quoting; posix sed;

cdist/conf/type/__cron/gencode-remote

@@ -60,7 +60,7 @@ prefix="#cdist:__cron/$__object_id"
 suffix="#/cdist:__cron/$__object_id"
 filter="^# DO NOT EDIT THIS FILE|^# \(.* installed on |^# \(Cron version V|^# \(Cronie version .\..\)$"
 cat << DONE
-crontab -u $user -l 2>/dev/null | grep -v -E "$filter" | awk -v prefix="$prefix" -v suffix="$suffix" '
+crontab -u '$user' -l 2>/dev/null | grep -v -E "$filter" | awk -v prefix="$prefix" -v suffix="$suffix" '
 {
    if (index(\$0,prefix)) {
       triggered=1
@@ -73,7 +73,7 @@ crontab -u $user -l 2>/dev/null | grep -v -E "$filter" | awk -v prefix="$prefix"
       print
    }
 }
-' | crontab -u $user -
+' | crontab -u '$user' -
 DONE
 
 case "$state_should" in
@@ -81,21 +81,21 @@ case "$state_should" in
         # if we insert new entry, filter also all entrys out with the same id 
         cat <<EOF
 (
-crontab -u $user -l 2>/dev/null | grep -v -E '$filter' | grep -v '# $name\\$' 2>/dev/null || true
+crontab -u '$user' -l 2>/dev/null | grep -v -E '$filter' | grep -v '# $name\\$' 2>/dev/null || true
 echo '$entry'
-) | crontab -u $user -
+) | crontab -u '$user' -
 EOF
     ;;
     absent)
         if [ -f "$__object/parameter/raw_command" ]; then
             cat <<EOF
-( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
-grep -v '^$entry\\$' | crontab -u $user -
+( crontab -u '$user' -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '^$entry\\$' | crontab -u '$user' -
 EOF
         else
             cat <<EOF
-( crontab -u $user -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
-grep -v '# $name\\$' | crontab -u $user -
+( crontab -u '$user' -l 2>/dev/null | grep -v -E '$filter' 2>/dev/null || true ) | \\
+grep -v '# $name\\$' | crontab -u '$user' -
 EOF
         fi
     ;;

cdist/conf/type/__jail_freebsd10/gencode-remote

@@ -137,7 +137,8 @@ EOF
    echo "rm -f '/etc/fstab.${name}'"
 # Remove jail entry from jail.conf
    cat <<EOF
-      sed -i .bak -E -e "/^${name} {\$/,/^}\\\$/d" /etc/jail.conf
+      mv /etc/jail.conf /etc/jail.conf.bak
+      sed -E -e "/^${name} {\$/,/^}\\\$/d" /etc/jail.conf.bak > /etc/jail.conf
       if [ -f "/etc/jail.conf.bak" ]; then
          rm -f "/etc/jail.conf.bak"
       fi
@@ -153,7 +154,8 @@ EOF
       done
       jail_list="\${new_list}"
       
-      sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
       unset jail_list
       if [ -f "/etc/rc.conf.bak" ]; then
          rm -f /etc/rc.conf.bak
@@ -239,7 +241,8 @@ cat <<EOF
    if [ -z "\$jail_enable" ]; then	# no jail_enable line in rc.conf at all
       echo "jail_enable=\"YES\"" >>/etc/rc.conf
    elif [ ! "\$(echo \$jail_enable | tr '[a-z]' '[A-Z]' | tr -d '"')" = "YES" ]; then	# jail_enable="NO"
-      sed -i '.bak' 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf	# fix this -^
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf.bak > /etc/rc.conf	# fix this -^
       rm -f /etc/rc.conf.bak
    fi
 
@@ -313,7 +316,8 @@ if [ "$onboot" = "yes" ]; then
          echo "jail_list=\"${name}\"" >>/etc/rc.conf
       else
          jail_list="\${jail_list} ${name}"
-         sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+         mv /etc/rc.conf /etc/rc.conf.bak
+         sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
          rm -f /etc/rc.conf.bak
       fi
       unset jail_list

cdist/conf/type/__jail_freebsd9/gencode-remote

@@ -142,7 +142,8 @@ EOF
    echo "rm -f '/etc/fstab.${name}'"
 # Remove jail_$name_* lines from rc.conf
    cat <<EOF
-      sed -i '.bak' "/^jail_${name}_/d" /etc/rc.conf
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed "/^jail_${name}_/d" /etc/rc.conf.bak > /etc/rc.conf
       if [ -f "/etc/rc.conf.bak" ]; then
          rm -f /etc/rc.conf.bak
       fi
@@ -158,7 +159,8 @@ EOF
       done
       jail_list="\${new_list}"
       
-      sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
       unset jail_list
       if [ -f "/etc/rc.conf.bak" ]; then
          rm -f /etc/rc.conf.bak
@@ -241,7 +243,8 @@ cat <<EOF
    if [ -z "\$jail_enable" ]; then	# no jail_enable line in rc.conf at all
       echo "jail_enable=\"YES\"" >>/etc/rc.conf
    elif [ ! "\$(echo \$jail_enable | tr '[a-z]' '[A-Z]')" = "YES" ]; then	# jail_enable="NO"
-      sed -i '.bak' 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf	# fix this -^
+      mv /etc/rc.conf /etc/rc.conf.bak
+      sed 's/^jail_enable=.*$/jail_enable="YES"/g' /etc/rc.conf.bak > /etc/rc.conf	# fix this -^
       rm -f /etc/rc.conf.bak
    fi
    cat >>/etc/rc.conf <<END
@@ -309,7 +312,8 @@ if [ "$onboot" = "yes" ]; then
          echo "jail_list=\"${name}\"" >>/etc/rc.conf
       else
          jail_list="\${jail_list} ${name}"
-         sed -i '.bak' "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf
+         mv /etc/rc.conf /etc/rc.conf.bak
+         sed "s/^jail_list=\".*\"/jail_list=\"\${jail_list}\"/" /etc/rc.conf.bak > /etc/rc.conf
          rm -f /etc/rc.conf.bak
       fi
       unset jail_list

cdist/conf/type/__package_pip/gencode-remote

@@ -53,7 +53,7 @@ case "$state_should" in
     present)
         if [ "$runas" ]
         then
-            echo "su -c '$pip install -q $name' $runas"
+            echo "su -c '$pip install -q $name' '$runas'"
         else
             echo $pip install -q "$name"
         fi
@@ -61,7 +61,7 @@ case "$state_should" in
     absent)
         if [ "$runas" ]
         then
-            echo "su -c '$pip uninstall -q -y $name' $runas"
+            echo "su -c '$pip uninstall -q -y $name' '$runas'"
         else
             echo $pip uninstall -q -y "$name"
         fi