echo "banned command $cmd: $output"

  dash$ x="foo\nasd"
  dash$ echo "$x"
  foo
  asd
  dash$ printf "%s\n" "$x"
  foo\nasd
  dash$

  zsh% x="foo\nasd"
  zsh% echo "$x"
  foo
  asd
  zsh% printf "%s\n" "$x"
  foo\nasd
  zsh%

  bash$ x="foo\nasd"
  bash$ echo "$x"
  foo\nasd
  bash$ printf "%s\n" "$x"
  foo\nasd
  bash$

    bash$ echo -e $x
    foo
    asd
    bash$

From POSIX:

>echo - write arguments to standard output

>If the first operand is -n, or if any of the operands contain a <backslash> character, the results are implementation-defined.

In other words, they control where this script runs and there is no need to run it on more than one platform, so it's okay for it to be non-portable.

In the end, it was much easier to just proclaim GNU coreutils as a dependency everywhere, and use g-prefixed versions of commands (gfind, ggrep, and so on).

I had to stick to (most of) POSIX across Unixes with ksh88/mksh/pdksh back in the day when my work had to be portable across Linux, BSD, Solaris, HP-UX, and AIX. I could rely on process substitution, etc. but stay vanilla outside the shell itself.

Honestly the only really annoying thing to me was that sed -i didn’t mean in place, but even then it wasn’t reliably atomic IIRC.

Handling the actual OS commands was much harder. Separate commands instead of getent (maybe getpw was one?) on HP-UX pops into my head.