From 1c8401be25e4749a2eee5ddc77ce7c6ac880c910 Mon Sep 17 00:00:00 2001
From: Leah Rowe <leah@libreboot.org>
Date: Thu, 24 Aug 2023 20:19:41 +0100
Subject: [PATCH] much, much stricter, more verbose error handling

lbmk is much more likely to crash now, in error conditions,
which is a boon for further auditing.

also: in "fetch", remove the downloaded program
if fail() was called.

this would also be done for gnulib, when downloading
grub, but done in such a way that gnulib goes first.

where calls to err write "ERROR" in the string, they
no longer say "ERROR" because the "err" function itself
now does that automatically.

also: listmodes/listoptions (in "lbmk") now reports an
error if no scripts and/or directories are found.

also: where a warning is given, but not an error, i've
gone through in some places and redirected the output
to stderr, not stdout

as part of error checks: running anything as root, except
for the "./build dependencies *" commands, is no longer
permitted and lbmk will throw an error

mrc downloads: debugfs output no longer redirected to /dev/null,
and stderr no longer redirected to stdout. everything is verbose.

certain non-error states are also more verbose. for example,
patch_rom in blobs/inject will now state when injection succeeds

certain actual errors(bugs) were fixed:
for example, build/release/roms now correctly prepares the blobs
hash files for a given target, containing only the files and
checksums in the list. Previously, a printf message was included.
Now, with this new code: blobutil/inject rightly verifies hashes.

doing all of this in one giant patch is cleaner
than 100 patches changing each file. even this is yet part
of a much larger audit going on in the Libreboot project.

Signed-off-by: Leah Rowe <leah@libreboot.org>
---
 .gitcheck                                 |   2 +
 fetch                                     |  48 ++++--
 fetch_trees                               |  82 +++++----
 lbmk                                      |  35 +++-
 resources/scripts/build/boot/roms         |   8 +-
 resources/scripts/build/boot/roms_helper  | 148 +++++++++-------
 resources/scripts/build/clean/cbutils     |   6 +-
 resources/scripts/build/clean/crossgcc    |   3 +-
 resources/scripts/build/clean/seabios     |   3 +-
 resources/scripts/build/clean/u-boot      |   7 +-
 resources/scripts/build/coreboot/utils    |  17 +-
 resources/scripts/build/descriptors/ich9m |   3 +-
 resources/scripts/build/grub/payload      |  21 ++-
 resources/scripts/build/grub/utils        |  18 +-
 resources/scripts/build/release/roms      |  93 ++++++----
 resources/scripts/build/release/src       | 110 +++++++-----
 resources/scripts/build/src/for           |  20 ++-
 resources/scripts/handle/config/file      |  65 ++++---
 resources/scripts/misc/versioncheck       |   9 +
 resources/scripts/update/blobs/download   | 201 ++++++++++++----------
 resources/scripts/update/blobs/extract    |  46 ++---
 resources/scripts/update/blobs/inject     |  98 ++++++-----
 resources/scripts/update/blobs/mrc        |  49 ++++--
 23 files changed, 667 insertions(+), 425 deletions(-)

diff --git a/.gitcheck b/.gitcheck
index 0e5df8bd..b3405a9c 100755
--- a/.gitcheck
+++ b/.gitcheck
@@ -10,6 +10,8 @@ git_email="placeholder@lbmkplaceholder.com"
 
 main()
 {
+	[ "$(id -u)" = "0" ] && return 0
+
 	if [ $# -gt 0 ]; then
 		if [ "${1}" = "clean" ]; then
 			clean 1> /dev/null
diff --git a/fetch b/fetch
index a8ec96de..2aef4bec 100755
--- a/fetch
+++ b/fetch
@@ -17,23 +17,32 @@ depend=""
 
 main()
 {
-	[ -z "${1+x}" ] && fail 'Error: name not set'
+	id -u 1>/dev/null 2>/dev/null || \
+	    fail "cannot ascertain user id"
+	if [ "$(id -u)" = "0" ]; then
+		fail "running lbmk as root as not permitted"
+	fi
+
+	[ $# -gt 0 ] || fail "no argument given"
+
+	[ -z "${1+x}" ] && fail 'main(): name not set'
 	name=${1}
 
 	read_config
 	verify_config
 
 	clone_project
-	[ "${depend}" = "" ] || ./fetch ${depend} || exit 1
+	[ "${depend}" = "" ] || ./fetch ${depend} || \
+	    fail "Cannot fetch dependency, ${depend}, for project, ${name}"
 
-	rm -Rf ${tmp_dir} >/dev/null 2>&1 || exit 1
+	rm -Rf ${tmp_dir} || fail "cannot remove tmpdir, ${tmp_dir}"
 }
 
 read_config()
 {
 	awkstr=" /\{.*${name}.*}{/ {flag=1;next} /\}/{flag=0} flag { print }"
 	while read -r line ; do
-		set ${line} >/dev/null 2>&1
+		set ${line} || fail "read_config: set line"
 		case ${line} in
 		rev:*)
 			revision=${2} ;;
@@ -53,9 +62,9 @@ EOF
 
 verify_config()
 {
-	[ -z "${revision+x}" ] && fail 'Error: revision not set'
-	[ -z "${location+x}" ] && fail 'Error: location not set'
-	[ -z "${url+x}" ] && fail 'Error: url not set'
+	[ -z "${revision+x}" ] && fail 'verify_config: revision not set'
+	[ -z "${location+x}" ] && fail 'verify_config: location not set'
+	[ -z "${url+x}" ] && fail 'verify_config: url not set'
 }
 
 clone_project()
@@ -63,19 +72,19 @@ clone_project()
 	tmp_dir=$(mktemp -dt "${name}_XXXXX")
 
 	git clone ${url} ${tmp_dir} || git clone ${bkup_url} ${tmp_dir} || \
-	    fail "ERROR: could not download ${name}"
+	    fail "clone_project: could not download ${name}"
 	(
-	cd ${tmp_dir} || fail "tmpdir not created"
-	git reset --hard ${revision} || fail "Cannot reset revision"
+	cd ${tmp_dir} || fail "clone_project: tmpdir not created"
+	git reset --hard ${revision} || \
+	    fail "clone_project: Cannot reset revision"
 	)
 	patch_project
 
 	[ ! -d "${location}" ] || \
-		rm -Rf ${location} || fail "Can't remove directory '${location}'"
-	mv ${tmp_dir} ${location} && return 0
-
-	printf "ERROR: Could not copy temp file to destination.\n"
-	fail " ${tmp_dir} > ${location} check permissions"
+		rm -Rf ${location} || \
+		    fail "clone_project: Can't remove directory '${location}'"
+	mv "${tmp_dir}" "${location}" || \
+	    fail "clone_project: could not copy temp file to destination"
 }
 
 patch_project()
@@ -85,16 +94,19 @@ patch_project()
 	for patchfile in ${PWD}/${patchdir}/*.patch ; do
 		[ -f "${patchfile}" ] || continue
 		(
-		cd ${tmp_dir} || fail "tmpdir not created"
-		git am ${patchfile} || fail "Cannot patch project: $name"
+		cd "${tmp_dir}" || fail "patch_project: tmpdir unavailable"
+		git am "${patchfile}" || \
+		    fail "patch_project: Cannot patch project: $name"
 		)
 	done
 }
 
 fail()
 {
+	for x in "${location}" "${tmp_dir}"; do
+		[ -z "${x}" ] || [ ! -d "${x}" ] || rm -Rf "${location}" || :
+	done
 	usage
-	rm -Rf "${tmp_dir}" > /dev/null 2>&1 | :
 	err "${1}"
 }
 
diff --git a/fetch_trees b/fetch_trees
index 83d26e66..91f868c7 100755
--- a/fetch_trees
+++ b/fetch_trees
@@ -34,7 +34,13 @@ cfgsdir=""
 
 main()
 {
-	rm -f ${cfgsdir}/*/seen
+	id -u 1>/dev/null 2>/dev/null || \
+	    err "cannot ascertain user id"
+	if [ "$(id -u)" = "0" ]; then
+		err "running lbmk as root as not permitted"
+	fi
+
+	rm -f ${cfgsdir}/*/seen || err_rm_seen "main 1"
 
 	printf "Downloading %s and (if available) applying patches\n" \
 	    ${project}
@@ -50,16 +56,19 @@ main()
 		targets=$@
 	else
 		for x in "${cfgsdir}/"*; do
-			[ ! -d "${x}" ] && continue
+			[ -d "${x}" ] || continue
 			targets="${targets} ${x##*/}"
 		done
 	fi
+	[ -z "${targets}" ] && \
+	    err "No targets available for project: ${project}"
 	for x in ${targets}; do
-		rm -f "${cfgsdir}"/*/seen
-		download_for_target "${x}"
+		rm -f "${cfgsdir}"/*/seen || err_rm_seen "main 2"
+		download_for_target "${x}" || \
+		    err "${project}/${target}: cannot download source tree"
 	done
 
-	rm -f ${cfgsdir}/*/seen
+	rm -f ${cfgsdir}/*/seen || err_rm_seen "main 3"
 }
 
 download_for_target()
@@ -68,20 +77,23 @@ download_for_target()
 	tree="undefined"
 	rev="undefined"
 
-	fetch_config "${_target}" || exit 1
+	fetch_config "${_target}" || \
+	    err "download_for_target: ${project}/${_target}: bad target.cfg"
 
-	rm -f "${cfgsdir}"/*/seen
+	rm -f "${cfgsdir}"/*/seen || err_rm_seen "download_for_target"
 
 	if [ -d "${project}/${tree}" ]; then
 		printf "REMARK: download/%s %s: exists. Skipping.\n" \
-		    ${project} ${tree}
+		    "${project}" "${tree}" 1>&2
 		[ "${tree}" != "${_target}" ] && \
-			printf "(for target: '%s}')\n" ${_target}
+			printf "(for target: '%s}')\n" "${_target}" 1>&2
 		return 0
 	fi
 
-	fetch_from_upstream || exit 1
-	prepare_new_tree "${_target}" "${tree}" "${rev}" || exit 1
+	fetch_from_upstream || \
+	    err "download_for_target: cannot fetch: ${project}"
+	prepare_new_tree "${_target}" "${tree}" "${rev}" || \
+	    err "download_for_target: cannot create tree: ${project}/${tree}"
 }
 
 fetch_config()
@@ -95,20 +107,21 @@ fetch_config()
 		check_config_for_target "${_target}" || return 1
 
 		# This is to override $rev and $tree
-		. "${cfgsdir}/${_target}/target.cfg" || exit 1
+		. "${cfgsdir}/${_target}/target.cfg" || \
+		    err "fetch_config: no \"${cfgsdir}/${_target}/target.cfg\""
 
 		if [ "${_target}" != "${tree}" ]; then
 			_target="${tree}"
 			continue
 		elif [ "${tree}" = "undefined" ]; then
-			printf "ERROR: download/%s:"
+			printf "ERROR (fetch_config): download/%s:" 1>&2
 			printf " tree name undefined for '%s\n'" \
-					${project} ${_target}
+			    "${project}" "${_target}" 1>&2
 			return 1
 		elif [ "${rev}" = "undefined" ]; then
-			printf "ERROR: download/%s:"
+			printf "ERROR (fetch_config): download/%s:" 1>&2
 			printf " commit ID undefined for '%s'\n" \
-					${project} ${_target}
+			    "${project}" "${_target}" 1>&2
 			return 1
 		else
 			break
@@ -121,21 +134,25 @@ check_config_for_target()
 	_target=${1}
 
 	if [ ! -f "${cfgsdir}/${_target}/target.cfg" ]; then
-		printf "ERROR: download/%s: target.cfg does not" ${project}
-		printf " exist for '%s'\n" ${_target}
+		printf "ERROR: download/%s: target.cfg does not" \
+		    "${project}" 1>&2
+		printf " exist for '%s'\n" "${_target}" 1>&2
 		return 1
 	elif [ -f "${cfgsdir}/${_target}/seen" ]; then
-		printf "ERROR: download/%s: logical loop:" ${project}
-		printf " '%s' target.cfg refers to another tree," ${_target}
-		printf " which ultimately refers back to '%s'." ${_target}
+		printf "ERROR: download/%s: logical loop:" "${project}" 1>&2
+		printf " '%s' target.cfg refers to another tree," "${_target}" \
+		    1>&2
+		printf " which ultimately refers back to '%s'." "${_target}" \
+		    1>&2
 		return 1
 	fi
-	touch "${cfgsdir}/${_target}/seen"
+	touch "${cfgsdir}/${_target}/seen" || \
+	    err "${project}/${_target}: touch \"${cfgsdir}/${_target}/seen\""
 }
 
 fetch_from_upstream()
 {
-	[ -d "${project}" ] || mkdir -p "${project}"
+	[ -d "${project}" ] || mkdir -p "${project}" || return 1
 	[ -d "${project}" ] || return 1
 	[ -d "${project}/${project}" ] && return 0
 
@@ -152,7 +169,8 @@ prepare_new_tree()
 	[ "${tree}" != "${target}" ] && \
 		printf "(for target, %s)\n" "${target}"
 
-	cp -R "${project}/${project}" "${project}/${tree}" || exit 1
+	cp -R "${project}/${project}" "${project}/${tree}" || \
+	    err "${project}/${tree}: cannot copy source tree"
 	(
 	cd "${project}/${tree}" || err "cannot cd to ${project}/${tree}"
 	git reset --hard ${rev} || \
@@ -160,11 +178,12 @@ prepare_new_tree()
 	git submodule update --init --checkout || \
 	    err "cannot update ${project} submodules for tree, ${tree}"
 
-	for patch in ../../"${cfgsdir}"/"${tree}"/patches/*.patch; do
-		[ ! -f "${patch}" ] && continue
+	for patch in "../../${cfgsdir}/${tree}/patches/"*.patch; do
+		[ -f "${patch}" ] || continue
 		if ! git am "${patch}"; then
-			git am --abort
-			err "cannot patch ${tree}"
+			git am --abort || \
+			    err "${project}/${tree}: FAILED: git am --abort"
+			err "cannot patch: ${project}/${tree}"
 		fi
 	done
 
@@ -172,9 +191,14 @@ prepare_new_tree()
 	# but should *only* be a last resort
 	if [ -f "../../${cfgsdir}/${tree}/extra.sh" ]; then
 		"../../${cfgsdir}/${tree}/extra.sh" || \
-			err "${tree} extra.sh"
+		    err "prepare_new_tree ${project}/${tree}: extra.sh: error"
 	fi
 	)
 }
 
+err_rm_seen()
+{
+	err "${1}: ${project}/${target}: cannot rm: \"${cfgsdir}/*/seen\""
+}
+
 main $@
diff --git a/lbmk b/lbmk
index e0933aa9..7cd69ed5 100755
--- a/lbmk
+++ b/lbmk
@@ -33,11 +33,18 @@ option=""
 
 main()
 {
+	id -u 1>/dev/null 2>/dev/null || \
+	    err "cannot ascertain user id"
+
 	[ "${0##*/}" = "lbmk" ] && err "Don't run this script directly."
 	[ $# -lt 1 ] && err "Too few arguments. Try: ${0} help"
 
-	buildpath="./resources/scripts/${0##*/}"
 	mode="${1}"
+	if [ "$(id -u)" = "0" ] && [ "${mode}" != "dependencies" ]; then
+		err "running lbmk as root as not permitted"
+	fi
+
+	buildpath="./resources/scripts/${0##*/}"
 
 	./.gitcheck || err "/.gitcheck call from main, in /lbmk"
 	[ "${mode}" = "help" ] && usage ${0} && exit 0
@@ -46,20 +53,22 @@ main()
 	if [ "${mode}" = "dependencies" ]; then
 		install_dependencies $@ || err "Could not install dependencies"
 		exit 0
-	else
-		./resources/scripts/misc/versioncheck
 	fi
 
 	option="${2}"
 	shift 2
 
+	./resources/scripts/misc/versioncheck || \
+	    err "Cannot check lbmk version"
+
 	case "${option}" in
 	list)
 		printf "Options for mode '%s':\n\n" ${mode}
 		listoptions "${mode}" ;;
 	all)
 		for option in $(listoptions "${mode}"); do
-			"${buildpath}/${mode}/${option}" $@
+			"${buildpath}/${mode}/${option}" $@ || \
+			    err "script fail: ${buildpath}/${mode}/${option} $@"
 		done
 		;;
 	*)
@@ -84,18 +93,23 @@ install_dependencies()
 	aur_notice=""
 	. "resources/dependencies/${2}"
 
-	${pkg_add} ${pkglist} || err "Error installing dependencies"
-	[ "${aur_notice}" != "" ] && \
-		printf "You must install these AUR packages: %s\n" \
-		    "${aur_notice}" 1>&2
+	${pkg_add} ${pkglist} || \
+	    err "install_dependencies: Error installing dependencies"
+	[ "${aur_notice}" = "" ] || \
+	    printf "You must install AUR packages: %s\n" "${aur_notice}" 1>&2
 }
 
 # Takes exactly one mode as parameter
 listoptions()
 {
+	options="n"
 	for option in "${buildpath}/${1}/"*; do
+		[ -f "${option}" ] || continue
 		printf '%s\n' ${option##*/}
+		options="y"
 	done
+	[ "${options}" = "y" ] || \
+	    err "listoptions: No scripts present in directory ${buildpath}/${1}"
 }
 
 usage()
@@ -118,9 +132,14 @@ usage()
 
 listmodes()
 {
+	modes="n"
 	for mode in "${buildpath}"/*; do
+		[ -d "${mode}" ] || continue
 		printf '%s\n' ${mode##*/}
+		modes="y"
 	done
+	[ "${modes}" = "y" ] || \
+	    err "listmodes: No directories present in directory ${buildpath}"
 }
 
 main $@
diff --git a/resources/scripts/build/boot/roms b/resources/scripts/build/boot/roms
index 966750a2..0aedfdb1 100755
--- a/resources/scripts/build/boot/roms
+++ b/resources/scripts/build/boot/roms
@@ -66,11 +66,11 @@ main()
 
 	if [ "${firstoption}" = "all" ]; then
 		for boardname in $(listboards); do
-			buildrom "${boardname}" || err "build/roms: error"
+			buildrom "${boardname}" || err "build/roms (1): error"
 		done
 	else
 		for board in ${boards}; do
-			buildrom "${board}" || err "build/roms: error"
+			buildrom "${board}" || err "build/roms (2): error"
 		done
 	fi
 
@@ -104,7 +104,7 @@ usage()
 listboards()
 {
 	for boarddir in resources/coreboot/*; do
-		[ ! -d "${boarddir}" ] && continue
+		[ -d "${boarddir}" ] || continue
 		board="${boarddir##resources/coreboot/}"
 		board="${board%/}"
 		printf '%s\n' "${board##*/}"
@@ -115,7 +115,7 @@ listboards()
 buildrom() {
 	[ -d "resources/coreboot/${1}/" ] || \
 		err "build/roms: target not defined: ${1}"
-	./build boot roms_helper ${1}${opts}
+	./build boot roms_helper ${1}${opts} || return 1
 }
 
 main $@
diff --git a/resources/scripts/build/boot/roms_helper b/resources/scripts/build/boot/roms_helper
index 6136e708..a8e7635d 100755
--- a/resources/scripts/build/boot/roms_helper
+++ b/resources/scripts/build/boot/roms_helper
@@ -63,10 +63,10 @@ done
 printf "\n\nboard is %s , kb is %s , displaymode is %s , payloads is %s\n" \
 		${board} ${keyboard_layouts} ${displaymodes} ${payloads} 1>&2
 
-[ ! -d "resources/coreboot/${board}" ] && \
+[ -d "resources/coreboot/${board}" ] || \
 	err "Target not defined: ${board}"
 
-[ ! -f "resources/coreboot/${board}/target.cfg" ] && \
+[ -f "resources/coreboot/${board}/target.cfg" ] || \
 	err "Missing target.cfg for target: ${board}"
 
 grub_scan_disk="undefined"
@@ -114,7 +114,7 @@ fi
 if [ "${payload_grub}" != "y" ] && [ "${payload_seabios}" != "y" ] && \
     [ "${payload_uboot}" != "y" ]; then
 	for configfile in "resources/coreboot/${board}/config/"*; do
-		[ ! -e "${configfile}" ] && continue
+		[ -e "${configfile}" ] || continue
 		err "target '${board}' defines no payload"
 	done
 fi
@@ -158,19 +158,22 @@ if [ ! -f "${seavgabiosrom}" ] \
     || [ ! -f elf/seabios/default/libgfxinit/bios.bin.elf ] \
     || [ ! -f elf/seabios/default/vgarom/bios.bin.elf ] \
     || [ ! -f elf/seabios/default/normal/bios.bin.elf ]; then
-	[ "${payload_seabios}" = "y" ] && \
-		./handle config file -b seabios
+	[ "${payload_seabios}" != "y" ] || \
+		./handle config file -b seabios || \
+		    err "cannot build seabios"
 fi
 
 memtest_bin="memtest86plus/build${arch#*_}/memtest.bin"
-[ "${payload_memtest}" = "y" ] && [ ! -f "${memtest_bin}" ] && \
-	./build src for -b ${memtest_bin%/*}
+[ "${payload_memtest}" != "y" ] || [ -f "${memtest_bin}" ] || \
+	./build src for -b ${memtest_bin%/*} || \
+	    err "cannot build memtest86+"
 
-[ -d "${romdir}/" ] || mkdir -p "${romdir}/"
-rm -f "${romdir}"/*
+[ -d "${romdir}/" ] || mkdir -p "${romdir}/" || \
+    err "cannot create rom directory: \"${romdir}\""
+rm -f "${romdir}"/* || err "cannot: rm -f \"${romdir}\"/*"
 
-if [ "${payload_grub}" = "y" ] \
-			|| [ "${payload_seabios_withgrub}" = "y" ]; then
+if [ "${payload_grub}" = "y" ] || \
+    [ "${payload_seabios_withgrub}" = "y" ]; then
 	if [ -f "elf/grub/grub_usqwerty.cfg" ]; then
 		sha1sumcmd="sha1sum resources/grub/config/grub.cfg"
 		grubrefchecksum="$(${sha1sumcmd} | awk '{print $1}')"
@@ -179,10 +182,12 @@ if [ "${payload_grub}" = "y" ] \
 		grubbuildchecksum="$(${sha1sumcmd} | awk '{print $1}')"
 
 		if [ "${grubrefchecksum}" != "${grubbuildchecksum}" ]; then
-			printf "Changes detected to GRUB. Re-building now:\n"
+			printf "Changes detected to GRUB. Re-building now.\n" \
+			    1>&2
 		fi
 	else
-		printf "Required GRUB payloads not yet built. Building now:\n"
+		printf "Required GRUB payloads not yet built. Building now.\n" \
+		    1>&2
 	fi
 	for keymapfile in ${kmapdir}/*; do
 		[ -f "${keymapfile}" ] || continue
@@ -196,13 +201,14 @@ if [ "${payload_grub}" = "y" ] \
 
 		if [ ! -f "${grubelf}" ] || [ ! -f "${grubcfg}" ] || \
 		    [ ! -f "${grubtestcfg}" ]; then
-			./build grub payload
+			./build grub payload || err "cannot build grub payload"
 		fi
 	done
 fi
 
 if [ "${payload_uboot}" = "y" ]; then
-	./handle config file -b u-boot ${board}
+	./handle config file -b u-boot ${board} || \
+	    err "cannot build u-boot target: ${board}"
 	ubdir="elf/u-boot/${board}/${uboot_config}"
 	ubootelf="${ubdir}/u-boot.elf"
 	[ ! -f "${ubootelf}" ] && [ -f "${ubdir}/u-boot.bin" ] && \
@@ -225,55 +231,61 @@ moverom() {
 
 	if [ "${cuttype}" = "4MiB IFD BIOS region" ]; then
 		dd if=${rompath} of=${newrompath} bs=1 \
-		    skip=$(($(stat -c %s ${rompath}) - 0x400000)) count=4194304
+		    skip=$(($(stat -c %s ${rompath}) - 0x400000)) \
+		    count=4194304 || err "moverom: cannot cut 4MB section"
 	else
-		cp ${rompath} ${newrompath}
+		cp ${rompath} ${newrompath} || err "moverom: cannot copy rom"
 	fi
 
 	# pike2008 cards cause a system hang when loading option roms in seabios
 	# if there is an empty option rom in cbfs, no option rom will be loaded
 	if [ "${cuttype}" = "d8d16sas" ]; then
 		emptyrom=$(mktemp -t coreboot_rom.XXXXXXXXXX)
-		rm -f "${emptyrom}"
-		touch "${emptyrom}"
+		rm -f "${emptyrom}" || err "cannot remove fake oprom"
+		touch "${emptyrom}" || err "cannot create fake oprom"
 		for deviceID in "0072" "3050"; do
 			"${cbfstool}" "${newrompath}" add -f "${emptyrom}" \
-			    -n pci1000,${deviceID}.rom -t raw
+			    -n pci1000,${deviceID}.rom -t raw || \
+			    err "moverom: cannot insert fake pike2008 rom"
 		done
-		rm -f "${emptyrom}"
+		rm -f "${emptyrom}" || err "moverom: cannot remove pike2008 rom"
 	fi
 
 	for romsize in 4 8 16; do
 		ifdgbe="descriptors/ich9m/ich9fdgbe_${romsize}m.bin"
 		if [ "${cuttype}" = "${romsize}MiB ICH9 IFD NOR flash" ]; then
 			[ -f "${ifdgbe}" ] || \
-				./build descriptors ich9m
+				./build descriptors ich9m || \
+				    err "moverom: cannot create ich9m ifd"
 			dd if=${ifdgbe} of=${newrompath} bs=1 count=12k \
-			    conv=notrunc
+			    conv=notrunc || err "moverom: cant insert ich9m ifd"
 		fi
 		cmpstr="${romsize}MiB ICH9 IFD NOGBE NOR flash"
 		ifdgbe="descriptors/ich9m/ich9fdnogbe_${romsize}m.bin"
 		if [ "${cuttype}" = "${cmpstr}" ]; then
 			[ -f "${ifdgbe}" ] || \
-				./build descriptors ich9m
+				./build descriptors ich9m || \
+				    err "moverom: cannot create ich9m ifd"
 			dd if=${ifdgbe} of=${newrompath} bs=1 count=4k \
-			    conv=notrunc
+			    conv=notrunc || err "moverom: cant insert ich9m ifd"
 		fi
 	done
 
 	if [ "${cuttype}" = "i945 laptop" ]; then
 		dd if=${newrompath} of=top64k.bin bs=1 \
-		    skip=$(($(stat -c %s ${newrompath}) - 0x10000)) count=64k
+		    skip=$(($(stat -c %s ${newrompath}) - 0x10000)) count=64k \
+		    || err "moverom: cannot copy boot block from i945 rom"
 		dd if=top64k.bin of=${newrompath} bs=1 \
 		    seek=$(($(stat -c %s ${newrompath}) - 0x20000)) count=64k \
-		    conv=notrunc
-		rm -f top64k.bin
+		    conv=notrunc || \
+		    err "moverom: cannot copy boot block into i945 rom"
+		rm -f top64k.bin || err "moverom: can't remove top64k.bin"
 	fi
 
 	if [ "${microcode_required}" = "n" ]; then
 		_newrom_b="${newrompath%.rom}_nomicrocode.rom"
 		cp "${newrompath}" "${_newrom_b}" || \
-		    err "cannot do: cp \"${newrompath}\" \"${_newrom_b}\""
+		    err "moverom: cp \"${newrompath}\" \"${_newrom_b}\""
 		microcode_present="y"
 		"${cbfstool}" "${_newrom_b}" remove -n \
 		    cpu_microcode_blob.bin || microcode_present="n"
@@ -283,7 +295,7 @@ moverom() {
 			    ${newrompath}
 			printf "Renaming default ROM file instead.\n"
 			mv "${newrompath}" "${_newrom_b}" || \
-			    err "fail: mv \"${newrompath}\" \"${_newrom_b}\""
+			    err "moverom: mv \"${newrompath}\" \"${_newrom_b}\""
 		fi
 	fi
 }
@@ -299,33 +311,34 @@ mkSeabiosRom() {
 
 	tmprom=$(mktemp -t coreboot_rom.XXXXXXXXXX)
 
-	cp "${target_cbrom}" "${tmprom}"
+	cp "${target_cbrom}" "${tmprom}" || \
+	    err "mkSeabiosRom: cannot copy to tmprom"
 
 	"${cbfstool}" "${tmprom}" add-payload -f "${target_seabioself}" \
 	    -n ${target_seabios_cbfs_path} -c lzma || \
-	    err "cannot add payload, ${target_seabioself}, to tmprom, ${tmprom}"
+	    err "mkSeabiosRom: can't add payload, ${target_seabioself}, to rom"
 
 	"${cbfstool}" "${tmprom}" add-int -i 3000 -n etc/ps2-keyboard-spinup \
-	    || err "cannot add-int etc/ps2-keyboard-spinup to tmprom, ${tmprom}"
+	    || err "mkSeabiosRom: cbfs add-int etc/ps2-keyboard-spinup 3000"
 
 	if [ "${target_initmode}" = "normal" ] || \
 	    [ "${target_initmode}" = "libgfxinit" ]; then
 		"${cbfstool}" "${tmprom}" add-int -i 2 \
 		    -n etc/pci-optionrom-exec || \
-		    err "cannot add-int etc/pci-optionrom-exec 2 to tmprom"
+		    err "mkSeabiosRom: cbfs add-int etc/pci-optionrom-exec 2"
 	elif [ "${target_initmode}" = "vgarom" ]; then # coreboot executes it
 		"${cbfstool}" "${tmprom}" add-int -i 0 \
 		    -n etc/pci-optionrom-exec || \
-		    err "cannot add-int etc/pci-optionrom-exec 0 to tmprom"
+		    err "mkSeabiosRom: cbfs add-int etc/pci-optionrom-exec 0"
 	fi # for undefined modes, don't add this integer. use SeaBIOS defaults
 
 	"${cbfstool}" "${tmprom}" add-int -i 0 -n etc/optionroms-checksum || \
-	    err "cannot add-int etc/optionroms-checksum 0 to tmprom"
+	    err "mkSeabiosRom: cbfs add-int etc/optionroms-checksum 0"
 
 	[ "${target_initmode}" != "libgfxinit" ] || \
 		"${cbfstool}" "${tmprom}" add -f "${seavgabiosrom}" \
 		    -n vgaroms/seavgabios.bin -t raw || \
-		    err "cannot add vgaroms/seavgabios.bin to tmprom"
+		    err "mkSeabiosRom: cbfs add-raw vgaroms/seavgabios.bin"
 
 	printf "%s\n" "${tmprom}"
 }
@@ -343,14 +356,15 @@ mkUbootRom() {
 	[ -f "${target_ubootelf}" ] || \
 		target_ubootelf="${target_ubdir}/u-boot.bin"
 	[ -f "${target_ubootelf}" ] || \
-		err "Could not find u-boot build for board, ${board}"
+		err "mkUbootRom: cant find u-boot build for board, ${board}"
 
 	tmprom=$(mktemp -t coreboot_rom.XXXXXXXXXX)
 
-	cp "${target_cbrom}" "${tmprom}"
+	cp "${target_cbrom}" "${tmprom}" || \
+	    err "mkUbootRom: cannot copy to tmprom"
 	"${cbfstool}" "${tmprom}" add-payload -f "${target_ubootelf}" \
 	    -n ${target_uboot_cbfs_path} -c lzma || \
-	    err "cannot add u-boot to tmprom"
+	    err "mkUbootRom: cannot add u-boot to tmprom"
 
 	printf "%s\n" "${tmprom}"
 }
@@ -379,20 +393,23 @@ mkGrubRom() {
 	if [ "${grub_scan_disk}" = "ahci" ]; then
 		sed \
 		's/set\ grub_scan_disk=\"both\"/set\ grub_scan_disk=\"ahci\"/' \
-		    "${grubcfg}" > "${tmpgrubcfg}"
+		    "${grubcfg}" > "${tmpgrubcfg}" || err "mkGrubRom: sed1"
 		sed \
 		's/set\ grub_scan_disk=\"both\"/set\ grub_scan_disk=\"ahci\"/' \
-		    "${grubtestcfg}" > "${tmpgrubtestcfg}"
+		    "${grubtestcfg}" > "${tmpgrubtestcfg}" || \
+		    err "mkGrubRom: sed2"
 	elif [ "${grub_scan_disk}" = "ata" ]; then
 		sed \
 		's/set\ grub_scan_disk=\"both\"/set\ grub_scan_disk=\"ata\"/' \
-		    "${grubcfg}" > "${tmpgrubcfg}"
+		    "${grubcfg}" > "${tmpgrubcfg}" || err "mkGrubRom: sed3"
 		sed \
 		's/set\ grub_scan_disk=\"both\"/set\ grub_scan_disk=\"ata\"/' \
-		    "${grubtestcfg}" > "${tmpgrubtestcfg}"
+		    "${grubtestcfg}" > "${tmpgrubtestcfg}" || \
+		    err "mkGrubRom: sed4"
 	else
-		cp "${grubcfg}" "${tmpgrubcfg}"
-		cp "${grubtestcfg}" "${tmpgrubtestcfg}"
+		cp "${grubcfg}" "${tmpgrubcfg}" || err "mkGrubRom: grub.cfg cp"
+		cp "${grubtestcfg}" "${tmpgrubtestcfg}" || \
+		    err "mkGrubRom: grubtest.cfg cp"
 	fi
 
 	"${cbfstool}" "${tmprom}" add -f "${tmpgrubcfg}" -n grub.cfg -t raw || \
@@ -400,7 +417,8 @@ mkGrubRom() {
 
 	"${cbfstool}" "${tmprom}" add -f "${tmpgrubtestcfg}" -n grubtest.cfg \
 	    -t raw || err "mkGrubRom: cannot add grubtest.cfg to tmprom"
-	rm -f "${tmpgrubcfg}" "${tmpgrubtestcfg}"
+	rm -f "${tmpgrubcfg}" "${tmpgrubtestcfg}" || \
+	    err "mkGrubRom: cannot remove tmp grub.cfg / grubtest.cfg"
 
 	backgroundfile="background1280x800.png"
 	if [ "${board}" = "x60" ] || [ "${board}" = "t60_intelgpu" ]; then
@@ -429,7 +447,8 @@ mkRomsWithGrub() {
 	elif [ "${payload_seabios_withgrub}" ] && \
 	    [ "${firstpayloadname}" != "grub" ]; then
 		mv "$(mkSeabiosRom "${x}" "fallback/payload" "$y")" \
-		    "${tmprompath}"
+		    "${tmprompath}" || \
+		    err "mkRomsWithGrub: cannot move SeaBIOS ROM to tmprom"
 	fi	
 
 	keymaps=""
@@ -469,8 +488,9 @@ mkRomsWithGrub() {
 			newrompath="${newrompath}${initmode}_${displaymode}_"
 			newrompath="${newrompath}${keymap}.rom"
 		fi
-		moverom "${tmpgrubrom}" "${newrompath}" "${romtype}"
-		rm -f "${tmpgrubrom}"
+		moverom "${tmpgrubrom}" "${newrompath}" "${romtype}" || \
+		    err "mkRomsWithGrub, moverom"
+		rm -f "${tmpgrubrom}" || err "rm tmpgrubrom, mkRomsWithGrub"
 	done
 }
 
@@ -483,18 +503,20 @@ mkRoms()
 
 	if [ ! -f "${cbcfgpath}" ]; then
 		printf "'%s' does not exist. Skipping build for %s %s %s\n" \
-		    ${cbcfgpath} ${board} ${displaymode} ${initmode}
+		    "${cbcfgpath}" "${board}" "${displaymode}" "${initmode}" \
+		    1>&2
 		return 0
 	fi
 
-	./handle config file -b coreboot ${board}
+	./handle config file -b coreboot ${board} || \
+	    err "mkRoms: cannot build coreboot for target: ${board}"
 
 	_corebootrom="elf/coreboot/${board}/${initmode}_${displaymode}"
 	[ "${initmode}" = "normal" ] && \
 		_corebootrom="${_corebootrom%_${displaymode}}"
 	_corebootrom="${_corebootrom}/coreboot.rom"
 	corebootrom="$(mktemp -t coreboot_rom.XXXXXXXXXX)"
-	cp "${_corebootrom}" "${corebootrom}"
+	cp "${_corebootrom}" "${corebootrom}" || err "mkRoms: cannot copy rom"
 
 	if [ "${payload_memtest}" = "y" ]; then
 		"${cbfstool}" "${corebootrom}" add-payload \
@@ -516,20 +538,23 @@ mkRoms()
 				newrompath="${newrompath}${displaymode}.rom"
 			fi
 
-			moverom "${t}" "${newrompath}" "${romtype}"
-			rm -f "${t}"
+			moverom "${t}" "${newrompath}" "${romtype}" || \
+			    err "mkRoms: cannot copy rom"
+			rm -f "${t}" || err "cannot rm ${t}"
 		else
 			tmprom=$(mktemp -t coreboot_rom.XXXXXXXXXX)
 			cp "${corebootrom}" "${tmprom}"
 			mkRomsWithGrub "${tmprom}" "${initmode}" \
-			    "${displaymode}" "seabios_withgrub"
-			rm -f "${tmprom}"
+			    "${displaymode}" "seabios_withgrub" || \
+			    err "mkRoms: cannot build grub roms, seabios w/grub"
+			rm -f "${tmprom}" || err "mkRoms: can't remove tmprom"
 		fi
 	fi
 
-	[ "${payload_grub}" = "y" ] && \
+	[ "${payload_grub}" != "y" ] || \
 		mkRomsWithGrub "${corebootrom}" "${initmode}" \
-		    "${displaymode}" "grub"
+		    "${displaymode}" "grub" || \
+		    err "mkRoms: mkRomsWithGrub failed"
 
 	if [ "${payload_uboot}" = "y" ]; then
 		x=${corebootrom}
@@ -543,8 +568,9 @@ mkRoms()
 			newrompath="${romdir}/uboot_payload_${board}_"
 			newrompath="${newrompath}${initmode}_${displaymode}.rom"
 		fi
-		moverom "${tmpubootrom}" "${newrompath}" "${romtype}"
-		rm -f "${tmpubootrom}"
+		moverom "${tmpubootrom}" "${newrompath}" "${romtype}" || \
+		    err "mkRoms: moverom fail (u-boot)"
+		rm -f "${tmpubootrom}" || err "mkRoms: cannot rm u-boot rom"
 	fi
 }
 
diff --git a/resources/scripts/build/clean/cbutils b/resources/scripts/build/clean/cbutils
index 067c2cb2..bdacc45a 100755
--- a/resources/scripts/build/clean/cbutils
+++ b/resources/scripts/build/clean/cbutils
@@ -44,15 +44,15 @@ clean_cbutils()
 
 		# Clean coreboot, of course
 		make -C "${tree}/" distclean || \
-		    err "cannot distclean coreboot tree, ${tree}"
+		    err "clean_cbutils: ${tree}: cannot distclean"
 
 		# Clean its utilities as well
 		for util in cbfstool ifdtool nvramtool cbmem; do
 			make distclean -C "${tree}/util/${util}/" || \
-			    err "cannot clean util, ${util}, at ${tree}"
+			    err "clean_cbutils: ${cbtree} ${util}: can't clean"
 		done
 		make distclean -C "${tree}/payloads/libpayload/" || \
-		    err "cannot distclean libpayload, at ${tree}"
+		    err "clean_cbutils: ${tree}: can't distclean libpayload"
 	done
 }
 
diff --git a/resources/scripts/build/clean/crossgcc b/resources/scripts/build/clean/crossgcc
index 7b1765f8..c76d1849 100755
--- a/resources/scripts/build/clean/crossgcc
+++ b/resources/scripts/build/clean/crossgcc
@@ -37,7 +37,8 @@ clean_crossgcc()
 	for board in coreboot/*; do
 		[ -d "${board}" ] || continue
 		[ "${board##*/}" = "coreboot" ] && continue
-		make -C "${board}/" crossgcc-clean || err "make-clean"
+		make -C "${board}/" crossgcc-clean || \
+		    err "clean_crossgcc: ${board}: !make crossgcc-clean"
 	done
 }
 
diff --git a/resources/scripts/build/clean/seabios b/resources/scripts/build/clean/seabios
index c6759e83..0178a729 100755
--- a/resources/scripts/build/clean/seabios
+++ b/resources/scripts/build/clean/seabios
@@ -40,7 +40,8 @@ clean_seabios()
 	for x in seabios/*; do
 		[ ! -d "${x}" ] && continue
 		[ "${x}" = "seabios/seabios" ] && continue
-		make -C "${x}" distclean || err "cannot distclean tree, ${x}"
+		make -C "${x}" distclean || \
+		    err "clean_seabios: cannot distclean tree, ${x}"
 	done
 }
 
diff --git a/resources/scripts/build/clean/u-boot b/resources/scripts/build/clean/u-boot
index 7ba3a4a9..5deff216 100755
--- a/resources/scripts/build/clean/u-boot
+++ b/resources/scripts/build/clean/u-boot
@@ -39,11 +39,12 @@ clean_uboot()
 		fi
 
 		make -C "${board}/" distclean || \
-		    err "cannot distclean u-boot dir, ${board}"
+		    err "clean_uboot: cannot distclean ${board}"
 
-		[ ! -e "${board}/.git" ] || \
+		if [ -e "${board}/.git" ]; then
 			git -C "${board}" clean -fdx || \
-			    err "cannot clean u-boot git repo, ${board}"
+			    err "clean_uboot: ${board}: cannot clean git files"
+		fi
 	done
 }
 
diff --git a/resources/scripts/build/coreboot/utils b/resources/scripts/build/coreboot/utils
index d381f9e2..bf0c47a7 100755
--- a/resources/scripts/build/coreboot/utils
+++ b/resources/scripts/build/coreboot/utils
@@ -48,7 +48,7 @@ build_for_mainboard() {
 	tree="undefined"
 	. "resources/coreboot/${board}/target.cfg" # source
 	[ "${tree}" = "undefined" ] && \
-		err "build/cbutils: improper tree definition for '${board}'"
+	    err "build_for_mainboard: improper tree definition for '${board}'"
 	buildutils "${tree}"
 }
 
@@ -56,19 +56,22 @@ buildutils() {
 	tree="${1}"
 	[ -d "coreboot/${tree}/" ] || \
 		./fetch_trees coreboot $tree || \
-		    err "cannot fetch ${tree}"
+		    err "buildutils: cannot fetch ${tree}"
 	for util in cbfstool ifdtool; do
 		[ -f "cbutils/${tree}/${util}" ] && continue
 		[ -d "cbutils/${tree}" ] || \
 			mkdir -p "cbutils/${tree}" || \
-			    err "cannot create directory, cbutils/${tree}"
+			    err "buildutils: can't mkdir cbutils/${tree}"
 
 		utildir="coreboot/${tree}/util/${util}"
-		make distclean -C "${utildir}" || err "cannot clean ${utildir}"
-		make -j$(nproc) -C "${utildir}" || err "cannot build ${utildir}"
+		make distclean -C "${utildir}" || \
+		    err "buildutils: cannot clean ${utildir}"
+		make -j$(nproc) -C "${utildir}" || \
+		    err "buildutils: cannot build ${utildir}"
 		cp "${utildir}/${util}" "cbutils/${tree}" || \
-		    err "cannot copy util, ${util}, to cbutils/${tree}/"
-		make distclean -C "${utildir}" || err "can't clean ${utildir}"
+		    err "buildutils: can't cp ${util} cbutils/${tree}/"
+		make distclean -C "${utildir}" || \
+		    err "buildutils: can't clean ${utildir}"
 	done
 }
 
diff --git a/resources/scripts/build/descriptors/ich9m b/resources/scripts/build/descriptors/ich9m
index 40d95d42..3bfed53c 100755
--- a/resources/scripts/build/descriptors/ich9m
+++ b/resources/scripts/build/descriptors/ich9m
@@ -29,7 +29,8 @@ main()
 	    err "ich9utils make"
 	[ ! -f "${ich9gen}" ] && err "ich9gen doesn't exist"
 
-	[ -d "descriptors/ich9m/" ] || mkdir -p "descriptors/ich9m/"
+	[ -d "descriptors/ich9m/" ] || mkdir -p "descriptors/ich9m/" || \
+	    err "can't create directory: descriptors/ich9m"
 	rm -f descriptors/ich9m/* || err "rm-rf"
 
 	(
diff --git a/resources/scripts/build/grub/payload b/resources/scripts/build/grub/payload
index 7f1d239f..00ed4d44 100755
--- a/resources/scripts/build/grub/payload
+++ b/resources/scripts/build/grub/payload
@@ -46,13 +46,16 @@ main()
 handle_dependencies()
 {
 	[ -d "grub/" ] || \
-		./fetch grub || err "cannot fetch grub"
+		./fetch grub || \
+		    err "handle_dependencies: cannot fetch grub"
 	[ -f "grub/grub-mkstandalone" ] || \
-		./build grub utils || err "cannot build grub utils"
+		./build grub utils || \
+		    err "handle_dependencies: cannot build grub utils"
 	[ -d "elf/grub" ] || \
-		mkdir -p elf/grub || err "cannot create directory, elf/grub"
-
-	rm -f elf/grub/* || err "cannot delete files in directory, elf/grub/"
+		mkdir -p elf/grub || \
+		    err "handle_dependencies: cannot mkdir elf/grub"
+	rm -f elf/grub/* || \
+	    err "handle_dependencies: cannot rm inside: elf/grub/"
 }
 
 build_grub_payloads()
@@ -85,15 +88,17 @@ build_grub_elf()
 	    --modules="${grub_modules}" \
 	    --install-modules="${grub_install_modules}" \
 	    ${gcfg} ${grubk} || \
-	    err "cannot create grub payload (grub-mkstandalone)"
+	    err "build_grub_elf: cannot build grub payload (grub-mkstandalone)"
 }
 
 create_grub_config()
 {
 	sed "s/usqwerty/${keymap}/" < ${grubcfgsdir}/config/grub.cfg \
-	    > elf/grub/grub_${keymap}.cfg || err "sed failed: grub.cfg"
+	    > elf/grub/grub_${keymap}.cfg || \
+	    err "create_grub_config: sed failed: grub.cfg"
 	sed "s/grubtest.cfg/grub.cfg/" < elf/grub/grub_${keymap}.cfg \
-	    > elf/grub/grub_${keymap}_test.cfg || err "sed failed: grubtest.cfg"
+	    > elf/grub/grub_${keymap}_test.cfg || \
+	    err "create_grub_config: sed failed: grubtest.cfg"
 }
 
 main $@
diff --git a/resources/scripts/build/grub/utils b/resources/scripts/build/grub/utils
index 3ef78227..f0449ed7 100755
--- a/resources/scripts/build/grub/utils
+++ b/resources/scripts/build/grub/utils
@@ -34,12 +34,18 @@ main()
 build_grub()
 {
 	(
-	cd grub/ || err "cd"
-	[ ! -d Makefile ] || make distclean || err "make-distclean"
-	./bootstrap --gnulib-srcdir=gnulib/ --no-git || err "bootstrap"
-	./autogen.sh || err "autogen"
-	./configure --with-platform=coreboot || err "configure"
-	make -j$(nproc) || err "make"
+	cd grub/ || \
+	    err "build_grub: cd"
+	[ ! -d Makefile ] || make distclean || \
+	    err "build_grub: make-distclean"
+	./bootstrap --gnulib-srcdir=gnulib/ --no-git || \
+	    err "build_grub: gnulib bootstrap"
+	./autogen.sh || \
+	    err "build_grub: autogen.sh"
+	./configure --with-platform=coreboot || \
+	    err "build_grub: autoconf"
+	make -j$(nproc) || \
+	    err "build_grub: make"
 	)
 }
 
diff --git a/resources/scripts/build/release/roms b/resources/scripts/build/release/roms
index 8afba9bf..bdc54c9b 100755
--- a/resources/scripts/build/release/roms
+++ b/resources/scripts/build/release/roms
@@ -50,20 +50,26 @@ main()
 
 init_check()
 {
-	[ -f version ] && \
+	if [ -f version ]; then
 		version="$(cat version)"
 	[ -f versiondate ] && \
 		versiondate="$(cat versiondate)"
 	[ ! -d "bin/" ] && \
-		err "no ROMs built yet. exiting"
-	[ ! -d "release/" ] && \
-		mkdir -p release/
-	[ ! -d "release/${version}/" ] && \
-		mkdir -p "release/${version}/"
-	[ -d "release/${version}/roms/" ] && \
-		rm -Rf "release/${version}/roms/"
-	[ ! -d "release/${version}/roms/" ] && \
-		mkdir -p "release/${version}/roms/"
+		err "init_check: no ROMs built yet (error)"
+	[ -d "release/" ] || \
+		mkdir -p release/ || \
+		    err "init_check: !mkdir -p release/"
+	[ -d "release/${version}/" ] || \
+		mkdir -p "release/${version}/" || \
+		    err "init_check: !mkdir -p release/${version}/"
+	[ ! -d "release/${version}/roms/" ] || \
+		rm -Rf "release/${version}/roms/" || \
+		    err "init_check: !rm -Rf release/${version}/roms/"
+
+	if [ ! -d "release/${version}/roms/" ]; then
+		mkdir -p "release/${version}/roms/" || \
+		    err "init_check: !mkdir -p release/${version}/roms/"
+	fi
 }
 
 make_archive()
@@ -90,24 +96,28 @@ make_archive()
 	    CONFIG_INCLUDE_SMSC_SCH5545_EC_FW="n"
 
 	# remove ME/MRC/EC firmware from ROM images
-	if [ "${CONFIG_HAVE_ME_BIN}" = "y" ] \
-			|| [ "${target}" = "e6400nvidia_4mb" ]; then
+	if [ "${CONFIG_HAVE_ME_BIN}" = "y" ] || \
+	    [ "${target}" = "e6400nvidia_4mb" ]; then
 		strip_archive "${romdir}"
 	fi
 
 	printf "Generating release/%s/roms/%s-%s_%s.tar.xz\n" \
-			"${version}" "${projectname}" \
-			"${version}" "${target##*/}"
-	printf "%s\n" "${version}" > "${romdir}/version"
-	printf "%s\n" "${versiondate}" > "${romdir}/versiondate"
-	printf "%s\n" "${projectname}" > "${romdir}/projectname"
+	    "${version}" "${projectname}" "${version}" "${target##*/}"
+	printf "%s\n" "${version}" > "${romdir}/version" || \
+	    err "make_archive: can't create ${romdir}/version"
+	printf "%s\n" "${versiondate}" > "${romdir}/versiondate" || \
+	    err "make_archive: can't create ${romdir}/versiondate"
+	printf "%s\n" "${projectname}" > "${romdir}/projectname" || \
+	    err "make_archive: can't create ${romdir}/projectname"
 
 	f="release/${version}/roms/${projectname}-${version}_${target##*/}"
-	tar -c "${romdir}/" | xz -9e > "${f}.tar.xz"
+	tar -c "${romdir}/" | xz -9e > "${f}.tar.xz" || \
+	    err "make_archive: can't create ${f}.tar.xz"
 
 	if [ -d "${romdir}_tmp" ]; then
-		rm -Rf "${romdir}"
-		mv "${romdir}_tmp" "${romdir}"
+		rm -Rf "${romdir}" || err "make_archive: !rm -Rf ${romdir}"
+		mv "${romdir}_tmp" "${romdir}" || \
+		    err "make_archive: !mv \"${romdir}_tmp\" \"${romdir}\""
 	fi
 }
 
@@ -117,21 +127,25 @@ strip_archive()
 
 	[ -d coreboot/${tree} ] || \
 		./fetch_trees coreboot ${tree} || \
-		    err "cannot fetch source tree, coreboot/${tree}"
+		    err "strip_archive: coreboot/${tree}: can't fetch source"
 	./build coreboot utils ${tree} || \
-	    err "cannot build utils for coreboot/${tree}"
+	    err "strip_archive: coreboot/${tree}: can't build utils"
 
-	rm -Rf "${romdir}_tmp" # dirty hack, to reduce disk io later
+	# dirty hack, to reduce disk io later
 	# rather than using /tmp, which might not be tmpfs
-	mkdir "${romdir}_tmp"
+	rm -Rf "${romdir}_tmp" || err "strip_archive: !rm -Rf ${romdir}_tmp"
+	mkdir "${romdir}_tmp" || err "strip_archive: !mkdir ${romdir}_tmp"
 
 	# Hash the rom before removing blobs
-	[ -f "${romdir}/blobhashes" ] || \
-		printf "ROMs must match these hashes after blob insertion:" \
-		    > "${romdir}/blobhashes"
+	rm -f "${romdir}/blobhashes" || \
+	    err "strip_archive: !rm -f ${blobdir}/blobhashes"
+	touch "${romdir}/blobhashes" || \
+	    err "strip_archive: !touch ${blobdir}/blobhashes"
+
 	(
-	cd ${romdir} || err "subshell: cd"
-	sha1sum *.rom >> blobhashes || err "subshell: sha1sum"
+	cd ${romdir} || err "strip_archive: !cd ${romdir}"
+	sha1sum *.rom >> blobhashes || \
+	    err "strip_archive: ${romdir}: !sha1sum *.rom >> blobhashes"
 	)
 
 	for romfile in "${romdir}"/*.rom; do
@@ -147,32 +161,35 @@ strip_rom_image()
 
 	if [ "${CONFIG_HAVE_ME_BIN}" = "y" ]; then
 		${ifdtool} --nuke me "${romfile}" || \
-		    err "cannot nuke Intel ME region on file, ${romfile}"
-		mv "${romfile}" "${romdir}_tmp"/
-		mv "${romfile}.new" "${romfile}"
+		    err "strip_rom_images: ${romfile}: cannot nuke Intel ME"
+		mv "${romfile}" "${romdir}_tmp" || \
+		    err "strip_rom_images: !mv ${romfile} ${romdir}_tmp"
+		mv "${romfile}.new" "${romfile}" || \
+		    err "strip_rom_images: !mv ${romfile}.new ${romfile}"
 	fi
 
 	if [ "${CONFIG_HAVE_MRC}" = "y" ]; then
 		${cbfstool} "${romfile}" remove -n mrc.bin || \
-		    err "cannot remove mrc.bin from file, ${romfile}"
+		    err "strip_rom_images: ${romfile}: cannot nuke mrc.bin"
 		${cbfstool} "${romfile}" print || :
 	fi
 
 	if [ "${CONFIG_KBC1126_FIRMWARE}" = "y" ]; then
 		${cbfstool} "${romfile}" remove -n ecfw1.bin || \
-		    err "cannot remove ecfw1.bin from file, ${romfile}"
+		    err "strip_rom_images: ${romfile}: can't nuke ecfw1.bin"
 		${cbfstool} "${romfile}" remove -n ecfw2.bin || \
-		    err "cannot remove ecfw2.bin from file, ${romfile}"
+		    err "strip_rom_images: ${romfile}: can't nuke ecfw2.bin"
 	fi
 
 	[ "${CONFIG_INCLUDE_SMSC_SCH5545_EC_FW}" != "y" ] || \
 		${cbfstool} "${romfile}" remove -n sch5545_ecfw.bin || \
-		    err "cannot remove sch5545_ecfw.bin from file, ${romfile}"
+		    err "strip_rom_images: ${romfile}: can't nuke sch5545ec fw"
 
 	# TODO: replace this board-specific hack
-	[ "${target}" != "e6400nvidia_4mb" ] || \
+	if [ "${target}" = "e6400nvidia_4mb" ]; then
 		${cbfstool} "${romfile}" remove -n "pci10de,06eb.rom" || \
-		    err "cannot remove pci10de,06eb.rom from file, ${romfile}"
+		    err "strip_rom_images: ${romfile}: can't nuke e6400 vga rom"
+	fi
 }
 
 main $@
diff --git a/resources/scripts/build/release/src b/resources/scripts/build/release/src
index 3f9feb9b..498bfabb 100755
--- a/resources/scripts/build/release/src
+++ b/resources/scripts/build/release/src
@@ -65,55 +65,68 @@ create_release_directory()
 	dirname="${projectname}-${version}_src"
 	srcdir="${reldir}/${dirname}"
 
-	[ ! -d "release/" ] && mkdir -p release/
-	[ ! -d "${reldir}/" ] && mkdir -p "${reldir}/"
-	[ -d "${srcdir}/" ] && \
-		rm -Rf "${srcdir}/"
-	[ -f "${srcdir}.tar.xz" ] && \
-		rm -f "${srcdir}.tar.xz/"
+	[ -d "release/" ] || mkdir -p release/ || \
+	    err "create_release_directory: !mkdir -p release/"
+	[ -d "${reldir}/" ] || mkdir -p "${reldir}/" || \
+	    err "create_release_directory: !mkdir -p ${reldir}/"
+	[ ! -d "${srcdir}/" ] || rm -Rf "${srcdir}/" || \
+	    err "create_release_directory: !rm -Rf ${srcdir}/"
+	[ ! -f "${srcdir}.tar.xz" ] || \
+		rm -f "${srcdir}.tar.xz/" || \
+		    err "create_release_directory: !rm -f ${srcdir}.tar.xz/"
 
-	mkdir -p "${srcdir}/"
-	printf "%s" "${version}" > "${srcdir}"/version
+	mkdir -p "${srcdir}/" || \
+	    err "create_release_directory: !mkdir -p ${srcdir}/"
+	printf "%s" "${version}" > "${srcdir}"/version || \
+	    err "create_release_directory: ${srcdir}/version: can't create file"
 }
 
 download_modules()
 {
 	for modname in ${trees_fetch_list}; do
-		[ ! -d "${modname}" ] && ./fetch_trees ${modname}
+		[ -d "${modname}" ] || ./fetch_trees ${modname} || \
+		    err "download_modules: couldn't download ${modname} trees"
 	done
 	for modname in ${simple_fetch_list}; do
-		[ ! -d "${modname}/" ] && ./fetch ${modname}
+		[ -d "${modname}/" ] || ./fetch ${modname} || \
+		    err "download_modules: couldn't download ${modname} repo"
 	done
 }
 
 copy_files()
 {
 	for dir in ${simple_fetch_list} ${dirlist}; do
-		cp -R "${dir}/" "${srcdir}/"
+		cp -R "${dir}/" "${srcdir}/" || \
+		    err "copy_files: !cp -R ${dir}/ ${srcdir}/"
 	done
 
 	copy_blobs
 
 	for i in ${filelist}; do
 		if [ ! -f "${i}" ]; then
-			rm -Rf "${srcdir}"
-			err "file '${1}' does not exist"
+			rm -Rf "${srcdir}" || \
+			    err "copy_files: !rm -Rf ${srcdir}"
+			err "copy_files: file '${1}' does not exist"
 		fi
-		cp ${i} "${srcdir}/"
+		cp "${i}" "${srcdir}/" || \
+		    err "copy_files: !cp ${i} ${srcdir}/"
 	done
 }
 
 copy_blobs()
 {
-	mkdir -p "${srcdir}"/blobs
+	mkdir -p "${srcdir}"/blobs || \
+	    err "copy_blobs: !mkdir -p ${srcdir}/blobs"
 	# do not copy intel ME etc, but do copy ifd/gbe files
 	for i in t440p xx20 xx30 hp8200sff hp_ivybridge hp_sandybridge \
 	    hp8300usdt t1650; do
 		for j in ifd gbe 4_ifd 8_ifd 12_ifd 16_ifd; do
 			[ -f "blobs/${i}/${j}.bin" ] || continue
 			[ -e "${srcdir}/blobs/${i}" ] || \
-				mkdir -p "${srcdir}/blobs/${i}"
-			cp blobs/${i}/${j}.bin "${srcdir}/blobs/${i}"
+				mkdir -p "${srcdir}/blobs/${i}" || \
+				    err "copy_blobs: ! -d ${srcdir}/blobs/${i}"
+			cp blobs/${i}/${j}.bin "${srcdir}/blobs/${i}" || \
+			    err "copy_blobs: ! -f ${srcdir}/blobs/${i}"
 		done
 	done
 }
@@ -121,45 +134,64 @@ copy_blobs()
 purge_files()
 {
 	(
-	cd "${srcdir}/coreboot/" || err "cd1"
+	cd "${srcdir}/coreboot/" || err "purge_files 1: !cd ${srcdir}/coreboot/"
 	for i in *; do
-		[ ! -d "${i}" ] && continue
+		[ -d "${i}" ] || continue
 		(
-		cd "${i}/" || err "cd2"
-		make distclean || err "make-distclean1"
+		cd "${i}/" || \
+		    err "purge_files 2: !cd ${i}/"
+		make distclean || err "purge_files 1: ${i}: !make distclean"
 		)
-		make clean -BC default/util/kbc1126/ || err "make-clean1"
+		make clean -BC default/util/kbc1126/ || \
+		    err "purge_files 1: default/util/kbc1126: ! make clean"
 	done
 	)
 
 	(
-	cd "${srcdir}/" || err "cd3"
-	./build clean all || err "build-clean1"
+	cd "${srcdir}/" || \
+	    err "purge_files 3: !cd ${srcdir}/"
+	./build clean all || \
+	    err "purge_files 1: ! ./build clean all"
 	for p in bios_extract flashrom grub ich9utils memtest86plus uefitool; do
-		./build src for -c "${p}"
+		./build src for -c "${p}" || \
+		    err "purge_files: !./build src for -c ${p}"
 	done
-	make clean -BC util/nvmutil || err "make-clean2"
-	make clean -BC util/ich9utils || err "make-clean3"
-	make clean -BC util/spkmodem_recv || err "make-clean4"
-	make clean -BC util/e6400-flash-unlock || err "make-clean5"
+	make clean -BC util/nvmutil || \
+	    err "purge_files 2: !make clean -BC util/nvmutil"
+	make clean -BC util/ich9utils || \
+	    err "purge_files 3: !make clean -BC util/ich9utils"
+	make clean -BC util/spkmodem_recv || \
+	    err "purge_files 4: !make clean -BC util/spkmodem_recv"
+	make clean -BC util/e6400-flash-unlock || \
+	    err "purge_files 5: !make clean -BC util/e6400-flash-unlock"
 
-	rm -Rf coreboot/coreboot/ || err "rm-rf1"
+	rm -Rf coreboot/coreboot/ || \
+	    err "purge_files 1: !rm -Rf coreboot/coreboot/"
 	rm -Rf .git .gitignore */.git* coreboot/*/.git* \
-	    coreboot/*/3rdparty/*/.git* || err "rm-rf2"
-	rm -Rf coreboot/*/util/nvidia/cbootimage/.git* || err "rm-rf3"
-	rm -Rf u-boot/u-boot/ u-boot/*/.git* || err "rm-rf4"
+	    coreboot/*/3rdparty/*/.git* || \
+	    err "purge_files rm-rf2: can't purge .git files/directories"
+	rm -Rf coreboot/*/util/nvidia/cbootimage/.git* || \
+	    err "purge_files 3: !rm -Rf coreboot/*/util/nvidia/cbootimage/.git*"
+	rm -Rf u-boot/u-boot/ u-boot/*/.git* || \
+	    err "purge_files 4: ¬rm -Rf u-boot/u-boot/ u-boot/*/.git*"
 	)
 }
 
 create_release_archive()
 {
 	(
-	cd "${reldir}/" || err "cd4"
-	printf "%s\n" "${version}" > "${dirname}/version"
-	printf "%s\n" "${versiondate}" > "${dirname}/versiondate"
-	printf "%s\n" "${projectname}" > "${dirname}/projectname"
-	tar -c "${dirname}/" | xz -9e >"${dirname}.tar.xz" || err "tar"
-	rm -Rf "${dirname}/" || err "rm-rf5"
+	cd "${reldir}/" || \
+	    err "create_release_archive 4: !cd ${reldir}/"
+	printf "%s\n" "${version}" > "${dirname}/version" || \
+	    err "create_release_archive: can't create ${dirname}/version"
+	printf "%s\n" "${versiondate}" > "${dirname}/versiondate" || \
+	    err "create_release_archive: can't create ${dirname}/versiondate"
+	printf "%s\n" "${projectname}" > "${dirname}/projectname" || \
+	    err "create_release_archive: can't create ${dirname}/projectname"
+	tar -c "${dirname}/" | xz -9e >"${dirname}.tar.xz" || \
+	    err "create_release_archive: can't create ${dirname}.tar.xz"
+	rm -Rf "${dirname}/" || \
+	    err "create_release_archive 5: !rm -Rf ${dirname}/"
 	)
 }
 
diff --git a/resources/scripts/build/src/for b/resources/scripts/build/src/for
index 6945b9f9..fd7f84f3 100755
--- a/resources/scripts/build/src/for
+++ b/resources/scripts/build/src/for
@@ -53,24 +53,28 @@ main()
 handle_dependencies()
 {
 	[ -d "${project}" ] || ./fetch "${project%/*}" || \
-	    err "Cannot download project, ${project%/*}"
-	[ -d "${project}" ] || err "Project, ${project%/*}, not downloaded"
+	    err "handle_dependencies: can't fetch ${project%/*}"
+	[ -d "${project}" ] || \
+		err "handle_dependencies: ${project%/*} not downloaded"
 
 	if [ "${project}" = "uefitool" ]; then
 		(
-		cd uefitool || err "cannot cd to uefitool/"
-		cmake UEFIExtract/ || err "cannot cmake UEFIExtract"
+		cd uefitool || err "handle_dependencies: !cd uefitool"
+		cmake UEFIExtract/ || \
+		    err "handle_dependencies: !cmake UEFIExtract/"
 		)
 	fi
 }
 
 run_make_command()
 {
-	[ ! -z "${mode}" ] || \
-		make -C "${project}" || err "'make' failed (${project})"
-	[ -z "${mode}" ] || \
+	if [ -z "${mode}" ]; then
+		make -C "${project}" || \
+		    err "run_make_command: !make -C ${project}"
+	else
 		make -C "${project}" distclean || make -C "${project}" clean \
-		    || err "cannot clean project src, ${project}"
+		    || err "run_make_command: ${project}: make-clean failed"
+	fi
 }
 
 main $@
diff --git a/resources/scripts/handle/config/file b/resources/scripts/handle/config/file
index 6dc0dbeb..9f26fc69 100755
--- a/resources/scripts/handle/config/file
+++ b/resources/scripts/handle/config/file
@@ -78,14 +78,13 @@ main()
 	# Build for all targets if no argument is given
 	if [ "$#" -eq 0 ]; then
 		for target_dir in "${cfgsdir}"/*; do
-			[ ! -d "${target_dir}/config/" ] && \
-				continue
+			[ -d "${target_dir}/config/" ] || continue
 			set -- "$@" "${target_dir#${cfgsdir}/}"
 		done
 	fi
 
-	[ ! -d "${elfdir}" ] && [ "${mode}" = "all" ] && \
-		mkdir -p ${elfdir}/
+	[ -d "${elfdir}" ] || [ "${mode}" != "all" ] || \
+		mkdir -p ${elfdir}/ || fail "cannot create directory: ${elfdir}"
 
 	for x in "$@"; do
 		target="${x}"
@@ -93,11 +92,12 @@ main()
 		    "${mode}" "${project}" "${target}"
 		[ "${project}" != "coreboot" ] || [ "${mode}" != "all" ] || \
 			./update blobs download ${target} || fail "blobutil"
-		handle_defconfig || err "error handling config file"
+		handle_defconfig || fail "error handling config file"
 	done
 
-	[ "${mode}" = "all" ] && \
-		printf "Done! The files are stored under %s/\n\n" ${elfdir}
+	if [ "${mode}" = "all" ]; then
+		printf "Done! The files are stored under %s/\n\n" "${elfdir}"
+	fi
 }
 
 handle_defconfig()
@@ -111,7 +111,7 @@ handle_defconfig()
 		config_name="${config#$target_dir/config/}"
 
 		printf "build/defconfig/%s %s: handling config %s\n" \
-		    ${project} ${target} ${config_name}
+		    "${project}" "${target}" "${config_name}"
 
 		[ "${mode}" != "all" ] || check_config || continue
 		run_make_command
@@ -128,24 +128,25 @@ handle_dependencies()
 	arch="undefined"
 
 	[ ! -f "${target_dir}/target.cfg" ] && \
-		fail "build/${project} ${target}: Missing target.cfg"
+		fail "handle_dependencies: ${target_dir}: missing target.cfg"
 
 	# Override the above defaults using target.cfg
 	. "${target_dir}/target.cfg" # source
 
 	[ "${tree}" = "undefined" ] && \
-		fail "build/${project} %{target}: tree undefined"
+		fail "handle_dependencies: ${target_dir}: tree undefined"
 	[ "${arch}" = "undefined" ] && \
-		fail "build/${project} ${target}: undefined cpu type"
+		fail "handle_dependencies: ${target_dir}: undefined cpu type"
 
 	codedir="${project}/${tree}"
 	[ -d "${codedir}" ] || \
-		./fetch_trees "${project}" "$target" || \
-		    fail "cannot fetch source tree, ${project}/${target}"
+		./fetch_trees "${project}" "${target}" || \
+		    fail "handle_dependencies: can't fetch ${project}/${target}"
 
 	# u-boot and coreboot are both compiled with coreboot's crossgcc
 	if [ "${project}" = "coreboot" ] || [ "${project}" = "u-boot" ]; then
-		[ "${mode}" != "all" ] || check_cross_compiler || fail "crossgcc"
+		[ "${mode}" != "all" ] || check_cross_compiler || \
+		    fail "handle_dependencies ${project}/${target}: crossgcc"
 	fi
 }
 
@@ -164,9 +165,10 @@ check_cross_compiler()
 	[ "${project}" = "u-boot" ] && \
 		cbdir="coreboot/cros" # u-boot only used on coreboot/cros
 	# only true if not building coreboot:
+	ctarget="${cbdir#coreboot/}"
 	[ -d "${cbdir}" ] || \
-		./fetch_trees coreboot ${cbdir#coreboot/} || \
-		    fail "check_cross_compiler"
+		./fetch_trees coreboot ${ctarget} || \
+		    fail "check_cross_compiler: can't fetch coreboot/${ctarget}"
 
 	if [ "${arch}" = "x86_32" ] || [ "${arch}" = "x86_64" ]; then
 		[ -d "${cbdir}/util/crossgcc/xgcc/i386-elf/" ] || \
@@ -205,39 +207,50 @@ check_cross_compiler()
 check_config()
 {
 	[ ! -f "${config}" ] && \
-		fail "build/${project} ${target}: configs missing"
+		fail "check_config: ${project}/${target}: configs missing"
 
 	dest_dir="${elfdir}/${target}/${config_name}"
+	# TODO: very hacky check. do it properly (based on build.list)
 	for elftest in "${dest_dir}"/*; do
 		if [ -f "${elftest}" ]; then
 			printf "Build already exists, so skipping build\n" 1>&2
 			return 1
 		fi
 	done
-	mkdir -p "${dest_dir}"
+	mkdir -p "${dest_dir}" || \
+	    fail "check_config: cannot mkdir: ${dest_dir}"
 }
 
 run_make_command()
 {
-	make -C "${codedir}" distclean || fail "run_make_command"
+	make -C "${codedir}" distclean || \
+	    make -C "${codedir}" clean || \
+	    fail "run_make_command: make distclean/clean failed"
 
-	cp "${config}" "${codedir}/.config" || fail "run_make_command"
+	cp "${config}" "${codedir}/.config" || \
+	    fail "run_make_command: can't copy config for: ${project}/${target}"
 	[ "${mode}" != "all" ] || make -C "${codedir}" silentoldconfig || \
 	    make -C "${codedir}" oldconfig || : # don't error on oldconfig
 
-	[ "${project}" = "coreboot" ] && [ "${mode}" = "all" ] && \
-		printf "%s\n" "${our_version}" > "${codedir}/.coreboot-version"
-	make -C "${codedir}" -j$(nproc) ${mode} || fail "run_make_command"
+	if [ "${project}" = "coreboot" ] && [ "${mode}" = "all" ]; then
+		printf "%s\n" "${our_version}" >"${codedir}/.coreboot-version" \
+		    || fail "run_make_command: ${codedir}: can't set version"
+	fi
+	make -C "${codedir}" -j$(nproc) ${mode} || \
+	    fail "run_make_command: make-all: ${codedir} (${project}/${target})"
 }
 
 copy_elf()
 {
 	for f in $(cat "${listfile}"); do
-		[ -f "${codedir}/$f" ] && cp "${codedir}/${f}" "${dest_dir}/"
+		[ ! -f "${codedir}/$f" ] || \
+		    cp "${codedir}/${f}" "${dest_dir}/" || \
+		    fail "copy_elf: cannot copy elf file"
 	done
 
 	make -C "${codedir}" distclean || \
-	    make -C "${codedir}" clean || fail "copy_elf"
+	    make -C "${codedir}" clean || \
+	    fail "copy_elf: clean: ${codedir} (${project}/${target})"
 }
 
 fail()
@@ -246,7 +259,7 @@ fail()
 		make -C "${codedir}" distclean \
 		    || make -C "${codedir}" clean || :
 
-	err "build/defconfig error ${1}"
+	err "${1}"
 }
 
 main $@
diff --git a/resources/scripts/misc/versioncheck b/resources/scripts/misc/versioncheck
index 9ca82091..73fbb140 100755
--- a/resources/scripts/misc/versioncheck
+++ b/resources/scripts/misc/versioncheck
@@ -19,6 +19,10 @@
 [ "x${DEBUG+set}" = 'xset' ] && set -v
 set -u
 
+. "include/err.sh"
+
+project="$(cat projectname)"
+
 version="version-unknown"
 [ -f version ] && version="$(cat version)"
 version_="${version}"
@@ -37,3 +41,8 @@ if [ -e ".git" ]; then
 	    versiondate="${versiondate_}"
 	printf "%s\n" "${versiondate}" > versiondate
 fi
+
+if [ "${versiondate}" = "version-date-unknown" ] || \
+    [ "${version}" = "version-unknown" ]; then
+	err "cannot determine ${projectname} revision"
+fi
diff --git a/resources/scripts/update/blobs/download b/resources/scripts/update/blobs/download
index c1babd13..422f0b3c 100755
--- a/resources/scripts/update/blobs/download
+++ b/resources/scripts/update/blobs/download
@@ -52,12 +52,15 @@ CONFIG_SMSC_SCH5545_EC_FW_FILE=""
 
 main()
 {
+	[ $# -gt 0 ] || \
+		err "No argument given"
+
 	board="${1}"
 	boarddir="${cbcfgsdir}/${board}"
 
-	[ ! -d "${boarddir}" ] && \
+	[ -d "${boarddir}" ] || \
 		err "Board target, ${board}, not defined"
-	[ ! -f "${boarddir}/target.cfg" ] && \
+	[ -f "${boarddir}/target.cfg" ] || \
 		err "Target missing target.cfg"
 
 	no_config="printf \"No config for target, %s\\n\" ${board} 1>&2; exit 0"
@@ -65,7 +68,7 @@ main()
 		[ -f "${x}" ] && no_config=""
 	done
 	eval "${no_config}"
-	
+
 	detect_firmware || exit 0
 	scan_sources_config
 
@@ -89,7 +92,7 @@ detect_firmware()
 	[ "${CONFIG_INCLUDE_SMSC_SCH5545_EC_FW}" = "y" ] && \
 	    needs="${needs} SCH5545EC"
 	[ -z ${needs+x} ] && \
-		printf 'No binary blobs needed for this board\n' && \
+		printf "No binary blobs needed for this board\n" && \
 		return 1
 	printf "Firmware needed for board '%s':\n%s\n" ${board} ${needs}
 }
@@ -155,16 +158,19 @@ build_dependencies()
 {
 	[ -d ${cbdir} ] || \
 		./fetch_trees coreboot ${cbdir##*/} || \
-		    err "can't download to ${cbdir}"
+		    err "build_dependencies: can't fetch ${cbdir}"
 	for d in uefitool biosutilities bios_extract me_cleaner; do
 		[ -d "${d}" ] && continue
-		./fetch ${d} || err "can't download ${d}"
+		./fetch "${d}" || \
+		    err "build_dependencies: can't fetch ${d}"
 	done
 	[ -f uefitool/uefiextract ] || \
-		./build src for -b uefitool || err "can't build uefitool"
-	[ -f ${cbdir}/util/kbc1126/kbc1126_ec_dump ] || \
+		./build src for -b uefitool || \
+		    err "build_dependencies: can't build uefitool"
+	if [ ! -f ${cbdir}/util/kbc1126/kbc1126_ec_dump ]; then
 		make -BC ${cbdir}/util/kbc1126 || \
-		    err "can't build kbc1126_ec_dump"
+		    err "build_dependencies: can't build kbc1126_ec_dump"
+	fi
 }
 
 download_blobs()
@@ -184,8 +190,9 @@ download_blobs()
 		esac
 	done
 	
-	[ -z ${_failed+x} ] || \
-		err "failed to obtain ${_failed}\nTry manual extraction?"
+	if [ ! -z ${_failed+x} ]; then
+		err "download_blobs: can't download blobs: ${_failed}\n"
+	fi
 }
 
 download_blob_intel_me()
@@ -203,11 +210,13 @@ extract_blob_intel_me()
 	_me_destination=${CONFIG_ME_BIN_PATH#../../}
 
 	[ -d "${_me_destination%/*}" ] || \
-		mkdir -p ${_me_destination%/*}
-	[ -d "${appdir}" ] && \
-		rm -Rf ${appdir}
+		mkdir -p ${_me_destination%/*} || \
+		    err "extract_blob_intel_me: mkdir ${_me_destination%/*}"
+	[ ! -d "${appdir}" ] || \
+		rm -Rf "${appdir}" || \
+		    err "extract_blob_intel_me: can't rm -Rf \"${appdir}\""
 	if [ -f "${_me_destination}" ]; then
-		printf 'me already downloaded\n'
+		printf "Intel ME firmware already downloaded\n" 1>&2
 		return 0
 	fi
 
@@ -216,12 +225,16 @@ extract_blob_intel_me()
 	innoextract ${dl_path} -d ${appdir} || \
 	    7z x ${dl_path} -o${appdir} || \
 	    unar "${dl_path}" -o "${appdir}" || \
-	    err "Could not extract vendor update"
+	    err "extract_blob_intel_me: could not extract vendor update"
 
 	bruteforce_extract_blob_intel_me "$(pwd)/${_me_destination}" \
-	    "$(pwd)/${appdir}" || err "Could not extract Intel ME firmware"
+	    "$(pwd)/${appdir}" || \
+	    err "extract_blob_intel_me: could not extract Intel ME firmware"
 
-	printf "Truncated and cleaned me output to ${_me_destination}\n"
+	[ -f "${_me_destination}" ] || \
+		err "extract_blob_intel_me, ${board}: me.bin missing"
+
+	printf "Truncated and cleaned me output to: %s\n" "${_me_destination}"
 }
 
 # cursed, carcinogenic code. TODO rewrite it better
@@ -237,7 +250,8 @@ bruteforce_extract_blob_intel_me()
 
 	(
 	printf "Entering %s\n" "${cdir}"
-	cd "${cdir}" || err "cannot enter directory, ${cdir}"
+	cd "${cdir}" || \
+	    err "bruteforce_extract_blob_intel_me: can't cd \"${cdir}\""
 	for i in *; do
 		if [ -f "${_me_destination}" ]; then
 			# me.bin found, so avoid needless further traversal
@@ -247,37 +261,33 @@ bruteforce_extract_blob_intel_me()
 			continue
 		elif [ -f "${i}" ]; then
 			"${mecleaner}" -r -t -O "${sdir}/vendorfile" \
-					-M "${_me_destination}" "${i}" \
-				&& break # (we found me.bin)	
+			    -M "${_me_destination}" "${i}" \
+			    && break # (we found me.bin)	
 			"${mecleaner}" -r -t -O "${_me_destination}" "${i}" \
-				&& break # (we found me.bin)
+			    && break # (we found me.bin)
 			"${me7updateparser}" -O ${_me_destination} "${i}" \
-				&& break # (we found me.bin)
+			    && break # (we found me.bin)
 			_7ztest="${_7ztest}a"
 			7z x "${i}" -o${_7ztest} \
 			    || innoextract "${i}" -d  "${_7ztest}" \
 			    || unar "${i}" -o "${_7ztest}" \
 			    || continue
 			bruteforce_extract_blob_intel_me "${_me_destination}" \
-					"${cdir}/${_7ztest}"
+			    "${cdir}/${_7ztest}"
 		elif [ -d "$i" ]; then
 			bruteforce_extract_blob_intel_me "${_me_destination}" \
-					"${cdir}/${i}"
+			    "${cdir}/${i}"
 		else
 			printf "SKIPPING: %s\n" "${i}"
 			continue
 		fi
 		cdir="${1}"
-		cd "${cdir}"
+		cd "${cdir}" # audit note: we already checked this (see above)
 	done
 	)
 
-	rm -Rf "${sdir}"
-
-	if [ ! -f "${_me_destination}" ]; then
-		printf "me.bin not found in vendor update for: %s\n" ${board}
-		return 1
-	fi
+	rm -Rf "${sdir}" || \
+	    err "bruteforce_extract_blob_intel_me: can't rm -Rf \"${sdir}\""
 }
 
 download_ec()
@@ -295,39 +305,48 @@ extract_blob_kbc1126_ec()
 	_ec_destination=${CONFIG_KBC1126_FW1#../../}
 
 	[ -d "${_ec_destination%/*}" ] || \
-		mkdir -p "${_ec_destination%/*}"
-	[ -d "${appdir}" ] && \
-		rm -Rf "${appdir}"
+		mkdir -p "${_ec_destination%/*}" || \
+		    err "extract_blob_kbc1126_ec: !mkdir ${_ec_destination%/*}"
+	[ ! -d "${appdir}" ] || \
+		rm -Rf "${appdir}" || \
+		    err "extract_blob_kbc1126_ec: !rm -Rf ${appdir}"
 	if [ -f "${_ec_destination}" ]; then
-		printf "ec already downloaded\n"
+		printf "KBC1126 EC firmware already downloaded\n" 1>&2
 		return 0
 	fi
 
-	unar "${dl_path}" -o "${appdir}"
+	unar "${dl_path}" -o "${appdir}" || \
+	    err "extract_blob_kbc1126_ec: !unar \"${dl_path}\" -o \"${appdir}\""
 
 	(
-	cd "${appdir}/${dl_path##*/}"
+	cd "${appdir}/${dl_path##*/}" || \
+	    err "extract_blob_kbc1126_ec: !cd \"${appdir}/${dl_path##*/}\""
 
-	mv Rompaq/68*.BIN ec.bin
+	mv Rompaq/68*.BIN ec.bin || :
 	if [ ! -f ec.bin ]; then
 		unar -D ROM.CAB Rom.bin || \
 		    unar -D Rom.CAB Rom.bin || \
-		    unar -D 68*.CAB Rom.bin
-		mv Rom.bin ec.bin
+		    unar -D 68*.CAB Rom.bin || \
+		    err "extract_blob_kbc1126_ec: can't extract ec.bin"
+		mv Rom.bin ec.bin || \
+		    err "extract_blob_kbc1126_ec: *didn't* extract ec.bin"
 	fi
+	[ -f ec.bin ] || \
+	    err "extract_blob_kbc1126_ec: ${board}: can't extract ec.bin"
 
-	[ -f ec.bin ] || err "could not extract ec.bin for board, ${board}"
-	"${kbc1126_ec_dump}" ec.bin
+	"${kbc1126_ec_dump}" ec.bin || \
+	    err "extract_blob_kbc1126_ec: ${board}: can't extract ecfw1/2.bin"
 	)
 
+	ec_ex="y"
 	for i in 1 2; do
-		[ -f "${appdir}/${dl_path##*/}/ec.bin.fw${i}" ] && continue
-		printf "Could not extract EC firmware for: %s\n" \
-		    ${board}
-		return 1
+		[ -f "${appdir}/${dl_path##*/}/ec.bin.fw${i}" ] || ec_ex="n"
 	done
+	[ "${ec_ex}" = "y" ] || \
+	    err "extract_blob_kbc1126_ec: ${board}: didn't extract ecfw1/2.bin"
 
-	cp "${appdir}/${dl_path##*/}"/ec.bin.fw* "${_ec_destination%/*}/"
+	cp "${appdir}/${dl_path##*/}"/ec.bin.fw* "${_ec_destination%/*}/" || \
+	    err "extract_blob_kbc1126_ec: cant mv ecfw1/2 ${_ec_destination%/*}"
 }
 
 download_e6400vga()
@@ -345,37 +364,41 @@ extract_e6400vga()
 	_vga_destination=${CONFIG_VGA_BIOS_FILE#../../}
 
 	if [ -f "${_vga_destination}" ]; then
-		printf 'vga rom already downloaded\n'
+		printf "extract_e6400vga: vga rom already downloaded\n" 1>&2
 		return 0
 	fi
 	[ -d "${_vga_destination%/*}" ] || \
-		mkdir -p ${_vga_destination%/*}
-	[ -d "${appdir}" ] && \
-		rm -Rf ${appdir}
+		mkdir -p ${_vga_destination%/*} || \
+		    err "extract_e6400vga: can't mkdir ${_vga_destination%/*}"
+	[ ! -d "${appdir}" ] || \
+		rm -Rf ${appdir} || \
+		    err "extract_e6400vga: can't rm -Rf ${appdir}"
 
-	mkdir -p "${appdir}"
-	cp "${dl_path}" "${appdir}"
+	mkdir -p "${appdir}" || \
+	    err "extract_e6400vga: can't mkdir ${appdir}"
+	cp "${dl_path}" "${appdir}" || \
+	    err "extract_e6400vga: can't copy vendor update"
 
-	if [ "${e6400_vga_offset}" = "" ]; then
-		printf "E6400 VGA offset not defined\n"
-		return 1
-	elif [ "${e6400_vga_romname}" = "" ]; then
-		printf "E6400 VGA ROM name not defined\n"
-		return 1
-	fi
+	[ "${e6400_vga_offset}" = "" ] && \
+		err "extract_e6400vga: E6400 VGA offset not defined"
+	[ "${e6400_vga_romname}" = "" ] && \
+		err "extract_e6400vga: E6400 VGA ROM name not defined"
 
 	(
-	cd "${appdir}"
-	tail -c +${e6400_vga_offset} "${dl_path##*/}" \
-			| gunzip > bios.bin
+	cd "${appdir}" || \
+	    err "extract_e6400vga: can't cd ${appdir}"
+	tail -c +${e6400_vga_offset} "${dl_path##*/}" | gunzip > bios.bin || \
+	    err "extract_e6400vga: can't gunzip > bios.bin"
+
 	[ -f "bios.bin" ] || \
-		err "Could not extract bios.bin from Dell E6400 update"
+		err "extract_e6400vga: can't extract bios.bin from update"
 	"${e6400_unpack}" bios.bin || printf "TODO: fix dell extract util\n"
 	[ -f "${e6400_vga_romname}" ] || \
-		err "Could not extract VGA ROM from Dell E6400 BIOS update"
+		err "extract_e6400vga: can't extract vga rom from bios.bin"
 	)
 
-	cp "${appdir}"/"${e6400_vga_romname}" "${_vga_destination}"
+	cp "${appdir}"/"${e6400_vga_romname}" "${_vga_destination}" || \
+	    err "extract_e6400vga: can't copy vga rom to ${_vga_destination}"
 
 	printf "E6400 Nvidia ROM saved to: %s\n" "${_vga_destination}"
 }
@@ -398,16 +421,18 @@ extract_sch5545ec()
 	_sch5545ec_destination=${CONFIG_SMSC_SCH5545_EC_FW_FILE#../../}
 
 	if [ -f "${_sch5545ec_destination}" ]; then
-		printf 'sch5545 firmware already downloaded\n'
+		printf "sch5545 firmware already downloaded\n" 1>&2
 		return 0
 	fi
 
-	[ -d "${appdir}" ] rm -Rf "${appdir}"
+	[ ! -d "${appdir}" ] || rm -Rf "${appdir}" || \
+	    err "extract_sch5545ec: can't remove ${appdir}"
 
-	mkdir -p "${appdir}/"
-	cp "${dl_path}" "${appdir}/"
+	mkdir -p "${appdir}/" || err "extract_sch5545ec: !mkdir ${appdir}"
+	cp "${dl_path}" "${appdir}/" || \
+	    err "extract_sch5545ec: can't copy vendor update file"
 	python "${pfs_extract}" "${appdir}/${dlsum}" -e || \
-	    err "cannot extract archive (dell, sch5545)"
+	    err "extract_sch5545ec: can't extract from vendor update"
 
 	# full system ROM (UEFI), to extract with UEFIExtract:
 	_bios="${appdir}/${dlsum}_extracted/Firmware"
@@ -419,15 +444,16 @@ extract_sch5545ec()
 	_sch5545ec_fw="${_sch5545ec_fw}/0 Raw section/body.bin" # <-- this!
 
 	# this makes the file defined by _sch5545ec_fw available to copy
-	"${uefiextract}" "${_bios}" || err "cannot extract dell uefi image"
+	"${uefiextract}" "${_bios}" || \
+	    err "extract_sch5545ec: cannot extract from uefi image"
 
 	cp "${_sch5545ec_fw}" "${_sch5545ec_destination}" || \
-	    err "cannot copy sch5545ec firmware file"
+	    err "extract_sch5545ec: cannot copy sch5545ec firmware file"
 }
 
 fetch_update()
 {
-	printf "Fetching vendor update for board: %s\n" ${board}
+	printf "Fetching vendor update for board: %s\n" "${board}"
 
 	fw_type="${1}"
 	dl=""
@@ -450,39 +476,38 @@ fetch_update()
 		dl_bkup="${sch5545ec_dl_url_bkup}"
 		dlsum="${sch5545ec_dl_hash}"
 	else
-		printf "Unsupported download type: %s\n" ${fw_type}
-		return 1
+		err "fetch_update: Unsupported download type: ${fw_type}"
 	fi
 
-	if [ -z "${dl_url+x}" ] && [ "${fw_type}" != "e6400vga" ]; then
-		printf "No vendor update specified for board: %s\n" ${board}
-		return 1
-	fi
+	[ -z "${dl_url+x}" ] && [ "${fw_type}" != "e6400vga" ] && \
+		err "fetch_update ${fw_type}: dl_url unspecified for: ${board}"
 
 	dl_path=${blobdir}/cache/${dlsum}
-	mkdir -p ${blobdir}/cache
+	mkdir -p ${blobdir}/cache || err "fetch_update: !mkdir ${blobdir}/cache"
 
 	dl_fail="y"
 	vendor_checksum ${dlsum} && dl_fail="n"
 	for x in "${dl}" "${dl_bkup}"; do
 		[ "${dl_fail}" = "n" ] && break
-		rm -f "${dl_path}"
-		wget -U "${agent}" ${x} -O ${dl_path}
+		[ -z "${x}" ] && continue
+		rm -f "${dl_path}" || \
+		    err "fetch_update ${fw_type}: !rm -f ${dl_path}"
+		wget -U "${agent}" ${x} -O ${dl_path} || continue
 		vendor_checksum ${dlsum} && dl_fail="n"
 	done
 	if [ "${dl_fail}" = "y" ]; then
-		printf "Could not download blob file\n" 1>&2
-		return 1
+		printf "ERROR: invalid vendor updates for: %s\n" "${board}" 1>&2
+		err "fetch_update ${fw_type}: matched vendor update unavailable"
 	fi
 }
 
 vendor_checksum()
 {
 	if [ ! -f "${dl_path}" ]; then
-		printf "Vendor update not found on disk for: %s\n" ${board}
+		printf "Vendor update not found on disk for: %s\n" ${board} 1>&2
 		return 1
 	elif [ "$(sha1sum ${dl_path} | awk '{print $1}')" != "${1}" ]; then
-		printf "Bad checksum on vendor update for: %s\n" ${board}
+		printf "Bad checksum on vendor update for: %s\n" ${board} 1>&2
 		return 1
 	fi
 }
diff --git a/resources/scripts/update/blobs/extract b/resources/scripts/update/blobs/extract
index d7a68bf3..b6b3af3b 100755
--- a/resources/scripts/update/blobs/extract
+++ b/resources/scripts/update/blobs/extract
@@ -44,22 +44,27 @@ main()
 
 check_board()
 {
-	[ -f "${vendor_rom}" ] || \
-		err "file does not exist: ${vendor_rom}"
-	[ -d "${boarddir}" ] || \
-		err "build/roms ${board}: target not defined"
-	[ -f "${boarddir}/target.cfg" ] || \
-		err "build/roms ${board}: missing target.cfg"
+	if [ ! -f "${vendor_rom}" ]; then
+		err "check_board: ${board}: file does not exist: ${vendor_rom}"
+	elif [ ! -d "${boarddir}" ]; then
+		err "check_board: ${board}: target not defined"
+	elif [ ! -f "${boarddir}/target.cfg" ]; then
+		err "check_board: ${board}: missing target.cfg"
+	fi
 }
 
 build_dependencies()
 {
-	[ -d me_cleaner ] || \
-		./fetch me_cleaner || err "can't fetch me_cleaner"
-	[ -d ${cbdir} ] || \
-		./fetch_trees coreboot default || err "can't fetch coreboot"
-	[ -f ${ifdtool} ] || \
-		make -C "${ifdtool%/ifdtool}" || err "can't build ifdtool"
+	if [ ! -d me_cleaner ]; then
+		./fetch me_cleaner || \
+		    err "build_dependencies: can't fetch me_cleaner"
+	elif [ ! -d "${cbdir}" ]; then
+		./fetch_trees coreboot default || \
+		    err "build_dependencies: can't fetch coreboot"
+	elif [ ! -f "${ifdtool}" ]; then
+		make -C "${ifdtool%/ifdtool}" || \
+		    err "build_dependencies: can't build ifdtool"
+	fi
 }
 
 extract_blobs()
@@ -67,11 +72,11 @@ extract_blobs()
 	printf "extracting blobs for %s from %s\n" ${board} ${vendor_rom}
 
 	set -- "${boarddir}/config/"*
-	. ${1} 2>/dev/null
+	. "${1}"
 	. "${boarddir}/target.cfg"
 
 	[ "$CONFIG_HAVE_MRC" != "y" ] || \
-		./update blobs mrc || err "could not download mrc"
+		./update blobs mrc || err "extract_blobs: can't fetch mrc"
 
 	_me_destination=${CONFIG_ME_BIN_PATH#../../}
 	_gbe_destination=${CONFIG_GBE_BIN_PATH#../../}
@@ -81,11 +86,11 @@ extract_blobs()
 	extract_blob_intel_gbe_nvm
 
 	# Cleans up other files extracted with ifdtool
-	rm -f flashregion*.bin 2> /dev/null
+	rm -f flashregion*.bin || err "extract_blobs: !rm -f flashregion*.bin"
 
-	[ -f ${_ifd_destination} ] || err "Could not extract IFD"
+	[ -f ${_ifd_destination} ] || err "extract_blobs: Could not extract IFD"
 	printf "gbe, ifd, and me extracted to %s\n" \
-	    ${_me_destination%/*}
+	    "${_me_destination%/*}"
 }
 
 extract_blob_intel_me()
@@ -96,15 +101,16 @@ extract_blob_intel_me()
 		-M ${_me_destination} ${vendor_rom} -t -r -S || \
 	    ${me7updateparser} \
 		-O ${_me_destination} ${vendor_rom} || \
-	    err "me_cleaner failed to extract blobs from rom"
+	    err "extract_blob_intel_me: cannot extract from vendor rom"
 }
 
 extract_blob_intel_gbe_nvm()
 {
 	printf "extracting gigabit ethernet firmware"
-	./${ifdtool} -x ${vendor_rom}
+	./${ifdtool} -x ${vendor_rom} || \
+	    err "extract_blob_intel_gbe_nvm: cannot extract gbe.bin from rom"
 	mv flashregion*gbe.bin ${_gbe_destination} || \
-	    err 'could not extract gbe'
+	    err "extract_blob_intel_gbe_nvm: cannot move gbe.bin"
 }
 
 print_help()
diff --git a/resources/scripts/update/blobs/inject b/resources/scripts/update/blobs/inject
index a6f6c007..4ab0c366 100755
--- a/resources/scripts/update/blobs/inject
+++ b/resources/scripts/update/blobs/inject
@@ -67,27 +67,28 @@ main()
 
 	printf "Friendly reminder (this is *not* an error message):\n"
 	printf "Please always ensure that the files were inserted correctly.\n"
-	printf "Read https://libreboot.org/docs/install/ivy_has_common.html\n"
+	printf "Read: https://libreboot.org/docs/install/ivy_has_common.html\n"
 }
 
 check_board()
 {
 	if ! check_release ${archive} ; then
 		[ -f "${rom}" ] || \
-			err "\"${rom}\" is not a valid path"
+			err "check_board: \"${rom}\" is not a valid path"
 		[ -z ${rom+x} ] && \
-			err "no rom specified"
+			err "check_board: no rom specified"
 		[ ! -z ${board+x} ] || \
-			board=$(detect_board ${rom}) || \
-			    err "no board specified"
+			board=$(detect_board "${rom}")
 	else
 		release=true
 		releasearchive="${archive}"
-		board=$(detect_board ${archive})
+		board=$(detect_board "${archive}")
 	fi
 
 	boarddir="${cbcfgsdir}/${board}"
-	[ -d "${boarddir}" ] || err "board ${board} not found"
+	if [ ! -d "${boarddir}" ]; then
+		err "check_board: board ${board} not found"
+	fi
 }
 
 check_release()
@@ -122,18 +123,20 @@ detect_board()
 build_dependencies()
 {
 	[ -d "${cbdir}" ] || ./fetch_trees coreboot default
-	./build coreboot utils default || err "could not build cbutils"
+	./build coreboot utils default || \
+	    err "build_dependencies: could not build cbutils"
 	./update blobs download ${board} || \
-	    err "Could not download blobs for ${board}"
+	    err "build_dependencies: Could not download blobs for ${board}"
 }
 
 inject_blobs()
 {
 	if [ "${release}" = "true" ]; then
-		echo 'patching release file'
+		printf "patching release file\n"
 		patch_release_roms
 	else
-		patch_rom ${rom}
+		patch_rom "${rom}" || \
+		    err "inject_blobs: could not patch ${x}"
 	fi
 }
 
@@ -141,17 +144,17 @@ patch_release_roms()
 {
 	_tmpdir=$(mktemp -d "/tmp/${board}_tmpXXXX")
 	tar xf "${releasearchive}" -C "${_tmpdir}" || \
-	err 'could not extract release archive'
+	    err "patch_release_roms: could not extract release archive"
 
 	for x in ${_tmpdir}/bin/*/*.rom ; do
 		echo "patching rom $x"
-		patch_rom ${x} || err "could not patch ${x}"
+		patch_rom ${x} || err "patch_release_roms: could not patch ${x}"
 	done
 
 	(
 	cd ${_tmpdir}/bin/*
 	sha1sum --status -c blobhashes || \
-	err 'ROMs did not match expected hashes'
+	    err "patch_release_roms: ROMs did not match expected hashes"
 	)
 
 	if [ "${modifygbe}" = "true" ]; then
@@ -160,19 +163,31 @@ patch_release_roms()
 		done
 	fi
 
-	[ -d bin/release ] || mkdir -p bin/release
-	mv ${_tmpdir}/bin/* bin/release/ && \
-	    printf '%s\n' 'Success! Your ROMs are in bin/release'
+	[ -d bin/release ] || mkdir -p bin/release || \
+	    err "patch_release_roms: !mkdir -p bin/release"
+	mv "${_tmpdir}"/bin/* bin/release/ || \
+	    err "patch_release_roms: !mv ${_tmpdir}/bin/* bin/release/"
 
-	rm -r "${_tmpdir}"
+	printf "Success! Your ROMs are in bin/release\n"
+
+	rm -Rf "${_tmpdir}" || err "patch_release_roms: !rm -Rf ${_tmpdir}"
 }
 
 patch_rom()
 {
 	rom="${1}"
 
+	no_config="printf \"No configs on target, %s\\n\" ${board} 1>&2; exit 1"
+	for x in "${boarddir}"/config/*; do
+		[ -f "${x}" ] && no_config=""
+	done
+	eval "${no_config}"
+
+	[ -f "${boarddir}/target.cfg" ] || \
+	    err "patch_rom: file missing: ${boarddir}/target.cfg"
+
 	set -- "${boarddir}/config/"*
-	. ${1} 2>/dev/null
+	. "${1}"
 	. "${boarddir}/target.cfg"
 
 	[ "$CONFIG_HAVE_MRC" = "y" ] && \
@@ -189,6 +204,8 @@ patch_rom()
 		inject_blob_smsc_sch5545_ec "${rom}"
 	[ "${modifygbe}" = "true" ] && ! [ "${release}" = "true" ] && \
 		modify_gbe ${rom}
+
+	printf "ROM image successfully patched: %s\n" "${rom}"
 }
 
 inject_blob_intel_mrc()
@@ -216,7 +233,7 @@ inject_blob_intel_mrc()
 	# TODO: this logic should be tweaked to handle more platforms
 
 	${cbfstool} ${rom} add -f mrc/haswell/mrc.bin -n mrc.bin -t mrc \
-		-b 0xfffa0000 || err "cannot insert mrc.bin"
+	    -b 0xfffa0000 || err "inject_blob_intel_mrc: cannot insert mrc.bin"
 }
 
 inject_blob_intel_me()
@@ -225,14 +242,14 @@ inject_blob_intel_me()
 
 	rom="${1}"
 	[ -z ${CONFIG_ME_BIN_PATH} ] && \
-		err "CONFIG_ME_BIN_PATH not set"
+		err "inject_blob_intel_me: CONFIG_ME_BIN_PATH not set"
 
 	_me_location=${CONFIG_ME_BIN_PATH#../../}
 	[ ! -f "${_me_location}" ] && \
-		err "CONFIG_ME_BIN_PATH points to missing file"
+		err "inject_blob_intel_me: per CONFIG_ME_BIN_PATH: file missing"
 
 	${ifdtool} -i me:${_me_location} ${rom} -O ${rom} || \
-	    err "cannot insert me.bin"
+	    err "inject_blob_intel_me: cannot insert me.bin"
 }
 
 inject_blob_hp_kbc1126_ec()
@@ -247,19 +264,21 @@ inject_blob_hp_kbc1126_ec()
 	printf "adding hp kbc1126 ec firmware\n"
 
 	if [ "${_ec1_offset}" = "" ] || [ "${_ec1_offset}" = "" ]; then
-		err "EC offsets not declared for board, ${board}"
+		err "inject_blob_hp_kbc1126_ec: ${board}: offset not declared"
 	fi
 	if [ "${_ec1_location}" = "" ] || [ "${_ec2_location}" = "" ]; then
-		err "EC firmware path not declared for board, ${board}"
+		err "inject_blob_hp_kbc1126_ec: ${board}: EC path not declared"
 	fi
 	if [ ! -f "${_ec1_location}" ] || [ ! -f "${_ec2_location}" ]; then
-		err "EC firmware not downloaded for board: ${board}"
+		err "inject_blob_hp_kbc1126_ec: ${board}: ecfw not downloaded"
 	fi
 
 	${cbfstool} "${rom}" add -f ${_ec1_location} -n ecfw1.bin \
-	    -b ${_ec1_offset} -t raw || err "cannot insert ecfw1.bin"
+	    -b ${_ec1_offset} -t raw || \
+	    err "inject_blob_hp_kbc1126_ec: cannot insert ecfw1.bin"
 	${cbfstool} "${rom}" add -f ${_ec2_location} -n ecfw2.bin \
-	    -b ${_ec2_offset} -t raw || err "cannot insert ecfw2.bin"
+	    -b ${_ec2_offset} -t raw || \
+	    err "inject_blob_hp_kbc1126_ec: cannot insert ecfw2.bin"
 }
 
 inject_blob_dell_e6400_vgarom_nvidia()
@@ -273,15 +292,15 @@ inject_blob_dell_e6400_vgarom_nvidia()
 	printf "adding pci option rom\n"
 
 	if [ "${_vga_dir}" != "${pciromsdir}" ]; then
-		err "Invalid PCI ROM directory, ${_vga_dir}"
+		err "inject_blob_dell_e6400vga: invalid pcirom dir: ${_vga_dir}"
 	fi
 	if [ ! -f "${_vga_location}" ]; then
-		err "No such file exists, ${_vga_location}"
+		err "inject_blob_dell_e6400vga: ${_vga_location} doesn't exist"
 	fi
 
 	${cbfstool} ${rom} add -f "${_vga_location}" \
 	    -n "pci${CONFIG_VGA_BIOS_ID}.rom" -t optionrom || \
-	    err "cannot insert e6400 nvidia rom"
+	    err "inject_blob_dell_e6400vga: cannot insert vga oprom"
 }
 
 inject_blob_smsc_sch5545_ec()
@@ -291,11 +310,12 @@ inject_blob_smsc_sch5545_ec()
 	_sch5545ec_location="${CONFIG_SMSC_SCH5545_EC_FW_FILE#../../}"
 
 	if [ ! -f "${_sch5545ec_location}" ]; then
-		err "SCH5545 firmware file missing"
+		err "inject_blob_smsc_sch5545_ec: SCH5545 fw missing"
 	fi
 
 	"${cbfstool}" "${rom}" add -f "${_sch5545ec_location}" \
-	    -n sch5545_ecfw.bin -t raw || err "cannot insert sch5545_ecfw.bin"
+	    -n sch5545_ecfw.bin -t raw || \
+	    err "inject_blob_smsc_sch5545_ec: can't insert sch5545_ecfw.bin"
 }
 
 modify_gbe()
@@ -305,22 +325,22 @@ modify_gbe()
 	rom=${1}
 
 	[ -z ${CONFIG_GBE_BIN_PATH} ] && \
-		err "CONFIG_GBE_BIN_PATH not set"
+		err "modify_gbe: ${board}: CONFIG_GBE_BIN_PATH not set"
 
 	_gbe_location=${CONFIG_GBE_BIN_PATH#../../}
 
 	[ -f "${_gbe_location}" ] || \
-		err "CONFIG_GBE_BIN_PATH points to missing file"
+		err "modify_gbe: CONFIG_GBE_BIN_PATH points to missing file"
 	[ -f ${nvmutil} ] || \
-		make -C util/nvmutil || err 'failed to build nvmutil'
+		make -C util/nvmutil || err "modify_gbe: couldn't build nvmutil"
 
 	_gbe_tmp=$(mktemp -t gbeXXXX.bin)
 	cp ${_gbe_location} ${_gbe_tmp}
-	${nvmutil} "${_gbe_tmp}" setmac ${new_mac} || \
-	    err 'failed to modify mac address'
+	${nvmutil} "${_gbe_tmp}" setmac "${new_mac}" || \
+	    err "modify_gbe: ${board}: failed to modify mac address"
 
 	${ifdtool} -i GbE:${_gbe_tmp} "${rom}" -O "${rom}" || \
-	    err "cannot insert modified gbe.bin"
+	    err "modify_gbe: ${board}: cannot insert modified gbe.bin"
 
 	rm -f ${_gbe_tmp}
 }
diff --git a/resources/scripts/update/blobs/mrc b/resources/scripts/update/blobs/mrc
index 57cbede6..74899990 100755
--- a/resources/scripts/update/blobs/mrc
+++ b/resources/scripts/update/blobs/mrc
@@ -72,23 +72,23 @@ check_existing()
 build_dependencies()
 {
 	[ -d "${cbdir}/" ] || ./fetch_trees coreboot default || \
-	    err "cannot fetch coreboot/default"
+	    err "build_dependencies: cannot fetch coreboot/default"
 	./build coreboot utils default || \
-	    err "cannot build cbutils/default"
+	    err "build_dependencies: cannot build cbutils/default"
 }
 
 fetch_mrc()
 {
-	mkdir -p mrc/haswell/ || err "cannot mkdir mrc/haswell"
+	mkdir -p mrc/haswell/ || err "fetch_mrc: !mkdir mrc/haswell"
 
 	(
-	cd mrc/haswell/
+	cd mrc/haswell/ || err "fetch_mrc: !cd mrc/haswell"
 
 	download_image ${_url} ${_file} ${_sha1sum}
 	[ -f ${_file} ] || \
 		download_image ${_url2} ${_file} ${_sha1sum}
 	[ -f $_file ] || \
-		err "%{_file} not downloaded / verification failed."
+		err "fetch_mrc: ${_file} not downloaded / verification failed."
 
 	extract_partition ROOT-A ${_file} root-a.ext2
 	extract_shellball root-a.ext2 chromeos-firmwareupdate-${_board}
@@ -96,9 +96,9 @@ fetch_mrc()
 	extract_coreboot chromeos-firmwareupdate-${_board}
 
 	../../${cbfstool} coreboot-*.bin extract -f mrc.bin -n mrc.bin \
-	    -r RO_SECTION || err "Could not fetch mrc.bin"
+	    -r RO_SECTION || err "fetch_mrc: could not fetch mrc.bin"
 	rm -f "chromeos-firmwareupdate-${_board}" coreboot-*.bin \
-	    "${_file}" "root-a.ext2"
+	    "${_file}" "root-a.ext2" || err "fetch_mrc: cannot remove files"
 
 	printf "\n\nmrc.bin saved to ${_mrc_complete}\n\n"
 	)
@@ -111,16 +111,16 @@ download_image()
 	_sha1sum=${3}
 
 	printf "Downloading recovery image\n"
-	curl "$url" > "$_file.zip"
+	curl "$url" > "$_file.zip" || err "download_image: curl failed"
 	printf "Verifying recovery image checksum\n"
 	if [ "$(sha1sum ${_file}.zip | awk '{print $1}')" = "${_sha1sum}" ]
 	then
-		unzip -q "${_file}.zip"
-		rm "${_file}.zip"
+		unzip -q "${_file}.zip" || err "download_image: cannot unzip"
+		rm -f "${_file}.zip" || err "download_image: can't rm zip {1}"
 		return 0
 	fi
-	rm "${_file}.zip"
-	err "Bad checksum. Recovery image deleted"
+	rm -f "${_file}.zip" || err "download_image: bad hash, and can't rm zip"
+	err "download_image: Bad checksum. Recovery image deleted"
 }
 
 extract_partition()
@@ -138,7 +138,8 @@ extract_partition()
 	SIZE=$(( $( echo ${ROOTP} | cut -f4 -d\ | tr -d "B" ) ))
 
 	dd if=${FILE} of=${ROOTFS} bs=${_bs} skip=$(( ${START} / ${_bs} )) \
-	    count=$(( ${SIZE} / ${_bs} )) > /dev/null
+	    count=$(( ${SIZE} / ${_bs} )) || \
+	    err "extract_partition: can't extract root file system"
 }
 
 extract_shellball()
@@ -148,7 +149,7 @@ extract_shellball()
 
 	printf "Extracting chromeos-firmwareupdate\n"
 	printf "cd /usr/sbin\ndump chromeos-firmwareupdate ${SHELLBALL}\nquit" \
-	    | debugfs ${ROOTFS} > /dev/null 2>&1
+	    | debugfs ${ROOTFS} || err "extract_shellball: debugfs"
 }
 
 extract_coreboot()
@@ -157,13 +158,27 @@ extract_coreboot()
 	_unpacked=$( mktemp -d )
 
 	printf "Extracting coreboot image\n"
-	sh ${_shellball} --unpack ${_unpacked} > /dev/null
+
+	[ -f "${_shellball}" ] || \
+	    err "extract_coreboot: shellball missing in google peppy image"
+
+	sh ${_shellball} --unpack ${_unpacked} || \
+	    err "extract_coreboot: shellball exits with non-zero status"
+
+	# TODO: audit the f* out of that shellball, for each mrc version.
+	# it has to be updated for each mrc update. we should ideally
+	# implement the functionality ourselves.
+
+	[ -f "${_unpacked}/VERSION" ] || \
+	    err "extract_coreboot: VERSION file missing on google coreboot rom"
 
 	_version=$( cat ${_unpacked}/VERSION | grep BIOS\ version: | \
 	    cut -f2 -d: | tr -d \  )
 
-	cp ${_unpacked}/bios.bin coreboot-${_version}.bin
-	rm -r "${_unpacked}"
+	cp ${_unpacked}/bios.bin coreboot-${_version}.bin || \
+	    err "extract_coreboot: cannot copy google peppy rom"
+	rm -Rf "${_unpacked}" || \
+	    err "extract_coreboot: cannot remove extracted google peppy archive"
 }
 
 main $@