diff --git a/.github/workflows/converter_tests.yaml b/.github/workflows/converter_tests.yaml
index a8cd3f3f7a4..64926d007d3 100644
--- a/.github/workflows/converter_tests.yaml
+++ b/.github/workflows/converter_tests.yaml
@@ -9,7 +9,7 @@ jobs:
       matrix:
         python-version: [3.7]
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
       with:
         fetch-depth: 1
     - uses: actions/setup-python@v1
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index 5530e5017bf..c2995ae1a3f 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -32,7 +32,7 @@ jobs:
       if: matrix.subset == 'kubernetes'
       run: |
         kubectl get pods
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
       with:
         fetch-depth: 1
         path: 'galaxy root'
diff --git a/.github/workflows/mulled.yaml b/.github/workflows/mulled.yaml
index f31e310452b..4a0ba77ab1f 100644
--- a/.github/workflows/mulled.yaml
+++ b/.github/workflows/mulled.yaml
@@ -15,7 +15,7 @@ jobs:
       with:
         path: .tox/mulled
         key: tox-mulled-${{ matrix.python-version }}
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
       with:
         fetch-depth: 1
     - uses: actions/setup-python@v1
diff --git a/lib/galaxy/webapps/galaxy/controllers/shed_tool_static.py b/lib/galaxy/webapps/galaxy/controllers/shed_tool_static.py
index 2261b5eb10a..7f659ad85bf 100644
--- a/lib/galaxy/webapps/galaxy/controllers/shed_tool_static.py
+++ b/lib/galaxy/webapps/galaxy/controllers/shed_tool_static.py
@@ -9,6 +9,12 @@ from galaxy.webapps.base.controller import BaseUIController
 log = logging.getLogger(__name__)
 
 
+def _asset_exists_and_is_safe(repo_path, asset_path):
+    if not safe_contains(repo_path, asset_path):
+        raise RequestParameterInvalidException()
+    return os.path.exists(asset_path)
+
+
 class ShedToolStatic(BaseUIController):
 
     @web.expose
@@ -26,17 +32,25 @@ class ShedToolStatic(BaseUIController):
         """
         guid = '/'.join((shed, 'repos', owner, repo, tool, version))
         tool = trans.app.toolbox.get_tool(guid)
-        repo_path = tool._repository_dir
-        if 'static/images' not in image_file:
-            path = join(repo_path, 'static', 'images', image_file)
+        repo_path = os.path.abspath(tool._repository_dir)
+        asset_path = os.path.abspath(join(repo_path, image_file))
+
+        # test specified image_file path exactly first, then fail through to
+        # other locations.
+        # Might want to swap this around and check for static/images first if
+        # that's the new(?) standard.
+        if not _asset_exists_and_is_safe(repo_path, asset_path):
+            if 'static/images' not in image_file:
+                asset_path = join(repo_path, 'static', 'images', image_file)
+                if not _asset_exists_and_is_safe(repo_path, asset_path):
+                    asset_path = None
+
+        if asset_path:
+            ext = os.path.splitext(image_file)[-1].lstrip('.')
+            if ext:
+                mime = trans.app.datatypes_registry.get_mimetype_by_extension(ext)
+                if mime:
+                    trans.response.set_content_type(mime)
+            return open(asset_path, 'rb')
         else:
-            path = join(repo_path, image_file)
-        if not safe_contains(os.path.abspath(repo_path), os.path.abspath(path)):
             raise RequestParameterInvalidException()
-        ext = os.path.splitext(image_file)[-1].lstrip('.')
-        if ext:
-            mime = trans.app.datatypes_registry.get_mimetype_by_extension(ext)
-            if mime:
-                trans.response.set_content_type(mime)
-        if os.path.exists(path):
-            return open(path, 'rb')
diff --git a/scripts/common_startup_functions.sh b/scripts/common_startup_functions.sh
index 2a1255bd894..fef20d27261 100644
--- a/scripts/common_startup_functions.sh
+++ b/scripts/common_startup_functions.sh
@@ -88,9 +88,9 @@ conda_activate() {
         echo "         starting Galaxy."
         PATH="$(get_conda_env_path $GALAXY_CONDA_ENV)/bin:$PATH"
         CONDA_DEFAULT_ENV="$GALAXY_CONDA_ENV"
-        CONDA_PREFIX="$(get_conda_root_path)"
+        CONDA_PREFIX="$(get_conda_active_prefix)"
     else
-        source activate "$GALAXY_CONDA_ENV"
+        source "$(get_conda_root_prefix)"/bin/activate "$GALAXY_CONDA_ENV"
     fi
 }
 
@@ -99,7 +99,7 @@ setup_python() {
     # should run this instance in.
     : ${GALAXY_VIRTUAL_ENV:=.venv}
     # $GALAXY_CONDA_ENV isn't set here to avoid running the version check if not using Conda
-    if [ -d "$GALAXY_VIRTUAL_ENV" -a -z "$skip_venv" ]; then
+    if [ -d "$GALAXY_VIRTUAL_ENV" ] && [ -z "$skip_venv" ]; then
         [ -n "$PYTHONPATH" ] && { echo 'Unsetting $PYTHONPATH'; unset PYTHONPATH; }
         echo "Activating virtualenv at $GALAXY_VIRTUAL_ENV"
         . "$GALAXY_VIRTUAL_ENV/bin/activate"
@@ -148,7 +148,7 @@ find_server() {
     APP_WEBSERVER=${APP_WEBSERVER:-$default_webserver}
     if [ "$APP_WEBSERVER" = "uwsgi" ]; then
         # Look for uwsgi
-        if [ -z "$skip_venv" -a -x $GALAXY_VIRTUAL_ENV/bin/uwsgi ]; then
+        if [ -z "$skip_venv" ] && [ -x $GALAXY_VIRTUAL_ENV/bin/uwsgi ]; then
             UWSGI=$GALAXY_VIRTUAL_ENV/bin/uwsgi
         elif command -v uwsgi >/dev/null 2>&1; then
             UWSGI=uwsgi
@@ -160,7 +160,7 @@ find_server() {
         [ -n "$server_app" ] && arg_getter_args="$arg_getter_args --app $server_app"
         run_server="$UWSGI"
         server_args=
-        if [ -z "$stop_daemon_arg_set" -a -z "$restart_arg_set" ]; then
+        if [ -z "$stop_daemon_arg_set" ] && [ -z "$restart_arg_set" ]; then
             server_args="$(eval python ./scripts/get_uwsgi_args.py $arg_getter_args)"
         fi
         server_args="$server_args $uwsgi_args"
@@ -193,13 +193,13 @@ find_server() {
 # to the `conda` script in the base environment. Thus in Conda 4.4, it may not be possible to locate `conda` even if you
 # are using Conda.
 set_conda_exe() {
-    [ -z "$_CONDA_EXE_SET" ] || return 0
+    [ -n "$CONDA_EXE" ] || [ -n "$_CONDA_EXE_SET" ] && return 0
     if python -V 2>&1 | grep -q -e 'Anaconda' -e 'Continuum Analytics' || \
             python -c 'import sys; print(sys.version.replace("\n", " "))' | grep -q -e 'packaged by conda-forge' ; then
-        : ${CONDA_EXE:=$(command -v conda)}
+        CONDA_EXE=$(command -v conda)
         if [ -z "$CONDA_EXE" ]; then
             echo "WARNING: \`python\` is from conda, but the \`conda\` command cannot be found."
-            pydir="$(dirname $(command -v python))"
+            pydir="$(dirname "$(command -v python)")"
             for CONDA_EXE in $pydir/conda $pydir/../../../bin/conda; do
                 [ -x "$CONDA_EXE" ] && break || unset CONDA_EXE
             done
@@ -209,7 +209,7 @@ set_conda_exe() {
                 echo "         $ conda activate base"
             else
                 echo "Guessed conda location: $CONDA_EXE"
-                PATH="$(dirname $CONDA_EXE):$PATH"
+                PATH="$(dirname "$CONDA_EXE"):$PATH"
             fi
         else
             echo "Found conda at: $CONDA_EXE"
@@ -220,12 +220,18 @@ set_conda_exe() {
 
 set_conda_info() {
     # cache conda info to avoid the cost of running it multiple times
-    if [ -z "$__CONDA_INFO" -o "$1" = "reset" ]; then
+    if [ -z "$__CONDA_INFO" ]; then
         __CONDA_INFO="$(${CONDA_EXE:-conda} info --json)"
     fi
 }
 
-get_conda_root_path() {
+get_conda_active_prefix() {
+    set_conda_info
+    printf "%s" "$__CONDA_INFO" \
+        | python -c "import json, sys; print(json.load(sys.stdin)['active_prefix'])"
+}
+
+get_conda_root_prefix() {
     set_conda_info
     printf "%s" "$__CONDA_INFO" \
         | python -c "import json, sys; print(json.load(sys.stdin)['root_prefix'])"
diff --git a/tox.ini b/tox.ini
index ebc9eef4a89..fd02ce81dda 100644
--- a/tox.ini
+++ b/tox.ini
@@ -13,7 +13,7 @@ commands =
 
     unit: bash run_tests.sh -u
 whitelist_externals = bash
-passenv = CI
+passenv = CI CONDA_EXE
 setenv =
     first_startup: GALAXY_PYTHON=python
     py{35,36,37}-first_startup: GALAXY_VIRTUAL_ENV=.venv3