diff --git a/cdist/conf/type/__apt_key/gencode-remote b/cdist/conf/type/__apt_key/gencode-remote
index 9c4fa00c..66494466 100755
--- a/cdist/conf/type/__apt_key/gencode-remote
+++ b/cdist/conf/type/__apt_key/gencode-remote
@@ -34,9 +34,9 @@ fi
 case "$state_should" in
    present)
       keyserver="$(cat "$__object/parameter/keyserver")"
-      echo "apt-key adv --keyserver \"$keyserver\" --recv-keys \"$keyid\""
+      echo "apt-key adv --keyserver '$keyserver' --recv-keys '$keyid'"
    ;;
    absent)
-      echo "apt-key del \"$keyid\""
+      echo "apt-key del '$keyid'"
    ;;
 esac
diff --git a/cdist/conf/type/__apt_ppa/gencode-remote b/cdist/conf/type/__apt_ppa/gencode-remote
index 41a6dc07..84ebebfe 100755
--- a/cdist/conf/type/__apt_ppa/gencode-remote
+++ b/cdist/conf/type/__apt_ppa/gencode-remote
@@ -29,9 +29,9 @@ fi
 
 case "$state_should" in
    present)
-      echo add-apt-repository \""$name"\"
+      echo "add-apt-repository '$name'"
    ;;
    absent)
-      echo remove-apt-repository \""$name"\"
+      echo "remove-apt-repository '$name'"
    ;;
 esac
diff --git a/cdist/conf/type/__ccollect_source/gencode-remote b/cdist/conf/type/__ccollect_source/gencode-remote
index 4ae74bc6..d22a0394 100755
--- a/cdist/conf/type/__ccollect_source/gencode-remote
+++ b/cdist/conf/type/__ccollect_source/gencode-remote
@@ -42,18 +42,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \""$1"\" \""$destination"\"
-    echo chgrp "$1" >> "$__messages_out"
+    echo "chgrp '$1' '$destination'"
+    echo "chgrp $1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \""$1"\" \""$destination"\"
-    echo chown "$1" >> "$__messages_out"
+    echo "chown '$1' '$destination'"
+    echo "chown $1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \""$1"\" \""$destination"\"
-   echo chmod "$1" >> "$__messages_out"
+   echo "chmod '$1' '$destination'"
+   echo "chmod $1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -80,7 +80,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \""$destination"\"
+            echo "rm -f '$destination'"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__cron/gencode-remote b/cdist/conf/type/__cron/gencode-remote
index f58896af..7b7f8512 100755
--- a/cdist/conf/type/__cron/gencode-remote
+++ b/cdist/conf/type/__cron/gencode-remote
@@ -79,18 +79,24 @@ DONE
 case "$state_should" in
     present)
         # if we insert new entry, filter also all entrys out with the same id 
-        echo "("
-        echo "crontab -u $user -l 2>/dev/null | grep -v -E \"$filter\" | grep -v \"# $name\\$\" 2>/dev/null || true"
-        echo "echo '$entry'"
-        echo ") | crontab -u $user -"
+        cat <<EOF
+(
+crontab -u $user -l 2>/dev/null | grep -v -E '$filter' | grep -v '# $name\\$' 2>/dev/null || true
+echo '$entry'
+) | crontab -u $user -
+EOF
     ;;
     absent)
         if [ -f "$__object/parameter/raw_command" ]; then
-            echo "( crontab -u $user -l 2>/dev/null | grep -v -E \"$filter\" 2>/dev/null || true ) | \\"
-            echo "grep -v \"^$entry\\$\" | crontab -u $user -"
+            cat <<EOF
+( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '^$entry\\$' | crontab -u $user -
+EOF
         else
-            echo "( crontab -u $user -l 2>/dev/null | grep -v -E \"$filter\" 2>/dev/null || true ) | \\"
-            echo "grep -v \"# $name\\$\" | crontab -u $user -"
+            cat <<EOF
+( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '# $name\\$' | crontab -u $user -
+EOF
         fi
     ;;
 esac
diff --git a/cdist/conf/type/__directory/gencode-remote b/cdist/conf/type/__directory/gencode-remote
index 35866eb4..fd1ff9ff 100755
--- a/cdist/conf/type/__directory/gencode-remote
+++ b/cdist/conf/type/__directory/gencode-remote
@@ -57,18 +57,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp "$recursive" \""$1"\" \""$destination"\"
-    echo chgrp "$recursive" "$1" >> "$__messages_out"
+    echo "chgrp '$recursive' '$1' '$destination'"
+    echo "chgrp $recursive $1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown "$recursive" \""$1"\" \""$destination"\"
-    echo chown "$recursive" "$1" >> "$__messages_out"
+    echo "chown '$recursive' '$1' '$destination'"
+    echo "chown $recursive $1" >> "$__messages_out"
 }
 
 set_mode() {
-    echo chmod "$recursive" \""$1"\" \""$destination"\"
-    echo chmod "$recursive" "$1" >> "$__messages_out"
+    echo "chmod '$recursive' '$1' '$destination'"
+    echo "chmod $recursive $1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -78,10 +78,10 @@ case "$state_should" in
          if [ "$type" != "none" ]; then
             # our destination is not a directory, remove whatever is there
             # and then create our directory and set all attributes
-            echo rm -f "\"$destination\""
+            echo "rm -f '$destination'"
             echo "remove non directory" >> "$__messages_out"
          fi
-         echo "mkdir $mkdiropt \"$destination\""
+         echo "mkdir $mkdiropt '$destination'"
          echo "create" >> "$__messages_out"
       fi
 
@@ -105,7 +105,7 @@ case "$state_should" in
    ;;
    absent)
         if [ "$type" = "directory" ]; then
-            echo rm -rf \""$destination"\"
+            echo "rm -rf '$destination'"
             echo remove >> "$__messages_out"
         fi
    ;;
diff --git a/cdist/conf/type/__file/gencode-local b/cdist/conf/type/__file/gencode-local
index fb9f9a92..7ca5941f 100755
--- a/cdist/conf/type/__file/gencode-local
+++ b/cdist/conf/type/__file/gencode-local
@@ -54,7 +54,7 @@ if [ "$state_should" = "present" ] || [ "$state_should" = "exists" ]; then
          source="$__object/stdin"
       fi
       if [ ! -f "$source" ]; then
-         echo "Source \"$source\" does not exist." >&2
+         echo "Source '$source' does not exist." >&2
          exit 1
       else
          if [ "$type" != "file" ]; then
@@ -96,7 +96,7 @@ DONE
       fi
 # move uploaded file into place
 cat << DONE
-$__remote_exec $__target_host "rm -rf \"$destination\"; mv \"\$destination_upload\" \"$destination\""
+$__remote_exec $__target_host "rm -rf '$destination'; mv \"\$destination_upload\" '$destination'"
 DONE
    fi
 fi
diff --git a/cdist/conf/type/__file/gencode-remote b/cdist/conf/type/__file/gencode-remote
index c98e6e76..8c8b426d 100755
--- a/cdist/conf/type/__file/gencode-remote
+++ b/cdist/conf/type/__file/gencode-remote
@@ -43,18 +43,18 @@ get_current_value() {
 }
 
 set_group() {
-    echo chgrp \""$1"\" \""$destination"\"
-    echo chgrp "$1" >> "$__messages_out"
+    echo "chgrp '$1' '$destination'"
+    echo "chgrp $1" >> "$__messages_out"
 }
 
 set_owner() {
-    echo chown \""$1"\" \""$destination"\"
-    echo chown "$1" >> "$__messages_out"
+    echo "chown '$1' '$destination'"
+    echo "chown $1" >> "$__messages_out"
 }
 
 set_mode() {
-   echo chmod \""$1"\" \""$destination"\"
-   echo chmod "$1" >> "$__messages_out"
+   echo "chmod '$1' '$destination'"
+   echo "chmod $1" >> "$__messages_out"
 }
 
 case "$state_should" in
@@ -81,7 +81,7 @@ case "$state_should" in
 
     absent)
         if [ "$type" = "file" ]; then
-            echo rm -f \""$destination"\"
+            echo "rm -f '$destination'"
             echo remove >> "$__messages_out"
         fi
     ;;
diff --git a/cdist/conf/type/__firewalld_rule/gencode-remote b/cdist/conf/type/__firewalld_rule/gencode-remote
index e1441234..35835635 100755
--- a/cdist/conf/type/__firewalld_rule/gencode-remote
+++ b/cdist/conf/type/__firewalld_rule/gencode-remote
@@ -33,13 +33,13 @@ rule="$(cat "$__object/parameter/rule")"
 
 case "$state_should" in
     present)
-        echo firewall-cmd --quiet --permanent --direct --add-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
-        echo firewall-cmd --quiet --direct --add-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
+        echo "firewall-cmd --quiet --permanent --direct --add-rule '$protocol' '$table' '$chain' '$priority' $rule"
+        echo "firewall-cmd --quiet --direct --add-rule '$protocol' '$table' '$chain' '$priority' $rule"
     ;;
 
     absent)
-        echo firewall-cmd --quiet --permanent --direct --remove-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
-        echo firewall-cmd --quiet --direct --remove-rule \""$protocol"\" \""$table"\" \""$chain"\" \""$priority"\" "$rule"
+        echo "firewall-cmd --quiet --permanent --direct --remove-rule '$protocol' '$table' '$chain' '$priority' $rule"
+        echo "firewall-cmd --quiet --direct --remove-rule '$protocol' '$table' '$chain' '$priority' $rule"
     ;;
     *)
         echo "Unknown state $state_should" >&2
diff --git a/cdist/conf/type/__firewalld_start/gencode-remote b/cdist/conf/type/__firewalld_start/gencode-remote
index 3e767f68..771007af 100755
--- a/cdist/conf/type/__firewalld_start/gencode-remote
+++ b/cdist/conf/type/__firewalld_start/gencode-remote
@@ -1,4 +1,4 @@
-#!/bin/sh -e
+"#!/bin/sh -2
 #
 # 2016 Darko Poljak(darko.poljak at ungleich.ch)
 #
@@ -42,16 +42,16 @@ esac
 if [ "$init" = 'systemd' ]; then
     # this handles ALL linux distros with systemd
     # e.g. archlinux, gentoo in some cases, new RHEL and SLES versions
-    echo "systemctl \"$cmd\" \"$name\""
+    echo "systemctl '$cmd' '$name'"
 else
     case "$os" in
         debian)
             case "$os_version" in
                 [1-7]*)
-                    echo "service \"$name\" \"$cmd\""
+                    echo "service '$name' '$cmd'"
                 ;;
                 8*)
-                    echo "systemctl \"$cmd\" \"$name\""
+                    echo "systemctl '$cmd' '$name'"
                 ;;
                 *)
                     echo "Unsupported version $os_version of $os" >&2
@@ -61,19 +61,19 @@ else
         ;;
 
         gentoo)
-            echo service \"$name\" \"$cmd\"
+            echo "service '$name' '$cmd'"
         ;;
 
         amazon|scientific|centos|fedora|owl|redhat|suse)
-            echo service \"$name\" \"$cmd\"
+            echo "service '$name' '$cmd'"
         ;;
 
         openwrt)
-            echo "/etc/init.d/\"$name\" \"$cmd\""
+            echo "'/etc/init.d/$name' '$cmd'"
         ;;
 
         ubuntu)
-            echo "service \"$name\" \"$cmd\""
+            echo "service '$name' '$cmd'"
         ;;
 
         *)
diff --git a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
index b4298c7c..240ae00b 100755
--- a/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
+++ b/cdist/conf/type/__install_partition_msdos_apply/gencode-remote
@@ -87,7 +87,7 @@ primary_count=0
 for object in $objects; do
    device="$(cat "$object/parameter/device")"
    if [ "$current_device" != "$device" ]; then
-      echo "create_disklabel \"$device\" || die 'Failed to create disklabel for $device'"
+      echo "create_disklabel '$device' || die 'Failed to create disklabel for $device'"
       current_device="$device"
       device_name=$(echo "${device}" | sed -e 's:^/dev/::;s:/:\\/:g')
       available_device_size=$(( $(awk "/${device_name}\$/ { print \$3; }" "$partitions") / 1024))
diff --git a/cdist/conf/type/__jail_freebsd10/gencode-remote b/cdist/conf/type/__jail_freebsd10/gencode-remote
index fa821994..33ba9cc4 100755
--- a/cdist/conf/type/__jail_freebsd10/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd10/gencode-remote
@@ -130,11 +130,11 @@ deleteJail() {
       fi
 EOF
 # Remove the jail's rw mountpoints
-   echo "rm -rf \"${jaildir}/rw/${name}\""
+   echo "rm -rf '${jaildir}/rw/${name}'"
 # Remove the jail directory
-   echo "rm -rf \"${jaildir}/${name}\""
+   echo "rm -rf '${jaildir}/${name}'"
 # Remove the jail's fstab
-   echo "rm -f \"/etc/fstab.${name}\""
+   echo "rm -f '/etc/fstab.${name}'"
 # Remove jail entry from jail.conf
    cat <<EOF
       sed -i .bak -E -e "/^${name} {\$/,/^}\\\$/d" /etc/jail.conf
diff --git a/cdist/conf/type/__jail_freebsd9/gencode-remote b/cdist/conf/type/__jail_freebsd9/gencode-remote
index 95404f4f..7be9ce35 100755
--- a/cdist/conf/type/__jail_freebsd9/gencode-remote
+++ b/cdist/conf/type/__jail_freebsd9/gencode-remote
@@ -135,11 +135,11 @@ deleteJail() {
       fi
 EOF
 # Remove the jail's rw mountpoints
-   echo "rm -rf \"${jaildir}/rw/${name}\""
+   echo "rm -rf '${jaildir}/rw/${name}'"
 # Remove the jail directory
-   echo "rm -rf \"${jaildir}/${name}\""
+   echo "rm -rf '${jaildir}/${name}'"
 # Remove the jail's fstab
-   echo "rm -f \"/etc/fstab.${name}\""
+   echo "rm -f '/etc/fstab.${name}'"
 # Remove jail_$name_* lines from rc.conf
    cat <<EOF
       sed -i '.bak' "/^jail_${name}_/d" /etc/rc.conf
diff --git a/cdist/conf/type/__keyboard/manifest b/cdist/conf/type/__keyboard/manifest
index 80cd4819..e7591cbc 100755
--- a/cdist/conf/type/__keyboard/manifest
+++ b/cdist/conf/type/__keyboard/manifest
@@ -34,13 +34,13 @@ case "$os" in
             __key_value KEYTABLE \
                 --file /etc/sysconfig/keyboard \
                 --delimiter '=' \
-                --value "\"$keyboard_type\""
+                --value "'$keyboard_type'"
         
         require="__file/etc/sysconfig/keyboard" \
             __key_value LAYOUT \
                 --file /etc/sysconfig/keyboard \
                 --delimiter '=' \
-                --value "\"$keyboard_type\""
+                --value "'$keyboard_type'"
     ;;
     *)
       echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
diff --git a/cdist/conf/type/__package_apt/gencode-remote b/cdist/conf/type/__package_apt/gencode-remote
index cbe14787..e1477db4 100755
--- a/cdist/conf/type/__package_apt/gencode-remote
+++ b/cdist/conf/type/__package_apt/gencode-remote
@@ -64,7 +64,7 @@ esac
 
 # Hint if we need to avoid questions at some point:
 # DEBIAN_PRIORITY=critical can reduce the number of questions
-aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\""
+aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
 
 if [ "$state_is" = "$state_should" ]; then
     if [ -z "$version" ] || [ "$version" = "$version_is" ]; then
diff --git a/cdist/conf/type/__package_emerge/gencode-remote b/cdist/conf/type/__package_emerge/gencode-remote
index 01c91bcc..c8a79c1f 100755
--- a/cdist/conf/type/__package_emerge/gencode-remote
+++ b/cdist/conf/type/__package_emerge/gencode-remote
@@ -63,10 +63,10 @@ fi
 
 case "$state_should" in
    present)
-        echo "emerge \"$name\" &>/dev/null || exit 1"
+        echo "emerge '$name' &>/dev/null || exit 1"
         ;;
    absent)
-        echo "emerge -C \"$name\" &>/dev/null || exit 1"
+        echo "emerge -C '$name' &>/dev/null || exit 1"
         ;;
    *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_luarocks/gencode-remote b/cdist/conf/type/__package_luarocks/gencode-remote
index e14d7a8e..60b9bfea 100755
--- a/cdist/conf/type/__package_luarocks/gencode-remote
+++ b/cdist/conf/type/__package_luarocks/gencode-remote
@@ -42,10 +42,10 @@ fi
 
 case "$state_should" in
     present)
-        echo luarocks install \""$name"\"
+        echo "luarocks install '$name'"
     ;;
     absent)
-        echo luarocks remove \""$name"\"
+        echo "luarocks remove '$name'"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_opkg/gencode-remote b/cdist/conf/type/__package_opkg/gencode-remote
index 53f154a5..94dc2808 100755
--- a/cdist/conf/type/__package_opkg/gencode-remote
+++ b/cdist/conf/type/__package_opkg/gencode-remote
@@ -43,12 +43,12 @@ esac
 case "$state_should" in
     present)
         if [ "$present" = "notpresent" ]; then
-            echo opkg --verbosity=0 update
+            echo "opkg --verbosity=0 update"
         fi
-        echo opkg --verbosity=0 install \""$name"\"
+        echo "opkg --verbosity=0 install '$name'"
     ;;
     absent)
-        echo opkg --verbosity=0 remove \""$name"\"
+        echo "opkg --verbosity=0 remove '$name'"
     ;;
     *)
         echo "Unknown state: $state" >&2
diff --git a/cdist/conf/type/__package_pacman/gencode-remote b/cdist/conf/type/__package_pacman/gencode-remote
index 43649124..7ba85479 100755
--- a/cdist/conf/type/__package_pacman/gencode-remote
+++ b/cdist/conf/type/__package_pacman/gencode-remote
@@ -45,10 +45,10 @@ fi
 
 case "$state_should" in
    present)
-         echo pacman --needed --noconfirm --noprogressbar -S \""$name"\"
+         echo "pacman --needed --noconfirm --noprogressbar -S '$name'"
    ;;
    absent)
-         echo pacman --noconfirm --noprogressbar -R \""$name"\"
+         echo "pacman --noconfirm --noprogressbar -R '$name'"
    ;;
    *)
       echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_pip/gencode-remote b/cdist/conf/type/__package_pip/gencode-remote
index 933406f2..33556bec 100755
--- a/cdist/conf/type/__package_pip/gencode-remote
+++ b/cdist/conf/type/__package_pip/gencode-remote
@@ -53,7 +53,7 @@ case "$state_should" in
     present)
         if [ "$runas" ]
         then
-            echo "su -c \"$pip install -q $name\" $runas"
+            echo "su -c '$pip install -q $name' $runas"
         else
             echo $pip install -q "$name"
         fi
@@ -61,7 +61,7 @@ case "$state_should" in
     absent)
         if [ "$runas" ]
         then
-            echo "su -c \"$pip uninstall -q -y $name\" $runas"
+            echo "su -c '$pip uninstall -q -y $name' $runas"
         else
             echo $pip uninstall -q -y "$name"
         fi
diff --git a/cdist/conf/type/__package_pkg_freebsd/gencode-remote b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
index e0980296..a01ddc2f 100755
--- a/cdist/conf/type/__package_pkg_freebsd/gencode-remote
+++ b/cdist/conf/type/__package_pkg_freebsd/gencode-remote
@@ -27,8 +27,8 @@ assert ()                 #  If condition false,
 
 	if [ ! "$1" ] 
 	then
-		echo "Assertion failed:  \"$1\""
-		echo "File \"$0\""
+		echo "Assertion failed:  '$1'"
+		echo "File '$0'"
 		exit $E_ASSERT_FAILED
 	fi  
 }
@@ -64,12 +64,14 @@ execcmd(){
 		[ -n "$version" ] && pkgsite="${pkgsite}/All/" || pkgsite="${pkgsite}/Latest/"
 		echo "${pkgsite}"
 	fi
-	echo "${2} 2>&- >&-"	# Silence the output of the command
-	echo "status=\$?"
-	echo "if [ \"\$status\" -ne \"0\" ]; then"
-	echo "	echo \"Error: ${cmd} exited nonzero with \$status\"'!' >&2"
-	echo "	exit 1"
-	echo "fi"
+    cat <<EOF
+${2} 2>&- >&-  # Silence the output of the command
+status=\$?
+if [ "\$status" -ne "0" ]; then
+	echo "Error: ${cmd} exited nonzero with \$status!" >&2
+	exit 1
+fi
+EOF
 }
 
 if [ -n "$curr_version" ]; then	# PKG *is* installed
diff --git a/cdist/conf/type/__package_rubygem/gencode-remote b/cdist/conf/type/__package_rubygem/gencode-remote
index d474db20..ee563ef8 100755
--- a/cdist/conf/type/__package_rubygem/gencode-remote
+++ b/cdist/conf/type/__package_rubygem/gencode-remote
@@ -39,10 +39,10 @@ fi
 
 case "$state_should" in
     present)
-        echo gem install \""$name"\" --no-ri --no-rdoc
+        echo "gem install '$name' --no-ri --no-rdoc"
     ;;
     absent)
-        echo gem uninstall \""$name"\"
+        echo "gem uninstall '$name'"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_upgrade_all/gencode-remote b/cdist/conf/type/__package_upgrade_all/gencode-remote
index 38aa001e..0bf86c99 100755
--- a/cdist/conf/type/__package_upgrade_all/gencode-remote
+++ b/cdist/conf/type/__package_upgrade_all/gencode-remote
@@ -44,7 +44,7 @@ else
     esac
 fi
 
-aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=\"--force-confdef\" -o Dpkg::Options::=\"--force-confold\""
+aptget="DEBIAN_FRONTEND=noninteractive apt-get --quiet --yes --no-install-recommends -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold"
 
 case "$type" in
     yum)
diff --git a/cdist/conf/type/__package_yum/gencode-remote b/cdist/conf/type/__package_yum/gencode-remote
index 60dc376d..97265827 100755
--- a/cdist/conf/type/__package_yum/gencode-remote
+++ b/cdist/conf/type/__package_yum/gencode-remote
@@ -60,10 +60,10 @@ fi
 
 case "$state_should" in
     present)
-        echo yum $opts install \""$install_name"\"
+        echo "yum $opts install '$install_name'"
     ;;
     absent)
-        echo yum $opts remove \""$name"\"
+        echo "yum $opts remove '$name'"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__package_zypper/gencode-remote b/cdist/conf/type/__package_zypper/gencode-remote
index caf15397..1f15c531 100755
--- a/cdist/conf/type/__package_zypper/gencode-remote
+++ b/cdist/conf/type/__package_zypper/gencode-remote
@@ -61,15 +61,15 @@ case "$state_should" in
     present)
         if [ -z "$version_should" ]; then
             [ "$state_is" = "present" ] && exit 0 # if state is present, we dont need to do anything
-            echo zypper $globalopts install --type \""$ptype"\" --auto-agree-with-licenses \""$name"\" ">/dev/null"
+            echo "zypper $globalopts install --type '$ptype' --auto-agree-with-licenses '$name' >/dev/null"
         else
             [ "$state_is" = "present" ] && [ "$version_should" = "$version_is" ] && exit 0 # if state is present and version is correct, we dont need to do anything
-            echo zypper $globalopts install --oldpackage --type \""$ptype"\" --auto-agree-with-licenses \""$name"\" = \""$version_should"\" ">/dev/null"
+            echo "zypper $globalopts install --oldpackage --type '$ptype' --auto-agree-with-licenses '$name' = '$version_should' >/dev/null"
         fi
     ;;
     absent)
         [ "$state_is" = "absent" ] && exit 0 # if state is absent, we dont need to do anything
-        echo zypper $globalopts remove --type \""$ptype"\" \""$name"\" ">/dev/null"
+        echo "zypper $globalopts remove --type '$ptype' '$name' >/dev/null"
     ;;
     *)
         echo "Unknown state: $state_should" >&2
diff --git a/cdist/conf/type/__postgres_database/explorer/state b/cdist/conf/type/__postgres_database/explorer/state
index dc9659e2..7a7c40a3 100755
--- a/cdist/conf/type/__postgres_database/explorer/state
+++ b/cdist/conf/type/__postgres_database/explorer/state
@@ -20,7 +20,7 @@
 
 name="$__object_id"
 
-if su - postgres -c "echo '\q' | psql '$name'" 2>/dev/null; then
+if su -l postgres -c "echo '\q' | psql '$name'" 2>/dev/null; then
    echo "present"
 else
    echo "absent"
diff --git a/cdist/conf/type/__postgres_database/gencode-remote b/cdist/conf/type/__postgres_database/gencode-remote
index 92301fb8..32fe08cf 100755
--- a/cdist/conf/type/__postgres_database/gencode-remote
+++ b/cdist/conf/type/__postgres_database/gencode-remote
@@ -29,10 +29,10 @@ if [ "$state_should" != "$state_is" ]; then
          if [ -f "$__object/parameter/owner" ]; then
             owner="-O '$(cat "$__object/parameter/owner")'"
          fi
-         echo "su - postgres -c \"createdb $owner '$name'\""
+         echo "su -l postgres -c \"createdb $owner '$name'\""
       ;;
       absent)
-         echo "su - postgres -c \"dropdb '$name'\""
+         echo "su -l postgres -c \"dropdb '$name'\""
       ;;
    esac
 fi
diff --git a/cdist/conf/type/__postgres_extension/gencode-remote b/cdist/conf/type/__postgres_extension/gencode-remote
index f7895103..60072994 100755
--- a/cdist/conf/type/__postgres_extension/gencode-remote
+++ b/cdist/conf/type/__postgres_extension/gencode-remote
@@ -30,10 +30,10 @@ state_should=$( cat "$__object/parameter/state" )
 case "$state_should" in
     present)
          cmd="CREATE EXTENSION IF NOT EXISTS $extension"
-         echo "su - postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
+         echo "su -l postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
     ;;
     absent)
          cmd="DROP   EXTENSION IF     EXISTS $extenstion"
-         echo "su - postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
+         echo "su -l postgres -c 'psql -c \"$cmd\" \"$dbname\"'"
     ;;
 esac
diff --git a/cdist/conf/type/__postgres_role/explorer/state b/cdist/conf/type/__postgres_role/explorer/state
index 8c102df9..6f7e2955 100755
--- a/cdist/conf/type/__postgres_role/explorer/state
+++ b/cdist/conf/type/__postgres_role/explorer/state
@@ -20,7 +20,7 @@
 
 name="$__object_id"
 
-if su - postgres -c "psql -c '\du' | grep -q '^ *$name *|'"; then
+if su -l postgres -c "psql -c '\du' | grep -q '^ *$name *|'"; then
    echo "present"
 else
    echo "absent"
diff --git a/cdist/conf/type/__postgres_role/gencode-remote b/cdist/conf/type/__postgres_role/gencode-remote
index f977e73e..901390e9 100755
--- a/cdist/conf/type/__postgres_role/gencode-remote
+++ b/cdist/conf/type/__postgres_role/gencode-remote
@@ -41,9 +41,9 @@ case "$state_should" in
          [ -n "$password" ] && password="PASSWORD '$password'"
 
          cmd="CREATE ROLE $name WITH $password $booleans"
-         echo "su - postgres -c \"psql -c \\\"$cmd\\\"\""
+         echo "su -l postgres -c \"psql -c \\\"$cmd\\\"\""
     ;;
     absent)
-        echo "su - postgres -c \"dropuser \\\"$name\\\"\""
+        echo "su -l postgres -c \"dropuser \\\"$name\\\"\""
     ;;
 esac
diff --git a/cdist/conf/type/__qemu_img/gencode-remote b/cdist/conf/type/__qemu_img/gencode-remote
index 62442eee..94816f58 100755
--- a/cdist/conf/type/__qemu_img/gencode-remote
+++ b/cdist/conf/type/__qemu_img/gencode-remote
@@ -18,4 +18,4 @@ format="$(cat "$__object/parameter/format")"
 size="$(cat "$__object/parameter/size")"
 diskimage="/$__object_id"
 
-echo qemu-img create -f \""$format"\" \""$diskimage"\" \""$size"\"
+echo "qemu-img create -f '$format' '$diskimage' '$size'"
diff --git a/cdist/conf/type/__rvm/gencode-remote b/cdist/conf/type/__rvm/gencode-remote
index 494c8fd8..3016e648 100755
--- a/cdist/conf/type/__rvm/gencode-remote
+++ b/cdist/conf/type/__rvm/gencode-remote
@@ -28,12 +28,12 @@ state_should="$(cat "$__object/parameter/state")"
 case "$state_should" in
     present)
         cat << DONE
-su - $user -c "unset rvm_path; unset rvm_bin_path; unset rvm_prefix; unset rvm_version; curl -L get.rvm.io | bash -s stable"
+su -l $user -c "unset rvm_path; unset rvm_bin_path; unset rvm_prefix; unset rvm_version; curl -L get.rvm.io | bash -s stable"
 DONE
     ;;
     absent)
         cat << DONE
-su - $user -c "rm -Rf \"\\\$HOME/.rvm\";
+su -l $user -c "rm -Rf \"\\\$HOME/.rvm\";
 sed '/rvm\/scripts\/rvm/d' \"\\\$HOME/.bashrc\" > \"\\\$HOME/.bashrc.cdist-tmp\"
 mv \"\\\$HOME/.bashrc.cdist-tmp\" \"\\\$HOME/.bashrc\""
 DONE
diff --git a/cdist/conf/type/__rvm_gem/explorer/state b/cdist/conf/type/__rvm_gem/explorer/state
index 4146d666..b0b40a0a 100755
--- a/cdist/conf/type/__rvm_gem/explorer/state
+++ b/cdist/conf/type/__rvm_gem/explorer/state
@@ -24,13 +24,13 @@ gemset="$(cat "$__object/parameter/gemset")"
 ruby="$(echo "$gemset" | cut -d '@' -f 1)"
 gemsetname="$(echo "$gemset" | cut -d '@' -f2)"
 user="$(cat "$__object/parameter/user")"
-if su - "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
+if su -l "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
    echo "absent"
    exit 0
 fi
-if su - "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
+if su -l "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
 rvm list | grep -q $ruby"; then
-   if su - "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
+   if su -l "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
 rvm use $ruby > /dev/null 2>&1; rvm gemset list | grep -q $gemsetname &&
 rvm use $gemset > /dev/null 2>&1 && gem list | grep -q $gem"; then
       echo "present"
diff --git a/cdist/conf/type/__rvm_gem/gencode-remote b/cdist/conf/type/__rvm_gem/gencode-remote
index 9212de91..ace05df6 100755
--- a/cdist/conf/type/__rvm_gem/gencode-remote
+++ b/cdist/conf/type/__rvm_gem/gencode-remote
@@ -29,12 +29,12 @@ state_should="$(cat "$__object/parameter/state")"
 case "$state_should" in
     present)
         cat << DONE
-su - "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem install "$gem"'
+su -l "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem install "$gem"'
 DONE
     ;;
     absent)
         cat << DONE
-su - "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem uninstall "$gem"'
+su -l "$user" -c 'source ~/.rvm/scripts/rvm; rvm use "$gemset"; gem uninstall "$gem"'
 DONE
     ;;
 esac
diff --git a/cdist/conf/type/__rvm_gemset/explorer/state b/cdist/conf/type/__rvm_gemset/explorer/state
index 1556c22c..1b4738b6 100755
--- a/cdist/conf/type/__rvm_gemset/explorer/state
+++ b/cdist/conf/type/__rvm_gemset/explorer/state
@@ -28,8 +28,8 @@ if [ ! -e "~$user/.rvm/scripts/rvm" ] ; then
    exit 0
 fi
 
-if su - "$user" -c "source ~/.rvm/scripts/rvm; rvm list strings | grep -q \"^$ruby\$\""; then
-    if su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use \"$ruby\" > /dev/null; rvm gemset list strings | cut -f 1 -d " " | grep -q \"^$gemsetname\$\""; then
+if su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm list strings | grep -q \"^$ruby\$\""; then
+    if su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm use \"$ruby\" > /dev/null; rvm gemset list strings | cut -f 1 -d " " | grep -q \"^$gemsetname\$\""; then
       echo "present"
       exit 0
   fi
diff --git a/cdist/conf/type/__rvm_gemset/gencode-remote b/cdist/conf/type/__rvm_gemset/gencode-remote
index 78851f9a..a902b9fb 100755
--- a/cdist/conf/type/__rvm_gemset/gencode-remote
+++ b/cdist/conf/type/__rvm_gemset/gencode-remote
@@ -31,18 +31,18 @@ state_should="$(cat "$__object/parameter/state")"
 case "$state_should" in
     present)
         cat << DONE
-su - "$user" -c "source ~/.rvm/scripts/rvm; rvm $gemset --create"
+su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm $gemset --create"
 DONE
         if -f "$__object/parameter/default"; then
             cat << DONE
-su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use --default $gemset"
+su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm use --default $gemset"
 DONE
         fi
 
     ;;
     absent)
         cat << DONE
-su - "$user" -c "source ~/.rvm/scripts/rvm; rvm use $ruby; rvm --force gemset delete $gemsetname"
+su -l "$user" -c "source ~/.rvm/scripts/rvm; rvm use $ruby; rvm --force gemset delete $gemsetname"
 DONE
     ;;
 esac
diff --git a/cdist/conf/type/__rvm_ruby/explorer/state b/cdist/conf/type/__rvm_ruby/explorer/state
index 43dafd4f..7ee8863a 100755
--- a/cdist/conf/type/__rvm_ruby/explorer/state
+++ b/cdist/conf/type/__rvm_ruby/explorer/state
@@ -20,11 +20,11 @@
 
 ruby="$__object_id"
 user="$(cat "$__object/parameter/user")"
-if su - "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
+if su -l "$user" -c "[ ! -d \"\$HOME/.rvm\" ]" ; then
     echo "absent"
     exit 0
 fi
-if su - "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
+if su -l "$user" -c "source \"\$HOME/.rvm/scripts/rvm\"
 rvm list | grep -q $ruby"; then
    echo "present"
 else
diff --git a/cdist/conf/type/__rvm_ruby/gencode-remote b/cdist/conf/type/__rvm_ruby/gencode-remote
index f2fd41ef..012c84c2 100755
--- a/cdist/conf/type/__rvm_ruby/gencode-remote
+++ b/cdist/conf/type/__rvm_ruby/gencode-remote
@@ -27,15 +27,15 @@ state_should="$(cat "$__object/parameter/state")"
 
 case "$state_should" in
     present)
-        echo "su - \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
+        echo "su -l \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
             "rvm install $ruby\""
         if [ -f "$__object/parameter/default" ]; then
-            echo "su - \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
+            echo "su -l \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
                 "rvm use --default $ruby\""
         fi
     ;;
     absent)
-        echo "su - \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
+        echo "su -l \"$user\" -c \"source \\\$HOME/.rvm/scripts/rvm;"\
             "rvm remove $ruby\""
     ;;
 
diff --git a/cdist/conf/type/__ssh_authorized_key/gencode-remote b/cdist/conf/type/__ssh_authorized_key/gencode-remote
index 82c90d61..e1273028 100755
--- a/cdist/conf/type/__ssh_authorized_key/gencode-remote
+++ b/cdist/conf/type/__ssh_authorized_key/gencode-remote
@@ -25,7 +25,7 @@ the_key="$(cat "$__object/parameter/key")"
 validated_key="$(echo "${the_key}" | tr ' ' '\n' | awk '/^(ssh|ecdsa)-[^ ]+/ { printf $1" "; getline; printf $1 }')"
 if [ -z "${validated_key}" ]
 then
-    echo "Key is invalid: \"${the_key}\"" >&2
+    echo "Key is invalid: '${the_key}'" >&2
     exit 1
 fi
 
diff --git a/cdist/conf/type/__start_on_boot/gencode-remote b/cdist/conf/type/__start_on_boot/gencode-remote
index 0ecea85b..bd343c9a 100755
--- a/cdist/conf/type/__start_on_boot/gencode-remote
+++ b/cdist/conf/type/__start_on_boot/gencode-remote
@@ -37,16 +37,16 @@ case "$state_should" in
         if [ "$init" = 'systemd' ]; then
             # this handles ALL linux distros with systemd
             # e.g. archlinux, gentoo in some cases, new RHEL and SLES versions
-            echo "systemctl -q enable \"$name\""
+            echo "systemctl -q enable '$name'"
         else
             case "$os" in
                 debian)
                     case "$os_version" in
                         [1-7]*)
-                            echo "update-rc.d \"$name\" defaults >/dev/null"
+                            echo "update-rc.d '$name' defaults >/dev/null"
                         ;;
                         8*)
-                            echo "systemctl enable \"$name\""
+                            echo "systemctl enable '$name'"
                         ;;
                         *)
                             echo "Unsupported version $os_version of $os" >&2
@@ -55,26 +55,26 @@ case "$state_should" in
                     esac
                 ;;
                 devuan)
-                    echo "update-rc.d \"$name\" defaults >/dev/null"
+                    echo "update-rc.d '$name' defaults >/dev/null"
                 ;;
 
                 gentoo)
-                    echo "rc-update add \"$name\" \"$target_runlevel\""
+                    echo "rc-update add '$name' '$target_runlevel'"
                 ;;
 
                 amazon|scientific|centos|fedora|owl|redhat|suse)
-                    echo "chkconfig \"$name\" on"
+                    echo "chkconfig '$name' on"
                 ;;
 
                 openwrt)
                     # 'enable' can be successful and still return a non-zero exit
                     # code, deal with it by checking for success ourselves in that
                     # case (the || ... part).
-                    echo "/etc/init.d/\"$name\" enable || [ -f /etc/rc.d/S??\"$name\" ]"
+                    echo "/etc/init.d/$name enable || [ -f /etc/rc.d/S??$name ]"
                 ;;
 
                 ubuntu)
-                    echo "update-rc.d \"$name\" defaults >/dev/null"
+                    echo "update-rc.d '$name' defaults >/dev/null"
                 ;;
 
                 freebsd)
@@ -93,24 +93,24 @@ case "$state_should" in
         if [ "$init" = 'systemd' ]; then
             # this handles ALL linux distros with systemd
             # e.g. archlinux, gentoo in some cases, new RHEL and SLES versions
-            echo "systemctl -q disable \"$name\""
+            echo "systemctl -q disable '$name'"
 
         else
             case "$os" in
                 debian|ubuntu|devuan)
-                    echo "update-rc.d -f \"$name\" remove"
+                    echo "update-rc.d -f '$name' remove"
                 ;;
 
                 gentoo)
-                    echo "rc-update del \"$name\"  \"$target_runlevel\""
+                    echo "rc-update del '$name'  '$target_runlevel'"
                 ;;
 
                 centos|fedora|owl|redhat|suse)
-                    echo "chkconfig \"$name\" off"
+                    echo "chkconfig '$name' off"
                 ;;
 
                 openwrt)
-                    echo "\"/etc/init.d/$name\" disable"
+                    echo "'/etc/init.d/$name' disable"
                 ;;
 
                 *)
diff --git a/cdist/conf/type/__timezone/gencode-remote b/cdist/conf/type/__timezone/gencode-remote
index 1f3f0196..1f5066b7 100755
--- a/cdist/conf/type/__timezone/gencode-remote
+++ b/cdist/conf/type/__timezone/gencode-remote
@@ -30,6 +30,6 @@ fi
 
 case "$os" in
    ubuntu|debian|devuan|coreos)
-      echo "echo \"$timezone_should\" > /etc/timezone"
+      echo "echo '$timezone_should' > /etc/timezone"
    ;;
 esac
diff --git a/cdist/conf/type/__timezone/manifest b/cdist/conf/type/__timezone/manifest
index a20f5d32..f2017449 100755
--- a/cdist/conf/type/__timezone/manifest
+++ b/cdist/conf/type/__timezone/manifest
@@ -48,7 +48,7 @@ case "$os" in
             __key_value ZONE \
                 --file /etc/sysconfig/clock \
                 --delimiter '=' \
-                --value "\"$timezone\""
+                --value "'$timezone'"
     ;;
     *)
         echo "Your operating system ($os) is currently not supported by this type (${__type##*/})." >&2
diff --git a/cdist/conf/type/__user_groups/gencode-remote b/cdist/conf/type/__user_groups/gencode-remote
index 8120761a..df84faaf 100755
--- a/cdist/conf/type/__user_groups/gencode-remote
+++ b/cdist/conf/type/__user_groups/gencode-remote
@@ -44,23 +44,23 @@ fi
 for group in $changed_groups; do
    if [ "$os" = "netbsd" ] || [ "$os" = "openbsd" ]; then
       case "$state_should" in
-         present) echo "usermod -G \"$group\" \"$user\"" ;;
+         present) echo "usermod -G '$group' '$user'" ;;
          absent) echo 'NetBSD and OpenBSD do not have a command to remove a user from a group' >&2 ; exit 1 ;;
       esac
    elif [ "$os" = "freebsd" ]; then
       case "$state_should" in
-         present) echo "pw groupmod \"$group\" -m \"$user\"" ;;
-         absent) echo "pw groupmod \"$group\" -d \"$user\"" ;;
+         present) echo "pw groupmod '$group' -m '$user'" ;;
+         absent) echo "pw groupmod '$group' -d '$user'" ;;
       esac
    elif [ "$oldusermod" = "true" ]; then
       case "$state_should" in
-         present) echo "usermod -A \"$group\" \"$user\"" ;;
-         absent) echo "usermod -R \"$group\" \"$user\"" ;;
+         present) echo "usermod -A '$group' '$user'" ;;
+         absent) echo "usermod -R '$group' '$user'" ;;
       esac
    else
       case "$state_should" in
-         present) echo "gpasswd -a \"$user\" \"$group\"" ;;
-         absent) echo "gpasswd -d \"$user\" \"$group\"" ;;
+         present) echo "gpasswd -a '$user' '$group'" ;;
+         absent) echo "gpasswd -d '$user' '$group'" ;;
       esac
    fi
 done
diff --git a/cdist/conf/type/__zypper_service/gencode-remote b/cdist/conf/type/__zypper_service/gencode-remote
index 955698d1..413a43ab 100755
--- a/cdist/conf/type/__zypper_service/gencode-remote
+++ b/cdist/conf/type/__zypper_service/gencode-remote
@@ -71,14 +71,14 @@ fi
 
 case "$state_should" in
    present)
-         echo zypper $zypper_def_opts addservice -t "$stype" "$uri" \"$desc\"
-         echo zypper $zypper_def_opts refs
-         echo zypper $zypper_def_opts ref
+         echo "zypper $zypper_def_opts addservice -t '$stype' '$uri' '$desc'"
+         echo "zypper $zypper_def_opts refs"
+         echo "zypper $zypper_def_opts ref"
    ;;
    absent)
-         echo zypper $zypper_def_opts removeservice "$service_id"
-         echo zypper $zypper_def_opts refs
-         echo zypper $zypper_def_opts ref
+         echo "zypper $zypper_def_opts removeservice '$service_id'"
+         echo "zypper $zypper_def_opts refs"
+         echo "zypper $zypper_def_opts ref"
    ;;
    *)
       echo "Unknown state: $state_should" >&2