diff --git a/thirdparty/cmake_modules/koreader_thirdparty_common.cmake b/thirdparty/cmake_modules/koreader_thirdparty_common.cmake
index 2dbe53b7e..581bc55e6 100644
--- a/thirdparty/cmake_modules/koreader_thirdparty_common.cmake
+++ b/thirdparty/cmake_modules/koreader_thirdparty_common.cmake
@@ -5,7 +5,13 @@ if(NOT DEFINED PROCESSOR_COUNT)
     set(PROCESSOR_COUNT ${N})
 endif()
 
-set(ISED "sed -ie")
+if (DEFINED ENV{DARWIN})
+    # Note: can't use `sed -i "" -e`, because cmake "helpfully"
+    # filter-out the empty argument during command invocation…
+    set(ISED sh -c "sed -i '' -e \"$@\"" --)
+else()
+    set(ISED sed -i -e)
+endif()
 
 if(NOT DEFINED PARALLEL_JOBS)
     math(EXPR PARALLEL_JOBS "${PROCESSOR_COUNT}+1")
@@ -30,10 +36,7 @@ else()
     set(KO_MAKE_RECURSIVE make)
 endif()
 
-set(KO_PATCH sh -c "${CMAKE_MODULE_PATH}/patch-wrapper.sh")
-# DownloadProject somehow faceplants with the variant above...
-# Plus, we need that one for inlined shell calls anyway.
-set(KO_PATCH_SH "sh ${CMAKE_MODULE_PATH}/patch-wrapper.sh")
+set(KO_PATCH ${CMAKE_MODULE_PATH}/patch-wrapper.sh)
 
 macro(assert_var_defined varName)
     if(NOT DEFINED ${varName})
@@ -50,3 +53,13 @@ macro(ep_get_binary_dir varName)
 endmacro()
 
 set(KO_DOWNLOAD_DIR "${CMAKE_CURRENT_SOURCE_DIR}/build/downloads")
+
+if(DEFINED ENV{ANDROID})
+    list(APPEND ANDROID_LIBTOOL_FIX_CMD ${ISED} $<SEMICOLON>
+        -e "s|version_type=none|version_type=linux|"
+        -e "s|need_lib_prefix=no|need_lib_prefix=yes|"
+        -e "s|need_version=no|need_version=yes|"
+        -e "s|library_names_spec=.*|library_names_spec=\"\\\\$libname\\\\$release\\\\$shared_ext\\\\$versuffix \\\\$libname\\\\$release\\\\$shared_ext\\\\$major \\\\$libname\\\\$shared_ext\"|"
+        -e "s|soname_spec=.*|soname_spec=\"\\\\$libname\\\\$release\\\\$shared_ext\\\\$major\"|"
+        libtool)
+endif()
diff --git a/thirdparty/curl/CMakeLists.txt b/thirdparty/curl/CMakeLists.txt
index 953047d09..4e52fdc58 100644
--- a/thirdparty/curl/CMakeLists.txt
+++ b/thirdparty/curl/CMakeLists.txt
@@ -18,23 +18,24 @@ ep_get_binary_dir(BINARY_DIR)
 
 # NOTE: Because InkView is the worst, we rename our own cURL build on PocketBook.... (#5861)
 if(DEFINED ENV{POCKETBOOK})
-    set(PATCH_CMD0 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/curl-7.78.0-pb-rename.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/curl-7.78.0-pb-rename.patch)
 endif()
 
-set(PATCH_CMD1 sh -c "${ISED} '/LD_LIBRARY_PATH=/d' ${SOURCE_DIR}/configure.ac")
-set(PATCH_CMD2 sh -c "${ISED} '/CURL_MAC_CFLAGS/d' ${SOURCE_DIR}/configure.ac")
-set(PATCH_CMD3 "./buildconf")
+list(APPEND PATCH_CMD COMMAND ${ISED} "/LD_LIBRARY_PATH=/d" ${SOURCE_DIR}/configure.ac)
+list(APPEND PATCH_CMD COMMAND ${ISED} "/CURL_MAC_CFLAGS/d" ${SOURCE_DIR}/configure.ac)
+list(APPEND PATCH_CMD COMMAND ./buildconf)
 
 set(CFG_ENV_VAR "CC=${CC}" "CPPFLAGS=${CPPFLAGS}" "CFLAGS=${CFLAGS}" "LDFLAGS=${LDFLAGS}")
 # Take a deep breath...
 # TODO: Flip to --with-zstd? We currently only use cURL for zsync2, so, obviously, not necessary right now...
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --host=${CHOST} --enable-shared=yes --enable-static=no --without-gnutls --without-mbedtls --without-nss --without-polarssl --without-winssl --with-ca-fallback --with-ca-bundle=./data/ca-bundle.crt --with-ssl --with-ca-path=/etc/ssl/certs --with-default-ssl-backend=openssl --disable-alt-svc --enable-crypto-auth --enable-dict --disable-ech --enable-file --enable-ftp --enable-gopher --enable-hsts --enable-http --enable-imap --disable-ldap --disable-ldaps --disable-ntlm-wb --enable-pop3 --enable-rt --enable-rtsp --disable-smb --without-libssh2 --enable-smtp --enable-telnet -enable-tftp --enable-tls-srp --disable-ares --enable-cookies --enable-dateparse --enable-dnsshuffle --enable-doh --enable-symbol-hiding --enable-http-auth --disable-ipv6 --enable-largefile --enable-manual --enable-mime --enable-netrc --enable-progress-meter --enable-proxy --disable-sspi --enable-threaded-resolver --enable-pthreads --enable-versioned-symbols --without-amissl --without-bearssl --without-brotli --without-cyassl --without-fish-functions-dir --without-nghttp2 --without-hyper --without-libidn2 --without-gssapi --without-libgsasl --without-libpsl --without-nghttp3 --without-ngtcp2 --without-quiche --without-librtmp --without-rustls --without-schannel --without-secure-transport --without-spnego --without-winidn --without-wolfssl --with-zlib --without-zstd)
-set(CFG_CMD ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
-set(CFG_CMD env ${CFG_CMD})
-set(BUILD_CMD1 ${KO_MAKE_RECURSIVE} ca-bundle)
-set(BUILD_CMD2 ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS})
-set(INSTALL_CMD1 ${KO_MAKE_RECURSIVE} install)
-set(INSTALL_CMD2 ${CMAKE_COMMAND} -E rename ${SOURCE_DIR}/lib/ca-bundle.crt ${BINARY_DIR}/ca-bundle.crt)
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+
+list(APPEND BUILD_CMD COMMAND ${KO_MAKE_RECURSIVE} ca-bundle)
+list(APPEND BUILD_CMD COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS})
+
+list(APPEND INSTALL_CMD COMMAND ${KO_MAKE_RECURSIVE} install)
+list(APPEND INSTALL_CMD COMMAND ${CMAKE_COMMAND} -E rename ${SOURCE_DIR}/lib/ca-bundle.crt ${BINARY_DIR}/ca-bundle.crt)
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
@@ -48,8 +49,8 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD0} COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2} COMMAND ${PATCH_CMD3}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ${CFG_CMD}
-    BUILD_COMMAND COMMAND ${BUILD_CMD1} COMMAND ${BUILD_CMD2}
-    INSTALL_COMMAND COMMAND ${INSTALL_CMD1} COMMAND ${INSTALL_CMD2}
+    BUILD_COMMAND COMMAND ${BUILD_CMD}
+    INSTALL_COMMAND COMMAND ${INSTALL_CMD}
 )
diff --git a/thirdparty/czmq/CMakeLists.txt b/thirdparty/czmq/CMakeLists.txt
index 6232e570f..a4012fe92 100644
--- a/thirdparty/czmq/CMakeLists.txt
+++ b/thirdparty/czmq/CMakeLists.txt
@@ -19,25 +19,22 @@ ep_get_binary_dir(BINARY_DIR)
 # -Wno-error so we can build on glibc 2.24 in spite of readdir_r
 set(CFG_ENV_VAR "CC=${CC}" "LDFLAGS=${LDFLAGS}" "CFLAGS=${CFLAGS} -Wno-error" czmq_have_xmlto=no czmq_have_asciidoc=no)
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --with-gnu-ld --with-libzmq=${ZMQ_DIR} --disable-static --enable-shared --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 # Hack to remove hardcoded rpath
-set(SED_CMD1 sh -c "${ISED} 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=\"\"|g' libtool")
-set(SED_CMD2 sh -c "${ISED} 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool")
+list(APPEND CFG_CMD COMMAND ${ISED} "s|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=\"\"|g" libtool)
+list(APPEND CFG_CMD COMMAND ${ISED} "s|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g" libtool)
 
+list(APPEND PATCH_CMD COMMAND ./autogen.sh)
 if(NOT DEFINED ENV{DARWIN})
     # patch: ignore limited broadcast address
-    set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zbeacon.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zbeacon.patch)
     # patch: add _DEFAULT_SOURCE define for glibc starting at version 2.20
-    set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/czmq_default_source_define.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/czmq_default_source_define.patch)
 endif()
 
 ko_write_gitclone_script(
@@ -51,8 +48,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND ./autogen.sh COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2}
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD} COMMAND ${SED_CMD1} COMMAND ${SED_CMD2}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} installdirs uninstall install
 )
diff --git a/thirdparty/djvulibre/CMakeLists.txt b/thirdparty/djvulibre/CMakeLists.txt
index f7aa29f44..5a43d870b 100644
--- a/thirdparty/djvulibre/CMakeLists.txt
+++ b/thirdparty/djvulibre/CMakeLists.txt
@@ -16,6 +16,17 @@ assert_var_defined(CHOST)
 
 ep_get_source_dir(SOURCE_DIR)
 
+list(APPEND PATCH_CMD COMMAND env NOCONFIGURE=1 ./autogen.sh)
+
+# Never *ever* call setlocale, for any reason.
+# Most of our target platforms have custom/broken/incomplete locales, don't screw with it.
+# And this runs in our main thread, so this is Very Bad(TM).
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/djvulibre-no-locale-mangling.patch)
+
+if(DEFINED ENV{ANDROID})
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/android.patch)
+endif()
+
 # fix build error due to -Werror under Fedora 26 (and potentially other systems)
 set(CFLAGS "${CFLAGS} -Wno-error")
 
@@ -25,24 +36,13 @@ set(CXXFLAGS "${CXXFLAGS} -Wno-register -Wno-error=register")
 
 set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CFLAGS=${CFLAGS}" "CXXFLAGS=${CXXFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --disable-desktopfiles --disable-static --enable-shared --disable-xmltools --disable-largefile --without-jpeg --without-tiff -host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
-
-# Never *ever* call setlocale, for any reason.
-# Most of our target platforms have custom/broken/incomplete locales, don't screw with it.
-# And this runs in our main thread, so this is Very Bad(TM).
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/djvulibre-no-locale-mangling.patch")
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
-
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
     # Technically we don't need tools on any platform but they only cause issues on Android
-    set(SED_CMD "${SED_CMD} && ${ISED} \"s|DIST_SUBDIRS = libdjvu.*|DIST_SUBDIRS = libdjvu|g\" Makefile")
-    set(SED_CMD "${SED_CMD} && ${ISED} \"s|SUBDIRS = libdjvu tools share \\$(am__append_1) \\$(am__append_2)|SUBDIRS = libdjvu share \\$(am__append_1) \\$(am__append_2)|g\" Makefile")
-    set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/android.patch")
+    list(APPEND CFG_CMD COMMAND ${ISED} "s|DIST_SUBDIRS = libdjvu.*|DIST_SUBDIRS = libdjvu|g" Makefile)
+    list(APPEND CFG_CMD COMMAND ${ISED} "s|SUBDIRS = libdjvu tools share \\$(am__append_1) \\$(am__append_2)|SUBDIRS = libdjvu share \\$(am__append_1) \\$(am__append_2)|g" Makefile)
 endif()
 
 ko_write_gitclone_script(
@@ -56,12 +56,9 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND NOCONFIGURE=1 ./autogen.sh
+    PATCH_COMMAND ${PATCH_CMD}
     BUILD_IN_SOURCE 1
-    CONFIGURE_COMMAND
-        COMMAND ${CFG_CMD}
-        COMMAND ${SED_CMD}
-        COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} SUBDIRS_FIRST=libdjvu
     # skip install
     INSTALL_COMMAND ""
diff --git a/thirdparty/dropbear/CMakeLists.txt b/thirdparty/dropbear/CMakeLists.txt
index 46b86d949..5279bfd29 100644
--- a/thirdparty/dropbear/CMakeLists.txt
+++ b/thirdparty/dropbear/CMakeLists.txt
@@ -15,23 +15,23 @@ assert_var_defined(CHOST)
 
 ep_get_source_dir(SOURCE_DIR)
 
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-nopasswd-hack.patch")
-set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-pubkey-hack.patch")
-set(PATCH_CMD3 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-pubkey-gen-hack.patch")
-set(PATCH_CMD4 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-nochdir-hack.patch")
-set(PATCH_CMD5 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-options-hack.patch")
-set(PATCH_CMD6 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-upstream-fixes.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-nopasswd-hack.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-pubkey-hack.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-pubkey-gen-hack.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-nochdir-hack.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-kindle-options-hack.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-upstream-fixes.patch)
 # This is pretty much platform-specific... Hard-coded paths and all that...
 if(DEFINED ENV{KOBO})
-    set(PATCH_CMD7 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-kobo.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-kobo.patch)
 elseif(DEFINED ENV{KINDLE})
-    set(PATCH_CMD7 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-kindle.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-kindle.patch)
 elseif(DEFINED ENV{CERVANTES})
-    set(PATCH_CMD7 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-cervantes.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-cervantes.patch)
 elseif(DEFINED ENV{POCKETBOOK})
-    set(PATCH_CMD7 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-pocketbook.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/dropbear-2018.76-scp-command-hack-pocketbook.patch)
 endif()
-set(PATCH_CMD8 sh -c "autoreconf -fi")
+list(APPEND PATCH_CMD COMMAND autoreconf -fi)
 
 set(CFG_ENV_VAR "CC=${CC}" "CPPFLAGS=${CPPFLAGS} -I${SOURCE_DIR}" "CFLAGS=${CFLAGS}" "LIBS=${LIBS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --host=${CHOST} --disable-lastlog --enable-zlib --enable-openpty --enable-shadow --enable-syslog --disable-harden)
@@ -46,8 +46,7 @@ ExternalProject_Add(
     URL http://deb.debian.org/debian/pool/main/d/dropbear/dropbear_${DROPBEAR_VER}.orig.tar.bz2
     URL_MD5 c3912f7fcdcc57c99937e4a79480d2c2
     DOWNLOAD_DIR ${KO_DOWNLOAD_DIR}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2} COMMAND
-    ${PATCH_CMD3} COMMAND ${PATCH_CMD4} COMMAND ${PATCH_CMD5} COMMAND ${PATCH_CMD6} COMMAND ${PATCH_CMD7} COMMAND ${PATCH_CMD8}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${BUILD_CMD}
     INSTALL_COMMAND ""
diff --git a/thirdparty/freetype2/CMakeLists.txt b/thirdparty/freetype2/CMakeLists.txt
index bc2aa4317..cf6af959e 100644
--- a/thirdparty/freetype2/CMakeLists.txt
+++ b/thirdparty/freetype2/CMakeLists.txt
@@ -16,14 +16,10 @@ ep_get_binary_dir(BINARY_DIR)
 
 set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CFLAGS=${CFLAGS}" "CXXFLAGS=${CXXFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --with-zlib=no --with-bzip2=no --with-brotli=no --with-png=no --with-harfbuzz=no --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 ko_write_gitclone_script(
@@ -38,7 +34,7 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     PATCH_COMMAND ./autogen.sh
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/fribidi/CMakeLists.txt b/thirdparty/fribidi/CMakeLists.txt
index 23914c4e8..8209145da 100644
--- a/thirdparty/fribidi/CMakeLists.txt
+++ b/thirdparty/fribidi/CMakeLists.txt
@@ -17,17 +17,13 @@ ep_get_binary_dir(BINARY_DIR)
 
 set(CFG_ENV_VAR "CC=${CC}" "CFLAGS=${CFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/autogen.sh ${CFG_OPTS})
 
 # Disable building docs, as it requires c2man
-set(SED_CMD sh -c "${ISED} 's|SUBDIRS = gen.tab lib bin doc test|SUBDIRS = gen.tab lib bin test|g' Makefile")
+list(APPEND CFG_CMD COMMAND ${ISED} "s|SUBDIRS = gen.tab lib bin doc test|SUBDIRS = gen.tab lib bin test|g" Makefile)
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 ko_write_gitclone_script(
@@ -41,9 +37,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND NOCONFIGURE=1 ./autogen.sh
     BUILD_IN_SOURCE 1
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/gettext/CMakeLists.txt b/thirdparty/gettext/CMakeLists.txt
index 1de6d7d94..859652694 100644
--- a/thirdparty/gettext/CMakeLists.txt
+++ b/thirdparty/gettext/CMakeLists.txt
@@ -19,19 +19,18 @@ ep_get_binary_dir(BINARY_DIR)
 
 # Android doesn't have a decimal_point member in the lconf struct before API 21
 if(DEFINED ENV{ANDROID})
-    set(PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/gettext-0.21-android-pre21-build.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/gettext-0.21-android-pre21-build.patch)
 endif()
 
 set(CFG_ENV_VAR "CC=${CC}" "AR=${AR}" "RANLIB=${RANLIB}" "CPPFLAGS=${CPPFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --enable-silent-rules --with-threads=none --disable-acl --disable-curses --disable-openmp --disable-native-java --disable-java)
 set(CFG_OPTS ${CFG_OPTS} --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --with-libiconv-prefix=${LIBICONV_PREFIX} --with-included-libunistring --with-included-libxml --with-included-gettext)
 set(CFG_OPTS ${CFG_OPTS} --enable-shared=false --enable-static=true ${CHOST_OPTS})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
-# remove HAVE_PWD_H for android build
 if(DEFINED ENV{ANDROID})
     # Tools? Where we're going we don't need tools.
-    set(SED_CMD sh -c "${ISED} 's/^\\(subdirs\\|SUBDIRS\\)\\( = .*\\) gettext-tools\$/\\1\\2/' Makefile")
+    list(APPEND CFG_CMD COMMAND ${ISED} "s/^\\(subdirs\\|SUBDIRS\\)\\( = .*\\) gettext-tools$/\\1\\2/" Makefile)
 endif()
 
 set(GETTEXT_VER "0.21")
@@ -41,8 +40,8 @@ ExternalProject_Add(
     URL http://ftpmirror.gnu.org/gettext/gettext-${GETTEXT_VER}.tar.gz
     URL_MD5 28b1cd4c94a74428723ed966c38cf479
     DOWNLOAD_DIR ${KO_DOWNLOAD_DIR}
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/giflib/CMakeLists.txt b/thirdparty/giflib/CMakeLists.txt
index 8c9850409..5e7feae0a 100644
--- a/thirdparty/giflib/CMakeLists.txt
+++ b/thirdparty/giflib/CMakeLists.txt
@@ -10,19 +10,17 @@ enable_language(C)
 ep_get_source_dir(SOURCE_DIR)
 ep_get_binary_dir(BINARY_DIR)
 
+list(APPEND PATCH_CMD ${ISED} "s|\\$srcdir/configure \\$\\*||g" autogen.sh)
+list(APPEND PATCH_CMD COMMAND ./autogen.sh)
+
 set(CFG_ENV_VAR ac_cv_prog_have_xmlto=no "CC=${CC}" "CFLAGS=${CFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 # use limits.h instead of stdint.h for android build
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} \"s|stdint.h|limits.h|g\" ${SOURCE_DIR}/lib/openbsd-reallocarray.c")
-
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ISED} "s|stdint.h|limits.h|g" ${SOURCE_DIR}/lib/openbsd-reallocarray.c)
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 ko_write_gitclone_script(
@@ -36,8 +34,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND sh -c "${ISED} \"s|\\$srcdir\\/configure \\$\\*||g\" autogen.sh" COMMAND ./autogen.sh
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/glib/CMakeLists.txt b/thirdparty/glib/CMakeLists.txt
index 65ca1dbcc..066fedc2e 100644
--- a/thirdparty/glib/CMakeLists.txt
+++ b/thirdparty/glib/CMakeLists.txt
@@ -26,35 +26,35 @@ ep_get_binary_dir(BINARY_DIR)
 # sometimes just hoping there's a python binary somewhere in $PATH (which, granted, there should be)...
 # Enforce that to python3 for containers where that's the only available Python version.
 if(DEFINED ENV{APPIMAGE} OR DEFINED ENV{CERVANTES} OR DEFINED ENV{KINDLE} OR DEFINED ENV{KOBO})
-    set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/glib-2.56.2-python3.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/glib-2.56.2-python3.patch)
 endif()
 # Android makes Linux syscalls hard to get to... Fix pilfered from Python.
 if(DEFINED ENV{ANDROID})
-    set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/glib-2.58.2-android-linux-syscalls.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/glib-2.58.2-android-linux-syscalls.patch)
 endif()
 
-set(PATCH_CMD3 env NOCONFIGURE=1 ./autogen.sh)
+list(APPEND PATCH_CMD COMMAND env NOCONFIGURE=1 ./autogen.sh)
 
 # Autotools needs some hints when x-compiling
-set(gen_arm_config "${gen_arm_config}glib_cv_stack_grows=no\\n")
-set(gen_arm_config "${gen_arm_config}glib_cv_uscore=no\\n")
+list(APPEND gen_arm_config "glib_cv_stack_grows=no")
+list(APPEND gen_arm_config "glib_cv_uscore=no")
 # In order to support legacy PocketBook 4.x firmware we should get rid of eventfd@GLIBC_2.7 and pipe2@GLIBC_2.9
 if(DEFINED ENV{LEGACY} OR DEFINED ENV{POCKETBOOK})
-    set(gen_arm_config "${gen_arm_config}glib_cv_eventfd=no\\n")
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_pipe2=no\\n")
+    list(APPEND gen_arm_config "glib_cv_eventfd=no")
+    list(APPEND gen_arm_config "ac_cv_func_pipe2=no")
     # As well as mkostemp@GLIBC_2.7
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_mkostemp=no\\n")
+    list(APPEND gen_arm_config "ac_cv_func_mkostemp=no")
 endif()
 if(DEFINED ENV{ANDROID})
     # disable getpwuid, getgrgid and timegm for > android-12
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_posix_getpwuid_r=no\\n")
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_posix_getgrgid_r=no\\n")
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_getpwuid_r=no\\n")
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_getgrgid_r=no\\n")
-    set(gen_arm_config "${gen_arm_config}ac_cv_func_timegm=no\\n")
+    list(APPEND gen_arm_config "ac_cv_func_posix_getpwuid_r=no")
+    list(APPEND gen_arm_config "ac_cv_func_posix_getgrgid_r=no")
+    list(APPEND gen_arm_config "ac_cv_func_getpwuid_r=no")
+    list(APPEND gen_arm_config "ac_cv_func_getgrgid_r=no")
+    list(APPEND gen_arm_config "ac_cv_func_timegm=no")
 endif()
 
-set(gen_arm_config sh -c "printf \"${gen_arm_config}\" > arm_cache.conf")
+list(APPEND CFG_CMD COMMAND sh -c "printf '%s\\n' \"$@\" >arm_cache.conf" -- ${gen_arm_config})
 
 set(CFG_ENV_VAR "CC=${CC}" "AR=${AR}" "RANLIB=${RANLIB}")
 set(CFG_ENV_VAR ${CFG_ENV_VAR} "LIBFFI_CFLAGS=-I${LIBFFI_DIR}/include")
@@ -80,7 +80,7 @@ endif()
 set(CFG_ENV_VAR ${CFG_ENV_VAR} "CFLAGS=${CFLAGS}" "LDFLAGS=${LDFLAGS}")
 
 set(CFG_OPTS ${CFG_OPTS} --host=${CHOST} ${HOST_OPTS})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
@@ -93,8 +93,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2} COMMAND ${PATCH_CMD3}
-    CONFIGURE_COMMAND COMMAND ${gen_arm_config} COMMAND ${CFG_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/harfbuzz/CMakeLists.txt b/thirdparty/harfbuzz/CMakeLists.txt
index bc607746e..464097223 100644
--- a/thirdparty/harfbuzz/CMakeLists.txt
+++ b/thirdparty/harfbuzz/CMakeLists.txt
@@ -19,6 +19,11 @@ assert_var_defined(FREETYPE_DIR)
 ep_get_source_dir(SOURCE_DIR)
 ep_get_binary_dir(BINARY_DIR)
 
+list(APPEND PATCH_CMD COMMAND env NOCONFIGURE=1 ./autogen.sh)
+
+# No build rpath
+list(APPEND PATCH_CMD COMMAND ${ISED} "s/\\(hardcode_into_libs\\)=.*$/\\1=no/" configure)
+
 # We've apparently hit a weird corner-case w/ XText where GCC/STL atomics *sometimes* horribly blow up on an ARM1136JF-S CPU w/ GCC 7.5...
 # c.f., https://github.com/koreader/koreader/issues/5780 & https://github.com/koreader/koreader/issues/6024
 # NOTE: Our initial approach was to only disable atomics in a very dirty manner, which only helped with the first issue.
@@ -32,21 +37,10 @@ set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CPPFLAGS=${CPPFLAGS} ${HB_CUSTOM_CFG}"
 set(CFG_ENV_VAR ${CFG_ENV_VAR} "FREETYPE_CFLAGS=-I${FREETYPE_DIR}/include/freetype2")
 set(CFG_ENV_VAR ${CFG_ENV_VAR} "FREETYPE_LIBS=-L${FREETYPE_DIR} -lfreetype")
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --enable-shared --disable-static --with-freetype --without-glib --without-gobject --without-cairo --without-fontconfig --without-icu --without-graphite2 --without-uniscribe --without-directwrite --without-coretext --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
-
-# Leaving PATCH_CMD unset appears to be perfectly fine, yay.
-
-set(AUTOGEN_CMD env NOCONFIGURE=1 ./autogen.sh)
-
-# No build rpath
-set(STUPID_CMD sh -c "${ISED} 's/\\(hardcode_into_libs\\)=.*\$/\\1=no/' configure")
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 set(HB_VER 8.2.2)
@@ -63,8 +57,8 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD} COMMAND ${AUTOGEN_CMD} COMMAND ${STUPID_CMD}
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${CONSTRAINED_PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/leptonica/CMakeLists.txt b/thirdparty/leptonica/CMakeLists.txt
index 762cfdaec..06a26bf16 100644
--- a/thirdparty/leptonica/CMakeLists.txt
+++ b/thirdparty/leptonica/CMakeLists.txt
@@ -23,17 +23,17 @@ ko_write_gitclone_script(
 # and not only when glibc >= 2.22, but since we now have the code to make the check, keep it,
 # that ensures a vanilla build with sane TCs ;).
 if((${ARM_GLIBC_GTE_2_22}) AND (NOT CMAKE_SYSTEM_PROCESSOR MATCHES ".+64$"))
-    set(PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/leptonica-1.74.1-fmemopen-arm-compat-symbol.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/leptonica-1.74.1-fmemopen-arm-compat-symbol.patch)
 endif()
 
 # We apparently need a rebuild of the configure on macOS (https://github.com/koreader/koreader/issues/4448#issuecomment-522363325)
-set(RECONF_CMD sh -c "autoreconf -fi")
+list(APPEND PATCH_CMD COMMAND autoreconf -fi)
 
 include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD} COMMAND ${RECONF_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ""
     # skip build and install, libk2pdfopt will build it
     BUILD_COMMAND ""
diff --git a/thirdparty/libpng/CMakeLists.txt b/thirdparty/libpng/CMakeLists.txt
index e1e0ab5cb..93f5f558e 100644
--- a/thirdparty/libpng/CMakeLists.txt
+++ b/thirdparty/libpng/CMakeLists.txt
@@ -17,14 +17,10 @@ ep_get_binary_dir(BINARY_DIR)
 
 set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CPPFLAGS=${CPPFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 ko_write_gitclone_script(
@@ -39,7 +35,7 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     PATCH_COMMAND ""
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/libunibreak/CMakeLists.txt b/thirdparty/libunibreak/CMakeLists.txt
index 36b54c68e..3ac38c78a 100644
--- a/thirdparty/libunibreak/CMakeLists.txt
+++ b/thirdparty/libunibreak/CMakeLists.txt
@@ -15,17 +15,14 @@ assert_var_defined(LDFLAGS)
 ep_get_source_dir(SOURCE_DIR)
 ep_get_binary_dir(BINARY_DIR)
 
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/add_lb_get_char_class.patch)
+
 set(CFG_ENV_VAR "CC=${CC}" "CFLAGS=${CFLAGS}" "LDFLAGS=${LDFLAGS}")
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --host=${CHOST})
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/add_lb_get_char_class.patch")
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/autogen.sh ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 ko_write_gitclone_script(
@@ -39,8 +36,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND ${PATCH_CMD1} COMMAND NOCONFIGURE=1 ./autogen.sh
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
 )
diff --git a/thirdparty/libwebp/CMakeLists.txt b/thirdparty/libwebp/CMakeLists.txt
index 0fc99db55..19370986b 100644
--- a/thirdparty/libwebp/CMakeLists.txt
+++ b/thirdparty/libwebp/CMakeLists.txt
@@ -16,6 +16,11 @@ assert_var_defined(CHOST)
 ep_get_source_dir(SOURCE_DIR)
 ep_get_binary_dir(BINARY_DIR)
 
+list(APPEND PATCH_CMD COMMAND ./autogen.sh)
+
+# No build rpath
+list(APPEND PATCH_CMD COMMAND ${ISED} "s/\\(hardcode_into_libs\\)=.*$/\\1=no/" configure)
+
 set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CPPFLAGS=${CPPFLAGS}" "LDFLAGS=${LDFLAGS}")
 # Note: with "--disable-libwebpmux --disable-libwebpdemux --enable-libwebpdecoder", we could
 # build libwebpdecoder.so only, which would be smaller and fine decoding single frame webp
@@ -23,17 +28,10 @@ set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CPPFLAGS=${CPPFLAGS}" "LDFLAGS=${LDFLAG
 # We need the regular libraries (libwebp.so and libwebpdemux.so) to handle them
 # (but we can left out the encoder, libwebpmux.so).
 set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --host=${CHOST} --disable-libwebpmux)
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
-
-# No build rpath
-set(PATCH_CMD sh -c "${ISED} 's/\\(hardcode_into_libs\\)=.*\$/\\1=no/' configure")
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
 ko_write_gitclone_script(
@@ -47,8 +45,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ./autogen.sh COMMAND ${PATCH_CMD}
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_IN_SOURCE 1
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} install
diff --git a/thirdparty/libzmq/CMakeLists.txt b/thirdparty/libzmq/CMakeLists.txt
index 99827f2d8..81c7e3e00 100644
--- a/thirdparty/libzmq/CMakeLists.txt
+++ b/thirdparty/libzmq/CMakeLists.txt
@@ -16,30 +16,29 @@ assert_var_defined(LDFLAGS)
 ep_get_source_dir(SOURCE_DIR)
 ep_get_binary_dir(BINARY_DIR)
 
+list(APPEND PATCH_CMD COMMAND ./autogen.sh)
+# Force dynamic lib version.
+list(APPEND PATCH_CMD COMMAND ${ISED} "s|-avoid-version||g" src/Makefile.am)
+# Skip tests.
+list(APPEND PATCH_CMD COMMAND ${ISED} "s|tests||g" Makefile.am)
+# Clear build dir every time so make install won't fail.
+list(APPEND PATCH_CMD COMMAND ${CMAKE_COMMAND} -E remove_directory ${BINARY_DIR} COMMAND ${CMAKE_COMMAND} -E make_directory ${BINARY_DIR})
+
 # added -Wno-unused-result in CXXFLAGS to ignore sodium_init() warning
-set(CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CFLAGS=${CFLAGS}" "CXXFLAGS=${CXXFLAGS} -Wno-unused-result" "LDFLAGS=${LDFLAGS}")
-set(CFG_ENV_VAR ${CFG_ENV_VAR} libzmq_have_xmlto=no libzmq_have_asciidoc=no)
+list(APPEND CFG_ENV_VAR "CC=${CC}" "CXX=${CXX}" "CFLAGS=${CFLAGS}" "CXXFLAGS=${CXXFLAGS} -Wno-unused-result" "LDFLAGS=${LDFLAGS}")
+list(APPEND CFG_ENV_VAR libzmq_have_xmlto=no libzmq_have_asciidoc=no)
 
-set(CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --without-documentation --host=${CHOST})
+list(APPEND CFG_OPTS --prefix=${BINARY_DIR} --libdir=${BINARY_DIR}/lib --disable-static --enable-shared --without-documentation --host=${CHOST})
 if(DEFINED ENV{LEGACY} OR DEFINED ENV{POCKETBOOK})
-    set(CFG_OPTS ${CFG_OPTS} --disable-eventfd)
+    list(APPEND CFG_OPTS --disable-eventfd)
 endif()
 
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure ${CFG_OPTS})
 
 if(DEFINED ENV{ANDROID})
-    set(SED_CMD sh -c "${ISED} 's|version_type=none|version_type=linux|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_lib_prefix=no|need_lib_prefix=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|need_version=no|need_version=yes|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|library_names_spec=.*|library_names_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$versuffix \\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major \\\\\$libname\\\\\$shared_ext\"|' libtool")
-    set(SED_CMD "${SED_CMD} && ${ISED} 's|soname_spec=.*|soname_spec=\"\\\\\$libname\\\\\$release\\\\\$shared_ext\\\\\$major\"|' libtool")
+    list(APPEND CFG_CMD COMMAND ${ANDROID_LIBTOOL_FIX_CMD})
 endif()
 
-set(FORCE_DYNAMLIB_VERSION sh -c "${ISED} \"s|-avoid-version||g\" src/Makefile.am")
-set(SKIP_TEST sh -c "${ISED} \"s|tests||g\" Makefile.am")
-# clear build dir every time so make install won't fail
-set(CLEAR_BUILD_DIR ${CMAKE_COMMAND} -E remove_directory ${BINARY_DIR} COMMAND ${CMAKE_COMMAND} -E make_directory ${BINARY_DIR})
-
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
     https://github.com/zeromq/libzmq
@@ -51,8 +50,8 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND ./autogen.sh COMMAND ${FORCE_DYNAMLIB_VERSION} COMMAND ${SKIP_TEST} COMMAND ${CLEAR_BUILD_DIR}
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
     INSTALL_COMMAND ${KO_MAKE_RECURSIVE} installdirs uninstall install
 )
diff --git a/thirdparty/lpeg/CMakeLists.txt b/thirdparty/lpeg/CMakeLists.txt
index cdf19aa08..c55d5f050 100644
--- a/thirdparty/lpeg/CMakeLists.txt
+++ b/thirdparty/lpeg/CMakeLists.txt
@@ -23,7 +23,7 @@ set(LPEG_RELEASE "1.0.2")
 set(LUA_LPEG_ROCKSPEC lpeg-${LPEG_VER}.rockspec)
 
 # Rewrite Makefile to behave sensibly w/ LuaRocks, and optionally allow linking to the lua lib...
-SET(PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/lpeg-${LPEG_RELEASE}-standard-makefile.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/lpeg-${LPEG_RELEASE}-standard-makefile.patch)
 
 # Move our custom rockspec to the build dir to fullfil build deps
 set(CONFIGURE_CMD ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_SOURCE_DIR}/${LUA_LPEG_ROCKSPEC} ${SOURCE_DIR}/${LUA_LPEG_ROCKSPEC})
@@ -51,7 +51,7 @@ ExternalProject_Add(
     URL http://distcache.FreeBSD.org/ports-distfiles/lpeg-${LPEG_RELEASE}.tar.gz
     URL_MD5 d342571886f1abcb7afe6a83d024d583
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ${CONFIGURE_CMD}
     BUILD_COMMAND ${BUILD_CMD}
     # skip install
diff --git a/thirdparty/lua-Spore/CMakeLists.txt b/thirdparty/lua-Spore/CMakeLists.txt
index 2ffd30217..032ad30db 100644
--- a/thirdparty/lua-Spore/CMakeLists.txt
+++ b/thirdparty/lua-Spore/CMakeLists.txt
@@ -25,11 +25,12 @@ set(LUA_SPORE_ROCKSPEC rockspec/lua-spore-${LUA_SPORE_VER}.rockspec)
 set(ROCKS_CMD ${LUAROCKS})
 separate_arguments(ROCKS_CMD)
 
-set(BUILD_CMD ${ROCKS_CMD} make --tree=${OUTPUT_DIR}/rocks ${LUA_SPORE_ROCKSPEC})
-set(BUILD_CMD ${BUILD_CMD} "CC=${CC}" "CFLAGS=${CFLAGS}" "LD=${LD}")
-set(BUILD_CMD ${BUILD_CMD} "LUA_INCDIR=${LUA_INCDIR}" "LUA_LIBDIR=${LUA_LIBDIR}")
+list(APPEND BUILD_CMD COMMAND ${ROCKS_CMD} make --tree=${OUTPUT_DIR}/rocks ${LUA_SPORE_ROCKSPEC})
+list(APPEND BUILD_CMD "CC=${CC}" "CFLAGS=${CFLAGS}" "LD=${LD}")
+list(APPEND BUILD_CMD "LUA_INCDIR=${LUA_INCDIR}" "LUA_LIBDIR=${LUA_LIBDIR}")
 
-set(PATCH_CMD sh -c "mkdir -p doc && ${ISED} \"s| 'luasocket|--'luasocket|g\" ${LUA_SPORE_ROCKSPEC}")
+list(APPEND PATCH_CMD COMMAND mkdir -p doc)
+list(APPEND PATCH_CMD COMMAND ${ISED} "s| 'luasocket|--&|g" ${LUA_SPORE_ROCKSPEC})
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
diff --git a/thirdparty/lua-rapidjson/CMakeLists.txt b/thirdparty/lua-rapidjson/CMakeLists.txt
index 47fdf854e..be96d03e7 100644
--- a/thirdparty/lua-rapidjson/CMakeLists.txt
+++ b/thirdparty/lua-rapidjson/CMakeLists.txt
@@ -21,9 +21,10 @@ assert_var_defined(LUAROCKS)
 ep_get_source_dir(SOURCE_DIR)
 
 set(LUA_RAPIDJSON_ROCKSPEC rapidjson-${LUA_RAPIDJSON_VER}.rockspec)
-set(PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/lua-rapidjson-never-native.patch")
+
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/lua-rapidjson-never-native.patch)
 if(DEFINED ENV{ANDROID})
-    set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/lua-rapidjson-android-link-to-lua.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/lua-rapidjson-android-link-to-lua.patch)
 endif()
 
 # We want to run luarocks --version=5.1, not "luarocks --version=5.1"...
@@ -31,15 +32,15 @@ endif()
 set(ROCKS_CMD ${LUAROCKS})
 separate_arguments(ROCKS_CMD)
 
-set(BUILD_CMD ${ROCKS_CMD} make --tree=${OUTPUT_DIR}/rocks ${LUA_RAPIDJSON_ROCKSPEC})
-set(BUILD_CMD ${BUILD_CMD} "CC=${CC}" "CXX=${CXX}")
-set(BUILD_CMD ${BUILD_CMD} "CFLAGS=${CFLAGS}" "CXXFLAGS=${CXXFLAGS}" "LDFLAGS=${LDFLAGS} ${LIBFLAG}")
-set(BUILD_CMD ${BUILD_CMD} "LUA_INCDIR=${LUA_INCDIR}" "LUA_LIBDIR=${LUA_LIBDIR}")
+list(APPEND BUILD_CMD COMMAND ${ROCKS_CMD} make --tree=${OUTPUT_DIR}/rocks ${LUA_RAPIDJSON_ROCKSPEC})
+list(APPEND BUILD_CMD "CC=${CC}" "CXX=${CXX}")
+list(APPEND BUILD_CMD "CFLAGS=${CFLAGS}" "CXXFLAGS=${CXXFLAGS}" "LDFLAGS=${LDFLAGS} ${LIBFLAG}")
+list(APPEND BUILD_CMD "LUA_INCDIR=${LUA_INCDIR}" "LUA_LIBDIR=${LUA_LIBDIR}")
 if(DEFINED LUALIB)
-    set(BUILD_CMD ${BUILD_CMD} "LUALIB=${LUALIB}")
+    list(APPEND BUILD_CMD "LUALIB=${LUALIB}")
 endif()
 if(DEFINED LIBFLAG)
-    set(BUILD_CMD ${BUILD_CMD} "LIBFLAG=${LIBFLAG}")
+    list(APPEND BUILD_CMD "LIBFLAG=${LIBFLAG}")
 endif()
 
 ko_write_gitclone_script(
@@ -53,7 +54,7 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD} COMMAND ${PATCH_CMD2}
+    PATCH_COMMAND ${PATCH_CMD}
     BUILD_IN_SOURCE 1
     CONFIGURE_COMMAND ""
     BUILD_COMMAND ${BUILD_CMD}
diff --git a/thirdparty/luajit/CMakeLists.txt b/thirdparty/luajit/CMakeLists.txt
index d3d7b3de4..9d8e50936 100644
--- a/thirdparty/luajit/CMakeLists.txt
+++ b/thirdparty/luajit/CMakeLists.txt
@@ -12,18 +12,18 @@ assert_var_defined(XCOMPILE)
 
 if($ENV{KODEBUG})
     # Debugging is a go!
-    set(DBG_CMD sh -c "${ISED} 's|#CCDEBUG= -g|CCDEBUG= -g|' ${SOURCE_DIR}/src/Makefile")
+    list(APPEND PATCH_CMD COMMAND ${ISED} "s|#CCDEBUG= -g|CCDEBUG= -g|" ${SOURCE_DIR}/src/Makefile)
     # To-do: make this auto-trigger when Valgrind is installed
-    #set(DBG_CMD "${DBG_CMD} && ${ISED} 's|#XCFLAGS+= -DLUAJIT_USE_VALGRIND|XCFLAGS+= -DLUAJIT_USE_VALGRIND|' ${SOURCE_DIR}/src/Makefile")
+    #list(APPEND PATCH_CMD COMMAND ${ISED} "s|#XCFLAGS+= -DLUAJIT_USE_VALGRIND|XCFLAGS+= -DLUAJIT_USE_VALGRIND|" ${SOURCE_DIR}/src/Makefile)
     if(DEFINED ENV{KODEBUG_LUAJIT_USE_SYSMALLOC})
         # Could this be helpful on Android?
-        set(DBG_CMD "${DBG_CMD} && ${ISED} 's|#XCFLAGS+= -DLUAJIT_USE_SYSMALLOC|XCFLAGS+= -DLUAJIT_USE_SYSMALLOC|' ${SOURCE_DIR}/src/Makefile")
+        list(APPEND PATCH_CMD COMMAND ${ISED} "s|#XCFLAGS+= -DLUAJIT_USE_SYSMALLOC|XCFLAGS+= -DLUAJIT_USE_SYSMALLOC|" ${SOURCE_DIR}/src/Makefile)
     endif()
     # Performance impact; not recommended unless required for something specific
     if(DEFINED ENV{KODEBUG_LUAJIT})
-        set(DBG_CMD "${DBG_CMD} && ${ISED} 's|#XCFLAGS+= -DLUAJIT_USE_GDBJIT|XCFLAGS+= -DLUAJIT_USE_GDBJIT|' ${SOURCE_DIR}/src/Makefile")
-        set(DBG_CMD "${DBG_CMD} && ${ISED} 's|#XCFLAGS+= -DLUA_USE_APICHECK|XCFLAGS+= -DLUA_USE_APICHECK|' ${SOURCE_DIR}/src/Makefile")
-        set(DBG_CMD "${DBG_CMD} && ${ISED} 's|#XCFLAGS+= -DLUA_USE_ASSERT|XCFLAGS+= -DLUA_USE_ASSERT|' ${SOURCE_DIR}/src/Makefile")
+        list(APPEND PATCH_CMD COMMAND ${ISED} "s|#XCFLAGS+= -DLUAJIT_USE_GDBJIT|XCFLAGS+= -DLUAJIT_USE_GDBJIT|" ${SOURCE_DIR}/src/Makefile)
+        list(APPEND PATCH_CMD COMMAND ${ISED} "s|#XCFLAGS+= -DLUA_USE_APICHECK|XCFLAGS+= -DLUA_USE_APICHECK|" ${SOURCE_DIR}/src/Makefile)
+        list(APPEND PATCH_CMD COMMAND ${ISED} "s|#XCFLAGS+= -DLUA_USE_ASSERT|XCFLAGS+= -DLUA_USE_ASSERT|" ${SOURCE_DIR}/src/Makefile)
     endif()
 endif()
 
@@ -71,9 +71,9 @@ endif()
 
 set(BUILD_CMD ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} ${BUILD_ARGS})
 
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/koreader-luajit-makefile-tweaks.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/koreader-luajit-makefile-tweaks.patch)
 # Enable table.pack & table.unpack w/o the rest of the -DLUAJIT_ENABLE_LUA52COMPAT baggage...
-set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/koreader-luajit-enable-table_pack.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/koreader-luajit-enable-table_pack.patch)
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
@@ -86,7 +86,7 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${DBG_CMD} COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2}
+    PATCH_COMMAND ${PATCH_CMD}
     BUILD_IN_SOURCE 1
     # skip configure
     CONFIGURE_COMMAND ""
diff --git a/thirdparty/luasec/CMakeLists.txt b/thirdparty/luasec/CMakeLists.txt
index 1426d9ec1..cc5d2cdc6 100644
--- a/thirdparty/luasec/CMakeLists.txt
+++ b/thirdparty/luasec/CMakeLists.txt
@@ -16,18 +16,18 @@ assert_var_defined(LUAPATH)
 ep_get_source_dir(SOURCE_DIR)
 
 # Don't enforce CFLAGS
-set(PATCH_CMD sh -c "${ISED} 's|-O2 ||g' src/Makefile")
+list(APPEND PATCH_CMD COMMAND ${ISED} "s|-O2 ||g" src/Makefile)
 
-set(BUILD_CMD_STR ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} "CC=${CC}" "CCLD=${LD}" "AR=${AR}" "RANLIB=${RANLIB}" "INC_PATH=${INC_PATH}" "LIB_PATH=${LIB_PATH}" "LUAPATH=${LUAPATH}" "LUACPATH=${LUAPATH}")
+list(APPEND MAKE_CMD COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} "CC=${CC}" "CCLD=${LD}" "AR=${AR}" "RANLIB=${RANLIB}" "INC_PATH=${INC_PATH}" "LIB_PATH=${LIB_PATH}" "LUAPATH=${LUAPATH}" "LUACPATH=${LUAPATH}")
 if(DEFINED LIBS)
-    set(BUILD_CMD_STR ${BUILD_CMD_STR} "LIBS=${LIBS}")
+    list(APPEND MAKE_CMD "LIBS=${LIBS}")
 endif()
 if (DEFINED ENV{DARWIN})
-    set(INSTALL_CMD ${BUILD_CMD_STR} macosx install)
-    set(BUILD_CMD ${BUILD_CMD_STR} macosx)
+    set(INSTALL_CMD ${MAKE_CMD} macosx install)
+    set(BUILD_CMD ${MAKE_CMD} macosx)
 else()
-    set(INSTALL_CMD ${BUILD_CMD_STR} linux install)
-    set(BUILD_CMD ${BUILD_CMD_STR} linux)
+    set(INSTALL_CMD ${MAKE_CMD} linux install)
+    set(BUILD_CMD ${MAKE_CMD} linux)
 endif()
 
 ko_write_gitclone_script(
@@ -42,7 +42,7 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ""
     BUILD_COMMAND ${BUILD_CMD}
     INSTALL_COMMAND ${INSTALL_CMD}
diff --git a/thirdparty/luasocket/CMakeLists.txt b/thirdparty/luasocket/CMakeLists.txt
index 8d816cedd..e673431fa 100644
--- a/thirdparty/luasocket/CMakeLists.txt
+++ b/thirdparty/luasocket/CMakeLists.txt
@@ -14,23 +14,26 @@ assert_var_defined(INSTALL_DIR)
 
 ep_get_source_dir(SOURCE_DIR)
 
-set(PATCH_CMD sh -c "${ISED} 's|socket\\.core|socket\\.score|' src/*")
-set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|socket_core|socket_score|' src/*")
-set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|mime\\.core|mime\\.mcore|' src/*")
-set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|mime_core|mime_mcore|' src/*")
-set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|SOCKET_CDIR)/core|SOCKET_CDIR)/score|' src/*")
-set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|MIME_CDIR)/core|MIME_CDIR)/mcore|' src/*")
+list(APPEND PATCH_CMD COMMAND sh -c "\"\$@\" src/*" --
+  ${ISED} " "
+  -e "s|socket\\.core|socket.score|"
+  -e "s|socket_core|socket_score|"
+  -e "s|mime\\.core|mime.mcore|"
+  -e "s|mime_core|mime_mcore|"
+  -e "s|SOCKET_CDIR)/core|SOCKET_CDIR)/score|"
+  -e "s|MIME_CDIR)/core|MIME_CDIR)/mcore|"
+)
 # Don't enforce CFLAGS
-set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|-O2 -ggdb3 ||g' src/makefile")
+list(APPEND PATCH_CMD COMMAND ${ISED} "s|-O2 -ggdb3 ||g" src/makefile)
 
-set(BUILD_CMD_STR ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} "PLAT=${PLAT}" "CC=${CC}" "LD=${CC}")
+list(APPEND BUILD_CMD COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} "PLAT=${PLAT}" "CC=${CC}" "LD=${CC}")
 if(DEFINED MYLDFLAGS)
-    set(BUILD_CMD_STR ${BUILD_CMD_STR} "MYLDFLAGS=${MYLDFLAGS}")
+  list(APPEND BUILD_CMD "MYLDFLAGS=${MYLDFLAGS}")
 endif()
 if(DEFINED LUALIB_mingw)
-    set(BUILD_CMD_STR ${BUILD_CMD_STR} "LUALIB_mingw=${LUALIB_mingw}")
+  list(APPEND BUILD_CMD "LUALIB_mingw=${LUALIB_mingw}")
 endif()
-set(BUILD_CMD ${BUILD_CMD_STR} "LUAINC=${LUAINC}" -j${PARALLEL_JOBS} all)
+list(APPEND BUILD_CMD "LUAINC=${LUAINC}" -j${PARALLEL_JOBS} all)
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
diff --git a/thirdparty/lunasvg/CMakeLists.txt b/thirdparty/lunasvg/CMakeLists.txt
index 3a516b3cf..7cb98ef20 100644
--- a/thirdparty/lunasvg/CMakeLists.txt
+++ b/thirdparty/lunasvg/CMakeLists.txt
@@ -37,8 +37,8 @@ list(APPEND CMAKE_ARGS "-DCMAKE_CXX_FLAGS=${CPPFLAGS} ${CXXFLAGS}")
 # Actual LunaSVG build options
 list(APPEND CMAKE_ARGS "-DBUILD_SHARED_LIBS=ON")
 
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/extended.patch")
-set(PATCH_CMD2 sh -c "cp -rpv ${CMAKE_CURRENT_SOURCE_DIR}/xtended ${SOURCE_DIR}/")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/extended.patch)
+list(APPEND PATCH_CMD COMMAND cp -rpv ${CMAKE_CURRENT_SOURCE_DIR}/xtended ${SOURCE_DIR}/)
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
@@ -51,7 +51,7 @@ include(ExternalProject)
 ExternalProject_Add(
     lunasvg
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2}
+    PATCH_COMMAND COMMAND ${PATCH_CMD}
     CMAKE_ARGS "${CMAKE_ARGS}"
     CMAKE_GENERATOR "Unix Makefiles"
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
diff --git a/thirdparty/minizip/CMakeLists.txt b/thirdparty/minizip/CMakeLists.txt
index bae6e0ad0..80abe19f0 100644
--- a/thirdparty/minizip/CMakeLists.txt
+++ b/thirdparty/minizip/CMakeLists.txt
@@ -17,9 +17,9 @@ ep_get_source_dir(SOURCE_DIR)
 
 # NOTE: 53a657318af1fccc4bac7ed230729302b2391d1d is the tip of the 1.2 branch. The fcrypt API we need is gone in master.
 # FIXME: Even then, something in said branch seems to upset MuPDF with our custom patch as-is, so keep using the old code...
-#set(PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/minizip-libaes-makefile.patch")
+# list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/minizip-libaes-makefile.patch)
 
-set(PATCH_CMD sh -c "${ISED} \"s|^CC=|#CC=|g\" aes/Makefile && ${ISED} \"s|^CFLAGS=|#CFLAGS=|g\" aes/Makefile")
+list(APPEND PATCH_CMD COMMAND ${ISED} "s|^CC=|#CC=|g" -e "s|^CFLAGS=|#CFLAGS=|g" aes/Makefile)
 
 #fix build error due to implicit declarations of function being invalid in C99 under macOS/XCode 12 
 set(CC "${CC} -Wno-error=implicit-function-declaration")
@@ -37,7 +37,7 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ""
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} ${BUILD_CMD_STR}
     # skip install
diff --git a/thirdparty/mupdf/CMakeLists.txt b/thirdparty/mupdf/CMakeLists.txt
index e98d7a6ec..900b7b4f3 100644
--- a/thirdparty/mupdf/CMakeLists.txt
+++ b/thirdparty/mupdf/CMakeLists.txt
@@ -10,6 +10,7 @@ enable_language(C)
 assert_var_defined(HOSTCFLAGS)
 assert_var_defined(HOSTCC)
 assert_var_defined(OS)
+
 if($ENV{KODEBUG})
     set(MUPDF_BUILD_TYPE "debug")
 else()
@@ -69,23 +70,23 @@ endif()
 
 set(SHARED_BUILD_CMD "${SHARED_BUILD_STR}")
 # use external fonts
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/external_fonts.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/external_fonts.patch)
 # add support for encryted zips
-set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/encrypted_zip.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/encrypted_zip.patch)
 # use libjpeg as a shared library
-set(PATCH_CMD3 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/libjpeg_shared.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/libjpeg_shared.patch)
 # Disable potentially crashy ARM ASM (it's 7 years old, and hell to debug)
 # NOTE: There's also a few ARCH_UNALIGNED_OK checks, but we never did pass that define.
 #       (FWIW, we *could*, on anything not kindle-legacy).
-set(PATCH_CMD4 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/no_arm_asm.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/no_arm_asm.patch)
 # Honor CFLAGS
-set(PATCH_CMD5 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/honor_cflags.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/honor_cflags.patch)
 # Patch for https://bugs.ghostscript.com/show_bug.cgi?id=698877; should be in upstream from 1.15
 # cf. https://github.com/koreader/koreader/issues/5182
-set(PATCH_CMD6 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/upstream-698877.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/upstream-698877.patch)
 # Patch for tar/cbt support; should be in upstream from 1.17
 # cf. https://github.com/koreader/koreader-base/issues/1041
-set(PATCH_CMD7 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-fixes.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-fixes.patch)
 # Backport a metric shitton of fixes
 # https://github.com/ArtifexSoftware/mupdf/commit/9920e40365821fbef6c3050695b3dcf0fa5f512e
 # https://github.com/ArtifexSoftware/mupdf/commit/3a263069d58416c251ef9f6a100a54be1e90dc0b
@@ -129,22 +130,22 @@ set(PATCH_CMD7 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-fixes.patch")
 
 # https://github.com/ArtifexSoftware/mupdf/commit/bc4ec04e21027e226052e0a4c767cbf09994552e
 # https://github.com/ArtifexSoftware/mupdf/commit/a7c435ac1836cc9e46ec4329c1543892148a7a0e
-set(PATCH_CMD8 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/mupdf-1.13.0-backports.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/mupdf-1.13.0-backports.patch)
 
 # Support for WebP images (unmerged-yet proposed upstream patch cleaned up of win32 stuff)
-set(PATCH_CMD9 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/webp-upstream-697749.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/webp-upstream-697749.patch)
 
 # add support for cbz chapters
-set(PATCH_CMD10 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/mupdf_cbz_chapter_support.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/mupdf_cbz_chapter_support.patch)
 
 # don't try link with libraries when building generator helpers…
-set(PATCH_CMD11 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/fix_link_cmd.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/fix_link_cmd.patch)
 
 # Backport https://github.com/ArtifexSoftware/mupdf/commit/50d80e509356784720ba8a7def5359f2673697ea (handle > 2GB Zip64)
-set(PATCH_CMD12 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/read_large_zip.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/read_large_zip.patch)
 
 # Ensure an HTML document fonts are freed on close.
-set(PATCH_CMD13 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/free-html-doc-fonts-on-close.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/free-html-doc-fonts-on-close.patch)
 
 # TODO: ignore shared git submodules built outside of mupdf by ourselves
 # https://git.ghostscript.com/mupdf.git is slow, so we use the official mirror on GitHub
@@ -162,7 +163,7 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2} COMMAND ${PATCH_CMD3} COMMAND ${PATCH_CMD4} COMMAND ${PATCH_CMD5} COMMAND ${PATCH_CMD6} COMMAND ${PATCH_CMD7} COMMAND ${PATCH_CMD8} COMMAND ${PATCH_CMD9} COMMAND ${PATCH_CMD10} COMMAND ${PATCH_CMD11} COMMAND ${PATCH_CMD12} COMMAND ${PATCH_CMD13}
+    PATCH_COMMAND ${PATCH_CMD}
     # skip configure
     CONFIGURE_COMMAND ""
     BUILD_COMMAND ${BUILD_CMD_GENERATE} COMMAND ${STATIC_BUILD_CMD} COMMAND ${SHARED_BUILD_CMD}
diff --git a/thirdparty/openssl/CMakeLists.txt b/thirdparty/openssl/CMakeLists.txt
index 3fde81517..c0c23e67d 100644
--- a/thirdparty/openssl/CMakeLists.txt
+++ b/thirdparty/openssl/CMakeLists.txt
@@ -64,7 +64,7 @@ else()
     set(ASM_OPT no-asm)
 endif()
 
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/openssl-1.1.0j-parallel_install_fix.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/openssl-1.1.0j-parallel_install_fix.patch)
 
 # NOTE: Disable https://github.com/openssl/openssl/pull/9595 as it's causing stalls long after the early boot on devices without the getrandom() syscall, which is pretty much all of them, because it's a Linux 3.17+ & glibc 2.25+ feature.
 #       This is most easily reproduced with scp transfers that will block on the initial select on /dev/random. Since those devices are low-power, UP, and mostly idle, it can take a fairly noticeable amount of time for entropy to be generated...
@@ -90,8 +90,8 @@ else()
     set(MAKE_CMD ${KO_MAKE_RECURSIVE} "CC=${CC}" "CFLAGS=${FILTERED_CFLAGS}" "SHARED_LDFLAGS=${SHARED_LDFLAGS}" "LD=${LD}" "AR=${AR}" "RANLIB=${RANLIB}")
 endif()
 # NOTE: Make depend may fail when using ccache, and may fail when // (on some OpenSSL versions, at least)
-set(BUILD_CMD1 ${MAKE_CMD} -j1 depend)
-set(BUILD_CMD2 ${MAKE_CMD} -j${PARALLEL_JOBS} build_libs)
+list(APPEND BUILD_CMD COMMAND ${MAKE_CMD} -j1 depend)
+list(APPEND BUILD_CMD COMMAND ${MAKE_CMD} -j${PARALLEL_JOBS} build_libs)
 
 ko_write_gitclone_script(
     GIT_CLONE_SCRIPT_FILENAME
@@ -105,10 +105,10 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1}
+    PATCH_COMMAND COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_IN_SOURCE 1
-    BUILD_COMMAND COMMAND ${BUILD_CMD1} COMMAND ${BUILD_CMD2}
+    BUILD_COMMAND COMMAND ${BUILD_CMD}
     # skip install
     INSTALL_COMMAND ""
 )
diff --git a/thirdparty/popen-noshell/CMakeLists.txt b/thirdparty/popen-noshell/CMakeLists.txt
index 260d6ff84..0a28bb1cf 100644
--- a/thirdparty/popen-noshell/CMakeLists.txt
+++ b/thirdparty/popen-noshell/CMakeLists.txt
@@ -10,9 +10,13 @@ enable_language(C CXX ASM)
 
 ep_get_source_dir(SOURCE_DIR)
 
+# Make it build on recent TCs, and implement a
+# simple Makefile for building it as a static lib
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/popen_noshell.patch)
+
 if(${LEGACY})
     # Revert 8d7a98d on legacy devices, pipe2 was introduced in Linux 2.6.27 & glibc 2.9
-    set(EXTRA_PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/kindle_legacy.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/kindle_legacy.patch)
 endif()
 
 assert_var_defined(CC)
@@ -36,9 +40,7 @@ ExternalProject_Add(
     popen-noshell
     BUILD_IN_SOURCE 1
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    # popen_noshell patch: Make it build on recent TCs, and implement
-    # a simple Makefile for building it as a static lib
-    PATCH_COMMAND COMMAND "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/popen_noshell.patch" COMMAND ${EXTRA_PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
     # skip configure
     CONFIGURE_COMMAND ""
     BUILD_COMMAND ${BUILD_CMD}
diff --git a/thirdparty/sdcv/CMakeLists.txt b/thirdparty/sdcv/CMakeLists.txt
index e0f81eb3a..7f4146c14 100644
--- a/thirdparty/sdcv/CMakeLists.txt
+++ b/thirdparty/sdcv/CMakeLists.txt
@@ -77,9 +77,9 @@ set(ENABLE_NLS False CACHE BOOL "")
 set(WITH_READLINE False CACHE BOOL "")
 
 # Revert 6e36e7730caf07b6cd0bfa265cdf9b5e31e7acad, because it's not helpful in our workflow, and just causes logging noise.
-set(PATCH_CMD1 "${KO_PATCH_SH} ${CMAKE_CURRENT_SOURCE_DIR}/sdcv-no-unknown-dict-warning.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/sdcv-no-unknown-dict-warning.patch)
 # Force utf8 command line parsing
-set(PATCH_CMD2 "${KO_PATCH_SH} ${CMAKE_CURRENT_SOURCE_DIR}/sdcv-locale-hack.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/sdcv-locale-hack.patch)
 
 set(SDCV_GIT_COMMIT v0.5.5)
 
@@ -97,7 +97,7 @@ download_project(
     GIT_TAG
     ${SDCV_GIT_COMMIT}
     #DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2}
+    PATCH_COMMAND ${PATCH_CMD}
 )
 
 add_subdirectory("${CMAKE_BINARY_DIR}/sdcv-src"
diff --git a/thirdparty/sdl2/CMakeLists.txt b/thirdparty/sdl2/CMakeLists.txt
index b70b53fcf..a04474de0 100644
--- a/thirdparty/sdl2/CMakeLists.txt
+++ b/thirdparty/sdl2/CMakeLists.txt
@@ -13,7 +13,7 @@ ep_get_source_dir(SOURCE_DIR)
 # remove workarounds for standalone applications and add a couple of actions
 # to be used from the osx main menu.
 
-set(PATCH_CMD "${KO_PATCH_SH} ${CMAKE_CURRENT_SOURCE_DIR}/cocoa.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/cocoa.patch)
 
 set(SDL2_VER "2.28.1")
 set(SDL2_MD5 "ccd2cd02b2ad4f71c2588747028953c3")
@@ -21,7 +21,7 @@ download_project(
     PROJ ${PROJECT_NAME}
     URL https://github.com/libsdl-org/SDL/releases/download/release-${SDL2_VER}/SDL2-${SDL2_VER}.tar.gz
     URL_MD5 ${SDL2_MD5}
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
 )
 
 add_subdirectory("${CMAKE_BINARY_DIR}/sdl2-src"
diff --git a/thirdparty/tar/CMakeLists.txt b/thirdparty/tar/CMakeLists.txt
index 5ecb0a3ec..5a37b3487 100644
--- a/thirdparty/tar/CMakeLists.txt
+++ b/thirdparty/tar/CMakeLists.txt
@@ -17,16 +17,16 @@ ep_get_binary_dir(BINARY_DIR)
 # O_PATH may be defined in our ToolChains, but older devices actually run kernels where it's not entirely usable...
 # (Usage in tar via gnulib's https://git.savannah.gnu.org/cgit/gnulib.git/log/lib/fchmodat.c)
 if(NOT DEFINED ENV{EMULATE_READER})
-    set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-1.33-remove-o_path-usage.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-1.33-remove-o_path-usage.patch)
 endif()
 
 # The wordsplit changes introduced in 1.31 require glob.h, which is not present on Androdi before ABI 28 (c.f., #787)
 if(DEFINED ENV{ANDROID})
-    set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-1.31-revert-wordsplit-for-android-glob.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tar-1.31-revert-wordsplit-for-android-glob.patch)
 endif()
 
-#set(PATCH_CMD3 sh -c "touch ABOUT-NLS po/Makevars.template")
-#set(PATCH_CMD4 sh -c "AUTOPOINT=true ./bootstrap --skip-po")
+# list(APPEND PATCH_CMD COMMAND touch ABOUT-NLS po/Makevars.template)
+# list(APPEND PATCH_CMD COMMAND env AUTOPOINT=true ./bootstrap --skip-po)
 
 # Avoid pulling > GLIBC_2.4 symbols on crappy platforms
 if(DEFINED ENV{LEGACY} OR DEFINED ENV{POCKETBOOK})
@@ -39,24 +39,15 @@ set(CFG_OPTS --host=${CHOST})
 if(DEFINED ENV{LEGACY} OR DEFINED ENV{POCKETBOOK})
     set(CFG_OPTS ${CFG_OPTS} --disable-largefile)
 endif()
-set(CFG_CMD env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure --disable-nls --disable-gcc-warnings --disable-acl --without-xattrs --without-posix-acls ${CFG_OPTS})
+list(APPEND CFG_CMD COMMAND env ${CFG_ENV_VAR} ${SOURCE_DIR}/configure --disable-nls --disable-gcc-warnings --disable-acl --without-xattrs --without-posix-acls ${CFG_OPTS})
 
 if(DEFINED ENV{LEGACY} OR DEFINED ENV{POCKETBOOK})
     # Forcibly disable FORTIFY on legacy devices...
-    set(SED_CMD sh -c "${ISED} 's/# define _FORTIFY_SOURCE 2/#undef _FORTIFY_SOURCE/' config.h")
+    list(APPEND CFG_CMD COMMAND ${ISED} "s/# define _FORTIFY_SOURCE 2/#undef _FORTIFY_SOURCE/" config.h)
 endif()
 
 # We build in-tree...
-set(INSTALL_CMD1 ${CMAKE_COMMAND} -E rename ${BINARY_DIR}/src/tar ${BINARY_DIR}/tar)
-#set(INSTALL_CMD1 ${CMAKE_COMMAND} -E make_directory ${BINARY_DIR})
-#set(INSTALL_CMD2 ${CMAKE_COMMAND} -E rename ${SOURCE_DIR}/src/tar ${BINARY_DIR}/tar)
-
-#ko_write_gitclone_script(
-#    GIT_CLONE_SCRIPT_FILENAME
-#    https://git.savannah.gnu.org/git/tar.git
-#    release_1_32
-#    ${SOURCE_DIR}
-#)
+list(APPEND INSTALL_CMD COMMAND ${CMAKE_COMMAND} -E copy ${BINARY_DIR}/src/tar ${BINARY_DIR}/tar)
 
 include(ExternalProject)
 set(TAR_VER "1.34")
@@ -65,13 +56,8 @@ ExternalProject_Add(
     URL http://ftpmirror.gnu.org/tar/tar-${TAR_VER}.tar.gz
     URL_MD5 9d5949e4c2d9665546ac65dafc0e726a
     DOWNLOAD_DIR ${KO_DOWNLOAD_DIR}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2}
-    #DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    #BUILD_IN_SOURCE 1
-    #PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2} COMMAND ${PATCH_CMD3} COMMAND ${PATCH_CMD4}
-    CONFIGURE_COMMAND COMMAND ${CFG_CMD} COMMAND ${SED_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}
-    # The buildsystem outputs binaries in a subdirectory...
-    INSTALL_COMMAND COMMAND ${INSTALL_CMD1}
-    #INSTALL_COMMAND COMMAND ${INSTALL_CMD1} COMMAND ${INSTALL_CMD2}
+    INSTALL_COMMAND COMMAND ${INSTALL_CMD}
 )
diff --git a/thirdparty/tesseract/CMakeLists.txt b/thirdparty/tesseract/CMakeLists.txt
index 63527df14..9adc0928b 100644
--- a/thirdparty/tesseract/CMakeLists.txt
+++ b/thirdparty/tesseract/CMakeLists.txt
@@ -8,7 +8,7 @@ include("koreader_thirdparty_git")
 ep_get_source_dir(SOURCE_DIR)
 
 if (DEFINED ENV{ANDROID})
-    set(PATCH_CMD "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tesseract-android.patch")
+    list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/tesseract-android.patch)
 endif()
 
 ko_write_gitclone_script(
@@ -22,7 +22,7 @@ include(ExternalProject)
 ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ""
     # skip build and install, libk2pdfopt will build it
     BUILD_COMMAND ""
diff --git a/thirdparty/turbo/CMakeLists.txt b/thirdparty/turbo/CMakeLists.txt
index adbcba565..06d11bf2d 100644
--- a/thirdparty/turbo/CMakeLists.txt
+++ b/thirdparty/turbo/CMakeLists.txt
@@ -14,11 +14,15 @@ ep_get_source_dir(SOURCE_DIR)
 
 set(BUILD_CMD ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS} "CC=${CC}" "CFLAGS=${CFLAGS}" "LDFLAGS=${LDFLAGS}" all)
 
+# Drop duplicate cdefs, make sure turbo find its libtffi_wrap library, and pull in upstream fixes
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/turbo.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/d7a8a247a4a2689b0f207162eb804141c87c4899.patch)
 # Remove the 7 years-old copy of a CA bundle that turbo doesn't actually use.
-set(PATCH_CMD sh -c "rm -f ${SOURCE_DIR}/turbo/ca-certificates.crt && ${ISED} 's|CC=|CC:=|' ${SOURCE_DIR}/Makefile")
+list(APPEND PATCH_CMD COMMAND rm -f ${SOURCE_DIR}/turbo/ca-certificates.crt)
+list(APPEND PATCH_CMD COMMAND ${ISED} "s|CC=|CC:=|" ${SOURCE_DIR}/Makefile)
 if (APPLE AND DEFINED ENV{ANDROID})
     # makefile of turbo hardcodes the shared library filename on darwin
-    set(PATCH_CMD "${PATCH_CMD} && ${ISED} 's|libtffi_wrap.dylib|libtffi_wrap.so|' ${SOURCE_DIR}/Makefile")
+    list(APPEND PATCH_CMD COMMAND ${ISED} "s|libtffi_wrap.dylib|libtffi_wrap.so|" ${SOURCE_DIR}/Makefile)
 endif()
 
 ko_write_gitclone_script(
@@ -33,9 +37,8 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    # Drop duplicate cdefs, make sure turbo find its libtffi_wrap library, and pull in upstream fixes
-    PATCH_COMMAND COMMAND "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/turbo.patch" COMMAND "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/d7a8a247a4a2689b0f207162eb804141c87c4899.patch"
-    CONFIGURE_COMMAND COMMAND ${PATCH_CMD}
+    PATCH_COMMAND ${PATCH_CMD}
+    CONFIGURE_COMMAND ""
     BUILD_COMMAND ${BUILD_CMD}
     # skip install
     INSTALL_COMMAND ""
diff --git a/thirdparty/zlib/CMakeLists.txt b/thirdparty/zlib/CMakeLists.txt
index f22bf996e..10869e675 100644
--- a/thirdparty/zlib/CMakeLists.txt
+++ b/thirdparty/zlib/CMakeLists.txt
@@ -42,9 +42,9 @@ else()
 endif()
 
 # Whelp, apparently the 1.2.12 release was a fun one, so apply the full Gentoo patchset...
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zlib-1.2.11-minizip-drop-crypt-header.patch")
-set(PATCH_CMD2 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zlib-1.2.11-configure-fix-AR-RANLIB-NM-detection.patch")
-set(PATCH_CMD3 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zlib-1.2.13-use-LDFLAGS-in-configure.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zlib-1.2.11-minizip-drop-crypt-header.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zlib-1.2.11-configure-fix-AR-RANLIB-NM-detection.patch)
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/zlib-1.2.13-use-LDFLAGS-in-configure.patch)
 
 include(ExternalProject)
 set(ZLIB_VER "1.2.13")
@@ -55,7 +55,7 @@ ExternalProject_Add(
     URL https://github.com/madler/zlib/releases/download/v${ZLIB_VER}/zlib-${ZLIB_VER}.tar.xz
     URL_MD5 ${ZLIB_MD5}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD1} COMMAND ${PATCH_CMD2} COMMAND ${PATCH_CMD3}
+    PATCH_COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ${CFG_CMD}
     BUILD_COMMAND ${BUILD_CMD}
     INSTALL_COMMAND ${INSTALL_CMD}
diff --git a/thirdparty/zstd/CMakeLists.txt b/thirdparty/zstd/CMakeLists.txt
index f5cff9496..97973cd6e 100644
--- a/thirdparty/zstd/CMakeLists.txt
+++ b/thirdparty/zstd/CMakeLists.txt
@@ -34,7 +34,6 @@ ExternalProject_Add(
     ${PROJECT_NAME}
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
     BUILD_IN_SOURCE 1
-    PATCH_COMMAND COMMAND ${PATCH_CMD}
     CONFIGURE_COMMAND ""
     BUILD_COMMAND COMMAND ${BUILD_CMD}
     INSTALL_COMMAND COMMAND ${INSTALL_CMD}
diff --git a/thirdparty/zsync2/CMakeLists.txt b/thirdparty/zsync2/CMakeLists.txt
index 35760f6d3..a441222d4 100644
--- a/thirdparty/zsync2/CMakeLists.txt
+++ b/thirdparty/zsync2/CMakeLists.txt
@@ -56,7 +56,7 @@ endif()
 #list(APPEND CMAKE_ARGS "-DCURL_INCLUDE_DIRS=${CURL_DIR}/include")
 
 # Fix build with old TCs (kindle & pocketbook).
-set(PATCH_CMD1 "${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/fix-old-tc-build.patch")
+list(APPEND PATCH_CMD COMMAND ${KO_PATCH} ${CMAKE_CURRENT_SOURCE_DIR}/fix-old-tc-build.patch)
 
 # NOTE: We're currently using our own fork instead of upstream's (https://github.com/AppImage/zsync2):
 ## * Enable range requests optimizations on the CLI
@@ -83,7 +83,7 @@ include(ExternalProject)
 ExternalProject_Add(
     zsync2
     DOWNLOAD_COMMAND ${CMAKE_COMMAND} -P ${GIT_CLONE_SCRIPT_FILENAME}
-    PATCH_COMMAND COMMAND ${PATCH_CMD1}
+    PATCH_COMMAND ${PATCH_CMD}
     CMAKE_ARGS "${CMAKE_ARGS}"
     CMAKE_GENERATOR "Unix Makefiles"
     BUILD_COMMAND ${KO_MAKE_RECURSIVE} -j${PARALLEL_JOBS}