diff --git a/.appveyor.yml b/.appveyor.yml
index a698ed2f..7735f800 100644
--- a/.appveyor.yml
+++ b/.appveyor.yml
@@ -81,7 +81,7 @@ build_script:
   - set s=c:\projects\upx\src
   - cat .GITREV.txt
   - set /p GITREV=<.GITREV.txt
-  - cl -MT -EHsc -O2 -W4 -wd4244 -DUPX_VERSION_GITREV="""%GITREV%""" %DEFS% -DWITH_LZMA=0x443 -DUCL_NO_ASM -I%s%\lzma-sdk -Ic:\projects\deps\ucl-1.03\include -Ic:\projects\deps\zlib-1.2.8 -Feupx.exe %s%\*.cpp %BDIR%\ucl-1.03\ucl.lib %BDIR%\zlib-1.2.8\zlib.lib
+  - cl -MT -EHsc -J -O2 -W4 -DUPX_VERSION_GITREV="""%GITREV%""" %DEFS% -DWITH_LZMA=0x443 -DUCL_NO_ASM -I%s%\lzma-sdk -Ic:\projects\deps\ucl-1.03\include -Ic:\projects\deps\zlib-1.2.8 -Feupx.exe %s%\*.cpp %BDIR%\ucl-1.03\ucl.lib %BDIR%\zlib-1.2.8\zlib.lib
 
 test_script:
   - set UPX=--no-color --no-progress
diff --git a/src/Makefile b/src/Makefile
index 8adb4aa9..ca63c35c 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -10,15 +10,6 @@ BUILD_TYPE_SANITIZE ?= 0
 BUILD_USE_DEPEND    ?= 1
 
 MAKEFLAGS += -r
-ifneq ($(upx_CXX),)
-CXX = $(upx_CXX)
-endif
-ifneq ($(upx_CXXLD),)
-CXXLD = $(upx_CXXLD)
-else
-CXXLD = $(CXX)
-endif
-
 .SUFFIXES:
 export SHELL = /bin/sh
 override e = $($1) $(EXTRA_$1) $(upx_$1) $(upx_EXTRA_$1) $($(basename $(notdir $@)).$1)
@@ -36,6 +27,9 @@ ifneq ($(srcdir),.)
 VPATH := . $(srcdir)
 endif
 
+# toolchain
+CXX    ?= g++
+CXXLD   = $(CXX)
 exeext ?= .out
 libext ?= .a
 objext ?= .o
@@ -46,8 +40,8 @@ upx_OBJECTS := $(notdir $(upx_SOURCES:.cpp=$(objext)))
 ifneq ($(wildcard $(top_srcdir)/.git/.),)
 UPX_VERSION_GITREV := $(strip $(shell cd '$(top_srcdir)' && git rev-parse --short=12 HEAD || echo 'ERROR'))
 ifneq ($(UPX_VERSION_GITREV),)
-x := $(strip $(shell cd '$(top_srcdir)' && git diff --exit-code HEAD >/dev/null && echo '' || echo '+'))
-DEFS += '-DUPX_VERSION_GITREV="$(UPX_VERSION_GITREV)$(x)"'
+GITREV_PLUS := $(strip $(shell cd '$(top_srcdir)' && git diff --exit-code HEAD >/dev/null && echo '' || echo '+'))
+DEFS += '-DUPX_VERSION_GITREV="$(UPX_VERSION_GITREV)$(GITREV_PLUS)"'
 endif
 endif
 
@@ -63,38 +57,43 @@ DEFS += -DWITH_LZMA=$(UPX_LZMA_VERSION)
 
 CPPFLAGS += $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES)
 ifeq ($(BUILD_TYPE_DEBUG),1)
-CXXFLAGS += -O0 -g
+CXXFLAGS_OPTIMIZE ?= -O0 -g
 else
-CXXFLAGS += -O2
+CXXFLAGS_OPTIMIZE ?= -O2
 endif
+CXXFLAGS += $(CXXFLAGS_OPTIMIZE)
 # protect against security threats caused by misguided C++ compiler "optimizations"
 ifeq ($(findstring clang,$(CXX)),)
 CXXFLAGS += -fno-delete-null-pointer-checks
 endif
 CXXFLAGS += -fno-strict-aliasing -fwrapv
+CXXFLAGS += -funsigned-char
 CXXFLAGS += -Wall -W -Wcast-align -Wcast-qual -Wmissing-declarations -Wpointer-arith -Wshadow -Wwrite-strings
 CXXFLAGS_WERROR ?= -Werror
 CXXFLAGS += $(CXXFLAGS_WERROR)
 
 ifeq ($(BUILD_TYPE_SANITIZE),1)
-CXXFLAGS_SANITIZE := -fsanitize=address,undefined -fno-omit-frame-pointer -DACC_CFG_NO_UNALIGNED
+CXXFLAGS_SANITIZE ?= -fsanitize=address,undefined -fno-omit-frame-pointer -DACC_CFG_NO_UNALIGNED
 CXXFLAGS += $(CXXFLAGS_SANITIZE)
 LDFLAGS  += $(CXXFLAGS_SANITIZE)
 # these are the only 2 objects that are actually speed-sensitive
-compress_lzma$(objext) filteri$(objext) : CXXFLAGS := $(filter-out $(CXXFLAGS_SANITIZE),$(CXXFLAGS))
+compress_lzma$(objext) filteri$(objext) : CXXFLAGS_SANITIZE =
 endif
 
-
-all: check-whitespace upx$(exeext) | ./.depend
+# rules
+all: upx$(exeext) | ./.depend
 .DELETE_ON_ERROR: upx$(exeext) $(upx_OBJECTS) ./.depend
 
 upx$(exeext): $(upx_OBJECTS) $(upx_DEPENDENCIES)
 	$($(notdir $@).PRE_LINK_STEP)
 	$(strip $(CXXLD) $(call e,CPPFLAGS) $(call e,CXXFLAGS) $(call e,LDFLAGS) -o $@ $(upx_OBJECTS) $(call e,LDADD) $(call e,LIBS))
 	$($(notdir $@).POST_LINK_STEP)
+	$(CHECK_WHITESPACE)
 
 %.o : %.cpp | ./.depend
 	$(strip $(CXX) $(call e,CPPFLAGS) $(call e,CXXFLAGS) -o $@ -c $<)
+%.cpp.ii : %.cpp
+	$(strip $(CXX) $(call e,CPPFLAGS) $(call e,CXXFLAGS) -o $@ -E $<)
 
 ifeq ($(BUILD_USE_DEPEND),1)
 ./.depend: $(sort $(wildcard $(srcdir)/*.cpp $(srcdir)/*.h)) $(MAKEFILE_LIST)
@@ -106,8 +105,13 @@ else
 .PHONY: ./.depend
 endif
 
+CHECK_WHITESPACE =
 ifeq ($(shell uname),Linux)
-check-whitespace : ; bash $(top_srcdir)/src/stub/scripts/check_whitespace.sh $(top_srcdir)
+CHECK_WHITESPACE = $(top_srcdir)/src/stub/scripts/check_whitespace.sh $(top_srcdir)
+ifneq ($(wildcard $(top_srcdir)/.git/.),)
+CHECK_WHITESPACE = $(top_srcdir)/src/stub/scripts/check_whitespace_git.sh $(top_srcdir)
+endif
+check-whitespace : ; $(CHECK_WHITESPACE)
 endif
 .PHONY: check-whitespace
 
@@ -128,6 +132,7 @@ else ifeq ($(MAKECMDGOALS),clean)
 else ifeq ($(MAKECMDGOALS),distclean)
 else ifeq ($(MAKECMDGOALS),maintainer-clean)
 else ifeq ($(MAKECMDGOALS),clang-format)
+else ifeq ($(MAKECMDGOALS),check-whitespace)
 else
 ifeq ($(BUILD_USE_DEPEND),1)
 -include ./.depend
diff --git a/src/conf.h b/src/conf.h
index d9f36e70..c5f82113 100644
--- a/src/conf.h
+++ b/src/conf.h
@@ -48,9 +48,14 @@
    // other compilers may work, but we're NOT interested into supporting them
 #  error "only clang and gcc are officially supported"
 #endif
+// UPX sanity checks for a sane compiler
 #if !defined(UINT_MAX) || (UINT_MAX != 0xffffffffL)
 #  error "UINT_MAX"
 #endif
+ACC_COMPILE_TIME_ASSERT_HEADER(sizeof(int) == 4)
+ACC_COMPILE_TIME_ASSERT_HEADER((1u << 31) << 1 == 0)
+ACC_COMPILE_TIME_ASSERT_HEADER(((int)(1u << 31)) >> 31 == -1) // arithmetic right shift
+ACC_COMPILE_TIME_ASSERT_HEADER((char)(-1) > 0) // -funsigned-char
 
 // FIXME - quick hack for arm-wince-gcc-3.4 (Debian pocketpc-*.deb packages)
 #if 1 && (ACC_ARCH_ARM) && defined(__pe__) && !defined(__CEGCC__) && !defined(_WIN32)
diff --git a/src/p_djgpp2.cpp b/src/p_djgpp2.cpp
index 472fa8f5..0b50edb9 100644
--- a/src/p_djgpp2.cpp
+++ b/src/p_djgpp2.cpp
@@ -344,7 +344,7 @@ void PackDjgpp2::pack(OutputFile *fo)
 
     // because of a feature (bug?) in stub.asm we need some padding
     memcpy(obuf+data->size, "UPX", 3);
-    data->size = ALIGN_UP(data->size, 4);
+    data->size = ALIGN_UP(data->size, 4u);
 
     linker->defineSymbol("DJ2MAIN1", coff_hdr.a_entry);
     relocateLoader();
diff --git a/src/p_ps1.cpp b/src/p_ps1.cpp
index aa7a148e..6d792669 100644
--- a/src/p_ps1.cpp
+++ b/src/p_ps1.cpp
@@ -547,7 +547,7 @@ void PackPs1::pack(OutputFile *fo)
 
     const int lsize = getLoaderSize();
 
-    unsigned filelen = ALIGN_UP(ih.tx_len, 4);
+    unsigned filelen = ALIGN_UP(ih.tx_len, 4u);
 
     const unsigned decomp_data_start = ih.tx_ptr;
     const unsigned comp_data_start = (decomp_data_start + filelen + overlap) - ph.c_len;
@@ -594,7 +594,7 @@ void PackPs1::pack(OutputFile *fo)
     if (!opt->ps1_exe.no_align || !isCon)
     {
         pad = oh.tx_len;
-        oh.tx_len = ALIGN_UP(oh.tx_len, CD_SEC);
+        oh.tx_len = ALIGN_UP(oh.tx_len, CD_SEC+0u);
         pad = oh.tx_len - pad;
         oh.tx_ptr -= pad;
     }
diff --git a/src/pefile.cpp b/src/pefile.cpp
index f2376d80..7539e163 100644
--- a/src/pefile.cpp
+++ b/src/pefile.cpp
@@ -330,7 +330,7 @@ void PeFile::Reloc::finish(upx_byte *&p,unsigned &siz)
         {
             prev = pos;
             *rel1 = 0;
-            rel->size = ALIGN_UP(ptr_diff(rel1,rel),4);
+            rel->size = ALIGN_UP(ptr_diff(rel1,rel), 4);
             newRelocPos((char *)rel + rel->size);
             rel->pagestart = (pos >> 4) &~ 0xfff;
         }
@@ -1177,7 +1177,7 @@ void PeFile::Export::build(char *newbase, unsigned newoffs)
 
 void PeFile::processExports(Export *xport) // pass1
 {
-    soexport = ALIGN_UP(IDSIZE(PEDIR_EXPORT),4);
+    soexport = ALIGN_UP(IDSIZE(PEDIR_EXPORT),4u);
     if (soexport == 0)
         return;
     if (!isdll && opt->win32_pe.compress_exports)
@@ -1258,7 +1258,7 @@ void PeFile::processTls1(Interval *iv,
     COMPILE_TIME_ASSERT(sizeof(tls) == tls_traits<LEXX>::sotls)
     COMPILE_TIME_ASSERT_ALIGNED1(tls)
 
-    if ((sotls = ALIGN_UP(IDSIZE(PEDIR_TLS),4)) == 0)
+    if ((sotls = ALIGN_UP(IDSIZE(PEDIR_TLS),4u)) == 0)
         return;
 
     const tls * const tlsp = (const tls*) (ibuf + IDADDR(PEDIR_TLS));
@@ -1508,7 +1508,7 @@ const upx_byte *PeFile::Resource::ntype() const
 
 unsigned PeFile::Resource::size() const
 {
-    return ALIGN_UP(current->data.size,4);
+    return ALIGN_UP(current->data.size, 4u);
 }
 
 unsigned PeFile::Resource::offs() const
diff --git a/src/s_win32.cpp b/src/s_win32.cpp
index 09997ca9..de538521 100644
--- a/src/s_win32.cpp
+++ b/src/s_win32.cpp
@@ -42,9 +42,9 @@
 
 #if (ACC_CC_MSC && (_MSC_VER >= 1000 && _MSC_VER < 1200))
 /* avoid -W4 warnings in <conio.h> */
-#pragma warning(disable: 4032)
+#pragma warning(disable : 4032)
 /* avoid -W4 warnings in <windows.h> */
-#pragma warning(disable: 4201 4214 4514)
+#pragma warning(disable : 4201 4214 4514)
 #endif
 #if defined(__RSXNT__)
 #define timeval win32_timeval /* struct timeval already in <sys/time.h> */
diff --git a/src/stub/scripts/check_whitespace.sh b/src/stub/scripts/check_whitespace.sh
index bffb987d..c10fcda7 100755
--- a/src/stub/scripts/check_whitespace.sh
+++ b/src/stub/scripts/check_whitespace.sh
@@ -14,8 +14,11 @@ find . \
     -type f -iname '*.bat' -prune -o \
     -type f -iname '*.exe' -prune -o \
     -type f -iname '*.pdf' -prune -o \
-    -type f -print0 | LC_ALL=C sort -z | \
-xargs -0r perl -n -e '
+    -type f -iname '*.swp' -prune -o \
+    -type f -print0 | \
+LC_ALL=C sort -z | xargs -0r perl -n -e '
+    #print("$ARGV\n");
+    if (m,[\x00\x01\x02\xfe\xff],) { print "ERROR: binary file detected $ARGV: $_"; exit(1); }
     if (m,[\r\x1a],) { print "ERROR: DOS EOL detected $ARGV: $_"; exit(1); }
     if (m,([ \t]+)$,) {
         # allow exactly two trailing spaces for GitHub flavoured Markdown in .md files
diff --git a/src/stub/scripts/check_whitespace_git.sh b/src/stub/scripts/check_whitespace_git.sh
new file mode 100755
index 00000000..7caed2c3
--- /dev/null
+++ b/src/stub/scripts/check_whitespace_git.sh
@@ -0,0 +1,33 @@
+#! /usr/bin/env bash
+## vim:set ts=4 sw=4 et:
+set -e; set -o pipefail
+
+# Copyright (C) Markus Franz Xaver Johannes Oberhumer
+
+[[ -z $1 ]] || cd "$1" || exit 1
+[[ -d .git ]] || exit 1
+
+git ls-files --full-name -z | perl -0 -n -e '
+    s,^,./,;
+    if (m,^\./src/lzma-sdk(\0|$),) { }
+    elsif (m,\.bat(\0|$),) { }
+    elsif (m,\.exe(\0|$),) { }
+    else { print; }
+' | LC_ALL=C sort -z | xargs -0r perl -n -e '
+    #print("$ARGV\n");
+    if (m,[\x00\x01\x02\xfe\xff],) { print "ERROR: binary file detected $ARGV: $_"; exit(1); }
+    if (m,[\r\x1a],) { print "ERROR: DOS EOL detected $ARGV: $_"; exit(1); }
+    if (m,([ \t]+)$,) {
+        # allow exactly two trailing spaces for GitHub flavoured Markdown in .md files
+        if ($1 ne "  " || $ARGV !~ m,\.md$,) {
+            print "ERROR: trailing whitespace detected $ARGV: $_"; exit(1);
+        }
+    }
+    if (m,\t,) {
+       if ($ARGV =~ m,(^|/)\.gitmodules$,) { }
+       elsif ($ARGV =~ m,(^|/)(gnu|m)?make(file|vars),i) { }
+       elsif ($ARGV =~ m,/tmp/.*\.(disasm|dump)$,) { }
+       elsif ($ARGV =~ m,/src/stub/src/arch/.*\.S$,) { }
+       else { print "ERROR: hard TAB detected $ARGV: $_"; exit(1); }
+    }
+' || exit 1