diff --git a/bin/imds b/bin/imds
index 591737d..08cdcd1 100755
--- a/bin/imds
+++ b/bin/imds
@@ -103,9 +103,9 @@ imds() {
             +e) err=1; continue ;;          # return
             # TODO: retry/deadline
             # output control
-            +n) echo; continue ;;           # insert newline
-            +s) echo -n " "; continue ;;    # insert space
-            +t) echo -en "\t"; continue ;;  # insert tab
+            +n) printf "\n"; continue ;;           # insert newline
+            +s) printf " "; continue ;;    # insert space
+            +t) printf "\t"; continue ;;  # insert tab
             # key aliasing
             @hostname)  args="$IMDS_HOSTNAME" ;;
             @ssh-keys)  cmd=_imds_ssh_keys ;;
diff --git a/lib/tiny-cloud/aws/imds b/lib/tiny-cloud/aws/imds
index d83aaa9..a115768 100644
--- a/lib/tiny-cloud/aws/imds
+++ b/lib/tiny-cloud/aws/imds
@@ -7,9 +7,9 @@ IMDS_TOKEN_TTL_HEADER="X-aws-ec2-metadata-token-ttl-seconds"
 IMDS_URI="latest"
 
 _imds_token() {
-    echo -ne "PUT /latest/api/token" \
-        "HTTP/1.0\r\n$IMDS_TOKEN_TTL_HEADER: $IMDS_TOKEN_TTL\r\n\r\n" |
-            nc -w 1 "$IMDS_ENDPOINT" 80 | tail -n 1
+    printf "PUT /latest/api/token HTTP/1.0\r\n%s: %s\r\n\r\n" \
+        "$IMDS_TOKEN_TTL_HEADER" "$IMDS_TOKEN_TTL" \
+        | nc -w 1 "$IMDS_ENDPOINT" 80 | tail -n 1
 }
 
 _imds_header() {
diff --git a/tests/bin/wget b/tests/bin/wget
new file mode 100755
index 0000000..9afe1b7
--- /dev/null
+++ b/tests/bin/wget
@@ -0,0 +1,94 @@
+#!/bin/sh
+
+prog=${0##*/}
+usage() {
+	cat <<EOF
+usage: wget [-cqS] [--spider] [-O FILE] [-o LOGFILE] [--header STR]
+	[--post-data STR | --post-file FILE] [-Y on/off]
+	[-P DIR] [-U AGENT] [-T SEC] URL...
+
+Retrieve files via HTTP or FTP
+
+	--spider	Only check URL existence: \$? is 0 if exists
+	--header STR	Add STR (of form 'header: value') to headers
+	--post-data STR	Send STR using POST method
+	--post-file FILE	Send FILE using POST method
+	-c		Continue retrieval of aborted transfer
+	-q		Quiet
+	-P DIR		Save to DIR (default .)
+	-S		Show server response
+	-T SEC		Network read timeout is SEC seconds
+	-O FILE		Save to FILE ('-' for stdout)
+	-o LOGFILE	Log messages to FILE
+	-U STR		Use STR for User-Agent header
+	-Y on/off	Use proxy
+EOF
+	exit $1
+}
+
+msg() {
+	if ! [ -n "$quiet" ]; then
+		# busybox wget sends to stderr
+		echo "$@" >&2
+	fi
+}
+
+OPTS=$(getopt -l quiet,help,header:,output-document:,spider,timeout:,tries: -o "qhO:T:t:" -n $prog -- "$@") || usage "1" >&2
+
+quiet=
+eval set -- "$OPTS"
+while true; do
+	opt="$1"
+	case "$opt" in
+		-h|--help)
+			usage 0
+			;;
+		-q|--quiet)
+			quiet=1
+			;;
+		--header) shift;;
+		--spider)
+			exit ${SPIDER_STATUS:-0}
+			;;
+		-O|--output-document)
+			shift
+			outfile="$1"
+			;;
+		-T|--timeout) shift;;
+		-t|--tries) shift;;
+		--)
+			shift
+			break
+			;;
+		*) usage "1" >&2
+			;;
+	esac
+	shift
+done
+
+if [ $# -eq 0 ]; then
+	usage "1" >&2
+fi
+
+for url; do
+	case "$url" in
+		"") msg "bad address"; exit 1;;
+		*fail*) msg "bad address"; exit 1;;
+		*404*) msg "wget: server returned error: HTTP/1.1 404 Not Found"; exit 1;;
+	esac
+done
+
+if [ -z "$WGETCONTENT" ]; then
+	WGETCONTENT=$( cat "$(echo ${url#http*://} | tr '/' '_')" 2>/dev/null)
+fi
+
+: "${outfile:=index.html}"
+case "$outfile" in
+	-)	msg "writing to stdout"
+		echo "$WGETCONTENT"
+		;;
+	*)	msg "saving to '$outfile'"
+		echo "$WGETCONTENT" > "$outfile"
+		;;
+esac
+
diff --git a/tests/fake-wget.test b/tests/fake-wget.test
new file mode 100755
index 0000000..1e7af27
--- /dev/null
+++ b/tests/fake-wget.test
@@ -0,0 +1,112 @@
+#!/usr/bin/env atf-sh
+
+. $(atf_get_srcdir)/test_env.sh
+init_tests \
+	fake_wget_usage \
+	fake_wget_spider \
+	fake_wget_quiet \
+	fake_wget \
+	fake_wget_outfile \
+	fake_wget_stdout \
+	fake_wget_fail \
+	fake_wget_404 \
+	fake_wget_missing_url \
+	fake_wget_empty_url \
+	fake_wget_header \
+	fake_wget_content_from_path
+
+fake_wget_usage_body() {
+	atf_check -s exit:0 \
+		-o match:"^usage: $@" \
+		-e empty \
+		wget -h
+
+	atf_check -s exit:1 \
+		-o empty \
+		-e match:"^usage: $@" \
+		wget -INVALID
+}
+
+fake_wget_spider_body() {
+	atf_check -s exit:0 \
+		-o empty \
+		-e empty \
+		wget --spider https://example.com
+}
+
+fake_wget_quiet_body() {
+	atf_check -s exit:0 \
+		-o empty \
+		-e empty \
+		wget -q https://example.com
+}
+
+fake_wget_body() {
+	atf_check -s exit:0 \
+		-o empty \
+		-e match:"saving to 'index.html'" \
+		wget https://example.com
+		test -f index.html || atf_fail "index.html not created"
+}
+
+fake_wget_outfile_body() {
+	atf_check -s exit:0 \
+		-o empty \
+		-e match:"saving to 'foo'" \
+		wget -O foo https://example.com
+	test -f foo || atf_fail "foo not created"
+
+	atf_check -s exit:0 \
+		-o empty \
+		-e match:"saving to 'bar'" \
+		sh -x "$atf_srcdir"/bin/wget --output-document bar https://example.com
+	test -f bar || atf_fail "bar not created"
+}
+
+fake_wget_stdout_body() {
+	export WGETCONTENT="hello world"
+	atf_check -s exit:0 \
+		-o match:"hello world" \
+		-e match:"writing to stdout" \
+		wget -O - https://example.com
+		! test -f - || atf_fail "- was created"
+}
+
+fake_wget_fail_body() {
+	atf_check -s exit:1 \
+		-e match:"bad address" \
+		wget https://example.com/fail
+}
+
+fake_wget_404_body() {
+	atf_check -s exit:1 \
+		-e match:"404 Not Found" \
+		wget https://example.com/404
+}
+
+fake_wget_missing_url_body() {
+	atf_check -s exit:1 \
+		-e match:"usage:" \
+		wget -q -O -
+}
+
+fake_wget_empty_url_body() {
+	atf_check -s exit:1 \
+		-e match:"bad address" \
+		wget ""
+}
+
+fake_wget_header_body() {
+	atf_check -s exit:0 \
+		-e match:"saving to" \
+		wget --header 'key: value' https://example.com
+}
+
+fake_wget_content_from_path_body() {
+	mkdir -p example.com/foo
+	echo value > example.com_foo_key
+	atf_check -s exit:0 \
+		-o match:"^value$" \
+		wget --quiet -O - https://example.com/foo/key
+}
+
diff --git a/tests/imds.test b/tests/imds.test
index 9bd9d0c..1839f50 100755
--- a/tests/imds.test
+++ b/tests/imds.test
@@ -6,6 +6,9 @@ export PREFIX="$srcdir"
 
 init_tests \
 	imds_help \
+	imds_space \
+	imds_aws_hostname \
+	imds_aws_ssh_keys \
 	imds_nocloud_cmdline_hostname \
 	imds_nocloud_cidata_hostname
 
@@ -13,6 +16,43 @@ imds_help_body() {
 	atf_check -o match:"Usage: imds" imds -h
 }
 
+imds_space_body() {
+	CLOUD=nocloud atf_check -o match:'^ $' imds +s
+	CLOUD=nocloud atf_check -o match:'^\t$' imds +t
+	CLOUD=nocloud atf_check -o match:'^$' imds +n
+}
+
+aws_set_fake_meta() {
+	local key="$1" value="$2"
+	echo "$value" > $(echo 169.254.169.254/latest/meta-data/"$key" \
+		| tr '/' '_')
+}
+
+aws_create_fake_nc() {
+	fake_bin nc <<-EOF
+		#!/bin/sh
+		input="\$(cat)"
+		case "\$input" in
+			-*) echo "nc: bad input: \$input" >&2; exit 1;;
+		esac
+		echo "token-foo"
+	EOF
+}
+
+imds_aws_hostname_body() {
+	aws_create_fake_nc
+	aws_set_fake_meta hostname myhostname
+	CLOUD=aws atf_check -o match:"myhostname" imds @hostname
+}
+
+imds_aws_ssh_keys_body() {
+	aws_create_fake_nc
+	aws_set_fake_meta public-keys 0=testuser
+	aws_set_fake_meta public-keys/0/openssh-key "ssh-ed25519 keydata"
+
+	CLOUD=aws atf_check -o match:"ssh-ed25519 keydata" imds @ssh-keys
+}
+
 imds_nocloud_cmdline_hostname_body() {
 	atf_require_prog yx
 	mkdir proc
diff --git a/tests/test_env.sh b/tests/test_env.sh
index 7bc17d6..9107a66 100644
--- a/tests/test_env.sh
+++ b/tests/test_env.sh
@@ -1,7 +1,8 @@
 # shellcheck shell=sh
 
-srcdir="$(atf_get_srcdir)/.."
-PATH="$srcdir/bin:$srcdir/sbin:$PATH"
+atf_srcdir="$(atf_get_srcdir)"
+srcdir="$atf_srcdir/.."
+PATH="$atf_srcdir/bin:$srcdir/bin:$srcdir/sbin:$PATH"
 
 export TINY_CLOUD_BASEDIR="$srcdir"
 export ROOT="$PWD"