diff --git a/tests/test-bundle.t b/tests/test-bundle.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1idW5kbGUudA==..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1idW5kbGUudA== 100644
--- a/tests/test-bundle.t
+++ b/tests/test-bundle.t
@@ -216,8 +216,10 @@
 
 Pull ../full.hg into empty (with hook)
 
-  $ echo "[hooks]" >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup"
+  > EOF
 
 doesn't work (yet ?)
 
diff --git a/tests/test-hook.t b/tests/test-hook.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1ob29rLnQ=..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1ob29rLnQ= 100644
--- a/tests/test-hook.t
+++ b/tests/test-hook.t
@@ -16,9 +16,9 @@
   > precommit = sh -c  "HG_LOCAL= HG_NODE= HG_TAG= printenv.py precommit"
   > pretxncommit = sh -c "HG_LOCAL= HG_TAG= printenv.py pretxncommit"
   > pretxncommit.tip = hg -q tip
-  > pre-identify = printenv.py pre-identify 1
-  > pre-cat = printenv.py pre-cat
-  > post-cat = printenv.py post-cat
+  > pre-identify = sh -c "printenv.py pre-identify 1"
+  > pre-cat = sh -c "printenv.py pre-cat"
+  > post-cat = sh -c "printenv.py post-cat"
   > pretxnopen = sh -c "HG_LOCAL= HG_TAG= printenv.py pretxnopen"
   > pretxnclose = sh -c "HG_LOCAL= HG_TAG= printenv.py pretxnclose"
   > txnclose = sh -c "HG_LOCAL= HG_TAG= printenv.py txnclose"
@@ -47,9 +47,9 @@
 
   $ cat > .hg/hgrc <<EOF
   > [hooks]
-  > prechangegroup = printenv.py prechangegroup
-  > changegroup = printenv.py changegroup
-  > incoming = printenv.py incoming
+  > prechangegroup = sh -c "printenv.py prechangegroup"
+  > changegroup = sh -c "printenv.py changegroup"
+  > incoming = sh -c "printenv.py incoming"
   > EOF
 
 pretxncommit and commit hooks can see both parents of merge
@@ -122,7 +122,7 @@
 
   $ cd ../a
   $ cat >> .hg/hgrc <<EOF
-  > pretag = printenv.py pretag
+  > pretag = sh -c "printenv.py pretag"
   > tag = sh -c "HG_PARENT1= HG_PARENT2= printenv.py tag"
   > EOF
   $ hg tag -d '3 0' a
@@ -142,7 +142,9 @@
 
 pretag hook can forbid tagging
 
-  $ echo "pretag.forbid = printenv.py pretag.forbid 1" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > pretag.forbid = sh -c "printenv.py pretag.forbid 1"
+  > EOF
   $ hg tag -d '4 0' fa
   pretag hook: HG_LOCAL=0 HG_NODE=539e4b31b6dc99b3cfbaa6b53cbc1c1f9a1e3a10 HG_TAG=fa
   pretag.forbid hook: HG_LOCAL=0 HG_NODE=539e4b31b6dc99b3cfbaa6b53cbc1c1f9a1e3a10 HG_TAG=fa
@@ -157,8 +159,10 @@
 pretxncommit hook can see changeset, can roll back txn, changeset no
 more there after
 
-  $ echo "pretxncommit.forbid0 = hg tip -q" >> .hg/hgrc
-  $ echo "pretxncommit.forbid1 = printenv.py pretxncommit.forbid 1" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > pretxncommit.forbid0 = sh -c "hg tip -q"
+  > pretxncommit.forbid1 = sh -c "printenv.py pretxncommit.forbid 1"
+  > EOF
   $ echo z > z
   $ hg add z
   $ hg -q tip
@@ -196,7 +200,9 @@
 
 precommit hook can prevent commit
 
-  $ echo "precommit.forbid = printenv.py precommit.forbid 1" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > precommit.forbid = sh -c "printenv.py precommit.forbid 1"
+  > EOF
   $ hg commit -m 'fail' -d '4 0'
   precommit hook: HG_PARENT1=539e4b31b6dc99b3cfbaa6b53cbc1c1f9a1e3a10
   precommit.forbid hook: HG_PARENT1=539e4b31b6dc99b3cfbaa6b53cbc1c1f9a1e3a10
@@ -207,10 +213,12 @@
 
 preupdate hook can prevent update
 
-  $ echo "preupdate = printenv.py preupdate" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > preupdate = sh -c "printenv.py preupdate"
+  > EOF
   $ hg update 1
   preupdate hook: HG_PARENT1=ab228980c14d
   0 files updated, 0 files merged, 2 files removed, 0 files unresolved
 
 update hook
 
@@ -211,10 +219,12 @@
   $ hg update 1
   preupdate hook: HG_PARENT1=ab228980c14d
   0 files updated, 0 files merged, 2 files removed, 0 files unresolved
 
 update hook
 
-  $ echo "update = printenv.py update" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > update = sh -c "printenv.py update"
+  > EOF
   $ hg update
   preupdate hook: HG_PARENT1=539e4b31b6dc
   update hook: HG_ERROR=0 HG_PARENT1=539e4b31b6dc
@@ -222,7 +232,9 @@
 
 pushkey hook
 
-  $ echo "pushkey = printenv.py pushkey" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > pushkey = sh -c "printenv.py pushkey"
+  > EOF
   $ cd ../b
   $ hg bookmark -r null foo
   $ hg push -B foo ../a
@@ -239,7 +251,9 @@
 
 listkeys hook
 
-  $ echo "listkeys = printenv.py listkeys" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > listkeys = sh -c "printenv.py listkeys"
+  > EOF
   $ hg bookmark -r null bar
   pretxnopen hook: HG_TXNID=TXN:* HG_TXNNAME=bookmark (glob)
   pretxnclose hook: HG_BOOKMARK_MOVED=1 HG_PENDING=$TESTTMP/a HG_TXNID=TXN:* HG_TXNNAME=bookmark (glob)
@@ -255,7 +269,9 @@
 
 test that prepushkey can prevent incoming keys
 
-  $ echo "prepushkey = printenv.py prepushkey.forbid 1" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > prepushkey = sh -c "printenv.py prepushkey.forbid 1"
+  > EOF
   $ cd ../b
   $ hg bookmark -r null baz
   $ hg push -B baz ../a
@@ -273,7 +289,9 @@
 
 test that prelistkeys can prevent listing keys
 
-  $ echo "prelistkeys = printenv.py prelistkeys.forbid 1" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > prelistkeys = sh -c "printenv.py prelistkeys.forbid 1"
+  > EOF
   $ hg bookmark -r null quux
   pretxnopen hook: HG_TXNID=TXN:* HG_TXNNAME=bookmark (glob)
   pretxnclose hook: HG_BOOKMARK_MOVED=1 HG_PENDING=$TESTTMP/a HG_TXNID=TXN:* HG_TXNNAME=bookmark (glob)
@@ -294,7 +312,7 @@
   3:07f3376c1e65
   $ cat > .hg/hgrc <<EOF
   > [hooks]
-  > prechangegroup.forbid = printenv.py prechangegroup.forbid 1
+  > prechangegroup.forbid = sh -c "printenv.py prechangegroup.forbid 1"
   > EOF
   $ hg pull ../a
   pulling from ../a
@@ -309,7 +327,7 @@
   $ cat > .hg/hgrc <<EOF
   > [hooks]
   > pretxnchangegroup.forbid0 = hg tip -q
-  > pretxnchangegroup.forbid1 = printenv.py pretxnchangegroup.forbid 1
+  > pretxnchangegroup.forbid1 = sh -c "printenv.py pretxnchangegroup.forbid 1"
   > EOF
   $ hg pull ../a
   pulling from ../a
@@ -332,8 +350,8 @@
   $ rm .hg/hgrc
   $ cat > ../a/.hg/hgrc <<EOF
   > [hooks]
-  > preoutgoing = printenv.py preoutgoing
-  > outgoing = printenv.py outgoing
+  > preoutgoing = sh -c "printenv.py preoutgoing"
+  > outgoing = sh -c "printenv.py outgoing"
   > EOF
   $ hg pull ../a
   pulling from ../a
@@ -351,7 +369,9 @@
 
 preoutgoing hook can prevent outgoing changes
 
-  $ echo "preoutgoing.forbid = printenv.py preoutgoing.forbid 1" >> ../a/.hg/hgrc
+  $ cat >> ../a/.hg/hgrc <<EOF
+  > preoutgoing.forbid = sh -c "printenv.py preoutgoing.forbid 1"
+  > EOF
   $ hg pull ../a
   pulling from ../a
   searching for changes
@@ -365,8 +385,8 @@
   $ cd ..
   $ cat > a/.hg/hgrc <<EOF
   > [hooks]
-  > preoutgoing = printenv.py preoutgoing
-  > outgoing = printenv.py outgoing
+  > preoutgoing = sh -c "printenv.py preoutgoing"
+  > outgoing = sh -c "printenv.py outgoing"
   > EOF
   $ hg clone a c
   preoutgoing hook: HG_SOURCE=clone
@@ -377,7 +397,9 @@
 
 preoutgoing hook can prevent outgoing changes for local clones
 
-  $ echo "preoutgoing.forbid = printenv.py preoutgoing.forbid 1" >> a/.hg/hgrc
+  $ cat >> a/.hg/hgrc <<EOF
+  > preoutgoing.forbid = sh -c "printenv.py preoutgoing.forbid 1"
+  > EOF
   $ hg clone a zzz
   preoutgoing hook: HG_SOURCE=clone
   preoutgoing.forbid hook: HG_SOURCE=clone
@@ -750,7 +772,7 @@
   $ cd ..
   $ cat << EOF >> hgrc-with-post-init-hook
   > [hooks]
-  > post-init = printenv.py post-init
+  > post-init = sh -c "printenv.py post-init"
   > EOF
   $ HGRCPATH=hgrc-with-post-init-hook hg init to
   post-init hook: HG_ARGS=init to HG_OPTS={'insecure': None, 'remotecmd': '', 'ssh': ''} HG_PATS=['to'] HG_RESULT=0
diff --git a/tests/test-http-bundle1.t b/tests/test-http-bundle1.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1odHRwLWJ1bmRsZTEudA==..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1odHRwLWJ1bmRsZTEudA== 100644
--- a/tests/test-http-bundle1.t
+++ b/tests/test-http-bundle1.t
@@ -127,8 +127,10 @@
 pull
 
   $ cd copy-pull
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup"
+  > EOF
   $ hg pull
   pulling from http://localhost:$HGPORT1/
   searching for changes
diff --git a/tests/test-http.t b/tests/test-http.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1odHRwLnQ=..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1odHRwLnQ= 100644
--- a/tests/test-http.t
+++ b/tests/test-http.t
@@ -118,8 +118,10 @@
 pull
 
   $ cd copy-pull
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup"
+  > EOF
   $ hg pull
   pulling from http://localhost:$HGPORT1/
   searching for changes
diff --git a/tests/test-https.t b/tests/test-https.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1odHRwcy50..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1odHRwcy50 100644
--- a/tests/test-https.t
+++ b/tests/test-https.t
@@ -203,8 +203,10 @@
 pull without cacert
 
   $ cd copy-pull
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup"
+  > EOF
   $ hg pull $DISABLECACERTS
   pulling from https://localhost:$HGPORT/
   warning: connecting to localhost using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info (?)
diff --git a/tests/test-push-http-bundle1.t b/tests/test-push-http-bundle1.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1wdXNoLWh0dHAtYnVuZGxlMS50..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1wdXNoLWh0dHAtYnVuZGxlMS50 100644
--- a/tests/test-push-http-bundle1.t
+++ b/tests/test-push-http-bundle1.t
@@ -66,10 +66,12 @@
 
 expect success
 
-  $ echo 'allow_push = *' >> .hg/hgrc
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup 0" >> .hg/hgrc
-  $ echo "pushkey = printenv.py pushkey 0" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > allow_push = *
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup 0"
+  > pushkey = sh -c "printenv.py pushkey 0"
+  > EOF
   $ req
   pushing to http://localhost:$HGPORT/
   searching for changes
@@ -151,7 +153,7 @@
   > push_ssl = false
   > allow_push = *
   > [hooks]
-  > prepushkey = printenv.py prepushkey 1
+  > prepushkey = sh -c "printenv.py prepushkey 1"
   > EOF
   $ req
   pushing to http://localhost:$HGPORT/
@@ -164,7 +166,9 @@
 
 expect phase change success
 
-  $ echo "prepushkey = printenv.py prepushkey 0" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > prepushkey = sh -c "printenv.py prepushkey 0"
+  > EOF
   $ req
   pushing to http://localhost:$HGPORT/
   searching for changes
diff --git a/tests/test-push-http.t b/tests/test-push-http.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1wdXNoLWh0dHAudA==..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1wdXNoLWh0dHAudA== 100644
--- a/tests/test-push-http.t
+++ b/tests/test-push-http.t
@@ -56,10 +56,12 @@
 
 expect success
 
-  $ echo 'allow_push = *' >> .hg/hgrc
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup 0" >> .hg/hgrc
-  $ echo "pushkey = printenv.py pushkey 0" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > allow_push = *
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup 0"
+  > pushkey = sh -c "printenv.py pushkey 0"
+  > EOF
   $ req
   pushing to http://localhost:$HGPORT/
   searching for changes
@@ -114,7 +116,7 @@
   > push_ssl = false
   > allow_push = *
   > [hooks]
-  > prepushkey = printenv.py prepushkey 1
+  > prepushkey = sh -c "printenv.py prepushkey 1"
   > EOF
   $ req
   pushing to http://localhost:$HGPORT/
@@ -133,7 +135,9 @@
 
 expect phase change success
 
-  $ echo "prepushkey = printenv.py prepushkey 0" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > prepushkey = sh -c "printenv.py prepushkey 0"
+  > EOF
   $ req
   pushing to http://localhost:$HGPORT/
   searching for changes
diff --git a/tests/test-ssh-bundle1.t b/tests/test-ssh-bundle1.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1zc2gtYnVuZGxlMS50..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1zc2gtYnVuZGxlMS50 100644
--- a/tests/test-ssh-bundle1.t
+++ b/tests/test-ssh-bundle1.t
@@ -38,7 +38,7 @@
   > uncompressed = True
   > 
   > [hooks]
-  > changegroup = printenv.py changegroup-in-remote 0 ../dummylog
+  > changegroup = sh -c "printenv.py changegroup-in-remote 0 ../dummylog"
   > EOF
   $ cd ..
 
@@ -114,8 +114,10 @@
   crosschecking files in changesets and manifests
   checking files
   2 files, 3 changesets, 2 total revisions
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup-in-local 0 ../dummylog" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup-in-local 0 ../dummylog"
+  > EOF
 
 empty default pull
 
diff --git a/tests/test-ssh.t b/tests/test-ssh.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1zc2gudA==..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1zc2gudA== 100644
--- a/tests/test-ssh.t
+++ b/tests/test-ssh.t
@@ -32,7 +32,7 @@
   > uncompressed = True
   > 
   > [hooks]
-  > changegroup = printenv.py changegroup-in-remote 0 ../dummylog
+  > changegroup = sh -c "printenv.py changegroup-in-remote 0 ../dummylog"
   > EOF
   $ cd ..
 
@@ -108,8 +108,10 @@
   crosschecking files in changesets and manifests
   checking files
   2 files, 3 changesets, 2 total revisions
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup-in-local 0 ../dummylog" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup-in-local 0 ../dummylog"
+  > EOF
 
 empty default pull
 
diff --git a/tests/test-static-http.t b/tests/test-static-http.t
index 3afde791dce192f38d8a228ed8e49397e353837e_dGVzdHMvdGVzdC1zdGF0aWMtaHR0cC50..34a5f6c66bc5a13381a68d08f73d858916167836_dGVzdHMvdGVzdC1zdGF0aWMtaHR0cC50 100644
--- a/tests/test-static-http.t
+++ b/tests/test-static-http.t
@@ -53,8 +53,10 @@
 
   $ rm .hg/cache/*
   $ cd ../local
-  $ echo '[hooks]' >> .hg/hgrc
-  $ echo "changegroup = printenv.py changegroup" >> .hg/hgrc
+  $ cat >> .hg/hgrc <<EOF
+  > [hooks]
+  > changegroup = sh -c "printenv.py changegroup"
+  > EOF
   $ hg pull
   pulling from static-http://localhost:$HGPORT/remote
   searching for changes