diff --git a/include/mrc.sh b/include/mrc.sh
index 3c6ac24e5376a3c17b4656cb64f7425cf4c1cca9..e57026a4ee2564b64baadf2709630c82b63888e7 100755
--- a/include/mrc.sh
+++ b/include/mrc.sh
@@ -22,8 +22,8 @@ extract_mrc()
 	extract_coreboot
 	)
 
-	x_ "${cbfstool}" "${appdir}/"coreboot-*.bin extract -n mrc.bin \
-	    -f "${_dest}" -r RO_SECTION
+	"${cbfstool}" "${appdir}/"coreboot-*.bin extract -n mrc.bin \
+	    -f "${_dest}" -r RO_SECTION || err "extract_mrc: cbfstool ${_dest}"
 }
 
 extract_partition()
@@ -40,8 +40,9 @@ extract_partition()
 	START=$(( $( echo ${ROOTP} | cut -f2 -d\ | tr -d "B" ) ))
 	SIZE=$(( $( echo ${ROOTP} | cut -f4 -d\ | tr -d "B" ) ))
 
-	x_ dd if="${FILE}" of="${ROOTFS}" bs=${_bs} \
-	    skip=$(( ${START} / ${_bs} )) count=$(( ${SIZE} / ${_bs} ))
+	dd if="${FILE}" of="${ROOTFS}" bs=${_bs} \
+	    skip=$(( ${START} / ${_bs} )) count=$(( ${SIZE} / ${_bs} )) || \
+	    err "extract_partition, dd ${FILE}, ${ROOTFS}"
 }
 
 extract_shellball()
@@ -58,7 +59,7 @@ extract_coreboot()
 	printf "Extracting coreboot image\n"
 	[ -f "${SHELLBALL}" ] || \
 	    err "extract_coreboot: shellball missing in google cros image"
-	x_ sh "${SHELLBALL}" --unpack "${_unpacked}"
+	sh "${SHELLBALL}" --unpack "${_unpacked}" || err "shellball, ${SHELLBALL}"
 
 	# TODO: audit the f* out of that shellball, for each mrc version.
 	# it has to be updated for each mrc update. we should ideally
@@ -70,5 +71,6 @@ extract_coreboot()
 	_version=$( cat "${_unpacked}/VERSION" | grep BIOS\ version: | \
 	    cut -f2 -d: | tr -d \  )
 
-	x_ cp "${_unpacked}/bios.bin" "coreboot-${_version}.bin"
+	cp "${_unpacked}/bios.bin" "coreboot-${_version}.bin" || \
+	    err "!cp unpacked, ${_unpacked}/bios.bin, coreboot-${_version}.rom"
 }
diff --git a/include/option.sh b/include/option.sh
index 1313710462b55540238586b099b7c616954b98da..aa8b844cd58a17535e05d9a6c683696f04a0394a 100755
--- a/include/option.sh
+++ b/include/option.sh
@@ -89,12 +89,12 @@ modify_coreboot_rom()
 		done
 	elif [ "${romtype}" = "i945 laptop" ]; then
 		# for bucts-based installation method from factory bios
-		x_ dd if="${rompath}" of="${tmprom}" bs=1 \
+		dd if="${rompath}" of="${tmprom}" bs=1 \
 		    skip=$(($(stat -c %s "${rompath}") - 0x10000)) \
-		    count=64k
-		x_ dd if="${tmprom}" of="${rompath}" bs=1 \
+		    count=64k || err "modrom 1, dd, ${rompath}"
+		dd if="${tmprom}" of="${rompath}" bs=1 \
 		    seek=$(($(stat -c %s "${rompath}") - 0x20000)) \
-		    count=64k conv=notrunc
+		    count=64k conv=notrunc || err "modrom 2, dd, ${rompath}"
 	fi
 	x_ rm -f "${tmprom}"
 }
diff --git a/script/build/grub b/script/build/grub
index ba0845d385856130cf274691d97edc8bf12924c7..31fc0084ad80c220ad9586ead1d4f4855eedfbfd 100755
--- a/script/build/grub
+++ b/script/build/grub
@@ -26,7 +26,7 @@ handle_dependencies()
 	[ -d "src/grub" ] || x_ ./update trees -f grub
 	[ -f "src/grub/grub-mkstandalone" ] || build_grub_utils
 	x_ mkdir -p "${elfdir}"
-	x_ rm -f "${elfdir}/"*
+	rm -f "${elfdir}/"* || err "!rm elf, handle_, ${elfdir}/"
 }
 
 build_grub_utils()
@@ -37,7 +37,7 @@ build_grub_utils()
 	x_ ./bootstrap --gnulib-srcdir=gnulib/ --no-git
 	x_ ./autogen.sh
 	x_ ./configure --with-platform=coreboot
-	x_ make -j$(nproc) FS_PAYLOAD_MODULES=""
+	make -j$(nproc) FS_PAYLOAD_MODULES="" || err "!mk grub utils"
 	)
 }
 
@@ -47,8 +47,8 @@ build_keymap_configs()
 		[ -f "${keylayoutfile}" ] || continue
 		keymap="${keylayoutfile##${grubcfgsdir}/keymap/}"
 		keymap="${keymap%.gkb}"
-		x_ printf "keymap %s\n" "${keymap}" > \
-		    "${elfdir}/keymap_${keymap}.cfg"
+		printf "keymap %s\n" "${keymap}" > \
+		    "${elfdir}/keymap_${keymap}.cfg" || err "!insert keymap"
 	done
 }
 
diff --git a/script/build/roms b/script/build/roms
index 2f7b93daf98c7ba4eae4c4ab1e87c82253fc441d..e8cd1c7f4f0f5b4ddbee3841fedcfa9fe1fe955f 100755
--- a/script/build/roms
+++ b/script/build/roms
@@ -136,7 +136,7 @@ prepare_target()
 	[ "${payload_memtest}" != "y" ] || [ -f "src/${memtest_bin}" ] || \
 		x_ ./update trees -b memtest86plus
 
-	x_ rm -f "${romdir}/"*
+	rm -f "${romdir}/"* || err "!prepare, rm files, ${romdir}"
 
 	build_dependency_grub
 	build_dependency_uboot
@@ -274,15 +274,17 @@ build_grub_roms()
 	if [ "${displaymode}" = "vesafb" ] || \
 	    [ "${displaymode}" = "corebootfb" ]; then
 		backgroundfile="config/grub/background/${grub_background}"
-		x_ "${cbfstool}" "${tmprom}" add -f ${backgroundfile} \
-		    -n background.png -t raw
+		"${cbfstool}" "${tmprom}" add -f ${backgroundfile} \
+		    -n background.png -t raw || err "insert background, ${backgroundfile}"
 	fi
 
 	tmpcfg=$(mktemp -t coreboot_rom.XXXXXXXXXX)
-	x_ printf "set grub_scan_disk=\"%s\"\n" "${grub_scan_disk}" >"${tmpcfg}"
+	printf "set grub_scan_disk=\"%s\"\n" "${grub_scan_disk}" >"${tmpcfg}" \
+	    || err "set grub_scandisk, ${grub_scan_disk}, ${tmpcfg}"
 	[ "${grub_scan_disk}" = "both" ] || \
 	    x_ "${cbfstool}" "${tmprom}" add -f "${tmpcfg}" -n scan.cfg -t raw
-	x_ printf "set timeout=%s\n" "${grub_timeout}" > "${tmpcfg}"
+	printf "set timeout=%s\n" "${grub_timeout}" > "${tmpcfg}" || \
+	    err "set timeout, ${grub_timeout}, ${tmpcfg}"
 	[ -z "${grub_timeout}" ] || x_ "${cbfstool}" "${tmprom}" add \
 	    -f "${tmpcfg}" -n timeout.cfg -t raw
 	x_ rm -f "${tmpcfg}"
diff --git a/script/update/release b/script/update/release
index d9dd9789e8106f9fcf3c08355f2874eb3582eb71..3ee99c78286cdb38cdf289f157e906f5098e074c 100755
--- a/script/update/release
+++ b/script/update/release
@@ -118,7 +118,8 @@ fetch_trees()
 	for x in config/*/build.list; do
 		[ -f "${x}" ] || continue
 		xp="${x#*/}"; xp="${xp%/*}"
-		[ -L "${xp}" ] || x_ rm -Rf "src/${xp}/${xp}"
+		[ -L "${xp}" ] || rm -Rf "src/${xp}/${xp}" || \
+		    err "!rm -Rf \"src/${xp}/${xp}\""
 	done
 
 	find . -name ".git" -exec rm -Rf {} + || err "${_xm}: rm .git"
@@ -144,20 +145,21 @@ handle_rom_archive()
 {
 	builddir="${1}"
 	romdir="tmp/romdir"
-	x_ rm -Rf "${romdir}"
+	rm -Rf "${romdir}" || err "!rm romdir, handle_rom_archive"
 	target="${builddir##*/}"
 
 	if [ ! -f "config/coreboot/${target}/target.cfg" ]; then
 		# No config, just make a tarball
 		tarball="release/${version}/roms/${relname}_${target}.tar.xz"
-		insert_copying_files "${builddir}"
+		insert_copying_files "${builddir}" || \
+		    err "!insert copy, handle, ${builddir}"
 		mktarball "${builddir}" "${tarball}"
 		return 0
 	fi
 
 	romdir="${romdir}/bin/${target}"
-	x_ mkdir -p "${romdir}"
-	x_ cp "${builddir}/"* "${romdir}"
+	mkdir -p "${romdir}" || err "!mkdir -p romdir, handle_rom_archive"
+	cp "${builddir}/"* "${romdir}" || err "!cp romdir, handle_rom_archive"
 
 	nukerom
 
@@ -166,7 +168,7 @@ handle_rom_archive()
 	insert_version_files "${romdir}" || \
 	    err "mkrom_tarball ${romdir}: versionfile"
 
-	insert_copying_files "${romdir}"
+	insert_copying_files "${romdir}" || err "!insert copy, handle 2, ${romdir}"
 	mkrom_tarball
 }
 
@@ -183,22 +185,24 @@ nukerom()
 		done
 		for romfile in "${romdir}"/*.tmprom; do
 			[ -f "${romfile}" ] || continue
-			x_ mv "${romfile}" "${romfile%.tmprom}.rom"
+			mv "${romfile}" "${romfile%.tmprom}.rom" || \
+			    err "!mv romfile, nukerom"
 		done
 	fi
 
 	# Hash the images before removing vendor files
 	# which "./vendor inject" uses for verification
-	x_ rm -f "${romdir}/vendorhashes"
-	x_ touch "${romdir}/vendorhashes"
+	rm -f "${romdir}/vendorhashes" || err "!rm ${romdir}/vendorhashes"
+	touch "${romdir}/vendorhashes" || err "!touch ${romdir}/vendorhashes"
 	(
-	x_ cd "${romdir}"
-	x_ sha512sum *.rom >> vendorhashes
+	cd "${romdir}" || err "!cd romdir ${romdir}, nukerom"
+	sha512sum *.rom >> vendorhashes || err "!create vendorhashes, nukerom"
 	)
 
 	for romfile in "${romdir}"/*.rom; do
 		[ -f "${romfile}" ] || continue
-		x_ ./vendor inject -r "${romfile}" -b ${target} -n nuke
+		./vendor inject -r "${romfile}" -b ${target} -n nuke || \
+		    err "!vendor inject (nuke) ${romfile}, nukerom"
 	done
 }
 
@@ -206,42 +210,43 @@ strip_ucode()
 {
 	romfile=${1}
 	_newrom_b="${romfile%.rom}_nomicrocode.tmprom"
-	x_ cp "${romfile}" "${_newrom_b}"
+	cp "${romfile}" "${_newrom_b}" || err "!cp romfile ${romfile}, strip_u"
 	microcode_present="y"
 	"${cbfstool}" "${_newrom_b}" remove -n \
 	    cpu_microcode_blob.bin 2>/dev/null || microcode_present="n"
 	[ "${microcode_present}" = "n" ] || return 0
 	printf "REMARK: '%s' already lacks microcode\n" "${romfile}" 1>&2
 	printf "Renaming default ROM file instead.\n" 1>&2
-	x_ mv "${romfile}" "${_newrom_b}"
+	mv "${romfile}" "${_newrom_b}" || err "!mv romfile ${romfile}, strip_u"
 }
 
 insert_copying_files()
 {
-	x_ rm -Rf "${1}/licenses"
-	x_ mkdir -p "${1}/licenses"
+	rm -Rf "${1}/licenses" || return 1
+	mkdir -p "${1}/licenses" || return 1
 	l="${1}/licenses"
 	# copy licenses to rom image archive, for completion
-	x_ cp "src/grub/COPYING" "${l}/COPYING.grub"
-	x_ cp "src/coreboot/default/COPYING" "${l}/COPYING.coreboot"
-	x_ cp -R "src/coreboot/default/LICENSES" "${l}/LICENSES.coreboot"
-	x_ cp "src/seabios/default/COPYING" "${l}/COPYING.coreboot"
-	x_ cp "src/seabios/default/COPYING.LESSER" "${l}/COPYING.LESSER.seabios"
-	x_ cp -R "src/u-boot/default/Licenses" "${l}/COPYING.u-boot"
-	x_ printf "Multiple licenses. Check corresponding %s source archive\n" \
-	    "${projectname}" > "${1}/COPYING"
+	cp "src/grub/COPYING" "${l}/COPYING.grub" || return 1
+	cp "src/coreboot/default/COPYING" "${l}/COPYING.coreboot" || return 1
+	cp -R "src/coreboot/default/LICENSES" "${l}/LICENSES.coreboot" || return 1
+	cp "src/seabios/default/COPYING" "${l}/COPYING.coreboot" || return 1
+	cp "src/seabios/default/COPYING.LESSER" "${l}/COPYING.LESSER.seabios" || return 1
+	cp -R "src/u-boot/default/Licenses" "${l}/COPYING.u-boot" || return 1
+	printf "Multiple licenses. Check corresponding %s source archive\n" \
+	    "${projectname}" > "${1}/COPYING" || return 1
 }
 
 mkrom_tarball()
 {
 	archivename="${relname}_${target##*/}"
 	f="release/${version}/roms/${archivename}"
-	x_ mkdir -p "${f%/*}"
+	mkdir -p "${f%/*}" || err "mkrom_tarball: !mkdir -p ${f%/*}"
 	(
-	x_ cd "${romdir%/bin/${target}}"
+	cd "${romdir%/bin/${target}}" || err "!cd ${romdir%/bin/${target}}"
 	mktarball "bin/${target}" "${archivename}.tar.xz"
 	)
-	x_ mv "${romdir%/bin/${target}}/${archivename}.tar.xz"* "${f%/*}"
+	mv "${romdir%/bin/${target}}/${archivename}.tar.xz"* "${f%/*}" || \
+	    err "!mktarball, rom, ${f%/*}/${romdir%/bin/${target}}/${archivename}.tar.xz"
 
 	printf "Created ROM archive: ${f%/*}/${archivename}.tar.xz"
 }
@@ -258,7 +263,7 @@ mktarball()
 	# preserve timestamps for reproducible tarballs
 	tar_implementation=$(tar --version | head -n1) || :
 
-	[ "${2%/*}" = "${2}" ] || x_ mkdir -p "${2%/*}"
+	[ "${2%/*}" = "${2}" ] || mkdir -p "${2%/*}" || err "mk, !mkdir -p \"${2%/*}\""
 	if [ "${tar_implementation% *}" = "tar (GNU tar)" ]; then
 		tar --sort=name --owner=root:0 --group=root:0 \
 		    --mtime="UTC 2023-10-21" -c "${1}" | xz -T0 -9e > "${2}" || \
@@ -269,7 +274,8 @@ mktarball()
 	fi
 	(
 	[ "${2%/*}" != "${2}" ] && x_ cd "${2%/*}"
-	x_ sha512sum "${2##*/}" > "${2##*/}.sha512"
+	sha512sum "${2##*/}" > "${2##*/}.sha512" || \
+	    err "!sha512sum \"${2##*/}\" > \"${2##*/}.sha512\""
 	)
 }
 
diff --git a/script/vendor/inject b/script/vendor/inject
index 923224d085832f55aeaab7d4e1d3724fa2293e7f..db8004e4a4062a83453a15274804943a05d7f6ed 100755
--- a/script/vendor/inject
+++ b/script/vendor/inject
@@ -122,7 +122,8 @@ patch_release_roms()
 		[ -f "${x}" ] || continue
 		[ -f "${x%_nomicrocode.rom}.rom" ] || continue
 
-		x_ cp "${x%_nomicrocode.rom}.rom" "${x}"
+		cp "${x%_nomicrocode.rom}.rom" "${x}" || \
+		    err "patch_r: !cp \"${x%_nomicrocode.rom}.rom\" \"${x}\""
 		x_ "${cbfstool}" "${x}" remove -n cpu_microcode_blob.bin
 	done