diff --git a/scripts/generate/_generate_all_bindings_flavors.sh b/scripts/generate/_generate_all_bindings_flavors.sh
index 512a20a0df8..ba9c82c6b5a 100755
--- a/scripts/generate/_generate_all_bindings_flavors.sh
+++ b/scripts/generate/_generate_all_bindings_flavors.sh
@@ -52,8 +52,8 @@ pushd "${REPO_ROOT}" &>/dev/null
 pids=""
 if [[ "${GENERATE_FIPS}" -eq 0 ]]; then
   ## macOS bindings
-  IS_MACOS_HOST=$(check_running_on_macos [[ $IGNORE_MACOS -eq 0 ]])
-  if [[ $IS_MACOS_HOST -eq 0 ]]; then
+  IS_MACOS_HOST=$(check_running_on_macos ${IGNORE_MACOS})
+  if [[ $IS_MACOS_HOST -eq 1 ]]; then
     ${GEN_BINDINGS_SCRIPT} -c "${RELATIVE_CRATE_PATH}" &
   else
     echo Script is not running on macOS.
diff --git a/scripts/generate/_generation_tools.sh b/scripts/generate/_generation_tools.sh
index baf1f2fa162..ca60e64937e 100644
--- a/scripts/generate/_generation_tools.sh
+++ b/scripts/generate/_generation_tools.sh
@@ -7,6 +7,12 @@ function usage {
   echo
 }
 
+IGNORE_DIRTY=0
+IGNORE_BRANCH=0
+IGNORE_UPSTREAM=0
+IGNORE_MACOS=0
+SKIP_TEST=0
+
 function generation_options {
   while getopts "dbums" option; do
     case ${option} in
@@ -20,9 +26,11 @@ function generation_options {
       IGNORE_UPSTREAM=1
       ;;
     m)
+      # shellcheck disable=SC2034
       IGNORE_MACOS=1
       ;;
     s)
+      # shellcheck disable=SC2034
       SKIP_TEST=1
       ;;
     *)
@@ -51,7 +59,9 @@ function check_workspace {
 }
 
 function check_branch {
-  local IGNORE_BRANCH=$1
+  # TODO: determine expectations for branch name
+  # Always ignore branch
+  local IGNORE_BRANCH=1
   local IGNORE_UPSTREAM=$2
   local CURRENT_BRANCH
 
@@ -102,19 +112,20 @@ function check_branch {
   fi
 }
 
-# If host is macOS returns successfully (zero value return)
+# If host is macOS, echos 1 and returns successfully (zero value return)
 function check_running_on_macos {
-  local FAIL_NON_MACOS=$1
+  local ALLOW_NON_MACOS=$1
   if [[ "$(uname)" =~ [Dd]arwin ]]; then
+    echo "1"
     return 0
   fi
-  if [[ $FAIL_NON_MACOS -eq 1 ]]; then
-    echo Script is not running on macOS.
-    echo Aborting. Use '-m' to ignore.
-    echo
-    exit 1
+  echo "0"
+  >&2 echo Script is not running on macOS.
+  if [[ $ALLOW_NON_MACOS -ne 1 ]]; then
+    return 1
   fi
-  return 1
+  >&2 echo Ignoring script not running on macOS
+  return 0
 }
 
 function assert_docker_status {
@@ -127,12 +138,12 @@ function assert_docker_status {
 function parse_version {
   local VERSION="${1}"
   echo Version: "${VERSION}"
-  echo "${VERSION}" | egrep -q '^[0-9]+\.[0-9]+\.[0-9]+$'
+  echo "${VERSION}" | grep -E -q '^[0-9]+\.[0-9]+\.[0-9]+$'
 }
 
 function prompt_yes_no {
   while true; do
-    read -p "$1 (y/n): " yn
+    read -rp "$1 (y/n): " yn
     case $yn in
     [Yy]*) break ;;
     [Nn]*) return 1 ;;
@@ -147,7 +158,7 @@ function validate_crate_version {
   local REPO_ROOT
   REPO_ROOT=$(git rev-parse --show-toplevel)
 
-  pushd "${CRATE_DIR}" &>/dev/null
+  pushd "${CRATE_DIR}" &>/dev/null || exit 1
 
   local CRATE_NAME
   CRATE_NAME=$("${REPO_ROOT}"/scripts/tools/cargo-dig.rs -n)
@@ -155,7 +166,7 @@ function validate_crate_version {
   local CRATE_VERSION
   CRATE_VERSION=$("${REPO_ROOT}"/scripts/tools/cargo-dig.rs -v)
 
-  PUBLISHED_CRATE_VERSION=$(cargo search "${CRATE_NAME}" | egrep "^${CRATE_NAME} " | sed -e 's/.*"\(.*\)".*/\1/')
+  PUBLISHED_CRATE_VERSION=$(cargo search "${CRATE_NAME}" | grep -E "^${CRATE_NAME} " | sed -e 's/.*"\(.*\)".*/\1/')
 
   if ! parse_version "${PUBLISHED_CRATE_VERSION}"; then
     echo Could not find current version of published crate.
@@ -174,7 +185,7 @@ function validate_crate_version {
     exit 1
   fi
 
-  popd &>/dev/null # "${CRATE_DIR}"
+  popd &>/dev/null || exit 1 # "${CRATE_DIR}"
 
   echo
   echo "Generating crate with version: ${CRATE_VERSION}"
@@ -185,8 +196,8 @@ function submodule_commit_metadata {
   local REPO_ROOT
   REPO_ROOT=$(git rev-parse --show-toplevel)
 
-  pushd "${REPO_ROOT}" &>/dev/null
-  COMMIT_HASH=$(git submodule status -- ${CRATE_DIR}/aws-lc | sed -e 's/.\([0-9a-f]*\).*/\1/')
-  perl -pi -e "s/commit-hash .*/commit-hash = \"${COMMIT_HASH}\"/" ${CRATE_DIR}/Cargo.toml
-  popd &>/dev/null
+  pushd "${REPO_ROOT}" &>/dev/null || exit 1
+  COMMIT_HASH=$(git submodule status -- "${CRATE_DIR}"/aws-lc | sed -e 's/.\([0-9a-f]*\).*/\1/')
+  perl -pi -e "s/commit-hash .*/commit-hash = \"${COMMIT_HASH}\"/" "${CRATE_DIR}"/Cargo.toml
+  popd &>/dev/null || exit 1
 }
diff --git a/scripts/generate/_run_supported_symbol_builds.sh b/scripts/generate/_run_supported_symbol_builds.sh
index 84bfc0cb311..71b3480b9b5 100755
--- a/scripts/generate/_run_supported_symbol_builds.sh
+++ b/scripts/generate/_run_supported_symbol_builds.sh
@@ -55,8 +55,8 @@ pushd "${REPO_ROOT}" &>/dev/null
 pids=''
 if [[ "${GENERATE_FIPS}" -eq 0 ]]; then
   ## macOS symbols
-  IS_MACOS_HOST=$(check_running_on_macos [[ $IGNORE_MACOS -eq 0 ]])
-  if [[ $IS_MACOS_HOST -eq 0 ]]; then
+  IS_MACOS_HOST=$(check_running_on_macos ${IGNORE_MACOS})
+  if [[ $IS_MACOS_HOST -eq 1 ]]; then
     ${COLLECT_SYMBOLS_SCRIPT} -c "${RELATIVE_CRATE_PATH}" &
   else
     echo Script is not running on macOS.
diff --git a/scripts/generate/_test_supported_builds.sh b/scripts/generate/_test_supported_builds.sh
index ae6aa3363b7..20836e75568 100755
--- a/scripts/generate/_test_supported_builds.sh
+++ b/scripts/generate/_test_supported_builds.sh
@@ -51,8 +51,8 @@ pushd "${REPO_ROOT}" &>/dev/null
 pids=''
 if [[ "${GENERATE_FIPS}" -eq 0 ]]; then
   ### Test crate on Mac
-  IS_MACOS_HOST=$(check_running_on_macos [[ $IGNORE_MACOS -eq 0 ]])
-  if [[ $IS_MACOS_HOST -eq 0 ]]; then
+  IS_MACOS_HOST=$(check_running_on_macos ${IGNORE_MACOS})
+  if [[ $IS_MACOS_HOST -eq 1 ]]; then
     ${CRATE_TEST_SCRIPT} -c "${RELATIVE_CRATE_PATH}" &
   else
     echo Script is not running on macOS.
diff --git a/scripts/generate/generate-aws-lc-sys.sh b/scripts/generate/generate-aws-lc-sys.sh
index 1ab0585a636..07e863e7f0f 100755
--- a/scripts/generate/generate-aws-lc-sys.sh
+++ b/scripts/generate/generate-aws-lc-sys.sh
@@ -4,12 +4,6 @@
 
 set -e
 
-IGNORE_DIRTY=0
-IGNORE_BRANCH=0
-IGNORE_UPSTREAM=0
-IGNORE_MACOS=0
-SKIP_TEST=0
-
 SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
 REPO_ROOT=$(git rev-parse --show-toplevel)
 
@@ -25,8 +19,8 @@ pushd "${REPO_ROOT}" &>/dev/null
 check_workspace $IGNORE_DIRTY
 check_branch $IGNORE_BRANCH $IGNORE_UPSTREAM
 
-IS_MACOS_HOST=$(check_running_on_macos [[ $IGNORE_MACOS -eq 0 ]])
-if [[ $IS_MACOS_HOST -ne 0 ]]; then
+IS_MACOS_HOST=$(check_running_on_macos ${IGNORE_MACOS})
+if [[ $IS_MACOS_HOST -ne 1 ]]; then
   echo Script is not running on macOS!
 fi
 
diff --git a/scripts/publish/_publish_tools.sh b/scripts/publish/_publish_tools.sh
index 4a2e4f464c4..0e5d6896e37 100644
--- a/scripts/publish/_publish_tools.sh
+++ b/scripts/publish/_publish_tools.sh
@@ -24,6 +24,52 @@ function publish_options {
   done
 }
 
+# Finds the version of the crate based on current working directory
+function crate_version_prefix {
+  local REPO_ROOT
+  REPO_ROOT=$(git rev-parse --show-toplevel)
+  "${REPO_ROOT}"/scripts/tools/cargo-dig.rs -v | sed -e 's/\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\)/\1_\2_\3/'
+}
+
+function sanity_check_sys_crate {
+  local CRATE_DIR CRATE_NAME PREFIX
+  CRATE_DIR="${1}"
+  CRATE_NAME=$(basename "${CRATE_DIR}")
+  PREFIX=$(echo "${CRATE_NAME}" | sed -e 's/-/_/g' | sed -e 's/^\(.*\)_sys/\1/')
+
+  local CRATE_VERSION_PREFIX CRATE_PREFIX EXPECTED_LINKS_LINE
+  CRATE_VERSION_PREFIX=$(crate_version_prefix "${CRATE_DIR}")
+  CRATE_PREFIX="${PREFIX}_${CRATE_VERSION_PREFIX}"
+  EXPECTED_LINKS_LINE="links = \"${CRATE_PREFIX}\""
+  if ! grep "${EXPECTED_LINKS_LINE}" "${CRATE_DIR}/Cargo.toml"; then
+    echo
+    echo ERROR: Expected 'links' line not found in: "${CRATE_DIR}/Cargo.toml"
+    echo "${EXPECTED_LINKS_LINE}"
+    exit 1
+  fi
+
+  local EXPECTED_MACRO_LINE PREFIX_INCLUDE_PATH
+  EXPECTED_MACRO_LINE="#define BORINGSSL_PREFIX ${CRATE_PREFIX}"
+  PREFIX_INCLUDE_PATH="${CRATE_DIR}"/generated-include/openssl/boringssl_prefix_symbols_asm.h
+  if ! grep "${EXPECTED_MACRO_LINE}" "${PREFIX_INCLUDE_PATH}"; then
+    echo
+    echo ERROR: Expected prefix macro not found in: "${PREFIX_INCLUDE_PATH}"
+    echo "${EXPECTED_MACRO_LINE}"
+    exit 1
+  fi
+
+  local COMMIT_HASH
+  COMMIT_HASH=$(git submodule status -- "${CRATE_DIR}"/aws-lc | sed -e 's/.\([0-9a-f]*\).*/\1/')
+  if ! grep "${COMMIT_HASH}" "${CRATE_DIR}/Cargo.toml"; then
+    echo
+    echo ERROR: Expected 'commit-hash' line not found in: "${CRATE_DIR}/Cargo.toml"
+    echo "${COMMIT_HASH}"
+    exit 1
+  fi
+
+  echo Sanity check: SUCCESS
+}
+
 function run_prepublish_checks {
   local SCRIPT_DIR
   SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &>/dev/null && pwd)
diff --git a/scripts/publish/publish-aws-lc-fips-sys.sh b/scripts/publish/publish-aws-lc-fips-sys.sh
index 923c8bab4fb..10a7e92ddcd 100755
--- a/scripts/publish/publish-aws-lc-fips-sys.sh
+++ b/scripts/publish/publish-aws-lc-fips-sys.sh
@@ -7,8 +7,8 @@ set -e
 SCRIPT_DIR=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
 PUBLISH=0
 REPO_ROOT=$(git rev-parse --show-toplevel)
-RELATIVE_CRATE_PATH=aws-lc-fips-sys
-CRATE_DIR="${REPO_ROOT}/${RELATIVE_CRATE_PATH}"
+CRATE_NAME=aws-lc-fips-sys
+CRATE_DIR="${REPO_ROOT}/${CRATE_NAME}"
 
 source "${SCRIPT_DIR}"/_publish_tools.sh
 
@@ -16,13 +16,15 @@ publish_options "$@"
 
 pushd "${CRATE_DIR}" &>/dev/null
 
+sanity_check_sys_crate "${CRATE_DIR}"
+
 cat << HERE > ./aws-lc/go.mod
 module boringssl.googlesource.com/boringssl
 
 go 1.13
 HERE
 
-run_prepublish_checks -c "${RELATIVE_CRATE_PATH}"
-publish_crate "${RELATIVE_CRATE_PATH}" ${PUBLISH}
+run_prepublish_checks -c "${CRATE_NAME}"
+publish_crate "${CRATE_NAME}" ${PUBLISH}
 git --git-dir="${CRATE_DIR}/aws-lc/.git" restore go.mod
 popd &>/dev/null
diff --git a/scripts/publish/publish-aws-lc-sys.sh b/scripts/publish/publish-aws-lc-sys.sh
index 601f52cb306..e5db6294d48 100755
--- a/scripts/publish/publish-aws-lc-sys.sh
+++ b/scripts/publish/publish-aws-lc-sys.sh
@@ -7,14 +7,16 @@ set -e
 SCRIPT_DIR=$(cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd)
 PUBLISH=0
 REPO_ROOT=$(git rev-parse --show-toplevel)
-RELATIVE_CRATE_PATH=aws-lc-sys
-CRATE_DIR="${REPO_ROOT}/${RELATIVE_CRATE_PATH}"
+CRATE_NAME=aws-lc-sys
+CRATE_DIR="${REPO_ROOT}/${CRATE_NAME}"
 
 source "${SCRIPT_DIR}"/_publish_tools.sh
-
 publish_options "$@"
 
 pushd "${CRATE_DIR}" &>/dev/null
-run_prepublish_checks -c "${RELATIVE_CRATE_PATH}"
-publish_crate "${RELATIVE_CRATE_PATH}" ${PUBLISH}
+
+sanity_check_sys_crate "${CRATE_DIR}"
+
+run_prepublish_checks -c "${CRATE_NAME}"
+publish_crate "${CRATE_NAME}" ${PUBLISH}
 popd &>/dev/null