Per the Magento download page, under the patches section
Please upload the patch into your Magento root directory and run the appropriate SSH command: For patch files with the file extension `.sh: sh patch_file_name.sh Example: sh PATCH_SUPEE-1868_CE_22.214.171.124_v1.sh
Magento recommends a direct invocation of the
sh command to run their patch runner. The file extension of
.sh supports this as well.
However, if you look at the top of each patch runner file, the shebang line points to
# Patch apllying tool template
# (c) Copyright 2013. Magento Inc.
The programmer in me wants to trust the source file, but the process wonk wants to obey what's written on the Magento website, the cynic wonders if the patch has been tested against the differences between bash and sh.