diff --git a/contrib/updpkgsums.sh.in b/contrib/updpkgsums.sh.in
index b0d2d69e..7b92efe3 100644
--- a/contrib/updpkgsums.sh.in
+++ b/contrib/updpkgsums.sh.in
@@ -82,9 +82,6 @@ fi
 export BUILDDIR=$(mktemp -d --tmpdir updpkgsums.XXXXXX)
 newbuildfile=$(mktemp --tmpdir updpkgsums.XXXXXX)
 
-# In case the eventual replacement fails, we don't want to leave behind
-# $newbuildfile as garbage in $TMPDIR. This fails silently if the replacement
-# succeeds.
 trap "rm -rf '$BUILDDIR' '$newbuildfile'" EXIT
 newsums=$(makepkg -g -p "$buildfile") || die 'Failed to generate new checksums'
 awk -v newsums="$newsums" '
@@ -100,8 +97,9 @@ awk -v newsums="$newsums" '
 	END { if (!w) print newsums }
 ' "$buildfile" > "$newbuildfile" || die 'Failed to write new PKGBUILD'
 
-# Replace the original buildfile.
-if ! mv -- "$newbuildfile" "$buildfile"; then
+# Rewrite the original buildfile. Use cat instead of mv/cp to preserve
+# permissions implicitly.
+if ! cat -- "$newbuildfile" >"$buildfile"; then
 	die "Failed to update %s. The file has not been modified." "$buildfile"
 fi
 
diff --git a/doc/PKGBUILD.5.txt b/doc/PKGBUILD.5.txt
index 7fa91ffe..c95c41d8 100644
--- a/doc/PKGBUILD.5.txt
+++ b/doc/PKGBUILD.5.txt
@@ -216,7 +216,7 @@ underscore and the architecture name e.g., 'checkdepends_x86_64=()'.
 	and are not utilized by pacman during dependency resolution. The format
 	for specifying optdepends is:
 
-	optdepends=('fakeroot: for makepkg usage as normal user')
+	optdepends=('python: for library bindings')
 +
 Additional architecture-specific optdepends can be added by appending an
 underscore and the architecture name e.g., 'optdepends_x86_64=()'.
@@ -336,10 +336,9 @@ files into the packaging directory, with optional `prepare()`, `build()`, and
 *package() Function*::
 	The `package()` function is used to install files into the directory that
 	will become the root directory of the built package and is run after all
-	the optional functions listed below. When specified in combination with
-	the fakeroot BUILDENV option in linkman:makepkg.conf[5], fakeroot usage
-	will be limited to running the packaging stage. All other functions will
-	be run as the user calling makepkg.
+	the optional functions listed below. The packaging stage is run using
+	fakeroot to ensure correct file permissions in the resulting package.
+	All other functions will be run as the user calling makepkg.
 
 *prepare() Function*::
 	An optional `prepare()` function can be specified in which operations to
diff --git a/etc/makepkg.conf.in b/etc/makepkg.conf.in
index 9ed7ef91..19f673d1 100644
--- a/etc/makepkg.conf.in
+++ b/etc/makepkg.conf.in
@@ -19,7 +19,7 @@ DLAGENTS=('ftp::/usr/bin/curl -qfC - --ftp-pasv --retry 3 --retry-delay 3 -o %o
 # /usr/bin/lftpget -c
 # /usr/bin/wget
 
-#-- The the package required by makepkg to download VCS sources
+#-- The package required by makepkg to download VCS sources
 #  Format: 'protocol::package'
 VCSCLIENTS=('bzr::bzr'
             'git::git'
diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
index 0db99120..880e7781 100644
--- a/scripts/makepkg.sh.in
+++ b/scripts/makepkg.sh.in
@@ -1499,7 +1499,7 @@ check_pgpsigs() {
 			esac
 			errors=1
 		else
-			if (( ${#validpgpkeys[@]} == 0 && ! $trusted )); then
+			if (( ${#validpgpkeys[@]} == 0 && !trusted )); then
 				printf "%s ($(gettext "the public key %s is not trusted"))" $(gettext "FAILED") "$fingerprint" >&2
 				errors=1
 			elif (( ${#validpgpkeys[@]} > 0 )) && ! in_array "$fingerprint" "${validpgpkeys[@]}"; then