Merge pull request #136 from jhunkeler/cmake-git-version-fixups

Bug Hunt 0x1000

25 files changed, 360 insertions, 162 deletions

diff --git a/src/cli/stasis/args.c b/src/cli/stasis/args.c
index 98b4479..e1c49fe 100644
--- a/src/cli/stasis/args.c
+++ b/src/cli/stasis/args.c
@@ -105,9 +105,7 @@ void usage(char *progname) {
             strncat(opt_short, "  ", sizeof(opt_short) - strlen(opt_short) - 1);
         }
 
-        const char *opt_fmt = "  %%-%ds\t%%s\t\t%%s";
-        size_t opt_fmt_len = snprintf(NULL, 0, opt_fmt, width);
-        snprintf(tmp, sizeof(tmp) - opt_fmt_len, opt_fmt, width + 4);
+        snprintf(tmp, sizeof(tmp) - strlen(tmp), "  %%-%ds\t%%s\t\t%%s", width + 4);
         snprintf(output, sizeof(output), tmp, opt_long, opt_short, long_options_help[x]);
         puts(output);
     }
diff --git a/src/cli/stasis/stasis_main.c b/src/cli/stasis/stasis_main.c
index 697791a..01a126e 100644
--- a/src/cli/stasis/stasis_main.c
+++ b/src/cli/stasis/stasis_main.c
@@ -30,14 +30,19 @@ static void setup_sysconfdir() {
 
 static void setup_python_version_override(struct Delivery *ctx, const char *version) {
     // Override Python version from command-line, if any
-    if (strlen(version)) {
+    if (version && strlen(version)) {
         guard_free(ctx->meta.python);
         ctx->meta.python = strdup(version);
         if (!ctx->meta.python) {
             SYSERROR("%s", "Unable to allocate bytes for python version override");
+            exit(1);
         }
         guard_free(ctx->meta.python_compact);
         ctx->meta.python_compact = to_short_version(ctx->meta.python);
+        if (!ctx->meta.python_compact) {
+            SYSERROR("%s", "Unable to allocate bytes for python compact version override");
+            exit(1);
+        }
     }
 }
 
@@ -693,6 +698,12 @@ int main(int argc, char *argv[]) {
     configure_delivery_context(&ctx);
 
     configure_jfrog_cli(&ctx);
+    /*
+    delivery_free(&ctx);
+    tpl_free();
+    globals_free();
+    return 0;
+    */
 
     runtime_apply(ctx.runtime.environ);
     strncpy(env_name, ctx.info.release_name, sizeof(env_name) - 1);
diff --git a/src/cli/stasis_indexer/readmes.c b/src/cli/stasis_indexer/readmes.c
index 91c936f..749b1ee 100644
--- a/src/cli/stasis_indexer/readmes.c
+++ b/src/cli/stasis_indexer/readmes.c
@@ -63,13 +63,13 @@ int indexer_readmes(struct Delivery **ctx, const size_t nelem) {
                     fprintf(indexfp, "  - Receipt: [STASIS input file](%s)\n", conf_name_relative);
 
                     char *pattern = NULL;
-                    asprintf(&pattern, "*%s*%s*",
+                    if (asprintf(&pattern, "*%s*%s*",
                              latest_deliveries[i]->info.build_number,
-                             strstr((*ctx)->rules.release_fmt, "%p") ? latest_deliveries[i]->meta.python_compact : "" );
-                    if (!pattern) {
+                             strstr((*ctx)->rules.release_fmt, "%p") ? latest_deliveries[i]->meta.python_compact : "" ) < 0) {
                         SYSERROR("%s", "Unable to allocate bytes for pattern");
                         return -1;
                     }
+
                     struct StrList *docker_images = get_docker_images(latest_deliveries[i], pattern);
                     if (docker_images
                         && strlist_count(docker_images)
@@ -105,6 +105,7 @@ int indexer_readmes(struct Delivery **ctx, const size_t nelem) {
                  strstr((*ctx)->rules.release_fmt, "%p") ? current->meta.python_compact : "" );
         if (!pattern) {
             SYSERROR("%s", "Unable to allocate bytes for pattern");
+            fclose(indexfp);
             return -1;
         }
 
diff --git a/src/lib/core/artifactory.c b/src/lib/core/artifactory.c
index 9e41046..2490346 100644
--- a/src/lib/core/artifactory.c
+++ b/src/lib/core/artifactory.c
@@ -8,14 +8,26 @@ int artifactory_download_cli(char *dest,
                              char *os,
                              char *arch,
                              char *remote_filename) {
+    SYSDEBUG("%s", "ARGS follow");
+    SYSDEBUG("dest=%s", dest);
+    SYSDEBUG("jfrog_artifactory_base_url=%s", jfrog_artifactory_base_url);
+    SYSDEBUG("jfrog_artifactory_product=%s", jfrog_artifactory_product);
+    SYSDEBUG("cli_major_ver=%s", cli_major_ver);
+    SYSDEBUG("version=%s", version);
+    SYSDEBUG("os=%s", os);
+    SYSDEBUG("arch=%s", arch);
+    SYSDEBUG("remote_filename=%s", remote_filename);
+
     char url[PATH_MAX] = {0};
     char path[PATH_MAX] = {0};
     char os_ident[STASIS_NAME_MAX] = {0};
     char arch_ident[STASIS_NAME_MAX] = {0};
 
     // convert platform string to lower-case
+    SYSDEBUG("%s", "Set os_ident");
     strncpy(os_ident, os, sizeof(os_ident) - 1);
     tolower_s(os_ident);
+    SYSDEBUG("os_ident=%s", os_ident);
 
     // translate OS identifier
     if (!strcmp(os_ident, "darwin") || startswith(os_ident, "macos")) {
@@ -28,7 +40,9 @@ int artifactory_download_cli(char *dest,
     }
 
     // translate ARCH identifier
+    SYSDEBUG("%s", "Set arch_ident");
     strncpy(arch_ident, arch, sizeof(arch_ident) - 1);
+    SYSDEBUG("arch_ident=%s", arch_ident);
     if (startswith(arch_ident, "i") && endswith(arch_ident, "86")) {
         strncpy(arch_ident, "386", sizeof(arch_ident) - 1);
     } else if (!strcmp(arch_ident, "amd64") || !strcmp(arch_ident, "x86_64") || !strcmp(arch_ident, "x64")) {
@@ -44,6 +58,7 @@ int artifactory_download_cli(char *dest,
         return -1;
     }
 
+    SYSDEBUG("%s", "Construct URL");
     snprintf(url, sizeof(url), "%s/%s/%s/%s/%s-%s-%s/%s",
              jfrog_artifactory_base_url,           // https://releases.jfrog.io/artifactory
              jfrog_artifactory_product,            // jfrog-cli
@@ -60,10 +75,15 @@ int artifactory_download_cli(char *dest,
         return -1;
     }
 
-    const char *remote_filename_fmt = "/%s";
-    int remote_filename_fmt_len = snprintf(NULL, 0, remote_filename_fmt, remote_filename);
-    snprintf(path + strlen(path), sizeof(path) - remote_filename_fmt_len, remote_filename_fmt, remote_filename);
+    SYSDEBUG("%s", "Construct path to write data");
+    SYSDEBUG("path buffer contents: '%s'", path);
+    SYSDEBUG("path buffer size: %zu", sizeof(path));
+    SYSDEBUG("path strlen: %zu", strlen(path));
+    SYSDEBUG("maxlen for snprintf: %zu", sizeof(path) - strlen(path));
+
+    snprintf(path + strlen(path), sizeof(path) - strlen(path), "/%s", remote_filename);
     char *errmsg = NULL;
+    SYSDEBUG("%s", "Downloading...");
     long fetch_status = download(url, path, &errmsg);
     if (HTTP_ERROR(fetch_status)) {
         SYSERROR("download failed: %s: %s\n", errmsg, url);
diff --git a/src/lib/core/conda.c b/src/lib/core/conda.c
index 90c6ba1..854d56d 100644
--- a/src/lib/core/conda.c
+++ b/src/lib/core/conda.c
@@ -17,10 +17,8 @@ int micromamba(const struct MicromambaInfo *info, char *command, ...) {
         strncpy(sys.machine, "64", sizeof(sys.machine) - 1);
     }
 
-    char url[PATH_MAX];
-    const char *url_fmt = "https://micro.mamba.pm/api/micromamba/%s-%s/latest";
-    const int url_fmt_len = snprintf(NULL, 0, url_fmt, sys.sysname, sys.machine);
-    snprintf(url, sizeof(url) - url_fmt_len, url_fmt, sys.sysname, sys.machine);
+    char url[PATH_MAX] = {0};
+    snprintf(url, sizeof(url), "https://micro.mamba.pm/api/micromamba/%s-%s/latest", sys.sysname, sys.machine);
 
     char installer_path[PATH_MAX];
     snprintf(installer_path, sizeof(installer_path), "%s/latest", getenv("TMPDIR") ? getenv("TMPDIR") : "/tmp");
@@ -63,7 +61,7 @@ int micromamba(const struct MicromambaInfo *info, char *command, ...) {
     }
 
     va_start(args, command);
-    cmd_len = vsnprintf(cmd + strlen(cmd), sizeof(cmd) - cmd_len, command, args);
+    cmd_len = vsnprintf(cmd + strlen(cmd), sizeof(cmd) - strlen(cmd), command, args);
     if (cmd_len < 0) {
         SYSERROR("%s", "Unable to append arguments to micromamba command");
         va_end(args);
@@ -95,16 +93,12 @@ int micromamba(const struct MicromambaInfo *info, char *command, ...) {
 
 int python_exec(const char *args) {
     const char *command_base = "python ";
-    const char *command_fmt = "%s%s";
 
-    const int len = snprintf(NULL, 0, command_fmt, command_base, args);
-    char *command = calloc(len + 1, sizeof(*command));
-    if (!command) {
-        SYSERROR("Unable to allocate %d bytes for command string", len);
+    char *command = NULL;
+    if (asprintf(&command, "%s%s", command_base, args) < 0 || !command) {
+        SYSERROR("%s", "Unable to allocate command string");
         return -1;
     }
-
-    snprintf(command, len + 1, command_fmt, command_base, args);
     msg(STASIS_MSG_L3, "Executing: %s\n", command);
 
     const int result = system(command);
@@ -114,15 +108,12 @@ int python_exec(const char *args) {
 
 int pip_exec(const char *args) {
     const char *command_base = "python -m pip ";
-    const char *command_fmt = "%s%s";
 
-    const int len = snprintf(NULL, 0, command_fmt, command_base, args);
-    char *command = calloc(len + 1, sizeof(*command));
-    if (!command) {
-        SYSERROR("Unable to allocate %d bytes for command string", len);
+    char *command = NULL;
+    if (asprintf(&command, "%s%s", command_base, args) < 0 || !command) {
+        SYSERROR("%s", "Unable to allocate command string");
         return -1;
     }
-    snprintf(command, len + 1, command_fmt, command_base, args);
     msg(STASIS_MSG_L3, "Executing: %s\n", command);
 
     const int result = system(command);
@@ -170,7 +161,7 @@ int pkg_index_provides(int mode, const char *index, const char *spec) {
     int status = 0;
     struct Process proc = {0};
     proc.redirect_stderr = 1;
-    strncpy(proc.f_stdout, logfile, sizeof(proc.f_stdout) - 1);
+    snprintf(proc.f_stdout, sizeof(proc.f_stdout), "%s", logfile);
 
     if (mode == PKG_USE_PIP) {
         // Do an installation in dry-run mode to see if the package exists in the given index.
@@ -320,6 +311,7 @@ static int env0_to_runtime(const char *logfile) {
         char **part = split(buf, "=", 1);
         if (!part) {
             perror("unable to split environment variable buffer");
+            fclose(fp);
             return -1;
         }
         if (!part[0]) {
@@ -512,8 +504,8 @@ int conda_setup_headless() {
             if (isempty(item)) {
                 continue;
             }
-            const int cmd_fmt_len = snprintf(NULL, 0, cmd_fmt, item);
-            snprintf(cmd + strlen(cmd), sizeof(cmd) - cmd_fmt_len, cmd_fmt, item);
+
+            snprintf(cmd + strlen(cmd), sizeof(cmd) - strlen(cmd), cmd_fmt, item);
             if (i < total - 1) {
                 strncat(cmd, " ", sizeof(cmd) - strlen(cmd) - 1);
             }
@@ -535,8 +527,7 @@ int conda_setup_headless() {
             if (isempty(item)) {
                 continue;
             }
-            const int cmd_fmt_len = snprintf(NULL, 0, cmd_fmt, item);
-            snprintf(cmd + strlen(cmd), sizeof(cmd) - cmd_fmt_len, cmd_fmt, item);
+            snprintf(cmd + strlen(cmd), sizeof(cmd) - strlen(cmd), cmd_fmt, item);
             if (i < total - 1) {
                 strncat(cmd, " ", sizeof(cmd) - strlen(cmd) - 1);
             }
@@ -605,13 +596,12 @@ int conda_env_create_from_uri(char *name, char *uri, char *python_version) {
     file_replace_text(tempfile, "- python\n", spec, 0);
 
     const char *fmt = "env create -n '%s' --file='%s'";
-    int len = snprintf(NULL, 0, fmt, name, tempfile);
-    char *env_command = calloc(len + 1, sizeof(*env_command));
-    if (!env_command) {
+    char *env_command = NULL;
+    if (asprintf(&env_command, fmt, name, tempfile) < 0 || !env_command) {
+        SYSERROR("%s", "unable to allocate environment command");
         return -1;
     }
 
-    snprintf(env_command, len + 1, fmt, name, tempfile);
     const int status = conda_exec(env_command);
     unlink(tempfile);
     guard_free(env_command);
@@ -669,7 +659,6 @@ int conda_index(const char *path) {
 
 int conda_env_exists(const char *root, const char *name) {
     char path[PATH_MAX] = {0};
-    const int len = snprintf(NULL, 0, "%s/%s", root, name);
-    snprintf(path, sizeof(path) - len, "%s/envs/%s", root, name);
+    snprintf(path, sizeof(path), "%s/envs/%s", root, name);
     return access(path, F_OK) == 0;
 }
diff --git a/src/lib/core/copy.c b/src/lib/core/copy.c
index ba52507..5b4e468 100644
--- a/src/lib/core/copy.c
+++ b/src/lib/core/copy.c
@@ -58,6 +58,7 @@ int copy2(const char *src, const char *dest, unsigned int op) {
         FILE *fp2 = fopen(dest, "w+b");
         if (!fp2) {
             perror(dest);
+            fclose(fp1);
             return -1;
         }
 
diff --git a/src/lib/core/docker.c b/src/lib/core/docker.c
index 52599d3..b289e5a 100644
--- a/src/lib/core/docker.c
+++ b/src/lib/core/docker.c
@@ -47,6 +47,7 @@ int docker_script(const char *image, char *args, char *data, const unsigned flag
     FILE *infile = fmemopen(data, strlen(data), "r");
     if (!infile) {
         // opening memory file for reading failed
+        pclose(outfile);
         return -1;
     }
 
diff --git a/src/lib/core/download.c b/src/lib/core/download.c
index 817e576..eb24351 100644
--- a/src/lib/core/download.c
+++ b/src/lib/core/download.c
@@ -11,44 +11,60 @@ size_t download_writer(void *fp, size_t size, size_t nmemb, void *stream) {
 }
 
 long download(char *url, const char *filename, char **errmsg) {
+    SYSDEBUG("%s", "ARGS follow");
+    SYSDEBUG("url=%s", url);
+    SYSDEBUG("filename=%s", filename);
+    SYSDEBUG("errmsg=%s (NULL is OK)", *errmsg);
     long http_code = -1;
-    char user_agent[20];
-    snprintf(user_agent, sizeof(user_agent), "stasis/%s", VERSION);
+    char user_agent[STASIS_NAME_MAX] = {0};
+    snprintf(user_agent, sizeof(user_agent), "stasis/%s", STASIS_VERSION);
 
-    long timeout = 30L;
+    SYSDEBUG("%s", "Setting timeout");
+    size_t timeout_default = 30L;
+    size_t timeout = timeout_default;
     const char *timeout_str = getenv("STASIS_DOWNLOAD_TIMEOUT");
     if (timeout_str) {
-        timeout = strtol(timeout_str, NULL, 10);
-        if (timeout <= 0L) {
-            timeout = 1L;
+        timeout = strtoul(timeout_str, NULL, 10);
+        if (timeout == ULONG_MAX && errno == ERANGE) {
+            SYSERROR("STASIS_DOWNLOAD_TIMEOUT must be a positive integer. Using default (%zu).", timeout);
+            timeout = timeout_default;
         }
     }
 
-    ssize_t max_retries = 5;
+    SYSDEBUG("%s", "Setting max_retries");
+    const size_t max_retries_default = 5;
+    size_t max_retries = max_retries_default;
     const char *max_retries_str = getenv("STASIS_DOWNLOAD_RETRY_MAX");
     if (max_retries_str) {
-        max_retries = strtol(max_retries_str, NULL, 10);
-        if (max_retries <= 0) {
-            max_retries = 1;
+        max_retries = strtoul(max_retries_str, NULL, 10);
+        if (max_retries == ULONG_MAX && errno == ERANGE) {
+            SYSERROR("STASIS_DOWNLOAD_RETRY_MAX must be a positive integer. Using default (%zu).", max_retries);
+            max_retries = max_retries_default;
         }
     }
 
-    ssize_t max_retry_seconds = 3;
+    SYSDEBUG("%s", "Setting max_retry_seconds");
+    const size_t max_retry_seconds_default = 3;
+    size_t max_retry_seconds = max_retry_seconds_default;
     const char *max_retry_seconds_str = getenv("STASIS_DOWNLOAD_RETRY_SECONDS");
     if (max_retry_seconds_str) {
-        max_retry_seconds = strtol(max_retry_seconds_str, NULL, 10);
-        if (max_retry_seconds < 0) {
-            max_retry_seconds = 0;
+        max_retry_seconds = strtoul(max_retry_seconds_str, NULL, 10);
+        if (max_retry_seconds == ULONG_MAX && errno == ERANGE) {
+            SYSERROR("STASIS_DOWNLOAD_RETRY_SECONDS must be a positive integer. Using default (%zu).", max_retry_seconds);
+            max_retry_seconds = max_retry_seconds_default;
         }
     }
 
 
+    SYSDEBUG("%s", "Initializing curl context");
     curl_global_init(CURL_GLOBAL_ALL);
     CURL *c = curl_easy_init();
-    for (ssize_t retry = 0; retry < max_retries; retry++) {
+    for (size_t retry = 0; retry < max_retries; retry++) {
         if (retry) {
             fprintf(stderr, "[RETRY %zu/%zu] %s: %s\n", retry + 1, max_retries, *errmsg, url);
         }
+
+        SYSDEBUG("%s", "Configuring curl");
         curl_easy_setopt(c, CURLOPT_URL, url);
         curl_easy_setopt(c, CURLOPT_WRITEFUNCTION, download_writer);
         FILE *fp = fopen(filename, "wb");
@@ -64,13 +80,19 @@ long download(char *url, const char *filename, char **errmsg) {
         curl_easy_setopt(c, CURLOPT_CONNECTTIMEOUT, timeout);
 
         SYSDEBUG("curl_easy_perform(): \n\turl=%s\n\tfilename=%s\n\tuser agent=%s\n\ttimeout=%zu", url, filename, user_agent, timeout);
-        CURLcode curl_code = curl_easy_perform(c);
+        const CURLcode curl_code = curl_easy_perform(c);
         SYSDEBUG("curl status code: %d", curl_code);
 
         if (curl_code != CURLE_OK) {
+            SYSDEBUG("curl failed with code: %s", curl_easy_strerror(curl_code));
             const size_t errmsg_maxlen = 256;
             if (!*errmsg) {
+                SYSDEBUG("%s", "allocating memory for error message");
                 *errmsg = calloc(errmsg_maxlen, sizeof(char));
+                if (!*errmsg) {
+                    SYSERROR("%s", "unable to allocate memory for error message");
+                    goto cleanup;
+                }
             }
             snprintf(*errmsg, errmsg_maxlen, "%s", curl_easy_strerror(curl_code));
             curl_easy_reset(c);
@@ -79,6 +101,8 @@ long download(char *url, const char *filename, char **errmsg) {
             continue;
         }
 
+        cleanup:
+        SYSDEBUG("%s", "Cleaning up");
         // Data written. Clean up.
         fclose(fp);
 
diff --git a/src/lib/core/github.c b/src/lib/core/github.c
index c5281c6..7c20fa4 100644
--- a/src/lib/core/github.c
+++ b/src/lib/core/github.c
@@ -118,7 +118,10 @@ int get_github_release_notes(const char *api_token, const char *repo, const char
         } else if ((data_offset = strstr(line, field_message))) {
             // Skip past the message field
             data_offset += strlen(field_message);
-            *(strchr(data_offset, '"')) = 0;
+            char *data_mark = strchr(data_offset, '"');
+            if (data_mark) {
+                *data_mark = '\0';
+            }
             fprintf(stderr, "GitHub API Error: '%s'\n", data_offset);
             fprintf(stderr, "URL: %s\n", endpoint_url);
             fprintf(stderr, "POST: %s\n", endpoint_post_fields);
diff --git a/src/lib/core/ini.c b/src/lib/core/ini.c
index 1ecff17..6995eb2 100644
--- a/src/lib/core/ini.c
+++ b/src/lib/core/ini.c
@@ -7,6 +7,9 @@
 
 struct INIFILE *ini_init() {
     struct INIFILE *ini = calloc(1, sizeof(*ini));
+    if (!ini) {
+        return NULL;
+    }
     ini->section_count = 0;
     return ini;
 }
diff --git a/src/lib/core/junitxml.c b/src/lib/core/junitxml.c
index 628f75f..caf21cb 100644
--- a/src/lib/core/junitxml.c
+++ b/src/lib/core/junitxml.c
@@ -3,17 +3,32 @@
 #include "strlist.h"
 #include "junitxml.h"
 
+static void testcase_failure_free(struct JUNIT_Failure **failure) {
+    struct JUNIT_Failure *x = (*failure);
+    guard_free(x->message);
+    guard_free(x);
+}
+
+static void testcase_error_free(struct JUNIT_Error **error) {
+    struct JUNIT_Error *x = (*error);
+    guard_free(x->message);
+    guard_free(x);
+}
+
+static void testcase_skipped_free(struct JUNIT_Skipped **skipped) {
+    struct JUNIT_Skipped *x = (*skipped);
+    guard_free(x->message);
+    guard_free(x);
+}
+
 static void testcase_result_state_free(struct JUNIT_Testcase **testcase) {
     struct JUNIT_Testcase *tc = (*testcase);
     if (tc->tc_result_state_type == JUNIT_RESULT_STATE_FAILURE) {
-        guard_free(tc->result_state.failure->message);
-        guard_free(tc->result_state.failure);
+        testcase_failure_free(&tc->result_state.failure);
     } else if (tc->tc_result_state_type == JUNIT_RESULT_STATE_ERROR) {
-        guard_free(tc->result_state.error->message);
-        guard_free(tc->result_state.error);
+        testcase_error_free(&tc->result_state.error);
     } else if (tc->tc_result_state_type == JUNIT_RESULT_STATE_SKIPPED) {
-        guard_free(tc->result_state.skipped->message);
-        guard_free(tc->result_state.skipped);
+        testcase_skipped_free(&tc->result_state.skipped);
     }
 }
 
@@ -58,10 +73,16 @@ static struct JUNIT_Failure *testcase_failure_from_attributes(struct StrList *at
         return NULL;
     }
     for (size_t x = 0; x < strlist_count(attrs); x += 2) {
-        char *attr_name = strlist_item(attrs, x);
-        char *attr_value = strlist_item(attrs, x + 1);
-        if (!strcmp(attr_name, "message")) {
-            result->message = strdup(attr_value);
+        const char *attr_name = strlist_item(attrs, x);
+        const char *attr_value = strlist_item(attrs, x + 1);
+        if (attr_name && attr_value) {
+            if (!strcmp(attr_name, "message")) {
+                result->message = strdup(attr_value);
+                if (!result->message) {
+                    SYSERROR("%s", "failed to allocate memory for testcase failure message");
+                    break;
+                }
+            }
         }
     }
     return result;
@@ -73,10 +94,16 @@ static struct JUNIT_Error *testcase_error_from_attributes(struct StrList *attrs)
         return NULL;
     }
     for (size_t x = 0; x < strlist_count(attrs); x += 2) {
-        char *attr_name = strlist_item(attrs, x);
-        char *attr_value = strlist_item(attrs, x + 1);
-        if (!strcmp(attr_name, "message")) {
-            result->message = strdup(attr_value);
+        const char *attr_name = strlist_item(attrs, x);
+        const char *attr_value = strlist_item(attrs, x + 1);
+        if (attr_name && attr_value) {
+            if (!strcmp(attr_name, "message")) {
+                result->message = strdup(attr_value);
+                if (!result->message) {
+                    SYSERROR("%s", "failed to allocate memory for testcase error message");
+                    break;
+                }
+            }
         }
     }
     return result;
@@ -88,10 +115,16 @@ static struct JUNIT_Skipped *testcase_skipped_from_attributes(struct StrList *at
         return NULL;
     }
     for (size_t x = 0; x < strlist_count(attrs); x += 2) {
-        char *attr_name = strlist_item(attrs, x);
-        char *attr_value = strlist_item(attrs, x + 1);
-        if (!strcmp(attr_name, "message")) {
-            result->message = strdup(attr_value);
+        const char *attr_name = strlist_item(attrs, x);
+        const char *attr_value = strlist_item(attrs, x + 1);
+        if (attr_name && attr_value) {
+            if (!strcmp(attr_name, "message")) {
+                result->message = strdup(attr_value);
+                if (!result->message) {
+                    SYSERROR("%s", "failed to allocate memory for testcase skip message");
+                    break;
+                }
+            }
         }
     }
     return result;
@@ -100,19 +133,37 @@ static struct JUNIT_Skipped *testcase_skipped_from_attributes(struct StrList *at
 static struct JUNIT_Testcase *testcase_from_attributes(struct StrList *attrs) {
     struct JUNIT_Testcase *result = calloc(1, sizeof(*result));
     if(!result) {
+        SYSERROR("%s", "failed to allocate memory for testcase");
         return NULL;
     }
     for (size_t x = 0; x < strlist_count(attrs); x += 2) {
         char *attr_name = strlist_item(attrs, x);
         char *attr_value = strlist_item(attrs, x + 1);
-        if (!strcmp(attr_name, "name")) {
-            result->name = strdup(attr_value);
-        } else if (!strcmp(attr_name, "classname")) {
-            result->classname = strdup(attr_value);
-        } else if (!strcmp(attr_name, "time")) {
-            result->time = strtof(attr_value, NULL);
-        } else if (!strcmp(attr_name, "message")) {
-            result->message = strdup(attr_value);
+        if (attr_name && attr_value) {
+            if (!strcmp(attr_name, "name")) {
+                result->name = strdup(attr_value);
+                if (!result->name) {
+                    SYSERROR("%s", "failed to allocate memory for testcase name");
+                    testcase_free(&result);
+                    break;
+                }
+            } else if (!strcmp(attr_name, "classname")) {
+                result->classname = strdup(attr_value);
+                if (!result->classname) {
+                    SYSERROR("%s", "failed to allocate memory for testcase class name");
+                    testcase_free(&result);
+                    break;
+                }
+            } else if (!strcmp(attr_name, "time")) {
+                result->time = strtof(attr_value, NULL);
+            } else if (!strcmp(attr_name, "message")) {
+                result->message = strdup(attr_value);
+                if (!result->message) {
+                    SYSERROR("%s", "failed to allocate memory for testcase message");
+                    testcase_free(&result);
+                    break;
+                }
+            }
         }
     }
     return result;
diff --git a/src/lib/core/multiprocessing.c b/src/lib/core/multiprocessing.c
index 92970f0..7b16af3 100644
--- a/src/lib/core/multiprocessing.c
+++ b/src/lib/core/multiprocessing.c
@@ -74,16 +74,21 @@ int child(struct MultiProcessingPool *pool, struct MultiProcessingTask *task) {
 
     // Set log file name
     if (globals.enable_task_logging) {
-        const char *log_file_fmt = "task-%zu-%d.log";
-        const int log_file_len = snprintf(NULL, 0, log_file_fmt, mp_global_task_count, task->parent_pid);
-        snprintf(task->log_file + strlen(task->log_file), sizeof(task->log_file) - log_file_len, log_file_fmt, mp_global_task_count, task->parent_pid);
+        snprintf(task->log_file + strlen(task->log_file), sizeof(task->log_file) - strlen(task->log_file),
+            "task-%zu-%d.log", mp_global_task_count, task->parent_pid);
     }
     fp_log = freopen(task->log_file, "w+", stdout);
     if (!fp_log) {
         fprintf(stderr, "unable to open '%s' for writing: %s\n", task->log_file, strerror(errno));
         return -1;
     }
-    dup2(fileno(stdout), fileno(stderr));
+
+    int fd = -1;
+    if ((fd = dup2(STDOUT_FILENO, STDERR_FILENO)) < 0) {
+        SYSERROR("%s", "Unable to redirect stderr to stdout");
+        fclose(fp_log);
+        return -1;
+    }
 
     // Generate timestamp for log header
     time_t t = time(NULL);
@@ -168,22 +173,21 @@ struct MultiProcessingTask *mp_pool_task(struct MultiProcessingPool *pool, const
 
     // Set task identifier string
     memset(slot->ident, 0, sizeof(slot->ident));
-    strncpy(slot->ident, ident, sizeof(slot->ident) - 1);
+    snprintf(slot->ident, sizeof(slot->ident), "%s", ident);
 
     // Set log file path
     memset(slot->log_file, 0, sizeof(*slot->log_file));
     if (globals.enable_task_logging) {
-        strncat(slot->log_file, pool->log_root, sizeof(slot->log_file) - strlen(slot->log_file) - 1);
-        strncat(slot->log_file, "/", sizeof(slot->log_file) - strlen(slot->log_file) - 1);
+        snprintf(slot->log_file, sizeof(slot->log_file) - strlen(slot->log_file), "%s/", pool->log_root);
     } else {
-        strncpy(slot->log_file, "/dev/stdout", sizeof(slot->log_file) - 1);
+        snprintf(slot->log_file, sizeof(slot->log_file), "/dev/stdout");
     }
 
     // Set working directory
     if (isempty(working_dir)) {
-        strncpy(slot->working_dir, ".", sizeof(slot->working_dir) - 1);
+        snprintf(slot->working_dir, sizeof(slot->working_dir), ".");
     } else {
-        strncpy(slot->working_dir, working_dir, sizeof(slot->working_dir) - 1);
+        snprintf(slot->working_dir, sizeof(slot->working_dir), "%s", working_dir);
     }
 
     // Create a temporary file to act as our intermediate command script
@@ -191,7 +195,16 @@ struct MultiProcessingTask *mp_pool_task(struct MultiProcessingPool *pool, const
     char *t_name = NULL;
 
     t_name = xmkstemp(&tp, "w");
-    if (!t_name || !tp) {
+    if (!t_name) {
+        SYSERROR("%s", "Failed to create temporary file name");
+        if (tp) {
+            fclose(tp);
+        }
+        return NULL;
+    }
+    if (!tp) {
+        SYSERROR("%s", "Failed to create temporary file");
+        guard_free(t_name);
         return NULL;
     }
 
@@ -202,7 +215,7 @@ struct MultiProcessingTask *mp_pool_task(struct MultiProcessingPool *pool, const
 
     // Record the script path
     memset(slot->parent_script, 0, sizeof(slot->parent_script));
-    strncpy(slot->parent_script, t_name, PATH_MAX - 1);
+    snprintf(slot->parent_script, sizeof(slot->parent_script), "%s", t_name);
     guard_free(t_name);
 
     // Populate the script
@@ -216,7 +229,7 @@ struct MultiProcessingTask *mp_pool_task(struct MultiProcessingPool *pool, const
     slot->cmd_len = (strlen(cmd) * sizeof(*cmd)) + 1;
     slot->cmd = mmap(NULL, slot->cmd_len, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0);
     memset(slot->cmd, 0, slot->cmd_len);
-    strncpy(slot->cmd, cmd, slot->cmd_len);
+    snprintf(slot->cmd, slot->cmd_len, "%s", cmd);
 
     // Set task timeout
     slot->timeout = globals.task_timeout;
@@ -236,13 +249,13 @@ void mp_pool_show_summary(struct MultiProcessingPool *pool) {
         if (task->status == MP_POOL_TASK_STATUS_INITIAL && task->pid == MP_POOL_PID_UNUSED) {
             // You will only see this label if the task pool is killed by
             // MP_POOL_FAIL_FAST and tasks are still queued for execution
-            strncpy(status_str, "HOLD", sizeof(status_str) - 1);
+            snprintf(status_str, sizeof(status_str), "HOLD");
         } else if (!task->status && !task->signaled_by) {
-            strncpy(status_str, "DONE", sizeof(status_str) - 1);
+            snprintf(status_str, sizeof(status_str), "DONE");
         } else if (task->signaled_by) {
-            strncpy(status_str, "TERM", sizeof(status_str) - 1);
+            snprintf(status_str, sizeof(status_str), "TERM");
         } else {
-            strncpy(status_str, "FAIL", sizeof(status_str) - 1);
+            snprintf(status_str, sizeof(status_str), "FAIL");
         }
 
         char duration[255] = {0};
@@ -512,11 +525,11 @@ struct MultiProcessingPool *mp_pool_init(const char *ident, const char *log_root
 
     // Set pool identity string
     memset(pool->ident, 0, sizeof(pool->ident));
-    strncpy(pool->ident, ident, sizeof(pool->ident) - 1);
+    snprintf(pool->ident, sizeof(pool->ident), "%s", ident);
 
     // Set logging base directory
     memset(pool->log_root, 0, sizeof(pool->log_root));
-    strncpy(pool->log_root, log_root, sizeof(pool->log_root) - 1);
+    snprintf(pool->log_root, sizeof(pool->log_root), "%s", log_root);
     pool->num_used = 0;
     pool->num_alloc = MP_POOL_TASK_MAX;
 
diff --git a/src/lib/core/relocation.c b/src/lib/core/relocation.c
index bd5504b..ea8b9c6 100644
--- a/src/lib/core/relocation.c
+++ b/src/lib/core/relocation.c
@@ -138,6 +138,7 @@ int file_replace_text(const char* filename, const char* target, const char* repl
     fp = fopen(filename, "w+");
     if (!fp) {
         SYSERROR("unable to reopen %s for writing", filename);
+        fclose(tfp);
         return -1;
     }
 
diff --git a/src/lib/core/semaphore.c b/src/lib/core/semaphore.c
index 579479a..3a2ffb6 100644
--- a/src/lib/core/semaphore.c
+++ b/src/lib/core/semaphore.c
@@ -53,11 +53,21 @@ int semaphore_init(struct Semaphore *s, const char *name, const int value) {
 }
 
 int semaphore_wait(struct Semaphore *s) {
-    return sem_wait(s->sem);
+    //int sgv_value = 0;
+    //int sgv_ret = sem_getvalue(s->sem, &sgv_value);
+    //SYSDEBUG("sem_getvalue() returned %d, value %d", sgv_ret, sgv_value);
+    const int status = sem_wait(s->sem);
+    //SYSDEBUG("returning %d", status);
+    return status;
 }
 
 int semaphore_post(struct Semaphore *s) {
-    return sem_post(s->sem);
+    //int sgv_value = 0;
+    //int sgv_ret = sem_getvalue(s->sem, &sgv_value);
+    //SYSDEBUG("sem_getvalue() returned %d, value %d", sgv_ret, sgv_value);
+    const int status = sem_post(s->sem);
+    //SYSDEBUG("returning %d", status);
+    return status;
 }
 
 void semaphore_destroy(struct Semaphore *s) {
diff --git a/src/lib/core/system.c b/src/lib/core/system.c
index 6c18cc2..5b47a62 100644
--- a/src/lib/core/system.c
+++ b/src/lib/core/system.c
@@ -21,7 +21,12 @@ int shell(struct Process *proc, char *args) {
 
     FILE *tp = NULL;
     char *t_name = xmkstemp(&tp, "w");
-    if (!t_name || !tp) {
+    if (!t_name) {
+        fclose(tp);
+        return -1;
+    }
+    if (!tp) {
+        guard_free(t_name);
         return -1;
     }
 
@@ -37,6 +42,8 @@ int shell(struct Process *proc, char *args) {
     pid_t pid = fork();
     if (pid == -1) {
         fprintf(stderr, "fork failed\n");
+        guard_free(t_name);
+        fclose(tp);
         exit(1);
     } else if (pid == 0) {
         FILE *fp_out = NULL;
@@ -55,6 +62,9 @@ int shell(struct Process *proc, char *args) {
                 fp_err = freopen(proc->f_stderr, "w+", stderr);
                 if (!fp_err) {
                     fprintf(stderr, "Unable to redirect stderr to %s: %s\n", proc->f_stdout, strerror(errno));
+                    if (fp_out) {
+                        fclose(fp_out);
+                    }
                     exit(1);
                 }
             }
@@ -62,12 +72,24 @@ int shell(struct Process *proc, char *args) {
 
         if (proc->redirect_stderr) {
             if (fp_err) {
+                if (dup2(fileno(fp_err), STDERR_FILENO) < 0) {
+                    fprintf(stderr, "Unable to redirect stderr to %s: %s\n", proc->f_stderr, strerror(errno));
+                    if (fp_out) {
+                        fclose(fp_out);
+                    }
+                    fclose(fp_err);
+                    _exit(1);
+                }
                 fclose(fp_err);
-                fclose(stderr);
-            }
-            if (dup2(fileno(stdout), fileno(stderr)) < 0) {
-                fprintf(stderr, "Unable to redirect stderr to stdout: %s\n", strerror(errno));
-                exit(1);
+            } else {
+                // redirect stderr to stdout
+                if (dup2(STDOUT_FILENO, STDERR_FILENO) < 0) {
+                    fprintf(stderr, "Unable to redirect stderr to stdout: %s\n", strerror(errno));
+                    if (fp_out) {
+                        fclose(fp_out);
+                    }
+                    _exit(1);
+                }
             }
         }
 
diff --git a/src/lib/core/template.c b/src/lib/core/template.c
index 623b811..3a1b759 100644
--- a/src/lib/core/template.c
+++ b/src/lib/core/template.c
@@ -28,7 +28,16 @@ extern void tpl_reset() {
 
 void tpl_register_func(char *key, void *tplfunc_ptr, int argc, void *data_in) {
     struct tplfunc_frame *frame = calloc(1, sizeof(*frame));
+    if (!frame) {
+        SYSERROR("%s", "unable to allocate memory for function frame");
+        exit(1);
+    }
+
     frame->key = strdup(key);
+    if (!frame->key) {
+        SYSERROR("%s", "unable to allocate memory for function frame key");
+        exit(1);
+    }
     frame->argc = argc;
     frame->func = tplfunc_ptr;
     frame->data_in = data_in;
@@ -71,7 +80,15 @@ void tpl_register(char *key, char **ptr) {
     } else {
         SYSDEBUG("%s", "Creating new item");
         item = calloc(1, sizeof(*item));
+        if (!item) {
+            SYSERROR("%s", "unable to allocate memory for new item");
+            exit(1);
+        }
         item->key = strdup(key);
+        if (!key) {
+            SYSERROR("%s", "unable to allocate memory for new key");
+            exit(1);
+        }
     }
 
     if (!item) {
@@ -240,6 +257,11 @@ char *tpl_render(char *str) {
                 for (params_count = 0; params[params_count] != NULL; params_count++) {}
 
                 struct tplfunc_frame *frame = tpl_getfunc(k);
+                if (!frame) {
+                    SYSERROR("no function named '%s'", k);
+                    guard_array_n_free(params, (size_t) params_count);
+                    return NULL;
+                }
                 if (params_count > frame->argc || params_count < frame->argc) {
                     fprintf(stderr, "At position %zu in %s\nIncorrect number of arguments for function: %s (expected %d, got %d)\n", off, key, frame->key, frame->argc, params_count);
                     value = strdup("");
diff --git a/src/lib/core/utils.c b/src/lib/core/utils.c
index f65a1d8..2b7f0ec 100644
--- a/src/lib/core/utils.c
+++ b/src/lib/core/utils.c
@@ -320,9 +320,7 @@ int git_clone(struct Process *proc, char *url, char *destdir, char *gitref) {
 
     if (destdir && access(destdir, F_OK) < 0) {
         // Destination directory does not exist
-        const char *command_fmt = " %s";
-        const int command_fmt_len = snprintf(NULL, 0, command_fmt, destdir);
-        snprintf(command + strlen(command), sizeof(command) - command_fmt_len, command_fmt, destdir);
+        snprintf(command + strlen(command), sizeof(command) - strlen(command), " %s", destdir);
         // Clone the repo
         result = shell(proc, command);
         if (result) {
@@ -677,9 +675,9 @@ int fix_tox_conf(const char *filename, char **result, size_t maxlen) {
     if (!toxini) {
         if (fptemp) {
             guard_free(result);
-            guard_free(tempfile);
             fclose(fptemp);
         }
+        guard_free(tempfile);
         return -1;
     }
 
@@ -704,6 +702,7 @@ int fix_tox_conf(const char *filename, char **result, size_t maxlen) {
                                 SYSERROR("failed to increase size to +%zu bytes",
                                          strlen(value) + strlen(with_posargs) + 1);
                                 guard_free(*result);
+                                guard_free(tempfile);
                                 return -1;
                             }
                             value = tmp;
@@ -926,9 +925,7 @@ void debug_hexdump(char *data, int len) {
     char *pos = start;
     while (pos != end) {
         if (count == 0) {
-            const char *pos_fmt = "%p";
-            const int pos_fmt_len = snprintf(NULL, 0, pos_fmt, pos);
-            snprintf(addr + strlen(addr), sizeof(addr) - pos_fmt_len, pos_fmt, pos);
+            snprintf(addr + strlen(addr), sizeof(addr) - strlen(addr), "%p", pos);
         }
         if (count == 8) {
             strncat(bytes, " ", sizeof(bytes) - strlen(bytes) - 1);
@@ -944,13 +941,8 @@ void debug_hexdump(char *data, int len) {
             continue;
         }
 
-        const char *bytes_fmt = "%02X ";
-        const int bytes_fmt_len = snprintf(NULL, 0, bytes_fmt, (unsigned char) *pos);
-        snprintf(bytes + strlen(bytes), sizeof(bytes) - bytes_fmt_len, bytes_fmt, (unsigned char) *pos);
-
-        const char *ascii_fmt = "%c";
-        // no need to calculate length for a single character
-        snprintf(ascii + strlen(ascii), sizeof(ascii) - strlen(ascii), ascii_fmt, isprint(*pos) ? *pos : '.');
+        snprintf(bytes + strlen(bytes), sizeof(bytes) - strlen(bytes), "%02X ", (unsigned char) *pos);
+        snprintf(ascii + strlen(ascii), sizeof(ascii) - strlen(ascii), "%c", isprint(*pos) ? *pos : '.');
 
         pos++;
         count++;
@@ -964,7 +956,7 @@ void debug_hexdump(char *data, int len) {
     for (int i = 0; i < padding; i++) {
         strncat(bytes, "   ", sizeof(bytes) - strlen(bytes) - 1);
     }
-    snprintf(output, DEBUG_HEXDUMP_FMT_BYTES + sizeof(addr) + sizeof(bytes) + sizeof(ascii), "%s | %s | %s", addr, bytes, ascii);
+    snprintf(output, sizeof(output), "%s | %s | %s", addr, bytes, ascii);
     puts(output);
 }
 
@@ -1178,6 +1170,7 @@ int get_random_bytes(char *result, size_t maxlen) {
         }
         if (fp && ferror(fp)) {
             SYSERROR("%s", "unable to read from random generator");
+            fclose(fp);
             return -1;
         }
         if (isalnum(ch)) {
diff --git a/src/lib/core/wheel.c b/src/lib/core/wheel.c
index 78209f1..0bc4209 100644
--- a/src/lib/core/wheel.c
+++ b/src/lib/core/wheel.c
@@ -90,6 +90,7 @@ static ssize_t wheel_parse_wheel(struct Wheel * pkg, const char * data) {
                     pkg->wheel_version = strdup(value);
                     if (!pkg->wheel_version) {
                         // memory error
+                        wheel_package_free(&pkg);
                         return -1;
                     }
                     break;
@@ -98,6 +99,7 @@ static ssize_t wheel_parse_wheel(struct Wheel * pkg, const char * data) {
                     pkg->generator = strdup(value);
                     if (!pkg->generator) {
                         // memory error
+                        wheel_package_free(&pkg);
                         return -1;
                     }
                     break;
@@ -106,6 +108,7 @@ static ssize_t wheel_parse_wheel(struct Wheel * pkg, const char * data) {
                     pkg->root_is_pure_lib = strdup(value);
                     if (!pkg->root_is_pure_lib) {
                         // memory error
+                        wheel_package_free(&pkg);
                         return -1;
                     }
                     break;
@@ -114,6 +117,7 @@ static ssize_t wheel_parse_wheel(struct Wheel * pkg, const char * data) {
                     if (!pkg->tag) {
                         pkg->tag = strlist_init();
                         if (!pkg->tag) {
+                            wheel_package_free(&pkg);
                             return -1;
                         }
                     }
@@ -126,8 +130,8 @@ static ssize_t wheel_parse_wheel(struct Wheel * pkg, const char * data) {
             }
             guard_free(key);
             guard_free(value);
+            guard_array_n_free(pair, 2);
         }
-        guard_array_free(pair);
     }
     guard_strlist_free(&lines);
     return data ? (ssize_t) strlen(data) : -1;
@@ -145,8 +149,8 @@ static ssize_t wheel_parse_metadata(struct WheelMetadata * const pkg, const char
     int reading_extra = 0;
     size_t provides_extra_i = 0;
     int reading_description = 0;
-    size_t base_description_len = 1024;
-    size_t len_description = 0;
+    int base_description_len = 1024;
+    int len_description = 0;
     struct WheelMetadata_ProvidesExtra *current_extra = NULL;
 
     if (!data) {
@@ -577,16 +581,16 @@ static ssize_t wheel_parse_metadata(struct WheelMetadata * const pkg, const char
                 // reading_description will never be reset to zero
                 reading_description = 1;
                 if (!pkg->description) {
-                    pkg->description = malloc(base_description_len + 1);
+                    pkg->description = malloc((size_t) base_description_len + 1);
                     if (!pkg->description) {
                         return -1;
                     }
-                    len_description = snprintf(pkg->description, base_description_len, "%s\n", line);
+                    len_description = snprintf(pkg->description, (size_t) base_description_len, "%s\n", line);
                 } else {
-                    const size_t next_len = snprintf(NULL, 0, "%s\n%s\n", pkg->description, line);
+                    const int next_len = snprintf(NULL, 0, "%s\n%s\n", pkg->description, line);
                     if (next_len + 1 > base_description_len) {
                         base_description_len *= 2;
-                        char *tmp = realloc(pkg->description, base_description_len + 1);
+                        char *tmp = realloc(pkg->description, (size_t) base_description_len + 1);
                         if (!tmp) {
                             // memory error
                             guard_free(pkg->description);
@@ -594,9 +598,7 @@ static ssize_t wheel_parse_metadata(struct WheelMetadata * const pkg, const char
                         }
                         pkg->description = tmp;
                     }
-                    len_description += snprintf(pkg->description + len_description, next_len + 1, "%s\n", line);
-
-                    //consume_append(&pkg->description, line, "\r\n");
+                    len_description += snprintf(pkg->description + len_description, (size_t) next_len + 1, "%s\n", line);
                 }
                 break;
             }
@@ -1051,13 +1053,13 @@ int wheel_get_records(struct Wheel *pkg, const char *filename) {
             const char *next_comma = strpbrk(token, ",");
             if (next_comma) {
                 if (x == 0) {
-                    record->filename = strndup(token, next_comma - token);
+                    record->filename = strndup(token, (size_t) (next_comma - token));
                 } else if (x == 1) {
-                    record->checksum = strndup(token, next_comma - token);
+                    record->checksum = strndup(token, (size_t) (next_comma - token));
                 }
                 token = next_comma + 1;
             } else {
-                record->size = strtol(token, NULL, 10);
+                record->size = (size_t) strtol(token, NULL, 10);
             }
         }
         records_count++;
diff --git a/src/lib/delivery/delivery.c b/src/lib/delivery/delivery.c
index 7d78878..5403743 100644
--- a/src/lib/delivery/delivery.c
+++ b/src/lib/delivery/delivery.c
@@ -2,7 +2,12 @@
 
 static char *strdup_maybe(const char * restrict s) {
     if (s != NULL) {
-        return strdup(s);
+        char *x = strdup(s);
+        if (!x) {
+            SYSERROR("%s", "strdup failed");
+            exit(1);
+        }
+        return x;
     }
     return NULL;
 }
@@ -57,9 +62,20 @@ struct Delivery *delivery_duplicate(const struct Delivery *ctx) {
     memcpy(&result->rules.content, &ctx->rules.content, sizeof(ctx->rules.content));
 
     if (ctx->rules._handle) {
+        SYSDEBUG("%s", "duplicating INIFILE handle - BEGIN");
         result->rules._handle = malloc(sizeof(*result->rules._handle));
-        result->rules._handle->section = malloc(result->rules._handle->section_count * sizeof(*result->rules._handle->section));
+        if (!result->rules._handle) {
+            SYSERROR("%s", "unable to allocate space for INIFILE handle");
+            return NULL;
+        }
+        result->rules._handle->section = malloc(ctx->rules._handle->section_count * sizeof(**ctx->rules._handle->section));
+        if (!result->rules._handle->section) {
+            guard_free(result->rules._handle);
+            SYSERROR("%s", "unable to allocate space for INIFILE section");
+            return NULL;
+        }
         memcpy(result->rules._handle, &ctx->rules._handle, sizeof(*ctx->rules._handle));
+        SYSDEBUG("%s", "duplicating INIFILE handle - END");
     }
 
     // Runtime
@@ -94,6 +110,10 @@ struct Delivery *delivery_duplicate(const struct Delivery *ctx) {
     result->system.arch = strdup_maybe(ctx->system.arch);
     if (ctx->system.platform) {
         result->system.platform = malloc(DELIVERY_PLATFORM_MAX * sizeof(*result->system.platform));
+        if (!result->system.platform) {
+            SYSERROR("%s", "unable to allocate space for system platform array");
+            return NULL;
+        }
         for (size_t i = 0; i < DELIVERY_PLATFORM_MAX; i++) {
             result->system.platform[i] = strdup_maybe(ctx->system.platform[i]);
         }
@@ -363,7 +383,7 @@ void delivery_defer_packages(struct Delivery *ctx, int type) {
         // Compile a list of packages that are *also* to be tested.
         char *spec_begin = strpbrk(name, "@~=<>!");
         char *spec_end = spec_begin;
-        char package_name[255] = {0};
+        char package_name[STASIS_NAME_MAX] = {0};
 
         if (spec_end) {
             // A version is present in the package name. Jump past operator(s).
@@ -381,7 +401,7 @@ void delivery_defer_packages(struct Delivery *ctx, int type) {
         // When spec is present in name, set tests->version to the version detected in the name
         for (size_t x = 0; x < ctx->tests->num_used; x++) {
             struct Test *test = ctx->tests->test[x];
-            char nametmp[1024] = {0};
+            char nametmp[STASIS_NAME_MAX] = {0};
 
             strncpy(nametmp, package_name, sizeof(nametmp) - 1);
             // Is the [test:NAME] in the package name?
diff --git a/src/lib/delivery/delivery_artifactory.c b/src/lib/delivery/delivery_artifactory.c
index 0a74241..1e93fd5 100644
--- a/src/lib/delivery/delivery_artifactory.c
+++ b/src/lib/delivery/delivery_artifactory.c
@@ -4,8 +4,12 @@ int delivery_init_artifactory(struct Delivery *ctx) {
     int status = 0;
     char dest[PATH_MAX] = {0};
     char filepath[PATH_MAX] = {0};
+
+    SYSDEBUG("%s", "Initializing artifactory tools");
     snprintf(dest, sizeof(dest), "%s/bin", ctx->storage.tools_dir);
+    SYSDEBUG("dest=%s", dest);
     snprintf(filepath, sizeof(dest), "%s/bin/jf", ctx->storage.tools_dir);
+    SYSDEBUG("filepath=%s", filepath);
 
     if (!access(filepath, F_OK)) {
         // already have it
@@ -13,6 +17,7 @@ int delivery_init_artifactory(struct Delivery *ctx) {
         goto delivery_init_artifactory_envsetup;
     }
 
+    SYSDEBUG("%s", "Assign platform");
     char *platform = ctx->system.platform[DELIVERY_PLATFORM];
     msg(STASIS_MSG_L3, "Downloading %s for %s %s\n", globals.jfrog.remote_filename, platform, ctx->system.arch);
     if ((status = artifactory_download_cli(dest,
diff --git a/src/lib/delivery/delivery_conda.c b/src/lib/delivery/delivery_conda.c
index d6898a4..cf61abb 100644
--- a/src/lib/delivery/delivery_conda.c
+++ b/src/lib/delivery/delivery_conda.c
@@ -4,25 +4,29 @@ void delivery_get_conda_installer_url(struct Delivery *ctx, char *result, size_t
     int len = 0;
     if (ctx->conda.installer_version) {
         // Use version specified by configuration file
-        len = snprintf(NULL, 0, ctx->conda.installer_baseurl,
+        len = snprintf(NULL, 0, "%s/%s-%s-%s-%s.sh",
+                ctx->conda.installer_baseurl,
                 ctx->conda.installer_name,
                 ctx->conda.installer_version,
                 ctx->conda.installer_platform,
                 ctx->conda.installer_arch);
 
-        snprintf(result, maxlen - len, "%s/%s-%s-%s-%s.sh", ctx->conda.installer_baseurl,
+        snprintf(result, maxlen - len, "%s/%s-%s-%s-%s.sh",
+                ctx->conda.installer_baseurl,
                 ctx->conda.installer_name,
                 ctx->conda.installer_version,
                 ctx->conda.installer_platform,
                 ctx->conda.installer_arch);
     } else {
         // Use latest installer
-        len = snprintf(NULL, 0, "%s/%s-%s-%s.sh", ctx->conda.installer_baseurl,
+        len = snprintf(NULL, 0, "%s/%s-%s-%s.sh",
+                ctx->conda.installer_baseurl,
                 ctx->conda.installer_name,
                 ctx->conda.installer_platform,
                 ctx->conda.installer_arch);
 
-        snprintf(result, maxlen - len, "%s/%s-%s-%s.sh", ctx->conda.installer_baseurl,
+        snprintf(result, maxlen - len, "%s/%s-%s-%s.sh",
+                ctx->conda.installer_baseurl,
                 ctx->conda.installer_name,
                 ctx->conda.installer_platform,
                 ctx->conda.installer_arch);
diff --git a/src/lib/delivery/delivery_docker.c b/src/lib/delivery/delivery_docker.c
index e5f1c2f..1178a8c 100644
--- a/src/lib/delivery/delivery_docker.c
+++ b/src/lib/delivery/delivery_docker.c
@@ -46,10 +46,7 @@ int delivery_docker(struct Delivery *ctx) {
         char *tag_orig = strlist_item(ctx->deploy.docker.tags, i);
         strncpy(tag, tag_orig, sizeof(tag) - 1);
         docker_sanitize_tag(tag);
-
-        const char *tag_fmt = " -t \"%s\" ";
-        const int tag_fmt_len = snprintf(NULL, 0, tag_fmt, tag);
-        snprintf(args + strlen(args), tag_fmt_len, tag_fmt, tag);
+        snprintf(args + strlen(args), sizeof(args) - strlen(args), " -t \"%s\" ", tag);
     }
 
     // Append build arguments to command (i.e. --build-arg "key=value"
@@ -58,10 +55,7 @@ int delivery_docker(struct Delivery *ctx) {
         if (!build_arg) {
             break;
         }
-
-        const char *build_arg_fmt = " --build-arg \"%s\" ";
-        const int build_arg_fmt_len = snprintf(NULL, 0, build_arg_fmt, build_arg);
-        snprintf(args + strlen(args), sizeof(args) - build_arg_fmt_len, build_arg_fmt, build_arg);
+        snprintf(args + strlen(args), sizeof(args) - strlen(args), " --build-arg \"%s\" ", build_arg);
     }
 
     // Build the image
diff --git a/src/lib/delivery/delivery_install.c b/src/lib/delivery/delivery_install.c
index 1e2b82c..22b3752 100644
--- a/src/lib/delivery/delivery_install.c
+++ b/src/lib/delivery/delivery_install.c
@@ -128,6 +128,11 @@ int delivery_overlay_packages_from_env(struct Delivery *ctx, const char *env_nam
     return 0;
 }
 
+static int fn_nop(const char *command) {
+    (void) command;
+    return 1;
+}
+
 int delivery_purge_packages(struct Delivery *ctx, const char *env_name, int use_pkg_manager) {
     int status = 0;
     char subcommand[100] = {0};
@@ -158,6 +163,7 @@ int delivery_purge_packages(struct Delivery *ctx, const char *env_name, int use_
             break;
         default:
             SYSERROR("Unknown package manager: %d", use_pkg_manager);
+            fn = fn_nop;
             status = -1;
             break;
     }
@@ -175,11 +181,12 @@ int delivery_purge_packages(struct Delivery *ctx, const char *env_name, int use_
             SYSERROR("%s removal operation failed", package_manager);
             guard_free(command);
             status = 1;
-            break;
+            goto cleanup;
         }
         guard_free(command);
     }
 
+    cleanup:
     if (current_env) {
         conda_activate(ctx->storage.conda_install_prefix, current_env);
         guard_free(current_env);
@@ -213,6 +220,11 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
         runner = pip_exec;
     }
 
+    if (!runner) {
+        SYSERROR("Invalid callback runner of type: %d", type);
+        return -1;
+    }
+
     if (INSTALL_PKG_CONDA_DEFERRED & type) {
         strncat(command_base, " --use-local", sizeof(command_base) - strlen(command_base) - 1);
     } else if (INSTALL_PKG_PIP_DEFERRED & type) {
@@ -222,9 +234,7 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
         if (!ctx->meta.based_on) {
             strncat(command_base, " --upgrade", sizeof(command_base) - strlen(command_base) - 1);
         }
-        const char *command_base_fmt = " --extra-index-url 'file://%s'";
-        const int len = snprintf(NULL, 0, command_base_fmt, ctx->storage.wheel_artifact_dir);
-        snprintf(command_base + strlen(command_base), sizeof(command_base) - len, command_base_fmt, ctx->storage.wheel_artifact_dir);
+        snprintf(command_base + strlen(command_base), sizeof(command_base), " --extra-index-url 'file://%s'", ctx->storage.wheel_artifact_dir);
     }
 
     size_t args_alloc_len = STASIS_BUFSIZ;
@@ -308,7 +318,7 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
                             return -1;
                         }
                     }
-                    snprintf(args + strlen(args), required_len + 1, fmt, req, info->version);
+                    snprintf(args + strlen(args), args_alloc_len - strlen(args), fmt, req, info->version);
                 } else {
                     fprintf(stderr, "Deferred package '%s' is not present in the tested package list!\n", name);
                     guard_free(args);
@@ -326,7 +336,7 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
                             return -1;
                         }
                     }
-                    snprintf(args + strlen(args), required_len + 1, fmt, name);
+                    snprintf(args + strlen(args), args_alloc_len - strlen(args), fmt, name);
                 } else {
                     const char *fmt_append = "%s '%s'";
                     const char *fmt = " '%s'";
@@ -338,7 +348,7 @@ int delivery_install_packages(struct Delivery *ctx, char *conda_install_dir, cha
                             return -1;
                         }
                     }
-                    snprintf(args + strlen(args), required_len + 1, fmt, name);
+                    snprintf(args + strlen(args), args_alloc_len - strlen(args), fmt, name);
                 }
             }
         }
diff --git a/tests/include/testing.h b/tests/include/testing.h
index 6fa5ca6..80d5aa2 100644
--- a/tests/include/testing.h
+++ b/tests/include/testing.h
@@ -115,8 +115,7 @@ inline char *stasis_testing_read_ascii(const char *filename) {
 }
 
 inline int stasis_testing_write_ascii(const char *filename, const char *data) {
-    FILE *fp;
-    fp = fopen(filename, "w+");
+    FILE *fp = fopen(filename, "w+");
     if (!fp) {
         perror(filename);
         return -1;
diff --git a/tests/test_utils.c b/tests/test_utils.c
index 7361139..a5faf5c 100644
--- a/tests/test_utils.c
+++ b/tests/test_utils.c
@@ -279,6 +279,7 @@ void test_file_readlines() {
     }
     if (fwrite(data, sizeof(*data), strlen(data), fp) != strlen(data)) {
         perror("short write");
+        fclose(fp);
         return;
     }
     fclose(fp);