git: run external commands as list of strings so we really get correct quoting (Issue #135) a6dfd14d4b20 from https://bitbucket.org/conservancy/kallithea/pull-request/17/add-quotes-to-repo-urls-for-git-backend fixed that issue but did not make it "safe". The vcs git backend still used command strings but tried to quote them correctly ... but that approach is almost impossible to get right. Instead, pass a string list all the way to the subprocess module and let it do the quoting. This also makes some of the code more simple.