trebuchet-deploy/trigger — pull request #28 by cscott (2014-11-16 19:19:17+00:00)
Title: Don't use `shell=True` when calling subprocess.Popen.

Using `shell=True` opens the door to argument quoting issues and little Bobby Tables (http://www.xkcd.com/327/). It's unnecessary, let's not do it.

(The salt deploy commands still seem to use magic commas, so if your repo name contains a comma you will probably have a Bad Day. But otherwise we should be pretty robust against strange tag and repo names now.)