diff --git a/CMakeLists.txt b/CMakeLists.txt
index b5a51991..081786fd 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -67,67 +67,67 @@ if(NOT CMAKE_CROSSCOMPILING)
       cat ARGS
       "/proc/cpuinfo"
       OUTPUT_VARIABLE CPUINFO)
-    string(REGEX REPLACE "^.*(sse2).*$" "\\1" SSE_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(sse2).*$" "\\1" SSE_THERE "${CPUINFO}")
     string(COMPARE EQUAL "sse2" "${SSE_THERE}" SSE2_TRUE)
-    string(REGEX REPLACE "^.*(sse4_2).*$" "\\1" SSE_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(sse4_2).*$" "\\1" SSE_THERE "${CPUINFO}")
     string(COMPARE EQUAL "sse4_2" "${SSE_THERE}" SSE42_TRUE)
     set(FALKHASH_OBJ falkhash-elf64.o)
     if(CMAKE_SIZEOF_VOID_P EQUAL 8)
       set(FHTW_OBJ fhtw-elf64.o)
     endif()
-    string(REGEX REPLACE "^.*(aes).*$" "\\1" AES_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(aes).*$" "\\1" AES_THERE "${CPUINFO}")
     string(COMPARE EQUAL "aes" "${AES_THERE}" AES_TRUE)
-    string(REGEX REPLACE "^.*(pclmulqdq).*$" "\\1" CLMUL_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(pclmulqdq).*$" "\\1" CLMUL_THERE "${CPUINFO}")
     string(COMPARE EQUAL "pclmulqdq" "${CLMUL_THERE}" CLMUL_TRUE)
-    string(REGEX REPLACE "^.* (sha_ni) .*$" "\\1" SHA_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (sha_ni) .*$" "\\1" SHA_THERE "${CPUINFO}")
     string(COMPARE EQUAL "sha_ni" "${SHA_THERE}" SHA_TRUE)
-    string(REGEX REPLACE "^.* (avx2) .*$" "\\1" AVX2_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (avx2) .*$" "\\1" AVX2_THERE "${CPUINFO}")
     string(COMPARE EQUAL "avx2" "${AVX2_THERE}" AVX2_TRUE)
-    string(REGEX REPLACE "^.* (avx512f) .*$" "\\1" AVX512F_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (avx512f) .*$" "\\1" AVX512F_THERE "${CPUINFO}")
     string(COMPARE EQUAL "avx512f" "${AVX512F_THERE}" AVX512F_TRUE)
-    string(REGEX REPLACE "^.* (avx512vl) .*$" "\\1" AVX512VL_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (avx512vl) .*$" "\\1" AVX512VL_THERE "${CPUINFO}")
     string(COMPARE EQUAL "avx512vl" "${AVX512VL_THERE}" AVX512VL_TRUE)
   elseif(CMAKE_SYSTEM_NAME MATCHES "Darwin")
     exec_program("/usr/sbin/sysctl -n machdep.cpu.features" OUTPUT_VARIABLE
                  CPUINFO)
-    string(REGEX REPLACE "^.*[^S](SSE2).*$" "\\1" SSE_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*[^S](SSE2).*$" "\\1" SSE_THERE "${CPUINFO}")
     string(COMPARE EQUAL "SSE2" "${SSE_THERE}" SSE2_TRUE)
-    string(REGEX REPLACE "^.*(SSE4.2).*$" "\\1" SSE_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(SSE4.2).*$" "\\1" SSE_THERE "${CPUINFO}")
     string(COMPARE EQUAL "SSE4.2" "${SSE_THERE}" SSE42_TRUE)
     set(FALKHASH_OBJ falkhash-macho64.o)
     if(CMAKE_SIZEOF_VOID_P EQUAL 8)
       set(FHTW_OBJ fhtw-macho64.o)
     endif()
-    string(REGEX REPLACE "^.*(AES).*$" "\\1" AES_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(AES).*$" "\\1" AES_THERE "${CPUINFO}")
     string(COMPARE EQUAL "AES" "${AES_THERE}" AES_TRUE)
-    string(REGEX REPLACE "^.*(SHA).*$" "\\1" SHA_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(SHA).*$" "\\1" SHA_THERE "${CPUINFO}")
     string(COMPARE EQUAL "SHA" "${SHA_THERE}" SHA_TRUE)
-    string(REGEX REPLACE "^.*(PCLMUL).*$" "\\1" CLMUL_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(PCLMUL).*$" "\\1" CLMUL_THERE "${CPUINFO}")
     string(COMPARE EQUAL "PCLMUL" "${CLMUL_THERE}" CLMUL_TRUE)
-    string(REGEX REPLACE "^.* (AVX2) .*$" "\\1" AVX2_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (AVX2) .*$" "\\1" AVX2_THERE "${CPUINFO}")
     string(COMPARE EQUAL "AVX2" "${AVX2_THERE}" AVX2_TRUE)
-    string(REGEX REPLACE "^.* (AVX512) .*$" "\\1" AVX512_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (AVX512) .*$" "\\1" AVX512_THERE "${CPUINFO}")
     string(COMPARE EQUAL "AVX512" "${AVX512_THERE}" AVX512_TRUE)
   elseif(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
     exec_program("grep Features /var/run/dmesg.boot" OUTPUT_VARIABLE CPUINFO)
-    string(REGEX REPLACE "^.*[^S](SSE2).*$" "\\1" SSE_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*[^S](SSE2).*$" "\\1" SSE_THERE "${CPUINFO}")
     string(COMPARE EQUAL "SSE2" "${SSE_THERE}" SSE2_TRUE)
-    string(REGEX REPLACE "^.*(SSE4.2).*$" "\\1" SSE_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(SSE4.2).*$" "\\1" SSE_THERE "${CPUINFO}")
     string(COMPARE EQUAL "SSE4.2" "${SSE_THERE}" SSE42_TRUE)
     set(FALKHASH_OBJ falkhash-elf64.o)
     if(CMAKE_SIZEOF_VOID_P EQUAL 8)
       set(FHTW_OBJ fhtw-elf64.o)
     endif()
-    string(REGEX REPLACE "^.*(AES).*$" "\\1" AES_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(AES).*$" "\\1" AES_THERE "${CPUINFO}")
     string(COMPARE EQUAL "AES" "${AES_THERE}" AES_TRUE)
-    string(REGEX REPLACE "^.*(PCLMULQDQ).*$" "\\1" CLMUL_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.*(PCLMULQDQ).*$" "\\1" CLMUL_THERE "${CPUINFO}")
     string(COMPARE EQUAL "PCLMULQDQ" "${CLMUL_THERE}" CLMUL_TRUE)
-    string(REGEX REPLACE "^.*(SHA).*$" "\\1" SHA_THERE ${CPUINFO}) # SHA1,SHA2
+    string(REGEX REPLACE "^.*(SHA).*$" "\\1" SHA_THERE "${CPUINFO}") # SHA1,SHA2
                                                                    # actually
     string(COMPARE EQUAL "SHA" "${SHA_THERE}" SHA_TRUE)
-    string(REGEX REPLACE "^.* (AVX2) .*$" "\\1" AVX2_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (AVX2) .*$" "\\1" AVX2_THERE "${CPUINFO}")
     string(COMPARE EQUAL "AVX2" "${AVX2_THERE}" AVX2_TRUE)
-    string(REGEX REPLACE "^.* (AVX512) .*$" "\\1" AVX512_THERE ${CPUINFO})
+    string(REGEX REPLACE "^.* (AVX512) .*$" "\\1" AVX512_THERE "${CPUINFO}")
     string(COMPARE EQUAL "AVX512" "${AVX512_THERE}" AVX512_TRUE)
   elseif(CMAKE_SYSTEM_NAME MATCHES "Windows")
     set(_vendor_id)