diff --git a/lib/puppet/ssl/host.rb b/lib/puppet/ssl/host.rb
index 08a8ace1f..a06b1e275 100644
--- a/lib/puppet/ssl/host.rb
+++ b/lib/puppet/ssl/host.rb
@@ -1,307 +1,308 @@
 require 'puppet/indirector'
 require 'puppet/ssl'
 require 'puppet/ssl/key'
 require 'puppet/ssl/certificate'
 require 'puppet/ssl/certificate_request'
 require 'puppet/ssl/certificate_revocation_list'
 
 # The class that manages all aspects of our SSL certificates --
 # private keys, public keys, requests, etc.
 class Puppet::SSL::Host
   # Yay, ruby's strange constant lookups.
   Key = Puppet::SSL::Key
   CA_NAME = Puppet::SSL::CA_NAME
   Certificate = Puppet::SSL::Certificate
   CertificateRequest = Puppet::SSL::CertificateRequest
   CertificateRevocationList = Puppet::SSL::CertificateRevocationList
 
   extend Puppet::Indirector
   indirects :certificate_status, :terminus_class => :file
 
   attr_reader :name
   attr_accessor :ca
 
   attr_writer :key, :certificate, :certificate_request
 
   # This accessor is used in instances for indirector requests to hold desired state
   attr_accessor :desired_state
 
   def self.localhost
-    @localhost ||= new.tap do |l|
-      l.generate unless l.certificate
-      l.key # Make sure it's read in
-    end
+    return @localhost if @localhost
+    @localhost = new
+    @localhost.generate unless @localhost.certificate
+    @localhost.key
+    @localhost
   end
 
   # This is the constant that people will use to mark that a given host is
   # a certificate authority.
   def self.ca_name
     CA_NAME
   end
 
   class << self
     attr_reader :ca_location
   end
 
   # Configure how our various classes interact with their various terminuses.
   def self.configure_indirection(terminus, cache = nil)
     Certificate.indirection.terminus_class = terminus
     CertificateRequest.indirection.terminus_class = terminus
     CertificateRevocationList.indirection.terminus_class = terminus
 
     host_map = {:ca => :file, :file => nil, :rest => :rest}
     if term = host_map[terminus]
       self.indirection.terminus_class = term
     else
       self.indirection.reset_terminus_class
     end
 
     if cache
       # This is weird; we don't actually cache our keys, we
       # use what would otherwise be the cache as our normal
       # terminus.
       Key.indirection.terminus_class = cache
     else
       Key.indirection.terminus_class = terminus
     end
 
     if cache
       Certificate.indirection.cache_class = cache
       CertificateRequest.indirection.cache_class = cache
       CertificateRevocationList.indirection.cache_class = cache
     else
       # Make sure we have no cache configured.  puppet master
       # switches the configurations around a bit, so it's important
       # that we specify the configs for absolutely everything, every
       # time.
       Certificate.indirection.cache_class = nil
       CertificateRequest.indirection.cache_class = nil
       CertificateRevocationList.indirection.cache_class = nil
     end
   end
 
   CA_MODES = {
     # Our ca is local, so we use it as the ultimate source of information
     # And we cache files locally.
     :local => [:ca, :file],
     # We're a remote CA client.
     :remote => [:rest, :file],
     # We are the CA, so we don't have read/write access to the normal certificates.
     :only => [:ca],
     # We have no CA, so we just look in the local file store.
     :none => [:file]
   }
 
   # Specify how we expect to interact with our certificate authority.
   def self.ca_location=(mode)
     modes = CA_MODES.collect { |m, vals| m.to_s }.join(", ")
     raise ArgumentError, "CA Mode can only be one of: #{modes}" unless CA_MODES.include?(mode)
 
     @ca_location = mode
 
     configure_indirection(*CA_MODES[@ca_location])
   end
 
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method is in-use
   # in `puppet cert -c <certname>`.
   def self.destroy(name)
     indirection.destroy(name)
   end
 
   def self.from_pson(pson)
     instance = new(pson["name"])
     if pson["desired_state"]
       instance.desired_state = pson["desired_state"]
     end
     instance
   end
 
   # Puppet::SSL::Host is actually indirected now so the original implementation
   # has been moved into the certificate_status indirector.  This method does not
   # appear to be in use in `puppet cert -l`.
   def self.search(options = {})
     indirection.search("*", options)
   end
 
   # Is this a ca host, meaning that all of its files go in the CA location?
   def ca?
     ca
   end
 
   def key
     @key ||= Key.indirection.find(name)
   end
 
   # This is the private key; we can create it from scratch
   # with no inputs.
   def generate_key
     @key = Key.new(name)
     @key.generate
     begin
       Key.indirection.save(@key)
     rescue
       @key = nil
       raise
     end
     true
   end
 
   def certificate_request
     @certificate_request ||= CertificateRequest.indirection.find(name)
   end
 
   # Our certificate request requires the key but that's all.
   def generate_certificate_request
     generate_key unless key
     @certificate_request = CertificateRequest.new(name)
     @certificate_request.generate(key.content)
     begin
       CertificateRequest.indirection.save(@certificate_request)
     rescue
       @certificate_request = nil
       raise
     end
 
     true
   end
 
   def certificate
     unless @certificate
       generate_key unless key
 
       # get the CA cert first, since it's required for the normal cert
       # to be of any use.
       return nil unless Certificate.indirection.find("ca") unless ca?
       return nil unless @certificate = Certificate.indirection.find(name)
 
       unless certificate_matches_key?
         raise Puppet::Error, "Retrieved certificate does not match private key; please remove certificate from server and regenerate it with the current key"
       end
     end
     @certificate
   end
 
   def certificate_matches_key?
     return false unless key
     return false unless certificate
 
     certificate.content.check_private_key(key.content)
   end
 
   # Generate all necessary parts of our ssl host.
   def generate
     generate_key unless key
     generate_certificate_request unless certificate_request
 
     # If we can get a CA instance, then we're a valid CA, and we
     # should use it to sign our request; else, just try to read
     # the cert.
     if ! certificate and ca = Puppet::SSL::CertificateAuthority.instance
       ca.sign(self.name)
     end
   end
 
   def initialize(name = nil)
     @name = (name || Puppet[:certname]).downcase
     @key = @certificate = @certificate_request = nil
     @ca = (name == self.class.ca_name)
   end
 
   # Extract the public key from the private key.
   def public_key
     key.content.public_key
   end
 
   # Create/return a store that uses our SSL info to validate
   # connections.
   def ssl_store(purpose = OpenSSL::X509::PURPOSE_ANY)
     unless @ssl_store
       @ssl_store = OpenSSL::X509::Store.new
       @ssl_store.purpose = purpose
 
       # Use the file path here, because we don't want to cause
       # a lookup in the middle of setting our ssl connection.
       @ssl_store.add_file(Puppet[:localcacert])
 
       # If there's a CRL, add it to our store.
       if crl = Puppet::SSL::CertificateRevocationList.indirection.find(CA_NAME)
         @ssl_store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
         @ssl_store.add_crl(crl.content)
       end
       return @ssl_store
     end
     @ssl_store
   end
 
   def to_pson(*args)
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
     pson_hash = { :name  => name }
 
     my_state = state
 
     pson_hash[:state] = my_state
     pson_hash[:desired_state] = desired_state if desired_state
 
     if my_state == 'requested'
       pson_hash[:fingerprint] = certificate_request.fingerprint
     else
       pson_hash[:fingerprint] = my_cert.fingerprint
     end
 
     pson_hash.to_pson(*args)
   end
 
   # Attempt to retrieve a cert, if we don't already have one.
   def wait_for_cert(time)
     begin
       return if certificate
       generate
       return if certificate
     rescue SystemExit,NoMemoryError
       raise
     rescue Exception => detail
       puts detail.backtrace if Puppet[:trace]
       Puppet.err "Could not request certificate: #{detail}"
       if time < 1
         puts "Exiting; failed to retrieve certificate and waitforcert is disabled"
         exit(1)
       else
         sleep(time)
       end
       retry
     end
 
     if time < 1
       puts "Exiting; no certificate found and waitforcert is disabled"
       exit(1)
     end
 
     while true
       sleep time
       begin
         break if certificate
         Puppet.notice "Did not receive certificate"
       rescue StandardError => detail
         puts detail.backtrace if Puppet[:trace]
         Puppet.err "Could not request certificate: #{detail}"
       end
     end
   end
 
   def state
     my_cert = Puppet::SSL::Certificate.indirection.find(name)
     if certificate_request
       return 'requested'
     end
 
     begin
       Puppet::SSL::CertificateAuthority.new.verify(my_cert)
       return 'signed'
     rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError
       return 'revoked'
     end
   end
 end
 
 require 'puppet/ssl/certificate_authority'
diff --git a/spec/unit/application/secret_agent_spec.rb b/spec/unit/application/secret_agent_spec.rb
index eba936447..d3923406d 100755
--- a/spec/unit/application/secret_agent_spec.rb
+++ b/spec/unit/application/secret_agent_spec.rb
@@ -1,32 +1,34 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/application/secret_agent'
 require 'puppet/indirector/catalog/rest'
 require 'puppet/indirector/report/rest'
 require 'tempfile'
 
 describe "Puppet::Application::Secret_agent" do
+  include PuppetSpec::Files
+
   it "should retrieve and apply a catalog and submit a report" do
     pending "REVISIT: 2.7 changes broke this, and we want the merge published"
 
-    dirname = Dir.mktmpdir("puppetdir")
+    dirname = tmpdir("puppetdir")
     Puppet[:vardir]   = dirname
     Puppet[:confdir]  = dirname
     Puppet[:certname] = "foo"
     @catalog = Puppet::Resource::Catalog.new
     @file = Puppet::Resource.new(:file, File.join(dirname, "tmp_dir_resource"), :parameters => {:ensure => :present})
     @catalog.add_resource(@file)
 
     @report = Puppet::Transaction::Report.new("apply")
     Puppet::Transaction::Report.stubs(:new).returns(@report)
 
     Puppet::Resource::Catalog::Rest.any_instance.stubs(:find).returns(@catalog)
     @report.expects(:save)
 
     Puppet::Util::Log.stubs(:newdestination)
 
     Puppet::Application::Secret_agent.new.run
 
     @report.status.should == "changed"
   end
 end
diff --git a/spec/unit/face/secret_agent_spec.rb b/spec/unit/face/secret_agent_spec.rb
index a5ec01f27..2530d144d 100755
--- a/spec/unit/face/secret_agent_spec.rb
+++ b/spec/unit/face/secret_agent_spec.rb
@@ -1,25 +1,27 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/face'
 require 'puppet/indirector/catalog/rest'
 require 'tempfile'
 
 describe Puppet::Face[:secret_agent, '0.0.1'] do
+  include PuppetSpec::Files
+
   describe "#synchronize" do
     it "should retrieve and apply a catalog and return a report" do
       pending "This test doesn't work, but the code actually does - tested by LAK"
-      dirname = Dir.mktmpdir("puppetdir")
+      dirname = tmpdir("puppetdir")
       Puppet[:vardir] = dirname
       Puppet[:confdir] = dirname
       @catalog = Puppet::Resource::Catalog.new
       @file = Puppet::Resource.new(:file, File.join(dirname, "tmp_dir_resource"), :parameters => {:ensure => :present})
       @catalog.add_resource(@file)
       Puppet::Resource::Catalog::Rest.any_instance.stubs(:find).returns(@catalog)
 
       report = subject.synchronize
 
       report.kind.should   == "apply"
       report.status.should == "changed"
     end
   end
 end
diff --git a/spec/unit/node/environment_spec.rb b/spec/unit/node/environment_spec.rb
index 79c21248d..78d383440 100755
--- a/spec/unit/node/environment_spec.rb
+++ b/spec/unit/node/environment_spec.rb
@@ -1,321 +1,321 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'tmpdir'
 
 require 'puppet/node/environment'
 require 'puppet/util/execution'
 
 describe Puppet::Node::Environment do
   include PuppetSpec::Files
   after do
     Puppet::Node::Environment.clear
   end
 
   it "should use the filetimeout for the ttl for the modulepath" do
     Puppet::Node::Environment.attr_ttl(:modulepath).should == Integer(Puppet[:filetimeout])
   end
 
   it "should use the filetimeout for the ttl for the module list" do
     Puppet::Node::Environment.attr_ttl(:modules).should == Integer(Puppet[:filetimeout])
   end
 
   it "should use the default environment if no name is provided while initializing an environment" do
     Puppet.settings.expects(:value).with(:environment).returns("one")
     Puppet::Node::Environment.new.name.should == :one
   end
 
   it "should treat environment instances as singletons" do
     Puppet::Node::Environment.new("one").should equal(Puppet::Node::Environment.new("one"))
   end
 
   it "should treat an environment specified as names or strings as equivalent" do
     Puppet::Node::Environment.new(:one).should equal(Puppet::Node::Environment.new("one"))
   end
 
   it "should return its name when converted to a string" do
     Puppet::Node::Environment.new(:one).to_s.should == "one"
   end
 
   it "should just return any provided environment if an environment is provided as the name" do
     one = Puppet::Node::Environment.new(:one)
     Puppet::Node::Environment.new(one).should equal(one)
   end
 
   describe "when managing known resource types" do
     before do
       @env = Puppet::Node::Environment.new("dev")
       @collection = Puppet::Resource::TypeCollection.new(@env)
       @env.stubs(:perform_initial_import).returns(Puppet::Parser::AST::Hostclass.new(''))
       Thread.current[:known_resource_types] = nil
     end
 
     it "should create a resource type collection if none exists" do
       Puppet::Resource::TypeCollection.expects(:new).with(@env).returns @collection
       @env.known_resource_types.should equal(@collection)
     end
 
     it "should reuse any existing resource type collection" do
       @env.known_resource_types.should equal(@env.known_resource_types)
     end
 
     it "should perform the initial import when creating a new collection" do
       @env = Puppet::Node::Environment.new("dev")
       @env.expects(:perform_initial_import).returns(Puppet::Parser::AST::Hostclass.new(''))
       @env.known_resource_types
     end
 
     it "should return the same collection even if stale if it's the same thread" do
       Puppet::Resource::TypeCollection.stubs(:new).returns @collection
       @env.known_resource_types.stubs(:stale?).returns true
 
       @env.known_resource_types.should equal(@collection)
     end
 
     it "should return the current thread associated collection if there is one" do
       Thread.current[:known_resource_types] = @collection
 
       @env.known_resource_types.should equal(@collection)
     end
 
     it "should give to all threads using the same environment the same collection if the collection isn't stale" do
       original_thread_type_collection = Puppet::Resource::TypeCollection.new(@env)
       Puppet::Resource::TypeCollection.expects(:new).with(@env).returns original_thread_type_collection
       @env.known_resource_types.should equal(original_thread_type_collection)
 
       original_thread_type_collection.expects(:require_reparse?).returns(false)
       Puppet::Resource::TypeCollection.stubs(:new).with(@env).returns @collection
 
       t = Thread.new {
         @env.known_resource_types.should equal(original_thread_type_collection)
       }
       t.join
     end
 
     it "should generate a new TypeCollection if the current one requires reparsing" do
       old_type_collection = @env.known_resource_types
       old_type_collection.stubs(:require_reparse?).returns true
       Thread.current[:known_resource_types] = nil
       new_type_collection = @env.known_resource_types
 
       new_type_collection.should be_a Puppet::Resource::TypeCollection
       new_type_collection.should_not equal(old_type_collection)
     end
   end
 
   it "should validate the modulepath directories" do
-    real_file = Dir.mktmpdir
+    real_file = tmpdir('moduledir')
     path = %W[/one /two #{real_file}].join(File::PATH_SEPARATOR)
 
     Puppet[:modulepath] = path
 
     env = Puppet::Node::Environment.new("testing")
 
     env.modulepath.should == [real_file]
   end
 
   it "should prefix the value of the 'PUPPETLIB' environment variable to the module path if present" do
     Puppet::Util::Execution.withenv("PUPPETLIB" => %w{/l1 /l2}.join(File::PATH_SEPARATOR)) do
       env = Puppet::Node::Environment.new("testing")
       module_path = %w{/one /two}.join(File::PATH_SEPARATOR)
       env.expects(:validate_dirs).with(%w{/l1 /l2 /one /two}).returns %w{/l1 /l2 /one /two}
       env.expects(:[]).with(:modulepath).returns module_path
 
       env.modulepath.should == %w{/l1 /l2 /one /two}
     end
   end
 
   describe "when validating modulepath or manifestdir directories" do
     before :each do
       @path_one = make_absolute('/one')
       @path_two = make_absolute('/two')
     end
 
     it "should not return non-directories" do
       env = Puppet::Node::Environment.new("testing")
 
       FileTest.expects(:directory?).with(@path_one).returns true
       FileTest.expects(:directory?).with(@path_two).returns false
 
       env.validate_dirs([@path_one, @path_two]).should == [@path_one]
     end
 
     it "should use the current working directory to fully-qualify unqualified paths" do
       FileTest.stubs(:directory?).returns true
       env = Puppet::Node::Environment.new("testing")
 
       two = File.expand_path(File.join(Dir.getwd, "two"))
       env.validate_dirs([@path_one, 'two']).should == [@path_one, two]
     end
   end
 
   describe "when modeling a specific environment" do
     it "should have a method for returning the environment name" do
       Puppet::Node::Environment.new("testing").name.should == :testing
     end
 
     it "should provide an array-like accessor method for returning any environment-specific setting" do
       env = Puppet::Node::Environment.new("testing")
       env.should respond_to(:[])
     end
 
     it "should ask the Puppet settings instance for the setting qualified with the environment name" do
       Puppet.settings.expects(:value).with("myvar", :testing).returns("myval")
       env = Puppet::Node::Environment.new("testing")
       env["myvar"].should == "myval"
     end
 
     it "should be able to return an individual module that exists in its module path" do
       env = Puppet::Node::Environment.new("testing")
 
       mod = mock 'module'
       Puppet::Module.expects(:new).with("one", env).returns mod
       mod.expects(:exist?).returns true
 
       env.module("one").should equal(mod)
     end
 
     it "should return nil if asked for a module that does not exist in its path" do
       env = Puppet::Node::Environment.new("testing")
 
       mod = mock 'module'
       Puppet::Module.expects(:new).with("one", env).returns mod
       mod.expects(:exist?).returns false
 
       env.module("one").should be_nil
     end
 
     it "should be able to return its modules" do
       Puppet::Node::Environment.new("testing").should respond_to(:modules)
     end
 
     describe ".modules" do
       it "should return a module named for every directory in each module path" do
         env = Puppet::Node::Environment.new("testing")
         env.expects(:modulepath).at_least_once.returns %w{/a /b}
         Dir.expects(:entries).with("/a").returns %w{foo bar}
         Dir.expects(:entries).with("/b").returns %w{bee baz}
 
         env.modules.collect{|mod| mod.name}.sort.should == %w{foo bar bee baz}.sort
       end
 
       it "should remove duplicates" do
         env = Puppet::Node::Environment.new("testing")
         env.expects(:modulepath).returns( %w{/a /b} ).at_least_once
         Dir.expects(:entries).with("/a").returns %w{foo}
         Dir.expects(:entries).with("/b").returns %w{foo}
 
         env.modules.collect{|mod| mod.name}.sort.should == %w{foo}
       end
 
       it "should ignore invalid modules" do
         env = Puppet::Node::Environment.new("testing")
         env.stubs(:modulepath).returns %w{/a}
         Dir.expects(:entries).with("/a").returns %w{foo bar}
 
         Puppet::Module.expects(:new).with { |name, env| name == "foo" }.returns mock("foomod", :name => "foo")
         Puppet::Module.expects(:new).with { |name, env| name == "bar" }.raises( Puppet::Module::InvalidName, "name is invalid" )
 
         env.modules.collect{|mod| mod.name}.sort.should == %w{foo}
       end
 
       it "should create modules with the correct environment" do
         env = Puppet::Node::Environment.new("testing")
         env.expects(:modulepath).at_least_once.returns %w{/a}
         Dir.expects(:entries).with("/a").returns %w{foo}
 
         env.modules.each {|mod| mod.environment.should == env }
       end
 
       it "should cache the module list" do
         env = Puppet::Node::Environment.new("testing")
         env.expects(:modulepath).at_least_once.returns %w{/a}
         Dir.expects(:entries).once.with("/a").returns %w{foo}
 
         env.modules
         env.modules
       end
     end
   end
 
   describe Puppet::Node::Environment::Helper do
     before do
       @helper = Object.new
       @helper.extend(Puppet::Node::Environment::Helper)
     end
 
     it "should be able to set and retrieve the environment" do
       @helper.environment = :foo
       @helper.environment.name.should == :foo
     end
 
     it "should accept an environment directly" do
       env = Puppet::Node::Environment.new :foo
       @helper.environment = env
       @helper.environment.name.should == :foo
     end
 
     it "should accept an environment as a string" do
       env = Puppet::Node::Environment.new "foo"
       @helper.environment = env
       @helper.environment.name.should == :foo
     end
   end
 
   describe "when performing initial import" do
     before do
       @parser = Puppet::Parser::Parser.new("test")
       Puppet::Parser::Parser.stubs(:new).returns @parser
       @env = Puppet::Node::Environment.new("env")
     end
 
     it "should set the parser's string to the 'code' setting and parse if code is available" do
       Puppet.settings[:code] = "my code"
       @parser.expects(:string=).with "my code"
       @parser.expects(:parse)
       @env.instance_eval { perform_initial_import }
     end
 
     it "should set the parser's file to the 'manifest' setting and parse if no code is available and the manifest is available" do
       filename = tmpfile('myfile')
       File.open(filename, 'w'){|f| }
       Puppet.settings[:manifest] = filename
       @parser.expects(:file=).with filename
       @parser.expects(:parse)
       @env.instance_eval { perform_initial_import }
     end
 
     it "should pass the manifest file to the parser even if it does not exist on disk" do
       filename = tmpfile('myfile')
       Puppet.settings[:code] = ""
       Puppet.settings[:manifest] = filename
       @parser.expects(:file=).with(filename).once
       @parser.expects(:parse).once
       @env.instance_eval { perform_initial_import }
     end
 
     it "should fail helpfully if there is an error importing" do
       File.stubs(:exist?).returns true
       @env.stubs(:known_resource_types).returns Puppet::Resource::TypeCollection.new(@env)
       @parser.expects(:file=).once
       @parser.expects(:parse).raises ArgumentError
       lambda { @env.instance_eval { perform_initial_import } }.should raise_error(Puppet::Error)
     end
 
     it "should not do anything if the ignore_import settings is set" do
       Puppet.settings[:ignoreimport] = true
       @parser.expects(:string=).never
       @parser.expects(:file=).never
       @parser.expects(:parse).never
       @env.instance_eval { perform_initial_import }
     end
 
     it "should mark the type collection as needing a reparse when there is an error parsing" do
       @parser.expects(:parse).raises Puppet::ParseError.new("Syntax error at ...")
       @env.stubs(:known_resource_types).returns Puppet::Resource::TypeCollection.new(@env)
 
       lambda { @env.instance_eval { perform_initial_import } }.should raise_error(Puppet::Error, /Syntax error at .../)
       @env.known_resource_types.require_reparse?.should be_true
     end
   end
 end