You might want to drop shell=True and use
a list as arguments instead.
The two issues (whether "shell" is True/False and whether the command is
a list or string) are orthogonal.
You should always use a list for the command, unless you are given a
string (e.g. by the user) which must be executed verbatim.
The shell=True argument is frowned upon and
should only be used if your really, really need a shell.
It's the use of a string (rather than a list) for the command which is
particularly frowned upon, as this tends to be error prone if any of the
arguments contain characters which are significant to the shell (most
commonly spaces, although other characters are also problematic).
On Unix, using a list for the command effectively necessitates that
shell=False (if you use a list with shell=True, the first element in the
list is executed as the command, with any remaining elements used to
initialise $1, $2, etc).
On Windows, the list is converted to a string in the same way regardless
of whether shell is True or False. The shell parameter determines whether
the string is passed directly to CreateProcess or whether it has
"%COMSPEC% /c " prepended to it. If shell is False, the first element in
the list (the program) must refer to a binary executable and include the
..exe (etc) extension. If shell is True, the program can be a batch file,
Python script, etc, and will be executed according to its extension.
