sh-setup: protect from exported IFS