FLASH_BOOT_STARTED_FILE}
 
     echo "flashing boot..."
@@ -487,10 +494,11 @@ function do_flash_boot() {
 
 function do_flash_reboot() {
     if ! [[ -f ${ROOT_INFO_FILE} ]] || ! [[ -f ${FLASH_BOOT_DONE_FILE} ]]; then
-        echo "root partition info file not present"
+        echo "root partition info file not present" | tee 1>&2 ${ERROR_FILE}
         return 1
     fi
 
+    rm -f ${ERROR_FILE}
     touch ${FLASH_REBOOT_STARTED_FILE}
 
     echo "preparing for reboot..."
@@ -525,7 +533,10 @@ function show_status() {
         new_version=$(cat ${VER_FILE})
     fi
 
-    if [[ -f ${FLASH_REBOOT_STARTED_FILE} ]]; then
+    if [[ -f ${ERROR_FILE} ]]; then
+        echo -n "error: "
+        cat ${ERROR_FILE}
+    elif [[ -f ${FLASH_REBOOT_STARTED_FILE} ]]; then
         echo "rebooting [${new_version}]"
     elif [[ -f ${FLASH_BOOT_DONE_FILE} ]]; then
         echo "boot flashed [${new_version}]"
diff --git a/board/common/overlay/usr/libexec/dehydrated-dumb-httpd b/board/common/overlay/usr/libexec/dehydrated-dumb-httpd
new file mode 100755
index 0000000000..25ad5b9432
--- /dev/null
+++ b/board/common/overlay/usr/libexec/dehydrated-dumb-httpd
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+CHALLENGE="$1"
+PORT=80
+LIFETIME=10
+TMP_RESPONSE="/tmp/dehydrated-response"
+LOG="/var/log/dehydrated-dumb-httpd.log"
+
+if [[ -z "${CHALLENGE}" ]]; then
+    echo "Usage $0 <challenge>"
+    exit 1
+fi
+
+{
+    echo -en "HTTP/1.1 200 OK\r\n"
+    echo -en "Content-Length: ${#CHALLENGE}\r\n"
+    echo -en "Content-Type: text/plain\r\n"
+    echo -en "Connection: close\r\n\r\n${CHALLENGE}"
+} > "${TMP_RESPONSE}"
+
+echo "Dumb httpd started" > ${LOG}
+socat -d TCP4-LISTEN:80,reuseaddr,fork EXEC:"/bin/cat ${TMP_RESPONSE}" &>>${LOG} &
+pid=$!
+sleep ${LIFETIME}
+kill ${pid}
+echo "Dumb httpd exit" >> ${LOG}
diff --git a/board/common/overlay/usr/libexec/dehydrated-hook b/board/common/overlay/usr/libexec/dehydrated-hook
new file mode 100755
index 0000000000..020150f294
--- /dev/null
+++ b/board/common/overlay/usr/libexec/dehydrated-hook
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+SSL_DIR="/data/etc/ssl"
+CERT_FILE="${SSL_DIR}/cert.pem"
+KEY_FILE="${SSL_DIR}/privkey.pem"
+
+if [[ "$1" == "deploy_challenge" ]]; then
+    /usr/libexec/dehydrated-dumb-httpd "$4" &
+elif [[ "$1" == "deploy_cert" ]]; then
+    logger -t dehydrated "deploying certificate & rebooting"
+    mkdir -p "${SSL_DIR}"
+    cp "$3" "${KEY_FILE}"
+    cp "$4" "${CERT_FILE}"
+    reboot
+fi
diff --git a/board/common/overlay/usr/libexec/list-versions-s3 b/board/common/overlay/usr/libexec/list-versions-s3
index 359c07067d..b8801359e5 100755
--- a/board/common/overlay/usr/libexec/list-versions-s3
+++ b/board/common/overlay/usr/libexec/list-versions-s3
@@ -24,12 +24,9 @@ files=(${keys})
 
 i=0
 for file in ${files[*]}; do
-    version=$(echo ${file:${#path} + 1} | cut -d '/' -f 1)
-    fname=$(basename ${file})
-    i=$((i + 1))
-    if [[ -z "${fname}" ]]; then
-        continue
-    fi
+    [[ "${file}" =~ ^${path}/(.+)/(.+)$ ]] || continue
+    version="${BASH_REMATCH[1]}"
+    fname="${BASH_REMATCH[2]}"
 
     prerelease=false
     if [[ "${version}" =~ ^.*[abc]\.?[0-9]+$ ]] || # e.g. 0.4.1b2, 0.4.1b.2, 0.4.1-b.2
@@ -38,9 +35,11 @@ for file in ${files[*]}; do
         prerelease=true
     fi
 
-    final_url=${url}/${path}/${version}/${fname}
-    board=$(echo ${fname} | cut -d '-' -f 2)
-    date=$(echo ${dates[${i}]} | cut -d 'T' -f 1)
-    
+    [[ "${fname}" =~ ^([^-]+)-([^-]+)-(.+)$ ]] || continue
+    board="${BASH_REMATCH[2]}"
+    final_url="${url}/${path}/${version}/${fname}"
+    date="${dates[${i}]:0:10}"
+
     echo "${version}|${prerelease}|${board}|${final_url}|${date}"
-done | sort -t '|' -k 5,3 -r
+    i=$((i + 1))
+done | semver-sort -r -t '|' -k 1
diff --git a/board/common/overlay/usr/sbin/dehydrated-wrapper b/board/common/overlay/usr/sbin/dehydrated-wrapper
new file mode 100755
index 0000000000..531cc23772
--- /dev/null
+++ b/board/common/overlay/usr/sbin/dehydrated-wrapper
@@ -0,0 +1,16 @@
+#!/bin/bash
+
+PROG="/usr/bin/dehydrated"
+BASE_DIR="/var/lib/dehydrated"
+TMP_DIR="/tmp/dehydrated"
+SSL_DIR="/data/etc/ssl"
+
+if ! [[ -x "${PROG}" && -r "${SSL_DIR}/domain" && -r "${SSL_DIR}/email" ]]; then
+    exit 0  # not installed or not configured
+fi
+
+mkdir -p "${BASE_DIR}"
+mkdir -p "${TMP_DIR}"
+
+logger -t dehydrated "checking for certificate renewal"
+dehydrated "$@"
diff --git a/board/common/overlay/usr/sbin/dyndns-update b/board/common/overlay/usr/sbin/dyndns-update
new file mode 100755
index 0000000000..dde7a7e8b7
--- /dev/null
+++ b/board/common/overlay/usr/sbin/dyndns-update
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+SCRIPT="/data/etc/dyndns-update.sh"
+
+if ! [[ -f "${SCRIPT}" ]]; then
+    exit 0
+fi
+
+logger -t dyndns "updating dynamic DNS"
+bash "${SCRIPT}" 2>&1 | logger -t dyndns
+exit ${PIPESTATUS[0]}
diff --git a/board/common/overlay/usr/sbin/https-update b/board/common/overlay/usr/sbin/https-update
new file mode 100755
index 0000000000..8c1ac1ddaf
--- /dev/null
+++ b/board/common/overlay/usr/sbin/https-update
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+PROG="/usr/sbin/dehydrated-wrapper"
+SSL_DIR="/data/etc/ssl"
+
+if ! [[ -d "${SSL_DIR}" ]]; then
+    exit 0
+fi
+
+logger -t dehydrated "updating SSL certificates"
+${PROG} -c 2>&1 | logger -t dehydrated
+exit ${PIPESTATUS[0]}
diff --git a/build.sh b/build.sh
index a63b327624..bf3c3c15a9 100755
--- a/build.sh
+++ b/build.sh
@@ -15,32 +15,32 @@ set -e # exit at first error
 
 board=$1
 target=${*:2}
-cd $(dirname $0)
+cd "$(dirname "$0")"
 basedir=$(pwd)
 gzip=$(which pigz 2> /dev/null || which gzip 2> /dev/null)
 
 # extra environment from local file
-test -f $basedir/.build-env && source $basedir/.build-env
+test -f "$basedir/.build-env" && source "$basedir/.build-env"
 
 # OS name
 if [ -n "$THINGOS_SHORT_NAME" ]; then
     osname=$THINGOS_SHORT_NAME
 else
-    osname=$(source $basedir/board/common/overlay/etc/version && echo $OS_SHORT_NAME)
+    osname=$(source "$basedir/board/common/overlay/etc/version" && echo "$OS_SHORT_NAME")
 fi
 
 # OS version
 if [ -n "$THINGOS_VERSION" ]; then
     osversion=$THINGOS_VERSION
 else
-    osversion=$(source $basedir/board/common/overlay/etc/version && echo $OS_VERSION)
+    osversion=$(source "$basedir/board/common/overlay/etc/version" && echo "$OS_VERSION")
 fi
 
 # when the special "boards" keyword is used for board, simply list all known boards
 if [ "$board" == "boards" ]; then
-    boards=$(ls $basedir/configs/*_defconfig | grep -v initramfs | grep -oE '\w+_defconfig$' | cut -d '_' -f 1)
+    boards=$(ls "$basedir"/configs/*_defconfig | grep -v initramfs | grep -oE '\w+_defconfig$' | cut -d '_' -f 1)
     for b in $boards; do
-        echo $b
+        echo "$b"
     done
 
     exit 0
@@ -48,9 +48,9 @@ fi
 
 # when the special "all" keyword is used for board, all boards are processed, in turn
 if [ "$board" == "all" ]; then
-    boards=$(ls $basedir/configs/*_defconfig | grep -v initramfs | grep -oE '\w+_defconfig$' | cut -d '_' -f 1)
+    boards=$(ls "$basedir"/configs/*_defconfig | grep -v initramfs | grep -oE '\w+_defconfig$' | cut -d '_' -f 1)
     for b in $boards; do
-        if ! $0 $b $target; then
+        if ! $0 "$b" "$target"; then
             exit 1
         fi
     done
@@ -61,96 +61,96 @@ fi
 outputdir=$basedir/output/$board
 boarddir=$basedir/board/$board
 
-if ! [ -f $basedir/configs/${board}_defconfig ]; then
+if ! [ -f "$basedir/configs/${board}_defconfig" ]; then
     echo "unknown board: $board"
     exit 1
 fi
 
 function prepare_target_dir() {
-    if [ -L $outputdir/target/var/lib ]; then
-        rm $outputdir/target/var/lib
-        mkdir $outputdir/target/var/lib
+    if [ -L "$outputdir/target/var/lib" ]; then
+        rm "$outputdir/target/var/lib"
+        mkdir "$outputdir/target/var/lib"
     fi
 }
 
-mkdir -p $outputdir
+mkdir -p "$outputdir"
 
-if ! [ -f $outputdir/.config ]; then
-    make O=$outputdir ${board}_defconfig
+if ! [ -f "$outputdir/.config" ]; then
+    make O="$outputdir" "${board}_defconfig"
 fi
 
 if [ "$target" == "mkimage" ]; then
-    $boarddir/mkimage.sh
+    "$boarddir/mkimage.sh"
 
 elif [ "$target" == "mkrelease" ]; then
-    test -f $outputdir/images/$osname-$board.img || $boarddir/mkimage.sh
-    cp $outputdir/images/$osname-$board.img $outputdir/images/$osname-$board-$osversion.img
+    test -f "$outputdir/images/$osname-$board.img" || "$boarddir/mkimage.sh"
+    cp "$outputdir/images/$osname-$board.img" "$outputdir/images/$osname-$board-$osversion.img"
     
     echo "preparing compressed xz image"
-    rm -f $outputdir/images/$osname-$board-$osversion.img.xz
-    xz -6ek -T 0 $outputdir/images/$osname-$board-$osversion.img
+    rm -f "$outputdir/images/$osname-$board-$osversion.img.xz"
+    xz -6ek -T 0 "$outputdir/images/$osname-$board-$osversion.img"
     echo "your xz image is ready at $outputdir/images/$osname-$board-$osversion.img.xz"
     
     echo "preparing compressed gz image"
-    rm -f $outputdir/images/$osname-$board-$osversion.img.gz
-    $gzip $outputdir/images/$osname-$board-$osversion.img
+    rm -f "$outputdir/images/$osname-$board-$osversion.img.gz"
+    $gzip "$outputdir/images/$osname-$board-$osversion.img"
     echo "your gz image is ready at $outputdir/images/$osname-$board-$osversion.img.gz"
     
-    rm -f $outputdir/images/$osname-$board-$osversion.img
+    rm -f "$outputdir/images/$osname-$board-$osversion.img"
 
 elif [ "$target" == "clean-target" ]; then
-    if [ -d $outputdir/target ]; then
+    if [ -d "$outputdir/target" ]; then
         echo "removing target directory"
-        rm -rf $outputdir/target/*
+        rm -rf "$outputdir/target/"*
 
         echo "removing staging directory"
-        rm -rf $outputdir/staging/*
+        rm -rf "$outputdir/staging/"*
 
         echo "removing images directory"
-        rm -rf $outputdir/images/*
+        rm -rf "$outputdir/images/"*
     fi
 
-    if [ -d $outputdir/build ]; then
+    if [ -d "$outputdir/build" ]; then
         echo "removing .stamp_target_installed files"
-        find $outputdir/build -name .stamp_target_installed | xargs -r rm
+        find "$outputdir/build" -name .stamp_target_installed -print0 | xargs -0 -r rm
 
         echo "removing .stamp_staging_installed files"
-        find $outputdir/build -name .stamp_staging_installed | xargs -r rm
+        find "$outputdir/build" -name .stamp_staging_installed -print0 | xargs -0 -r rm
 
         echo "removing .stamp_host_installed files"
-        find $outputdir/build -name .stamp_host_installed | xargs -r rm
+        find "$outputdir/build" -name .stamp_host_installed -print0 | xargs -0 -r rm
 
         echo "removing .stamp_images_installed files"
-        find $outputdir/build -name .stamp_images_installed | xargs -r rm
+        find "$outputdir/build" -name .stamp_images_installed -print0 | xargs -0 -r rm
 
         echo "removing linux kernel build dir"
-        make O=$outputdir linux-dirclean
+        make O="$outputdir" linux-dirclean
     fi
 
-    if [ -f $outputdir/.config ]; then
+    if [ -f "$outputdir/.config" ]; then
         echo "removing .config file"
-        rm -f $outputdir/.config
+        rm -f "$outputdir/.config"
     fi
 
     echo "target is clean"
 
 elif [[ "$target" == initramfs* ]]; then
     extra_args=${target:10}
-    $0 ${board}_initramfs $extra_args
-    if [ -z "$extra_args" ] && [ -x $boarddir/cpinitramfs.sh ]; then
-        IMG_DIR=$basedir/output/${board}_initramfs/images/ BOARD_DIR=$boarddir $boarddir/cpinitramfs.sh
+    $0 "${board}_initramfs" "$extra_args"
+    if [ -z "$extra_args" ] && [ -x "$boarddir/cpinitramfs.sh" ]; then
+        IMG_DIR=$basedir/output/${board}_initramfs/images/ BOARD_DIR=$boarddir "$boarddir/cpinitramfs.sh"
     fi
 
 elif [ "$target" == "all" ]; then
     prepare_target_dir
-    make O=$outputdir all
+    make O="$outputdir" all
 
 elif [ -n "$target" ]; then
     prepare_target_dir
-    make O=$outputdir $target
+    make O="$outputdir" "$target"
 
 else  # if [ -z "$target ]
-    $0 $board all
+    $0 "$board" all
     echo "build successful"
 fi
 
diff --git a/configs/bananapim1_defconfig b/configs/bananapim1_defconfig
index 32b160d41e..512d93ed6c 100644
--- a/configs/bananapim1_defconfig
+++ b/configs/bananapim1_defconfig
@@ -79,6 +79,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/nanopineo2_defconfig b/configs/nanopineo2_defconfig
index 14a4a70a35..b4109948b0 100644
--- a/configs/nanopineo2_defconfig
+++ b/configs/nanopineo2_defconfig
@@ -71,6 +71,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/nanopineo_defconfig b/configs/nanopineo_defconfig
index 6490a3cef7..df1d3f8a93 100644
--- a/configs/nanopineo_defconfig
+++ b/configs/nanopineo_defconfig
@@ -71,6 +71,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/odroidc1_defconfig b/configs/odroidc1_defconfig
index 743356103b..9e66e280f3 100644
--- a/configs/odroidc1_defconfig
+++ b/configs/odroidc1_defconfig
@@ -82,6 +82,7 @@ BR2_PACKAGE_LIBCURL=y
 BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/odroidc2_defconfig b/configs/odroidc2_defconfig
index 3fffccdf39..eb6344d666 100644
--- a/configs/odroidc2_defconfig
+++ b/configs/odroidc2_defconfig
@@ -71,6 +71,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/odroidxu4_defconfig b/configs/odroidxu4_defconfig
index 9cf04c0b4f..912e453016 100644
--- a/configs/odroidxu4_defconfig
+++ b/configs/odroidxu4_defconfig
@@ -74,6 +74,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/orangepione_defconfig b/configs/orangepione_defconfig
index 9066bb1e37..1ddaae8237 100644
--- a/configs/orangepione_defconfig
+++ b/configs/orangepione_defconfig
@@ -74,6 +74,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/orangepizero_defconfig b/configs/orangepizero_defconfig
index f169592add..db934039c9 100644
--- a/configs/orangepizero_defconfig
+++ b/configs/orangepizero_defconfig
@@ -74,6 +74,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/pine64_defconfig b/configs/pine64_defconfig
index 67d391f4f1..04e82b9643 100644
--- a/configs/pine64_defconfig
+++ b/configs/pine64_defconfig
@@ -70,6 +70,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/raspberrypi2_defconfig b/configs/raspberrypi2_defconfig
index 5cde2faa8f..382c165396 100644
--- a/configs/raspberrypi2_defconfig
+++ b/configs/raspberrypi2_defconfig
@@ -12,7 +12,7 @@ BR2_ROOTFS_OVERLAY="board/common/overlay board/raspberrypi2/overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/common/postscript.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/6d8bf28fa4b1ca0a35c0cd1dcb267fb216daf720.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3c235dcfe80a7c7ba360219e4a3ecb256f294376.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="bcm2709-rpi-2-b"
@@ -84,6 +84,7 @@ BR2_PACKAGE_X265=y
 BR2_PACKAGE_LIBCURL=y
 BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/raspberrypi3_defconfig b/configs/raspberrypi3_defconfig
index 9bd7487d34..ac94accf14 100644
--- a/configs/raspberrypi3_defconfig
+++ b/configs/raspberrypi3_defconfig
@@ -12,7 +12,7 @@ BR2_ROOTFS_OVERLAY="board/common/overlay board/raspberrypi3/overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/common/postscript.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/6d8bf28fa4b1ca0a35c0cd1dcb267fb216daf720.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3c235dcfe80a7c7ba360219e4a3ecb256f294376.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="bcm2710-rpi-3-b bcm2710-rpi-3-b-plus bcm2710-rpi-cm3"
@@ -84,6 +84,7 @@ BR2_PACKAGE_X265=y
 BR2_PACKAGE_LIBCURL=y
 BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/raspberrypi4_defconfig b/configs/raspberrypi4_defconfig
index bdc4d49386..dbe2cd8bca 100644
--- a/configs/raspberrypi4_defconfig
+++ b/configs/raspberrypi4_defconfig
@@ -12,7 +12,7 @@ BR2_ROOTFS_OVERLAY="board/common/overlay board/raspberrypi4/overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/common/postscript.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/6d8bf28fa4b1ca0a35c0cd1dcb267fb216daf720.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3c235dcfe80a7c7ba360219e4a3ecb256f294376.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcm2711"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="bcm2711-rpi-4-b"
@@ -85,6 +85,7 @@ BR2_PACKAGE_X265=y
 BR2_PACKAGE_LIBCURL=y
 BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/raspberrypi_defconfig b/configs/raspberrypi_defconfig
index c61eb3ee67..e25ec42695 100644
--- a/configs/raspberrypi_defconfig
+++ b/configs/raspberrypi_defconfig
@@ -19,7 +19,7 @@ BR2_ROOTFS_OVERLAY="board/common/overlay board/raspberrypi/overlay"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/common/postscript.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/6d8bf28fa4b1ca0a35c0cd1dcb267fb216daf720.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="https://github.com/raspberrypi/linux/archive/3c235dcfe80a7c7ba360219e4a3ecb256f294376.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bcmrpi"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="bcm2708-rpi-zero-w bcm2708-rpi-b bcm2708-rpi-b-plus bcm2708-rpi-cm"
@@ -91,6 +91,7 @@ BR2_PACKAGE_X265=y
 BR2_PACKAGE_LIBCURL=y
 BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/configs/tinkerboard_defconfig b/configs/tinkerboard_defconfig
index 96d7c4261a..a37292044d 100644
--- a/configs/tinkerboard_defconfig
+++ b/configs/tinkerboard_defconfig
@@ -74,6 +74,7 @@ BR2_PACKAGE_CURL=y
 BR2_PACKAGE_LIBCAP=y
 BR2_PACKAGE_PCRE=y
 BR2_PACKAGE_PCRE_UCP=y
+BR2_PACKAGE_SEMVER_SORT=y
 BR2_PACKAGE_AUTOSSH=y
 BR2_PACKAGE_CRDA=y
 BR2_PACKAGE_DHCP=y
diff --git a/package/Config.in b/package/Config.in
index f438f95599..948ad4d0cb 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -918,6 +918,7 @@ menu "External python modules"
 	source "package/python-jaraco-classes/Config.in"
 	source "package/python-jinja2/Config.in"
 	source "package/python-jsonmodels/Config.in"
+	source "package/python-jsonpointer/Config.in"
 	source "package/python-jsonschema/Config.in"
 	source "package/python-json-schema-validator/Config.in"
 	source "package/python-keyring/Config.in"
@@ -1822,6 +1823,7 @@ menu "Miscellaneous"
 	source "package/proj/Config.in"
 	source "package/qemu/Config.in"
 	source "package/qpdf/Config.in"
+	source "package/semver-sort/Config.in"
 	source "package/shared-mime-info/Config.in"
 	source "package/taskd/Config.in"
 	source "package/wine/Config.in"
diff --git a/package/dehydrated/dehydrated.hash b/package/dehydrated/dehydrated.hash
index 1d194e5a7d..388dd24749 100644
--- a/package/dehydrated/dehydrated.hash
+++ b/package/dehydrated/dehydrated.hash
@@ -1,6 +1,6 @@
 # Locally computed after verifying
-# https://github.com/lukas2511/dehydrated/releases/download/v0.6.2/dehydrated-0.6.2.tar.gz.asc
+# https://github.com/lukas2511/dehydrated/releases/download/v0.6.5/dehydrated-0.6.5.tar.gz.asc
 # with key 3C2F2605E078A1E18F4793909C4DBE6CF438F333 from https://keybase.io/lukas2511
-sha256  163384479199f06f59382ceb6291a299567a2f4f0b963b9b61f2db65a407e80e  dehydrated-0.6.2.tar.gz
+sha256  10aabd0027450bc70a18e49acaca7a9697e0cfb92368d3e508b7a4d6d69bfa35 dehydrated-0.6.5.tar.gz
 # License, locally computed
 sha256  b4583b7dd07e3e2a08906de38e7e329d41f921ed9dcb6310b3886e013a6b8723  LICENSE
diff --git a/package/dehydrated/dehydrated.mk b/package/dehydrated/dehydrated.mk
index b7de27a407..17c67b8478 100644
--- a/package/dehydrated/dehydrated.mk
+++ b/package/dehydrated/dehydrated.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DEHYDRATED_VERSION = 0.6.2
+DEHYDRATED_VERSION = 0.6.5
 DEHYDRATED_SITE = https://github.com/lukas2511/dehydrated/releases/download/v$(DEHYDRATED_VERSION)
 
 DEHYDRATED_LICENSE = MIT
diff --git a/package/python-jsonpointer/Config.in b/package/python-jsonpointer/Config.in
new file mode 100644
index 0000000000..0895f7e032
--- /dev/null
+++ b/package/python-jsonpointer/Config.in
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_PYTHON_JSONPOINTER
+	bool "python-jsonpointer"
+	depends on BR2_PACKAGE_PYTHON3
+	help
+	  Resolve JSON Pointers in Python.
+
+	  https://github.com/stefankoegl/python-json-pointer
diff --git a/package/python-jsonpointer/python-jsonpointer.hash b/package/python-jsonpointer/python-jsonpointer.hash
new file mode 100644
index 0000000000..b84e0cce71
--- /dev/null
+++ b/package/python-jsonpointer/python-jsonpointer.hash
@@ -0,0 +1 @@
+sha256	c192ba86648e05fdae4f08a17ec25180a9aef5008d973407b581798a83975362  jsonpointer-2.0.tar.gz
diff --git a/package/python-jsonpointer/python-jsonpointer.mk b/package/python-jsonpointer/python-jsonpointer.mk
new file mode 100644
index 0000000000..6e22ec29f7
--- /dev/null
+++ b/package/python-jsonpointer/python-jsonpointer.mk
@@ -0,0 +1,14 @@
+################################################################################
+#
+# python-jsonpointer
+#
+################################################################################
+
+PYTHON_JSONPOINTER_VERSION = 2.0
+PYTHON_JSONPOINTER_SOURCE = jsonpointer-$(PYTHON_JSONPOINTER_VERSION).tar.gz
+PYTHON_JSONPOINTER_SITE = https://files.pythonhosted.org/packages/52/e7/246d9ef2366d430f0ce7bdc494ea2df8b49d7a2a41ba51f5655f68cfe85f
+PYTHON_JSONPOINTER_SETUP_TYPE = setuptools
+PYTHON_JSONPOINTER_LICENSE = BSD
+PYTHON_JSONPOINTER_LICENSE_FILES = LICENSE.txt
+
+$(eval $(python-package))
diff --git a/package/rpi-firmware/rpi-firmware.hash b/package/rpi-firmware/rpi-firmware.hash
index 713f912eb8..cd9ba14fc9 100644
--- a/package/rpi-firmware/rpi-firmware.hash
+++ b/package/rpi-firmware/rpi-firmware.hash
@@ -1 +1 @@
-sha256 eec0287caa24b42d5460ed7c555e6871096ee7cfddd1582bf864930740095de1  rpi-firmware-01508e81ec1e918448227ca864616d56c430b46d.tar.gz
+sha256 92ac14e7af3ac0f30271c9de903ee237f9f77e31583000281324cb1d8100ae95  rpi-firmware-878d27e23ff2f1c9a35d1b1fc8fe71e06083b823.tar.gz
diff --git a/package/rpi-firmware/rpi-firmware.mk b/package/rpi-firmware/rpi-firmware.mk
index ddb977676d..6d71b2e9b1 100644
--- a/package/rpi-firmware/rpi-firmware.mk
+++ b/package/rpi-firmware/rpi-firmware.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-RPI_FIRMWARE_VERSION = 01508e81ec1e918448227ca864616d56c430b46d
+RPI_FIRMWARE_VERSION = 878d27e23ff2f1c9a35d1b1fc8fe71e06083b823
 RPI_FIRMWARE_SITE = $(call github,raspberrypi,firmware,$(RPI_FIRMWARE_VERSION))
 RPI_FIRMWARE_LICENSE = BSD-3-Clause
 RPI_FIRMWARE_LICENSE_FILES = boot/LICENCE.broadcom
diff --git a/package/rpi-userland/rpi-userland.hash b/package/rpi-userland/rpi-userland.hash
index 6dd8e1fa94..b05c71a48b 100644
--- a/package/rpi-userland/rpi-userland.hash
+++ b/package/rpi-userland/rpi-userland.hash
@@ -1 +1 @@
-sha256 f0909d5fcdc53b9227e307b858ed695dcaa6dce7f90acee0de3cb9add4f8ad12 rpi-userland-2f85f2db007fb7b15ed1b485f42eae4cc6bc2bf4.tar.gz
+sha256 3d31967d87c6d825ee73d1a5b8f39a53f2a006f7ff2903d7f628503248e62897 rpi-userland-13b33c8ee52521ac3c804ffa6d8e8b8a8cd30697.tar.gz
diff --git a/package/rpi-userland/rpi-userland.mk b/package/rpi-userland/rpi-userland.mk
index df32acb790..d53280bc27 100644
--- a/package/rpi-userland/rpi-userland.mk
+++ b/package/rpi-userland/rpi-userland.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-RPI_USERLAND_VERSION = 2f85f2db007fb7b15ed1b485f42eae4cc6bc2bf4
+RPI_USERLAND_VERSION = 13b33c8ee52521ac3c804ffa6d8e8b8a8cd30697
 RPI_USERLAND_SITE = $(call github,raspberrypi,userland,$(RPI_USERLAND_VERSION))
 RPI_USERLAND_LICENSE = BSD-3-Clause
 RPI_USERLAND_LICENSE_FILES = LICENCE
diff --git a/package/semver-sort/Config.in b/package/semver-sort/Config.in
new file mode 100644
index 0000000000..1e0c85000c
--- /dev/null
+++ b/package/semver-sort/Config.in
@@ -0,0 +1,2 @@
+config BR2_PACKAGE_SEMVER_SORT
+	bool "semver-sort"
diff --git a/package/semver-sort/semver-sort.mk b/package/semver-sort/semver-sort.mk
new file mode 100644
index 0000000000..e96df2eec5
--- /dev/null
+++ b/package/semver-sort/semver-sort.mk
@@ -0,0 +1,19 @@
+################################################################################
+#
+# semver-sort
+#
+################################################################################
+
+SEMVER_SORT_VERSION = a4de79b7691945e1db9b21ffc5b39b751477dc4e
+SEMVER_SORT_SITE = $(call github,ccrisan,semver-sort,$(SEMVER_SORT_VERSION))
+SEMVER_SORT_LICENSE = MIT
+
+define SEMVER_SORT_BUILD_CMDS
+    make CC="$(TARGET_CC)" -C "$(@D)" semver-sort
+endef
+
+define SEMVER_SORT_INSTALL_TARGET_CMDS
+    cp $(@D)/semver-sort $(TARGET_DIR)/usr/bin/
+endef
+
+$(eval $(generic-package))
diff --git a/writeimage.sh b/writeimage.sh
index 665df07481..6531da7d40 100755
--- a/writeimage.sh
+++ b/writeimage.sh
@@ -2,14 +2,16 @@
 
 
 function usage() {
-    echo "Usage: $0 [options...]"
-    echo ""
-    echo "Available options:"
-    echo "    <-i image_file> - indicates the path to the image file (e.g. -i /home/user/Download/file.img.gz)"
-    echo "    <-d sdcard_dev> - indicates the path to the sdcard block device (e.g. -d /dev/mmcblk0)"
-    echo "    [-m modem:apn:user:pwd:pin] - configures the mobile network modem (e.g. -m ttyUSB0:internet)"
-    echo "    [-n ssid:psk] - sets the wireless network name and key (e.g. -n mynet:mykey1234)"
-    echo "    [-s ip/cidr:gw:dns] - sets a static IP configuration instead of DHCP (e.g. -s 192.168.1.101/24:192.168.1.1:8.8.8.8)"
+    cat <<END_USAGE
+Usage: $0 [options...]
+
+Available options:
+    <-i image_file> - indicates the path to the image file (e.g. -i /home/user/Download/file.img.gz)
+    <-d sdcard_dev> - indicates the path to the sdcard block device (e.g. -d /dev/mmcblk0)
+    [-m modem:apn:user:pwd:pin] - configures the mobile network modem (e.g. -m ttyUSB0:internet)
+    [-n ssid:psk] - sets the wireless network name and key (e.g. -n mynet:mykey1234)
+    [-s ip/cidr:gw:dns] - sets a static IP configuration instead of DHCP (e.g. -s 192.168.1.101/24:192.168.1.1:8.8.8.8)
+END_USAGE
     exit 1
 }
 
@@ -64,14 +66,14 @@ function cleanup {
     set +e
 
     # unmount sdcard
-    umount ${SDCARD_DEV}* >/dev/null 2>&1
+    umount "${SDCARD_DEV}"* >/dev/null 2>&1
 }
 
 trap cleanup EXIT
 
-BOOT=$(dirname $0)/.boot
+BOOT=$(dirname "$0")/.boot
 
-if ! [ -f $DISK_IMG ]; then
+if ! [ -f "$DISK_IMG" ]; then
     echo "could not find image file $DISK_IMG"
     exit 1
 fi
@@ -85,7 +87,7 @@ if [[ $DISK_IMG == *.gz ]]; then
         exit 1
     fi
     msg "decompressing the .gz compressed image"
-    $gunzip -c $DISK_IMG > ${DISK_IMG%???}
+    $gunzip -c "$DISK_IMG" > "${DISK_IMG%???}"
     DISK_IMG=${DISK_IMG%???}
 elif [[ $DISK_IMG == *.xz ]]; then
     if [ -z "$unxz" ]; then
@@ -93,84 +95,90 @@ elif [[ $DISK_IMG == *.xz ]]; then
         exit 1
     fi
     msg "decompressing the .xz compressed image"
-    $unxz -T 0 -c $DISK_IMG > ${DISK_IMG%???}
+    $unxz -T 0 -c "$DISK_IMG" > "${DISK_IMG%???}"
     DISK_IMG=${DISK_IMG%???}
 fi
 
-umount ${SDCARD_DEV}* 2>/dev/null || true
+umount "${SDCARD_DEV}"* 2>/dev/null || true
 msg "writing disk image to sdcard"
-dd if=$DISK_IMG of=$SDCARD_DEV bs=1048576
+dd if="$DISK_IMG" of="$SDCARD_DEV" bs=1048576
 sync
 
 if which partprobe > /dev/null 2>&1; then
     msg "re-reading sdcard partition table"
-    partprobe ${SDCARD_DEV}
+    partprobe "${SDCARD_DEV}"
     sleep 1
 fi
 
 msg "mounting sdcard"
-mkdir -p $BOOT
+mkdir -p "$BOOT"
 
-if [ `uname` == "Darwin" ]; then
+if [ "$(uname)" == "Darwin" ]; then
     BOOT_DEV=${SDCARD_DEV}s1 # e.g. /dev/disk4s1
-    diskutil unmountDisk ${SDCARD_DEV}
-    mount -ft msdos $BOOT_DEV $BOOT
+    diskutil unmountDisk "${SDCARD_DEV}"
+    mount -ft msdos "$BOOT_DEV" "$BOOT"
 else # assuming Linux
     BOOT_DEV=${SDCARD_DEV}p1 # e.g. /dev/mmcblk0p1
-    if ! [ -e ${SDCARD_DEV}p1 ]; then
+    if ! [ -e "${SDCARD_DEV}p1" ]; then
         BOOT_DEV=${SDCARD_DEV}1 # e.g. /dev/sdc1
     fi
-    mount $BOOT_DEV $BOOT
+    mount "$BOOT_DEV" "$BOOT"
 fi
 
 # wifi
 if [ -n "$SSID" ]; then
     msg "creating wireless configuration"
     conf=$BOOT/wpa_supplicant.conf
-    echo "update_config=1" > $conf
-    echo "ctrl_interface=/var/run/wpa_supplicant" >> $conf
-    echo "network={" >> $conf
-    echo "    scan_ssid=1" >> $conf
-    echo "    ssid=\"$SSID\"" >> $conf
+    {
+    echo "update_config=1"
+    echo "ctrl_interface=/var/run/wpa_supplicant"
+    echo "network={"
+    echo "    scan_ssid=1"
+    echo "    ssid=\"$SSID\""
     if [ -n "$PSK" ]; then
-        echo "    psk=\"$PSK\"" >> $conf
+        echo "    psk=\"$PSK\""
     fi
-    echo "}" >> $conf
-    echo "" >> $conf
+    echo "}"
+    echo ""
+    } > "$conf"
 fi
 
 # modem
 if [ -n "$MODEM" ]; then
     msg "creating mobile network configuration"
     conf=$BOOT/ppp
-    mkdir -p $conf
-    echo $MODEM > $conf/modem
-    echo "AT+CGDCONT=1,\"IP\",\"$APN\"" > $conf/apn
-    echo > $conf/extra
-    echo > $conf/auth
-    echo > $conf/pin
+    mkdir -p "$conf"
+    echo "$MODEM" > "$conf/modem"
+    echo "AT+CGDCONT=1,\"IP\",\"$APN\"" > "$conf/apn"
+    echo > "$conf/extra"
     if [ -n "$MUSER" ]; then
-        echo "user \"$MUSER\"" > $conf/auth
-        echo "password \"$MPWD\"" >> $conf/auth
-    fi
+        echo "user \"$MUSER\""
+        echo "password \"$MPWD\""
+    else
+        echo
+    fi > "$conf/auth"
     if [ -n "$PIN" ]; then
-        echo "AT+CPIN=$PIN" > $conf/pin
-    fi
+        echo "AT+CPIN=$PIN"
+    else
+        echo
+    fi > "$conf/pin"
 fi
 
 # static ip
 if [ -n "$IP" ] && [ -n "$GW" ] && [ -n "$DNS" ]; then
     msg "setting static IP configuration"
     conf=$BOOT/static_ip.conf
-    echo "STATIC_IP=\"$IP\"" > $conf
-    echo "STATIC_GW=\"$GW\"" >> $conf
-    echo "STATIC_DNS=\"$DNS\"" >> $conf
+    {
+    echo "STATIC_IP=\"$IP\""
+    echo "STATIC_GW=\"$GW\""
+    echo "STATIC_DNS=\"$DNS\""
+    } > "$conf"
 fi
 
 msg "unmounting sdcard"
 sync
-umount $BOOT
-rmdir $BOOT
+umount "$BOOT"
+rmdir "$BOOT"
 
 msg "you can now remove the sdcard"