diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index ff6b7f2d2..816878da9 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -1,584 +1,583 @@
 # A module to collect utility functions.
 
 require 'English'
 require 'puppet/external/lock'
 require 'puppet/error'
 require 'puppet/util/execution_stub'
 require 'uri'
 require 'sync'
 require 'monitor'
 require 'tempfile'
 require 'pathname'
 require 'ostruct'
 require 'puppet/util/platform'
 
 module Puppet
 module Util
   require 'puppet/util/monkey_patches'
   require 'benchmark'
 
   # These are all for backward compatibility -- these are methods that used
   # to be in Puppet::Util but have been moved into external modules.
   require 'puppet/util/posix'
   extend Puppet::Util::POSIX
 
   @@sync_objects = {}.extend MonitorMixin
 
 
   def self.activerecord_version
     if (defined?(::ActiveRecord) and defined?(::ActiveRecord::VERSION) and defined?(::ActiveRecord::VERSION::MAJOR) and defined?(::ActiveRecord::VERSION::MINOR))
       ([::ActiveRecord::VERSION::MAJOR, ::ActiveRecord::VERSION::MINOR].join('.').to_f)
     else
       0
     end
   end
 
 
   # Run some code with a specific environment.  Resets the environment back to
   # what it was at the end of the code.
   def self.withenv(hash)
     saved = ENV.to_hash
     hash.each do |name, val|
       ENV[name.to_s] = val
     end
 
     yield
   ensure
     ENV.clear
     saved.each do |name, val|
       ENV[name] = val
     end
   end
 
 
   # Execute a given chunk of code with a new umask.
   def self.withumask(mask)
     cur = File.umask(mask)
 
     begin
       yield
     ensure
       File.umask(cur)
     end
   end
 
 
   def self.synchronize_on(x,type)
     sync_object,users = 0,1
     begin
       @@sync_objects.synchronize {
         (@@sync_objects[x] ||= [Sync.new,0])[users] += 1
       }
       @@sync_objects[x][sync_object].synchronize(type) { yield }
     ensure
       @@sync_objects.synchronize {
         @@sync_objects.delete(x) unless (@@sync_objects[x][users] -= 1) > 0
       }
     end
   end
 
   # Change the process to a different user
   def self.chuser
     if group = Puppet[:group]
       begin
         Puppet::Util::SUIDManager.change_group(group, true)
       rescue => detail
         Puppet.warning "could not change to group #{group.inspect}: #{detail}"
         $stderr.puts "could not change to group #{group.inspect}"
 
         # Don't exit on failed group changes, since it's
         # not fatal
         #exit(74)
       end
     end
 
     if user = Puppet[:user]
       begin
         Puppet::Util::SUIDManager.change_user(user, true)
       rescue => detail
         $stderr.puts "Could not change to user #{user}: #{detail}"
         exit(74)
       end
     end
   end
 
   # Create instance methods for each of the log levels.  This allows
   # the messages to be a little richer.  Most classes will be calling this
   # method.
   def self.logmethods(klass, useself = true)
     Puppet::Util::Log.eachlevel { |level|
       klass.send(:define_method, level, proc { |args|
         args = args.join(" ") if args.is_a?(Array)
         if useself
 
           Puppet::Util::Log.create(
             :level => level,
             :source => self,
             :message => args
           )
         else
 
           Puppet::Util::Log.create(
             :level => level,
             :message => args
           )
         end
       })
     }
   end
 
   # Proxy a bunch of methods to another object.
   def self.classproxy(klass, objmethod, *methods)
     classobj = class << klass; self; end
     methods.each do |method|
       classobj.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
   # Proxy a bunch of methods to another object.
   def self.proxy(klass, objmethod, *methods)
     methods.each do |method|
       klass.send(:define_method, method) do |*args|
         obj = self.send(objmethod)
 
         obj.send(method, *args)
       end
     end
   end
 
 
   def benchmark(*args)
     msg = args.pop
     level = args.pop
     object = nil
 
     if args.empty?
       if respond_to?(level)
         object = self
       else
         object = Puppet
       end
     else
       object = args.pop
     end
 
     raise Puppet::DevError, "Failed to provide level to :benchmark" unless level
 
     unless level == :none or object.respond_to? level
       raise Puppet::DevError, "Benchmarked object does not respond to #{level}"
     end
 
     # Only benchmark if our log level is high enough
     if level != :none and Puppet::Util::Log.sendlevel?(level)
       result = nil
       seconds = Benchmark.realtime {
         yield
       }
       object.send(level, msg + (" in %0.2f seconds" % seconds))
       return seconds
     else
       yield
     end
   end
 
   def which(bin)
     if absolute_path?(bin)
       return bin if FileTest.file? bin and FileTest.executable? bin
     else
       ENV['PATH'].split(File::PATH_SEPARATOR).each do |dir|
         begin
           dest = File.expand_path(File.join(dir, bin))
         rescue ArgumentError => e
           # if the user's PATH contains a literal tilde (~) character and HOME is not set, we may get
           # an ArgumentError here.  Let's check to see if that is the case; if not, re-raise whatever error
           # was thrown.
           if e.to_s =~ /HOME/ and (ENV['HOME'].nil? || ENV['HOME'] == "")
             # if we get here they have a tilde in their PATH.  We'll issue a single warning about this and then
             # ignore this path element and carry on with our lives.
             Puppet::Util::Warnings.warnonce("PATH contains a ~ character, and HOME is not set; ignoring PATH element '#{dir}'.")
           elsif e.to_s =~ /doesn't exist|can't find user/
             # ...otherwise, we just skip the non-existent entry, and do nothing.
             Puppet::Util::Warnings.warnonce("Couldn't expand PATH containing a ~ character; ignoring PATH element '#{dir}'.")
           else
             raise
           end
         else
           if Puppet.features.microsoft_windows? && File.extname(dest).empty?
             exts = ENV['PATHEXT']
             exts = exts ? exts.split(File::PATH_SEPARATOR) : %w[.COM .EXE .BAT .CMD]
             exts.each do |ext|
               destext = File.expand_path(dest + ext)
               return destext if FileTest.file? destext and FileTest.executable? destext
             end
           end
           return dest if FileTest.file? dest and FileTest.executable? dest
         end
       end
     end
     nil
   end
   module_function :which
 
   # Determine in a platform-specific way whether a path is absolute. This
   # defaults to the local platform if none is specified.
   def absolute_path?(path, platform=nil)
     # Escape once for the string literal, and once for the regex.
     slash = '[\\\\/]'
     name = '[^\\\\/]+'
     regexes = {
       :windows => %r!^(([A-Z]:#{slash})|(#{slash}#{slash}#{name}#{slash}#{name})|(#{slash}#{slash}\?#{slash}#{name}))!i,
       :posix   => %r!^/!,
     }
 
     # Due to weird load order issues, I was unable to remove this require.
     # This is fixed in Telly so it can be removed there.
     require 'puppet'
 
     # Ruby only sets File::ALT_SEPARATOR on Windows and the Ruby standard
     # library uses that to test what platform it's on.  Normally in Puppet we
     # would use Puppet.features.microsoft_windows?, but this method needs to
     # be called during the initialization of features so it can't depend on
     # that.
     platform ||= Puppet::Util::Platform.windows? ? :windows : :posix
 
     !! (path =~ regexes[platform])
   end
   module_function :absolute_path?
 
   # Convert a path to a file URI
   def path_to_uri(path)
     return unless path
 
     params = { :scheme => 'file' }
 
     if Puppet.features.microsoft_windows?
       path = path.gsub(/\\/, '/')
 
       if unc = /^\/\/([^\/]+)(\/[^\/]+)/.match(path)
         params[:host] = unc[1]
         path = unc[2]
       elsif path =~ /^[a-z]:\//i
         path = '/' + path
       end
     end
 
     params[:path] = URI.escape(path)
 
     begin
       URI::Generic.build(params)
     rescue => detail
       raise Puppet::Error, "Failed to convert '#{path}' to URI: #{detail}"
     end
   end
   module_function :path_to_uri
 
   # Get the path component of a URI
   def uri_to_path(uri)
     return unless uri.is_a?(URI)
 
     path = URI.unescape(uri.path)
 
     if Puppet.features.microsoft_windows? and uri.scheme == 'file'
       if uri.host
         path = "//#{uri.host}" + path # UNC
       else
         path.sub!(/^\//, '')
       end
     end
 
     path
   end
   module_function :uri_to_path
 
   def safe_posix_fork(stdin=$stdin, stdout=$stdout, stderr=$stderr, &block)
     child_pid = Kernel.fork do
       $stdin.reopen(stdin)
       $stdout.reopen(stdout)
       $stderr.reopen(stderr)
 
       3.upto(256){|fd| IO::new(fd).close rescue nil}
 
       block.call if block
     end
     child_pid
   end
   module_function :safe_posix_fork
 
   # Create an exclusive lock.
   def threadlock(resource, type = Sync::EX)
     Puppet::Util.synchronize_on(resource,type) { yield }
   end
 
-
   module_function :benchmark
 
   def memory
     unless defined?(@pmap)
       @pmap = which('pmap')
     end
     if @pmap
       %x{#{@pmap} #{Process.pid}| grep total}.chomp.sub(/^\s*total\s+/, '').sub(/K$/, '').to_i
     else
       0
     end
   end
 
   def symbolize(value)
     if value.respond_to? :intern
       value.intern
     else
       value
     end
   end
 
   def symbolizehash(hash)
     newhash = {}
     hash.each do |name, val|
       if name.is_a? String
         newhash[name.intern] = val
       else
         newhash[name] = val
       end
     end
     newhash
   end
 
   def symbolizehash!(hash)
     # this is not the most memory-friendly way to accomplish this, but the
     #  code re-use and clarity seems worthwhile.
     newhash = symbolizehash(hash)
     hash.clear
     hash.merge!(newhash)
 
     hash
   end
   module_function :symbolize, :symbolizehash, :symbolizehash!
 
   # Just benchmark, with no logging.
   def thinmark
     seconds = Benchmark.realtime {
       yield
     }
 
     seconds
   end
 
   module_function :memory, :thinmark
 
   # Because IO#binread is only available in 1.9
   def binread(file)
     File.open(file, 'rb') { |f| f.read }
   end
   module_function :binread
 
   # utility method to get the current call stack and format it to a human-readable string (which some IDEs/editors
   # will recognize as links to the line numbers in the trace)
   def self.pretty_backtrace(backtrace = caller(1))
     backtrace.collect do |line|
       file_path, line_num = line.split(":")
       file_path = expand_symlinks(File.expand_path(file_path))
 
       file_path + ":" + line_num
     end .join("\n")
 
   end
 
   # utility method that takes a path as input, checks each component of the path to see if it is a symlink, and expands
   # it if it is.  returns the expanded path.
   def self.expand_symlinks(file_path)
     file_path.split("/").inject do |full_path, next_dir|
       next_path = full_path + "/" + next_dir
       if File.symlink?(next_path) then
         link = File.readlink(next_path)
         next_path =
             case link
               when /^\// then link
               else
                 File.expand_path(full_path + "/" + link)
             end
       end
       next_path
     end
   end
 
   # Replace a file, securely.  This takes a block, and passes it the file
   # handle of a file open for writing.  Write the replacement content inside
   # the block and it will safely replace the target file.
   #
   # This method will make no changes to the target file until the content is
   # successfully written and the block returns without raising an error.
   #
   # As far as possible the state of the existing file, such as mode, is
   # preserved.  This works hard to avoid loss of any metadata, but will result
   # in an inode change for the file.
   #
   # Arguments: `filename`, `default_mode`
   #
   # The filename is the file we are going to replace.
   #
   # The default_mode is the mode to use when the target file doesn't already
   # exist; if the file is present we copy the existing mode/owner/group values
   # across.
   def replace_file(file, default_mode, &block)
     raise Puppet::DevError, "replace_file requires a block" unless block_given?
 
     file     = Pathname(file)
     tempfile = Tempfile.new(file.basename.to_s, file.dirname.to_s)
 
     file_exists = file.exist?
 
     # Set properties of the temporary file before we write the content, because
     # Tempfile doesn't promise to be safe from reading by other people, just
     # that it avoids races around creating the file.
     #
     # Our Windows emulation is pretty limited, and so we have to carefully
     # and specifically handle the platform, which has all sorts of magic.
     # So, unlike Unix, we don't pre-prep security; we use the default "quite
     # secure" tempfile permissions instead.  Magic happens later.
     unless Puppet.features.microsoft_windows?
       # Grab the current file mode, and fall back to the defaults.
       stat = file.lstat rescue OpenStruct.new(:mode => default_mode,
                                               :uid  => Process.euid,
                                               :gid  => Process.egid)
 
       # We only care about the bottom four slots, which make the real mode,
       # and not the rest of the platform stat call fluff and stuff.
       tempfile.chmod(stat.mode & 07777)
       tempfile.chown(stat.uid, stat.gid)
     end
 
     # OK, now allow the caller to write the content of the file.
     yield tempfile
 
     # Now, make sure the data (which includes the mode) is safe on disk.
     tempfile.flush
     begin
       tempfile.fsync
     rescue NotImplementedError
       # fsync may not be implemented by Ruby on all platforms, but
       # there is absolutely no recovery path if we detect that.  So, we just
       # ignore the return code.
       #
       # However, don't be fooled: that is accepting that we are running in
       # an unsafe fashion.  If you are porting to a new platform don't stub
       # that out.
     end
 
     tempfile.close
 
     if Puppet.features.microsoft_windows?
       # This will appropriately clone the file, but only if the file we are
       # replacing exists.  Which is kind of annoying; thanks Microsoft.
       #
       # So, to avoid getting into an infinite loop we will retry once if the
       # file doesn't exist, but only the once...
       have_retried = false
 
       begin
         # Yes, the arguments are reversed compared to the rename in the rest
         # of the world.
         Puppet::Util::Windows::File.replace_file(file, tempfile.path)
       rescue Puppet::Util::Windows::Error => e
         # This might race, but there are enough possible cases that there
         # isn't a good, solid "better" way to do this, and the next call
         # should fail in the same way anyhow.
         raise if have_retried or File.exist?(file)
         have_retried = true
 
         # OK, so, we can't replace a file that doesn't exist, so let us put
         # one in place and set the permissions.  Then we can retry and the
         # magic makes this all work.
         #
         # This is the least-worst option for handling Windows, as far as we
         # can determine.
         File.open(file, 'a') do |fh|
           # this space deliberately left empty for auto-close behaviour,
           # append mode, and not actually changing any of the content.
         end
 
         # Set the permissions to what we want.
         Puppet::Util::Windows::Security.set_mode(default_mode, file.to_s)
 
         # ...and finally retry the operation.
         retry
       end
     else
       File.rename(tempfile.path, file)
     end
 
     # Ideally, we would now fsync the directory as well, but Ruby doesn't
     # have support for that, and it doesn't matter /that/ much...
 
     # Return something true, and possibly useful.
     file
   end
   module_function :replace_file
 
 
   # Executes a block of code, wrapped with some special exception handling.  Causes the ruby interpreter to
   #  exit if the block throws an exception.
   #
   # @param [String] message a message to log if the block fails
   # @param [Integer] code the exit code that the ruby interpreter should return if the block fails
   # @yield
   def exit_on_fail(message, code = 1)
     yield
   # First, we need to check and see if we are catching a SystemExit error.  These will be raised
   #  when we daemonize/fork, and they do not necessarily indicate a failure case.
   rescue SystemExit => err
     raise err
 
   # Now we need to catch *any* other kind of exception, because we may be calling third-party
   #  code (e.g. webrick), and we have no idea what they might throw.
   rescue Exception => err
     ## NOTE: when debugging spec failures, these two lines can be very useful
     #puts err.inspect
     #puts Puppet::Util.pretty_backtrace(err.backtrace)
     Puppet.log_exception(err, "Could not #{message}: #{err}")
     Puppet::Util::Log.force_flushqueue()
     exit(code)
   end
   module_function :exit_on_fail
 
 
 
 
   #######################################################################################################
   # Deprecated methods relating to process execution; these have been moved to Puppet::Util::Execution
   #######################################################################################################
 
   def execpipe(command, failonfail = true, &block)
     Puppet.deprecation_warning("Puppet::Util.execpipe is deprecated; please use Puppet::Util::Execution.execpipe")
     Puppet::Util::Execution.execpipe(command, failonfail, &block)
   end
   module_function :execpipe
 
   def execfail(command, exception)
     Puppet.deprecation_warning("Puppet::Util.execfail is deprecated; please use Puppet::Util::Execution.execfail")
     Puppet::Util::Execution.execfail(command, exception)
   end
   module_function :execfail
 
   def execute(command, arguments = {})
     Puppet.deprecation_warning("Puppet::Util.execute is deprecated; please use Puppet::Util::Execution.execute")
     Puppet::Util::Execution.execute(command, arguments)
   end
   module_function :execute
 
 end
 end
 
 
 require 'puppet/util/errors'
 require 'puppet/util/methodhelper'
 require 'puppet/util/metaid'
 require 'puppet/util/classgen'
 require 'puppet/util/docs'
 require 'puppet/util/execution'
 require 'puppet/util/logging'
 require 'puppet/util/package'
 require 'puppet/util/warnings'
diff --git a/lib/puppet/util/execution.rb b/lib/puppet/util/execution.rb
index e44157c12..c5020a1b1 100644
--- a/lib/puppet/util/execution.rb
+++ b/lib/puppet/util/execution.rb
@@ -1,254 +1,245 @@
 module Puppet
   require 'rbconfig'
 
   # A command failed to execute.
   require 'puppet/error'
   class ExecutionFailure < Puppet::Error
   end
 
 module Util::Execution
 
   # Execute the provided command with STDIN connected to a pipe, yielding the
   # pipe object.  That allows data to be fed to that subprocess.
   #
   # The command can be a simple string, which is executed as-is, or an Array,
   # which is treated as a set of command arguments to pass through.#
   #
   # In all cases this is passed directly to the shell, and STDOUT and STDERR
   # are connected together during execution.
   def self.execpipe(command, failonfail = true)
     if respond_to? :debug
       debug "Executing '#{command}'"
     else
       Puppet.debug "Executing '#{command}'"
     end
 
     # Paste together an array with spaces.  We used to paste directly
     # together, no spaces, which made for odd invocations; the user had to
     # include whitespace between arguments.
     #
     # Having two spaces is really not a big drama, since this passes to the
     # shell anyhow, while no spaces makes for a small developer cost every
     # time this is invoked. --daniel 2012-02-13
     command_str = command.respond_to?(:join) ? command.join(' ') : command
     output = open("| #{command_str} 2>&1") do |pipe|
       yield pipe
     end
 
     if failonfail
       unless $CHILD_STATUS == 0
         raise ExecutionFailure, output
       end
     end
 
     output
   end
 
   def self.execfail(command, exception)
     output = execute(command)
     return output
   rescue ExecutionFailure
     raise exception, output
   end
 
 
 
   # Execute the desired command, and return the status and output.
   # def execute(command, options)
   # [command] an Array or String representing the command to execute. If it is
   #   an Array the first element should be the executable and the rest of the
   #   elements should be the individual arguments to that executable.
   # [options] a Hash optionally containing any of the following keys:
   #   :failonfail (default true) -- if this value is set to true, then this method will raise an error if the
   #      command is not executed successfully.
   #   :uid (default nil) -- the user id of the user that the process should be run as
   #   :gid (default nil) -- the group id of the group that the process should be run as
   #   :combine (default true) -- sets whether or not to combine stdout/stderr in the output
   #   :stdinfile (default nil) -- sets a file that can be used for stdin. Passing a string for stdin is not currently
   #      supported.
   #   :squelch (default false) -- if true, ignore stdout / stderr completely
   #   :override_locale (default true) -- by default (and if this option is set to true), we will temporarily override
   #     the user/system locale to "C" (via environment variables LANG and LC_*) while we are executing the command.
   #     This ensures that the output of the command will be formatted consistently, making it predictable for parsing.
   #     Passing in a value of false for this option will allow the command to be executed using the user/system locale.
   #   :custom_environment (default {}) -- a hash of key/value pairs to set as environment variables for the duration
   #     of the command
   def self.execute(command, options = {})
     # specifying these here rather than in the method signature to allow callers to pass in a partial
     # set of overrides without affecting the default values for options that they don't pass in
     default_options = {
         :failonfail => true,
         :uid => nil,
         :gid => nil,
         :combine => true,
         :stdinfile => nil,
         :squelch => false,
         :override_locale => true,
         :custom_environment => {},
     }
 
     options = default_options.merge(options)
 
     if command.is_a?(Array)
       command = command.flatten.map(&:to_s)
       str = command.join(" ")
     elsif command.is_a?(String)
       str = command
     end
 
     if respond_to? :debug
       debug "Executing '#{str}'"
     else
       Puppet.debug "Executing '#{str}'"
     end
 
     null_file = Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null'
 
     stdin = File.open(options[:stdinfile] || null_file, 'r')
     stdout = options[:squelch] ? File.open(null_file, 'w') : Tempfile.new('puppet')
     stderr = options[:combine] ? stdout : File.open(null_file, 'w')
 
     exec_args = [command, options, stdin, stdout, stderr]
 
     if execution_stub = Puppet::Util::ExecutionStub.current_value
       return execution_stub.call(*exec_args)
     elsif Puppet.features.posix?
       child_pid = execute_posix(*exec_args)
       exit_status = Process.waitpid2(child_pid).last.exitstatus
     elsif Puppet.features.microsoft_windows?
       process_info = execute_windows(*exec_args)
       begin
         exit_status = Puppet::Util::Windows::Process.wait_process(process_info.process_handle)
       ensure
         Process.CloseHandle(process_info.process_handle)
         Process.CloseHandle(process_info.thread_handle)
       end
     end
 
     [stdin, stdout, stderr].each {|io| io.close rescue nil}
 
     # read output in if required
     unless options[:squelch]
       output = wait_for_output(stdout)
       Puppet.warning "Could not get output" unless output
     end
 
     if options[:failonfail] and exit_status != 0
       raise ExecutionFailure, "Execution of '#{str}' returned #{exit_status}: #{output}"
     end
 
     output
   end
 
   # get the path to the ruby executable (available via Config object, even if
   # it's not in the PATH... so this is slightly safer than just using
   # Puppet::Util.which)
   def self.ruby_path()
     File.join(RbConfig::CONFIG['bindir'],
               RbConfig::CONFIG['ruby_install_name'] + RbConfig::CONFIG['EXEEXT']).
       sub(/.*\s.*/m, '"\&"')
   end
 
   # Because some modules provide their own version of this method.
   class << self
     alias util_execute execute
   end
 
 
   # this is private method, see call to private_class_method after method definition
   def self.execute_posix(command, options, stdin, stdout, stderr)
     child_pid = Puppet::Util.safe_posix_fork(stdin, stdout, stderr) do
 
       # We can't just call Array(command), and rely on it returning
       # things like ['foo'], when passed ['foo'], because
       # Array(command) will call command.to_a internally, which when
       # given a string can end up doing Very Bad Things(TM), such as
       # turning "/tmp/foo;\r\n /bin/echo" into ["/tmp/foo;\r\n", " /bin/echo"]
       command = [command].flatten
       Process.setsid
       begin
         Puppet::Util::SUIDManager.change_privileges(options[:uid], options[:gid], true)
 
         # if the caller has requested that we override locale environment variables,
         if (options[:override_locale]) then
           # loop over them and clear them
           Puppet::Util::POSIX::LOCALE_ENV_VARS.each { |name| ENV.delete(name) }
           # set LANG and LC_ALL to 'C' so that the command will have consistent, predictable output
           # it's OK to manipulate these directly rather than, e.g., via "withenv", because we are in
           # a forked process.
           ENV['LANG'] = 'C'
           ENV['LC_ALL'] = 'C'
         end
 
         # unset all of the user-related environment variables so that different methods of starting puppet
         # (automatic start during boot, via 'service', via /etc/init.d, etc.) won't have unexpected side
         # effects relating to user / home dir environment vars.
         # it's OK to manipulate these directly rather than, e.g., via "withenv", because we are in
         # a forked process.
         Puppet::Util::POSIX::USER_ENV_VARS.each { |name| ENV.delete(name) }
 
         options[:custom_environment] ||= {}
         Puppet::Util.withenv(options[:custom_environment]) do
           Kernel.exec(*command)
         end
       rescue => detail
         Puppet.log_exception(detail, "Could not execute posix command: #{detail}")
         exit!(1)
       end
     end
     child_pid
   end
   private_class_method :execute_posix
 
 
   # this is private method, see call to private_class_method after method definition
   def self.execute_windows(command, options, stdin, stdout, stderr)
     command = command.map do |part|
       part.include?(' ') ? %Q["#{part.gsub(/"/, '\"')}"] : part
     end.join(" ") if command.is_a?(Array)
 
     options[:custom_environment] ||= {}
     Puppet::Util.withenv(options[:custom_environment]) do
       Puppet::Util::Windows::Process.execute(command, options, stdin, stdout, stderr)
     end
   end
   private_class_method :execute_windows
 
 
   # this is private method, see call to private_class_method after method definition
   def self.wait_for_output(stdout)
     # Make sure the file's actually been written.  This is basically a race
     # condition, and is probably a horrible way to handle it, but, well, oh
     # well.
     # (If this method were treated as private / inaccessible from outside of this file, we shouldn't have to worry
     #  about a race condition because all of the places that we call this from are preceded by a call to "waitpid2",
     #  meaning that the processes responsible for writing the file have completed before we get here.)
     2.times do |try|
       if File.exists?(stdout.path)
-        output = stdout.open.read
-
+        stdout.open
         begin
-          stdout.close(true)
-        rescue Errno::EACCES => e
-          # try to unlink, though it will fail on Windows if the child process,
-          # e.g. start.exe, executed another process asynchronously, as the
-          # grandchild still has a handle to the tempfile
-          raise e unless Puppet.features.microsoft_windows?
+          return stdout.read
+        ensure
+          stdout.close
+          stdout.unlink
         end
-
-        return output
       else
         time_to_sleep = try / 2.0
         Puppet.warning "Waiting for output; will sleep #{time_to_sleep} seconds"
         sleep(time_to_sleep)
       end
     end
     nil
   end
   private_class_method :wait_for_output
-
-
-
-
 end
 end
diff --git a/spec/unit/ssl/certificate_authority_spec.rb b/spec/unit/ssl/certificate_authority_spec.rb
index fb981f863..040558116 100755
--- a/spec/unit/ssl/certificate_authority_spec.rb
+++ b/spec/unit/ssl/certificate_authority_spec.rb
@@ -1,948 +1,948 @@
 #! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_authority'
 
 describe Puppet::SSL::CertificateAuthority do
   after do
     Puppet::SSL::CertificateAuthority.instance_variable_set(:@singleton_instance, nil)
     Puppet.settings.clearused
   end
 
   def stub_ca_host
     @key = mock 'key'
     @key.stubs(:content).returns "cakey"
     @cacert = mock 'certificate'
     @cacert.stubs(:content).returns "cacertificate"
 
     @host = stub 'ssl_host', :key => @key, :certificate => @cacert, :name => Puppet::SSL::Host.ca_name
   end
 
   it "should have a class method for returning a singleton instance" do
     Puppet::SSL::CertificateAuthority.should respond_to(:instance)
   end
 
   describe "when finding an existing instance" do
     describe "and the host is a CA host and the run_mode is master" do
       before do
         Puppet[:ca] = true
         Puppet.run_mode.stubs(:master?).returns true
 
         @ca = mock('ca')
         Puppet::SSL::CertificateAuthority.stubs(:new).returns @ca
       end
 
       it "should return an instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(@ca)
       end
 
       it "should always return the same instance" do
         Puppet::SSL::CertificateAuthority.instance.should equal(Puppet::SSL::CertificateAuthority.instance)
       end
     end
 
     describe "and the host is not a CA host" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns false
         Puppet.run_mode.stubs(:master?).returns true
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
 
     describe "and the run_mode is not master" do
       it "should return nil" do
         Puppet.settings.stubs(:value).with(:ca).returns true
         Puppet.run_mode.stubs(:master?).returns false
 
         ca = mock('ca')
         Puppet::SSL::CertificateAuthority.expects(:new).never
         Puppet::SSL::CertificateAuthority.instance.should be_nil
       end
     end
   end
 
   describe "when initializing" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
     end
 
     it "should always set its name to the value of :certname" do
       Puppet.settings.expects(:value).with(:certname).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.new.name.should == "ca_testing"
     end
 
     it "should create an SSL::Host instance whose name is the 'ca_name'" do
       Puppet::SSL::Host.expects(:ca_name).returns "caname"
 
       host = stub 'host'
       Puppet::SSL::Host.expects(:new).with("caname").returns host
 
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should use the :main, :ca, and :ssl settings sections" do
       Puppet.settings.expects(:use).with(:main, :ssl, :ca)
       Puppet::SSL::CertificateAuthority.new
     end
 
     it "should create an inventory instance" do
       Puppet::SSL::Inventory.expects(:new).returns "inventory"
 
       Puppet::SSL::CertificateAuthority.new.inventory.should == "inventory"
     end
 
     it "should make sure the CA is set up" do
       Puppet::SSL::CertificateAuthority.any_instance.expects(:setup)
 
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when setting itself up" do
     it "should generate the CA certificate if it does not have one" do
       Puppet.settings.stubs :use
 
       host = stub 'host'
       Puppet::SSL::Host.stubs(:new).returns host
 
       host.expects(:certificate).returns nil
 
       Puppet::SSL::CertificateAuthority.any_instance.expects(:generate_ca_certificate)
       Puppet::SSL::CertificateAuthority.new
     end
   end
 
   describe "when retrieving the certificate revocation list" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
       Puppet.settings.stubs(:value).with(:cacrl).returns "/my/crl"
 
       cert = stub("certificate", :content => "real_cert")
       key = stub("key", :content => "real_key")
       @host = stub 'host', :certificate => cert, :name => "hostname", :key => key
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @ca.stubs(:host).returns @host
     end
 
     it "should return any found CRL instance" do
       crl = mock 'crl'
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns crl
       @ca.crl.should equal(crl)
     end
 
     it "should create, generate, and save a new CRL instance of no CRL can be found" do
       crl = Puppet::SSL::CertificateRevocationList.new("fakename")
       Puppet::SSL::CertificateRevocationList.indirection.expects(:find).returns nil
 
       Puppet::SSL::CertificateRevocationList.expects(:new).returns crl
 
       crl.expects(:generate).with(@ca.host.certificate.content, @ca.host.key.content)
       Puppet::SSL::CertificateRevocationList.indirection.expects(:save).with(crl)
 
       @ca.crl.should equal(crl)
     end
   end
 
   describe "when generating a self-signed CA certificate" do
     before do
       Puppet.settings.stubs(:use)
       Puppet.settings.stubs(:value).returns "ca_testing"
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:setup)
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:crl)
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @host = stub 'host', :key => mock("key"), :name => "hostname", :certificate => mock('certificate')
 
       Puppet::SSL::CertificateRequest.any_instance.stubs(:generate)
 
       @ca.stubs(:host).returns @host
     end
 
     it "should create and store a password at :capass" do
       Puppet.settings.expects(:value).with(:capass).returns "/path/to/pass"
 
       FileTest.expects(:exist?).with("/path/to/pass").returns false
 
       fh = mock 'filehandle'
       Puppet.settings.expects(:write).with(:capass).yields fh
 
       fh.expects(:print).with { |s| s.length > 18 }
 
       @ca.stubs(:sign)
 
       @ca.generate_ca_certificate
     end
 
     it "should generate a key if one does not exist" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.generate_ca_certificate
     end
 
     it "should create and sign a self-signed cert using the CA name" do
       request = mock 'request'
       Puppet::SSL::CertificateRequest.expects(:new).with(@ca.host.name).returns request
       request.expects(:generate).with(@ca.host.key)
       request.stubs(:request_extensions => [])
 
       @ca.expects(:sign).with(@host.name, false, request)
 
       @ca.stubs :generate_password
 
       @ca.generate_ca_certificate
     end
 
     it "should generate its CRL" do
       @ca.stubs :generate_password
       @ca.stubs :sign
 
       @ca.host.expects(:key).returns nil
       @ca.host.expects(:generate_key)
 
       @ca.expects(:crl)
 
       @ca.generate_ca_certificate
     end
   end
 
   describe "when signing" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).with(Puppet::SSL::Host.ca_name).returns @host
 
       @ca = Puppet::SSL::CertificateAuthority.new
 
       @name = "myhost"
       @real_cert = stub 'realcert', :sign => nil
       @cert = Puppet::SSL::Certificate.new(@name)
       @cert.content = @real_cert
 
       Puppet::SSL::Certificate.stubs(:new).returns @cert
 
       @cert.stubs(:content=)
       Puppet::SSL::Certificate.indirection.stubs(:save)
 
       # Stub out the factory
       Puppet::SSL::CertificateFactory.stubs(:build).returns "my real cert"
 
       @request_content = stub "request content stub", :subject => OpenSSL::X509::Name.new([['CN', @name]])
       @request = stub 'request', :name => @name, :request_extensions => [], :subject_alt_names => [], :content => @request_content
 
       # And the inventory
       @inventory = stub 'inventory', :add => nil
       @ca.stubs(:inventory).returns @inventory
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:destroy)
     end
 
     describe "and calculating the next certificate serial number" do
       before do
         @path = "/path/to/serial"
         Puppet.settings.stubs(:value).with(:serial).returns @path
 
         @filehandle = stub 'filehandle', :<< => @filehandle
         Puppet.settings.stubs(:readwritelock).with(:serial).yields @filehandle
       end
 
       it "should default to 0x1 for the first serial number" do
         @ca.next_serial.should == 0x1
       end
 
       it "should return the current content of the serial file" do
         FileTest.stubs(:exist?).with(@path).returns true
         File.expects(:read).with(@path).returns "0002"
 
         @ca.next_serial.should == 2
       end
 
       it "should write the next serial number to the serial file as hex" do
         @filehandle.expects(:<<).with("0002")
 
         @ca.next_serial
       end
 
       it "should lock the serial file while writing" do
         Puppet.settings.expects(:readwritelock).with(:serial)
 
         @ca.next_serial
       end
     end
 
     describe "its own certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
       end
 
       it "should not look up a certificate request for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).never
 
         @ca.sign(@name, true, @request)
       end
 
       it "should use a certificate type of :ca" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0].should == :ca
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the provided CSR as the CSR" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[1].should == @request
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should use the provided CSR's content as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2].subject.to_s.should == "/CN=myhost"
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3].should == @serial
         end.returns "my real cert"
         @ca.sign(@name, :ca, @request)
       end
 
       it "should sign the certificate request even if it contains alt names" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false, @request)
         end.should_not raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.expects(:save).with(@cert)
 
         @ca.sign(@name, :ca, @request)
       end
     end
 
     describe "another host's certificate" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         Puppet::SSL::CertificateRequest.indirection.stubs :save
       end
 
       it "should use a certificate type of :server" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[0] == :server
         end.returns "my real cert"
 
         @ca.sign(@name)
       end
 
       it "should use look up a CSR for the host in the :ca_file terminus" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns @request
 
         @ca.sign(@name)
       end
 
       it "should fail if no CSR can be found for the host" do
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with(@name).returns nil
 
         lambda { @ca.sign(@name) }.should raise_error(ArgumentError)
       end
 
       it "should fail if an unknown request extension is present" do
         @request.stubs :request_extensions => [{ "oid"   => "bananas",
                                                  "value" => "delicious" }]
         expect { @ca.sign(@name) }.
           should raise_error(/CSR has request extensions that are not permitted/)
       end
 
       it "should fail if the CSR contains alt names and they are not expected" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name, false)
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should not fail if the CSR does not contain alt names and they are expected" do
         @request.stubs(:subject_alt_names).returns []
         expect { @ca.sign(@name, true) }.should_not raise_error
       end
 
       it "should reject alt names by default" do
         @request.stubs(:subject_alt_names).returns %w[DNS:foo DNS:bar DNS:baz]
 
         expect do
           @ca.sign(@name)
         end.to raise_error(Puppet::SSL::CertificateAuthority::CertificateSigningError, /CSR '#{@name}' contains subject alternative names \(.*?\), which are disallowed. Use `puppet cert --allow-dns-alt-names sign #{@name}` to sign this request./)
       end
 
       it "should use the CA certificate as the issuer" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[2] == @cacert.content
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should pass the next serial as the serial number" do
         Puppet::SSL::CertificateFactory.expects(:build).with do |*args|
           args[3] == @serial
         end.returns "my real cert"
         @ca.sign(@name)
       end
 
       it "should sign the resulting certificate using its real key and a digest" do
         digest = mock 'digest'
         OpenSSL::Digest::SHA256.expects(:new).returns digest
 
         key = stub 'key', :content => "real_key"
         @ca.host.stubs(:key).returns key
 
         @cert.content.expects(:sign).with("real_key", digest)
         @ca.sign(@name)
       end
 
       it "should save the resulting certificate" do
         Puppet::SSL::Certificate.indirection.stubs(:save).with(@cert)
         @ca.sign(@name)
       end
 
       it "should remove the host's certificate request" do
         Puppet::SSL::CertificateRequest.indirection.expects(:destroy).with(@name)
 
         @ca.sign(@name)
       end
 
       it "should check the internal signing policies" do
         @ca.expects(:check_internal_signing_policies).returns true
         @ca.sign(@name)
       end
     end
 
     context "#check_internal_signing_policies" do
       before do
         @serial = 10
         @ca.stubs(:next_serial).returns @serial
 
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
         @cert.stubs :save
       end
 
       it "should reject CSRs whose CN doesn't match the name for which we're signing them" do
         # Shorten this so the test doesn't take too long
         Puppet[:keylength] = 1024
         key = Puppet::SSL::Key.new('the_certname')
         key.generate
 
         csr = Puppet::SSL::CertificateRequest.new('the_certname')
         csr.generate(key)
 
         expect do
           @ca.check_internal_signing_policies('not_the_certname', csr, false)
         end.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /common name "the_certname" does not match expected certname "not_the_certname"/
         )
       end
 
       describe "when validating the CN" do
         before :all do
           Puppet[:keylength] = 1024
           Puppet[:passfile] = '/f00'
           @signing_key = Puppet::SSL::Key.new('my_signing_key')
           @signing_key.generate
         end
 
         [
          'completely_okay',
          'sure, why not? :)',
          'so+many(things)-are=allowed.',
          'this"is#just&madness%you[see]',
          'and even a (an?) \\!',
          'waltz, nymph, for quick jigs vex bud.',
          '{552c04ca-bb1b-11e1-874b-60334b04494e}'
         ].each do |name|
           it "should accept #{name.inspect}" do
             csr = Puppet::SSL::CertificateRequest.new(name)
             csr.generate(@signing_key)
 
             @ca.check_internal_signing_policies(name, csr, false)
           end
         end
 
         [
          'super/bad',
          "not\neven\tkind\rof",
          "ding\adong\a",
          "hidden\b\b\b\b\b\bmessage",
-         "☃ :("
+         "\xE2\x98\x83 :("
         ].each do |name|
           it "should reject #{name.inspect}" do
             # We aren't even allowed to make objects with these names, so let's
             # stub that to simulate an invalid one coming from outside Puppet
             Puppet::SSL::CertificateRequest.stubs(:validate_certname)
             csr = Puppet::SSL::CertificateRequest.new(name)
             csr.generate(@signing_key)
 
             expect do
               @ca.check_internal_signing_policies(name, csr, false)
             end.to raise_error(
               Puppet::SSL::CertificateAuthority::CertificateSigningError,
               /subject contains unprintable or non-ASCII characters/
             )
           end
         end
       end
 
       it "should reject a critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "banana",
                                                        "value" => "yumm",
                                                        "critical" => true }]
         expect { @ca.check_internal_signing_policies(@name, @request, false) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a non-critical extension that isn't on the whitelist" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false }]
         expect { @ca.check_internal_signing_policies(@name, @request, false) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject non-whitelist extensions even if a valid extension is present" do
         @request.stubs(:request_extensions).returns [{ "oid" => "peach",
                                                        "value" => "meh",
                                                        "critical" => false },
                                                      { "oid" => "subjectAltName",
                                                        "value" => "DNS:foo",
                                                        "critical" => true }]
         expect { @ca.check_internal_signing_policies(@name, @request, false) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /request extensions that are not permitted/
         )
       end
 
       it "should reject a subjectAltName for a non-DNS value" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'email:bar@example.com']
         expect { @ca.check_internal_signing_policies(@name, @request, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName outside the DNS label space/
         )
       end
 
       it "should reject a wildcard subject" do
         @request.content.stubs(:subject).
           returns(OpenSSL::X509::Name.new([["CN", "*.local"]]))
 
         expect { @ca.check_internal_signing_policies('*.local', @request, false) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subject contains a wildcard/
         )
       end
 
       it "should reject a wildcard subjectAltName" do
         @request.stubs(:subject_alt_names).returns ['DNS:foo', 'DNS:*.bar']
         expect { @ca.check_internal_signing_policies(@name, @request, true) }.to raise_error(
           Puppet::SSL::CertificateAuthority::CertificateSigningError,
           /subjectAltName contains a wildcard/
         )
       end
     end
 
     it "should create a certificate instance with the content set to the newly signed x509 certificate" do
       @serial = 10
       @ca.stubs(:next_serial).returns @serial
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       Puppet::SSL::Certificate.expects(:new).with(@name).returns @cert
 
       @ca.sign(@name)
     end
 
     it "should return the certificate instance" do
       @ca.stubs(:next_serial).returns @serial
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name).should equal(@cert)
     end
 
     it "should add the certificate to its inventory" do
       @ca.stubs(:next_serial).returns @serial
       @inventory.expects(:add).with(@cert)
 
       Puppet::SSL::CertificateRequest.indirection.stubs(:find).with(@name).returns @request
       Puppet::SSL::Certificate.indirection.stubs :save
       @ca.sign(@name)
     end
 
     it "should have a method for triggering autosigning of available CSRs" do
       @ca.should respond_to(:autosign)
     end
 
     describe "when autosigning certificates" do
       it "should do nothing if autosign is disabled" do
         Puppet.settings.expects(:value).with(:autosign).returns 'false'
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       it "should do nothing if no autosign.conf exists" do
         Puppet.settings.expects(:value).with(:autosign).returns '/auto/sign'
         FileTest.expects(:exist?).with("/auto/sign").returns false
 
         Puppet::SSL::CertificateRequest.indirection.expects(:search).never
         @ca.autosign
       end
 
       describe "and autosign is enabled and the autosign.conf file exists" do
         before do
           Puppet.settings.stubs(:value).with(:autosign).returns '/auto/sign'
           FileTest.stubs(:exist?).with("/auto/sign").returns true
           File.stubs(:readlines).with("/auto/sign").returns ["one\n", "two\n"]
 
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns []
 
           @store = stub 'store', :allow => nil
           Puppet::Network::AuthStore.stubs(:new).returns @store
         end
 
         describe "when creating the AuthStore instance to verify autosigning" do
           it "should create an AuthStore with each line in the configuration file allowed to be autosigned" do
             Puppet::Network::AuthStore.expects(:new).returns @store
 
             @store.expects(:allow).with("one")
             @store.expects(:allow).with("two")
 
             @ca.autosign
           end
 
           it "should reparse the autosign configuration on each call" do
             Puppet::Network::AuthStore.expects(:new).times(2).returns @store
 
             @ca.autosign
             @ca.autosign
           end
 
           it "should ignore comments" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "#two\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
 
           it "should ignore blank lines" do
             File.stubs(:readlines).with("/auto/sign").returns ["one\n", "\n"]
 
             @store.expects(:allow).with("one")
             @ca.autosign
           end
         end
 
         it "should sign all CSRs whose hostname matches the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
 
         it "should not sign CSRs whose hostname does not match the autosign configuration" do
           csr1 = mock 'csr1'
           csr2 = mock 'csr2'
           Puppet::SSL::CertificateRequest.indirection.stubs(:search).returns [csr1, csr2]
         end
       end
     end
   end
 
   describe "when managing certificate clients" do
     before do
       Puppet.settings.stubs(:use)
 
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:password?).returns true
 
       stub_ca_host
 
       Puppet::SSL::Host.expects(:new).returns @host
       Puppet::SSL::CertificateAuthority.any_instance.stubs(:host).returns @host
 
       @cacert = mock 'certificate'
       @cacert.stubs(:content).returns "cacertificate"
       @ca = Puppet::SSL::CertificateAuthority.new
     end
 
     it "should have a method for acting on the SSL files" do
       @ca.should respond_to(:apply)
     end
 
     describe "when applying a method to a set of hosts" do
       it "should fail if no subjects have been specified" do
         lambda { @ca.apply(:generate) }.should raise_error(ArgumentError)
       end
 
       it "should create an Interface instance with the specified method and the options" do
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).with(:generate, :to => :host).returns(stub('applier', :apply => nil))
         @ca.apply(:generate, :to => :host)
       end
 
       it "should apply the Interface with itself as the argument" do
         applier = stub('applier')
         applier.expects(:apply).with(@ca)
         Puppet::SSL::CertificateAuthority::Interface.expects(:new).returns applier
         @ca.apply(:generate, :to => :ca_testing)
       end
     end
 
     it "should be able to list waiting certificate requests" do
       req1 = stub 'req1', :name => "one"
       req2 = stub 'req2', :name => "two"
       Puppet::SSL::CertificateRequest.indirection.expects(:search).with("*").returns [req1, req2]
 
       @ca.waiting?.should == %w{one two}
     end
 
     it "should delegate removing hosts to the Host class" do
       Puppet::SSL::Host.expects(:destroy).with("myhost")
 
       @ca.destroy("myhost")
     end
 
     it "should be able to verify certificates" do
       @ca.should respond_to(:verify)
     end
 
     it "should list certificates as the sorted list of all existing signed certificates" do
       cert1 = stub 'cert1', :name => "cert1"
       cert2 = stub 'cert2', :name => "cert2"
       Puppet::SSL::Certificate.indirection.expects(:search).with("*").returns [cert1, cert2]
       @ca.list.should == %w{cert1 cert2}
     end
 
     describe "and printing certificates" do
       it "should return nil if the certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         @ca.print("myhost").should be_nil
       end
 
       it "should print certificates by calling :to_text on the host's certificate" do
         cert1 = stub 'cert1', :name => "cert1", :to_text => "mytext"
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns cert1
         @ca.print("myhost").should == "mytext"
       end
     end
 
     describe "and fingerprinting certificates" do
       before :each do
         @cert = stub 'cert', :name => "cert", :fingerprint => "DIGEST"
         Puppet::SSL::Certificate.indirection.stubs(:find).with("myhost").returns @cert
         Puppet::SSL::CertificateRequest.indirection.stubs(:find).with("myhost")
       end
 
       it "should raise an error if the certificate or CSR cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns nil
         lambda { @ca.fingerprint("myhost") }.should raise_error
       end
 
       it "should try to find a CSR if no certificate can be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("myhost").returns nil
         Puppet::SSL::CertificateRequest.indirection.expects(:find).with("myhost").returns @cert
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should delegate to the certificate fingerprinting" do
         @cert.expects(:fingerprint)
         @ca.fingerprint("myhost")
       end
 
       it "should propagate the digest algorithm to the certificate fingerprinting system" do
         @cert.expects(:fingerprint).with(:digest)
         @ca.fingerprint("myhost", :digest)
       end
     end
 
     describe "and verifying certificates" do
       before do
         @store = stub 'store', :verify => true, :add_file => nil, :purpose= => nil, :add_crl => true, :flags= => nil
 
         OpenSSL::X509::Store.stubs(:new).returns @store
 
         Puppet.settings.stubs(:value).returns "crtstuff"
 
         @cert = stub 'cert', :content => "mycert"
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
         @crl = stub('crl', :content => "mycrl")
 
         @ca.stubs(:crl).returns @crl
       end
 
       it "should fail if the host's certificate cannot be found" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("me").returns(nil)
 
         lambda { @ca.verify("me") }.should raise_error(ArgumentError)
       end
 
       it "should create an SSL Store to verify" do
         OpenSSL::X509::Store.expects(:new).returns @store
 
         @ca.verify("me")
       end
 
       it "should add the CA Certificate to the store" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should add the CRL to the store if the crl is enabled" do
         @store.expects(:add_crl).with "mycrl"
 
         @ca.verify("me")
       end
 
       it "should set the store purpose to OpenSSL::X509::PURPOSE_SSL_CLIENT" do
         Puppet.settings.stubs(:value).with(:cacert).returns "/ca/cert"
         @store.expects(:add_file).with "/ca/cert"
 
         @ca.verify("me")
       end
 
       it "should set the store flags to check the crl" do
         @store.expects(:flags=).with OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK
 
         @ca.verify("me")
       end
 
       it "should use the store to verify the certificate" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns true
 
         @ca.verify("me")
       end
 
       it "should fail if the verification returns false" do
         @cert.expects(:content).returns "mycert"
 
         @store.expects(:verify).with("mycert").returns false
 
         lambda { @ca.verify("me") }.should raise_error
       end
     end
 
     describe "and revoking certificates" do
       before do
         @crl = mock 'crl'
         @ca.stubs(:crl).returns @crl
 
         @ca.stubs(:next_serial).returns 10
 
         @real_cert = stub 'real_cert', :serial => 15
         @cert = stub 'cert', :content => @real_cert
         Puppet::SSL::Certificate.indirection.stubs(:find).returns @cert
 
       end
 
       it "should fail if the certificate revocation list is disabled" do
         @ca.stubs(:crl).returns false
 
         lambda { @ca.revoke('ca_testing') }.should raise_error(ArgumentError)
 
       end
 
       it "should delegate the revocation to its CRL" do
         @ca.crl.expects(:revoke)
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from the local certificate if it exists" do
         @ca.crl.expects(:revoke).with { |serial, key| serial == 15 }
 
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns @cert
 
         @ca.revoke('host')
       end
 
       it "should get the serial number from inventory if no local certificate exists" do
         real_cert = stub 'real_cert', :serial => 15
         cert = stub 'cert', :content => real_cert
         Puppet::SSL::Certificate.indirection.expects(:find).with("host").returns nil
 
         @ca.inventory.expects(:serial).with("host").returns 16
 
         @ca.crl.expects(:revoke).with { |serial, key| serial == 16 }
         @ca.revoke('host')
       end
     end
 
     it "should be able to generate a complete new SSL host" do
       @ca.should respond_to(:generate)
     end
 
     describe "and generating certificates" do
       before do
         @host = stub 'host', :generate_certificate_request => nil
         Puppet::SSL::Host.stubs(:new).returns @host
         Puppet::SSL::Certificate.indirection.stubs(:find).returns nil
 
         @ca.stubs(:sign)
       end
 
       it "should fail if a certificate already exists for the host" do
         Puppet::SSL::Certificate.indirection.expects(:find).with("him").returns "something"
 
         lambda { @ca.generate("him") }.should raise_error(ArgumentError)
       end
 
       it "should create a new Host instance with the correct name" do
         Puppet::SSL::Host.expects(:new).with("him").returns @host
 
         @ca.generate("him")
       end
 
       it "should use the Host to generate the certificate request" do
         @host.expects :generate_certificate_request
 
         @ca.generate("him")
       end
 
       it "should sign the generated request" do
         @ca.expects(:sign).with("him", false)
         @ca.generate("him")
       end
     end
   end
 end
diff --git a/spec/unit/util/execution_spec.rb b/spec/unit/util/execution_spec.rb
index ed66c78fc..f7efbaaca 100755
--- a/spec/unit/util/execution_spec.rb
+++ b/spec/unit/util/execution_spec.rb
@@ -1,557 +1,552 @@
 #! /usr/bin/env ruby -S rspec
 require 'spec_helper'
 
 describe Puppet::Util::Execution do
   include Puppet::Util::Execution
 
 
   # utility method to help deal with some windows vs. unix differences
   def process_status(exitstatus)
     return exitstatus if Puppet.features.microsoft_windows?
 
     stub('child_status', :exitstatus => exitstatus)
   end
 
   # utility methods to help us test some private methods without being quite so verbose
   def call_exec_posix(command, arguments, stdin, stdout, stderr)
     Puppet::Util::Execution.send(:execute_posix, command, arguments, stdin, stdout, stderr)
   end
   def call_exec_windows(command, arguments, stdin, stdout, stderr)
     Puppet::Util::Execution.send(:execute_windows, command, arguments, stdin, stdout, stderr)
   end
 
 
   describe "execution methods" do
     let(:pid) { 5501 }
     let(:process_handle) { 0xDEADBEEF }
     let(:thread_handle) { 0xCAFEBEEF }
     let(:proc_info_stub) { stub 'processinfo', :process_handle => process_handle, :thread_handle => thread_handle, :process_id => pid}
     let(:null_file) { Puppet.features.microsoft_windows? ? 'NUL' : '/dev/null' }
 
     def stub_process_wait(exitstatus)
       if Puppet.features.microsoft_windows?
         Puppet::Util::Windows::Process.stubs(:wait_process).with(process_handle).returns(exitstatus)
         Process.stubs(:CloseHandle).with(process_handle)
         Process.stubs(:CloseHandle).with(thread_handle)
       else
         Process.stubs(:waitpid2).with(pid).returns([pid, stub('child_status', :exitstatus => exitstatus)])
       end
     end
 
     describe "#execute_posix (stubs)", :unless => Puppet.features.microsoft_windows? do
       before :each do
         # Most of the things this method does are bad to do during specs. :/
         Kernel.stubs(:fork).returns(pid).yields
         Process.stubs(:setsid)
         Kernel.stubs(:exec)
         Puppet::Util::SUIDManager.stubs(:change_user)
         Puppet::Util::SUIDManager.stubs(:change_group)
 
         $stdin.stubs(:reopen)
         $stdout.stubs(:reopen)
         $stderr.stubs(:reopen)
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
 
         # there is a danger here that ENV will be modified by exec_posix.  Normally it would only affect the ENV
         #  of a forked process, but here, we're stubbing Kernel.fork, so the method has the ability to override the
         #  "real" ENV.  To guard against this, we'll capture a snapshot of ENV before each test.
         @saved_env = ENV.to_hash
 
         # Now, we're going to effectively "mock" the magic ruby 'ENV' variable by creating a local definition of it
         #  inside of the module we're testing.
         Puppet::Util::Execution::ENV = {}
       end
 
       after :each do
         # And here we remove our "mock" version of 'ENV', which will allow us to validate that the real ENV has been
         #  left unharmed.
         Puppet::Util::Execution.send(:remove_const, :ENV)
 
         # capture the current environment and make sure it's the same as it was before the test
         cur_env = ENV.to_hash
 
         # we will get some fairly useless output if we just use the raw == operator on the hashes here, so we'll
         #  be a bit more explicit and laborious in the name of making the error more useful...
         @saved_env.each_pair { |key,val| cur_env[key].should == val }
         (cur_env.keys - @saved_env.keys).should == []
 
       end
 
 
       it "should fork a child process to execute the command" do
         Kernel.expects(:fork).returns(pid).yields
         Kernel.expects(:exec).with('test command')
 
         call_exec_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should start a new session group" do
         Process.expects(:setsid)
 
         call_exec_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should permanently change to the correct user and group if specified" do
         Puppet::Util::SUIDManager.expects(:change_group).with(55, true)
         Puppet::Util::SUIDManager.expects(:change_user).with(50, true)
 
         call_exec_posix('test command', {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should exit failure if there is a problem execing the command" do
         Kernel.expects(:exec).with('test command').raises("failed to execute!")
         Puppet::Util::Execution.stubs(:puts)
         Puppet::Util::Execution.expects(:exit!).with(1)
 
         call_exec_posix('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute commands specified as arrays" do
         Kernel.expects(:exec).with('test command', 'with', 'arguments')
 
         call_exec_posix(['test command', 'with', 'arguments'], {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should properly execute string commands with embedded newlines" do
         Kernel.expects(:exec).with("/bin/echo 'foo' ; \n /bin/echo 'bar' ;")
 
         call_exec_posix("/bin/echo 'foo' ; \n /bin/echo 'bar' ;", {:uid => 50, :gid => 55}, @stdin, @stdout, @stderr)
       end
 
       it "should return the pid of the child process" do
         call_exec_posix('test command', {}, @stdin, @stdout, @stderr).should == pid
       end
     end
 
     describe "#execute_windows (stubs)", :if => Puppet.features.microsoft_windows? do
       before :each do
         Process.stubs(:create).returns(proc_info_stub)
         stub_process_wait(0)
 
         @stdin  = File.open(null_file, 'r')
         @stdout = Tempfile.new('stdout')
         @stderr = File.open(null_file, 'w')
       end
 
       it "should create a new process for the command" do
         Process.expects(:create).with(
           :command_line => "test command",
           :startup_info => {:stdin => @stdin, :stdout => @stdout, :stderr => @stderr},
           :close_handles => false
         ).returns(proc_info_stub)
 
         call_exec_windows('test command', {}, @stdin, @stdout, @stderr)
       end
 
       it "should return the process info of the child process" do
         call_exec_windows('test command', {}, @stdin, @stdout, @stderr).should == proc_info_stub
       end
 
       it "should quote arguments containing spaces if command is specified as an array" do
         Process.expects(:create).with do |args|
           args[:command_line] == '"test command" with some "arguments \"with spaces"'
         end.returns(proc_info_stub)
 
         call_exec_windows(['test command', 'with', 'some', 'arguments "with spaces'], {}, @stdin, @stdout, @stderr)
       end
     end
 
     describe "#execute (stubs)" do
       before :each do
         stub_process_wait(0)
       end
 
       describe "when an execution stub is specified" do
         before :each do
           Puppet::Util::ExecutionStub.set do |command,args,stdin,stdout,stderr|
             "execution stub output"
           end
         end
 
         it "should call the block on the stub" do
           Puppet::Util::Execution.execute("/usr/bin/run_my_execute_stub").should == "execution stub output"
         end
 
         it "should not actually execute anything" do
           Puppet::Util::Execution.expects(:execute_posix).never
           Puppet::Util::Execution.expects(:execute_windows).never
 
           Puppet::Util::Execution.execute("/usr/bin/run_my_execute_stub")
         end
       end
 
       describe "when setting up input and output files" do
         include PuppetSpec::Files
         let(:executor) { Puppet.features.microsoft_windows? ? 'execute_windows' : 'execute_posix' }
         let(:rval) { Puppet.features.microsoft_windows? ? proc_info_stub : pid }
 
         before :each do
           Puppet::Util::Execution.stubs(:wait_for_output)
         end
 
         it "should set stdin to the stdinfile if specified" do
           input = tmpfile('stdin')
           FileUtils.touch(input)
 
           Puppet::Util::Execution.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == input
           end.returns(rval)
 
           Puppet::Util::Execution.execute('test command', :stdinfile => input)
         end
 
         it "should set stdin to the null file if not specified" do
           Puppet::Util::Execution.expects(executor).with do |_,_,stdin,_,_|
             stdin.path == null_file
           end.returns(rval)
 
           Puppet::Util::Execution.execute('test command')
         end
 
         describe "when squelch is set" do
           it "should set stdout and stderr to the null file" do
             Puppet::Util::Execution.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == null_file and stderr.path == null_file
             end.returns(rval)
 
             Puppet::Util::Execution.execute('test command', :squelch => true)
           end
         end
 
         describe "when squelch is not set" do
           it "should set stdout to a temporary output file" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util::Execution.expects(executor).with do |_,_,_,stdout,_|
               stdout.path == outfile.path
             end.returns(rval)
 
             Puppet::Util::Execution.execute('test command', :squelch => false)
           end
 
           it "should set stderr to the same file as stdout if combine is true" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util::Execution.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == outfile.path
             end.returns(rval)
 
             Puppet::Util::Execution.execute('test command', :squelch => false, :combine => true)
           end
 
           it "should set stderr to the null device if combine is false" do
             outfile = Tempfile.new('stdout')
             Tempfile.stubs(:new).returns(outfile)
 
             Puppet::Util::Execution.expects(executor).with do |_,_,_,stdout,stderr|
               stdout.path == outfile.path and stderr.path == null_file
             end.returns(rval)
 
             Puppet::Util::Execution.execute('test command', :squelch => false, :combine => false)
           end
         end
       end
 
       describe "on Windows", :if => Puppet.features.microsoft_windows? do
         it "should always close the process and thread handles" do
           Puppet::Util::Execution.stubs(:execute_windows).returns(proc_info_stub)
 
           Puppet::Util::Windows::Process.expects(:wait_process).with(process_handle).raises('whatever')
           Process.expects(:CloseHandle).with(thread_handle)
           Process.expects(:CloseHandle).with(process_handle)
 
           expect { Puppet::Util::Execution.execute('test command') }.should raise_error(RuntimeError)
         end
       end
     end
 
     describe "#execute (posix locale)", :unless => Puppet.features.microsoft_windows?  do
 
       before :each do
         # there is a danger here that ENV will be modified by exec_posix.  Normally it would only affect the ENV
         #  of a forked process, but, in some of the previous tests in this file we're stubbing Kernel.fork., which could
         #  allow the method to override the "real" ENV.  This shouldn't be a problem for these tests because they are
         #  not stubbing Kernel.fork, but, better safe than sorry... so, to guard against this, we'll capture a snapshot
         #  of ENV before each test.
         @saved_env = ENV.to_hash
       end
 
       after :each do
         # capture the current environment and make sure it's the same as it was before the test
         cur_env = ENV.to_hash
         # we will get some fairly useless output if we just use the raw == operator on the hashes here, so we'll
         #  be a bit more explicit and laborious in the name of making the error more useful...
         @saved_env.each_pair { |key,val| cur_env[key].should == val }
         (cur_env.keys - @saved_env.keys).should == []
       end
 
 
       # build up a printf-style string that contains a command to get the value of an environment variable
       # from the operating system.  We can substitute into this with the names of the desired environment variables later.
       get_env_var_cmd = 'echo $%s'
 
       # a sentinel value that we can use to emulate what locale environment variables might be set to on an international
       # system.
       lang_sentinel_value = "es_ES.UTF-8"
       # a temporary hash that contains sentinel values for each of the locale environment variables that we override in
       # "execute"
       locale_sentinel_env = {}
       Puppet::Util::POSIX::LOCALE_ENV_VARS.each { |var| locale_sentinel_env[var] = lang_sentinel_value }
 
       it "should override the locale environment variables when :override_locale is not set (defaults to true)" do
         # temporarily override the locale environment vars with a sentinel value, so that we can confirm that
         # execute is actually setting them.
         Puppet::Util.withenv(locale_sentinel_env) do
           Puppet::Util::POSIX::LOCALE_ENV_VARS.each do |var|
             # we expect that all of the POSIX vars will have been cleared except for LANG and LC_ALL
             expected_value = (['LANG', 'LC_ALL'].include?(var)) ? "C" : ""
             Puppet::Util::execute(get_env_var_cmd % var).strip.should == expected_value
           end
         end
       end
 
       it "should override the LANG environment variable when :override_locale is set to true" do
         # temporarily override the locale environment vars with a sentinel value, so that we can confirm that
         # execute is actually setting them.
         Puppet::Util.withenv(locale_sentinel_env) do
           Puppet::Util::POSIX::LOCALE_ENV_VARS.each do |var|
             # we expect that all of the POSIX vars will have been cleared except for LANG and LC_ALL
             expected_value = (['LANG', 'LC_ALL'].include?(var)) ? "C" : ""
             Puppet::Util::execute(get_env_var_cmd % var, {:override_locale => true}).strip.should == expected_value
           end
         end
       end
 
       it "should *not* override the LANG environment variable when :override_locale is set to false" do
         # temporarily override the locale environment vars with a sentinel value, so that we can confirm that
         # execute is not setting them.
         Puppet::Util.withenv(locale_sentinel_env) do
           Puppet::Util::POSIX::LOCALE_ENV_VARS.each do |var|
             Puppet::Util::execute(get_env_var_cmd % var, {:override_locale => false}).strip.should == lang_sentinel_value
           end
         end
       end
 
       it "should have restored the LANG and locale environment variables after execution" do
         # we'll do this once without any sentinel values, to give us a little more test coverage
         orig_env_vals = {}
         Puppet::Util::POSIX::LOCALE_ENV_VARS.each do |var|
           orig_env_vals[var] = ENV[var]
         end
         # now we can really execute any command--doesn't matter what it is...
         Puppet::Util::execute(get_env_var_cmd % 'anything', {:override_locale => true})
         # now we check and make sure the original environment was restored
         Puppet::Util::POSIX::LOCALE_ENV_VARS.each do |var|
           ENV[var].should == orig_env_vals[var]
         end
 
         # now, once more... but with our sentinel values
         Puppet::Util.withenv(locale_sentinel_env) do
           # now we can really execute any command--doesn't matter what it is...
           Puppet::Util::execute(get_env_var_cmd % 'anything', {:override_locale => true})
           # now we check and make sure the original environment was restored
           Puppet::Util::POSIX::LOCALE_ENV_VARS.each do |var|
             ENV[var].should == locale_sentinel_env[var]
           end
         end
 
       end
     end
 
     describe "#execute (posix user env vars)", :unless => Puppet.features.microsoft_windows?  do
       # build up a printf-style string that contains a command to get the value of an environment variable
       # from the operating system.  We can substitute into this with the names of the desired environment variables later.
       get_env_var_cmd = 'echo $%s'
 
       # a sentinel value that we can use to emulate what locale environment variables might be set to on an international
       # system.
       user_sentinel_value = "Abracadabra"
       # a temporary hash that contains sentinel values for each of the locale environment variables that we override in
       # "execute"
       user_sentinel_env = {}
       Puppet::Util::POSIX::USER_ENV_VARS.each { |var| user_sentinel_env[var] = user_sentinel_value }
 
       it "should unset user-related environment vars during execution" do
         # first we set up a temporary execution environment with sentinel values for the user-related environment vars
         # that we care about.
         Puppet::Util.withenv(user_sentinel_env) do
           # with this environment, we loop over the vars in question
           Puppet::Util::POSIX::USER_ENV_VARS.each do |var|
             # ensure that our temporary environment is set up as we expect
             ENV[var].should == user_sentinel_env[var]
 
             # run an "exec" via the provider and ensure that it unsets the vars
             Puppet::Util::execute(get_env_var_cmd % var).strip.should == ""
 
             # ensure that after the exec, our temporary env is still intact
             ENV[var].should == user_sentinel_env[var]
           end
 
         end
       end
 
       it "should have restored the user-related environment variables after execution" do
         # we'll do this once without any sentinel values, to give us a little more test coverage
         orig_env_vals = {}
         Puppet::Util::POSIX::USER_ENV_VARS.each do |var|
           orig_env_vals[var] = ENV[var]
         end
         # now we can really execute any command--doesn't matter what it is...
         Puppet::Util::execute(get_env_var_cmd % 'anything')
         # now we check and make sure the original environment was restored
         Puppet::Util::POSIX::USER_ENV_VARS.each do |var|
           ENV[var].should == orig_env_vals[var]
         end
 
         # now, once more... but with our sentinel values
         Puppet::Util.withenv(user_sentinel_env) do
           # now we can really execute any command--doesn't matter what it is...
           Puppet::Util::execute(get_env_var_cmd % 'anything')
           # now we check and make sure the original environment was restored
           Puppet::Util::POSIX::USER_ENV_VARS.each do |var|
             ENV[var].should == user_sentinel_env[var]
           end
         end
 
       end
     end
 
     describe "after execution" do
       before :each do
         stub_process_wait(0)
 
         if Puppet.features.microsoft_windows?
           Puppet::Util::Execution.stubs(:execute_windows).returns(proc_info_stub)
         else
           Puppet::Util::Execution.stubs(:execute_posix).returns(pid)
         end
       end
 
       it "should wait for the child process to exit" do
         Puppet::Util::Execution.stubs(:wait_for_output)
 
         Puppet::Util::Execution.execute('test command')
       end
 
       it "should close the stdin/stdout/stderr files used by the child" do
         stdin = mock 'file', :close
         stdout = mock 'file', :close
         stderr = mock 'file', :close
 
         File.expects(:open).
             times(3).
             returns(stdin).
             then.returns(stdout).
             then.returns(stderr)
 
         Puppet::Util::Execution.execute('test command', {:squelch => true, :combine => false})
       end
 
       it "should read and return the output if squelch is false" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util::Execution.execute('test command').should == "My expected command output"
       end
 
       it "should not read the output if squelch is true" do
         stdout = Tempfile.new('test')
         Tempfile.stubs(:new).returns(stdout)
         stdout.write("My expected command output")
 
         Puppet::Util::Execution.execute('test command', :squelch => true).should == nil
       end
 
       it "should delete the file used for output if squelch is false" do
         stdout = Tempfile.new('test')
         path = stdout.path
         Tempfile.stubs(:new).returns(stdout)
 
         Puppet::Util::Execution.execute('test command')
 
         File.should_not be_exist(path)
       end
 
-      it "should handle when unlink fails" do
+      it "should not raise an error if the file is open" do
         stdout = Tempfile.new('test')
-        stdout.stubs(:close)
-        stdout.expects(:close).with(true).raises(Errno::EACCES, stdout.path)
         Tempfile.stubs(:new).returns(stdout)
+        file = File.new(stdout.path, 'r')
 
-        if Puppet.features.microsoft_windows?
+        expect {
           Puppet::Util.execute('test command')
-        else
-          expect {
-            Puppet::Util.execute('test command')
-          }.to raise_error(Errno::EACCES, /Permission denied/)
-        end
+        }.to_not raise_error
       end
 
       it "should raise an error if failonfail is true and the child failed" do
         stub_process_wait(1)
 
         expect {
           Puppet::Util::Execution.execute('fail command', :failonfail => true)
         }.to raise_error(Puppet::ExecutionFailure, /Execution of 'fail command' returned 1/)
       end
 
       it "should not raise an error if failonfail is false and the child failed" do
         stub_process_wait(1)
 
         expect {
           Puppet::Util::Execution.execute('fail command', :failonfail => false)
         }.not_to raise_error
       end
 
       it "should not raise an error if failonfail is true and the child succeeded" do
         expect {
           Puppet::Util::Execution.execute('fail command', :failonfail => true)
         }.not_to raise_error
       end
 
       it "should respect default values for args that aren't overridden if a partial arg list is passed in" do
         stub_process_wait(1)
         expect {
           # here we are passing in a non-nil value for "arguments", but we aren't specifying a value for
           # :failonfail.  We expect it to be set to its normal default value (true).
           Puppet::Util::Execution.execute('fail command', { :squelch => true })
         }.to raise_error(Puppet::ExecutionFailure, /Execution of 'fail command' returned 1/)
       end
     end
   end
 
   describe "#execpipe" do
     it "should execute a string as a string" do
       Puppet::Util::Execution.expects(:open).with('| echo hello 2>&1').returns('hello')
       $CHILD_STATUS.expects(:==).with(0).returns(true)
       Puppet::Util::Execution.execpipe('echo hello').should == 'hello'
     end
 
     it "should execute an array by pasting together with spaces" do
       Puppet::Util::Execution.expects(:open).with('| echo hello 2>&1').returns('hello')
       $CHILD_STATUS.expects(:==).with(0).returns(true)
       Puppet::Util::Execution.execpipe(['echo', 'hello']).should == 'hello'
     end
 
     it "should fail if asked to fail, and the child does" do
       Puppet::Util::Execution.stubs(:open).returns('error message')
       $CHILD_STATUS.expects(:==).with(0).returns(false)
       expect { Puppet::Util::Execution.execpipe('echo hello') }.
         to raise_error Puppet::ExecutionFailure, /error message/
     end
 
     it "should not fail if asked not to fail, and the child does" do
       Puppet::Util::Execution.stubs(:open).returns('error message')
       $CHILD_STATUS.stubs(:==).with(0).returns(false)
       expect do
         Puppet::Util::Execution.execpipe('echo hello', false).should == 'error message'
       end.not_to raise_error
     end
   end
 end