diff --git a/lib/puppet/type/computer.rb b/lib/puppet/type/computer.rb
index 89a0692bf..7a2c52d53 100644
--- a/lib/puppet/type/computer.rb
+++ b/lib/puppet/type/computer.rb
@@ -1,62 +1,66 @@
 Puppet::Type.newtype(:computer) do
 
   @doc = "Computer object management using DirectoryService
     on OS X.
 
     Note that these are distinctly different kinds of objects to 'hosts',
     as they require a MAC address and can have all sorts of policy attached to
     them.
 
     This provider only manages Computer objects in the local directory service
     domain, not in remote directories.
 
     If you wish to manage `/etc/hosts` file on Mac OS X, then simply use the host
     type as per other platforms.
 
     This type primarily exists to create localhost Computer objects that MCX
-    policy can then be attached to."
+    policy can then be attached to.
+    
+    **Autorequires:** If Puppet is managing the plist file representing a
+    Computer object (located at `/var/db/dslocal/nodes/Default/computers/{name}.plist`),
+    the Computer resource will autorequire it."
 
   # ensurable
 
   # We autorequire the computer object in case it is being managed at the
   # file level by Puppet.
 
   autorequire(:file) do
     if self[:name]
       "/var/db/dslocal/nodes/Default/computers/#{self[:name]}.plist"
     else
       nil
     end
   end
 
   newproperty(:ensure, :parent => Puppet::Property::Ensure) do
     desc "Control the existences of this computer record. Set this attribute to
       `present` to ensure the computer record exists.  Set it to `absent`
       to delete any computer records with this name"
     newvalue(:present) do
       provider.create
     end
 
     newvalue(:absent) do
       provider.delete
     end
   end
 
   newparam(:name) do
     desc "The authoritative 'short' name of the computer record."
     isnamevar
   end
 
   newparam(:realname) do
     desc "The 'long' name of the computer record."
   end
 
   newproperty(:en_address) do
     desc "The MAC address of the primary network interface. Must match en0."
   end
 
   newproperty(:ip_address) do
     desc "The IP Address of the Computer object."
   end
 
 end
diff --git a/lib/puppet/type/exec.rb b/lib/puppet/type/exec.rb
index daa49e223..5ed2b104c 100755
--- a/lib/puppet/type/exec.rb
+++ b/lib/puppet/type/exec.rb
@@ -1,649 +1,651 @@
 module Puppet
   newtype(:exec) do
     include Puppet::Util::Execution
     require 'timeout'
 
     @doc = "Executes external commands.  It is critical that all commands
       executed using this mechanism can be run multiple times without
       harm, i.e., they are *idempotent*.  One useful way to create idempotent
       commands is to use the checks like `creates` to avoid running the
       command unless some condition is met.
 
       Note that you can restrict an `exec` to only run when it receives
       events by using the `refreshonly` parameter; this is a useful way to
       have your configuration respond to events with arbitrary commands.
 
       Note also that if an `exec` receives an event from another resource,
       it will get executed again (or execute the command specified in `refresh`, if there is one).
 
       There is a strong tendency to use `exec` to do whatever work Puppet
       can't already do; while this is obviously acceptable (and unavoidable)
       in the short term, it is highly recommended to migrate work from `exec`
       to native Puppet types as quickly as possible.  If you find that
       you are doing a lot of work with `exec`, please at least notify
       us at Puppet Labs what you are doing, and hopefully we can work with
-      you to get a native resource type for the work you are doing."
+      you to get a native resource type for the work you are doing.
+      
+      **Autorequires:** If Puppet is managing an exec's cwd or the executable file used in an exec's command, the exec resource will autorequire those files. If Puppet is managing the user that an exec should run as, the exec resource will autorequire that user."
 
     require 'open3'
 
     # Create a new check mechanism.  It's basically just a parameter that
     # provides one extra 'check' method.
     def self.newcheck(name, &block)
       @checks ||= {}
 
       check = newparam(name, &block)
       @checks[name] = check
     end
 
     def self.checks
       @checks.keys
     end
 
     newproperty(:returns, :array_matching => :all, :event => :executed_command) do |property|
       include Puppet::Util::Execution
       munge do |value|
         value.to_s
       end
 
       def event_name
         :executed_command
       end
 
       defaultto "0"
 
       attr_reader :output
       desc "The expected return code(s).  An error will be returned if the
         executed command returns something else.  Defaults to 0. Can be
         specified as an array of acceptable return codes or a single value."
 
       # Make output a bit prettier
       def change_to_s(currentvalue, newvalue)
         "executed successfully"
       end
 
       # First verify that all of our checks pass.
       def retrieve
         # Default to somethinng
 
         if @resource.check
           return :notrun
         else
           return self.should
         end
       end
 
       # Actually execute the command.
       def sync
         olddir = nil
 
         # We need a dir to change to, even if it's just the cwd
         dir = self.resource[:cwd] || Dir.pwd
 
         event = :executed_command
         tries = self.resource[:tries]
         try_sleep = self.resource[:try_sleep]
 
         begin
           tries.times do |try|
             # Only add debug messages for tries > 1 to reduce log spam.
             debug("Exec try #{try+1}/#{tries}") if tries > 1
             @output, @status = @resource.run(self.resource[:command])
             break if self.should.include?(@status.exitstatus.to_s)
             if try_sleep > 0 and tries > 1
               debug("Sleeping for #{try_sleep} seconds between tries")
               sleep try_sleep
             end
           end
         rescue Timeout::Error
           self.fail "Command exceeded timeout" % value.inspect
         end
 
         if log = @resource[:logoutput]
           case log
           when :true
             log = @resource[:loglevel]
           when :on_failure
             unless self.should.include?(@status.exitstatus.to_s)
               log = @resource[:loglevel]
             else
               log = :false
             end
           end
           unless log == :false
             @output.split(/\n/).each { |line|
               self.send(log, line)
             }
           end
         end
 
         unless self.should.include?(@status.exitstatus.to_s)
           self.fail("#{self.resource[:command]} returned #{@status.exitstatus} instead of one of [#{self.should.join(",")}]")
         end
 
         event
       end
     end
 
     newparam(:command) do
       isnamevar
       desc "The actual command to execute.  Must either be fully qualified
         or a search path for the command must be provided.  If the command
         succeeds, any output produced will be logged at the instance's
         normal log level (usually `notice`), but if the command fails
         (meaning its return code does not match the specified code) then
         any output is logged at the `err` log level."
     end
 
     newparam(:path) do
       desc "The search path used for command execution.
         Commands must be fully qualified if no path is specified.  Paths
         can be specified as an array or as a colon-separated list."
 
       # Support both arrays and colon-separated fields.
       def value=(*values)
         @value = values.flatten.collect { |val|
           if val =~ /;/ # recognize semi-colon separated paths
             val.split(";")
           elsif val =~ /^\w:[^:]*$/ # heuristic to avoid splitting a driveletter away
             val
           else
             val.split(":")
           end
         }.flatten
       end
     end
 
     newparam(:user) do
       desc "The user to run the command as.  Note that if you
         use this then any error output is not currently captured.  This
         is because of a bug within Ruby.  If you are using Puppet to
         create this user, the exec will automatically require the user,
         as long as it is specified by name."
 
       # Most validation is handled by the SUIDManager class.
       validate do |user|
         self.fail "Only root can execute commands as other users" unless Puppet.features.root?
       end
     end
 
     newparam(:group) do
       desc "The group to run the command as.  This seems to work quite
         haphazardly on different platforms -- it is a platform issue
         not a Ruby or Puppet one, since the same variety exists when
         running commnands as different users in the shell."
       # Validation is handled by the SUIDManager class.
     end
 
     newparam(:cwd) do
       desc "The directory from which to run the command.  If
         this directory does not exist, the command will fail."
 
       validate do |dir|
         unless dir =~ /^#{File::SEPARATOR}/
           self.fail("CWD must be a fully qualified path")
         end
       end
 
       munge do |dir|
         dir = dir[0] if dir.is_a?(Array)
 
         dir
       end
     end
 
     newparam(:logoutput) do
       desc "Whether to log output.  Defaults to logging output at the
         loglevel for the `exec` resource. Use *on_failure* to only
         log the output when the command reports an error.  Values are
         **true**, *false*, *on_failure*, and any legal log level."
 
       newvalues(:true, :false, :on_failure)
     end
 
     newparam(:refresh) do
       desc "How to refresh this command.  By default, the exec is just
         called again when it receives an event from another resource,
         but this parameter allows you to define a different command
         for refreshing."
 
       validate do |command|
         @resource.validatecmd(command)
       end
     end
 
     newparam(:env) do
       desc "This parameter is deprecated. Use 'environment' instead."
 
       munge do |value|
         warning "'env' is deprecated on exec; use 'environment' instead."
         resource[:environment] = value
       end
     end
 
     newparam(:environment) do
       desc "Any additional environment variables you want to set for a
         command.  Note that if you use this to set PATH, it will override
         the `path` attribute.  Multiple environment variables should be
         specified as an array."
 
       validate do |values|
         values = [values] unless values.is_a? Array
         values.each do |value|
           unless value =~ /\w+=/
             raise ArgumentError, "Invalid environment setting '#{value}'"
           end
         end
       end
     end
 
     newparam(:timeout) do
       desc "The maximum time the command should take.  If the command takes
         longer than the timeout, the command is considered to have failed
         and will be stopped.  Use any negative number to disable the timeout.
         The time is specified in seconds."
 
       munge do |value|
         value = value.shift if value.is_a?(Array)
         if value.is_a?(String)
           unless value =~ /^[-\d.]+$/
             raise ArgumentError, "The timeout must be a number."
           end
           Float(value)
         else
           value
         end
       end
 
       defaultto 300
     end
 
     newparam(:tries) do
       desc "The number of times execution of the command should be tried.
         Defaults to '1'. This many attempts will be made to execute
         the command until an acceptable return code is returned.
         Note that the timeout paramater applies to each try rather than
         to the complete set of tries."
 
       munge do |value|
         if value.is_a?(String)
           unless value =~ /^[\d]+$/
             raise ArgumentError, "Tries must be an integer"
           end
           value = Integer(value)
         end
         raise ArgumentError, "Tries must be an integer >= 1" if value < 1
         value
       end
 
       defaultto 1
     end
 
     newparam(:try_sleep) do
       desc "The time to sleep in seconds between 'tries'."
 
       munge do |value|
         if value.is_a?(String)
           unless value =~ /^[-\d.]+$/
             raise ArgumentError, "try_sleep must be a number"
           end
           value = Float(value)
         end
         raise ArgumentError, "try_sleep cannot be a negative number" if value < 0
         value
       end
 
       defaultto 0
     end
 
 
     newcheck(:refreshonly) do
       desc "The command should only be run as a
         refresh mechanism for when a dependent object is changed.  It only
         makes sense to use this option when this command depends on some
         other object; it is useful for triggering an action:
 
             # Pull down the main aliases file
             file { \"/etc/aliases\":
               source => \"puppet://server/module/aliases\"
             }
 
             # Rebuild the database, but only when the file changes
             exec { newaliases:
               path => [\"/usr/bin\", \"/usr/sbin\"],
               subscribe => File[\"/etc/aliases\"],
               refreshonly => true
             }
 
         Note that only `subscribe` and `notify` can trigger actions, not `require`,
         so it only makes sense to use `refreshonly` with `subscribe` or `notify`."
 
       newvalues(:true, :false)
 
       # We always fail this test, because we're only supposed to run
       # on refresh.
       def check(value)
         # We have to invert the values.
         if value == :true
           false
         else
           true
         end
       end
     end
 
     newcheck(:creates) do
       desc "A file that this command creates.  If this
         parameter is provided, then the command will only be run
         if the specified file does not exist:
 
             exec { \"tar xf /my/tar/file.tar\":
               cwd => \"/var/tmp\",
               creates => \"/var/tmp/myfile\",
               path => [\"/usr/bin\", \"/usr/sbin\"]
             }
 
         "
 
       # FIXME if they try to set this and fail, then we should probably
       # fail the entire exec, right?
       validate do |files|
         files = [files] unless files.is_a? Array
 
         files.each do |file|
           self.fail("'creates' must be set to a fully qualified path") unless file
 
           unless file =~ %r{^#{File::SEPARATOR}}
             self.fail "'creates' files must be fully qualified."
           end
         end
       end
 
       # If the file exists, return false (i.e., don't run the command),
       # else return true
       def check(value)
         ! FileTest.exists?(value)
       end
     end
 
     newcheck(:unless) do
       desc "If this parameter is set, then this `exec` will run unless
         the command returns 0.  For example:
 
             exec { \"/bin/echo root >> /usr/lib/cron/cron.allow\":
               path => \"/usr/bin:/usr/sbin:/bin\",
               unless => \"grep root /usr/lib/cron/cron.allow 2>/dev/null\"
             }
 
         This would add `root` to the cron.allow file (on Solaris) unless
         `grep` determines it's already there.
 
         Note that this command follows the same rules as the main command,
         which is to say that it must be fully qualified if the path is not set.
         "
 
       validate do |cmds|
         cmds = [cmds] unless cmds.is_a? Array
 
         cmds.each do |cmd|
           @resource.validatecmd(cmd)
         end
       end
 
       # Return true if the command does not return 0.
       def check(value)
         begin
           output, status = @resource.run(value, true)
         rescue Timeout::Error
           err "Check #{value.inspect} exceeded timeout"
           return false
         end
 
         status.exitstatus != 0
       end
     end
 
     newcheck(:onlyif) do
       desc "If this parameter is set, then this `exec` will only run if
         the command returns 0.  For example:
 
             exec { \"logrotate\":
               path => \"/usr/bin:/usr/sbin:/bin\",
               onlyif => \"test `du /var/log/messages | cut -f1` -gt 100000\"
             }
 
         This would run `logrotate` only if that test returned true.
 
         Note that this command follows the same rules as the main command,
         which is to say that it must be fully qualified if the path is not set.
 
         Also note that onlyif can take an array as its value, e.g.:
 
             onlyif => [\"test -f /tmp/file1\", \"test -f /tmp/file2\"]
 
         This will only run the exec if /all/ conditions in the array return true.
         "
 
       validate do |cmds|
         cmds = [cmds] unless cmds.is_a? Array
 
         cmds.each do |cmd|
           @resource.validatecmd(cmd)
         end
       end
 
       # Return true if the command returns 0.
       def check(value)
         begin
           output, status = @resource.run(value, true)
         rescue Timeout::Error
           err "Check #{value.inspect} exceeded timeout"
           return false
         end
 
         status.exitstatus == 0
       end
     end
 
     # Exec names are not isomorphic with the objects.
     @isomorphic = false
 
     validate do
       validatecmd(self[:command])
     end
 
     # FIXME exec should autorequire any exec that 'creates' our cwd
     autorequire(:file) do
       reqs = []
 
       # Stick the cwd in there if we have it
       reqs << self[:cwd] if self[:cwd]
 
       self[:command].scan(/^(#{File::SEPARATOR}\S+)/) { |str|
         reqs << str
       }
 
       self[:command].scan(/^"([^"]+)"/) { |str|
         reqs << str
       }
 
       [:onlyif, :unless].each { |param|
         next unless tmp = self[param]
 
         tmp = [tmp] unless tmp.is_a? Array
 
         tmp.each do |line|
           # And search the command line for files, adding any we
           # find.  This will also catch the command itself if it's
           # fully qualified.  It might not be a bad idea to add
           # unqualified files, but, well, that's a bit more annoying
           # to do.
           reqs += line.scan(%r{(#{File::SEPARATOR}\S+)})
         end
       }
 
       # For some reason, the += isn't causing a flattening
       reqs.flatten!
 
       reqs
     end
 
     autorequire(:user) do
       # Autorequire users if they are specified by name
       if user = self[:user] and user !~ /^\d+$/
         user
       end
     end
 
     def self.instances
       []
     end
 
     # Verify that we pass all of the checks.  The argument determines whether
     # we skip the :refreshonly check, which is necessary because we now check
     # within refresh
     def check(refreshing = false)
       self.class.checks.each { |check|
         next if refreshing and check == :refreshonly
         if @parameters.include?(check)
           val = @parameters[check].value
           val = [val] unless val.is_a? Array
           val.each do |value|
             return false unless @parameters[check].check(value)
           end
         end
       }
 
       true
     end
 
     # Verify that we have the executable
     def checkexe(cmd)
       exe = extractexe(cmd)
 
       if self[:path]
         if Puppet.features.posix? and !File.exists?(exe)
           withenv :PATH => self[:path].join(File::PATH_SEPARATOR) do
             exe = which(exe) || raise(ArgumentError,"Could not find command '#{exe}'")
           end
         elsif Puppet.features.microsoft_windows? and !File.exists?(exe)
           self[:path].each do |path|
             [".exe", ".ps1", ".bat", ".com", ""].each do |extension|
               file = File.join(path, exe+extension)
               return if File.exists?(file)
             end
           end
         end
       end
 
       raise ArgumentError, "Could not find executable '#{exe}'" unless FileTest.exists?(exe)
       unless FileTest.executable?(exe)
         raise ArgumentError,
           "'#{exe}' is not executable"
       end
     end
 
     def output
       if self.property(:returns).nil?
         return nil
       else
         return self.property(:returns).output
       end
     end
 
     # Run the command, or optionally run a separately-specified command.
     def refresh
       if self.check(true)
         if cmd = self[:refresh]
           self.run(cmd)
         else
           self.property(:returns).sync
         end
       end
     end
 
     # Run a command.
     def run(command, check = false)
       output = nil
       status = nil
 
       dir = nil
 
       checkexe(command)
 
       if dir = self[:cwd]
         unless File.directory?(dir)
           if check
             dir = nil
           else
             self.fail "Working directory '#{dir}' does not exist"
           end
         end
       end
 
       dir ||= Dir.pwd
 
       if check
         debug "Executing check '#{command}'"
       else
         debug "Executing '#{command}'"
       end
       begin
         # Do our chdir
         Dir.chdir(dir) do
           environment = {}
 
           environment[:PATH] = self[:path].join(":") if self[:path]
 
           if envlist = self[:environment]
             envlist = [envlist] unless envlist.is_a? Array
             envlist.each do |setting|
               if setting =~ /^(\w+)=((.|\n)+)$/
                 name = $1
                 value = $2
                 if environment.include? name
                   warning(
                   "Overriding environment setting '#{name}' with '#{value}'"
                   )
                 end
                 environment[name] = value
               else
                 warning "Cannot understand environment setting #{setting.inspect}"
               end
             end
           end
 
           withenv environment do
             Timeout::timeout(self[:timeout]) do
               output, status = Puppet::Util::SUIDManager.run_and_capture(
                 [command], self[:user], self[:group]
               )
             end
             # The shell returns 127 if the command is missing.
             if status.exitstatus == 127
               raise ArgumentError, output
             end
           end
         end
       rescue Errno::ENOENT => detail
         self.fail detail.to_s
       end
 
       return output, status
     end
 
     def validatecmd(cmd)
       exe = extractexe(cmd)
       # if we're not fully qualified, require a path
       self.fail "'#{cmd}' is not qualified and no path was specified. Please qualify the command or specify a path." if File.expand_path(exe) != exe and self[:path].nil?
     end
 
     def extractexe(cmd)
       # easy case: command was quoted
       if cmd =~ /^"([^"]+)"/
         $1
       else
         cmd.split(/ /)[0]
       end
     end
   end
 end
diff --git a/lib/puppet/type/file.rb b/lib/puppet/type/file.rb
index cbb51bbed..e1a4ecbb9 100644
--- a/lib/puppet/type/file.rb
+++ b/lib/puppet/type/file.rb
@@ -1,791 +1,793 @@
 require 'digest/md5'
 require 'cgi'
 require 'etc'
 require 'uri'
 require 'fileutils'
 require 'puppet/network/handler'
 require 'puppet/util/diff'
 require 'puppet/util/checksums'
 require 'puppet/network/client'
 require 'puppet/util/backups'
 
 Puppet::Type.newtype(:file) do
   include Puppet::Util::MethodHelper
   include Puppet::Util::Checksums
   include Puppet::Util::Backups
   @doc = "Manages local files, including setting ownership and
     permissions, creation of both files and directories, and
     retrieving entire files from remote servers.  As Puppet matures, it
     expected that the `file` resource will be used less and less to
     manage content, and instead native resources will be used to do so.
 
     If you find that you are often copying files in from a central
     location, rather than using native resources, please contact
     Puppet Labs and we can hopefully work with you to develop a
-    native resource to support what you are doing."
+    native resource to support what you are doing.
+    
+    **Autorequires:** If Puppet is managing the user or group that owns a file, the file resource will autorequire them. If Puppet is managing any parent directories of a file, the file resource will autorequire them."
 
   def self.title_patterns
     [ [ /^(.*?)\/*\Z/m, [ [ :path, lambda{|x| x} ] ] ] ]
   end
 
   newparam(:path) do
     desc "The path to the file to manage.  Must be fully qualified."
     isnamevar
 
     validate do |value|
       # accept various path syntaxes: lone slash, posix, win32, unc
       unless (Puppet.features.posix? and value =~ /^\//) or (Puppet.features.microsoft_windows? and (value =~ /^.:\// or value =~ /^\/\/[^\/]+\/[^\/]+/))
         fail Puppet::Error, "File paths must be fully qualified, not '#{value}'"
       end
     end
 
     # convert the current path in an index into the collection and the last
     # path name. The aim is to use less storage for all common paths in a hierarchy
     munge do |value|
       path, name = File.split(value.gsub(/\/+/,'/'))
       { :index => Puppet::FileCollection.collection.index(path), :name => name }
     end
 
     # and the reverse
     unmunge do |value|
       basedir = Puppet::FileCollection.collection.path(value[:index])
       # a lone slash as :name indicates a root dir on windows
       if value[:name] == '/'
         basedir
       else
         File.join( basedir, value[:name] )
       end
     end
   end
 
   newparam(:backup) do
     desc "Whether files should be backed up before
       being replaced.  The preferred method of backing files up is via
       a `filebucket`, which stores files by their MD5 sums and allows
       easy retrieval without littering directories with backups.  You
       can specify a local filebucket or a network-accessible
       server-based filebucket by setting `backup => bucket-name`.
       Alternatively, if you specify any value that begins with a `.`
       (e.g., `.puppet-bak`), then Puppet will use copy the file in
       the same directory with that value as the extension of the
       backup. Setting `backup => false` disables all backups of the
       file in question.
 
       Puppet automatically creates a local filebucket named `puppet` and
       defaults to backing up there.  To use a server-based filebucket,
       you must specify one in your configuration
 
             filebucket { main:
               server => puppet
             }
 
       The `puppet master` daemon creates a filebucket by default,
       so you can usually back up to your main server with this
       configuration.  Once you've described the bucket in your
       configuration, you can use it in any file
 
             file { \"/my/file\":
               source => \"/path/in/nfs/or/something\",
               backup => main
             }
 
       This will back the file up to the central server.
 
       At this point, the benefits of using a filebucket are that you do not
       have backup files lying around on each of your machines, a given
       version of a file is only backed up once, and you can restore
       any given file manually, no matter how old.  Eventually,
       transactional support will be able to automatically restore
       filebucketed files.
       "
 
     defaultto "puppet"
 
     munge do |value|
       # I don't really know how this is happening.
       value = value.shift if value.is_a?(Array)
 
       case value
       when false, "false", :false
         false
       when true, "true", ".puppet-bak", :true
         ".puppet-bak"
       when String
         value
       else
         self.fail "Invalid backup type #{value.inspect}"
       end
     end
   end
 
   newparam(:recurse) do
     desc "Whether and how deeply to do recursive
       management."
 
     newvalues(:true, :false, :inf, :remote, /^[0-9]+$/)
 
     # Replace the validation so that we allow numbers in
     # addition to string representations of them.
     validate { |arg| }
     munge do |value|
       newval = super(value)
       case newval
       when :true, :inf; true
       when :false; false
       when :remote; :remote
       when Integer, Fixnum, Bignum
         self.warning "Setting recursion depth with the recurse parameter is now deprecated, please use recurselimit"
 
         # recurse == 0 means no recursion
         return false if value == 0
 
         resource[:recurselimit] = value
         true
       when /^\d+$/
         self.warning "Setting recursion depth with the recurse parameter is now deprecated, please use recurselimit"
         value = Integer(value)
 
         # recurse == 0 means no recursion
         return false if value == 0
 
         resource[:recurselimit] = value
         true
       else
         self.fail "Invalid recurse value #{value.inspect}"
       end
     end
   end
 
   newparam(:recurselimit) do
     desc "How deeply to do recursive management."
 
     newvalues(/^[0-9]+$/)
 
     munge do |value|
       newval = super(value)
       case newval
       when Integer, Fixnum, Bignum; value
       when /^\d+$/; Integer(value)
       else
         self.fail "Invalid recurselimit value #{value.inspect}"
       end
     end
   end
 
   newparam(:replace, :boolean => true) do
     desc "Whether or not to replace a file that is
       sourced but exists.  This is useful for using file sources
       purely for initialization."
     newvalues(:true, :false)
     aliasvalue(:yes, :true)
     aliasvalue(:no, :false)
     defaultto :true
   end
 
   newparam(:force, :boolean => true) do
     desc "Force the file operation.  Currently only used when replacing
       directories with links."
     newvalues(:true, :false)
     defaultto false
   end
 
   newparam(:ignore) do
     desc "A parameter which omits action on files matching
       specified patterns during recursion.  Uses Ruby's builtin globbing
       engine, so shell metacharacters are fully supported, e.g. `[a-z]*`.
       Matches that would descend into the directory structure are ignored,
       e.g., `*/*`."
 
     validate do |value|
       unless value.is_a?(Array) or value.is_a?(String) or value == false
         self.devfail "Ignore must be a string or an Array"
       end
     end
   end
 
   newparam(:links) do
     desc "How to handle links during file actions.  During file copying,
       `follow` will copy the target file instead of the link, `manage`
       will copy the link itself, and `ignore` will just pass it by.
       When not copying, `manage` and `ignore` behave equivalently
       (because you cannot really ignore links entirely during local recursion), and `follow` will manage the file to which the
       link points."
 
     newvalues(:follow, :manage)
 
     defaultto :manage
   end
 
   newparam(:purge, :boolean => true) do
     desc "Whether unmanaged files should be purged.  If you have a filebucket
       configured the purged files will be uploaded, but if you do not,
       this will destroy data.  Only use this option for generated
       files unless you really know what you are doing.  This option only
       makes sense when recursively managing directories.
 
       Note that when using `purge` with `source`, Puppet will purge any files
       that are not on the remote system."
 
     defaultto :false
 
     newvalues(:true, :false)
   end
 
   newparam(:sourceselect) do
     desc "Whether to copy all valid sources, or just the first one.  This parameter
       is only used in recursive copies; by default, the first valid source is the
       only one used as a recursive source, but if this parameter is set to `all`,
       then all valid sources will have all of their contents copied to the local host,
       and for sources that have the same file, the source earlier in the list will
       be used."
 
     defaultto :first
 
     newvalues(:first, :all)
   end
 
   # Autorequire any parent directories.
   autorequire(:file) do
     basedir = File.dirname(self[:path])
     if basedir != self[:path]
       basedir
     else
       nil
     end
   end
 
   # Autorequire the owner and group of the file.
   {:user => :owner, :group => :group}.each do |type, property|
     autorequire(type) do
       if @parameters.include?(property)
         # The user/group property automatically converts to IDs
         next unless should = @parameters[property].shouldorig
         val = should[0]
         if val.is_a?(Integer) or val =~ /^\d+$/
           nil
         else
           val
         end
       end
     end
   end
 
   CREATORS = [:content, :source, :target]
   SOURCE_ONLY_CHECKSUMS = [:none, :ctime, :mtime]
 
   validate do
     creator_count = 0
     CREATORS.each do |param|
       creator_count += 1 if self.should(param)
     end
     creator_count += 1 if @parameters.include?(:source)
     self.fail "You cannot specify more than one of #{CREATORS.collect { |p| p.to_s}.join(", ")}" if creator_count > 1
 
     self.fail "You cannot specify a remote recursion without a source" if !self[:source] and self[:recurse] == :remote
 
     self.fail "You cannot specify source when using checksum 'none'" if self[:checksum] == :none && !self[:source].nil?
 
     SOURCE_ONLY_CHECKSUMS.each do |checksum_type|
       self.fail "You cannot specify content when using checksum '#{checksum_type}'" if self[:checksum] == checksum_type && !self[:content].nil?
     end
 
     self.warning "Possible error: recurselimit is set but not recurse, no recursion will happen" if !self[:recurse] and self[:recurselimit]
   end
 
   def self.[](path)
     return nil unless path
     super(path.gsub(/\/+/, '/').sub(/\/$/, ''))
   end
 
   def self.instances(base = '/')
     return self.new(:name => base, :recurse => true, :recurselimit => 1, :audit => :all).recurse_local.values
   end
 
   @depthfirst = false
 
   # Determine the user to write files as.
   def asuser
     if self.should(:owner) and ! self.should(:owner).is_a?(Symbol)
       writeable = Puppet::Util::SUIDManager.asuser(self.should(:owner)) {
         FileTest.writable?(File.dirname(self[:path]))
       }
 
       # If the parent directory is writeable, then we execute
       # as the user in question.  Otherwise we'll rely on
       # the 'owner' property to do things.
       asuser = self.should(:owner) if writeable
     end
 
     asuser
   end
 
   def bucket
     return @bucket if @bucket
 
     backup = self[:backup]
     return nil unless backup
     return nil if backup =~ /^\./
 
     unless catalog or backup == "puppet"
       fail "Can not find filebucket for backups without a catalog"
     end
 
     unless catalog and filebucket = catalog.resource(:filebucket, backup) or backup == "puppet"
       fail "Could not find filebucket #{backup} specified in backup"
     end
 
     return default_bucket unless filebucket
 
     @bucket = filebucket.bucket
 
     @bucket
   end
 
   def default_bucket
     Puppet::Type.type(:filebucket).mkdefaultbucket.bucket
   end
 
   # Does the file currently exist?  Just checks for whether
   # we have a stat
   def exist?
     stat ? true : false
   end
 
   # We have to do some extra finishing, to retrieve our bucket if
   # there is one.
   def finish
     # Look up our bucket, if there is one
     bucket
     super
   end
 
   # Create any children via recursion or whatever.
   def eval_generate
     return [] unless self.recurse?
 
     recurse
     #recurse.reject do |resource|
     #    catalog.resource(:file, resource[:path])
     #end.each do |child|
     #    catalog.add_resource child
     #    catalog.relationship_graph.add_edge self, child
     #end
   end
 
   def flush
     # We want to make sure we retrieve metadata anew on each transaction.
     @parameters.each do |name, param|
       param.flush if param.respond_to?(:flush)
     end
     @stat = nil
   end
 
   def initialize(hash)
     # Used for caching clients
     @clients = {}
 
     super
 
     # If they've specified a source, we get our 'should' values
     # from it.
     unless self[:ensure]
       if self[:target]
         self[:ensure] = :symlink
       elsif self[:content]
         self[:ensure] = :file
       end
     end
 
     @stat = nil
   end
 
   # Configure discovered resources to be purged.
   def mark_children_for_purging(children)
     children.each do |name, child|
       next if child[:source]
       child[:ensure] = :absent
     end
   end
 
   # Create a new file or directory object as a child to the current
   # object.
   def newchild(path)
     full_path = File.join(self[:path], path)
 
     # Add some new values to our original arguments -- these are the ones
     # set at initialization.  We specifically want to exclude any param
     # values set by the :source property or any default values.
     # LAK:NOTE This is kind of silly, because the whole point here is that
     # the values set at initialization should live as long as the resource
     # but values set by default or by :source should only live for the transaction
     # or so.  Unfortunately, we don't have a straightforward way to manage
     # the different lifetimes of this data, so we kludge it like this.
     # The right-side hash wins in the merge.
     options = @original_parameters.merge(:path => full_path).reject { |param, value| value.nil? }
 
     # These should never be passed to our children.
     [:parent, :ensure, :recurse, :recurselimit, :target, :alias, :source].each do |param|
       options.delete(param) if options.include?(param)
     end
 
     self.class.new(options)
   end
 
   # Files handle paths specially, because they just lengthen their
   # path names, rather than including the full parent's title each
   # time.
   def pathbuilder
     # We specifically need to call the method here, so it looks
     # up our parent in the catalog graph.
     if parent = parent()
       # We only need to behave specially when our parent is also
       # a file
       if parent.is_a?(self.class)
         # Remove the parent file name
         list = parent.pathbuilder
         list.pop # remove the parent's path info
         return list << self.ref
       else
         return super
       end
     else
       return [self.ref]
     end
   end
 
   # Should we be purging?
   def purge?
     @parameters.include?(:purge) and (self[:purge] == :true or self[:purge] == "true")
   end
 
   # Recursively generate a list of file resources, which will
   # be used to copy remote files, manage local files, and/or make links
   # to map to another directory.
   def recurse
     children = {}
     children = recurse_local if self[:recurse] != :remote
 
     if self[:target]
       recurse_link(children)
     elsif self[:source]
       recurse_remote(children)
     end
 
     # If we're purging resources, then delete any resource that isn't on the
     # remote system.
     mark_children_for_purging(children) if self.purge?
 
     result = children.values.sort { |a, b| a[:path] <=> b[:path] }
     remove_less_specific_files(result)
   end
 
   # This is to fix bug #2296, where two files recurse over the same
   # set of files.  It's a rare case, and when it does happen you're
   # not likely to have many actual conflicts, which is good, because
   # this is a pretty inefficient implementation.
   def remove_less_specific_files(files)
     mypath = self[:path].split(File::Separator)
     other_paths = catalog.vertices.
       select  { |r| r.is_a?(self.class) and r[:path] != self[:path] }.
       collect { |r| r[:path].split(File::Separator) }.
       select  { |p| p[0,mypath.length]  == mypath }
 
     return files if other_paths.empty?
 
     files.reject { |file|
       path = file[:path].split(File::Separator)
       other_paths.any? { |p| path[0,p.length] == p }
       }
   end
 
   # A simple method for determining whether we should be recursing.
   def recurse?
     return false unless @parameters.include?(:recurse)
 
     val = @parameters[:recurse].value
 
     !!(val and (val == true or val == :remote))
   end
 
   # Recurse the target of the link.
   def recurse_link(children)
     perform_recursion(self[:target]).each do |meta|
       if meta.relative_path == "."
         self[:ensure] = :directory
         next
       end
 
       children[meta.relative_path] ||= newchild(meta.relative_path)
       if meta.ftype == "directory"
         children[meta.relative_path][:ensure] = :directory
       else
         children[meta.relative_path][:ensure] = :link
         children[meta.relative_path][:target] = meta.full_path
       end
     end
     children
   end
 
   # Recurse the file itself, returning a Metadata instance for every found file.
   def recurse_local
     result = perform_recursion(self[:path])
     return {} unless result
     result.inject({}) do |hash, meta|
       next hash if meta.relative_path == "."
 
       hash[meta.relative_path] = newchild(meta.relative_path)
       hash
     end
   end
 
   # Recurse against our remote file.
   def recurse_remote(children)
     sourceselect = self[:sourceselect]
 
     total = self[:source].collect do |source|
       next unless result = perform_recursion(source)
       return if top = result.find { |r| r.relative_path == "." } and top.ftype != "directory"
       result.each { |data| data.source = "#{source}/#{data.relative_path}" }
       break result if result and ! result.empty? and sourceselect == :first
       result
     end.flatten
 
     # This only happens if we have sourceselect == :all
     unless sourceselect == :first
       found = []
       total.reject! do |data|
         result = found.include?(data.relative_path)
         found << data.relative_path unless found.include?(data.relative_path)
         result
       end
     end
 
     total.each do |meta|
       if meta.relative_path == "."
         parameter(:source).metadata = meta
         next
       end
       children[meta.relative_path] ||= newchild(meta.relative_path)
       children[meta.relative_path][:source] = meta.source
       children[meta.relative_path][:checksum] = :md5 if meta.ftype == "file"
 
       children[meta.relative_path].parameter(:source).metadata = meta
     end
 
     children
   end
 
   def perform_recursion(path)
 
     Puppet::FileServing::Metadata.search(
 
       path,
       :links => self[:links],
       :recurse => (self[:recurse] == :remote ? true : self[:recurse]),
 
       :recurselimit => self[:recurselimit],
       :ignore => self[:ignore],
       :checksum_type => (self[:source] || self[:content]) ? self[:checksum] : :none
     )
   end
 
   # Remove any existing data.  This is only used when dealing with
   # links or directories.
   def remove_existing(should)
     return unless s = stat
 
     self.fail "Could not back up; will not replace" unless perform_backup
 
     unless should.to_s == "link"
       return if s.ftype.to_s == should.to_s
     end
 
     case s.ftype
     when "directory"
       if self[:force] == :true
         debug "Removing existing directory for replacement with #{should}"
         FileUtils.rmtree(self[:path])
       else
         notice "Not removing directory; use 'force' to override"
       end
     when "link", "file"
       debug "Removing existing #{s.ftype} for replacement with #{should}"
       File.unlink(self[:path])
     else
       self.fail "Could not back up files of type #{s.ftype}"
     end
     expire
   end
 
   def retrieve
     if source = parameter(:source)
       source.copy_source_values
     end
     super
   end
 
   # Set the checksum, from another property.  There are multiple
   # properties that modify the contents of a file, and they need the
   # ability to make sure that the checksum value is in sync.
   def setchecksum(sum = nil)
     if @parameters.include? :checksum
       if sum
         @parameters[:checksum].checksum = sum
       else
         # If they didn't pass in a sum, then tell checksum to
         # figure it out.
         currentvalue = @parameters[:checksum].retrieve
         @parameters[:checksum].checksum = currentvalue
       end
     end
   end
 
   # Should this thing be a normal file?  This is a relatively complex
   # way of determining whether we're trying to create a normal file,
   # and it's here so that the logic isn't visible in the content property.
   def should_be_file?
     return true if self[:ensure] == :file
 
     # I.e., it's set to something like "directory"
     return false if e = self[:ensure] and e != :present
 
     # The user doesn't really care, apparently
     if self[:ensure] == :present
       return true unless s = stat
       return(s.ftype == "file" ? true : false)
     end
 
     # If we've gotten here, then :ensure isn't set
     return true if self[:content]
     return true if stat and stat.ftype == "file"
     false
   end
 
   # Stat our file.  Depending on the value of the 'links' attribute, we
   # use either 'stat' or 'lstat', and we expect the properties to use the
   # resulting stat object accordingly (mostly by testing the 'ftype'
   # value).
   cached_attr(:stat) do
     method = :stat
 
     # Files are the only types that support links
     if (self.class.name == :file and self[:links] != :follow) or self.class.name == :tidy
       method = :lstat
     end
     path = self[:path]
 
     begin
       File.send(method, self[:path])
     rescue Errno::ENOENT => error
       return nil
     rescue Errno::EACCES => error
       warning "Could not stat; permission denied"
       return nil
     end
   end
 
   # We have to hack this just a little bit, because otherwise we'll get
   # an error when the target and the contents are created as properties on
   # the far side.
   def to_trans(retrieve = true)
     obj = super
     obj.delete(:target) if obj[:target] == :notlink
     obj
   end
 
   # Write out the file.  Requires the property name for logging.
   # Write will be done by the content property, along with checksum computation
   def write(property)
     remove_existing(:file)
 
     use_temporary_file = write_temporary_file?
     if use_temporary_file
       path = "#{self[:path]}.puppettmp_#{rand(10000)}"
       path = "#{self[:path]}.puppettmp_#{rand(10000)}" while File.exists?(path) or File.symlink?(path)
     else
       path = self[:path]
     end
 
     mode = self.should(:mode) # might be nil
     umask = mode ? 000 : 022
     mode_int = mode ? mode.to_i(8) : nil
 
     content_checksum = Puppet::Util.withumask(umask) { File.open(path, 'w', mode_int ) { |f| write_content(f) } }
 
     # And put our new file in place
     if use_temporary_file # This is only not true when our file is empty.
       begin
         fail_if_checksum_is_wrong(path, content_checksum) if validate_checksum?
         File.rename(path, self[:path])
       rescue => detail
         fail "Could not rename temporary file #{path} to #{self[:path]}: #{detail}"
       ensure
         # Make sure the created file gets removed
         File.unlink(path) if FileTest.exists?(path)
       end
     end
 
     # make sure all of the modes are actually correct
     property_fix
 
   end
 
   private
 
   # Should we validate the checksum of the file we're writing?
   def validate_checksum?
     self[:checksum] !~ /time/
   end
 
   # Make sure the file we wrote out is what we think it is.
   def fail_if_checksum_is_wrong(path, content_checksum)
     newsum = parameter(:checksum).sum_file(path)
     return if [:absent, nil, content_checksum].include?(newsum)
 
     self.fail "File written to disk did not match checksum; discarding changes (#{content_checksum} vs #{newsum})"
   end
 
   # write the current content. Note that if there is no content property
   # simply opening the file with 'w' as done in write is enough to truncate
   # or write an empty length file.
   def write_content(file)
     (content = property(:content)) && content.write(file)
   end
 
   private
 
   def write_temporary_file?
     # unfortunately we don't know the source file size before fetching it
     # so let's assume the file won't be empty
     (c = property(:content) and c.length) || (s = @parameters[:source] and 1)
   end
 
   # There are some cases where all of the work does not get done on
   # file creation/modification, so we have to do some extra checking.
   def property_fix
     properties.each do |thing|
       next unless [:mode, :owner, :group, :seluser, :selrole, :seltype, :selrange].include?(thing.name)
 
       # Make sure we get a new stat objct
       expire
       currentvalue = thing.retrieve
       thing.sync unless thing.safe_insync?(currentvalue)
     end
   end
 end
 
 # We put all of the properties in separate files, because there are so many
 # of them.  The order these are loaded is important, because it determines
 # the order they are in the property lit.
 require 'puppet/type/file/checksum'
 require 'puppet/type/file/content'     # can create the file
 require 'puppet/type/file/source'      # can create the file
 require 'puppet/type/file/target'      # creates a different type of file
 require 'puppet/type/file/ensure'      # can create the file
 require 'puppet/type/file/owner'
 require 'puppet/type/file/group'
 require 'puppet/type/file/mode'
 require 'puppet/type/file/type'
 require 'puppet/type/file/selcontext'  # SELinux file context
 require 'puppet/type/file/ctime'
 require 'puppet/type/file/mtime'
diff --git a/lib/puppet/type/macauthorization.rb b/lib/puppet/type/macauthorization.rb
index ef6fbb6c1..e89aa7c89 100644
--- a/lib/puppet/type/macauthorization.rb
+++ b/lib/puppet/type/macauthorization.rb
@@ -1,163 +1,166 @@
 Puppet::Type.newtype(:macauthorization) do
 
   @doc = "Manage the Mac OS X authorization database.
-    See the [Apple developer site](http://developer.apple.com/documentation/Security/Conceptual/Security_Overview/Security_Services/chapter_4_section_5.html) for more information."
+    See the [Apple developer site](http://developer.apple.com/documentation/Security/Conceptual/Security_Overview/Security_Services/chapter_4_section_5.html) for more information.
+    
+    **Autorequires:** If Puppet is managing the `/etc/authorization` file, each
+    macauthorization resource will autorequire it."
 
   ensurable
 
   autorequire(:file) do
     ["/etc/authorization"]
   end
 
   def munge_boolean(value)
     case value
     when true, "true", :true
       :true
     when false, "false", :false
       :false
     else
       fail("munge_boolean only takes booleans")
     end
   end
 
   def munge_integer(value)
       Integer(value)
   rescue ArgumentError
       fail("munge_integer only takes integers")
   end
 
   newparam(:name) do
     desc "The name of the right or rule to be managed.
     Corresponds to 'key' in Authorization Services. The key is the name
     of a rule. A key uses the same naming conventions as a right. The
     Security Server uses a rule’s key to match the rule with a right.
     Wildcard keys end with a ‘.’. The generic rule has an empty key value.
     Any rights that do not match a specific rule use the generic rule."
 
     isnamevar
   end
 
   newproperty(:auth_type) do
     desc "type - can be a 'right' or a 'rule'. 'comment' has not yet been
     implemented."
 
     newvalue(:right)
     newvalue(:rule)
     # newvalue(:comment)  # not yet implemented.
   end
 
   newproperty(:allow_root, :boolean => true) do
     desc "Corresponds to 'allow-root' in the authorization store, renamed
     due to hyphens being problematic. Specifies whether a right should be
     allowed automatically if the requesting process is running with
     uid == 0.  AuthorizationServices defaults this attribute to false if
     not specified"
 
     newvalue(:true)
     newvalue(:false)
 
     munge do |value|
       @resource.munge_boolean(value)
     end
   end
 
   newproperty(:authenticate_user, :boolean => true) do
     desc "Corresponds to 'authenticate-user' in the authorization store,
     renamed due to hyphens being problematic."
 
     newvalue(:true)
     newvalue(:false)
 
     munge do |value|
       @resource.munge_boolean(value)
     end
   end
 
   newproperty(:auth_class) do
     desc "Corresponds to 'class' in the authorization store, renamed due
     to 'class' being a reserved word."
 
     newvalue(:user)
     newvalue(:'evaluate-mechanisms')
     newvalue(:allow)
     newvalue(:deny)
     newvalue(:rule)
   end
 
   newproperty(:comment) do
     desc "The 'comment' attribute for authorization resources."
   end
 
   newproperty(:group) do
     desc "The user must authenticate as a member of this group. This
     attribute can be set to any one group."
   end
 
   newproperty(:k_of_n) do
     desc "k-of-n describes how large a subset of rule mechanisms must
     succeed for successful authentication. If there are 'n' mechanisms,
     then 'k' (the integer value of this parameter) mechanisms must succeed.
     The most common setting for this parameter is '1'. If k-of-n is not
     set, then 'n-of-n' mechanisms must succeed."
 
     munge do |value|
       @resource.munge_integer(value)
     end
   end
 
   newproperty(:mechanisms, :array_matching => :all) do
     desc "an array of suitable mechanisms."
   end
 
   newproperty(:rule, :array_matching => :all) do
     desc "The rule(s) that this right refers to."
   end
 
   newproperty(:session_owner, :boolean => true) do
     desc "Corresponds to 'session-owner' in the authorization store,
     renamed due to hyphens being problematic.  Whether the session owner
     automatically matches this rule or right."
 
     newvalue(:true)
     newvalue(:false)
 
     munge do |value|
       @resource.munge_boolean(value)
     end
   end
 
   newproperty(:shared, :boolean => true) do
     desc "If this is set to true, then the Security Server marks the
     credentials used to gain this right as shared. The Security Server
     may use any shared credentials to authorize this right. For maximum
     security, set sharing to false so credentials stored by the Security
     Server for one application may not be used by another application."
 
     newvalue(:true)
     newvalue(:false)
 
     munge do |value|
       @resource.munge_boolean(value)
     end
   end
 
   newproperty(:timeout) do
     desc "The credential used by this rule expires in the specified
     number of seconds. For maximum security where the user must
     authenticate every time, set the timeout to 0. For minimum security,
     remove the timeout attribute so the user authenticates only once per
     session."
 
     munge do |value|
       @resource.munge_integer(value)
     end
   end
 
   newproperty(:tries) do
     desc "The number of tries allowed."
     munge do |value|
       @resource.munge_integer(value)
     end
   end
 
 end
diff --git a/lib/puppet/type/mcx.rb b/lib/puppet/type/mcx.rb
index 4f0a6c3c5..07c9348dd 100644
--- a/lib/puppet/type/mcx.rb
+++ b/lib/puppet/type/mcx.rb
@@ -1,115 +1,118 @@
 #--
 # Copyright (C) 2008 Jeffrey J McCune.
 
 # This program and entire repository is free software; you can
 # redistribute it and/or modify it under the terms of the GNU
 # General Public License as published by the Free Software
 # Foundation; either version 2 of the License, or any later version.
 
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 
 # Author: Jeff McCune <mccune.jeff@gmail.com>
 
 Puppet::Type.newtype(:mcx) do
 
   @doc = "MCX object management using DirectoryService on OS X.
 
 The default provider of this type merely manages the XML plist as
 reported by the dscl -mcxexport command.  This is similar to the
 content property of the file type in Puppet.
 
 The recommended method of using this type is to use Work Group Manager
 to manage users and groups on the local computer, record the resulting
-puppet manifest using the command 'ralsh mcx' then deploying this
+puppet manifest using the command `puppet resource mcx`, then deploy it
 to other machines.
+
+**Autorequires:** If Puppet is managing the user, group, or computer that these
+MCX settings refer to, the MCX resource will autorequire that user, group, or computer.
 "
   feature :manages_content, \
     "The provider can manage MCXSettings as a string.",
     :methods => [:content, :content=]
 
   ensurable do
     desc "Create or remove the MCX setting."
 
     newvalue(:present) do
       provider.create
     end
 
     newvalue(:absent) do
       provider.destroy
     end
 
   end
 
   newparam(:name) do
     desc "The name of the resource being managed.
     The default naming convention follows Directory Service paths:
 
         /Computers/localhost
         /Groups/admin
         /Users/localadmin
 
     The `ds_type` and `ds_name` type parameters are not necessary if the
     default naming convention is followed."
     isnamevar
   end
 
   newparam(:ds_type) do
 
     desc "The DirectoryService type this MCX setting attaches to."
 
     newvalues(:user, :group, :computer, :computerlist)
 
   end
 
   newparam(:ds_name) do
     desc "The name to attach the MCX Setting to.
     e.g. 'localhost' when ds_type => computer. This setting is not
     required, as it may be parsed so long as the resource name is
     parseable.  e.g. /Groups/admin where 'group' is the dstype."
   end
 
   newproperty(:content, :required_features => :manages_content) do
     desc "The XML Plist.  The value of MCXSettings in DirectoryService.
     This is the standard output from the system command:
         
         dscl localhost -mcxexport /Local/Default/<ds_type>/ds_name
     
     Note that `ds_type` is capitalized and plural in the dscl command."
   end
 
   # JJM Yes, this is not DRY at all.  Because of the code blocks
   # autorequire must be done this way.  I think.
 
   def setup_autorequire(type)
     # value returns a Symbol
     name = value(:name)
     ds_type = value(:ds_type)
     ds_name = value(:ds_name)
     if ds_type == type
       rval = [ ds_name.to_s ]
     else
       rval = [ ]
     end
     rval
   end
 
   autorequire(:user) do
     setup_autorequire(:user)
   end
 
   autorequire(:group) do
     setup_autorequire(:group)
   end
 
   autorequire(:computer) do
     setup_autorequire(:computer)
   end
 
 end
diff --git a/lib/puppet/type/package.rb b/lib/puppet/type/package.rb
index d73d90dff..1222a5319 100644
--- a/lib/puppet/type/package.rb
+++ b/lib/puppet/type/package.rb
@@ -1,319 +1,323 @@
 # Define the different packaging systems.  Each package system is implemented
 # in a module, which then gets used to individually extend each package object.
 # This allows packages to exist on the same machine using different packaging
 # systems.
 
 module Puppet
   newtype(:package) do
     @doc = "Manage packages.  There is a basic dichotomy in package
       support right now:  Some package types (e.g., yum and apt) can
       retrieve their own package files, while others (e.g., rpm and sun) cannot.  For those package formats that cannot retrieve
       their own files, you can use the `source` parameter to point to
       the correct file.
 
       Puppet will automatically guess the packaging format that you are
       using based on the platform you are on, but you can override it
       using the `provider` parameter; each provider defines what it
       requires in order to function, and you must meet those requirements
-      to use a given provider."
+      to use a given provider.
+      
+      **Autorequires:** If Puppet is managing the files specified as a package's
+      `adminfile`, `responsefile`, or `source`, the package resource will autorequire
+      those files."
 
     feature :installable, "The provider can install packages.",
       :methods => [:install]
     feature :uninstallable, "The provider can uninstall packages.",
       :methods => [:uninstall]
     feature :upgradeable, "The provider can upgrade to the latest version of a
         package.  This feature is used by specifying `latest` as the
         desired value for the package.",
       :methods => [:update, :latest]
     feature :purgeable, "The provider can purge packages.  This generally means
         that all traces of the package are removed, including
         existing configuration files.  This feature is thus destructive
         and should be used with the utmost care.",
       :methods => [:purge]
     feature :versionable, "The provider is capable of interrogating the
         package database for installed version(s), and can select
         which out of a set of available versions of a package to
         install if asked."
     feature :holdable, "The provider is capable of placing packages on hold
         such that they are not automatically upgraded as a result of
         other package dependencies unless explicit action is taken by
         a user or another package. Held is considered a superset of
         installed.",
       :methods => [:hold]
 
     ensurable do
       desc "What state the package should be in.
         *latest* only makes sense for those packaging formats that can
         retrieve new packages on their own and will throw an error on
         those that cannot.  For those packaging systems that allow you
         to specify package versions, specify them here.  Similarly,
         *purged* is only useful for packaging systems that support
         the notion of managing configuration files separately from
         'normal' system files."
 
       attr_accessor :latest
 
       newvalue(:present, :event => :package_installed) do
         provider.install
       end
 
       newvalue(:absent, :event => :package_removed) do
         provider.uninstall
       end
 
       newvalue(:purged, :event => :package_purged, :required_features => :purgeable) do
         provider.purge
       end
 
       newvalue(:held, :event => :package_held, :required_features => :holdable) do
         provider.hold
       end
 
       # Alias the 'present' value.
       aliasvalue(:installed, :present)
 
       newvalue(:latest, :required_features => :upgradeable) do
         # Because yum always exits with a 0 exit code, there's a retrieve
         # in the "install" method.  So, check the current state now,
         # to compare against later.
         current = self.retrieve
         begin
           provider.update
         rescue => detail
           self.fail "Could not update: #{detail}"
         end
 
         if current == :absent
           :package_installed
         else
           :package_changed
         end
       end
 
       newvalue(/./, :required_features => :versionable) do
         begin
           provider.install
         rescue => detail
           self.fail "Could not update: #{detail}"
         end
 
         if self.retrieve == :absent
           :package_installed
         else
           :package_changed
         end
       end
 
       defaultto :installed
 
       # Override the parent method, because we've got all kinds of
       # funky definitions of 'in sync'.
       def insync?(is)
         @latest ||= nil
         @lateststamp ||= (Time.now.to_i - 1000)
         # Iterate across all of the should values, and see how they
         # turn out.
 
         @should.each { |should|
           case should
           when :present
             return true unless [:absent, :purged, :held].include?(is)
           when :latest
             # Short-circuit packages that are not present
             return false if is == :absent or is == :purged
 
             # Don't run 'latest' more than about every 5 minutes
             if @latest and ((Time.now.to_i - @lateststamp) / 60) < 5
               #self.debug "Skipping latest check"
             else
               begin
                 @latest = provider.latest
                 @lateststamp = Time.now.to_i
               rescue => detail
                 error = Puppet::Error.new("Could not get latest version: #{detail}")
                 error.set_backtrace(detail.backtrace)
                 raise error
               end
             end
 
             case is
             when @latest
               return true
             when :present
               # This will only happen on retarded packaging systems
               # that can't query versions.
               return true
             else
               self.debug "#{@resource.name} #{is.inspect} is installed, latest is #{@latest.inspect}"
             end
           when :absent
             return true if is == :absent or is == :purged
           when :purged
             return true if is == :purged
           when is
             return true
           end
         }
 
         false
       end
 
       # This retrieves the current state. LAK: I think this method is unused.
       def retrieve
         provider.properties[:ensure]
       end
 
       # Provide a bit more information when logging upgrades.
       def should_to_s(newvalue = @should)
         if @latest
           @latest.to_s
         else
           super(newvalue)
         end
       end
     end
 
     newparam(:name) do
       desc "The package name.  This is the name that the packaging
       system uses internally, which is sometimes (especially on Solaris)
       a name that is basically useless to humans.  If you want to
       abstract package installation, then you can use aliases to provide
       a common name to packages:
 
           # In the 'openssl' class
           $ssl = $operatingsystem ? {
             solaris => SMCossl,
             default => openssl
           }
 
           # It is not an error to set an alias to the same value as the
           # object name.
           package { $ssl:
             ensure => installed,
             alias => openssl
           }
 
           . etc. .
 
           $ssh = $operatingsystem ? {
             solaris => SMCossh,
             default => openssh
           }
 
           # Use the alias to specify a dependency, rather than
           # having another selector to figure it out again.
           package { $ssh:
             ensure => installed,
             alias => openssh,
             require => Package[openssl]
           }
 
       "
       isnamevar
     end
 
     newparam(:source) do
       desc "Where to find the actual package.  This must be a local file
         (or on a network file system) or a URL that your specific
         packaging type understands; Puppet will not retrieve files for you."
     end
     newparam(:instance) do
       desc "A read-only parameter set by the package."
     end
     newparam(:status) do
       desc "A read-only parameter set by the package."
     end
 
     newparam(:type) do
       desc "Deprecated form of `provider`."
 
       munge do |value|
         warning "'type' is deprecated; use 'provider' instead"
         @resource[:provider] = value
 
         @resource[:provider]
       end
     end
 
     newparam(:adminfile) do
       desc "A file containing package defaults for installing packages.
         This is currently only used on Solaris.  The value will be
         validated according to system rules, which in the case of
         Solaris means that it should either be a fully qualified path
         or it should be in `/var/sadm/install/admin`."
     end
 
     newparam(:responsefile) do
       desc "A file containing any necessary answers to questions asked by
         the package.  This is currently used on Solaris and Debian.  The
         value will be validated according to system rules, but it should
         generally be a fully qualified path."
     end
 
     newparam(:configfiles) do
       desc "Whether configfiles should be kept or replaced.  Most packages
         types do not support this parameter."
 
       defaultto :keep
 
       newvalues(:keep, :replace)
     end
 
     newparam(:category) do
       desc "A read-only parameter set by the package."
     end
     newparam(:platform) do
       desc "A read-only parameter set by the package."
     end
     newparam(:root) do
       desc "A read-only parameter set by the package."
     end
     newparam(:vendor) do
       desc "A read-only parameter set by the package."
     end
     newparam(:description) do
       desc "A read-only parameter set by the package."
     end
 
     newparam(:allowcdrom) do
       desc "Tells apt to allow cdrom sources in the sources.list file.
         Normally apt will bail if you try this."
 
       newvalues(:true, :false)
     end
 
     newparam(:flavor) do
       desc "Newer versions of OpenBSD support 'flavors', which are
         further specifications for which type of package you want."
     end
 
     autorequire(:file) do
       autos = []
       [:responsefile, :adminfile].each { |param|
         if val = self[param]
           autos << val
         end
       }
 
       if source = self[:source]
         if source =~ /^#{File::SEPARATOR}/
           autos << source
         end
       end
       autos
     end
 
     # This only exists for testing.
     def clear
       if obj = @parameters[:ensure]
         obj.latest = nil
       end
     end
 
     # The 'query' method returns a hash of info if the package
     # exists and returns nil if it does not.
     def exists?
       @provider.get(:ensure) != :absent
     end
   end
 end
diff --git a/lib/puppet/type/selmodule.rb b/lib/puppet/type/selmodule.rb
index 60be8a855..e76c18cc0 100644
--- a/lib/puppet/type/selmodule.rb
+++ b/lib/puppet/type/selmodule.rb
@@ -1,53 +1,55 @@
 #
 # Simple module for manageing SELinux policy modules
 #
 
 Puppet::Type.newtype(:selmodule) do
   @doc = "Manages loading and unloading of SELinux policy modules
     on the system.  Requires SELinux support.  See man semodule(8)
-    for more information on SELinux policy modules."
+    for more information on SELinux policy modules.
+    
+    **Autorequires:** If Puppet is managing the file containing this SELinux policy module (which is either explicitly specified in the `selmodulepath` attribute or will be found at {`selmoduledir`}/{`name`}.pp), the selmodule resource will autorequire that file."
 
   ensurable
 
   newparam(:name) do
     desc "The name of the SELinux policy to be managed.  You should not
       include the customary trailing .pp extension."
     isnamevar
   end
 
   newparam(:selmoduledir) do
 
     desc "The directory to look for the compiled pp module file in.
       Currently defaults to `/usr/share/selinux/targeted`.  If selmodulepath
       is not specified the module will be looked for in this directory in a
       in a file called NAME.pp, where NAME is the value of the name parameter."
 
     defaultto "/usr/share/selinux/targeted"
   end
 
   newparam(:selmodulepath) do
 
     desc "The full path to the compiled .pp policy module.  You only need to use
       this if the module file is not in the directory pointed at by selmoduledir."
 
   end
 
   newproperty(:syncversion) do
 
     desc "If set to `true`, the policy will be reloaded if the
     version found in the on-disk file differs from the loaded
     version.  If set to `false` (the default) the the only check
     that will be made is if the policy is loaded at all or not."
 
     newvalue(:true)
     newvalue(:false)
   end
 
   autorequire(:file) do
     if self[:selmodulepath]
       [self[:selmodulepath]]
     else
       ["#{self[:selmoduledir]}/#{self[:name]}.pp"]
     end
   end
 end
diff --git a/lib/puppet/type/ssh_authorized_key.rb b/lib/puppet/type/ssh_authorized_key.rb
index e3320140e..8338e2d64 100644
--- a/lib/puppet/type/ssh_authorized_key.rb
+++ b/lib/puppet/type/ssh_authorized_key.rb
@@ -1,98 +1,102 @@
 module Puppet
   newtype(:ssh_authorized_key) do
     @doc = "Manages SSH authorized keys. Currently only type 2 keys are
-    supported."
+    supported.
+    
+    **Autorequires:** If Puppet is managing the user account in which this 
+    SSH key should be installed, the `ssh_authorized_key` resource will autorequire
+    that user."
 
     ensurable
 
     newparam(:name) do
       desc "The SSH key comment. This attribute is currently used as a
       system-wide primary key and therefore has to be unique."
 
       isnamevar
     end
 
     newproperty(:type) do
       desc "The encryption type used: ssh-dss or ssh-rsa."
 
       newvalue("ssh-dss")
       newvalue("ssh-rsa")
 
       aliasvalue(:dsa, "ssh-dss")
       aliasvalue(:rsa, "ssh-rsa")
     end
 
     newproperty(:key) do
       desc "The key itself; generally a long string of hex digits."
     end
 
     newproperty(:user) do
       desc "The user account in which the SSH key should be installed.
       The resource will automatically depend on this user."
     end
 
     newproperty(:target) do
       desc "The absolute filename in which to store the SSH key. This
       property is optional and should only be used in cases where keys
       are stored in a non-standard location (i.e.` not in
       `~user/.ssh/authorized_keys`)."
 
       defaultto :absent
 
       def should
         return super if defined?(@should) and @should[0] != :absent
 
         return nil unless user = resource[:user]
 
         begin
           return File.expand_path("~#{user}/.ssh/authorized_keys")
         rescue
           Puppet.debug "The required user is not yet present on the system"
           return nil
         end
       end
 
       def insync?(is)
         is == should
       end
     end
 
     newproperty(:options, :array_matching => :all) do
       desc "Key options, see sshd(8) for possible values. Multiple values
         should be specified as an array."
 
       defaultto do :absent end
 
       def is_to_s(value)
         if value == :absent or value.include?(:absent)
           super
         else
           value.join(",")
         end
       end
 
       def should_to_s(value)
         if value == :absent or value.include?(:absent)
           super
         else
           value.join(",")
         end
       end
     end
 
     autorequire(:user) do
       should(:user) if should(:user)
     end
 
     validate do
       # Go ahead if target attribute is defined
       return if @parameters[:target].shouldorig[0] != :absent
 
       # Go ahead if user attribute is defined
       return if @parameters.include?(:user)
 
       # If neither target nor user is defined, this is an error
       raise Puppet::Error, "Attribute 'user' or 'target' is mandatory"
     end
   end
 end
diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index e7389a0d1..584d3adfc 100755
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -1,436 +1,438 @@
 require 'etc'
 require 'facter'
 require 'puppet/property/list'
 require 'puppet/property/ordered_list'
 require 'puppet/property/keyvalue'
 
 module Puppet
   newtype(:user) do
     @doc = "Manage users.  This type is mostly built to manage system
       users, so it is lacking some features useful for managing normal
       users.
 
       This resource type uses the prescribed native tools for creating
       groups and generally uses POSIX APIs for retrieving information
-      about them.  It does not directly modify `/etc/passwd` or anything."
+      about them.  It does not directly modify `/etc/passwd` or anything.
+      
+      **Autorequires:** If Puppet is managing the user's primary group (as provided in the `gid` attribute), the user resource will autorequire that group. If Puppet is managing any role accounts corresponding to the user's roles, the user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
 
     feature :manages_homedir,
       "The provider can create and remove home directories."
 
     feature :manages_passwords,
       "The provider can modify user passwords, by accepting a password
       hash."
 
     feature :manages_password_age,
       "The provider can set age requirements and restrictions for
       passwords."
 
     feature :manages_solaris_rbac,
       "The provider can manage roles and normal users"
 
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
 
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
       end
 
       newvalue(:absent, :event => :user_removed) do
         provider.delete
       end
 
       newvalue(:role, :event => :role_created, :required_features => :manages_solaris_rbac) do
         provider.create_role
       end
 
       desc "The basic state that the object should be in."
 
       # If they're talking about the thing at all, they generally want to
       # say it should exist.
       defaultto do
         if @resource.managed?
           :present
         else
           nil
         end
       end
 
       def retrieve
         if provider.exists?
           if provider.respond_to?(:is_role?) and provider.is_role?
             return :role
           else
             return :present
           end
         else
           return :absent
         end
       end
     end
 
     newproperty(:home) do
       desc "The home directory of the user.  The directory must be created
         separately and is not currently checked for existence."
     end
 
     newproperty(:uid) do
       desc "The user ID.  Must be specified numerically.  For new users
         being created, if no user ID is specified then one will be
         chosen automatically, which will likely result in the same user
         having different IDs on different systems, which is not
         recommended.  This is especially noteworthy if you use Puppet
         to manage the same user on both Darwin and other platforms,
         since Puppet does the ID generation for you on Darwin, but the
         tools do so on other platforms."
 
       munge do |value|
         case value
         when String
           if value =~ /^[-0-9]+$/
             value = Integer(value)
           end
         end
 
         return value
       end
     end
 
     newproperty(:gid) do
       desc "The user's primary group.  Can be specified numerically or
         by name."
 
       munge do |value|
         if value.is_a?(String) and value =~ /^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
 
       def insync?(is)
         # We know the 'is' is a number, so we need to convert the 'should' to a number,
         # too.
         @should.each do |value|
           return true if number = Puppet::Util.gid(value) and is == number
         end
 
         false
       end
 
       def sync
         found = false
         @should.each do |value|
           if number = Puppet::Util.gid(value)
             provider.gid = number
             found = true
             break
           end
         end
 
         fail "Could not find group(s) #{@should.join(",")}" unless found
 
         # Use the default event.
       end
     end
 
     newproperty(:comment) do
       desc "A description of the user.  Generally is a user's full name."
     end
 
     newproperty(:shell) do
       desc "The user's login shell.  The shell must exist and be
         executable."
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
       desc "The user's password, in whatever encrypted format the local machine requires. Be sure to enclose any value that includes a dollar sign ($) in single quotes (\')."
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
       end
 
       def change_to_s(currentvalue, newvalue)
         if currentvalue == :absent
           return "created password"
         else
           return "changed password"
         end
       end
     end
 
     newproperty(:password_min_age, :required_features => :manages_password_age) do
       desc "The minimum amount of time in days a password must be used before it may be changed"
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password minimum age must be provided as a number"
         end
       end
     end
 
     newproperty(:password_max_age, :required_features => :manages_password_age) do
       desc "The maximum amount of time in days a password may be used before it must be changed"
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password maximum age must be provided as a number"
         end
       end
     end
 
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups of which the user is a member.  The primary
         group should not be listed.  Multiple groups should be
         specified as an array."
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Group names must be provided, not numbers"
         end
         raise ArgumentError, "Group names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:name) do
       desc "User name.  While limitations are determined for
         each operating system, it is generally a good idea to keep to
         the degenerate 8 characters, beginning with a letter."
       isnamevar
     end
 
     newparam(:membership) do
       desc "Whether specified groups should be treated as the only groups
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newparam(:allowdupe, :boolean => true) do
       desc "Whether to allow duplicate UIDs."
 
       newvalues(:true, :false)
 
       defaultto false
     end
 
     newparam(:managehome, :boolean => true) do
       desc "Whether to manage the home directory when managing the user."
 
       newvalues(:true, :false)
 
       defaultto false
 
       validate do |val|
         if val.to_s == "true"
           raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" unless provider.class.manages_homedir?
         end
       end
     end
 
     newproperty(:expiry, :required_features => :manages_expiry) do
       desc "The expiry date for this user. Must be provided in
            a zero padded YYYY-MM-DD format - e.g 2010-02-19."
 
       validate do |value|
         if value !~ /^\d{4}-\d{2}-\d{2}$/
           raise ArgumentError, "Expiry dates must be YYYY-MM-DD"
         end
       end
     end
 
     # Autorequire the group, if it's around
     autorequire(:group) do
       autos = []
 
       if obj = @parameters[:gid] and groups = obj.shouldorig
         groups = groups.collect { |group|
           if group =~ /^\d+$/
             Integer(group)
           else
             group
           end
         }
         groups.each { |group|
           case group
           when Integer
             if resource = catalog.resources.find { |r| r.is_a?(Puppet::Type.type(:group)) and r.should(:gid) == group }
               autos << resource
             end
           else
             autos << group
           end
         }
       end
 
       if obj = @parameters[:groups] and groups = obj.should
         autos += groups.split(",")
       end
 
       autos
     end
 
     # Provide an external hook.  Yay breaking out of APIs.
     def exists?
       provider.exists?
     end
 
     def retrieve
       absent = false
       properties.inject({}) { |prophash, property|
         current_value = :absent
 
         if absent
           prophash[property] = :absent
         else
           current_value = property.retrieve
           prophash[property] = current_value
         end
 
         if property.name == :ensure and current_value == :absent
           absent = true
         end
         prophash
       }
     end
 
     newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
 
       def membership
         :role_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Role names must be provided, not numbers"
         end
         raise ArgumentError, "Role names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     #autorequire the roles that the user has
     autorequire(:user) do
       reqs = []
 
       if roles_property = @parameters[:roles] and roles = roles_property.should
         reqs += roles.split(',')
       end
 
       reqs
     end
 
     newparam(:role_membership) do
       desc "Whether specified roles should be treated as the only roles
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:auths, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The auths the user has.  Multiple auths should be
         specified as an array."
 
       def membership
         :auth_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Auth names must be provided, not numbers"
         end
         raise ArgumentError, "Auth names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:auth_membership) do
       desc "Whether specified auths should be treated as the only auths
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:profiles, :parent => Puppet::Property::OrderedList, :required_features => :manages_solaris_rbac) do
       desc "The profiles the user has.  Multiple profiles should be
         specified as an array."
 
       def membership
         :profile_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Profile names must be provided, not numbers"
         end
         raise ArgumentError, "Profile names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:profile_membership) do
       desc "Whether specified roles should be treated as the only roles
         of which the user is a member or whether they should merely
         be treated as the minimum membership list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:keys, :parent => Puppet::Property::KeyValue, :required_features => :manages_solaris_rbac) do
       desc "Specify user attributes in an array of keyvalue pairs"
 
       def membership
         :key_membership
       end
 
       validate do |value|
         raise ArgumentError, "key value pairs must be seperated by an =" unless value.include?("=")
       end
     end
 
     newparam(:key_membership) do
       desc "Whether specified key value pairs should be treated as the only attributes
         of the user or whether they should merely
         be treated as the minimum list."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:project, :required_features => :manages_solaris_rbac) do
       desc "The name of the project associated with a user"
     end
   end
 end
diff --git a/lib/puppet/type/zfs.rb b/lib/puppet/type/zfs.rb
index 1757931f8..6f04bddd8 100755
--- a/lib/puppet/type/zfs.rb
+++ b/lib/puppet/type/zfs.rb
@@ -1,50 +1,52 @@
 module Puppet
   newtype(:zfs) do
-    @doc = "Manage zfs. Create destroy and set properties on zfs instances."
+    @doc = "Manage zfs. Create destroy and set properties on zfs instances.
+
+**Autorequires:** If Puppet is managing the zpool at the root of this zfs instance, the zfs resource will autorequire it. If Puppet is managing any parent zfs instances, the zfs resource will autorequire them."
 
     ensurable
 
     newparam(:name) do
       desc "The full name for this filesystem. (including the zpool)"
     end
 
     newproperty(:mountpoint) do
       desc "The mountpoint property."
     end
 
     newproperty(:compression) do
       desc "The compression property."
     end
 
     newproperty(:copies) do
       desc "The copies property."
     end
 
     newproperty(:quota) do
       desc "The quota property."
     end
 
     newproperty(:reservation) do
       desc "The reservation property."
     end
 
     newproperty(:sharenfs) do
       desc "The sharenfs property."
     end
 
     newproperty(:snapdir) do
       desc "The snapdir property."
     end
 
     autorequire(:zpool) do
       #strip the zpool off the zfs name and autorequire it
       [@parameters[:name].value.split('/')[0]]
     end
 
     autorequire(:zfs) do
       #slice and dice, we want all the zfs before this one
       names = @parameters[:name].value.split('/')
       names.slice(1..-2).inject([]) { |a,v| a << "#{a.last}/#{v}" }.collect { |fs| names[0] + fs }
     end
   end
 end
diff --git a/lib/puppet/type/zone.rb b/lib/puppet/type/zone.rb
index 408d6f5dd..471619c98 100644
--- a/lib/puppet/type/zone.rb
+++ b/lib/puppet/type/zone.rb
@@ -1,444 +1,446 @@
 Puppet::Type.newtype(:zone) do
-  @doc = "Solaris zones."
+  @doc = "Solaris zones.
+
+**Autorequires:** If Puppet is managing the directory specified as the root of the zone's filesystem (with the `path` attribute), the zone resource will autorequire that directory."
 
   # These properties modify the zone configuration, and they need to provide
   # the text separately from syncing it, so all config statements can be rolled
   # into a single creation statement.
   class ZoneConfigProperty < Puppet::Property
     # Perform the config operation.
     def sync
       provider.setconfig self.configtext
     end
   end
 
   # Those properties that can have multiple instances.
   class ZoneMultiConfigProperty < ZoneConfigProperty
     def configtext
       list = @should
 
       current_value = self.retrieve
 
       unless current_value.is_a? Symbol
         if current_value.is_a? Array
           list += current_value
         else
           list << current_value if current_value
         end
       end
 
       # Some hackery so we can test whether current_value is an array or a symbol
       if current_value.is_a? Array
         tmpis = current_value
       else
         if current_value
           tmpis = [current_value]
         else
           tmpis = []
         end
       end
 
       rms = []
       adds = []
 
       # Collect the modifications to make
       list.sort.uniq.collect do |obj|
         # Skip objectories that are configured and should be
         next if tmpis.include?(obj) and @should.include?(obj)
 
         if tmpis.include?(obj)
           rms << obj
         else
           adds << obj
         end
       end
 
 
       # And then perform all of the removals before any of the adds.
       (rms.collect { |o| rm(o) } + adds.collect { |o| add(o) }).join("\n")
     end
 
     # We want all specified directories to be included.
     def insync?(current_value)
       if current_value.is_a? Array and @should.is_a? Array
         current_value.sort == @should.sort
       else
         current_value == @should
       end
     end
   end
 
   ensurable do
     desc "The running state of the zone.  The valid states directly reflect
       the states that `zoneadm` provides.  The states are linear,
       in that a zone must be `configured` then `installed`, and
       only then can be `running`.  Note also that `halt` is currently
       used to stop zones."
 
     @states = {}
     @parametervalues = []
 
     def self.alias_state(values)
       @state_aliases ||= {}
       values.each do |nick, name|
         @state_aliases[nick] = name
       end
     end
 
     def self.newvalue(name, hash)
       @parametervalues = [] if @parametervalues.is_a? Hash
 
       @parametervalues << name
 
       @states[name] = hash
       hash[:name] = name
     end
 
     def self.state_name(name)
       if other = @state_aliases[name]
         other
       else
         name
       end
     end
 
     newvalue :absent, :down => :destroy
     newvalue :configured, :up => :configure, :down => :uninstall
     newvalue :installed, :up => :install, :down => :stop
     newvalue :running, :up => :start
 
     alias_state :incomplete => :installed, :ready => :installed, :shutting_down => :running
 
     defaultto :running
 
     def self.state_index(value)
       @parametervalues.index(state_name(value))
     end
 
     # Return all of the states between two listed values, exclusive
     # of the first item.
     def self.state_sequence(first, second)
       findex = sindex = nil
       unless findex = @parametervalues.index(state_name(first))
         raise ArgumentError, "'#{first}' is not a valid zone state"
       end
       unless sindex = @parametervalues.index(state_name(second))
         raise ArgumentError, "'#{first}' is not a valid zone state"
       end
       list = nil
 
       # Apparently ranges are unidirectional, so we have to reverse
       # the range op twice.
       if findex > sindex
         list = @parametervalues[sindex..findex].collect do |name|
           @states[name]
         end.reverse
       else
         list = @parametervalues[findex..sindex].collect do |name|
           @states[name]
         end
       end
 
       # The first result is the current state, so don't return it.
       list[1..-1]
     end
 
     def retrieve
       provider.properties[:ensure]
     end
 
     def sync
       method = nil
       if up?
         direction = :up
       else
         direction = :down
       end
 
       # We need to get the state we're currently in and just call
       # everything between it and us.
       self.class.state_sequence(self.retrieve, self.should).each do |state|
         if method = state[direction]
           warned = false
           while provider.processing?
             unless warned
               info "Waiting for zone to finish processing"
               warned = true
             end
             sleep 1
           end
           provider.send(method)
         else
           raise Puppet::DevError, "Cannot move #{direction} from #{st[:name]}"
         end
       end
 
       ("zone_#{self.should}").intern
     end
 
     # Are we moving up the property tree?
     def up?
       current_value = self.retrieve
       self.class.state_index(current_value) < self.class.state_index(self.should)
     end
   end
 
   newparam(:name) do
     desc "The name of the zone."
 
     isnamevar
   end
 
   newparam(:id) do
     desc "The numerical ID of the zone.  This number is autogenerated
       and cannot be changed."
   end
 
   newparam(:clone) do
     desc "Instead of installing the zone, clone it from another zone.
       If the zone root resides on a zfs file system, a snapshot will be
       used to create the clone, is it redisides on ufs, a copy of the zone
       will be used. The zone you clone from must not be running."
   end
 
   newproperty(:ip, :parent => ZoneMultiConfigProperty) do
     require 'ipaddr'
 
     desc "The IP address of the zone.  IP addresses must be specified
       with the interface, separated by a colon, e.g.: bge0:192.168.0.1.
       For multiple interfaces, specify them in an array."
 
     # Add an interface.
     def add(str)
       interface, ip, defrouter = ipsplit(str)
       cmd = "add net\n"
       cmd += "set physical=#{interface}\n" if interface
       cmd += "set address=#{ip}\n" if ip
       cmd += "set defrouter=#{defrouter}\n" if defrouter
       #if @resource[:iptype] == :shared
       cmd += "end\n"
     end
 
     # Convert a string into the component interface, address and defrouter
     def ipsplit(str)
       interface, address, defrouter = str.split(':')
       return interface, address, defrouter
     end
 
     # Remove an interface.
     def rm(str)
       interface, ip, defrouter = ipsplit(str)
       # Reality seems to disagree with the documentation here; the docs
       # specify that braces are required, but they're apparently only
       # required if you're specifying multiple values.
       if ip
         "remove net address=#{ip}"
       elsif interface
         "remove net interface=#{interface}"
       else
         raise ArgumentError, "can not remove network based on default router"
       end
     end
   end
 
   newproperty(:iptype, :parent => ZoneConfigProperty) do
     desc "The IP stack type of the zone. Can either be 'shared' or 'exclusive'."
 
     defaultto :shared
 
     newvalue :shared
     newvalue :exclusive
 
     def configtext
       "set ip-type=#{self.should}"
     end
   end
 
   newproperty(:autoboot, :parent => ZoneConfigProperty) do
     desc "Whether the zone should automatically boot."
 
     defaultto true
 
     newvalue(:true) {}
     newvalue(:false) {}
 
     def configtext
       "set autoboot=#{self.should}"
     end
   end
 
   newproperty(:pool, :parent => ZoneConfigProperty) do
     desc "The resource pool for this zone."
 
     def configtext
       "set pool=#{self.should}"
     end
   end
 
   newproperty(:shares, :parent => ZoneConfigProperty) do
     desc "Number of FSS CPU shares allocated to the zone."
 
     def configtext
       "add rctl\nset name=zone.cpu-shares\nadd value (priv=privileged,limit=#{self.should},action=none)\nend"
     end
   end
 
   newproperty(:inherit, :parent => ZoneMultiConfigProperty) do
     desc "The list of directories that the zone inherits from the global
       zone.  All directories must be fully qualified."
 
     validate do |value|
       unless value =~ /^\//
         raise ArgumentError, "Inherited filesystems must be fully qualified"
       end
     end
 
     # Add a directory to our list of inherited directories.
     def add(dir)
       "add inherit-pkg-dir\nset dir=#{dir}\nend"
     end
 
     def rm(dir)
       # Reality seems to disagree with the documentation here; the docs
       # specify that braces are required, but they're apparently only
       # required if you're specifying multiple values.
       "remove inherit-pkg-dir dir=#{dir}"
     end
 
     def should
       @should
     end
   end
 
   # Specify the sysidcfg file.  This is pretty hackish, because it's
   # only used to boot the zone the very first time.
   newparam(:sysidcfg) do
     desc %{The text to go into the sysidcfg file when the zone is first
       booted.  The best way is to use a template:
 
           # $templatedir/sysidcfg
           system_locale=en_US
           timezone=GMT
           terminal=xterms
           security_policy=NONE
           root_password=<%= password %>
           timeserver=localhost
           name_service=DNS {domain_name=<%= domain %> name_server=<%= nameserver %>}
           network_interface=primary {hostname=<%= realhostname %>
             ip_address=<%= ip %>
             netmask=<%= netmask %>
             protocol_ipv6=no
             default_route=<%= defaultroute %>}
           nfs4_domain=dynamic
 
       And then call that:
 
           zone { myzone:
             ip => "bge0:192.168.0.23",
             sysidcfg => template(sysidcfg),
             path => "/opt/zones/myzone",
             realhostname => "fully.qualified.domain.name"
           }
 
       The sysidcfg only matters on the first booting of the zone,
       so Puppet only checks for it at that time.}
   end
 
   newparam(:path) do
     desc "The root of the zone's filesystem.  Must be a fully qualified
       file name.  If you include '%s' in the path, then it will be
       replaced with the zone's name.  At this point, you cannot use
       Puppet to move a zone."
 
     validate do |value|
       unless value =~ /^\//
         raise ArgumentError, "The zone base must be fully qualified"
       end
     end
 
     munge do |value|
       if value =~ /%s/
         value % @resource[:name]
       else
         value
       end
     end
   end
 
   newparam(:create_args) do
     desc "Arguments to the zonecfg create command.  This can be used to create branded zones."
   end
 
   newparam(:install_args) do
     desc "Arguments to the zoneadm install command.  This can be used to create branded zones."
   end
 
   newparam(:realhostname) do
     desc "The actual hostname of the zone."
   end
 
   # If Puppet is also managing the base dir or its parent dir, list them
   # both as prerequisites.
   autorequire(:file) do
     if @parameters.include? :path
       [@parameters[:path].value, File.dirname(@parameters[:path].value)]
     else
       nil
     end
   end
 
   def validate_ip(ip, name)
       IPAddr.new(ip) if ip
   rescue ArgumentError
       self.fail "'#{ip}' is an invalid #{name}"
   end
 
   validate do
     value = self[:ip]
     interface, address, defrouter = value.split(':')
     if self[:iptype] == :shared
       if (interface && address && defrouter.nil?) ||
         (interface && address && defrouter)
         validate_ip(address, "IP address")
         validate_ip(defrouter, "default router")
       else
         self.fail "ip must contain interface name and ip address separated by a \":\""
       end
     else
       self.fail "only interface may be specified when using exclusive IP stack: #{value}" unless interface && address.nil? && defrouter.nil?
     end
 
     self.fail "zone path is required" unless self[:path]
   end
 
   def retrieve
     provider.flush
     if hash = provider.properties and hash[:ensure] != :absent
       result = setstatus(hash)
       result
     else
       # Return all properties as absent.
       return properties.inject({}) do | prophash, property|
         prophash[property] = :absent
         prophash
       end
     end
   end
 
   # Take the results of a listing and set everything appropriately.
   def setstatus(hash)
     prophash = {}
     hash.each do |param, value|
       next if param == :name
       case self.class.attrtype(param)
       when :property
         # Only try to provide values for the properties we're managing
         if prop = self.property(param)
           prophash[prop] = value
         end
       else
         self[param] = value
       end
     end
     prophash
   end
 end