Here's the cppcheck output -- thankfully, not everything here makes it into our packages. (For example, the code in ./mk/debian/xe-guest-utilities.postinst installs new APT sources. This is not ideal. As far as I can tell we don't ship this.)

./mk/testcases/lsb:5:6: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/testcases/lsb:15:17: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/testcases/lsb:20:3: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/testcases/lsb:33:16: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/testcases/lsb:34:25: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/testcases/lsb:35:21: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:43:11: warning: Declare and assign separately to avoid masking return values. [SC2155]
./mk/xe-linux-distribution:46:2: warning: MAJOR appears unused. Verify it or export it. [SC2034]
./mk/xe-linux-distribution:47:2: warning: MINOR appears unused. Verify it or export it. [SC2034]
./mk/xe-linux-distribution:48:2: warning: DISTRO appears unused. Verify it or export it. [SC2034]
./mk/xe-linux-distribution:49:2: warning: UNAME appears unused. Verify it or export it. [SC2034]
./mk/xe-linux-distribution:76:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:76:39: note: You don't break lines with \ in single quotes, it results in literal backslash-linefeed. [SC1004]
./mk/xe-linux-distribution:84:72: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:138:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:141:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:143:123: note: This word is outside of quotes. Did you intend to 'nest '"'single quotes'"' instead'?  [SC2026]
./mk/xe-linux-distribution:167:14: note: expr is antiquated. Consider rewriting this using $((..)), ${} or [[ ]]. [SC2003]
./mk/xe-linux-distribution:167:19: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:176:68: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:213:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:231:63: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:252:51: note: Use '[:upper:]' to support accents and foreign alphabets. [SC2019]
./mk/xe-linux-distribution:252:57: note: Use '[:lower:]' to support accents and foreign alphabets. [SC2018]
./mk/xe-linux-distribution:270:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:270:17: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:270:68: note: You don't break lines with \ in single quotes, it results in literal backslash-linefeed. [SC1004]
./mk/xe-linux-distribution:271:68: note: You don't break lines with \ in single quotes, it results in literal backslash-linefeed. [SC1004]
./mk/xe-linux-distribution:298:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:310:68: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:329:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:330:95: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:330:95: note: Use $(..) instead of legacy `..`. [SC2006]
./mk/xe-linux-distribution:342:68: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:359:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:371:68: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution:390:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution:420:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution.init:27:9: warning: Assigning an array to a string! Assign as array, or use * instead of @ to concatenate. [SC2124]
./mk/xe-linux-distribution.init:28:10: warning: In POSIX sh, echo flags are not supported. [SC2039]
./mk/xe-linux-distribution.init:53:13: warning: In POSIX sh, $".." is not supported. [SC2039]
./mk/xe-linux-distribution.init:59:13: warning: In POSIX sh, $".." is not supported. [SC2039]
./mk/xe-linux-distribution.init:68:12: warning: In POSIX sh, $".." is not supported. [SC2039]
./mk/xe-linux-distribution.init:71:12: warning: In POSIX sh, $".." is not supported. [SC2039]
./mk/xe-linux-distribution.init:72:14: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution.init:77:16: warning: In POSIX sh, &> is not supported. [SC2039]
./mk/xe-linux-distribution.init:84:12: warning: In POSIX sh, $".." is not supported. [SC2039]
./mk/xe-linux-distribution.init:84:49: warning: Quote this to prevent word splitting. [SC2046]
./mk/xe-linux-distribution.init:116:14: warning: In POSIX sh, $".." is not supported. [SC2039]
./mk/xe-linux-distribution-test:7:1: warning: TEST appears unused. Verify it or export it. [SC2034]
./mk/xe-linux-distribution-test:24:17: warning: Assigning an array to a string! Assign as array, or use * instead of @ to concatenate. [SC2124]
./mk/xe-linux-distribution-test:25:22: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/xe-linux-distribution-test:29:10: note: Double quote to prevent globbing and word splitting. [SC2086]
./mk/debian/xe-guest-utilities.postinst:6:10: warning: Quote this to prevent word splitting. [SC2046]
./mk/debian/xe-guest-utilities.postinst:7:46: warning: os_distro is referenced but not assigned. [SC2154]
./mk/debian/xe-guest-utilities.postinst:8:17: warning: os_majorver is referenced but not assigned. [SC2154]
./mk/debian/xe-guest-utilities.postinst:8:44: warning: os_minorver is referenced but not assigned. [SC2154]