diff --git a/debian/scripts/checks/final-checks b/debian/scripts/checks/final-checks
index 2c03c47d0321..37067f90be3a 100755
--- a/debian/scripts/checks/final-checks
+++ b/debian/scripts/checks/final-checks
@@ -15,7 +15,7 @@ fail=0
 
 failure()
 {
-	echo "EE: $@" 1>&2
+	echo "EE: $*" 1>&2
 	fail=1
 }
 
@@ -27,23 +27,23 @@ abi_check()
 
 	local abidir="$abidir/$arch"
 
-	if [ ! -f "$abidir/$flavour" -a \
-	     ! -f "$abidir/$flavour.ignore" -a \
-	     ! -f "$abidir/ignore" ]
+	if [ ! -f "$abidir/$flavour" ] && \
+	   [ ! -f "$abidir/$flavour.ignore" ] && \
+	   [ ! -f "$abidir/ignore" ]
 	then
 		failure "$arch/$flavour ABI symbol file missing"
 	fi
 
-	if [ ! -f "$abidir/$flavour.modules" -a \
-	     ! -f "$abidir/$flavour.ignore.modules" -a \
-	     ! -f "$abidir/ignore.modules" ]
+	if [ ! -f "$abidir/$flavour.modules" ] && \
+	   [ ! -f "$abidir/$flavour.ignore.modules" ] && \
+	   [ ! -f "$abidir/ignore.modules" ]
 	then
 		failure "$arch/$flavour ABI modules file missing"
 	fi
 
-	if [ ! -f "$abidir/$flavour.retpoline" -a \
-	     ! -f "$abidir/$flavour.ignore.retpoline" -a \
-	     ! -f "$abidir/ignore.retpoline" ]
+	if [ ! -f "$abidir/$flavour.retpoline" ] && \
+	   [ ! -f "$abidir/$flavour.ignore.retpoline" ] && \
+	   [ ! -f "$abidir/ignore.retpoline" ]
 	then
 		failure "$arch/$flavour ABI retpoline file missing"
 	fi
@@ -67,7 +67,7 @@ do
 		continue
 	fi
 
-	image_pkg=$(awk -F '\\s*=\\s*' '$1 == "do_flavour_image_package" { print $2 }' $debian/rules.d/$arch.mk)
+	image_pkg=$(awk -F '\\s*=\\s*' '$1 == "do_flavour_image_package" { print $2 }' "$debian/rules.d/$arch.mk")
 	if [ "$image_pkg" = "false" ]; then
 		continue
 	fi
@@ -79,17 +79,14 @@ do
 		}' "$debian/rules.d/$arch.mk")
 	for flavour in $flavours
 	do
-		flavour=$(echo "$flavour" | sed -e 's@.*/config.flavour.@@')
 		if [ -d debian/certs ]; then
-			python3 debian/scripts/misc/annotations --export -c CONFIG_SYSTEM_TRUSTED_KEYS --arch $arch --flavour $flavour | grep -q '^CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"$'
-			if [ $? -ne 0 ]; then
-				failure "'CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"' is required"
+			if ! python3 debian/scripts/misc/annotations --export -c CONFIG_SYSTEM_TRUSTED_KEYS --arch "$arch" --flavour "$flavour" | grep -q '^CONFIG_SYSTEM_TRUSTED_KEYS="debian/canonical-certs.pem"$' ; then
+				failure "'CONFIG_SYSTEM_TRUSTED_KEYS=\"debian/canonical-certs.pem\"' is required"
 			fi
 		fi
 		if [ -d debian/revoked-certs ]; then
-			python3 debian/scripts/misc/annotations --export -c CONFIG_SYSTEM_REVOCATION_KEYS --arch $arch --flavour $flavour | grep -q '^CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem"$'
-			if [ $? -ne 0 ]; then
-				failure "'CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem"' is required"
+			if ! python3 debian/scripts/misc/annotations --export -c CONFIG_SYSTEM_REVOCATION_KEYS --arch "$arch" --flavour "$flavour" | grep -q '^CONFIG_SYSTEM_REVOCATION_KEYS="debian/canonical-revoked-certs.pem"$' ; then
+				failure "'CONFIG_SYSTEM_REVOCATION_KEYS=\"debian/canonical-revoked-certs.pem\"' is required"
 			fi
 		fi
 		if [ "${skipabi}" = "false" ] ; then