diff --git a/acceptance/tests/environment/use_enc_environment_for_pluginsync.rb b/acceptance/tests/environment/use_enc_environment_for_pluginsync.rb
index 0a3f34a1c..72a12ed33 100644
--- a/acceptance/tests/environment/use_enc_environment_for_pluginsync.rb
+++ b/acceptance/tests/environment/use_enc_environment_for_pluginsync.rb
@@ -1,43 +1,43 @@
 test_name "Agent should use environment given by ENC for pluginsync"
 
 testdir = master.tmpdir('respect_enc_test')
 
 create_remote_file master, "#{testdir}/enc.rb", <<END
 #!#{master['puppetbindir']}/ruby
 puts <<YAML
 parameters:
 environment: special
 YAML
 END
 on master, "chmod 755 #{testdir}/enc.rb"
 
 master_opts = {
   'master' => {
     'node_terminus' => 'exec',
     'external_nodes' => "#{testdir}/enc.rb"
   },
   'special' => {
     'modulepath' => "#{testdir}/special"
   }
 }
 if master.is_pe?
   master_opts['special']['modulepath'] << ":#{master['sitemoduledir']}"
 end
 
 on master, "mkdir -p #{testdir}/modules"
 # Create a plugin file on the master
 on master, "mkdir -p #{testdir}/special/amod/lib/puppet"
 create_remote_file(master, "#{testdir}/special/amod/lib/puppet/foo.rb", "#special_version")
 
 on master, "chown -R #{master['user']}:#{master['group']} #{testdir}"
 on master, "chmod -R g+rwX #{testdir}"
 
 with_puppet_running_on master, master_opts, testdir do
 
   agents.each do |agent|
     run_agent_on(agent, "--no-daemonize --onetime --server #{master}")
-    on agent, "cat #{agent.puppet['vardir']}/lib/puppet/foo.rb"
+    on agent, "cat \"#{agent.puppet['vardir']}/lib/puppet/foo.rb\""
     assert_match(/#special_version/, stdout, "The plugin from environment 'special' was not synced")
-    on agent, "rm -rf #{agent.puppet['vardir']}/lib"
+    on agent, "rm -rf \"#{agent.puppet['vardir']}/lib\""
   end
 end
diff --git a/acceptance/tests/pluginsync/files_earlier_in_modulepath_take_precendence.rb b/acceptance/tests/pluginsync/files_earlier_in_modulepath_take_precendence.rb
index 076ca63d7..62cc95121 100644
--- a/acceptance/tests/pluginsync/files_earlier_in_modulepath_take_precendence.rb
+++ b/acceptance/tests/pluginsync/files_earlier_in_modulepath_take_precendence.rb
@@ -1,49 +1,49 @@
 test_name "earlier modules take precendence over later modules in the modulepath"
 
 step "Create some modules in the modulepath"
 basedir = master.tmpdir("module_precedence")
 module1libdir = "#{basedir}/1"
 module2libdir = "#{basedir}/2"
 
 apply_manifest_on(master, <<MANIFEST)
 file { "#{basedir}":
   owner => #{master['group']},
   recurse => true,
   require => File[mod1, mod2]
 }
 
 Exec { path => "/bin:/usr/bin" }
 
 exec { "mod1path": command => "mkdir -p #{module1libdir}/a/lib" }
 exec { "mod2path": command => "mkdir -p #{module2libdir}/a/lib" }
 
 file { "mod1":
   path => "#{module1libdir}/a/lib/foo.rb",
   content => "'from the first module'",
   owner => #{master['group']},
   require => Exec[mod1path]
 }
 
 file { "mod2":
   path => "#{module2libdir}/a/lib/foo.rb",
   content => "'from the second module'",
   owner => #{master['group']},
   require => Exec[mod2path]
 }
 MANIFEST
 
 master_opts = {
   'master' => {
     'modulepath' => "#{module1libdir}:#{module2libdir}",
     'node_terminus' => 'plain',
   }
 }
 
 with_puppet_running_on master, master_opts, basedir do
   agents.each do |agent|
     on(agent, puppet('agent', "-t --server #{master}"))
-    on agent, "cat #{agent.puppet['vardir']}/lib/foo.rb" do
+    on agent, "cat \"#{agent.puppet['vardir']}/lib/foo.rb\"" do
       assert_match(/from the first module/, stdout, "The synced plugin was not found or the wrong version was synced")
     end
   end
 end
diff --git a/acceptance/tests/ticket_6541_invalid_filebucket_files.rb b/acceptance/tests/ticket_6541_invalid_filebucket_files.rb
index 46972d203..b743efe87 100644
--- a/acceptance/tests/ticket_6541_invalid_filebucket_files.rb
+++ b/acceptance/tests/ticket_6541_invalid_filebucket_files.rb
@@ -1,33 +1,33 @@
 test_name "#6541: file type truncates target when filebucket cannot retrieve hash"
 
 agents.each do |agent|
   target=agent.tmpfile('6541-target')
 
-  on agent, host_command('rm -rf #{host.puppet["vardir"]}/*bucket')
+  on agent, "rm -rf \"#{agent.puppet['vardir']}/*bucket\""
 
   step "write zero length file"
   manifest = "file { '#{target}': content => '' }"
   apply_manifest_on(agent, manifest)
 
   step "overwrite file, causing zero-length file to be backed up"
   manifest = "file { '#{target}': content => 'some text' }"
   apply_manifest_on(agent, manifest)
 
   test_name "verify invalid hashes should not change the file"
   manifest = "file { '#{target}': content => '{md5}notahash' }"
   apply_manifest_on(agent, manifest) do
     assert_no_match(/content changed/, stdout, "#{agent}: shouldn't have overwrote the file")
   end
 
   test_name "verify valid but unbucketed hashes should not change the file"
   manifest = "file { '#{target}': content => '{md5}13ad7345d56b566a4408ffdcd877bc78' }"
   apply_manifest_on(agent, manifest) do
     assert_no_match(/content changed/, stdout, "#{agent}: shouldn't have overwrote the file")
   end
 
   test_name "verify that an empty file can be retrieved from the filebucket"
   manifest = "file { '#{target}': content => '{md5}d41d8cd98f00b204e9800998ecf8427e' }"
   apply_manifest_on(agent, manifest) do
     assert_match(/content changed '\{md5\}552e21cd4cd9918678e3c1a0df491bc3' to '\{md5\}d41d8cd98f00b204e9800998ecf8427e'/, stdout, "#{agent}: shouldn't have overwrote the file")
   end
 end
diff --git a/acceptance/tests/ticket_6734_6256_5530_5503.rb b/acceptance/tests/ticket_6734_6256_5530_5503.rb
index 32d8b86cd..04419ed22 100644
--- a/acceptance/tests/ticket_6734_6256_5530_5503.rb
+++ b/acceptance/tests/ticket_6734_6256_5530_5503.rb
@@ -1,12 +1,12 @@
 # Puppet master fails to start due to impropper
 # permissons on the puppet/ dir.  Specially, the rrd
 # sub dir is not created when puppet master starts
 
 test_name "Tickets 6734 6256 5530 5503i Puppet Master fails to start"
 
 with_puppet_running_on master, {} do
   step "Check permissions on puppet/rrd/"
-  on master, "ls -l #{master.puppet['vardir']} | grep rrd | awk '{print $3\" \"$4}'" do
+  on master, "ls -l \"#{master.puppet['vardir']}\" | grep rrd | awk '{print $3\" \"$4}'" do
     assert_match(/#{master['group']} #{master['group']}/, stdout, "puppet/rrd does not exist/wrong permissions")
   end
 end
diff --git a/acceptance/tests/ticket_9862_puppet_runs_without_service_user_or_group_present.rb b/acceptance/tests/ticket_9862_puppet_runs_without_service_user_or_group_present.rb
index f6c23ca83..bdd98e414 100644
--- a/acceptance/tests/ticket_9862_puppet_runs_without_service_user_or_group_present.rb
+++ b/acceptance/tests/ticket_9862_puppet_runs_without_service_user_or_group_present.rb
@@ -1,65 +1,65 @@
 test_name "#9862: puppet runs without service user or group present"
 
 # puppet doesn't try to manage ownership on windows.
 confine :except, :platform => 'windows'
 
 require 'puppet/acceptance/temp_file_utils'
 extend Puppet::Acceptance::TempFileUtils
 initialize_temp_dirs
 
 def assert_ownership(agent, location, expected_user, expected_group)
   on(agent, "stat --format '%U:%G' #{location}") do
     assert_match(/#{expected_user}:#{expected_group}/, stdout)
   end
 end
 
 def missing_directory_for(agent, dir)
   agent_dir = get_test_file_path(agent, dir)
   on agent, "rm -rf #{agent_dir}"
   agent_dir
 end
 
 teardown do
   agents.each do |agent|
     step "ensure puppet resets it's user/group settings"
     on agent, puppet('apply', '-e', '"notify { puppet_run: }"')
-    on agent, "find #{agent.puppet['vardir']} -user existinguser" do
+    on agent, "find \"#{agent.puppet['vardir']}\" -user existinguser" do
       assert_equal('',stdout)
     end
     on agent, puppet('resource', 'user', 'existinguser', 'ensure=absent')
     on agent, puppet('resource', 'group', 'existinggroup', 'ensure=absent')
   end
 end
 
 step "when the user and group are missing"
 agents.each do |agent|
   logdir = missing_directory_for(agent, 'log')
 
   on agent, puppet('apply',
                    '-e', '"notify { puppet_run: }"',
                    '--logdir', logdir,
                    '--user', 'missinguser',
                    '--group', 'missinggroup') do
 
     assert_match(/puppet_run/, stdout)
     assert_ownership(agent, logdir, 'root', 'root')
   end
 end
 
 step "when the user and group exist"
 agents.each do |agent|
   logdir = missing_directory_for(agent, 'log')
 
   on agent, puppet('resource', 'user', 'existinguser', 'ensure=present')
   on agent, puppet('resource', 'group', 'existinggroup', 'ensure=present')
 
   on agent, puppet('apply',
                    '-e', '"notify { puppet_run: }"',
                    '--logdir', logdir,
                    '--user', 'existinguser',
                    '--group', 'existinggroup') do
 
     assert_match(/puppet_run/, stdout)
     assert_ownership(agent, logdir, 'existinguser', 'existinggroup')
   end
 end
diff --git a/lib/puppet/resource/catalog.rb b/lib/puppet/resource/catalog.rb
index 7de7df8dc..5a67f2574 100644
--- a/lib/puppet/resource/catalog.rb
+++ b/lib/puppet/resource/catalog.rb
@@ -1,549 +1,552 @@
 require 'puppet/node'
 require 'puppet/indirector'
 require 'puppet/transaction'
 require 'puppet/util/pson'
 require 'puppet/util/tagging'
 require 'puppet/graph'
 
 # This class models a node catalog.  It is the thing meant to be passed
 # from server to client, and it contains all of the information in the
 # catalog, including the resources and the relationships between them.
 #
 # @api public
 
 class Puppet::Resource::Catalog < Puppet::Graph::SimpleGraph
   class DuplicateResourceError < Puppet::Error
     include Puppet::ExternalFileError
   end
 
   extend Puppet::Indirector
   indirects :catalog, :terminus_setting => :catalog_terminus
 
   include Puppet::Util::Tagging
   extend Puppet::Util::Pson
 
   # The host name this is a catalog for.
   attr_accessor :name
 
   # The catalog version.  Used for testing whether a catalog
   # is up to date.
   attr_accessor :version
 
   # How long this catalog took to retrieve.  Used for reporting stats.
   attr_accessor :retrieval_duration
 
   # Whether this is a host catalog, which behaves very differently.
   # In particular, reports are sent, graphs are made, and state is
   # stored in the state database.  If this is set incorrectly, then you often
   # end up in infinite loops, because catalogs are used to make things
   # that the host catalog needs.
   attr_accessor :host_config
 
   # Whether this catalog was retrieved from the cache, which affects
   # whether it is written back out again.
   attr_accessor :from_cache
 
   # Some metadata to help us compile and generally respond to the current state.
   attr_accessor :client_version, :server_version
 
   # A String representing the environment for this catalog
   attr_accessor :environment
 
   # The actual environment instance that was used during compilation
   attr_accessor :environment_instance
 
   # Add classes to our class list.
   def add_class(*classes)
     classes.each do |klass|
       @classes << klass
     end
 
     # Add the class names as tags, too.
     tag(*classes)
   end
 
   def title_key_for_ref( ref )
     ref =~ /^([-\w:]+)\[(.*)\]$/m
     [$1, $2]
   end
 
   def add_resource(*resources)
     resources.each do |resource|
       add_one_resource(resource)
     end
   end
 
   # @param resource [A Resource] a resource in the catalog
   # @return [A Resource, nil] the resource that contains the given resource
   # @api public
   def container_of(resource)
     adjacent(resource, :direction => :in)[0]
   end
 
   def add_one_resource(resource)
     fail_on_duplicate_type_and_title(resource)
 
     add_resource_to_table(resource)
     create_resource_aliases(resource)
 
     resource.catalog = self if resource.respond_to?(:catalog=)
     add_resource_to_graph(resource)
   end
   private :add_one_resource
 
   def add_resource_to_table(resource)
     title_key = title_key_for_ref(resource.ref)
     @resource_table[title_key] = resource
     @resources << title_key
   end
   private :add_resource_to_table
 
   def add_resource_to_graph(resource)
     add_vertex(resource)
     @relationship_graph.add_vertex(resource) if @relationship_graph
   end
   private :add_resource_to_graph
 
   def create_resource_aliases(resource)
     if resource.respond_to?(:isomorphic?) and resource.isomorphic? and resource.name != resource.title
       self.alias(resource, resource.uniqueness_key)
     end
   end
   private :create_resource_aliases
 
   # Create an alias for a resource.
   def alias(resource, key)
     resource.ref =~ /^(.+)\[/
     class_name = $1 || resource.class.name
 
     newref = [class_name, key].flatten
 
     if key.is_a? String
       ref_string = "#{class_name}[#{key}]"
       return if ref_string == resource.ref
     end
 
     # LAK:NOTE It's important that we directly compare the references,
     # because sometimes an alias is created before the resource is
     # added to the catalog, so comparing inside the below if block
     # isn't sufficient.
     if existing = @resource_table[newref]
       return if existing == resource
       resource_declaration = " at #{resource.file}:#{resource.line}" if resource.file and resource.line
       existing_declaration = " at #{existing.file}:#{existing.line}" if existing.file and existing.line
       msg = "Cannot alias #{resource.ref} to #{key.inspect}#{resource_declaration}; resource #{newref.inspect} already declared#{existing_declaration}"
       raise ArgumentError, msg
     end
     @resource_table[newref] = resource
     @aliases[resource.ref] ||= []
     @aliases[resource.ref] << newref
   end
 
   # Apply our catalog to the local host.
   # @param options [Hash{Symbol => Object}] a hash of options
   # @option options [Puppet::Transaction::Report] :report
   #   The report object to log this transaction to. This is optional,
   #   and the resulting transaction will create a report if not
   #   supplied.
   # @option options [Array[String]] :tags
   #   Tags used to filter the transaction. If supplied then only
   #   resources tagged with any of these tags will be evaluated.
   # @option options [Boolean] :ignoreschedules
   #   Ignore schedules when evaluating resources
   # @option options [Boolean] :for_network_device
   #   Whether this catalog is for a network device
   #
   # @return [Puppet::Transaction] the transaction created for this
   #   application
   #
   # @api public
   def apply(options = {})
     Puppet::Util::Storage.load if host_config?
 
     transaction = create_transaction(options)
 
     begin
       transaction.report.as_logging_destination do
         transaction.evaluate
       end
     rescue Puppet::Error => detail
       Puppet.log_exception(detail, "Could not apply complete catalog: #{detail}")
     rescue => detail
       Puppet.log_exception(detail, "Got an uncaught exception of type #{detail.class}: #{detail}")
     ensure
       # Don't try to store state unless we're a host config
       # too recursive.
       Puppet::Util::Storage.store if host_config?
     end
 
     yield transaction if block_given?
 
     transaction
   end
 
   # The relationship_graph form of the catalog. This contains all of the
   # dependency edges that are used for determining order.
   #
+  # @param given_prioritizer [Puppet::Graph::Prioritizer] The prioritization
+  #   strategy to use when constructing the relationship graph. Defaults the
+  #   being determined by the `ordering` setting.
   # @return [Puppet::Graph::RelationshipGraph]
   # @api public
-  def relationship_graph
+  def relationship_graph(given_prioritizer = nil)
     if @relationship_graph.nil?
-      @relationship_graph = Puppet::Graph::RelationshipGraph.new(prioritizer)
+      @relationship_graph = Puppet::Graph::RelationshipGraph.new(given_prioritizer || prioritizer)
       @relationship_graph.populate_from(self)
     end
     @relationship_graph
   end
 
   def clear(remove_resources = true)
     super()
     # We have to do this so that the resources clean themselves up.
     @resource_table.values.each { |resource| resource.remove } if remove_resources
     @resource_table.clear
     @resources = []
 
     if @relationship_graph
       @relationship_graph.clear
       @relationship_graph = nil
     end
   end
 
   def classes
     @classes.dup
   end
 
   # Create a new resource and register it in the catalog.
   def create_resource(type, options)
     unless klass = Puppet::Type.type(type)
       raise ArgumentError, "Unknown resource type #{type}"
     end
     return unless resource = klass.new(options)
 
     add_resource(resource)
     resource
   end
 
   # Make sure all of our resources are "finished".
   def finalize
     make_default_resources
 
     @resource_table.values.each { |resource| resource.finish }
 
     write_graph(:resources)
   end
 
   def host_config?
     host_config
   end
 
   def initialize(name = nil, environment = Puppet::Node::Environment::NONE)
     super()
     @name = name
     @classes = []
     @resource_table = {}
     @resources = []
     @relationship_graph = nil
 
     @host_config = true
     @environment_instance = environment
     @environment = environment.to_s
 
     @aliases = {}
 
     if block_given?
       yield(self)
       finalize
     end
   end
 
   # Make the default objects necessary for function.
   def make_default_resources
     # We have to add the resources to the catalog, or else they won't get cleaned up after
     # the transaction.
 
     # First create the default scheduling objects
     Puppet::Type.type(:schedule).mkdefaultschedules.each { |res| add_resource(res) unless resource(res.ref) }
 
     # And filebuckets
     if bucket = Puppet::Type.type(:filebucket).mkdefaultbucket
       add_resource(bucket) unless resource(bucket.ref)
     end
   end
 
   # Remove the resource from our catalog.  Notice that we also call
   # 'remove' on the resource, at least until resource classes no longer maintain
   # references to the resource instances.
   def remove_resource(*resources)
     resources.each do |resource|
       title_key = title_key_for_ref(resource.ref)
       @resource_table.delete(title_key)
       if aliases = @aliases[resource.ref]
         aliases.each { |res_alias| @resource_table.delete(res_alias) }
         @aliases.delete(resource.ref)
       end
       remove_vertex!(resource) if vertex?(resource)
       @relationship_graph.remove_vertex!(resource) if @relationship_graph and @relationship_graph.vertex?(resource)
       @resources.delete(title_key)
       resource.remove
     end
   end
 
   # Look a resource up by its reference (e.g., File[/etc/passwd]).
   def resource(type, title = nil)
     # Always create a resource reference, so that it always
     # canonicalizes how we are referring to them.
     if title
       res = Puppet::Resource.new(type, title)
     else
       # If they didn't provide a title, then we expect the first
       # argument to be of the form 'Class[name]', which our
       # Reference class canonicalizes for us.
       res = Puppet::Resource.new(nil, type)
     end
     res.catalog = self
     title_key      = [res.type, res.title.to_s]
     uniqueness_key = [res.type, res.uniqueness_key].flatten
     @resource_table[title_key] || @resource_table[uniqueness_key]
   end
 
   def resource_refs
     resource_keys.collect{ |type, name| name.is_a?( String ) ? "#{type}[#{name}]" : nil}.compact
   end
 
   def resource_keys
     @resource_table.keys
   end
 
   def resources
     @resources.collect do |key|
       @resource_table[key]
     end
   end
 
   def self.from_data_hash(data)
     result = new(data['name'], Puppet::Node::Environment::NONE)
 
     if tags = data['tags']
       result.tag(*tags)
     end
 
     if version = data['version']
       result.version = version
     end
 
     if environment = data['environment']
       result.environment = environment
       result.environment_instance = Puppet::Node::Environment.remote(environment.to_sym)
     end
 
     if resources = data['resources']
       result.add_resource(*resources.collect do |res|
         Puppet::Resource.from_data_hash(res)
       end)
     end
 
     if edges = data['edges']
       edges.each do |edge_hash|
         edge = Puppet::Relationship.from_data_hash(edge_hash)
         unless source = result.resource(edge.source)
           raise ArgumentError, "Could not intern from data: Could not find relationship source #{edge.source.inspect}"
         end
         edge.source = source
 
         unless target = result.resource(edge.target)
           raise ArgumentError, "Could not intern from data: Could not find relationship target #{edge.target.inspect}"
         end
         edge.target = target
 
         result.add_edge(edge)
       end
     end
 
     if classes = data['classes']
       result.add_class(*classes)
     end
 
     result
   end
 
   def self.from_pson(data)
     Puppet.deprecation_warning("from_pson is being removed in favour of from_data_hash.")
     self.from_data_hash(data)
   end
 
   def to_data_hash
     {
       'tags'      => tags,
       'name'      => name,
       'version'   => version,
       'environment' => environment.to_s,
       'resources' => @resources.collect { |v| @resource_table[v].to_pson_data_hash },
       'edges'     => edges.   collect { |e| e.to_pson_data_hash },
       'classes'   => classes
     }
   end
 
   PSON.register_document_type('Catalog',self)
   def to_pson_data_hash
     {
       'document_type' => 'Catalog',
       'data'       => to_data_hash,
       'metadata' => {
         'api_version' => 1
         }
     }
   end
 
   def to_pson(*args)
     to_pson_data_hash.to_pson(*args)
   end
 
   # Convert our catalog into a RAL catalog.
   def to_ral
     to_catalog :to_ral
   end
 
   # Convert our catalog into a catalog of Puppet::Resource instances.
   def to_resource
     to_catalog :to_resource
   end
 
   # filter out the catalog, applying +block+ to each resource.
   # If the block result is false, the resource will
   # be kept otherwise it will be skipped
   def filter(&block)
     to_catalog :to_resource, &block
   end
 
   # Store the classes in the classfile.
   def write_class_file
     ::File.open(Puppet[:classfile], "w") do |f|
       f.puts classes.join("\n")
     end
   rescue => detail
     Puppet.err "Could not create class file #{Puppet[:classfile]}: #{detail}"
   end
 
   # Store the list of resources we manage
   def write_resource_file
     ::File.open(Puppet[:resourcefile], "w") do |f|
       to_print = resources.map do |resource|
         next unless resource.managed?
         if resource.name_var
           "#{resource.type}[#{resource[resource.name_var]}]"
         else
           "#{resource.ref.downcase}"
         end
       end.compact
       f.puts to_print.join("\n")
     end
   rescue => detail
     Puppet.err "Could not create resource file #{Puppet[:resourcefile]}: #{detail}"
   end
 
   # Produce the graph files if requested.
   def write_graph(name)
     # We only want to graph the main host catalog.
     return unless host_config?
 
     super
   end
 
   private
 
   def prioritizer
     @prioritizer ||= case Puppet[:ordering]
                      when "title-hash"
                        Puppet::Graph::TitleHashPrioritizer.new
                      when "manifest"
                        Puppet::Graph::SequentialPrioritizer.new
                      when "random"
                        Puppet::Graph::RandomPrioritizer.new
                      else
                        raise Puppet::DevError, "Unknown ordering type #{Puppet[:ordering]}"
                      end
   end
 
   def create_transaction(options)
     transaction = Puppet::Transaction.new(self, options[:report], prioritizer)
     transaction.tags = options[:tags] if options[:tags]
     transaction.ignoreschedules = true if options[:ignoreschedules]
     transaction.for_network_device = options[:network_device]
 
     transaction
   end
 
   # Verify that the given resource isn't declared elsewhere.
   def fail_on_duplicate_type_and_title(resource)
     # Short-circuit the common case,
     return unless existing_resource = @resource_table[title_key_for_ref(resource.ref)]
 
     # If we've gotten this far, it's a real conflict
     msg = "Duplicate declaration: #{resource.ref} is already declared"
 
     msg << " in file #{existing_resource.file}:#{existing_resource.line}" if existing_resource.file and existing_resource.line
 
     msg << "; cannot redeclare"
 
     raise DuplicateResourceError.new(msg, resource.file, resource.line)
   end
 
   # An abstracted method for converting one catalog into another type of catalog.
   # This pretty much just converts all of the resources from one class to another, using
   # a conversion method.
   def to_catalog(convert)
     result = self.class.new(self.name, self.environment_instance)
 
     result.version = self.version
 
     map = {}
     resources.each do |resource|
       next if virtual_not_exported?(resource)
       next if block_given? and yield resource
 
       newres = resource.copy_as_resource
       newres.catalog = result
 
       if convert != :to_resource
         newres = newres.to_ral
       end
 
       # We can't guarantee that resources don't munge their names
       # (like files do with trailing slashes), so we have to keep track
       # of what a resource got converted to.
       map[resource.ref] = newres
 
       result.add_resource newres
     end
 
     message = convert.to_s.gsub "_", " "
     edges.each do |edge|
       # Skip edges between virtual resources.
       next if virtual_not_exported?(edge.source)
       next if block_given? and yield edge.source
 
       next if virtual_not_exported?(edge.target)
       next if block_given? and yield edge.target
 
       unless source = map[edge.source.ref]
         raise Puppet::DevError, "Could not find resource #{edge.source.ref} when converting #{message} resources"
       end
 
       unless target = map[edge.target.ref]
         raise Puppet::DevError, "Could not find resource #{edge.target.ref} when converting #{message} resources"
       end
 
       result.add_edge(source, target, edge.label)
     end
 
     map.clear
 
     result.add_class(*self.classes)
     result.tag(*self.tags)
 
     result
   end
 
   def virtual_not_exported?(resource)
     resource.respond_to?(:virtual?) and resource.virtual? and (resource.respond_to?(:exported?) and not resource.exported?)
   end
 end
diff --git a/lib/puppet/transaction.rb b/lib/puppet/transaction.rb
index 3820d0759..7eaa213d5 100644
--- a/lib/puppet/transaction.rb
+++ b/lib/puppet/transaction.rb
@@ -1,369 +1,369 @@
 require 'puppet'
 require 'puppet/util/tagging'
 require 'puppet/application'
 require 'digest/sha1'
 require 'set'
 
 # the class that actually walks our resource/property tree, collects the changes,
 # and performs them
 #
 # @api private
 class Puppet::Transaction
   require 'puppet/transaction/additional_resource_generator'
   require 'puppet/transaction/event'
   require 'puppet/transaction/event_manager'
   require 'puppet/transaction/resource_harness'
   require 'puppet/resource/status'
 
   attr_accessor :catalog, :ignoreschedules, :for_network_device
 
   # The report, once generated.
   attr_reader :report
 
   # Routes and stores any events and subscriptions.
   attr_reader :event_manager
 
   # Handles most of the actual interacting with resources
   attr_reader :resource_harness
 
   attr_reader :prefetched_providers
 
   include Puppet::Util
   include Puppet::Util::Tagging
 
   def initialize(catalog, report, prioritizer)
     @catalog = catalog
 
     @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
 
     @prioritizer = prioritizer
 
     @report.add_times(:config_retrieval, @catalog.retrieval_duration || 0)
 
     @event_manager = Puppet::Transaction::EventManager.new(self)
 
     @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
 
     @prefetched_providers = Hash.new { |h,k| h[k] = {} }
   end
 
   # Invoke the pre_run_check hook in every resource in the catalog.
   # This should (only) be called by Transaction#evaluate before applying
   # the catalog.
   #
   # @see Puppet::Transaction#evaluate
   # @see Puppet::Type#pre_run_check
   # @raises Puppet::Error
   # @return void
   def perform_pre_run_checks
     prerun_errors = {}
 
     @catalog.vertices.each do |res|
       begin
         res.pre_run_check
       rescue Puppet::Error => detail
         prerun_errors[res] = detail
       end
     end
 
     unless prerun_errors.empty?
       prerun_errors.each do |res, detail|
         res.log_exception(detail)
       end
       raise Puppet::Error, "Some pre-run checks failed"
     end
   end
 
   # This method does all the actual work of running a transaction.  It
   # collects all of the changes, executes them, and responds to any
   # necessary events.
   def evaluate(&block)
     block ||= method(:eval_resource)
     generator = AdditionalResourceGenerator.new(@catalog, relationship_graph, @prioritizer)
     @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
 
     perform_pre_run_checks
 
     Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
 
     continue_while = lambda { !stop_processing? }
 
     post_evalable_providers = Set.new
     pre_process = lambda do |resource|
       prov_class = resource.provider.class
       post_evalable_providers << prov_class if prov_class.respond_to?(:post_resource_eval)
 
       prefetch_if_necessary(resource)
 
       # If we generated resources, we don't know what they are now
       # blocking, so we opt to recompute it, rather than try to track every
       # change that would affect the number.
       relationship_graph.clear_blockers if generator.eval_generate(resource)
     end
 
     providerless_types = []
     overly_deferred_resource_handler = lambda do |resource|
       # We don't automatically assign unsuitable providers, so if there
       # is one, it must have been selected by the user.
       if resource.provider
         resource.err "Provider #{resource.provider.class.name} is not functional on this host"
       else
         providerless_types << resource.type
       end
 
       resource_status(resource).failed = true
     end
 
     canceled_resource_handler = lambda do |resource|
       resource_status(resource).skipped = true
       resource.debug "Transaction canceled, skipping"
     end
 
     teardown = lambda do
       # Just once per type. No need to punish the user.
       providerless_types.uniq.each do |type|
         Puppet.err "Could not find a suitable provider for #{type}"
       end
 
       post_evalable_providers.each do |provider|
         begin
           provider.post_resource_eval
         rescue => detail
           Puppet.log_exception(detail, "post_resource_eval failed for provider #{provider}")
         end
       end
     end
 
     relationship_graph.traverse(:while => continue_while,
                                 :pre_process => pre_process,
                                 :overly_deferred_resource_handler => overly_deferred_resource_handler,
                                 :canceled_resource_handler => canceled_resource_handler,
                                 :teardown => teardown) do |resource|
       if resource.is_a?(Puppet::Type::Component)
         Puppet.warning "Somehow left a component in the relationship graph"
       else
         resource.info "Starting to evaluate the resource" if Puppet[:evaltrace] and @catalog.host_config?
         seconds = thinmark { block.call(resource) }
         resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
       end
     end
 
     Puppet.debug "Finishing transaction #{object_id}"
   end
 
   # Wraps application run state check to flag need to interrupt processing
   def stop_processing?
     Puppet::Application.stop_requested? && catalog.host_config?
   end
 
   # Are there any failed resources in this transaction?
   def any_failed?
     report.resource_statuses.values.detect { |status| status.failed? }
   end
 
   # Find all of the changed resources.
   def changed?
     report.resource_statuses.values.find_all { |status| status.changed }.collect { |status| catalog.resource(status.resource) }
   end
 
   def relationship_graph
-    catalog.relationship_graph
+    catalog.relationship_graph(@prioritizer)
   end
 
   def resource_status(resource)
     report.resource_statuses[resource.to_s] || add_resource_status(Puppet::Resource::Status.new(resource))
   end
 
   # The tags we should be checking.
   def tags
     self.tags = Puppet[:tags] unless defined?(@tags)
 
     super
   end
 
   def prefetch_if_necessary(resource)
     provider_class = resource.provider.class
     return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
 
     resources = resources_by_provider(resource.type, provider_class.name)
 
     if provider_class == resource.class.defaultprovider
       providerless_resources = resources_by_provider(resource.type, nil)
       providerless_resources.values.each {|res| res.provider = provider_class.name}
       resources.merge! providerless_resources
     end
 
     prefetch(provider_class, resources)
   end
 
   private
 
   # Apply all changes for a resource
   def apply(resource, ancestor = nil)
     status = resource_harness.evaluate(resource)
     add_resource_status(status)
     event_manager.queue_events(ancestor || resource, status.events) unless status.failed?
   rescue => detail
     resource.err "Could not evaluate: #{detail}"
   end
 
   # Evaluate a single resource.
   def eval_resource(resource, ancestor = nil)
     if skip?(resource)
       resource_status(resource).skipped = true
     else
       resource_status(resource).scheduled = true
       apply(resource, ancestor)
     end
 
     # Check to see if there are any events queued for this resource
     event_manager.process_events(resource)
   end
 
   def failed?(resource)
     s = resource_status(resource) and s.failed?
   end
 
   # Does this resource have any failed dependencies?
   def failed_dependencies?(resource)
     # First make sure there are no failed dependencies.  To do this,
     # we check for failures in any of the vertexes above us.  It's not
     # enough to check the immediate dependencies, which is why we use
     # a tree from the reversed graph.
     found_failed = false
 
 
     # When we introduced the :whit into the graph, to reduce the combinatorial
     # explosion of edges, we also ended up reporting failures for containers
     # like class and stage.  This is undesirable; while just skipping the
     # output isn't perfect, it is RC-safe. --daniel 2011-06-07
     suppress_report = (resource.class == Puppet::Type.type(:whit))
 
     relationship_graph.dependencies(resource).each do |dep|
       next unless failed?(dep)
       found_failed = true
 
       # See above. --daniel 2011-06-06
       unless suppress_report then
         resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
       end
     end
 
     found_failed
   end
 
   # A general method for recursively generating new resources from a
   # resource.
   def generate_additional_resources(resource)
     return unless resource.respond_to?(:generate)
     begin
       made = resource.generate
     rescue => detail
       resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
     end
     return unless made
     made = [made] unless made.is_a?(Array)
     made.uniq.each do |res|
       begin
         res.tag(*resource.tags)
         @catalog.add_resource(res)
         res.finish
         add_conditional_directed_dependency(resource, res)
         generate_additional_resources(res)
       rescue Puppet::Resource::Catalog::DuplicateResourceError
         res.info "Duplicate generated resource; skipping"
       end
     end
   end
 
   # Should we ignore tags?
   def ignore_tags?
     ! @catalog.host_config?
   end
 
   def resources_by_provider(type_name, provider_name)
     unless @resources_by_provider
       @resources_by_provider = Hash.new { |h, k| h[k] = Hash.new { |h, k| h[k] = {} } }
 
       @catalog.vertices.each do |resource|
         if resource.class.attrclass(:provider)
           prov = resource.provider && resource.provider.class.name
           @resources_by_provider[resource.type][prov][resource.name] = resource
         end
       end
     end
 
     @resources_by_provider[type_name][provider_name] || {}
   end
 
   # Prefetch any providers that support it, yo.  We don't support prefetching
   # types, just providers.
   def prefetch(provider_class, resources)
     type_name = provider_class.resource_type.name
     return if @prefetched_providers[type_name][provider_class.name]
     Puppet.debug "Prefetching #{provider_class.name} resources for #{type_name}"
     begin
       provider_class.prefetch(resources)
     rescue => detail
       Puppet.log_exception(detail, "Could not prefetch #{type_name} provider '#{provider_class.name}': #{detail}")
     end
     @prefetched_providers[type_name][provider_class.name] = true
   end
 
   def add_resource_status(status)
     report.add_resource_status(status)
   end
 
   # Is the resource currently scheduled?
   def scheduled?(resource)
     self.ignoreschedules or resource_harness.scheduled?(resource)
   end
 
   # Should this resource be skipped?
   def skip?(resource)
     if missing_tags?(resource)
       resource.debug "Not tagged with #{tags.join(", ")}"
     elsif ! scheduled?(resource)
       resource.debug "Not scheduled"
     elsif failed_dependencies?(resource)
       # When we introduced the :whit into the graph, to reduce the combinatorial
       # explosion of edges, we also ended up reporting failures for containers
       # like class and stage.  This is undesirable; while just skipping the
       # output isn't perfect, it is RC-safe. --daniel 2011-06-07
       unless resource.class == Puppet::Type.type(:whit) then
         resource.warning "Skipping because of failed dependencies"
       end
     elsif resource.virtual?
       resource.debug "Skipping because virtual"
     elsif !host_and_device_resource?(resource) && resource.appliable_to_host? && for_network_device
       resource.debug "Skipping host resources because running on a device"
     elsif !host_and_device_resource?(resource) && resource.appliable_to_device? && !for_network_device
       resource.debug "Skipping device resources because running on a posix host"
     else
       return false
     end
     true
   end
 
   def host_and_device_resource?(resource)
     resource.appliable_to_host? && resource.appliable_to_device?
   end
 
   def handle_qualified_tags( qualified )
     # The default behavior of Puppet::Util::Tagging is
     # to split qualified tags into parts. That would cause
     # qualified tags to match too broadly here.
     return
   end
 
   # Is this resource tagged appropriately?
   def missing_tags?(resource)
     return false if ignore_tags?
     return false if tags.empty?
 
     not resource.tagged?(*tags)
   end
 end
 
 require 'puppet/transaction/report'
 
diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index 874130ee5..f3bae900e 100644
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -1,687 +1,687 @@
 require 'etc'
 require 'facter'
 require 'puppet/parameter/boolean'
 require 'puppet/property/list'
 require 'puppet/property/ordered_list'
 require 'puppet/property/keyvalue'
 
 module Puppet
   newtype(:user) do
     @doc = "Manage users.  This type is mostly built to manage system
       users, so it is lacking some features useful for managing normal
       users.
 
       This resource type uses the prescribed native tools for creating
       groups and generally uses POSIX APIs for retrieving information
       about them.  It does not directly modify `/etc/passwd` or anything.
 
       **Autorequires:** If Puppet is managing the user's primary group (as
       provided in the `gid` attribute), the user resource will autorequire
       that group. If Puppet is managing any role accounts corresponding to the
       user's roles, the user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
 
     feature :manages_homedir,
       "The provider can create and remove home directories."
 
     feature :manages_passwords,
       "The provider can modify user passwords, by accepting a password
       hash."
 
     feature :manages_password_age,
       "The provider can set age requirements and restrictions for
       passwords."
 
     feature :manages_password_salt,
       "The provider can set a password salt. This is for providers that
        implement PBKDF2 passwords with salt properties."
 
     feature :manages_solaris_rbac,
       "The provider can manage roles and normal users"
 
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
 
    feature :system_users,
      "The provider allows you to create system users with lower UIDs."
 
     feature :manages_aix_lam,
       "The provider can manage AIX Loadable Authentication Module (LAM) system."
 
     feature :libuser,
       "Allows local users to be managed on systems that also use some other
        remote NSS method of managing accounts."
 
     feature :manages_shell,
       "The provider allows for setting shell and validates if possible"
 
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
       end
 
       newvalue(:absent, :event => :user_removed) do
         provider.delete
       end
 
       newvalue(:role, :event => :role_created, :required_features => :manages_solaris_rbac) do
         provider.create_role
       end
 
       desc "The basic state that the object should be in."
 
       # If they're talking about the thing at all, they generally want to
       # say it should exist.
       defaultto do
         if @resource.managed?
           :present
         else
           nil
         end
       end
 
       def retrieve
         if provider.exists?
           if provider.respond_to?(:is_role?) and provider.is_role?
             return :role
           else
             return :present
           end
         else
           return :absent
         end
       end
     end
 
     newproperty(:home) do
       desc "The home directory of the user.  The directory must be created
         separately and is not currently checked for existence."
     end
 
     newproperty(:uid) do
       desc "The user ID; must be specified numerically. If no user ID is
         specified when creating a new user, then one will be chosen
         automatically. This will likely result in the same user having
         different UIDs on different systems, which is not recommended. This is
         especially noteworthy when managing the same user on both Darwin and
         other platforms, since Puppet does UID generation on Darwin, but
         the underlying tools do so on other platforms.
 
         On Windows, this property is read-only and will return the user's
         security identifier (SID)."
 
       munge do |value|
         case value
         when String
           if value =~ /^[-0-9]+$/
             value = Integer(value)
           end
         end
 
         return value
       end
     end
 
     newproperty(:gid) do
       desc "The user's primary group.  Can be specified numerically or by name.
 
         This attribute is not supported on Windows systems; use the `groups`
         attribute instead. (On Windows, designating a primary group is only
         meaningful for domain accounts, which Puppet does not currently manage.)"
 
       munge do |value|
         if value.is_a?(String) and value =~ /^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
 
       def insync?(is)
         # We know the 'is' is a number, so we need to convert the 'should' to a number,
         # too.
         @should.each do |value|
           return true if number = Puppet::Util.gid(value) and is == number
         end
 
         false
       end
 
       def sync
         found = false
         @should.each do |value|
           if number = Puppet::Util.gid(value)
             provider.gid = number
             found = true
             break
           end
         end
 
         fail "Could not find group(s) #{@should.join(",")}" unless found
 
         # Use the default event.
       end
     end
 
     newproperty(:comment) do
       desc "A description of the user.  Generally the user's full name."
       munge do |v|
         v.respond_to?(:force_encoding) ? v.force_encoding(Encoding::ASCII_8BIT) : v
       end
     end
 
     newproperty(:shell, :required_features => :manages_shell) do
       desc "The user's login shell.  The shell must exist and be
         executable.
 
         This attribute cannot be managed on Windows systems."
     end
 
     newproperty(:password, :required_features => :manages_passwords) do
       desc %q{The user's password, in whatever encrypted format the local
         system requires.
 
         * Most modern Unix-like systems use salted SHA1 password hashes. You can use
           Puppet's built-in `sha1` function to generate a hash from a password.
         * Mac OS X 10.5 and 10.6 also use salted SHA1 hashes.
         * Mac OS X 10.7 (Lion) uses salted SHA512 hashes. The Puppet Labs [stdlib][]
           module contains a `str2saltedsha512` function which can generate password
           hashes for Lion.
         * Mac OS X 10.8 and higher use salted SHA512 PBKDF2 hashes. When
           managing passwords on these systems the salt and iterations properties
           need to be specified as well as the password.
         * Windows passwords can only be managed in cleartext, as there is no Windows API
           for setting the password hash.
 
         [stdlib]: https://github.com/puppetlabs/puppetlabs-stdlib/
 
         Be sure to enclose any value that includes a dollar sign ($) in single
         quotes (') to avoid accidental variable interpolation.}
 
       validate do |value|
         raise ArgumentError, "Passwords cannot include ':'" if value.is_a?(String) and value.include?(":")
       end
 
       def change_to_s(currentvalue, newvalue)
         if currentvalue == :absent
           return "created password"
         else
           return "changed password"
         end
       end
 
       def is_to_s( currentvalue )
         return '[old password hash redacted]'
       end
       def should_to_s( newvalue )
         return '[new password hash redacted]'
       end
 
     end
 
     newproperty(:password_min_age, :required_features => :manages_password_age) do
       desc "The minimum number of days a password must be used before it may be changed."
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password minimum age must be provided as a number."
         end
       end
     end
 
     newproperty(:password_max_age, :required_features => :manages_password_age) do
       desc "The maximum number of days a password may be used before it must be changed."
 
       munge do |value|
         case value
         when String
           Integer(value)
         else
           value
         end
       end
 
       validate do |value|
         if value.to_s !~ /^-?\d+$/
           raise ArgumentError, "Password maximum age must be provided as a number."
         end
       end
     end
 
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups to which the user belongs.  The primary group should
         not be listed, and groups should be identified by name rather than by
         GID.  Multiple groups should be specified as an array."
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Group names must be provided, not GID numbers."
         end
         raise ArgumentError, "Group names must be provided as an array, not a comma-separated list." if value.include?(",")
         raise ArgumentError, "Group names must not be empty. If you want to specify \"no groups\" pass an empty array" if value.empty?
       end
     end
 
     newparam(:name) do
       desc "The user name. While naming limitations vary by operating system,
         it is advisable to restrict names to the lowest common denominator,
         which is a maximum of 8 characters beginning with a letter.
 
         Note that Puppet considers user names to be case-sensitive, regardless
         of the platform's own rules; be sure to always use the same case when
         referring to a given user."
       isnamevar
     end
 
     newparam(:membership) do
       desc "Whether specified groups should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of groups to which
         the user belongs. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newparam(:system, :boolean => true, :parent => Puppet::Parameter::Boolean) do
       desc "Whether the user is a system user, according to the OS's criteria;
       on most platforms, a UID less than or equal to 500 indicates a system
       user. Defaults to `false`."
 
       defaultto false
     end
 
     newparam(:allowdupe, :boolean => true, :parent => Puppet::Parameter::Boolean) do
       desc "Whether to allow duplicate UIDs. Defaults to `false`."
 
       defaultto false
     end
 
     newparam(:managehome, :boolean => true, :parent => Puppet::Parameter::Boolean) do
       desc "Whether to manage the home directory when managing the user.
         This will create the home directory when `ensure => present`, and
         delete the home directory when `ensure => absent`. Defaults to `false`."
 
       defaultto false
 
       validate do |val|
         if munge(val)
           raise ArgumentError, "User provider #{provider.class.name} can not manage home directories" if provider and not provider.class.manages_homedir?
         end
       end
     end
 
     newproperty(:expiry, :required_features => :manages_expiry) do
       desc "The expiry date for this user. Must be provided in
            a zero-padded YYYY-MM-DD format --- e.g. 2010-02-19.
            If you want to make sure the user account does never
            expire, you can pass the special value `absent`."
 
       newvalues :absent
       newvalues /^\d{4}-\d{2}-\d{2}$/
 
       validate do |value|
         if value.intern != :absent and value !~ /^\d{4}-\d{2}-\d{2}$/
           raise ArgumentError, "Expiry dates must be YYYY-MM-DD or the string \"absent\""
         end
       end
     end
 
     # Autorequire the group, if it's around
     autorequire(:group) do
       autos = []
 
       if obj = @parameters[:gid] and groups = obj.shouldorig
         groups = groups.collect { |group|
           if group =~ /^\d+$/
             Integer(group)
           else
             group
           end
         }
         groups.each { |group|
           case group
           when Integer
             if resource = catalog.resources.find { |r| r.is_a?(Puppet::Type.type(:group)) and r.should(:gid) == group }
               autos << resource
             end
           else
             autos << group
           end
         }
       end
 
       if obj = @parameters[:groups] and groups = obj.should
         autos += groups.split(",")
       end
 
       autos
     end
 
     # This method has been exposed for puppet to manage users and groups of
     # files in its settings and should not be considered available outside of
     # puppet.
     #
     # (see Puppet::Settings#service_user_available?)
     #
     # @return [Boolean] if the user exists on the system
     # @api private
     def exists?
       provider.exists?
     end
 
     def retrieve
       absent = false
       properties.inject({}) { |prophash, property|
         current_value = :absent
 
         if absent
           prophash[property] = :absent
         else
           current_value = property.retrieve
           prophash[property] = current_value
         end
 
         if property.name == :ensure and current_value == :absent
           absent = true
         end
         prophash
       }
     end
 
     newproperty(:roles, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The roles the user has.  Multiple roles should be
         specified as an array."
 
       def membership
         :role_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Role names must be provided, not numbers"
         end
         raise ArgumentError, "Role names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     #autorequire the roles that the user has
     autorequire(:user) do
       reqs = []
 
       if roles_property = @parameters[:roles] and roles = roles_property.should
         reqs += roles.split(',')
       end
 
       reqs
     end
 
     newparam(:role_membership) do
       desc "Whether specified roles should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of roles the user
         has. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:auths, :parent => Puppet::Property::List, :required_features => :manages_solaris_rbac) do
       desc "The auths the user has.  Multiple auths should be
         specified as an array."
 
       def membership
         :auth_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Auth names must be provided, not numbers"
         end
         raise ArgumentError, "Auth names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:auth_membership) do
       desc "Whether specified auths should be considered the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of auths the user
         has. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:profiles, :parent => Puppet::Property::OrderedList, :required_features => :manages_solaris_rbac) do
       desc "The profiles the user has.  Multiple profiles should be
         specified as an array."
 
       def membership
         :profile_membership
       end
 
       validate do |value|
         if value =~ /^\d+$/
           raise ArgumentError, "Profile names must be provided, not numbers"
         end
         raise ArgumentError, "Profile names must be provided as an array, not a comma-separated list" if value.include?(",")
       end
     end
 
     newparam(:profile_membership) do
       desc "Whether specified roles should be treated as the **complete list**
         (`inclusive`) or the **minimum list** (`minimum`) of roles
         of which the user is a member. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:keys, :parent => Puppet::Property::KeyValue, :required_features => :manages_solaris_rbac) do
       desc "Specify user attributes in an array of key = value pairs."
 
       def membership
         :key_membership
       end
 
       validate do |value|
         raise ArgumentError, "Key/value pairs must be separated by an =" unless value.include?("=")
       end
     end
 
     newparam(:key_membership) do
       desc "Whether specified key/value pairs should be considered the
         **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
         the user's attributes. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:project, :required_features => :manages_solaris_rbac) do
       desc "The name of the project associated with a user."
     end
 
     newparam(:ia_load_module, :required_features => :manages_aix_lam) do
       desc "The name of the I&A module to use to manage this user."
     end
 
     newproperty(:attributes, :parent => Puppet::Property::KeyValue, :required_features => :manages_aix_lam) do
       desc "Specify AIX attributes for the user in an array of attribute = value pairs."
 
       def membership
         :attribute_membership
       end
 
       def delimiter
         " "
       end
 
       validate do |value|
         raise ArgumentError, "Attributes value pairs must be separated by an =" unless value.include?("=")
       end
     end
 
     newparam(:attribute_membership) do
       desc "Whether specified attribute value pairs should be treated as the
         **complete list** (`inclusive`) or the **minimum list** (`minimum`) of
         attribute/value pairs for the user. Defaults to `minimum`."
 
       newvalues(:inclusive, :minimum)
 
       defaultto :minimum
     end
 
     newproperty(:salt, :required_features => :manages_password_salt) do
       desc "This is the 32 byte salt used to generate the PBKDF2 password used in
             OS X. This field is required for managing passwords on OS X >= 10.8."
     end
 
     newproperty(:iterations, :required_features => :manages_password_salt) do
       desc "This is the number of iterations of a chained computation of the
             password hash (http://en.wikipedia.org/wiki/PBKDF2).  This parameter
             is used in OS X. This field is required for managing passwords on OS X >= 10.8."
 
       munge do |value|
         if value.is_a?(String) and value =~/^[-0-9]+$/
           Integer(value)
         else
           value
         end
       end
     end
 
     newparam(:forcelocal, :boolean => true,
             :required_features => :libuser,
             :parent => Puppet::Parameter::Boolean) do
       desc "Forces the mangement of local accounts when accounts are also
             being managed by some other NSS"
       defaultto false
     end
 
-    def eval_generate
+    def generate
       return [] if self[:purge_ssh_keys].empty?
       find_unmanaged_keys
     end
 
     newparam(:purge_ssh_keys) do
       desc "Whether to purge authorized SSH keys for this user if they are not managed
         with the `ssh_authorized_key` resource type. Allowed values are:
 
         * `false` (default) --- don't purge SSH keys for this user.
         * `true` --- look for keys in the `.ssh/authorized_keys` file in the user's
           home directory. Purge any keys that aren't managed as `ssh_authorized_key`
           resources.
         * An array of file paths --- look for keys in all of the files listed. Purge
           any keys that aren't managed as `ssh_authorized_key` resources. If any of
           these paths starts with `~` or `%h`, that token will be replaced with
           the user's home directory."
 
       defaultto :false
 
       # Use Symbols instead of booleans until PUP-1967 is resolved.
       newvalues(:true, :false)
 
       validate do |value|
         if [ :true, :false ].include? value.to_s.intern
           return
         end
         value = [ value ] if value.is_a?(String)
         if value.is_a?(Array)
           value.each do |entry|
 
             raise ArgumentError, "Each entry for purge_ssh_keys must be a string, not a #{entry.class}" unless entry.is_a?(String)
 
             valid_home = Puppet::Util.absolute_path?(entry) || entry =~ %r{^~/|^%h/}
             raise ArgumentError, "Paths to keyfiles must be absolute, not #{entry}" unless valid_home
           end
           return
         end
         raise ArgumentError, "purge_ssh_keys must be true, false, or an array of file names, not #{value.inspect}"
       end
 
       munge do |value|
         # Resolve string, boolean and symbol forms of true and false to a
         # single representation.
         test_sym = value.to_s.intern
         value = test_sym if [:true, :false].include? test_sym
 
         return [] if value == :false
         home = resource[:home]
         if value == :true and not home
           raise ArgumentError, "purge_ssh_keys can only be true for users with a defined home directory"
         end
 
         return [ "#{home}/.ssh/authorized_keys" ] if value == :true
         # value is an array - munge each value
         [ value ].flatten.map do |entry|
           if entry =~ /^~|^%h/ and not home
             raise ArgumentError, "purge_ssh_keys value '#{value}' meta character ~ or %h only allowed for users with a defined home directory"
           end
           entry.gsub!(/^~\//, "#{home}/")
           entry.gsub!(/^%h\//, "#{home}/")
           entry
         end
       end
     end
 
     # Generate ssh_authorized_keys resources for purging. The key files are
     # taken from the purge_ssh_keys parameter. The generated resources inherit
     # all metaparameters from the parent user resource.
     #
     # @return [Array<Puppet::Type::Ssh_authorized_key] a list of resources
     #   representing the found keys
-    # @see eval_generate
+    # @see generate
     # @api private
     def find_unmanaged_keys
       self[:purge_ssh_keys].
         select { |f| File.readable?(f) }.
         map { |f| unknown_keys_in_file(f) }.
         flatten.each do |res|
           res[:ensure] = :absent
           res[:user] = self[:name]
           @parameters.each do |name, param|
             res[name] = param.value if param.metaparam?
           end
         end
     end
 
     # Parse an ssh authorized keys file superficially, extract the comments
     # on the keys. These are considered names of possible ssh_authorized_keys
     # resources. Keys that are managed by the present catalog are ignored.
     #
-    # @see eval_generate
+    # @see generate
     # @api private
     # @return [Array<Puppet::Type::Ssh_authorized_key] a list of resources
     #   representing the found keys
     def unknown_keys_in_file(keyfile)
       names = []
       File.new(keyfile).each do |line|
         next if line.strip.empty?
         next if line =~ /^\s*#/
         names << line.strip.split.last
       end
 
       names.map { |keyname|
         Puppet::Type.type(:ssh_authorized_key).new(
           :name => keyname,
           :target => keyfile)
       }.reject { |res|
         catalog.resource_refs.include? res.ref
       }
     end
   end
 end
diff --git a/spec/integration/type/user_spec.rb b/spec/integration/type/user_spec.rb
new file mode 100644
index 000000000..c908092ba
--- /dev/null
+++ b/spec/integration/type/user_spec.rb
@@ -0,0 +1,31 @@
+#! /usr/bin/env ruby
+require 'spec_helper'
+require 'puppet_spec/files'
+require 'puppet_spec/compiler'
+
+describe Puppet::Type.type(:user), '(integration)', :unless => Puppet.features.microsoft_windows? do
+  include PuppetSpec::Files
+  include PuppetSpec::Compiler
+
+  context "when set to purge ssh keys from a file" do
+    let(:tempfile) { file_containing('user_spec', "# comment\nssh-rsa KEY-DATA key-name") }
+    # must use an existing user, or the generated key resource
+    # will fail on account of an invalid user for the key
+    # - root should be a safe default
+    let(:manifest) { "user { 'root': purge_ssh_keys => '#{tempfile}' }" }
+
+    it "should purge authorized ssh keys" do
+      apply_compiled_manifest(manifest, Puppet::Graph::RandomPrioritizer.new)
+      File.read(tempfile).should_not =~ /key-name/
+    end
+
+    context "with other prefetching resources evaluated first" do
+      let(:manifest) { "host { 'test': before => User[root] } user { 'root': purge_ssh_keys => '#{tempfile}' }" }
+
+      it "should purge authorized ssh keys" do
+        apply_compiled_manifest(manifest, Puppet::Graph::RandomPrioritizer.new)
+        File.read(tempfile).should_not =~ /key-name/
+      end
+    end
+  end
+end
diff --git a/spec/unit/type/user_spec.rb b/spec/unit/type/user_spec.rb
index be2441bc1..2e016d9ba 100755
--- a/spec/unit/type/user_spec.rb
+++ b/spec/unit/type/user_spec.rb
@@ -1,514 +1,514 @@
 #! /usr/bin/env ruby
 # encoding: UTF-8
 require 'spec_helper'
 
 describe Puppet::Type.type(:user) do
   before :each do
     @provider_class = described_class.provide(:simple) do
       has_features :manages_expiry, :manages_password_age, :manages_passwords, :manages_solaris_rbac, :manages_shell
       mk_resource_methods
       def create; end
       def delete; end
       def exists?; get(:ensure) != :absent; end
       def flush; end
       def self.instances; []; end
     end
     described_class.stubs(:defaultprovider).returns @provider_class
   end
 
   it "should be able to create an instance" do
     described_class.new(:name => "foo").should_not be_nil
   end
 
   it "should have an allows_duplicates feature" do
     described_class.provider_feature(:allows_duplicates).should_not be_nil
   end
 
   it "should have a manages_homedir feature" do
     described_class.provider_feature(:manages_homedir).should_not be_nil
   end
 
   it "should have a manages_passwords feature" do
     described_class.provider_feature(:manages_passwords).should_not be_nil
   end
 
   it "should have a manages_solaris_rbac feature" do
     described_class.provider_feature(:manages_solaris_rbac).should_not be_nil
   end
 
   it "should have a manages_expiry feature" do
     described_class.provider_feature(:manages_expiry).should_not be_nil
   end
 
   it "should have a manages_password_age feature" do
     described_class.provider_feature(:manages_password_age).should_not be_nil
   end
 
   it "should have a system_users feature" do
     described_class.provider_feature(:system_users).should_not be_nil
   end
 
   it "should have a manages_shell feature" do
     described_class.provider_feature(:manages_shell).should_not be_nil
   end
 
   describe :managehome do
     let (:provider) { @provider_class.new(:name => 'foo', :ensure => :absent) }
     let (:instance) { described_class.new(:name => 'foo', :provider => provider) }
 
     it "defaults to false" do
       instance[:managehome].should be_false
     end
 
     it "can be set to false" do
       instance[:managehome] = 'false'
     end
 
     it "cannot be set to true for a provider that does not manage homedirs" do
       provider.class.stubs(:manages_homedir?).returns false
       expect { instance[:managehome] = 'yes' }.to raise_error(Puppet::Error, /can not manage home directories/)
     end
 
     it "can be set to true for a provider that does manage homedirs" do
       provider.class.stubs(:manages_homedir?).returns true
       instance[:managehome] = 'yes'
     end
   end
 
   describe "instances" do
     it "should delegate existence questions to its provider" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       instance = described_class.new(:name => "foo", :provider => @provider)
       instance.exists?.should == false
 
       @provider.set(:ensure => :present)
       instance.exists?.should == true
     end
   end
 
   properties = [:ensure, :uid, :gid, :home, :comment, :shell, :password, :password_min_age, :password_max_age, :groups, :roles, :auths, :profiles, :project, :keys, :expiry]
 
   properties.each do |property|
     it "should have a #{property} property" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property)
     end
 
     it "should have documentation for its #{property} property" do
       described_class.attrclass(property).doc.should be_instance_of(String)
     end
   end
 
   list_properties = [:groups, :roles, :auths]
 
   list_properties.each do |property|
     it "should have a list '#{property}'" do
       described_class.attrclass(property).ancestors.should be_include(Puppet::Property::List)
     end
   end
 
   it "should have an ordered list 'profiles'" do
     described_class.attrclass(:profiles).ancestors.should be_include(Puppet::Property::OrderedList)
   end
 
   it "should have key values 'keys'" do
     described_class.attrclass(:keys).ancestors.should be_include(Puppet::Property::KeyValue)
   end
 
   describe "when retrieving all current values" do
     before do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present, :uid => 15, :gid => 15)
       @user = described_class.new(:name => "foo", :uid => 10, :provider => @provider)
     end
 
     it "should return a hash containing values for all set properties" do
       @user[:gid] = 10
       values = @user.retrieve
       [@user.property(:uid), @user.property(:gid)].each { |property| values.should be_include(property) }
     end
 
     it "should set all values to :absent if the user is absent" do
       @user.property(:ensure).expects(:retrieve).returns :absent
       @user.property(:uid).expects(:retrieve).never
       @user.retrieve[@user.property(:uid)].should == :absent
     end
 
     it "should include the result of retrieving each property's current value if the user is present" do
       @user.retrieve[@user.property(:uid)].should == 15
     end
   end
 
   describe "when managing the ensure property" do
     it "should support a :present value" do
       expect { described_class.new(:name => 'foo', :ensure => :present) }.to_not raise_error
     end
 
     it "should support an :absent value" do
       expect { described_class.new(:name => 'foo', :ensure => :absent) }.to_not raise_error
     end
 
     it "should call :create on the provider when asked to sync to the :present state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
       @provider.expects(:create)
       described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).sync
     end
 
     it "should call :delete on the provider when asked to sync to the :absent state" do
       @provider = @provider_class.new(:name => 'foo', :ensure => :present)
       @provider.expects(:delete)
       described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).sync
     end
 
     describe "and determining the current state" do
       it "should return :present when the provider indicates the user exists" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :present)
         described_class.new(:name => 'foo', :ensure => :absent, :provider => @provider).parameter(:ensure).retrieve.should == :present
       end
 
       it "should return :absent when the provider indicates the user does not exist" do
         @provider = @provider_class.new(:name => 'foo', :ensure => :absent)
         described_class.new(:name => 'foo', :ensure => :present, :provider => @provider).parameter(:ensure).retrieve.should == :absent
       end
     end
   end
 
   describe "when managing the uid property" do
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :uid => '50')[:uid].should == 50
     end
 
     it "should support UIDs as numbers" do
       described_class.new(:name => 'foo', :uid => 50)[:uid].should == 50
     end
 
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :uid => :absent)[:uid].should == :absent
     end
   end
 
   describe "when managing the gid" do
     it "should support :absent as a value" do
       described_class.new(:name => 'foo', :gid => :absent)[:gid].should == :absent
     end
 
     it "should convert number-looking strings into actual numbers" do
       described_class.new(:name => 'foo', :gid => '50')[:gid].should == 50
     end
 
     it "should support GIDs specified as integers" do
       described_class.new(:name => 'foo', :gid => 50)[:gid].should == 50
     end
 
     it "should support groups specified by name" do
       described_class.new(:name => 'foo', :gid => 'foo')[:gid].should == 'foo'
     end
 
     describe "when testing whether in sync" do
       it "should return true if no 'should' values are set" do
         # this is currently not the case because gid has no default value, so we would never even
         # call insync? on that property
         if param = described_class.new(:name => 'foo').parameter(:gid)
           param.must be_safe_insync(500)
         end
       end
 
       it "should return true if any of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must be_safe_insync(500)
       end
 
       it "should return false if none of the specified groups are equal to the current integer" do
         Puppet::Util.expects(:gid).with("foo").returns 300
         Puppet::Util.expects(:gid).with("bar").returns 500
         described_class.new(:name => 'baz', :gid => [ 'foo', 'bar' ]).parameter(:gid).must_not be_safe_insync(700)
       end
     end
 
     describe "when syncing" do
       it "should use the first found, specified group as the desired value and send it to the provider" do
         Puppet::Util.expects(:gid).with("foo").returns nil
         Puppet::Util.expects(:gid).with("bar").returns 500
 
         @provider = @provider_class.new(:name => 'foo')
         resource = described_class.new(:name => 'foo', :provider => @provider, :gid => [ 'foo', 'bar' ])
 
         @provider.expects(:gid=).with 500
         resource.parameter(:gid).sync
       end
     end
   end
 
   describe "when managing groups" do
     it "should support a singe group" do
       expect { described_class.new(:name => 'foo', :groups => 'bar') }.to_not raise_error
     end
 
     it "should support multiple groups as an array" do
       expect { described_class.new(:name => 'foo', :groups => [ 'bar' ]) }.to_not raise_error
       expect { described_class.new(:name => 'foo', :groups => [ 'bar', 'baz' ]) }.to_not raise_error
     end
 
     it "should not support a comma separated list" do
       expect { described_class.new(:name => 'foo', :groups => 'bar,baz') }.to raise_error(Puppet::Error, /Group names must be provided as an array/)
     end
 
     it "should not support an empty string" do
       expect { described_class.new(:name => 'foo', :groups => '') }.to raise_error(Puppet::Error, /Group names must not be empty/)
     end
 
     describe "when testing is in sync" do
 
       before :each do
         # the useradd provider uses a single string to represent groups and so does Puppet::Property::List when converting to should values
         @provider = @provider_class.new(:name => 'foo', :groups => 'a,b,e,f')
       end
 
       it "should not care about order" do
         @property = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ]).property(:groups)
         @property.must be_safe_insync([ 'a', 'b', 'c' ])
         @property.must be_safe_insync([ 'a', 'c', 'b' ])
         @property.must be_safe_insync([ 'b', 'a', 'c' ])
         @property.must be_safe_insync([ 'b', 'c', 'a' ])
         @property.must be_safe_insync([ 'c', 'a', 'b' ])
         @property.must be_safe_insync([ 'c', 'b', 'a' ])
       end
 
       it "should merge current value and desired value if membership minimal" do
         @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
         @instance[:membership] = :minimum
         @instance[:groups].should == 'a,b,c,e,f'
       end
 
       it "should not treat a subset of groups insync if membership inclusive" do
         @instance = described_class.new(:name => 'foo', :groups => [ 'a', 'c', 'b' ], :provider => @provider)
         @instance[:membership] = :inclusive
         @instance[:groups].should == 'a,b,c'
       end
     end
   end
 
 
   describe "when managing expiry" do
     it "should fail if given an invalid date" do
       expect { described_class.new(:name => 'foo', :expiry => "200-20-20") }.to raise_error(Puppet::Error, /Expiry dates must be YYYY-MM-DD/)
     end
   end
 
   describe "when managing minimum password age" do
     it "should accept a negative minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '-1') }.to_not raise_error
     end
 
     it "should fail with an empty minimum age" do
       expect { described_class.new(:name => 'foo', :password_min_age => '') }.to raise_error(Puppet::Error, /minimum age must be provided as a number/)
     end
   end
 
   describe "when managing maximum password age" do
     it "should accept a negative maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '-1') }.to_not raise_error
     end
 
     it "should fail with an empty maximum age" do
       expect { described_class.new(:name => 'foo', :password_max_age => '') }.to raise_error(Puppet::Error, /maximum age must be provided as a number/)
     end
   end
 
   describe "when managing passwords" do
     before do
       @password = described_class.new(:name => 'foo', :password => 'mypass').parameter(:password)
     end
 
     it "should not include the password in the change log when adding the password" do
       @password.change_to_s(:absent, "mypass").should_not be_include("mypass")
     end
 
     it "should not include the password in the change log when changing the password" do
       @password.change_to_s("other", "mypass").should_not be_include("mypass")
     end
 
     it "should redact the password when displaying the old value" do
       @password.is_to_s("currentpassword").should =~ /^\[old password hash redacted\]$/
     end
 
     it "should redact the password when displaying the new value" do
       @password.should_to_s("newpassword").should =~ /^\[new password hash redacted\]$/
     end
 
     it "should fail if a ':' is included in the password" do
       expect { described_class.new(:name => 'foo', :password => "some:thing") }.to raise_error(Puppet::Error, /Passwords cannot include ':'/)
     end
 
     it "should allow the value to be set to :absent" do
       expect { described_class.new(:name => 'foo', :password => :absent) }.to_not raise_error
     end
   end
 
   describe "when managing comment on Ruby 1.9", :if => String.method_defined?(:encode) do
     it "should force value encoding to ASCII-8BIT" do
       value = 'abcd™'
       value.encoding.should == Encoding::UTF_8
       user = described_class.new(:name => 'foo', :comment => value)
       user[:comment].encoding.should == Encoding::ASCII_8BIT
       user[:comment].should == value.force_encoding(Encoding::ASCII_8BIT)
     end
   end
 
   describe "when manages_solaris_rbac is enabled" do
     it "should support a :role value for ensure" do
       expect { described_class.new(:name => 'foo', :ensure => :role) }.to_not raise_error
     end
   end
 
   describe "when user has roles" do
     it "should autorequire roles" do
       testuser = described_class.new(:name => "testuser", :roles => ['testrole'] )
       testrole = described_class.new(:name => "testrole")
 
       config = Puppet::Resource::Catalog.new :testing do |conf|
         [testuser, testrole].each { |resource| conf.add_resource resource }
       end
       Puppet::Type::User::ProviderDirectoryservice.stubs(:get_macosx_version_major).returns "10.5"
 
       rel = testuser.autorequire[0]
       rel.source.ref.should == testrole.ref
       rel.target.ref.should == testuser.ref
     end
   end
 
   describe "when setting shell" do
     before :each do
       @shell_provider_class = described_class.provide(:shell_manager) do
         has_features :manages_shell
         mk_resource_methods
         def create; check_valid_shell;end
         def shell=(value); check_valid_shell; end
         def delete; end
         def exists?; get(:ensure) != :absent; end
         def flush; end
         def self.instances; []; end
         def check_valid_shell; end
       end
 
       described_class.stubs(:defaultprovider).returns @shell_provider_class
     end
 
     it "should call :check_valid_shell on the provider when changing shell value" do
       @provider = @shell_provider_class.new(:name => 'foo', :shell => '/bin/bash', :ensure => :present)
       @provider.expects(:check_valid_shell)
       resource = described_class.new(:name => 'foo', :shell => '/bin/zsh', :provider => @provider)
       Puppet::Util::Storage.stubs(:load)
       Puppet::Util::Storage.stubs(:store)
       catalog = Puppet::Resource::Catalog.new
       catalog.add_resource resource
       catalog.apply
     end
 
     it "should call :check_valid_shell on the provider when changing ensure from present to absent" do
       @provider = @shell_provider_class.new(:name => 'foo', :shell => '/bin/bash', :ensure => :absent)
       @provider.expects(:check_valid_shell)
       resource = described_class.new(:name => 'foo', :shell => '/bin/zsh', :provider => @provider)
       Puppet::Util::Storage.stubs(:load)
       Puppet::Util::Storage.stubs(:store)
       catalog = Puppet::Resource::Catalog.new
       catalog.add_resource resource
       catalog.apply
     end
   end
 
   describe "when purging ssh keys" do
     it "should not accept a keyfile with a relative path" do
       expect {
         described_class.new(:name => "a", :purge_ssh_keys => "keys")
       }.to raise_error(Puppet::Error, /Paths to keyfiles must be absolute, not keys/)
     end
 
     context "with a home directory specified" do
       it "should accept true" do
         described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => true)
       end
       it "should accept the ~ wildcard" do
         described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => "~/keys")
       end
       it "should accept the %h wildcard" do
         described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => "%h/keys")
       end
       it "raises when given a relative path" do
         expect {
           described_class.new(:name => "a", :home => "/tmp", :purge_ssh_keys => "keys")
         }.to raise_error(Puppet::Error, /Paths to keyfiles must be absolute/)
       end
     end
 
     context "with no home directory specified" do
       it "should not accept true" do
         expect {
           described_class.new(:name => "a", :purge_ssh_keys => true)
         }.to raise_error(Puppet::Error, /purge_ssh_keys can only be true for users with a defined home directory/)
       end
       it "should not accept the ~ wildcard" do
         expect {
           described_class.new(:name => "a", :purge_ssh_keys => "~/keys")
         }.to raise_error(Puppet::Error, /meta character ~ or %h only allowed for users with a defined home directory/)
       end
       it "should not accept the %h wildcard" do
         expect {
           described_class.new(:name => "a", :purge_ssh_keys => "%h/keys")
         }.to raise_error(Puppet::Error, /meta character ~ or %h only allowed for users with a defined home directory/)
       end
     end
 
     context "with a valid parameter" do
       let(:paths) do
         [ "/dev/null", "/tmp/keyfile" ].map { |path| File.expand_path(path) }
       end
       subject do
         res = described_class.new(:name => "test", :purge_ssh_keys => paths)
         res.catalog = Puppet::Resource::Catalog.new
         res
       end
-      it "should not just return from eval_generate" do
+      it "should not just return from generate" do
         subject.expects :find_unmanaged_keys
-        subject.eval_generate
+        subject.generate
       end
       it "should check each keyfile for readability" do
         paths.each do |path|
           File.expects(:readable?).with(path)
         end
-        subject.eval_generate
+        subject.generate
       end
     end
 
     describe "generated keys" do
       subject do
         res = described_class.new(:name => "test_user_name", :purge_ssh_keys => purge_param)
         res.catalog = Puppet::Resource::Catalog.new
         res
       end
       context "when purging is disabled" do
         let(:purge_param) { false }
-        its(:eval_generate) { should be_empty }
+        its(:generate) { should be_empty }
       end
       context "when purging is enabled" do
         let(:purge_param) { my_fixture('authorized_keys') }
-        let(:resources) { subject.eval_generate }
+        let(:resources) { subject.generate }
         it "should contain a resource for each key" do
           names = resources.collect { |res| res.name }
           names.should include("keyname1")
           names.should include("keyname2")
         end
         it "should not include keys in comment lines" do
           names = resources.collect { |res| res.name }
           names.should_not include("keyname3")
         end
         it "should each have a value for the user property" do
           resources.map { |res|
             res[:user]
           }.reject { |user_name|
             user_name == "test_user_name"
           }.should be_empty
         end
       end
     end
   end
 end