rebase + squash

Signed-off-by: Lamont Granquist <lamont@scriptkiddie.org>

21 files changed, 340 insertions, 325 deletions

diff --git a/lib/chef/provider/apt_repository.rb b/lib/chef/provider/apt_repository.rb
index 973c10e94a..85df37a1a3 100644
--- a/lib/chef/provider/apt_repository.rb
+++ b/lib/chef/provider/apt_repository.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Thom May (<thom@chef.io>)
-# Copyright:: Copyright (c) 2016-2017, Chef Software Inc.
+# Copyright:: Copyright (c) 2016-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -29,7 +29,7 @@ class Chef
 
       provides :apt_repository, platform_family: "debian"
 
-      LIST_APT_KEY_FINGERPRINTS = "apt-key adv --list-public-keys --with-fingerprint --with-colons".freeze
+      LIST_APT_KEY_FINGERPRINTS = %w{apt-key adv --list-public-keys --with-fingerprint --with-colons}.freeze
 
       def load_current_resource
       end
@@ -48,6 +48,8 @@ class Chef
         end
 
         declare_resource(:execute, "apt-cache gencaches") do
+          command %w{apt-cache gencaches}
+          default_env true
           ignore_failure true
           action :nothing
         end
@@ -113,8 +115,8 @@ class Chef
       # @param [String] cmd the command to run
       #
       # @return [Array] an array of fingerprints
-      def extract_fingerprints_from_cmd(cmd)
-        so = shell_out(cmd)
+      def extract_fingerprints_from_cmd(*cmd)
+        so = shell_out(*cmd)
         so.stdout.split(/\n/).map do |t|
           if z = t.match(/^fpr:+([0-9A-F]+):/)
             z[1].split.join
@@ -129,7 +131,7 @@ class Chef
       def key_is_valid?(key)
         valid = true
 
-        so = shell_out("apt-key list")
+        so = shell_out("apt-key", "list")
         so.stdout.split(/\n/).map do |t|
           if t =~ %r{^\/#{key}.*\[expired: .*\]$}
             logger.debug "Found expired key: #{t}"
@@ -166,8 +168,8 @@ class Chef
       def no_new_keys?(file)
         # Now we are using the option --with-colons that works across old os versions
         # as well as the latest (16.10). This for both `apt-key` and `gpg` commands
-        installed_keys = extract_fingerprints_from_cmd(LIST_APT_KEY_FINGERPRINTS)
-        proposed_keys = extract_fingerprints_from_cmd("gpg --with-fingerprint --with-colons #{file}")
+        installed_keys = extract_fingerprints_from_cmd(*LIST_APT_KEY_FINGERPRINTS)
+        proposed_keys = extract_fingerprints_from_cmd("gpg", "--with-fingerprint", "--with-colons", file)
         (installed_keys & proposed_keys).sort == proposed_keys.sort
       end
 
@@ -208,6 +210,8 @@ class Chef
         end
 
         declare_resource(:execute, "apt-key add #{cached_keyfile}") do
+          command [ "apt-key", "add", cached_keyfile ]
+          default_env true
           sensitive new_resource.sensitive
           action :run
           not_if { no_new_keys?(cached_keyfile) }
@@ -243,9 +247,10 @@ class Chef
       def install_key_from_keyserver(key, keyserver = new_resource.keyserver)
         declare_resource(:execute, "install-key #{key}") do
           command keyserver_install_cmd(key, keyserver)
+          default_env true
           sensitive new_resource.sensitive
           not_if do
-            present = extract_fingerprints_from_cmd(LIST_APT_KEY_FINGERPRINTS).any? do |fp|
+            present = extract_fingerprints_from_cmd(*LIST_APT_KEY_FINGERPRINTS).any? do |fp|
               fp.end_with? key.upcase
             end
             present && key_is_valid?(key.upcase)
diff --git a/lib/chef/provider/apt_update.rb b/lib/chef/provider/apt_update.rb
index 28fc122055..eeafcba58b 100644
--- a/lib/chef/provider/apt_update.rb
+++ b/lib/chef/provider/apt_update.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Thom May (<thom@chef.io>)
-# Copyright:: Copyright (c) 2016-2017, Chef Software Inc.
+# Copyright:: Copyright (c) 2016-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -67,7 +67,10 @@ class Chef
           action :create_if_missing
         end
 
-        declare_resource(:execute, "apt-get -q update")
+        declare_resource(:execute, "apt-get -q update") do
+          command [ "apt-get", "-q", "update" ]
+          default_env true
+        end
       end
 
     end
diff --git a/lib/chef/provider/cron/unix.rb b/lib/chef/provider/cron/unix.rb
index 4edd5ba206..6539ccd7ca 100644
--- a/lib/chef/provider/cron/unix.rb
+++ b/lib/chef/provider/cron/unix.rb
@@ -33,7 +33,7 @@ class Chef
         private
 
         def read_crontab
-          crontab = shell_out("/usr/bin/crontab -l", user: @new_resource.user)
+          crontab = shell_out(%w{/usr/bin/crontab -l}, user: @new_resource.user)
           status = crontab.status.exitstatus
 
           logger.trace crontab.format_for_exception if status > 0
@@ -53,7 +53,7 @@ class Chef
           exit_status = 0
           error_message = ""
           begin
-            crontab_write = shell_out("/usr/bin/crontab #{tempcron.path}", user: @new_resource.user)
+            crontab_write = shell_out("/usr/bin/crontab", tempcron.path, user: @new_resource.user)
             stderr = crontab_write.stderr
             exit_status = crontab_write.status.exitstatus
             # solaris9, 10 on some failures for example invalid 'mins' in crontab fails with exit code of zero :(
diff --git a/lib/chef/provider/ifconfig.rb b/lib/chef/provider/ifconfig.rb
index f3d65d7c7c..070a4686ba 100644
--- a/lib/chef/provider/ifconfig.rb
+++ b/lib/chef/provider/ifconfig.rb
@@ -53,7 +53,7 @@ class Chef
 
         @ifconfig_version = nil
 
-        @net_tools_version = shell_out("ifconfig --version")
+        @net_tools_version = shell_out("ifconfig", "--version")
         @net_tools_version.stderr.each_line do |line|
           if line =~ /^net-tools (\d+.\d+)/
             @ifconfig_version = line.match(/^net-tools (\d+.\d+)/)[1]
diff --git a/lib/chef/provider/mdadm.rb b/lib/chef/provider/mdadm.rb
index 9b023b1a65..10e814a79b 100644
--- a/lib/chef/provider/mdadm.rb
+++ b/lib/chef/provider/mdadm.rb
@@ -31,7 +31,7 @@ class Chef
         logger.trace("#{new_resource} checking for software raid device #{current_resource.raid_device}")
 
         device_not_found = 4
-        mdadm = shell_out!("mdadm --detail --test #{new_resource.raid_device}", returns: [0, device_not_found])
+        mdadm = shell_out!("mdadm", "--detail", "--test", new_resource.raid_device, returns: [0, device_not_found])
         exists = (mdadm.status == 0)
         current_resource.exists(exists)
       end
diff --git a/lib/chef/provider/mount/aix.rb b/lib/chef/provider/mount/aix.rb
index c1ed499957..9614fc1e7f 100644
--- a/lib/chef/provider/mount/aix.rb
+++ b/lib/chef/provider/mount/aix.rb
@@ -48,7 +48,7 @@ class Chef
           end
           # lsfs o/p = #MountPoint:Device:Vfs:Nodename:Type:Size:Options:AutoMount:Acct
           # search only for current mount point
-          shell_out("lsfs -c #{@new_resource.mount_point}").stdout.each_line do |line|
+          shell_out("lsfs", "-c", @new_resource.mount_point).stdout.each_line do |line|
             case line
             when /^#\s/
               next
@@ -121,21 +121,22 @@ class Chef
         def mount_fs
           unless @current_resource.mounted
             mountable?
-            command = "mount -v #{@new_resource.fstype}"
+            command = [ "mount", "-v", @new_resource.fstype ]
 
             if !(@new_resource.options.nil? || @new_resource.options.empty?)
-              command << " -o #{@new_resource.options.join(',')}"
+              command << "-o"
+              command << @new_resource.options.join(",")
             end
 
             command << case @new_resource.device_type
                        when :device
-                         " #{device_real}"
+                         device_real
                        when :label
-                         " -L #{@new_resource.device}"
+                         [ "-L", @new_resource.device ]
                        when :uuid
-                         " -U #{@new_resource.device}"
+                         [ "-U", @new_resource.device ]
                        end
-            command << " #{@new_resource.mount_point}"
+            command << @new_resource.mount_point
             shell_out!(command)
             logger.trace("#{@new_resource} is mounted at #{@new_resource.mount_point}")
           else
@@ -145,9 +146,9 @@ class Chef
 
         def remount_command
           if !(@new_resource.options.nil? || @new_resource.options.empty?)
-            "mount -o remount,#{@new_resource.options.join(',')} #{@new_resource.device} #{@new_resource.mount_point}"
+            [ "mount", "-o", "remount,#{@new_resource.options.join(',')}", @new_resource.device, @new_resource.mount_point ]
           else
-            "mount -o remount #{@new_resource.device} #{@new_resource.mount_point}"
+            [ "mount", "-o", "remount", @new_resource.device, @new_resource.mount_point ]
           end
         end
 
diff --git a/lib/chef/provider/mount/mount.rb b/lib/chef/provider/mount/mount.rb
index 52d55f5404..55be15d8c5 100644
--- a/lib/chef/provider/mount/mount.rb
+++ b/lib/chef/provider/mount/mount.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Joshua Timberman (<joshua@chef.io>)
-# Copyright:: Copyright 2009-2016, Chef Software Inc.
+# Copyright:: Copyright 2009-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -102,18 +102,21 @@ class Chef
         def mount_fs
           unless @current_resource.mounted
             mountable?
-            command = "mount -t #{@new_resource.fstype}"
-            command << " -o #{@new_resource.options.join(',')}" unless @new_resource.options.nil? || @new_resource.options.empty?
+            command = [ "mount", "-t", @new_resource.fstype ]
+            unless @new_resource.options.nil? || @new_resource.options.empty?
+              command << "-o"
+              command << @new_resource.options.join(",")
+            end
             command << case @new_resource.device_type
                        when :device
-                         " #{device_real}"
+                         device_real
                        when :label
-                         " -L #{@new_resource.device}"
+                         [ "-L", @new_resource.device ]
                        when :uuid
-                         " -U #{@new_resource.device}"
+                         [ "-U", @new_resource.device ]
                        end
-            command << " #{@new_resource.mount_point}"
-            shell_out!(command)
+            command << @new_resource.mount_point
+            shell_out!(*command)
             logger.trace("#{@new_resource} is mounted at #{@new_resource.mount_point}")
           else
             logger.trace("#{@new_resource} is already mounted at #{@new_resource.mount_point}")
@@ -122,7 +125,7 @@ class Chef
 
         def umount_fs
           if @current_resource.mounted
-            shell_out!("umount #{@new_resource.mount_point}")
+            shell_out!("umount", @new_resource.mount_point)
             logger.trace("#{@new_resource} is no longer mounted at #{@new_resource.mount_point}")
           else
             logger.trace("#{@new_resource} is not mounted at #{@new_resource.mount_point}")
@@ -130,12 +133,12 @@ class Chef
         end
 
         def remount_command
-          "mount -o remount,#{@new_resource.options.join(',')} #{@new_resource.mount_point}"
+          [ "mount", "-o", "remount,#{@new_resource.options.join(',')}", @new_resource.mount_point ]
         end
 
         def remount_fs
           if @current_resource.mounted && @new_resource.supports[:remount]
-            shell_out!(remount_command)
+            shell_out!(*remount_command)
             @new_resource.updated_by_last_action(true)
             logger.trace("#{@new_resource} is remounted at #{@new_resource.mount_point}")
           elsif @current_resource.mounted
@@ -221,7 +224,7 @@ class Chef
               @real_device = @new_resource.device
             else
               @real_device = ""
-              ret = shell_out("/sbin/findfs #{device_fstab}")
+              ret = shell_out("/sbin/findfs", device_fstab)
               device_line = ret.stdout.lines.first # stdout.first consumes
               @real_device = device_line.chomp unless device_line.nil?
             end
diff --git a/lib/chef/provider/mount/solaris.rb b/lib/chef/provider/mount/solaris.rb
index 095c07432a..48936c8057 100644
--- a/lib/chef/provider/mount/solaris.rb
+++ b/lib/chef/provider/mount/solaris.rb
@@ -76,14 +76,17 @@ class Chef
         def mount_fs
           actual_options = native_options(options)
           actual_options.delete("-")
-          command = "mount -F #{fstype}"
-          command << " -o #{actual_options.join(',')}" unless actual_options.empty?
-          command << " #{device} #{mount_point}"
+          command = [ "mount", "-F", fstype ]
+          unless actual_options.empty?
+            command << "-o"
+            command << actual_options.join(",")
+          end
+          command << [ device, mount_point ]
           shell_out!(command)
         end
 
         def umount_fs
-          shell_out!("umount #{mount_point}")
+          shell_out!("umount", mount_point)
         end
 
         def remount_fs
@@ -91,7 +94,7 @@ class Chef
           actual_options = native_options(options)
           actual_options.delete("-")
           mount_options = actual_options.empty? ? "" : ",#{actual_options.join(',')}"
-          shell_out!("mount -o remount#{mount_options} #{mount_point}")
+          shell_out!("mount", "-o", "remount#{mount_options}", mount_point)
         end
 
         def enable_fs
@@ -150,7 +153,7 @@ class Chef
         # /dev/dsk/c1t0d0s0 on / type ufs read/write/setuid/devices/intr/largefiles/logging/xattr/onerror=panic/dev=700040 on Tue May  1 11:33:55 2012
         def mounted?
           mounted = false
-          shell_out!("mount -v").stdout.each_line do |line|
+          shell_out!("mount", "-v").stdout.each_line do |line|
             case line
             when /^#{device_regex}\s+on\s+#{Regexp.escape(mount_point)}\s+/
               logger.trace("Special device #{device} is mounted as #{mount_point}")
diff --git a/lib/chef/provider/osx_profile.rb b/lib/chef/provider/osx_profile.rb
index e753f84d86..66b5c26137 100644
--- a/lib/chef/provider/osx_profile.rb
+++ b/lib/chef/provider/osx_profile.rb
@@ -188,16 +188,16 @@ class Chef
       end
 
       def install_profile(profile_path)
-        cmd = "profiles -I -F '#{profile_path}'"
-        logger.trace("cmd: #{cmd}")
-        shellout_results = shell_out(cmd)
+        cmd = [ "profiles", "-I", "-F", profile_path ]
+        logger.trace("cmd: #{cmd.join(" ")}")
+        shellout_results = shell_out(*cmd)
         shellout_results.exitstatus
       end
 
       def remove_profile
-        cmd = "profiles -R -p '#{@new_profile_identifier}'"
-        logger.trace("cmd: #{cmd}")
-        shellout_results = shell_out(cmd)
+        cmd = [ "profiles", "-R", "-p", @new_profile_identifier ]
+        logger.trace("cmd: #{cmd.join(" ")}")
+        shellout_results = shell_out(*cmd)
         shellout_results.exitstatus
       end
 
@@ -225,8 +225,7 @@ class Chef
       end
 
       def write_installed_profiles(tempfile)
-        cmd = "profiles -P -o '#{tempfile}'"
-        shell_out!(cmd)
+        shell_out!( "profiles", "-P", "-o", tempfile )
       end
 
       def read_plist(xml_file)
diff --git a/lib/chef/provider/route.rb b/lib/chef/provider/route.rb
index 2195abfe29..aaa056e542 100644
--- a/lib/chef/provider/route.rb
+++ b/lib/chef/provider/route.rb
@@ -133,7 +133,7 @@ class Chef
         else
           command = generate_command(:add)
           converge_by("run #{command.join(' ')} to add route") do
-            shell_out!(command)
+            shell_out!(*command)
             logger.info("#{new_resource} added")
           end
         end
@@ -146,7 +146,7 @@ class Chef
         if is_running
           command = generate_command(:delete)
           converge_by("run #{command.join(' ')} to delete route ") do
-            shell_out!(command)
+            shell_out!(*command)
             logger.info("#{new_resource} removed")
           end
         else
diff --git a/lib/chef/provider/systemd_unit.rb b/lib/chef/provider/systemd_unit.rb
index 44f34fb8d7..328540764c 100644
--- a/lib/chef/provider/systemd_unit.rb
+++ b/lib/chef/provider/systemd_unit.rb
@@ -135,7 +135,7 @@ class Chef
       def action_start
         unless current_resource.active
           converge_by("starting unit: #{new_resource.unit_name}") do
-            systemctl_execute!(:start, new_resource.unit_name)
+            systemctl_execute!(:start, new_resource.unit_name, default_env: false)
           end
         end
       end
@@ -143,21 +143,21 @@ class Chef
       def action_stop
         if current_resource.active
           converge_by("stopping unit: #{new_resource.unit_name}") do
-            systemctl_execute!(:stop, new_resource.unit_name)
+            systemctl_execute!(:stop, new_resource.unit_name, default_env: false)
           end
         end
       end
 
       def action_restart
         converge_by("restarting unit: #{new_resource.unit_name}") do
-          systemctl_execute!(:restart, new_resource.unit_name)
+          systemctl_execute!(:restart, new_resource.unit_name, default_env: false)
         end
       end
 
       def action_reload
         if current_resource.active
           converge_by("reloading unit: #{new_resource.unit_name}") do
-            systemctl_execute!(:reload, new_resource.unit_name)
+            systemctl_execute!(:reload, new_resource.unit_name, default_env: false)
           end
         else
           logger.trace("#{new_resource.unit_name} is not active, skipping reload.")
@@ -166,19 +166,19 @@ class Chef
 
       def action_try_restart
         converge_by("try-restarting unit: #{new_resource.unit_name}") do
-          systemctl_execute!("try-restart", new_resource.unit_name)
+          systemctl_execute!("try-restart", new_resource.unit_name, default_env: false)
         end
       end
 
       def action_reload_or_restart
         converge_by("reload-or-restarting unit: #{new_resource.unit_name}") do
-          systemctl_execute!("reload-or-restart", new_resource.unit_name)
+          systemctl_execute!("reload-or-restart", new_resource.unit_name, default_env: false)
         end
       end
 
       def action_reload_or_try_restart
         converge_by("reload-or-try-restarting unit: #{new_resource.unit_name}") do
-          systemctl_execute!("reload-or-try-restart", new_resource.unit_name)
+          systemctl_execute!("reload-or-try-restart", new_resource.unit_name, default_env: false)
         end
       end
 
@@ -191,7 +191,7 @@ class Chef
       end
 
       def masked?
-        systemctl_execute(:status, new_resource.unit_name).stdout.include?("masked")
+        systemctl_execute("status", new_resource.unit_name).stdout.include?("masked")
       end
 
       def static?
@@ -219,19 +219,19 @@ class Chef
       end
 
       def daemon_reload
-        shell_out!("#{systemctl_cmd} daemon-reload", **systemctl_opts, default_env: false)
+        shell_out!(systemctl_cmd, "daemon-reload", **systemctl_opts, default_env: false)
       end
 
-      def systemctl_execute!(action, unit)
-        shell_out!("#{systemctl_cmd} #{action} #{Shellwords.escape(unit)}", **systemctl_opts, default_env: false)
+      def systemctl_execute!(action, unit, **options)
+        shell_out!(systemctl_cmd, action, unit, **systemctl_opts.merge(options))
       end
 
-      def systemctl_execute(action, unit)
-        shell_out("#{systemctl_cmd} #{action} #{Shellwords.escape(unit)}", **systemctl_opts)
+      def systemctl_execute(action, unit, **options)
+        shell_out(systemctl_cmd, action, unit, **systemctl_opts.merge(options))
       end
 
       def systemctl_cmd
-        @systemctl_cmd ||= "#{systemctl_path} #{systemctl_args}"
+        @systemctl_cmd ||= [ systemctl_path, systemctl_args ]
       end
 
       def systemctl_path
diff --git a/spec/unit/provider/apt_repository_spec.rb b/spec/unit/provider/apt_repository_spec.rb
index 79b871eb6c..1601e9f629 100644
--- a/spec/unit/provider/apt_repository_spec.rb
+++ b/spec/unit/provider/apt_repository_spec.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Thom May (<thom@chef.io>)
-# Copyright:: 2016-2017, Chef Software, Inc.
+# Copyright:: 2016-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -55,7 +55,7 @@ describe Chef::Provider::AptRepository do
   end
 
   let(:apt_key_finger_cmd) do
-    "apt-key adv --list-public-keys --with-fingerprint --with-colons"
+    %w{apt-key adv --list-public-keys --with-fingerprint --with-colons}
   end
 
   let(:apt_key_finger) do
@@ -106,12 +106,12 @@ C5986B4F1257FFA86632CBA746181433FBB75451
   describe "#extract_fingerprints_from_cmd" do
     it "runs the desired command" do
       expect(provider).to receive(:shell_out).and_return(apt_key_finger)
-      provider.extract_fingerprints_from_cmd(apt_key_finger_cmd)
+      provider.extract_fingerprints_from_cmd(*apt_key_finger_cmd)
     end
 
     it "returns a list of key fingerprints" do
       expect(provider).to receive(:shell_out).and_return(apt_key_finger)
-      expect(provider.extract_fingerprints_from_cmd(apt_key_finger_cmd)).to eql(apt_fingerprints)
+      expect(provider.extract_fingerprints_from_cmd(*apt_key_finger_cmd)).to eql(apt_fingerprints)
     end
   end
 
@@ -124,21 +124,21 @@ C5986B4F1257FFA86632CBA746181433FBB75451
 
   describe "#no_new_keys?" do
     before do
-      allow(provider).to receive(:extract_fingerprints_from_cmd).with(apt_key_finger_cmd).and_return(apt_fingerprints)
+      allow(provider).to receive(:extract_fingerprints_from_cmd).with(*apt_key_finger_cmd).and_return(apt_fingerprints)
     end
 
     let(:file) { "/tmp/remote-gpg-keyfile" }
 
     it "matches a set of keys" do
       allow(provider).to receive(:extract_fingerprints_from_cmd)
-        .with("gpg --with-fingerprint --with-colons #{file}")
+        .with("gpg", "--with-fingerprint", "--with-colons", file)
         .and_return(Array(apt_fingerprints.first))
       expect(provider.no_new_keys?(file)).to be_truthy
     end
 
     it "notices missing keys" do
       allow(provider).to receive(:extract_fingerprints_from_cmd)
-        .with("gpg --with-fingerprint --with-colons #{file}")
+        .with("gpg", "--with-fingerprint", "--with-colons", file)
         .and_return(%w{ F36A89E33CC1BD0F71079007327574EE02A818DD })
       expect(provider.no_new_keys?(file)).to be_falsey
     end
diff --git a/spec/unit/provider/apt_update_spec.rb b/spec/unit/provider/apt_update_spec.rb
index 35a47c45e5..5cd327b66b 100644
--- a/spec/unit/provider/apt_update_spec.rb
+++ b/spec/unit/provider/apt_update_spec.rb
@@ -37,6 +37,8 @@ describe Chef::Provider::AptUpdate do
     Chef::Provider::AptUpdate.new(new_resource, run_context)
   end
 
+  let(:apt_update_cmd) { %w{apt-get -q update} }
+
   it "responds to load_current_resource" do
     expect(provider).to respond_to(:load_current_resource)
   end
@@ -45,7 +47,7 @@ describe Chef::Provider::AptUpdate do
     before do
       FileUtils.rmdir config_dir
       expect(File.exist?(config_dir)).to be false
-      allow_any_instance_of(Chef::Provider::Execute).to receive(:shell_out!).with("apt-get -q update", anything())
+      allow_any_instance_of(Chef::Provider::Execute).to receive(:shell_out_compacted!).with(*apt_update_cmd, anything())
     end
 
     it "should create the directory" do
@@ -64,7 +66,7 @@ describe Chef::Provider::AptUpdate do
   describe "#action_update" do
     it "should update the apt cache" do
       provider.load_current_resource
-      expect_any_instance_of(Chef::Provider::Execute).to receive(:shell_out!).with("apt-get -q update", anything())
+      expect_any_instance_of(Chef::Provider::Execute).to receive(:shell_out_compacted!).with(*apt_update_cmd, anything())
       provider.run_action(:update)
       expect(new_resource).to be_updated_by_last_action
     end
@@ -79,14 +81,14 @@ describe Chef::Provider::AptUpdate do
 
     it "should run if the time stamp is old" do
       expect(File).to receive(:mtime).with("#{stamp_dir}/update-success-stamp").and_return(Time.now - 86_500)
-      expect_any_instance_of(Chef::Provider::Execute).to receive(:shell_out!).with("apt-get -q update", anything())
+      expect_any_instance_of(Chef::Provider::Execute).to receive(:shell_out_compacted!).with(*apt_update_cmd, anything())
       provider.run_action(:periodic)
       expect(new_resource).to be_updated_by_last_action
     end
 
     it "should not run if the time stamp is new" do
       expect(File).to receive(:mtime).with("#{stamp_dir}/update-success-stamp").and_return(Time.now)
-      expect_any_instance_of(Chef::Provider::Execute).not_to receive(:shell_out!).with("apt-get -q update", anything())
+      expect_any_instance_of(Chef::Provider::Execute).not_to receive(:shell_out_compacted!).with(*apt_update_cmd, anything())
       provider.run_action(:periodic)
       expect(new_resource).to_not be_updated_by_last_action
     end
@@ -98,14 +100,14 @@ describe Chef::Provider::AptUpdate do
 
       it "should run if the time stamp is old" do
         expect(File).to receive(:mtime).with("#{stamp_dir}/update-success-stamp").and_return(Time.now - 500)
-        expect_any_instance_of(Chef::Provider::Execute).to receive(:shell_out!).with("apt-get -q update", anything())
+        expect_any_instance_of(Chef::Provider::Execute).to receive(:shell_out_compacted!).with(*apt_update_cmd, anything())
         provider.run_action(:periodic)
         expect(new_resource).to be_updated_by_last_action
       end
 
       it "should not run if the time stamp is new" do
         expect(File).to receive(:mtime).with("#{stamp_dir}/update-success-stamp").and_return(Time.now - 300)
-        expect_any_instance_of(Chef::Provider::Execute).not_to receive(:shell_out!).with("apt-get -q update", anything())
+        expect_any_instance_of(Chef::Provider::Execute).not_to receive(:shell_out_compacted!).with(*apt_update_cmd, anything())
         provider.run_action(:periodic)
         expect(new_resource).to_not be_updated_by_last_action
       end
diff --git a/spec/unit/provider/cron/unix_spec.rb b/spec/unit/provider/cron/unix_spec.rb
index c77b0e0528..c8ef82e37a 100644
--- a/spec/unit/provider/cron/unix_spec.rb
+++ b/spec/unit/provider/cron/unix_spec.rb
@@ -66,12 +66,12 @@ describe Chef::Provider::Cron::Unix do
     before do
       allow(logger).to receive(:trace)
       allow(shell_out).to receive(:format_for_exception).and_return("formatted command output")
-      allow(provider).to receive(:shell_out).with("/usr/bin/crontab -l", user: username).and_return(shell_out)
+      allow(provider).to receive(:shell_out_compacted).with("/usr/bin/crontab", "-l", user: username).and_return(shell_out)
     end
 
     it "should call crontab -l with the user" do
       provider.send(:read_crontab)
-      expect(provider).to have_received(:shell_out).with("/usr/bin/crontab -l", user: username)
+      expect(provider).to have_received(:shell_out_compacted).with("/usr/bin/crontab", "-l", user: username)
     end
 
     it "should return the contents of the crontab" do
@@ -119,12 +119,12 @@ describe Chef::Provider::Cron::Unix do
       expect(tempfile).to receive(:chmod).with(420)
       expect(tempfile).to receive(:close!)
       allow(tempfile).to receive(:<<)
-      allow(provider).to receive(:shell_out).with("/usr/bin/crontab #{tempfile.path}", user: username).and_return(shell_out)
+      allow(provider).to receive(:shell_out_compacted).with("/usr/bin/crontab", tempfile.path, user: username).and_return(shell_out)
     end
 
     it "should call crontab for the user" do
       provider.send(:write_crontab, "Foo")
-      expect(provider).to have_received(:shell_out).with("/usr/bin/crontab #{tempfile.path}", user: username)
+      expect(provider).to have_received(:shell_out_compacted).with("/usr/bin/crontab", tempfile.path, user: username)
     end
 
     it "should call crontab with a file containing the crontab" do
diff --git a/spec/unit/provider/ifconfig_spec.rb b/spec/unit/provider/ifconfig_spec.rb
index 0b8db90428..8c63a3e46e 100644
--- a/spec/unit/provider/ifconfig_spec.rb
+++ b/spec/unit/provider/ifconfig_spec.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Prajakta Purohit (prajakta@chef.io)
-# Copyright:: Copyright 2008-2016, Chef Software Inc.
+# Copyright:: Copyright 2008-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -50,7 +50,7 @@ EOS
       ifconfig = double(stdout: "", exitstatus: 1)
       allow(@provider).to receive(:shell_out_compacted).and_return(ifconfig)
       ifconfig_version = double(stdout: "", stderr: net_tools_version, exitstatus: 4)
-      allow(@provider).to receive(:shell_out_compacted).with("ifconfig --version").and_return(ifconfig_version)
+      allow(@provider).to receive(:shell_out_compacted).with("ifconfig", "--version").and_return(ifconfig_version)
       @provider.load_current_resource
     end
     it "should track state of ifconfig failure" do
diff --git a/spec/unit/provider/mdadm_spec.rb b/spec/unit/provider/mdadm_spec.rb
index 17824c4fb8..d79c1b35db 100644
--- a/spec/unit/provider/mdadm_spec.rb
+++ b/spec/unit/provider/mdadm_spec.rb
@@ -39,13 +39,13 @@ describe Chef::Provider::Mdadm do
     end
 
     it "determines that the metadevice exists when mdadm exit code is zero" do
-      allow(@provider).to receive(:shell_out!).with("mdadm --detail --test /dev/md1", returns: [0, 4]).and_return(OpenStruct.new(status: 0))
+      allow(@provider).to receive(:shell_out_compacted!).with("mdadm", "--detail", "--test", "/dev/md1", returns: [0, 4]).and_return(OpenStruct.new(status: 0))
       @provider.load_current_resource
       expect(@provider.current_resource.exists).to be_truthy
     end
 
     it "determines that the metadevice does not exist when mdadm exit code is 4" do
-      allow(@provider).to receive(:shell_out!).with("mdadm --detail --test /dev/md1", returns: [0, 4]).and_return(OpenStruct.new(status: 4))
+      allow(@provider).to receive(:shell_out_compacted!).with("mdadm", "--detail", "--test", "/dev/md1", returns: [0, 4]).and_return(OpenStruct.new(status: 4))
       @provider.load_current_resource
       expect(@provider.current_resource.exists).to be_falsey
     end
diff --git a/spec/unit/provider/mount/aix_spec.rb b/spec/unit/provider/mount/aix_spec.rb
index 80a83130e9..b472e60710 100644
--- a/spec/unit/provider/mount/aix_spec.rb
+++ b/spec/unit/provider/mount/aix_spec.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Kaustubh Deorukhkar (<kaustubh@clogeny.com>)
-# Copyright:: Copyright 2013-2016, Chef Software Inc.
+# Copyright:: Copyright 2013-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -71,12 +71,12 @@ WRONG
 
   def stub_mounted(provider, mounted_output)
     response = double("Mixlib::ShellOut command", exitstatus: 0, stdout: mounted_output, stderr: "")
-    expect(provider).to receive(:shell_out!).with("mount").and_return(response)
+    expect(provider).to receive(:shell_out_compacted!).with("mount").and_return(response)
   end
 
   def stub_enabled(provider, enabled_output)
     response = double("Mixlib::ShellOut command", exitstatus: 0, stdout: enabled_output, stderr: "")
-    expect(provider).to receive(:shell_out).with("lsfs -c #{@new_resource.mount_point}").and_return(response)
+    expect(provider).to receive(:shell_out_compacted).with("lsfs", "-c", @new_resource.mount_point).and_return(response)
   end
 
   def stub_mounted_enabled(provider, mounted_output, enabled_output)
@@ -145,7 +145,7 @@ WRONG
     it "should mount resource if it is not mounted" do
       stub_mounted_enabled(@provider, @unmounted_output, "")
 
-      expect(@provider).to receive(:shell_out!).with("mount -v #{@new_resource.fstype} #{@new_resource.device} #{@new_resource.mount_point}")
+      expect(@provider).to receive(:shell_out_compacted!).with("mount", "-v", @new_resource.fstype, @new_resource.device, @new_resource.mount_point)
 
       @provider.run_action(:mount)
     end
@@ -163,7 +163,7 @@ WRONG
     it "should umount resource if it is already mounted" do
       stub_mounted_enabled(@provider, @mounted_output, "")
 
-      expect(@provider).to receive(:shell_out!).with("umount #{@new_resource.mount_point}")
+      expect(@provider).to receive(:shell_out_compacted!).with("umount", @new_resource.mount_point)
 
       @provider.run_action(:umount)
     end
@@ -182,7 +182,7 @@ WRONG
       @new_resource.supports({ remount: true })
       stub_mounted_enabled(@provider, @mounted_output, "")
 
-      expect(@provider).to receive(:shell_out!).with("mount -o remount #{@new_resource.device} #{@new_resource.mount_point}")
+      expect(@provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount", @new_resource.device, @new_resource.mount_point)
 
       @provider.run_action(:remount)
     end
@@ -192,7 +192,7 @@ WRONG
       @new_resource.options("nodev,rw")
       stub_mounted_enabled(@provider, @mounted_output, "")
 
-      expect(@provider).to receive(:shell_out!).with("mount -o remount,nodev,rw #{@new_resource.device} #{@new_resource.mount_point}")
+      expect(@provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount,nodev,rw", @new_resource.device, @new_resource.mount_point)
 
       @provider.run_action(:remount)
     end
diff --git a/spec/unit/provider/mount/mount_spec.rb b/spec/unit/provider/mount/mount_spec.rb
index 562dbcdc5d..2af3c93fc9 100644
--- a/spec/unit/provider/mount/mount_spec.rb
+++ b/spec/unit/provider/mount/mount_spec.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Joshua Timberman (<joshua@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software Inc.
+# Copyright:: Copyright 2008-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -42,7 +42,7 @@ describe Chef::Provider::Mount::Mount do
 
   describe "when discovering the current fs state" do
     before do
-      allow(@provider).to receive(:shell_out!).and_return(OpenStruct.new(stdout: ""))
+      allow(@provider).to receive(:shell_out_compacted!).and_return(OpenStruct.new(stdout: ""))
       allow(::File).to receive(:foreach).with("/etc/fstab")
     end
 
@@ -58,7 +58,7 @@ describe Chef::Provider::Mount::Mount do
       @new_resource.device_type :uuid
       @new_resource.device "d21afe51-a0fe-4dc6-9152-ac733763ae0a"
       @stdout_findfs = double("STDOUT", first: "/dev/sdz1")
-      expect(@provider).to receive(:shell_out).with("/sbin/findfs UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(@status)
+      expect(@provider).to receive(:shell_out_compacted).with("/sbin/findfs", "UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(@status)
       @provider.load_current_resource
       @provider.mountable?
     end
@@ -97,7 +97,7 @@ describe Chef::Provider::Mount::Mount do
       status = double(stdout: "", exitstatus: 1)
       @new_resource.device_type :uuid
       @new_resource.device "d21afe51-a0fe-4dc6-9152-ac733763ae0a"
-      expect(@provider).to receive(:shell_out).with("/sbin/findfs UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(status)
+      expect(@provider).to receive(:shell_out_compacted).with("/sbin/findfs", "UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(status)
       expect(::File).to receive(:exists?).with("").and_return(false)
       expect { @provider.load_current_resource(); @provider.mountable? }.to raise_error(Chef::Exceptions::Mount)
     end
@@ -295,14 +295,14 @@ describe Chef::Provider::Mount::Mount do
 
     describe "mount_fs" do
       it "should mount the filesystem if it is not mounted" do
-        expect(@provider).to receive(:shell_out!).with("mount -t ext3 -o defaults /dev/sdz1 /tmp/foo")
+        expect(@provider).to receive(:shell_out_compacted!).with("mount", "-t", "ext3", "-o", "defaults", "/dev/sdz1", "/tmp/foo")
         @provider.mount_fs()
       end
 
       it "should mount the filesystem with options if options were passed" do
         options = "rw,noexec,noauto"
         @new_resource.options(%w{rw noexec noauto})
-        expect(@provider).to receive(:shell_out!).with("mount -t ext3 -o rw,noexec,noauto /dev/sdz1 /tmp/foo")
+        expect(@provider).to receive(:shell_out_compacted!).with("mount", "-t", "ext3", "-o", "rw,noexec,noauto", "/dev/sdz1", "/tmp/foo")
         @provider.mount_fs()
       end
 
@@ -310,10 +310,10 @@ describe Chef::Provider::Mount::Mount do
         status = double(stdout: "/dev/sdz1\n", exitstatus: 1)
         @new_resource.device "d21afe51-a0fe-4dc6-9152-ac733763ae0a"
         @new_resource.device_type :uuid
-        allow(@provider).to receive(:shell_out).with("/sbin/findfs UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(status)
+        allow(@provider).to receive(:shell_out_compacted).with("/sbin/findfs", "UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(status)
         @stdout_mock = double("stdout mock")
         allow(@stdout_mock).to receive(:each).and_yield("#{@new_resource.device} on #{@new_resource.mount_point}")
-        expect(@provider).to receive(:shell_out!).with("mount -t #{@new_resource.fstype} -o defaults -U #{@new_resource.device} #{@new_resource.mount_point}").and_return(@stdout_mock)
+        expect(@provider).to receive(:shell_out_compacted!).with("mount", "-t", @new_resource.fstype, "-o", "defaults", "-U", @new_resource.device, @new_resource.mount_point).and_return(@stdout_mock)
         @provider.mount_fs()
       end
 
@@ -328,7 +328,7 @@ describe Chef::Provider::Mount::Mount do
     describe "umount_fs" do
       it "should umount the filesystem if it is mounted" do
         @current_resource.mounted(true)
-        expect(@provider).to receive(:shell_out!).with("umount /tmp/foo")
+        expect(@provider).to receive(:shell_out!).with("umount", "/tmp/foo")
         @provider.umount_fs()
       end
 
@@ -343,7 +343,7 @@ describe Chef::Provider::Mount::Mount do
       it "should use mount -o remount if remount is supported" do
         @new_resource.supports({ remount: true })
         @current_resource.mounted(true)
-        expect(@provider).to receive(:shell_out!).with("mount -o remount,defaults #{@new_resource.mount_point}")
+        expect(@provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount,defaults", @new_resource.mount_point)
         @provider.remount_fs
       end
 
@@ -352,7 +352,7 @@ describe Chef::Provider::Mount::Mount do
         options = "rw,noexec,noauto"
         @new_resource.options(%w{rw noexec noauto})
         @current_resource.mounted(true)
-        expect(@provider).to receive(:shell_out!).with("mount -o remount,rw,noexec,noauto #{@new_resource.mount_point}")
+        expect(@provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount,rw,noexec,noauto", @new_resource.mount_point)
         @provider.remount_fs
       end
 
@@ -500,7 +500,7 @@ describe Chef::Provider::Mount::Mount do
       it "should update the existing line" do
         @current_resource.enabled(true)
         status = double(stdout: "/dev/sdz1\n", exitstatus: 1)
-        expect(@provider).to receive(:shell_out).with("/sbin/findfs UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(status)
+        expect(@provider).to receive(:shell_out_compacted).with("/sbin/findfs", "UUID=d21afe51-a0fe-4dc6-9152-ac733763ae0a").and_return(status)
 
         filesystems = [%q{/dev/sdy1 /tmp/foo  ext3  defaults  1 2},
                       %q{/dev/sdz1 /tmp/foo  ext3  defaults  1 2}].join("\n")
diff --git a/spec/unit/provider/mount/solaris_spec.rb b/spec/unit/provider/mount/solaris_spec.rb
index e489b9001a..4e73bc77b5 100644
--- a/spec/unit/provider/mount/solaris_spec.rb
+++ b/spec/unit/provider/mount/solaris_spec.rb
@@ -1,6 +1,6 @@
 #
 # Author:: Lamont Granquist (<lamont@chef.io>)
-# Copyright:: Copyright 2008-2016, Chef Software, Inc.
+# Copyright:: Copyright 2008-2018, Chef Software Inc.
 # License:: Apache License, Version 2.0
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
@@ -57,22 +57,22 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
   end
 
   let(:vfstab_file_contents) do
-    <<-EOF.gsub /^\s*/, ""
-    #device         device          mount           FS      fsck    mount   mount
-    #to mount       to fsck         point           type    pass    at boot options
-    #
-    fd      -       /dev/fd fd      -       no      -
-    /proc   -       /proc   proc    -       no      -
-    # swap
-    /dev/dsk/c0t0d0s1       -       -       swap    -       no      -
-    # root
-    /dev/dsk/c0t0d0s0       /dev/rdsk/c0t0d0s0      /       ufs     1       no      -
-    # tmpfs
-    swap    -       /tmp    tmpfs   -       yes     -
-    # nfs
-    cartman:/share2         -                       /cartman        nfs     -       yes     rw,soft
-    # ufs
-    /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+    <<~EOF
+      #device         device          mount           FS      fsck    mount   mount
+      #to mount       to fsck         point           type    pass    at boot options
+      #
+      fd      -       /dev/fd fd      -       no      -
+      /proc   -       /proc   proc    -       no      -
+      # swap
+      /dev/dsk/c0t0d0s1       -       -       swap    -       no      -
+      # root
+      /dev/dsk/c0t0d0s0       /dev/rdsk/c0t0d0s0      /       ufs     1       no      -
+      # tmpfs
+      swap    -       /tmp    tmpfs   -       yes     -
+      # nfs
+      cartman:/share2         -                       /cartman        nfs     -       yes     rw,soft
+      # ufs
+      /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
     EOF
   end
 
@@ -84,15 +84,15 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
   end
 
   let(:mount_output) do
-    <<-EOF.gsub /^\s*/, ""
-    /dev/dsk/c0t0d0s0 on / type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200000 on Tue Jul 31 22:34:46 2012
-    /dev/dsk/c0t2d0s7 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+    <<~EOF
+      /dev/dsk/c0t0d0s0 on / type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200000 on Tue Jul 31 22:34:46 2012
+      /dev/dsk/c0t2d0s7 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
     EOF
   end
 
   before do
     stub_const("Chef::Provider::Mount::Solaris::VFSTAB", vfstab_file.path )
-    allow(provider).to receive(:shell_out!).with("mount -v").and_return(OpenStruct.new(stdout: mount_output))
+    allow(provider).to receive(:shell_out_compacted!).with("mount", "-v").and_return(OpenStruct.new(stdout: mount_output))
     allow(File).to receive(:symlink?).with(device).and_return(false)
     allow(File).to receive(:exist?).and_call_original # Tempfile.open on ruby 1.8.7 calls File.exist?
     allow(File).to receive(:exist?).with(device).and_return(true)
@@ -215,22 +215,22 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
     context "when loading a normal UFS filesystem with noauto, don't mount at boot" do
 
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        #device         device          mount           FS      fsck    mount   mount
-        #to mount       to fsck         point           type    pass    at boot options
-        #
-        fd      -       /dev/fd fd      -       no      -
-        /proc   -       /proc   proc    -       no      -
-        # swap
-        /dev/dsk/c0t0d0s1       -       -       swap    -       no      -
-        # root
-        /dev/dsk/c0t0d0s0       /dev/rdsk/c0t0d0s0      /       ufs     1       no      -
-        # tmpfs
-        swap    -       /tmp    tmpfs   -       yes     -
-        # nfs
-        cartman:/share2         -                       /cartman        nfs     -       yes     rw,soft
-        # ufs
-        /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       no     -
+        <<~EOF
+          #device         device          mount           FS      fsck    mount   mount
+          #to mount       to fsck         point           type    pass    at boot options
+          #
+          fd      -       /dev/fd fd      -       no      -
+          /proc   -       /proc   proc    -       no      -
+          # swap
+          /dev/dsk/c0t0d0s1       -       -       swap    -       no      -
+          # root
+          /dev/dsk/c0t0d0s0       /dev/rdsk/c0t0d0s0      /       ufs     1       no      -
+          # tmpfs
+          swap    -       /tmp    tmpfs   -       yes     -
+          # nfs
+          cartman:/share2         -                       /cartman        nfs     -       yes     rw,soft
+          # ufs
+          /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       no     -
         EOF
       end
 
@@ -245,13 +245,13 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the device is an smbfs mount" do
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        //solarsystem/tmp on /mnt type smbfs read/write/setuid/devices/dev=5080000 on Tue Mar 29 11:40:18 2011
+        <<~EOF
+          //solarsystem/tmp on /mnt type smbfs read/write/setuid/devices/dev=5080000 on Tue Mar 29 11:40:18 2011
         EOF
       end
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        //WORKGROUP;username:password@host/share    -   /mountpoint smbfs   -   no  fileperms=0777,dirperms=0777
+        <<~EOF
+          //WORKGROUP;username:password@host/share    -   /mountpoint smbfs   -   no  fileperms=0777,dirperms=0777
         EOF
       end
 
@@ -264,14 +264,14 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the device is an NFS mount" do
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        cartman:/share2 on /cartman type nfs rsize=32768,wsize=32768,NFSv4,dev=4000004 on Tue Mar 29 11:40:18 2011
+        <<~EOF
+          cartman:/share2 on /cartman type nfs rsize=32768,wsize=32768,NFSv4,dev=4000004 on Tue Mar 29 11:40:18 2011
         EOF
       end
 
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        cartman:/share2         -                       /cartman        nfs     -       yes     rw,soft
+        <<~EOF
+          cartman:/share2         -                       /cartman        nfs     -       yes     rw,soft
         EOF
       end
 
@@ -335,14 +335,14 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
       let(:target) { "/dev/mapper/target" }
 
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        #{target} on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+        <<~EOF
+          #{target} on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
         EOF
       end
 
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        #{target}       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+        <<~EOF
+          #{target}       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
         EOF
       end
 
@@ -372,14 +372,14 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
       let(:absolute_target) { File.expand_path(target, File.dirname(device)) }
 
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        #{absolute_target} on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+        <<~EOF
+          #{absolute_target} on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
         EOF
       end
 
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        #{absolute_target}       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+        <<~EOF
+          #{absolute_target}       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
         EOF
       end
 
@@ -405,9 +405,9 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the matching mount point is last in the mounts list" do
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t0d0s0 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200000 on Tue Jul 31 22:34:46 2012
-        /dev/dsk/c0t2d0s7 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+        <<~EOF
+          /dev/dsk/c0t0d0s0 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200000 on Tue Jul 31 22:34:46 2012
+          /dev/dsk/c0t2d0s7 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
         EOF
       end
       it "should set mounted true" do
@@ -418,9 +418,9 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the matching mount point is not last in the mounts list" do
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s7 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
-        /dev/dsk/c0t0d0s0 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200000 on Tue Jul 31 22:34:46 2012
+        <<~EOF
+          /dev/dsk/c0t2d0s7 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+          /dev/dsk/c0t0d0s0 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200000 on Tue Jul 31 22:34:46 2012
         EOF
       end
       it "should set mounted false" do
@@ -431,8 +431,8 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the matching mount point is not in the mounts list (mountpoint wrong)" do
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s7 on /mnt/foob type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+        <<~EOF
+          /dev/dsk/c0t2d0s7 on /mnt/foob type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
         EOF
       end
       it "should set mounted false" do
@@ -443,8 +443,8 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the matching mount point is not in the mounts list (raw device wrong)" do
       let(:mount_output) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s72 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
+        <<~EOF
+          /dev/dsk/c0t2d0s72 on /mnt/foo type ufs read/write/setuid/intr/largefiles/xattr/onerror=panic/dev=2200007 on Tue Jul 31 22:34:46 2012
         EOF
       end
       it "should set mounted false" do
@@ -455,9 +455,9 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the mount point is last in fstab" do
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
-        /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+        <<~EOF
+          /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+          /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
         EOF
       end
 
@@ -469,9 +469,9 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the mount point is not last in fstab and is a substring of another mount" do
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
-        /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s7      /mnt/foo/bar            ufs     2       yes     -
+        <<~EOF
+          /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+          /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s7      /mnt/foo/bar            ufs     2       yes     -
         EOF
       end
 
@@ -483,9 +483,9 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the mount point is not last in fstab" do
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
-        /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s72      /mnt/foo            ufs     2       yes     -
+        <<~EOF
+          /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+          /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s72      /mnt/foo            ufs     2       yes     -
         EOF
       end
 
@@ -497,8 +497,8 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the mount point is not in fstab, but the mountpoint is a substring of one that is" do
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foob            ufs     2       yes     -
+        <<~EOF
+          /dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foob            ufs     2       yes     -
         EOF
       end
 
@@ -510,8 +510,8 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the mount point is not in fstab, but the device is a substring of one that is" do
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+        <<~EOF
+          /dev/dsk/c0t2d0s72       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
         EOF
       end
 
@@ -523,8 +523,8 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
 
     context "when the mountpoint line is commented out" do
       let(:vfstab_file_contents) do
-        <<-EOF.gsub /^\s*/, ""
-        #/dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
+        <<~EOF
+          #/dev/dsk/c0t2d0s7       /dev/rdsk/c0t2d0s7      /mnt/foo            ufs     2       yes     -
         EOF
       end
 
@@ -538,28 +538,28 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
   context "after the mount's state has been discovered" do
     describe "mount_fs" do
       it "should mount the filesystem" do
-        expect(provider).to receive(:shell_out!).with("mount -F #{fstype} #{device} #{mountpoint}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-F", fstype, device, mountpoint)
         provider.mount_fs()
       end
 
       it "should mount the filesystem with options if options were passed" do
         options = "logging,noatime,largefiles,nosuid,rw,quota"
         new_resource.options(options.split(/,/))
-        expect(provider).to receive(:shell_out!).with("mount -F #{fstype} -o #{options} #{device} #{mountpoint}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-F", fstype, "-o", options, device, mountpoint)
         provider.mount_fs()
       end
 
       it "should delete the 'noauto' magic option" do
         options = "rw,noauto"
         new_resource.options(%w{rw noauto})
-        expect(provider).to receive(:shell_out!).with("mount -F #{fstype} -o rw #{device} #{mountpoint}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-F", fstype, "-o", "rw", device, mountpoint)
         provider.mount_fs()
       end
     end
 
     describe "umount_fs" do
       it "should umount the filesystem if it is mounted" do
-        expect(provider).to receive(:shell_out!).with("umount #{mountpoint}")
+        expect(provider).to receive(:shell_out_compacted!).with("umount", mountpoint)
         provider.umount_fs()
       end
     end
@@ -567,7 +567,7 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
     describe "remount_fs without options and do not mount at boot" do
       it "should use mount -o remount" do
         new_resource.options(%w{noauto})
-        expect(provider).to receive(:shell_out!).with("mount -o remount #{new_resource.mount_point}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount", new_resource.mount_point)
         provider.remount_fs
       end
     end
@@ -575,7 +575,7 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
     describe "remount_fs with options and do not mount at boot" do
       it "should use mount -o remount,rw" do
         new_resource.options(%w{rw noauto})
-        expect(provider).to receive(:shell_out!).with("mount -o remount,rw #{new_resource.mount_point}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount,rw", new_resource.mount_point)
         provider.remount_fs
       end
     end
@@ -583,7 +583,7 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
     describe "remount_fs with options and mount at boot" do
       it "should use mount -o remount,rw" do
         new_resource.options(%w{rw})
-        expect(provider).to receive(:shell_out!).with("mount -o remount,rw #{new_resource.mount_point}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount,rw", new_resource.mount_point)
         provider.remount_fs
       end
     end
@@ -591,7 +591,7 @@ describe Chef::Provider::Mount::Solaris, :unix_only do
     describe "remount_fs without options and mount at boot" do
       it "should use mount -o remount" do
         new_resource.options([])
-        expect(provider).to receive(:shell_out!).with("mount -o remount #{new_resource.mount_point}")
+        expect(provider).to receive(:shell_out_compacted!).with("mount", "-o", "remount", new_resource.mount_point)
         provider.remount_fs
       end
     end
diff --git a/spec/unit/provider/osx_profile_spec.rb b/spec/unit/provider/osx_profile_spec.rb
index dce52fd598..624ef8cca9 100644
--- a/spec/unit/provider/osx_profile_spec.rb
+++ b/spec/unit/provider/osx_profile_spec.rb
@@ -116,7 +116,7 @@ describe Chef::Provider::OsxProfile do
       allow(provider).to receive(:generate_tempfile).and_return(tempfile)
       allow(provider).to receive(:get_installed_profiles).and_call_original
       allow(provider).to receive(:read_plist).and_return(all_profiles)
-      expect(provider).to receive(:shell_out!).with("profiles -P -o '/tmp/allprofiles.plist'")
+      expect(provider).to receive(:shell_out_compacted!).with("profiles", "-P", "-o", "/tmp/allprofiles.plist")
       provider.load_current_resource
     end
 
@@ -164,7 +164,7 @@ describe Chef::Provider::OsxProfile do
       all_profiles["_computerlevel"][1]["ProfileUUID"] = "1781fbec-3325-565f-9022-9bb39245d4dd"
       provider.load_current_resource
       allow(provider).to receive(:write_profile_to_disk).and_return(profile_path)
-      expect(provider).to receive(:shell_out).with("profiles -I -F '#{profile_path}'").and_return(shell_out_success)
+      expect(provider).to receive(:shell_out_compacted).with("profiles", "-I", "-F", profile_path).and_return(shell_out_success)
       provider.action_install()
     end
 
@@ -248,7 +248,7 @@ describe Chef::Provider::OsxProfile do
       new_resource.identifier "com.testprofile.screensaver"
       new_resource.action(:remove)
       provider.load_current_resource
-      expect(provider).to receive(:shell_out).with("profiles -R -p '#{new_resource.identifier}'").and_return(shell_out_success)
+      expect(provider).to receive(:shell_out_compacted).with("profiles", "-R", "-p", new_resource.identifier).and_return(shell_out_success)
       provider.action_remove()
     end
   end
diff --git a/spec/unit/provider/systemd_unit_spec.rb b/spec/unit/provider/systemd_unit_spec.rb
index 93f624933f..00f39d0fd9 100644
--- a/spec/unit/provider/systemd_unit_spec.rb
+++ b/spec/unit/provider/systemd_unit_spec.rb
@@ -24,7 +24,6 @@ describe Chef::Provider::SystemdUnit do
   let(:events) { Chef::EventDispatch::Dispatcher.new }
   let(:run_context) { Chef::RunContext.new(node, {}, events) }
   let(:unit_name) { "sysstat-collect\\x2d.timer" }
-  let(:unit_name_escaped) { "sysstat-collect\\\\x2d.timer" }
   let(:user_name) { "joe" }
   let(:current_resource) { Chef::Resource::SystemdUnit.new(unit_name) }
   let(:new_resource) { Chef::Resource::SystemdUnit.new(unit_name) }
@@ -285,9 +284,9 @@ describe Chef::Provider::SystemdUnit do
             new_resource.user("joe")
             allow(provider).to receive(:manage_unit_file).with(:create)
             expect(new_resource.triggers_reload).to eq true
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user daemon-reload", **user_cmd_opts, default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "daemon-reload", **user_cmd_opts, default_env: false)
             provider.action_create
           end
 
@@ -298,9 +297,9 @@ describe Chef::Provider::SystemdUnit do
                              .and_return(true)
             allow(provider).to receive(:manage_unit_file).with(:delete)
             expect(new_resource.triggers_reload).to eq true
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user daemon-reload", **user_cmd_opts, default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "daemon-reload", **user_cmd_opts, default_env: false)
             provider.action_delete
           end
 
@@ -308,9 +307,9 @@ describe Chef::Provider::SystemdUnit do
             new_resource.user("joe")
             new_resource.triggers_reload(false)
             allow(provider).to receive(:manage_unit_file).with(:create)
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to_not receive(:shell_out!)
-                                      .with("#{systemctl_path} --user daemon-reload", **user_cmd_opts, default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to_not receive(:shell_out_compacted!)
+                                      .with(systemctl_path, "--user", "daemon-reload", **user_cmd_opts, default_env: false)
             provider.action_create
           end
 
@@ -321,9 +320,9 @@ describe Chef::Provider::SystemdUnit do
                              .with(unit_path_user)
                              .and_return(true)
             allow(provider).to receive(:manage_unit_file).with(:delete)
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to_not receive(:shell_out!)
-                                      .with("#{systemctl_path} --user daemon-reload", **user_cmd_opts, default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to_not receive(:shell_out_compacted!)
+                                      .with(systemctl_path, "--user", "daemon-reload", **user_cmd_opts, default_env: false)
             provider.action_delete
           end
 
@@ -352,16 +351,16 @@ describe Chef::Provider::SystemdUnit do
 
           it "presets the unit" do
             new_resource.user("joe")
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user preset #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "preset", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_preset
           end
 
           it "reverts the unit" do
             new_resource.user("joe")
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user revert #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "revert", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_revert
           end
@@ -371,9 +370,9 @@ describe Chef::Provider::SystemdUnit do
           it "triggers a daemon-reload when creating a unit with triggers_reload" do
             allow(provider).to receive(:manage_unit_file).with(:create)
             expect(new_resource.triggers_reload).to eq true
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system daemon-reload", default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "daemon-reload", default_env: false)
             provider.action_create
           end
 
@@ -383,18 +382,18 @@ describe Chef::Provider::SystemdUnit do
                              .and_return(true)
             allow(provider).to receive(:manage_unit_file).with(:delete)
             expect(new_resource.triggers_reload).to eq true
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system daemon-reload", default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "daemon-reload", default_env: false)
             provider.action_delete
           end
 
           it "does not trigger a daemon-reload when creating a unit without triggers_reload" do
             new_resource.triggers_reload(false)
             allow(provider).to receive(:manage_unit_file).with(:create)
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to_not receive(:shell_out!)
-                                      .with("#{systemctl_path} --system daemon-reload", default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to_not receive(:shell_out_compacted!)
+                                      .with(systemctl_path, "--system", "daemon-reload", default_env: false)
             provider.action_create
           end
 
@@ -404,9 +403,9 @@ describe Chef::Provider::SystemdUnit do
                              .with(unit_path_system)
                              .and_return(true)
             allow(provider).to receive(:manage_unit_file).with(:delete)
-            allow(provider).to receive(:shell_out!)
-            expect(provider).to_not receive(:shell_out!)
-                                      .with("#{systemctl_path} --system daemon-reload", default_env: false)
+            allow(provider).to receive(:shell_out_compacted!)
+            expect(provider).to_not receive(:shell_out_compacted!)
+                                      .with(systemctl_path, "--system", "daemon-reload", default_env: false)
             provider.action_delete
           end
           it "deletes the file when it exists" do
@@ -431,15 +430,15 @@ describe Chef::Provider::SystemdUnit do
           end
 
           it "presets the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system preset #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "preset", unit_name)
                                   .and_return(shell_out_success)
             provider.action_preset
           end
 
           it "reverts the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system revert #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "revert", unit_name)
                                   .and_return(shell_out_success)
             provider.action_revert
           end
@@ -450,8 +449,8 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "reenables the unit" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user reenable #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "reenable", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_reenable
           end
@@ -459,8 +458,8 @@ describe Chef::Provider::SystemdUnit do
           it "enables the unit when it is disabled" do
             current_resource.user(user_name)
             current_resource.enabled(false)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user enable #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "enable", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_enable
           end
@@ -468,22 +467,22 @@ describe Chef::Provider::SystemdUnit do
           it "does not enable the unit when it is enabled" do
             current_resource.user(user_name)
             current_resource.enabled(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_enable
           end
 
           it "does not enable the unit when it is static" do
             current_resource.user(user_name)
             current_resource.static(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_enable
           end
 
           it "disables the unit when it is enabled" do
             current_resource.user(user_name)
             current_resource.enabled(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user disable #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "disable", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_disable
           end
@@ -491,64 +490,64 @@ describe Chef::Provider::SystemdUnit do
           it "does not disable the unit when it is disabled" do
             current_resource.user(user_name)
             current_resource.enabled(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_disable
           end
 
           it "does not disable the unit when it is static" do
             current_resource.user(user_name)
             current_resource.static(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_disable
           end
         end
 
         context "when no user is specified" do
           it "reenables the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system reenable #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "reenable", unit_name)
                                   .and_return(shell_out_success)
             provider.action_reenable
           end
 
           it "enables the unit when it is disabled" do
             current_resource.enabled(false)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system enable #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "enable", unit_name)
                                   .and_return(shell_out_success)
             provider.action_enable
           end
 
           it "does not enable the unit when it is enabled" do
             current_resource.enabled(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_enable
           end
 
           it "does not enable the unit when it is static" do
             current_resource.static(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_enable
           end
 
           it "disables the unit when it is enabled" do
             current_resource.enabled(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system disable #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "disable", unit_name)
                                   .and_return(shell_out_success)
             provider.action_disable
           end
 
           it "does not disable the unit when it is disabled" do
             current_resource.enabled(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_disable
           end
 
           it "does not disable the unit when it is static" do
             current_resource.user(user_name)
             current_resource.static(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_disable
           end
         end
@@ -559,8 +558,8 @@ describe Chef::Provider::SystemdUnit do
           it "masks the unit when it is unmasked" do
             current_resource.user(user_name)
             current_resource.masked(false)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user mask #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "mask", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_mask
           end
@@ -568,15 +567,15 @@ describe Chef::Provider::SystemdUnit do
           it "does not mask the unit when it is masked" do
             current_resource.user(user_name)
             current_resource.masked(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_mask
           end
 
           it "unmasks the unit when it is masked" do
             current_resource.user(user_name)
             current_resource.masked(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user unmask #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "unmask", unit_name, **user_cmd_opts)
                                   .and_return(shell_out_success)
             provider.action_unmask
           end
@@ -584,7 +583,7 @@ describe Chef::Provider::SystemdUnit do
           it "does not unmask the unit when it is unmasked" do
             current_resource.user(user_name)
             current_resource.masked(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_unmask
           end
         end
@@ -592,29 +591,29 @@ describe Chef::Provider::SystemdUnit do
         context "when no user is specified" do
           it "masks the unit when it is unmasked" do
             current_resource.masked(false)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system mask #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "mask", unit_name)
                                   .and_return(shell_out_success)
             provider.action_mask
           end
 
           it "does not mask the unit when it is masked" do
             current_resource.masked(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_mask
           end
 
           it "unmasks the unit when it is masked" do
             current_resource.masked(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system unmask #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "unmask", unit_name)
                                   .and_return(shell_out_success)
             provider.action_unmask
           end
 
           it "does not unmask the unit when it is unmasked" do
             current_resource.masked(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_unmask
           end
         end
@@ -625,8 +624,8 @@ describe Chef::Provider::SystemdUnit do
           it "starts the unit when it is inactive" do
             current_resource.user(user_name)
             current_resource.active(false)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user start #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "start", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_start
           end
@@ -634,15 +633,15 @@ describe Chef::Provider::SystemdUnit do
           it "does not start the unit when it is active" do
             current_resource.user(user_name)
             current_resource.active(true)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_start
           end
 
           it "stops the unit when it is active" do
             current_resource.user(user_name)
             current_resource.active(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user stop #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "stop", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_stop
           end
@@ -650,7 +649,7 @@ describe Chef::Provider::SystemdUnit do
           it "does not stop the unit when it is inactive" do
             current_resource.user(user_name)
             current_resource.active(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_stop
           end
         end
@@ -658,29 +657,29 @@ describe Chef::Provider::SystemdUnit do
         context "when no user is specified" do
           it "starts the unit when it is inactive" do
             current_resource.active(false)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system start #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "start", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_start
           end
 
           it "does not start the unit when it is active" do
             current_resource.active(true)
-            expect(provider).to_not receive(:shell_out!)
+            expect(provider).to_not receive(:shell_out_compacted!)
             provider.action_start
           end
 
           it "stops the unit when it is active" do
             current_resource.active(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system stop #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "stop", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_stop
           end
 
           it "does not stop the unit when it is inactive" do
             current_resource.active(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_stop
           end
         end
@@ -690,8 +689,8 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "restarts the unit" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user restart #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "restart", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_restart
           end
@@ -699,8 +698,8 @@ describe Chef::Provider::SystemdUnit do
           it "reloads the unit if active" do
             current_resource.user(user_name)
             current_resource.active(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user reload #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "reload", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_reload
           end
@@ -708,30 +707,30 @@ describe Chef::Provider::SystemdUnit do
           it "does not reload if the unit is inactive" do
             current_resource.user(user_name)
             current_resource.active(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_reload
           end
         end
 
         context "when no user is specified" do
           it "restarts the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system restart #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "restart", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_restart
           end
 
           it "reloads the unit if active" do
             current_resource.active(true)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system reload #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "reload", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_reload
           end
 
           it "does not reload the unit if inactive" do
             current_resource.active(false)
-            expect(provider).not_to receive(:shell_out!)
+            expect(provider).not_to receive(:shell_out_compacted!)
             provider.action_reload
           end
         end
@@ -741,8 +740,8 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "try-restarts the unit" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user try-restart #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "try-restart", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_try_restart
           end
@@ -750,8 +749,8 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "try-restarts the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system try-restart #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "try-restart", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_try_restart
           end
@@ -762,8 +761,8 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "reload-or-restarts the unit" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user reload-or-restart #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "reload-or-restart", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_reload_or_restart
           end
@@ -771,8 +770,8 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "reload-or-restarts the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system reload-or-restart #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "reload-or-restart", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_reload_or_restart
           end
@@ -783,8 +782,8 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "reload-or-try-restarts the unit" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --user reload-or-try-restart #{unit_name_escaped}", **user_cmd_opts, default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--user", "reload-or-try-restart", unit_name, **user_cmd_opts, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_reload_or_try_restart
           end
@@ -792,8 +791,8 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "reload-or-try-restarts the unit" do
-            expect(provider).to receive(:shell_out!)
-                                  .with("#{systemctl_path} --system reload-or-try-restart #{unit_name_escaped}", default_env: false)
+            expect(provider).to receive(:shell_out_compacted!)
+                                  .with(systemctl_path, "--system", "reload-or-try-restart", unit_name, default_env: false)
                                   .and_return(shell_out_success)
             provider.action_reload_or_try_restart
           end
@@ -809,16 +808,16 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "returns true when unit is active" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user is-active #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "is-active", unit_name, user_cmd_opts)
                                   .and_return(shell_out_success)
             expect(provider.active?).to be true
           end
 
           it "returns false when unit is inactive" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user is-active #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "is-active", unit_name, user_cmd_opts)
                                   .and_return(shell_out_failure)
             expect(provider.active?).to be false
           end
@@ -826,15 +825,15 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "returns true when unit is active" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system is-active #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "is-active", unit_name)
                                   .and_return(shell_out_success)
             expect(provider.active?).to be true
           end
 
           it "returns false when unit is not active" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system is-active #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "is-active", unit_name)
                                   .and_return(shell_out_failure)
             expect(provider.active?).to be false
           end
@@ -850,16 +849,16 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "returns true when unit is enabled" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user is-enabled #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "is-enabled", unit_name, user_cmd_opts)
                                   .and_return(shell_out_success)
             expect(provider.enabled?).to be true
           end
 
           it "returns false when unit is not enabled" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user is-enabled #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "is-enabled", unit_name, user_cmd_opts)
                                   .and_return(shell_out_failure)
             expect(provider.enabled?).to be false
           end
@@ -867,15 +866,15 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "returns true when unit is enabled" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system is-enabled #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "is-enabled", unit_name)
                                   .and_return(shell_out_success)
             expect(provider.enabled?).to be true
           end
 
           it "returns false when unit is not enabled" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system is-enabled #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "is-enabled", unit_name)
                                   .and_return(shell_out_failure)
             expect(provider.enabled?).to be false
           end
@@ -891,16 +890,16 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "returns true when the unit is masked" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user status #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "status", unit_name, user_cmd_opts)
                                   .and_return(shell_out_masked)
             expect(provider.masked?).to be true
           end
 
           it "returns false when the unit is not masked" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user status #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "status", unit_name, user_cmd_opts)
                                   .and_return(shell_out_static)
             expect(provider.masked?).to be false
           end
@@ -908,15 +907,15 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "returns true when the unit is masked" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system status #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "status", unit_name)
                                   .and_return(shell_out_masked)
             expect(provider.masked?).to be true
           end
 
           it "returns false when the unit is not masked" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system status #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "status", unit_name)
                                   .and_return(shell_out_static)
             expect(provider.masked?).to be false
           end
@@ -932,16 +931,16 @@ describe Chef::Provider::SystemdUnit do
         context "when a user is specified" do
           it "returns true when the unit is static" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user is-enabled #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "is-enabled", unit_name, user_cmd_opts)
                                   .and_return(shell_out_static)
             expect(provider.static?).to be true
           end
 
           it "returns false when the unit is not static" do
             current_resource.user(user_name)
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --user is-enabled #{unit_name_escaped}", user_cmd_opts)
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--user", "is-enabled", unit_name, user_cmd_opts)
                                   .and_return(shell_out_masked)
             expect(provider.static?).to be false
           end
@@ -949,15 +948,15 @@ describe Chef::Provider::SystemdUnit do
 
         context "when no user is specified" do
           it "returns true when the unit is static" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system is-enabled #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "is-enabled", unit_name)
                                   .and_return(shell_out_static)
             expect(provider.static?).to be true
           end
 
           it "returns false when the unit is not static" do
-            expect(provider).to receive(:shell_out)
-                                  .with("#{systemctl_path} --system is-enabled #{unit_name_escaped}", {})
+            expect(provider).to receive(:shell_out_compacted)
+                                  .with(systemctl_path, "--system", "is-enabled", unit_name)
                                   .and_return(shell_out_masked)
             expect(provider.static?).to be false
           end