Double quote to prevent globbing and word splitting.

.ci/travis/linux/before_script.sh

@@ -47,7 +47,7 @@ echo "${bold}Docker build deps${endbold}"
 docker --version
 if [[ $DOCKER_QGIS_IMAGE_BUILD_PUSH =~ false ]]; then
   docker-compose --version
-  docker-compose -f $DOCKER_COMPOSE config
+  docker-compose -f "${DOCKER_COMPOSE}" config
 fi
 
 if [[ $DOCKER_DEPS_IMAGE_REBUILD =~ true ]]; then

.ci/travis/linux/script.sh

@@ -24,7 +24,7 @@ mkdir -p $CCACHE_DIR
 
 if [[ $DOCKER_QGIS_IMAGE_BUILD_PUSH =~ true ]]; then
   DIR=$(git rev-parse --show-toplevel)/.docker
-  pushd ${DIR}
+  pushd "${DIR}"
   echo "${bold}Building QGIS Docker image '${DOCKER_TAG}'...${endbold}"
   docker build --build-arg CACHE_DIR=/root/.ccache \
                --build-arg DOCKER_TAG=${DOCKER_TAG} \
@@ -36,5 +36,5 @@ if [[ $DOCKER_QGIS_IMAGE_BUILD_PUSH =~ true ]]; then
   docker push "qgis/qgis:${DOCKER_TAG}"
   popd
 else
-  docker-compose -f $DOCKER_COMPOSE run --rm qgis-deps
+  docker-compose -f "${DOCKER_COMPOSE}" run --rm qgis-deps
 fi

scripts/addcopyright.sh

@@ -30,11 +30,11 @@ else
 fi
 
 for i in $FILES; do
-	echo $i >&2
+	echo "${i}" >&2
 	author=
 	authordate=
 	eval $(git log --reverse --pretty="export author='%an' authordate=\"\$(date --date='%ai' +'%%B %Y')\"" $i | head -1)
-	basename=$(basename $i)
+	basename=$(basename "${i}")
 	authoryear=${authordate#* }
 
         case $i in
@@ -45,13 +45,13 @@ for i in $FILES; do
 
 	src/app/gps/qwtpolar-*|src/app/qtmain_android.cpp|src/core/gps/qextserialport/*|lib/astyle/*)
 		# Skip third party files
-                echo $f skipped
+                echo "${i} skipped"
                 continue
                 ;;
 
 	esac
 
-	case $author in
+	case "${author}" in
 	morb_au)
 		authorname="Brendan Morley"
 		authoremail="morb at ozemail dot com dot au"