Running update before upgrade will fetch the latest sources, so we
can be sure that the upgrades will bring the box to the latest
versions of everything. Otherwise, this is often a no-op because
the box's sources will be cached at time of generation, meaning
there is nothing to upgrade.
Fix shellcheck complaints. These changes are not particularly important,
but spotting new/real issues is easier when checker output is empty by
default.
