diff --git a/scripts/run-sparse.sh b/scripts/run-sparse.sh
index cf0623a..a644bf2 100755
--- a/scripts/run-sparse.sh
+++ b/scripts/run-sparse.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright 2020 Google LLC
 
 set -e -u -o pipefail
 
diff --git a/scripts/run-tests.sh b/scripts/run-tests.sh
index 311a2dc..cecd951 100755
--- a/scripts/run-tests.sh
+++ b/scripts/run-tests.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # SPDX-License-Identifier: GPL-2.0-or-later
+# Copyright 2020 Google LLC
 #
 # Test script for fsverity-utils.  Runs 'make check' in lots of configurations,
 # runs static analysis, and does a few other tests.
@@ -20,6 +21,9 @@
 	exit 1
 }
 
+TMPDIR=$(mktemp -d -t libfsverity_test.XXXXXXXXX)
+trap 'rm -r "$TMPDIR"' EXIT
+
 # Both stdout and stderr go to log file.
 # Only stderr goes to terminal.
 echo "Starting fsverity-utils tests.  See run-tests.log for full output."
@@ -54,7 +58,7 @@
 fi
 
 log "Test using libfsverity from C++ program"
-cat > /tmp/libfsverity_test.cc <<EOF
+cat > "$TMPDIR/test.cc" <<EOF
 #include <libfsverity.h>
 #include <iostream>
 int main()
@@ -62,10 +66,44 @@
 	std::cout << libfsverity_get_digest_size(FS_VERITY_HASH_ALG_SHA256) << std::endl;
 }
 EOF
-c++ -Wall -Werror /tmp/libfsverity_test.cc -Icommon -L. -lfsverity \
-	-o /tmp/libfsverity_test
-[ "$(LD_LIBRARY_PATH=. /tmp/libfsverity_test)" = "32" ]
-rm /tmp/libfsverity_test*
+c++ -Wall -Werror "$TMPDIR/test.cc" -Icommon -L. -lfsverity -o "$TMPDIR/test"
+[ "$(LD_LIBRARY_PATH=. "$TMPDIR/test")" = "32" ]
+rm "${TMPDIR:?}"/*
+
+log "Check that build doesn't produce untracked files"
+$MAKE all test_programs
+if git status --short | grep -q '^??'; then
+	git status
+	fail "Build produced untracked files (check 'git status').  Missing gitignore entry?"
+fi
+
+log "Test that 'make uninstall' uninstalls all files"
+make DESTDIR="$TMPDIR" install
+if [ "$(find "$TMPDIR" -type f -o -type l | wc -l)" = 0 ]; then
+	fail "'make install' didn't install any files"
+fi
+make DESTDIR="$TMPDIR" uninstall
+if [ "$(find "$TMPDIR" -type f -o -type l | wc -l)" != 0 ]; then
+	fail "'make uninstall' didn't uninstall all files"
+fi
+rm -r "${TMPDIR:?}"/*
+
+log "Check that all files have license and copyright info"
+list="$TMPDIR/filelist"
+filter_license_info() {
+	# files to exclude from license and copyright info checks
+	grep -E -v '(\.gitignore|COPYING|NEWS|README|testdata|fsverity_uapi\.h)'
+}
+git grep -L 'SPDX-License-Identifier: GPL-2\.0-or-later' \
+	| filter_license_info > "$list" || true
+if [ -s "$list" ]; then
+	fail "The following files are missing an appropriate SPDX license identifier: $(<"$list")"
+fi
+git grep -L '\<Copyright\>' | filter_license_info > "$list" || true
+if [ -s "$list" ]; then
+	fail "The following files are missing a copyright statement: $(<"$list")"
+fi
+rm "$list"
 
 log "Build and test with gcc"
 $MAKE CC=gcc check
@@ -73,8 +111,11 @@
 log "Build and test with gcc (-Wall + -Werror)"
 $MAKE CC=gcc CFLAGS="-Wall -Werror" check
 
+log "Build and test with gcc (-O3)"
+$MAKE CC=gcc CFLAGS="-O3 -Wall -Werror" check
+
 log "Build and test with gcc (32-bit)"
-$MAKE CC=gcc CFLAGS="-m32" check
+$MAKE CC=gcc CFLAGS="-m32 -O2 -Wall -Werror" check
 
 log "Build and test with clang"
 $MAKE CC=clang check
@@ -82,6 +123,9 @@
 log "Build and test with clang (-Wall + -Werror)"
 $MAKE CC=clang CFLAGS="-Wall -Werror" check
 
+log "Build and test with clang (-O3)"
+$MAKE CC=clang CFLAGS="-O3 -Wall -Werror" check
+
 log "Build and test with clang + UBSAN"
 $MAKE CC=clang CFLAGS="-fsanitize=undefined -fno-sanitize-recover=undefined" \
 	check
@@ -93,6 +137,9 @@
 $MAKE CC=clang CFLAGS="-fsanitize=unsigned-integer-overflow -fno-sanitize-recover=unsigned-integer-overflow" \
 	check
 
+log "Build and test with clang + CFI"
+$MAKE CC=clang CFLAGS="-fsanitize=cfi -flto -fvisibility=hidden" check
+
 log "Build and test with valgrind"
 $MAKE TEST_WRAPPER_PROG="valgrind --quiet --error-exitcode=100 --leak-check=full --errors-for-leak-kinds=all" \
 	check