diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index ad0b1f490..ccfc4c7d3 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -1,591 +1,578 @@
 # A module to collect utility functions.
 
 require 'English'
 require 'puppet/util/monkey_patches'
 require 'puppet/external/lock'
 require 'puppet/util/execution_stub'
 require 'uri'
 require 'sync'
 require 'monitor'
 require 'tempfile'
 require 'pathname'
 
 module Puppet
   # A command failed to execute.
   require 'puppet/error'
   class ExecutionFailure < Puppet::Error
   end
 module Util
   require 'benchmark'
 
   # These are all for backward compatibility -- these are methods that used
   # to be in Puppet::Util but have been moved into external modules.
   require 'puppet/util/posix'
   extend Puppet::Util::POSIX
 
   @@sync_objects = {}.extend MonitorMixin
 
   def self.activerecord_version
     if (defined?(::ActiveRecord) and defined?(::ActiveRecord::VERSION) and defined?(::ActiveRecord::VERSION::MAJOR) and defined?(::ActiveRecord::VERSION::MINOR))
       ([::ActiveRecord::VERSION::MAJOR, ::ActiveRecord::VERSION::MINOR].join('.').to_f)
     else
       0
     end
   end
 
   def self.synchronize_on(x,type)
     sync_object,users = 0,1
     begin
       @@sync_objects.synchronize {
         (@@sync_objects[x] ||= [Sync.new,0])[users] += 1
       }
       @@sync_objects[x][sync_object].synchronize(type) { yield }
     ensure
       @@sync_objects.synchronize {
         @@sync_objects.delete(x) unless (@@sync_objects[x][users] -= 1) > 0
       }
     end
   end
 
   # Change the process to a different user
   def self.chuser
     if group = Puppet[:group]
       begin
         Puppet::Util::SUIDManager.change_group(group, true)
       rescue => detail
         Puppet.warning "could not change to group #{group.inspect}: #{detail}"
         $stderr.puts "could not change to group #{group.inspect}"
 
         # Don't exit on failed group changes, since it's
         # not fatal
         #exit(74)
       end
     end
 
     if user = Puppet[:user]
       begin
         Puppet::Util::SUIDManager.change_user(user, true)
       rescue => detail
         $stderr.puts "Could not change to user #{user}: #{detail}"
         exit(74)
       end
     end
   end
 
   # Create instance methods for each of the log levels.  This allows
   # the messages to be a little richer.  Most classes will be calling this
   # method.
   def self.logmethods(klass, useself = true)
     Puppet::Util::Log.eachlevel { |level|
       klass.send(:define_method, level, proc { |args|
         args = args.join(" ") if args.is_a?(Array)
         if useself
 
           Puppet::Util::Log.create(
             :level => level,
             :source => self,
             :message => args
           )
         else
 
           Puppet::Util::Log.create(
             :level => level,
             :message => args
           )
         end
       })
     }
   end
 
   # Proxy a bunch of methods to another object.
   def self.classproxy(klass, objmethod, *methods)
     classobj = class << klass; self; end
     methods.each do |method|
       classobj.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # Proxy a bunch of methods to another object.
   def self.proxy(klass, objmethod, *methods)
     methods.each do |method|
       klass.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # XXX this should all be done using puppet objects, not using
   # normal mkdir
   def self.recmkdir(dir,mode = 0755)
     if FileTest.exist?(dir)
       return false
     else
       tmp = dir.sub(/^\//,'')
       path = [File::SEPARATOR]
       tmp.split(File::SEPARATOR).each { |dir|
         path.push dir
         if ! FileTest.exist?(File.join(path))
           Dir.mkdir(File.join(path), mode)
         elsif FileTest.directory?(File.join(path))
           next
         else FileTest.exist?(File.join(path))
           raise "Cannot create #{dir}: basedir #{File.join(path)} is a file"
         end
       }
       return true
     end
   end
 
   # Execute a given chunk of code with a new umask.
   def self.withumask(mask)
     cur = File.umask(mask)
 
     begin
       yield
     ensure
       File.umask(cur)
     end
   end
 
   def benchmark(*args)
     msg = args.pop
     level = args.pop
     object = nil
 
     if args.empty?
       if respond_to?(level)
         object = self
       else
         object = Puppet
       end
     else
       object = args.pop
     end
 
     raise Puppet::DevError, "Failed to provide level to :benchmark" unless level
 
     unless level == :none or object.respond_to? level
       raise Puppet::DevError, "Benchmarked object does not respond to #{level}"
     end
 
     # Only benchmark if our log level is high enough
     if level != :none and Puppet::Util::Log.sendlevel?(level)
       result = nil
       seconds = Benchmark.realtime {
         yield
       }
       object.send(level, msg + (" in %0.2f seconds" % seconds))
       return seconds
     else
       yield
     end
   end
 
   def which(bin)
     if absolute_path?(bin)
       return bin if FileTest.file? bin and FileTest.executable? bin
     else
       ENV['PATH'].split(File::PATH_SEPARATOR).each do |dir|
         dest = File.expand_path(File.join(dir, bin))
         if Puppet.features.microsoft_windows? && File.extname(dest).empty?
           exts = ENV['PATHEXT']
           exts = exts ? exts.split(File::PATH_SEPARATOR) : %w[.COM .EXE .BAT .CMD]
           exts.each do |ext|
             destext = File.expand_path(dest + ext)
             return destext if FileTest.file? destext and FileTest.executable? destext
           end
         end
         return dest if FileTest.file? dest and FileTest.executable? dest
       end
     end
     nil
   end
   module_function :which
 
   # Determine in a platform-specific way whether a path is absolute. This
   # defaults to the local platform if none is specified.
   def absolute_path?(path, platform=nil)
     # Escape once for the string literal, and once for the regex.
     slash = '[\\\\/]'
     name = '[^\\\\/]+'
     regexes = {
       :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i,
       :posix   => %r!^/!,
     }
     require 'puppet'
     platform ||= Puppet.features.microsoft_windows? ? :windows : :posix
 
     !! (path =~ regexes[platform])
   end
   module_function :absolute_path?
 
   # Convert a path to a file URI
   def path_to_uri(path)
     return unless path
 
     params = { :scheme => 'file' }
 
     if Puppet.features.microsoft_windows?
       path = path.gsub(/\\/, '/')
 
       if unc = /^\/\/([^\/]+)(\/[^\/]+)/.match(path)
         params[:host] = unc[1]
         path = unc[2]
       elsif path =~ /^[a-z]:\//i
         path = '/' + path
       end
     end
 
     params[:path] = URI.escape(path)
 
     begin
       URI::Generic.build(params)
     rescue => detail
       raise Puppet::Error, "Failed to convert '#{path}' to URI: #{detail}"
     end
   end
   module_function :path_to_uri
 
   # Get the path component of a URI
   def uri_to_path(uri)
     return unless uri.is_a?(URI)
 
     path = URI.unescape(uri.path)
 
     if Puppet.features.microsoft_windows? and uri.scheme == 'file'
       if uri.host
         path = "//#{uri.host}" + path # UNC
       else
         path.sub!(/^\//, '')
       end
     end
 
     path
   end
   module_function :uri_to_path
 
   # Execute the provided command in a pipe, yielding the pipe object.
   def execpipe(command, failonfail = true)
     if respond_to? :debug
       debug "Executing '#{command}'"
     else
       Puppet.debug "Executing '#{command}'"
     end
 
     command_str = command.respond_to?(:join) ? command.join('') : command
     output = open("| #{command_str} 2>&1") do |pipe|
       yield pipe
     end
 
     if failonfail
       unless $CHILD_STATUS == 0
         raise ExecutionFailure, output
       end
     end
 
     output
   end
 
   def execfail(command, exception)
       output = execute(command)
       return output
   rescue ExecutionFailure
       raise exception, output
   end
 
   def execute_posix(command, arguments, stdin, stdout, stderr)
     child_pid = Kernel.fork do
       # We can't just call Array(command), and rely on it returning
       # things like ['foo'], when passed ['foo'], because
       # Array(command) will call command.to_a internally, which when
       # given a string can end up doing Very Bad Things(TM), such as
       # turning "/tmp/foo;\r\n /bin/echo" into ["/tmp/foo;\r\n", " /bin/echo"]
       command = [command].flatten
       Process.setsid
       begin
         $stdin.reopen(stdin)
         $stdout.reopen(stdout)
         $stderr.reopen(stderr)
 
         3.upto(256){|fd| IO::new(fd).close rescue nil}
 
         Puppet::Util::SUIDManager.change_privileges(arguments[:uid], arguments[:gid], true)
 
         ENV['LANG'] = ENV['LC_ALL'] = ENV['LC_MESSAGES'] = ENV['LANGUAGE'] = 'C'
         Kernel.exec(*command)
       rescue => detail
         puts detail.to_s
         exit!(1)
       end
     end
     child_pid
   end
   module_function :execute_posix
 
   def execute_windows(command, arguments, stdin, stdout, stderr)
     command = command.map do |part|
       part.include?(' ') ? %Q["#{part.gsub(/"/, '\"')}"] : part
     end.join(" ") if command.is_a?(Array)
 
     process_info = Process.create( :command_line => command, :startup_info => {:stdin => stdin, :stdout => stdout, :stderr => stderr} )
     process_info.process_id
   end
   module_function :execute_windows
 
   # Execute the desired command, and return the status and output.
   # def execute(command, failonfail = true, uid = nil, gid = nil)
   # :combine sets whether or not to combine stdout/stderr in the output
   # :stdinfile sets a file that can be used for stdin. Passing a string
   # for stdin is not currently supported.
   def execute(command, arguments = {:failonfail => true, :combine => true})
     if command.is_a?(Array)
       command = command.flatten.map(&:to_s)
       str = command.join(" ")
     elsif command.is_a?(String)
       str = command
     end
 
     if respond_to? :debug
       debug "Executing '#{str}'"
     else
       Puppet.debug "Executing '#{str}'"
     end
 
     null_file = Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null'
 
     stdin = File.open(arguments[:stdinfile] || null_file, 'r')
     stdout = arguments[:squelch] ? File.open(null_file, 'w') : Tempfile.new('puppet')
     stderr = arguments[:combine] ? stdout : File.open(null_file, 'w')
 
     exec_args = [command, arguments, stdin, stdout, stderr]
 
     if execution_stub = Puppet::Util::ExecutionStub.current_value
       return execution_stub.call(*exec_args)
     elsif Puppet.features.posix?
       child_pid = execute_posix(*exec_args)
       exit_status = Process.waitpid2(child_pid).last.exitstatus
     elsif Puppet.features.microsoft_windows?
       child_pid = execute_windows(*exec_args)
       exit_status = Process.waitpid2(child_pid).last
       # $CHILD_STATUS is not set when calling win32/process Process.create
       # and since it's read-only, we can't set it. But we can execute a
       # a shell that simply returns the desired exit status, which has the
       # desired effect.
       %x{#{ENV['COMSPEC']} /c exit #{exit_status}}
     end
 
     [stdin, stdout, stderr].each {|io| io.close rescue nil}
 
     # read output in if required
     unless arguments[:squelch]
       output = wait_for_output(stdout)
       Puppet.warning "Could not get output" unless output
     end
 
     if arguments[:failonfail] and exit_status != 0
       raise ExecutionFailure, "Execution of '#{str}' returned #{exit_status}: #{output}"
     end
 
     output
   end
 
   module_function :execute
 
   def wait_for_output(stdout)
     # Make sure the file's actually been written.  This is basically a race
     # condition, and is probably a horrible way to handle it, but, well, oh
     # well.
     2.times do |try|
       if File.exists?(stdout.path)
         output = stdout.open.read
 
         stdout.close(true)
 
         return output
       else
         time_to_sleep = try / 2.0
         Puppet.warning "Waiting for output; will sleep #{time_to_sleep} seconds"
         sleep(time_to_sleep)
       end
     end
     nil
   end
   module_function :wait_for_output
 
   # Create an exclusive lock.
   def threadlock(resource, type = Sync::EX)
     Puppet::Util.synchronize_on(resource,type) { yield }
   end
 
   # Because some modules provide their own version of this method.
   alias util_execute execute
 
   module_function :benchmark
 
   def memory
     unless defined?(@pmap)
       @pmap = which('pmap')
     end
     if @pmap
       %x{#{@pmap} #{Process.pid}| grep total}.chomp.sub(/^\s*total\s+/, '').sub(/K$/, '').to_i
     else
       0
     end
   end
 
   def symbolize(value)
     if value.respond_to? :intern
       value.intern
     else
       value
     end
   end
 
   def symbolizehash(hash)
     newhash = {}
     hash.each do |name, val|
       if name.is_a? String
         newhash[name.intern] = val
       else
         newhash[name] = val
       end
     end
   end
 
   def symbolizehash!(hash)
     hash.each do |name, val|
       if name.is_a? String
         hash[name.intern] = val
         hash.delete(name)
       end
     end
 
     hash
   end
   module_function :symbolize, :symbolizehash, :symbolizehash!
 
   # Just benchmark, with no logging.
   def thinmark
     seconds = Benchmark.realtime {
       yield
     }
 
     seconds
   end
 
   module_function :memory, :thinmark
 
   # Because IO#binread is only available in 1.9
   def binread(file)
     File.open(file, 'rb') { |f| f.read }
   end
   module_function :binread
 
   # Replace a file, securely.  This takes a block, and passes it the file
   # handle of a file open for writing.  Write the replacement content inside
   # the block and it will safely replace the target file.
   #
   # This method will make no changes to the target file until the content is
   # successfully written and the block returns without raising an error.
   #
   # As far as possible the state of the existing file, such as mode, is
   # preserved.  This works hard to avoid loss of any metadata, but will result
   # in an inode change for the file.
   #
   # Arguments: `filename`, `default_mode`
   #
   # The filename is the file we are going to replace.
   #
   # The default_mode is the mode to use when the target file doesn't already
   # exist; if the file is present we copy the existing mode/owner/group values
   # across.
   def replace_file(file, default_mode, &block)
     raise Puppet::DevError, "replace_file requires a block" unless block_given?
+    raise Puppet::DevError, "replace_file is non-functional on Windows" if Puppet.features.microsoft_windows?
 
     file     = Pathname(file)
     tempfile = Tempfile.new(file.basename.to_s, file.dirname.to_s)
 
     file_exists = file.exist?
 
     # If the file exists, use its current mode/owner/group. If it doesn't, use
     # the supplied mode, and default to current user/group.
     if file_exists
-      if Puppet.features.microsoft_windows?
-        mode = Puppet::Util::Windows::Security.get_mode(file.to_s)
-        uid = Puppet::Util::Windows::Security.get_owner(file.to_s)
-        gid = Puppet::Util::Windows::Security.get_owner(file.to_s)
-      else
-        stat = file.lstat
-
-        mode = stat.mode
-        uid = stat.uid
-        gid = stat.gid
-      end
+      stat = file.lstat
 
       # We only care about the four lowest-order octets. Higher octets are
       # filesystem-specific.
-      mode &= 07777
+      mode = stat.mode & 07777
+      uid = stat.uid
+      gid = stat.gid
     else
       mode = default_mode
       uid = Process.euid
       gid = Process.egid
     end
 
     # Set properties of the temporary file before we write the content, because
     # Tempfile doesn't promise to be safe from reading by other people, just
     # that it avoids races around creating the file.
-    if Puppet.features.microsoft_windows?
-      Puppet::Util::Windows::Security.set_mode(mode, tempfile.path)
-      Puppet::Util::Windows::Security.set_owner(uid, tempfile.path)
-      Puppet::Util::Windows::Security.set_group(gid, tempfile.path)
-    else
-      tempfile.chmod(mode)
-      tempfile.chown(uid, gid)
-    end
+    tempfile.chmod(mode)
+    tempfile.chown(uid, gid)
 
     # OK, now allow the caller to write the content of the file.
     yield tempfile
 
     # Now, make sure the data (which includes the mode) is safe on disk.
     tempfile.flush
     begin
       tempfile.fsync
     rescue NotImplementedError
       # fsync may not be implemented by Ruby on all platforms, but
       # there is absolutely no recovery path if we detect that.  So, we just
       # ignore the return code.
       #
       # However, don't be fooled: that is accepting that we are running in
       # an unsafe fashion.  If you are porting to a new platform don't stub
       # that out.
     end
 
     tempfile.close
 
     File.rename(tempfile.path, file)
 
     # Ideally, we would now fsync the directory as well, but Ruby doesn't
     # have support for that, and it doesn't matter /that/ much...
 
     # Return something true, and possibly useful.
     file
   end
   module_function :replace_file
 end
 end
 
 require 'puppet/util/errors'
 require 'puppet/util/methodhelper'
 require 'puppet/util/metaid'
 require 'puppet/util/classgen'
 require 'puppet/util/docs'
 require 'puppet/util/execution'
 require 'puppet/util/logging'
 require 'puppet/util/package'
 require 'puppet/util/warnings'
diff --git a/spec/unit/util_spec.rb b/spec/unit/util_spec.rb
index 72733b625..b931e9373 100755
--- a/spec/unit/util_spec.rb
+++ b/spec/unit/util_spec.rb
@@ -1,679 +1,689 @@
 #!/usr/bin/env ruby
 
 require 'spec_helper'
 
 describe Puppet::Util do
   include PuppetSpec::Files
 
   if Puppet.features.microsoft_windows?
     def set_mode(mode, file)
       Puppet::Util::Windows::Security.set_mode(mode, file)
     end
 
     def get_mode(file)
       Puppet::Util::Windows::Security.get_mode(file) & 07777
     end
   else
     def set_mode(mode, file)
       File.chmod(mode, file)
     end
 
     def get_mode(file)
       File.lstat(file).mode & 07777
     end
   end
 
   def process_status(exitstatus)
     return exitstatus if Puppet.features.microsoft_windows?
 
     stub('child_status', :exitstatus => exitstatus)
   end
 
   describe "#absolute_path?" do
     it "should default to the platform of the local system" do
       Puppet.features.stubs(:posix?).returns(true)
       Puppet.features.stubs(:microsoft_windows?).returns(false)
 
       Puppet::Util.should be_absolute_path('/foo')
       Puppet::Util.should_not be_absolute_path('C:/foo')
 
       Puppet.features.stubs(:posix?).returns(false)
       Puppet.features.stubs(:microsoft_windows?).returns(true)
 
       Puppet::Util.should be_absolute_path('C:/foo')
       Puppet::Util.should_not be_absolute_path('/foo')
     end
 
     describe "when using platform :posix" do
       %w[/ /foo /foo/../bar //foo //Server/Foo/Bar //?/C:/foo/bar /\Server/Foo /foo//bar/baz].each do |path|
         it "should return true for #{path}" do
           Puppet::Util.should be_absolute_path(path, :posix)
         end
       end
 
       %w[. ./foo \foo C:/foo \\Server\Foo\Bar \\?\C:\foo\bar \/?/foo\bar \/Server/foo foo//bar/baz].each do |path|
         it "should return false for #{path}" do
           Puppet::Util.should_not be_absolute_path(path, :posix)
         end
       end
     end
 
     describe "when using platform :windows" do
       %w[C:/foo C:\foo \\\\Server\Foo\Bar \\\\?\C:\foo\bar //Server/Foo/Bar //?/C:/foo/bar /\?\C:/foo\bar \/Server\Foo/Bar c:/foo//bar//baz].each do |path|
         it "should return true for #{path}" do
           Puppet::Util.should be_absolute_path(path, :windows)
         end
       end
 
       %w[/ . ./foo \foo /foo /foo/../bar //foo C:foo/bar foo//bar/baz].each do |path|
         it "should return false for #{path}" do
           Puppet::Util.should_not be_absolute_path(path, :windows)
         end
       end
     end
   end
 
   describe "#path_to_uri" do
     %w[. .. foo foo/bar foo/../bar].each do |path|
       it "should reject relative path: #{path}" do
         lambda { Puppet::Util.path_to_uri(path) }.should raise_error(Puppet::Error)
       end
     end
 
     it "should perform URI escaping" do
       Puppet::Util.path_to_uri("/foo bar").path.should == "/foo%20bar"
     end
 
     describe "when using platform :posix" do
       before :each do
         Puppet.features.stubs(:posix).returns true
         Puppet.features.stubs(:microsoft_windows?).returns false
       end
 
       %w[/ /foo /foo/../bar].each do |path|
         it "should convert #{path} to URI" do
           Puppet::Util.path_to_uri(path).path.should == path
         end
       end
     end
 
     describe "when using platform :windows" do
       before :each do
         Puppet.features.stubs(:posix).returns false
         Puppet.features.stubs(:microsoft_windows?).returns true
       end
 
       it "should normalize backslashes" do
         Puppet::Util.path_to_uri('c:\\foo\\bar\\baz').path.should == '/' + 'c:/foo/bar/baz'
       end
 
       %w[C:/ C:/foo/bar].each do |path|
         it "should convert #{path} to absolute URI" do
           Puppet::Util.path_to_uri(path).path.should == '/' + path
         end
       end
 
       %w[share C$].each do |path|
         it "should convert UNC #{path} to absolute URI" do
           uri = Puppet::Util.path_to_uri("\\\\server\\#{path}")
           uri.host.should == 'server'
           uri.path.should == '/' + path
         end
       end
     end
   end
 
   describe ".uri_to_path" do
     require 'uri'
 
     it "should strip host component" do
       Puppet::Util.uri_to_path(URI.parse('http://foo/bar')).should == '/bar'
     end
 
     it "should accept puppet URLs" do
       Puppet::Util.uri_to_path(URI.parse('puppet:///modules/foo')).should == '/modules/foo'
     end
 
     it "should return unencoded path" do
       Puppet::Util.uri_to_path(URI.parse('http://foo/bar%20baz')).should == '/bar baz'
     end
 
     it "should be nil-safe" do
       Puppet::Util.uri_to_path(nil).should be_nil
     end
 
     describe "when using platform :posix",:if => Puppet.features.posix? do
       it "should accept root" do
         Puppet::Util.uri_to_path(URI.parse('file:/')).should == '/'
       end
 
       it "should accept single slash" do
         Puppet::Util.uri_to_path(URI.parse('file:/foo/bar')).should == '/foo/bar'
       end
 
       it "should accept triple slashes" do
         Puppet::Util.uri_to_path(URI.parse('file:///foo/bar')).should == '/foo/bar'
       end
     end
 
     describe "when using platform :windows", :if => Puppet.features.microsoft_windows? do
       it "should accept root" do
         Puppet::Util.uri_to_path(URI.parse('file:/C:/')).should == 'C:/'
       end
 
       it "should accept single slash" do
         Puppet::Util.uri_to_path(URI.parse('file:/C:/foo/bar')).should == 'C:/foo/bar'
       end
 
       it "should accept triple slashes" do
         Puppet::Util.uri_to_path(URI.parse('file:///C:/foo/bar')).should == 'C:/foo/bar'
       end
 
       it "should accept file scheme with double slashes as a UNC path" do
         Puppet::Util.uri_to_path(URI.parse('file://host/share/file')).should == '//host/share/file'
       end
     end
   end
 
   describe "execution methods" do
     let(:pid) { 5501 }
     let(:null_file) { Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null' }
 
     describe "#execute_posix" do
       before :each do
         # Most of the things this method does are bad to do during specs. :/
         Kernel.stubs(:fork).returns(pid).yields
         Process.stubs(:setsid)
         Kernel.stubs(:exec)
         Puppet::Util::SUIDManager.stubs(:change_user)
         Puppet::Util::SUIDManager.stubs(:change_group)
 
         $stdin.stubs(:reopen)
         $stdout.stubs(:reopen)
         $stderr.stubs(:reopen)
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should fork a child process to execute the command" do
         Kernel.expects(:fork).returns(pid).yields
         Kernel.expects(:exec).with('test command')
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should start a new session group" do
         Process.expects(:setsid)
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should close all open file descriptors except stdin/stdout/stderr" do
         # This is ugly, but I can't really think of a better way to do it without
         # letting it actually close fds, which seems risky
         (0..2).each {|n| IO.expects(:new).with(n).never}
         (3..256).each {|n| IO.expects(:new).with(n).returns mock('io', :close) }
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should permanently change to the correct user and group if specified" do
         Puppet::Util::SUIDManager.expects(:change_group).with(55, true)
         Puppet::Util::SUIDManager.expects(:change_user).with(50, true)
 
         Puppet::Util.execute_posix('test command', {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should exit failure if there is a problem execing the command" do
         Kernel.expects(:exec).with('test command').raises("failed to execute!")
         Puppet::Util.stubs(:puts)
         Puppet::Util.expects(:exit!).with(1)
 
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute commands specified as arrays" do
         Kernel.expects(:exec).with('test command', 'with', 'arguments')
 
         Puppet::Util.execute_posix(['test command', 'with', 'arguments'], {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute string commands with embedded newlines" do
         Kernel.expects(:exec).with("/bin/echo 'foo' ; \n /bin/echo 'bar' ;")
 
         Puppet::Util.execute_posix("/bin/echo 'foo' ; \n /bin/echo 'bar' ;", {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should return the pid of the child process" do
         Puppet::Util.execute_posix('test command', {}, @stdin, @stdout, @stderr).should == pid
       end
     end
 
     describe "#execute_windows" do
       let(:proc_info_stub) { stub 'processinfo', :process_id => pid }
 
       before :each do
         Process.stubs(:create).returns(proc_info_stub)
         Process.stubs(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should create a new process for the command" do
         Process.expects(:create).with(
           :command_line => "test command",
           :startup_info => {:stdin => @stdin, :stdout => @stdout, :stderr => @stderr}
         ).returns(proc_info_stub)
 
         Puppet::Util.execute_windows('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should return the pid of the child process" do
         Puppet::Util.execute_windows('test command', {}, @stdin, @stdout, @stderr).should == pid
       end
 
       it "should quote arguments containing spaces if command is specified as an array" do
         Process.expects(:create).with do |args|
           args[:command_line] == '"test command" with some "arguments \"with spaces"'
         end.returns(proc_info_stub)
 
         Puppet::Util.execute_windows(['test command', 'with', 'some', 'arguments "with spaces'], {}, @stdin, @stdout, @stderr)
       end
     end
 
     describe "#execute" do
       before :each do
         Process.stubs(:waitpid2).with(pid).returns([pid, process_status(0)])
       end
 
       describe "when an execution stub is specified" do
         before :each do
           Puppet::Util::ExecutionStub.set do |command,args,stdin,stdout,stderr|
             "execution stub output"
           end
         end
 
         it "should call the block on the stub" do
           Puppet::Util.execute("/usr/bin/run_my_execute_stub").should == "execution stub output"
         end
 
         it "should not actually execute anything" do
           Puppet::Util.expects(:execute_posix).never
           Puppet::Util.expects(:execute_windows).never
 
           Puppet::Util.execute("/usr/bin/run_my_execute_stub")
         end
       end
 
       describe "when setting up input and output files" do
         include PuppetSpec::Files
         let(:executor) { Puppet.features.microsoft_windows? ? 'execute_windows' : 'execute_posix' }
 
         before :each do
           Puppet::Util.stubs(:wait_for_output)
         end
 
         it "should set stdin to the stdinfile if specified" do
           input = tmpfile('stdin')
           FileUtils.touch(input)
 
           Puppet::Util.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == input
           end.returns(pid)
 
           Puppet::Util.execute('test command', :stdinfile => input)
         end
 
         it "should set stdin to the null file if not specified" do
           Puppet::Util.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == null_file
           end.returns(pid)
 
           Puppet::Util.execute('test command')
         end
 
         describe "when squelch is set" do
           it "should set stdout and stderr to the null file" do
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == null_file and stderr.path == null_file
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => true)
           end
         end
 
         describe "when squelch is not set" do
           it "should set stdout to a temporary output file" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,_|
               stdout.path == outfile.path
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => false)
           end
 
           it "should set stderr to the same file as stdout if combine is true" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == outfile.path
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => false, :combine => true)
           end
 
           it "should set stderr to the null device if combine is false" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == null_file
             end.returns(pid)
 
             Puppet::Util.execute('test command', :squelch => false, :combine => false)
           end
         end
       end
     end
 
     describe "after execution" do
       let(:executor) { Puppet.features.microsoft_windows? ? 'execute_windows' : 'execute_posix' }
 
       before :each do
         Process.stubs(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         Puppet::Util.stubs(executor).returns(pid)
       end
 
       it "should wait for the child process to exit" do
         Puppet::Util.stubs(:wait_for_output)
 
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         Puppet::Util.execute('test command')
       end
 
       it "should close the stdin/stdout/stderr files used by the child" do
         stdin = mock 'file', :close
         stdout = mock 'file', :close
         stderr = mock 'file', :close
 
         File.expects(:open).
           times(3).
           returns(stdin).
           then.returns(stdout).
           then.returns(stderr)
 
         Puppet::Util.execute('test command', :squelch => true)
       end
 
       it "should read and return the output if squelch is false" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util.execute('test command').should == "My expected command output"
       end
 
       it "should not read the output if squelch is true" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util.execute('test command', :squelch => true).should == nil
       end
 
       it "should delete the file used for output if squelch is false" do
         stdout = Tempfile.new('test')
         path = stdout.path
         Tempfile.stubs(:new).returns(stdout)
 
         Puppet::Util.execute('test command')
 
         File.should_not be_exist(path)
       end
 
       it "should raise an error if failonfail is true and the child failed" do
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(1)])
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => true)
         }.to raise_error(Puppet::ExecutionFailure, /Execution of 'fail command' returned 1/)
       end
 
       it "should not raise an error if failonfail is false and the child failed" do
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(1)])
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => false)
         }.not_to raise_error
       end
 
       it "should not raise an error if failonfail is true and the child succeeded" do
         Process.expects(:waitpid2).with(pid).returns([pid, process_status(0)])
 
         expect {
           Puppet::Util.execute('fail command', :failonfail => true)
         }.not_to raise_error
       end
     end
   end
 
   describe "#which" do
     let(:base) { File.expand_path('/bin') }
     let(:path) { File.join(base, 'foo') }
 
     before :each do
       FileTest.stubs(:file?).returns false
       FileTest.stubs(:file?).with(path).returns true
 
       FileTest.stubs(:executable?).returns false
       FileTest.stubs(:executable?).with(path).returns true
     end
 
     it "should accept absolute paths" do
       Puppet::Util.which(path).should == path
     end
 
     it "should return nil if no executable found" do
       Puppet::Util.which('doesnotexist').should be_nil
     end
 
     it "should reject directories" do
       Puppet::Util.which(base).should be_nil
     end
 
     describe "on POSIX systems" do
       before :each do
         Puppet.features.stubs(:posix?).returns true
         Puppet.features.stubs(:microsoft_windows?).returns false
       end
 
       it "should walk the search PATH returning the first executable" do
         ENV.stubs(:[]).with('PATH').returns(File.expand_path('/bin'))
 
         Puppet::Util.which('foo').should == path
       end
     end
 
     describe "on Windows systems" do
       let(:path) { File.expand_path(File.join(base, 'foo.CMD')) }
 
       before :each do
         Puppet.features.stubs(:posix?).returns false
         Puppet.features.stubs(:microsoft_windows?).returns true
       end
 
       describe "when a file extension is specified" do
         it "should walk each directory in PATH ignoring PATHEXT" do
           ENV.stubs(:[]).with('PATH').returns(%w[/bar /bin].map{|dir| File.expand_path(dir)}.join(File::PATH_SEPARATOR))
 
           FileTest.expects(:file?).with(File.join(File.expand_path('/bar'), 'foo.CMD')).returns false
 
           ENV.expects(:[]).with('PATHEXT').never
           Puppet::Util.which('foo.CMD').should == path
         end
       end
 
       describe "when a file extension is not specified" do
         it "should walk each extension in PATHEXT until an executable is found" do
           bar = File.expand_path('/bar')
           ENV.stubs(:[]).with('PATH').returns("#{bar}#{File::PATH_SEPARATOR}#{base}")
           ENV.stubs(:[]).with('PATHEXT').returns(".EXE#{File::PATH_SEPARATOR}.CMD")
 
           exts = sequence('extensions')
           FileTest.expects(:file?).in_sequence(exts).with(File.join(bar, 'foo.EXE')).returns false
           FileTest.expects(:file?).in_sequence(exts).with(File.join(bar, 'foo.CMD')).returns false
           FileTest.expects(:file?).in_sequence(exts).with(File.join(base, 'foo.EXE')).returns false
           FileTest.expects(:file?).in_sequence(exts).with(path).returns true
 
           Puppet::Util.which('foo').should == path
         end
 
         it "should walk the default extension path if the environment variable is not defined" do
           ENV.stubs(:[]).with('PATH').returns(base)
           ENV.stubs(:[]).with('PATHEXT').returns(nil)
 
           exts = sequence('extensions')
           %w[.COM .EXE .BAT].each do |ext|
             FileTest.expects(:file?).in_sequence(exts).with(File.join(base, "foo#{ext}")).returns false
           end
           FileTest.expects(:file?).in_sequence(exts).with(path).returns true
 
           Puppet::Util.which('foo').should == path
         end
 
         it "should fall back if no extension matches" do
           ENV.stubs(:[]).with('PATH').returns(base)
           ENV.stubs(:[]).with('PATHEXT').returns(".EXE")
 
           FileTest.stubs(:file?).with(File.join(base, 'foo.EXE')).returns false
           FileTest.stubs(:file?).with(File.join(base, 'foo')).returns true
           FileTest.stubs(:executable?).with(File.join(base, 'foo')).returns true
 
           Puppet::Util.which('foo').should == File.join(base, 'foo')
         end
       end
     end
   end
 
   describe "#binread" do
     let(:contents) { "foo\r\nbar" }
 
     it "should preserve line endings" do
       path = tmpfile('util_binread')
       File.open(path, 'wb') { |f| f.print contents }
 
       Puppet::Util.binread(path).should == contents
     end
 
     it "should raise an error if the file doesn't exist" do
       expect { Puppet::Util.binread('/path/does/not/exist') }.to raise_error(Errno::ENOENT)
     end
   end
 
   context "#replace_file" do
-    subject { Puppet::Util }
-    it { should respond_to :replace_file }
-
-    let :target do
-      target = Tempfile.new("puppet-util-replace-file")
-      target.puts("hello, world")
-      target.flush              # make sure content is on disk.
-      target.fsync rescue nil
-      target.close
-      target
-    end
-
-    it "should fail if no block is given" do
-      expect { subject.replace_file(target.path, 0600) }.to raise_error /block/
-    end
+    describe "on POSIX platforms", :if => Puppet.features.posix? do
+      subject { Puppet::Util }
+      it { should respond_to :replace_file }
 
-    it "should replace a file when invoked" do
-      # Check that our file has the expected content.
-      File.read(target.path).should == "hello, world\n"
+      let :target do
+        target = Tempfile.new("puppet-util-replace-file")
+        target.puts("hello, world")
+        target.flush              # make sure content is on disk.
+        target.fsync rescue nil
+        target.close
+        target
+      end
 
-      # Replace the file.
-      subject.replace_file(target.path, 0600) do |fh|
-        fh.puts "I am the passenger..."
+      it "should fail if no block is given" do
+        expect { subject.replace_file(target.path, 0600) }.to raise_error /block/
       end
 
-      # ...and check the replacement was complete.
-      File.read(target.path).should == "I am the passenger...\n"
-    end
+      it "should replace a file when invoked" do
+        # Check that our file has the expected content.
+        File.read(target.path).should == "hello, world\n"
 
-    [0555, 0600, 0660, 0700, 0770].each do |mode|
-      it "should copy 0#{mode.to_s(8)} permissions from the target file by default" do
-        set_mode(mode, target.path)
+        # Replace the file.
+        subject.replace_file(target.path, 0600) do |fh|
+          fh.puts "I am the passenger..."
+        end
 
-        get_mode(target.path).should == mode
+        # ...and check the replacement was complete.
+        File.read(target.path).should == "I am the passenger...\n"
+      end
 
-        subject.replace_file(target.path, 0000) {|fh| fh.puts "bazam" }
+      [0555, 0600, 0660, 0700, 0770].each do |mode|
+        it "should copy 0#{mode.to_s(8)} permissions from the target file by default" do
+          set_mode(mode, target.path)
 
-        get_mode(target.path).should == mode
-        File.read(target.path).should == "bazam\n"
-      end
-    end
+          get_mode(target.path).should == mode
 
-    it "should copy the permissions of the source file before yielding" do
-      set_mode(0555, target.path)
-      inode = File.stat(target.path).ino unless Puppet.features.microsoft_windows?
+          subject.replace_file(target.path, 0000) {|fh| fh.puts "bazam" }
 
-      yielded = false
-      subject.replace_file(target.path, 0600) do |fh|
-        get_mode(fh.path).should == 0555
-        yielded = true
+          get_mode(target.path).should == mode
+          File.read(target.path).should == "bazam\n"
+        end
       end
-      yielded.should be_true
 
-      # We can't check inode on Windows
-      File.stat(target.path).ino.should_not == inode unless Puppet.features.microsoft_windows?
+      it "should copy the permissions of the source file before yielding" do
+        set_mode(0555, target.path)
+        inode = File.stat(target.path).ino unless Puppet.features.microsoft_windows?
 
-      get_mode(target.path).should == 0555
-    end
+        yielded = false
+        subject.replace_file(target.path, 0600) do |fh|
+          get_mode(fh.path).should == 0555
+          yielded = true
+        end
+        yielded.should be_true
 
-    it "should use the default permissions if the source file doesn't exist" do
-      new_target = target.path + '.foo'
-      File.should_not be_exist(new_target)
+        # We can't check inode on Windows
+        File.stat(target.path).ino.should_not == inode unless Puppet.features.microsoft_windows?
 
-      begin
-        subject.replace_file(new_target, 0555) {|fh| fh.puts "foo" }
-        get_mode(new_target).should == 0555
-      ensure
-        File.unlink(new_target) if File.exists?(new_target)
+        get_mode(target.path).should == 0555
       end
-    end
 
-    it "should not replace the file if an exception is thrown in the block" do
-      yielded = false
-      threw   = false
+      it "should use the default permissions if the source file doesn't exist" do
+        new_target = target.path + '.foo'
+        File.should_not be_exist(new_target)
 
-      begin
-        subject.replace_file(target.path, 0600) do |fh|
-          yielded = true
-          fh.puts "different content written, then..."
-          raise "...throw some random failure"
+        begin
+          subject.replace_file(new_target, 0555) {|fh| fh.puts "foo" }
+          get_mode(new_target).should == 0555
+        ensure
+          File.unlink(new_target) if File.exists?(new_target)
         end
-      rescue Exception => e
-        if e.to_s =~ /some random failure/
-          threw = true
-        else
-          raise
+      end
+
+      it "should not replace the file if an exception is thrown in the block" do
+        yielded = false
+        threw   = false
+
+        begin
+          subject.replace_file(target.path, 0600) do |fh|
+            yielded = true
+            fh.puts "different content written, then..."
+            raise "...throw some random failure"
+          end
+        rescue Exception => e
+          if e.to_s =~ /some random failure/
+            threw = true
+          else
+            raise
+          end
         end
+
+        yielded.should be_true
+        threw.should be_true
+
+        # ...and check the replacement was complete.
+        File.read(target.path).should == "hello, world\n"
       end
+    end
 
-      yielded.should be_true
-      threw.should be_true
+    describe "on Windows platforms" do
+      it "should fail and complain" do
+        Puppet.features.stubs(:microsoft_windows?).returns true
 
-      # ...and check the replacement was complete.
-      File.read(target.path).should == "hello, world\n"
+        expect { Puppet::Util.replace_file("C:/foo", 0644) {} }.to raise_error(Puppet::DevError, "replace_file is non-functional on Windows")
+      end
     end
   end
 end