diff --git a/lib/puppet/ssl/certificate_authority.rb b/lib/puppet/ssl/certificate_authority.rb
index 9dcdc1b3b..22823dee6 100644
--- a/lib/puppet/ssl/certificate_authority.rb
+++ b/lib/puppet/ssl/certificate_authority.rb
@@ -1,361 +1,361 @@
 require 'monitor'
 require 'puppet/ssl/host'
 require 'puppet/ssl/certificate_request'
 
 # The class that knows how to sign certificates.  It creates
 # a 'special' SSL::Host whose name is 'ca', thus indicating
 # that, well, it's the CA.  There's some magic in the
 # indirector/ssl_file terminus base class that does that
 # for us.
 #   This class mostly just signs certs for us, but
 # it can also be seen as a general interface into all of the
 # SSL stuff.
 class Puppet::SSL::CertificateAuthority
   # We will only sign extensions on this whitelist, ever.  Any CSR with a
   # requested extension that we don't recognize is rejected, against the risk
   # that it will introduce some security issue through our ignorance of it.
   #
   # Adding an extension to this whitelist simply means we will consider it
   # further, not that we will always accept a certificate with an extension
   # requested on this list.
   RequestExtensionWhitelist = %w{subjectAltName}
 
   require 'puppet/ssl/certificate_factory'
   require 'puppet/ssl/inventory'
   require 'puppet/ssl/certificate_revocation_list'
   require 'puppet/ssl/certificate_authority/interface'
   require 'puppet/network/authstore'
 
   extend MonitorMixin
 
   class CertificateVerificationError < RuntimeError
     attr_accessor :error_code
 
     def initialize(code)
       @error_code = code
     end
   end
 
   def self.singleton_instance
     synchronize do
       @singleton_instance ||= new
     end
   end
 
   class CertificateSigningError < RuntimeError
     attr_accessor :host
 
     def initialize(host)
       @host = host
     end
   end
 
   def self.ca?
     return false unless Puppet[:ca]
     return false unless Puppet.run_mode.master?
     true
   end
 
   # If this process can function as a CA, then return a singleton
   # instance.
   def self.instance
     return nil unless ca?
 
     singleton_instance
   end
 
   attr_reader :name, :host
 
   # Create and run an applicator.  I wanted to build an interface where you could do
   # something like 'ca.apply(:generate).to(:all) but I don't think it's really possible.
   def apply(method, options)
     raise ArgumentError, "You must specify the hosts to apply to; valid values are an array or the symbol :all" unless options[:to]
     applier = Interface.new(method, options)
     applier.apply(self)
   end
 
   # If autosign is configured, then autosign all CSRs that match our configuration.
   def autosign
     return unless auto = autosign?
 
     store = nil
     store = autosign_store(auto) if auto != true
 
     Puppet::SSL::CertificateRequest.indirection.search("*").each do |csr|
       sign(csr.name) if auto == true or store.allowed?(csr.name, "127.1.1.1")
     end
   end
 
   # Do we autosign?  This returns true, false, or a filename.
   def autosign?
     auto = Puppet[:autosign]
     return false if ['false', false].include?(auto)
     return true if ['true', true].include?(auto)
 
     raise ArgumentError, "The autosign configuration '#{auto}' must be a fully qualified file" unless auto =~ /^\//
     FileTest.exist?(auto) && auto
   end
 
   # Create an AuthStore for autosigning.
   def autosign_store(file)
     auth = Puppet::Network::AuthStore.new
     File.readlines(file).each do |line|
       next if line =~ /^\s*#/
       next if line =~ /^\s*$/
       auth.allow(line.chomp)
     end
 
     auth
   end
 
   # Retrieve (or create, if necessary) the certificate revocation list.
   def crl
     unless defined?(@crl)
       unless @crl = Puppet::SSL::CertificateRevocationList.indirection.find(Puppet::SSL::CA_NAME)
         @crl = Puppet::SSL::CertificateRevocationList.new(Puppet::SSL::CA_NAME)
         @crl.generate(host.certificate.content, host.key.content)
         Puppet::SSL::CertificateRevocationList.indirection.save(@crl)
       end
     end
     @crl
   end
 
   # Delegate this to our Host class.
   def destroy(name)
     Puppet::SSL::Host.destroy(name)
   end
 
   # Generate a new certificate.
   def generate(name, options = {})
     raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.indirection.find(name)
     host = Puppet::SSL::Host.new(name)
 
     # Pass on any requested subjectAltName field.
     san = options[:dns_alt_names]
 
     host = Puppet::SSL::Host.new(name)
     host.generate_certificate_request(:dns_alt_names => san)
     sign(name, !!san)
   end
 
   # Generate our CA certificate.
   def generate_ca_certificate
     generate_password unless password?
 
     host.generate_key unless host.key
 
     # Create a new cert request.  We do this specially, because we don't want
     # to actually save the request anywhere.
     request = Puppet::SSL::CertificateRequest.new(host.name)
 
     # We deliberately do not put any subjectAltName in here: the CA
     # certificate absolutely does not need them. --daniel 2011-10-13
     request.generate(host.key)
 
     # Create a self-signed certificate.
     @certificate = sign(host.name, false, request)
 
     # And make sure we initialize our CRL.
     crl
   end
 
   def initialize
     Puppet.settings.use :main, :ssl, :ca
 
     @name = Puppet[:certname]
 
     @host = Puppet::SSL::Host.new(Puppet::SSL::Host.ca_name)
 
     setup
   end
 
   # Retrieve (or create, if necessary) our inventory manager.
   def inventory
     @inventory ||= Puppet::SSL::Inventory.new
   end
 
   # Generate a new password for the CA.
   def generate_password
     pass = ""
     20.times { pass += (rand(74) + 48).chr }
 
     begin
       Puppet.settings.write(:capass) { |f| f.print pass }
     rescue Errno::EACCES => detail
       raise Puppet::Error, "Could not write CA password: #{detail}"
     end
 
     @password = pass
 
     pass
   end
 
   # List all signed certificates.
   def list
     Puppet::SSL::Certificate.indirection.search("*").collect { |c| c.name }
   end
 
   # Read the next serial from the serial file, and increment the
   # file so this one is considered used.
   def next_serial
     serial = nil
 
     # This is slightly odd.  If the file doesn't exist, our readwritelock creates
     # it, but with a mode we can't actually read in some cases.  So, use
     # a default before the lock.
     serial = 0x1 unless FileTest.exist?(Puppet[:serial])
 
     Puppet.settings.readwritelock(:serial) { |f|
       serial ||= File.read(Puppet.settings[:serial]).chomp.hex if FileTest.exist?(Puppet[:serial])
 
       # We store the next valid serial, not the one we just used.
       f << "%04X" % (serial + 1)
     }
 
     serial
   end
 
   # Does the password file exist?
   def password?
     FileTest.exist? Puppet[:capass]
   end
 
   # Print a given host's certificate as text.
   def print(name)
     (cert = Puppet::SSL::Certificate.indirection.find(name)) ? cert.to_text : nil
   end
 
   # Revoke a given certificate.
   def revoke(name)
     raise ArgumentError, "Cannot revoke certificates when the CRL is disabled" unless crl
 
     if cert = Puppet::SSL::Certificate.indirection.find(name)
       serial = cert.content.serial
     elsif ! serial = inventory.serial(name)
       raise ArgumentError, "Could not find a serial number for #{name}"
     end
     crl.revoke(serial, host.key.content)
   end
 
   # This initializes our CA so it actually works.  This should be a private
   # method, except that you can't any-instance stub private methods, which is
   # *awesome*.  This method only really exists to provide a stub-point during
   # testing.
   def setup
     generate_ca_certificate unless @host.certificate
   end
 
   # Sign a given certificate request.
   def sign(hostname, allow_dns_alt_names = false, self_signing_csr = nil)
     # This is a self-signed certificate
     if self_signing_csr
       # # This is a self-signed certificate, which is for the CA.  Since this
       # # forces the certificate to be self-signed, anyone who manages to trick
       # # the system into going through this path gets a certificate they could
       # # generate anyway.  There should be no security risk from that.
       csr = self_signing_csr
       cert_type = :ca
       issuer = csr.content
     else
       unless csr = Puppet::SSL::CertificateRequest.indirection.find(hostname)
         raise ArgumentError, "Could not find certificate request for #{hostname}"
       end
 
       cert_type = :server
       issuer = host.certificate.content
 
       # Make sure that the CSR conforms to our internal signing policies.
       # This will raise if the CSR doesn't conform, but just in case...
       check_internal_signing_policies(hostname, csr, allow_dns_alt_names) or
         raise CertificateSigningError.new(hostname), "CSR had an unknown failure checking internal signing policies, will not sign!"
     end
 
     cert = Puppet::SSL::Certificate.new(hostname)
     cert.content = Puppet::SSL::CertificateFactory.
       build(cert_type, csr, issuer, next_serial)
     cert.content.sign(host.key.content, OpenSSL::Digest::SHA1.new)
 
     Puppet.notice "Signed certificate request for #{hostname}"
 
     # Add the cert to the inventory before we save it, since
     # otherwise we could end up with it being duplicated, if
     # this is the first time we build the inventory file.
     inventory.add(cert)
 
     # Save the now-signed cert.  This should get routed correctly depending
     # on the certificate type.
     Puppet::SSL::Certificate.indirection.save(cert)
 
     # And remove the CSR if this wasn't self signed.
     Puppet::SSL::CertificateRequest.indirection.destroy(csr.name) unless self_signing_csr
 
     cert
   end
 
   def check_internal_signing_policies(hostname, csr, allow_dns_alt_names)
     # Reject unknown request extensions.
     unknown_req = csr.request_extensions.
       reject {|x| RequestExtensionWhitelist.include? x["oid"] }
 
-    if unknown_req and unknown_req.count > 0
+    if unknown_req and not unknown_req.empty?
       names = unknown_req.map {|x| x["oid"] }.sort.uniq.join(", ")
       raise CertificateSigningError.new(hostname), "CSR has request extensions that are not permitted: #{names}"
     end
 
     # Wildcards: we don't allow 'em at any point.
     #
     # The stringification here makes the content visible, and saves us having
     # to scrobble through the content of the CSR subject field to make sure it
     # is what we expect where we expect it.
     if csr.content.subject.to_s.include? '*'
       raise CertificateSigningError.new(hostname), "CSR subject contains a wildcard, which is not allowed: #{csr.content.subject.to_s}"
     end
 
     unless csr.subject_alt_names.empty?
       # If you alt names are allowed, they are required. Otherwise they are
       # disallowed. Self-signed certs are implicitly trusted, however.
       unless allow_dns_alt_names
         raise CertificateSigningError.new(hostname), "CSR contained subject alternative names (#{csr.subject_alt_names.join(', ')}), which are disallowed. Use --allow-dns-alt-names to sign this request."
       end
 
       # If subjectAltNames are present, validate that they are only for DNS
       # labels, not any other kind.
       unless csr.subject_alt_names.all? {|x| x =~ /^DNS:/ }
         raise CertificateSigningError.new(hostname), "CSR contained a subjectAltName outside the DNS label space: #{csr.subject_alt_names.join(', ')}"
       end
 
       # Check for wildcards in the subjectAltName fields too.
       if csr.subject_alt_names.any? {|x| x.include? '*' }
         raise CertificateSigningError.new(hostname), "CSR subjectAltName contains a wildcard, which is not allowed: #{csr.subject_alt_names.join(', ')}"
       end
     end
 
     return true                 # good enough for us!
   end
 
   # Verify a given host's certificate.
   def verify(name)
     unless cert = Puppet::SSL::Certificate.indirection.find(name)
       raise ArgumentError, "Could not find a certificate for #{name}"
     end
     store = OpenSSL::X509::Store.new
     store.add_file Puppet[:cacert]
     store.add_crl crl.content if self.crl
     store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
     store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end
 
   def fingerprint(name, md = :MD5)
     unless cert = Puppet::SSL::Certificate.indirection.find(name) || Puppet::SSL::CertificateRequest.indirection.find(name)
       raise ArgumentError, "Could not find a certificate or csr for #{name}"
     end
     cert.fingerprint(md)
   end
 
   # List the waiting certificate requests.
   def waiting?
     Puppet::SSL::CertificateRequest.indirection.search("*").collect { |r| r.name }
   end
 end
diff --git a/lib/puppet/ssl/certificate_request.rb b/lib/puppet/ssl/certificate_request.rb
index 28c07f1cb..461dc5721 100644
--- a/lib/puppet/ssl/certificate_request.rb
+++ b/lib/puppet/ssl/certificate_request.rb
@@ -1,149 +1,149 @@
 require 'puppet/ssl/base'
 
 # Manage certificate requests.
 class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
   wraps OpenSSL::X509::Request
 
   extend Puppet::Indirector
 
   # If auto-signing is on, sign any certificate requests as they are saved.
   module AutoSigner
     def save(instance, key = nil)
       super
 
       # Try to autosign the CSR.
       if ca = Puppet::SSL::CertificateAuthority.instance
         ca.autosign
       end
     end
   end
 
   indirects :certificate_request, :terminus_class => :file, :extend => AutoSigner
 
   # Convert a string into an instance.
   def self.from_s(string)
     instance = wrapped_class.new(string)
     name = instance.subject.to_s.sub(/\/CN=/i, '').downcase
     result = new(name)
     result.content = instance
     result
   end
 
   # Because of how the format handler class is included, this
   # can't be in the base class.
   def self.supported_formats
     [:s]
   end
 
   def extension_factory
     @ef ||= OpenSSL::X509::ExtensionFactory.new
   end
 
   # How to create a certificate request with our system defaults.
   def generate(key, options = {})
     Puppet.info "Creating a new SSL certificate request for #{name}"
 
     # Support either an actual SSL key, or a Puppet key.
     key = key.content if key.is_a?(Puppet::SSL::Key)
 
     # If we're a CSR for the CA, then use the real ca_name, rather than the
     # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
     # but it's also just a good idea.
     common_name = name == Puppet::SSL::CA_NAME ? Puppet.settings[:ca_name] : name
 
     csr = OpenSSL::X509::Request.new
     csr.version = 0
     csr.subject = OpenSSL::X509::Name.new([["CN", common_name]])
     csr.public_key = key.public_key
 
     if options[:dns_alt_names] then
       names = options[:dns_alt_names].split(/\s*,\s*/).map(&:strip) + [name]
       names = names.sort.uniq.map {|name| "DNS:#{name}" }.join(", ")
       names = extension_factory.create_extension("subjectAltName", names, false)
 
       extReq = OpenSSL::ASN1::Set([OpenSSL::ASN1::Sequence([names])])
 
       # We only support the standard request extensions.  If you really need
       # msExtReq support, let us know and we can restore them. --daniel 2011-10-10
       csr.add_attribute(OpenSSL::X509::Attribute.new("extReq", extReq))
     end
 
     csr.sign(key, OpenSSL::Digest::MD5.new)
 
     raise Puppet::Error, "CSR sign verification failed; you need to clean the certificate request for #{name} on the server" unless csr.verify(key.public_key)
 
     @content = csr
     Puppet.info "Certificate Request fingerprint (md5): #{fingerprint}"
     @content
   end
 
   # Return the set of extensions requested on this CSR, in a form designed to
   # be useful to Ruby: a hash.  Which, not coincidentally, you can pass
   # successfully to the OpenSSL constructor later, if you want.
   def request_extensions
     raise Puppet::Error, "CSR needs content to extract fields" unless @content
 
     # Prefer the standard extReq, but accept the Microsoft specific version as
     # a fallback, if the standard version isn't found.
     ext = @content.attributes.find {|x| x.oid == "extReq" } or
       @content.attributes.find {|x| x.oid == "msExtReq" }
     return [] unless ext
 
     # Assert the structure and extract the names into an array of arrays.
     unless ext.value.is_a? OpenSSL::ASN1::Set
       raise Puppet::Error, "In #{ext.oid}, expected Set but found #{ext.value.class}"
     end
 
     unless ext.value.value.is_a? Array
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array] but found #{ext.value.value.class}"
     end
 
-    unless ext.value.value.count == 1
-      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.count} items in the array"
+    unless ext.value.value.length == 1
+      raise Puppet::Error, "In #{ext.oid}, expected Set[Array[...]], but found #{ext.value.value.length} items in the array"
     end
 
     san = ext.value.value.first
     unless san.is_a? OpenSSL::ASN1::Sequence
       raise Puppet::Error, "In #{ext.oid}, expected Set[Array[Sequence[...]]], but found #{san.class}"
     end
     san = san.value
 
     # OK, now san should be the array of items, validate that...
     index = -1
     san.map do |name|
       index += 1
 
       unless name.is_a? OpenSSL::ASN1::Sequence
         raise Puppet::Error, "In #{ext.oid}, expected request extension record #{index} to be a Sequence, but found #{name.class}"
       end
       name = name.value
 
       # OK, turn that into an extension, to unpack the content.  Lovely that
       # we have to swap the order of arguments to the underlying method, or
       # perhaps that the ASN.1 representation chose to pack them in a
       # strange order where the optional component comes *earlier* than the
       # fixed component in the sequence.
-      case name.count
+      case name.length
       when 2
         ev = OpenSSL::X509::Extension.new(name[0].value, name[1].value)
         { "oid" => ev.oid, "value" => ev.value }
 
       when 3
         ev = OpenSSL::X509::Extension.new(name[0].value, name[2].value, name[1].value)
         { "oid" => ev.oid, "value" => ev.value, "critical" => ev.critical? }
 
       else
-        raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.count}"
+        raise Puppet::Error, "In #{ext.oid}, expected extension record #{index} to have two or three items, but found #{name.length}"
       end
     end.flatten
   end
 
   def subject_alt_names
     @subject_alt_names ||= request_extensions.
       select {|x| x["oid"] = "subjectAltName" }.
       map {|x| x["value"].split(/\s*,\s*/) }.
       flatten.
       sort.
       uniq
   end
 end
diff --git a/spec/unit/configurer_spec.rb b/spec/unit/configurer_spec.rb
index 052b167ce..5c660cc31 100755
--- a/spec/unit/configurer_spec.rb
+++ b/spec/unit/configurer_spec.rb
@@ -1,611 +1,611 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/configurer'
 
 describe Puppet::Configurer do
   before do
     Puppet.settings.stubs(:use).returns(true)
     @agent = Puppet::Configurer.new
     @agent.stubs(:dostorage)
     Puppet::Util::Storage.stubs(:store)
     Puppet[:server] = "puppetmaster"
     Puppet[:report] = true
   end
 
   it "should include the Plugin Handler module" do
     Puppet::Configurer.ancestors.should be_include(Puppet::Configurer::PluginHandler)
   end
 
   it "should include the Fact Handler module" do
     Puppet::Configurer.ancestors.should be_include(Puppet::Configurer::FactHandler)
   end
 
   it "should use the puppetdlockfile as its lockfile path" do
     Puppet.settings.expects(:value).with(:puppetdlockfile).returns("/my/lock")
     Puppet::Configurer.lockfile_path.should == "/my/lock"
   end
 
   describe "when executing a pre-run hook" do
     it "should do nothing if the hook is set to an empty string" do
       Puppet.settings[:prerun_command] = ""
       Puppet::Util.expects(:exec).never
 
       @agent.execute_prerun_command
     end
 
     it "should execute any pre-run command provided via the 'prerun_command' setting" do
       Puppet.settings[:prerun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
       @agent.execute_prerun_command
     end
 
     it "should fail if the command fails" do
       Puppet.settings[:prerun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
       @agent.execute_prerun_command.should be_false
     end
   end
 
   describe "when executing a post-run hook" do
     it "should do nothing if the hook is set to an empty string" do
       Puppet.settings[:postrun_command] = ""
       Puppet::Util.expects(:exec).never
 
       @agent.execute_postrun_command
     end
 
     it "should execute any post-run command provided via the 'postrun_command' setting" do
       Puppet.settings[:postrun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
       @agent.execute_postrun_command
     end
 
     it "should fail if the command fails" do
       Puppet.settings[:postrun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
       @agent.execute_postrun_command.should be_false
     end
   end
 
   describe "when executing a catalog run" do
     before do
       Puppet.settings.stubs(:use).returns(true)
       @agent.stubs(:prepare)
       Puppet::Node::Facts.indirection.terminus_class = :memory
       @facts = Puppet::Node::Facts.new(Puppet[:node_name_value])
       Puppet::Node::Facts.indirection.save(@facts)
 
       @catalog = Puppet::Resource::Catalog.new
       @catalog.stubs(:to_ral).returns(@catalog)
       Puppet::Resource::Catalog.indirection.terminus_class = :rest
       Puppet::Resource::Catalog.indirection.stubs(:find).returns(@catalog)
       @agent.stubs(:send_report)
       @agent.stubs(:save_last_run_summary)
 
       Puppet::Util::Log.stubs(:close_all)
     end
 
     after :all do
       Puppet::Node::Facts.indirection.reset_terminus_class
       Puppet::Resource::Catalog.indirection.reset_terminus_class
     end
 
     it "should prepare for the run" do
       @agent.expects(:prepare)
 
       @agent.run
     end
 
     it "should initialize a transaction report if one is not provided" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns report
 
       @agent.run
     end
 
     it "should respect node_name_fact when setting the host on a report" do
       Puppet[:node_name_fact] = 'my_name_fact'
       @facts.values = {'my_name_fact' => 'node_name_from_fact'}
 
       @agent.run.host.should == 'node_name_from_fact'
     end
 
     it "should pass the new report to the catalog" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.stubs(:new).returns report
       @catalog.expects(:apply).with{|options| options[:report] == report}
 
       @agent.run
     end
 
     it "should use the provided report if it was passed one" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).never
       @catalog.expects(:apply).with{|options| options[:report] == report}
 
       @agent.run(:report => report)
     end
 
     it "should set the report as a log destination" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns report
 
       Puppet::Util::Log.expects(:newdestination).with(report)
       Puppet::Util::Log.expects(:close).with(report)
 
       @agent.run
     end
 
     it "should retrieve the catalog" do
       @agent.expects(:retrieve_catalog)
 
       @agent.run
     end
 
     it "should log a failure and do nothing if no catalog can be retrieved" do
       @agent.expects(:retrieve_catalog).returns nil
 
       Puppet.expects(:err).with "Could not retrieve catalog; skipping run"
 
       @agent.run
     end
 
     it "should apply the catalog with all options to :run" do
       @agent.expects(:retrieve_catalog).returns @catalog
 
       @catalog.expects(:apply).with { |args| args[:one] == true }
       @agent.run :one => true
     end
 
     it "should accept a catalog and use it instead of retrieving a different one" do
       @agent.expects(:retrieve_catalog).never
 
       @catalog.expects(:apply)
       @agent.run :one => true, :catalog => @catalog
     end
 
     it "should benchmark how long it takes to apply the catalog" do
       @agent.expects(:benchmark).with(:notice, "Finished catalog run")
 
       @agent.expects(:retrieve_catalog).returns @catalog
 
       @catalog.expects(:apply).never # because we're not yielding
       @agent.run
     end
 
     it "should execute post-run hooks after the run" do
       @agent.expects(:execute_postrun_command)
 
       @agent.run
     end
 
     it "should send the report" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
       @agent.expects(:send_report).with(report)
 
       @agent.run
     end
 
     it "should send the transaction report even if the catalog could not be retrieved" do
       @agent.expects(:retrieve_catalog).returns nil
 
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
       @agent.expects(:send_report)
 
       @agent.run
     end
 
     it "should send the transaction report even if there is a failure" do
       @agent.expects(:retrieve_catalog).raises "whatever"
 
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
       @agent.expects(:send_report)
 
       @agent.run.should be_nil
     end
 
     it "should remove the report as a log destination when the run is finished" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       @agent.run
 
       Puppet::Util::Log.destinations.should_not include(report)
     end
 
     it "should return the report as the result of the run" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       @agent.run.should equal(report)
     end
 
     it "should send the transaction report even if the pre-run command fails" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       Puppet.settings[:prerun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
       @agent.expects(:send_report)
 
       @agent.run.should be_nil
     end
 
     it "should include the pre-run command failure in the report" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       Puppet.settings[:prerun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
-      report.expects(:<<).with { |log| log.message =~ /^Could not run command from prerun_command/ }
+      report.expects(:<<).with { |log| log.message.include?("Could not run command from prerun_command") }
 
       @agent.run.should be_nil
     end
 
     it "should send the transaction report even if the post-run command fails" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       Puppet.settings[:postrun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
       @agent.expects(:send_report)
 
       @agent.run.should be_nil
     end
 
     it "should include the post-run command failure in the report" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       Puppet.settings[:postrun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
-      report.expects(:<<).with { |log| log.message =~ /^Could not run command from postrun_command/ }
+      report.expects(:<<).with { |log| log.message.include?("Could not run command from postrun_command") }
 
       @agent.run.should be_nil
     end
 
     it "should execute post-run command even if the pre-run command fails" do
       Puppet.settings[:prerun_command] = "/my/precommand"
       Puppet.settings[:postrun_command] = "/my/postcommand"
       Puppet::Util.expects(:execute).with(["/my/precommand"]).raises(Puppet::ExecutionFailure, "Failed")
       Puppet::Util.expects(:execute).with(["/my/postcommand"])
 
       @agent.run.should be_nil
     end
 
     it "should finalize the report" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       report.expects(:finalize_report)
       @agent.run
     end
 
     it "should not apply the catalog if the pre-run command fails" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       Puppet.settings[:prerun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
       @catalog.expects(:apply).never()
       @agent.expects(:send_report)
 
       @agent.run.should be_nil
     end
 
     it "should apply the catalog, send the report, and return nil if the post-run command fails" do
       report = Puppet::Transaction::Report.new("apply")
       Puppet::Transaction::Report.expects(:new).returns(report)
 
       Puppet.settings[:postrun_command] = "/my/command"
       Puppet::Util.expects(:execute).with(["/my/command"]).raises(Puppet::ExecutionFailure, "Failed")
 
       @catalog.expects(:apply)
       @agent.expects(:send_report)
 
       @agent.run.should be_nil
     end
 
     describe "when not using a REST terminus for catalogs" do
       it "should not pass any facts when retrieving the catalog" do
         Puppet::Resource::Catalog.indirection.terminus_class = :compiler
         @agent.expects(:facts_for_uploading).never
         Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options|
           options[:facts].nil?
         }.returns @catalog
 
         @agent.run
       end
     end
 
     describe "when using a REST terminus for catalogs" do
       it "should pass the prepared facts and the facts format as arguments when retrieving the catalog" do
         Puppet::Resource::Catalog.indirection.terminus_class = :rest
         @agent.expects(:facts_for_uploading).returns(:facts => "myfacts", :facts_format => :foo)
         Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options|
           options[:facts] == "myfacts" and options[:facts_format] == :foo
         }.returns @catalog
 
         @agent.run
       end
     end
   end
 
   describe "when sending a report" do
     include PuppetSpec::Files
 
     before do
       Puppet.settings.stubs(:use).returns(true)
       @configurer = Puppet::Configurer.new
       Puppet[:lastrunfile] = tmpfile('last_run_file')
 
       @report = Puppet::Transaction::Report.new("apply")
     end
 
     it "should print a report summary if configured to do so" do
       Puppet.settings[:summarize] = true
 
       @report.expects(:summary).returns "stuff"
 
       @configurer.expects(:puts).with("stuff")
       @configurer.send_report(@report)
     end
 
     it "should not print a report summary if not configured to do so" do
       Puppet.settings[:summarize] = false
 
       @configurer.expects(:puts).never
       @configurer.send_report(@report)
     end
 
     it "should save the report if reporting is enabled" do
       Puppet.settings[:report] = true
 
       Puppet::Transaction::Report.indirection.expects(:save).with(@report)
       @configurer.send_report(@report)
     end
 
     it "should not save the report if reporting is disabled" do
       Puppet.settings[:report] = false
 
       Puppet::Transaction::Report.indirection.expects(:save).with(@report).never
       @configurer.send_report(@report)
     end
 
     it "should save the last run summary if reporting is enabled" do
       Puppet.settings[:report] = true
 
       @configurer.expects(:save_last_run_summary).with(@report)
       @configurer.send_report(@report)
     end
 
     it "should save the last run summary if reporting is disabled" do
       Puppet.settings[:report] = false
 
       @configurer.expects(:save_last_run_summary).with(@report)
       @configurer.send_report(@report)
     end
 
     it "should log but not fail if saving the report fails" do
       Puppet.settings[:report] = true
 
       Puppet::Transaction::Report.indirection.expects(:save).raises("whatever")
 
       Puppet.expects(:err)
       lambda { @configurer.send_report(@report) }.should_not raise_error
     end
   end
 
   describe "when saving the summary report file" do
     before do
       Puppet.settings.stubs(:use).returns(true)
       @configurer = Puppet::Configurer.new
 
       @report = stub 'report'
       @trans = stub 'transaction'
       @lastrunfd = stub 'lastrunfd'
       Puppet::Util::FileLocking.stubs(:writelock).yields(@lastrunfd)
     end
 
     it "should write the raw summary to the lastrunfile setting value" do
       Puppet::Util::FileLocking.expects(:writelock).with(Puppet[:lastrunfile], 0660)
       @configurer.save_last_run_summary(@report)
     end
 
     it "should write the raw summary as yaml" do
       @report.expects(:raw_summary).returns("summary")
       @lastrunfd.expects(:print).with(YAML.dump("summary"))
       @configurer.save_last_run_summary(@report)
     end
 
     it "should log but not fail if saving the last run summary fails" do
       Puppet::Util::FileLocking.expects(:writelock).raises "exception"
       Puppet.expects(:err)
       lambda { @configurer.save_last_run_summary(@report) }.should_not raise_error
     end
 
   end
 
   describe "when retrieving a catalog" do
     before do
       Puppet.settings.stubs(:use).returns(true)
       @agent.stubs(:facts_for_uploading).returns({})
 
       @catalog = Puppet::Resource::Catalog.new
 
       # this is the default when using a Configurer instance
       Puppet::Resource::Catalog.indirection.stubs(:terminus_class).returns :rest
 
       @agent.stubs(:convert_catalog).returns @catalog
     end
 
     describe "and configured to only retrieve a catalog from the cache" do
       before do
         Puppet.settings[:use_cached_catalog] = true
       end
 
       it "should first look in the cache for a catalog" do
         Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_terminus] == true }.returns @catalog
         Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.never
 
         @agent.retrieve_catalog({}).should == @catalog
       end
 
       it "should compile a new catalog if none is found in the cache" do
         Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_terminus] == true }.returns nil
         Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.returns @catalog
 
         @agent.retrieve_catalog({}).should == @catalog
       end
     end
 
     it "should use the Catalog class to get its catalog" do
       Puppet::Resource::Catalog.indirection.expects(:find).returns @catalog
 
       @agent.retrieve_catalog({})
     end
 
     it "should use its node_name_value to retrieve the catalog" do
       Facter.stubs(:value).returns "eh"
       Puppet.settings[:node_name_value] = "myhost.domain.com"
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| name == "myhost.domain.com" }.returns @catalog
 
       @agent.retrieve_catalog({})
     end
 
     it "should default to returning a catalog retrieved directly from the server, skipping the cache" do
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.returns @catalog
 
       @agent.retrieve_catalog({}).should == @catalog
     end
 
     it "should log and return the cached catalog when no catalog can be retrieved from the server" do
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.returns nil
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_terminus] == true }.returns @catalog
 
       Puppet.expects(:notice)
 
       @agent.retrieve_catalog({}).should == @catalog
     end
 
     it "should not look in the cache for a catalog if one is returned from the server" do
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.returns @catalog
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_terminus] == true }.never
 
       @agent.retrieve_catalog({}).should == @catalog
     end
 
     it "should return the cached catalog when retrieving the remote catalog throws an exception" do
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.raises "eh"
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_terminus] == true }.returns @catalog
 
       @agent.retrieve_catalog({}).should == @catalog
     end
 
     it "should log and return nil if no catalog can be retrieved from the server and :usecacheonfailure is disabled" do
       Puppet.stubs(:[])
       Puppet.expects(:[]).with(:usecacheonfailure).returns false
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.returns nil
 
       Puppet.expects(:warning)
 
       @agent.retrieve_catalog({}).should be_nil
     end
 
     it "should return nil if no cached catalog is available and no catalog can be retrieved from the server" do
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_cache] == true }.returns nil
       Puppet::Resource::Catalog.indirection.expects(:find).with { |name, options| options[:ignore_terminus] == true }.returns nil
 
       @agent.retrieve_catalog({}).should be_nil
     end
 
     it "should convert the catalog before returning" do
       Puppet::Resource::Catalog.indirection.stubs(:find).returns @catalog
 
       @agent.expects(:convert_catalog).with { |cat, dur| cat == @catalog }.returns "converted catalog"
       @agent.retrieve_catalog({}).should == "converted catalog"
     end
 
     it "should return nil if there is an error while retrieving the catalog" do
       Puppet::Resource::Catalog.indirection.expects(:find).at_least_once.raises "eh"
 
       @agent.retrieve_catalog({}).should be_nil
     end
   end
 
   describe "when converting the catalog" do
     before do
       Puppet.settings.stubs(:use).returns(true)
 
       @catalog = Puppet::Resource::Catalog.new
       @oldcatalog = stub 'old_catalog', :to_ral => @catalog
     end
 
     it "should convert the catalog to a RAL-formed catalog" do
       @oldcatalog.expects(:to_ral).returns @catalog
 
       @agent.convert_catalog(@oldcatalog, 10).should equal(@catalog)
     end
 
     it "should finalize the catalog" do
       @catalog.expects(:finalize)
 
       @agent.convert_catalog(@oldcatalog, 10)
     end
 
     it "should record the passed retrieval time with the RAL catalog" do
       @catalog.expects(:retrieval_duration=).with 10
 
       @agent.convert_catalog(@oldcatalog, 10)
     end
 
     it "should write the RAL catalog's class file" do
       @catalog.expects(:write_class_file)
 
       @agent.convert_catalog(@oldcatalog, 10)
     end
 
     it "should write the RAL catalog's resource file" do
       @catalog.expects(:write_resource_file)
 
       @agent.convert_catalog(@oldcatalog, 10)
     end
   end
 
   describe "when preparing for a run" do
     before do
       Puppet.settings.stubs(:use).returns(true)
       @agent.stubs(:download_fact_plugins)
       @agent.stubs(:download_plugins)
       @facts = {"one" => "two", "three" => "four"}
     end
 
     it "should initialize the metadata store" do
       @agent.class.stubs(:facts).returns(@facts)
       @agent.expects(:dostorage)
       @agent.prepare({})
     end
 
     it "should download fact plugins" do
       @agent.expects(:download_fact_plugins)
 
       @agent.prepare({})
     end
 
     it "should download plugins" do
       @agent.expects(:download_plugins)
 
       @agent.prepare({})
     end
   end
 end
diff --git a/spec/unit/ssl/certificate_factory_spec.rb b/spec/unit/ssl/certificate_factory_spec.rb
index c47c0fa0e..fc1b3a740 100755
--- a/spec/unit/ssl/certificate_factory_spec.rb
+++ b/spec/unit/ssl/certificate_factory_spec.rb
@@ -1,127 +1,126 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/ssl/certificate_factory'
 
 describe Puppet::SSL::CertificateFactory do
   let :serial    do OpenSSL::BN.new('12') end
   let :name      do "example.local" end
   let :x509_name do OpenSSL::X509::Name.new([['CN', name]]) end
   let :key       do Puppet::SSL::Key.new(name).generate end
   let :csr       do
     csr = Puppet::SSL::CertificateRequest.new(name)
     csr.generate(key)
     csr
   end
   let :issuer do
     cert = OpenSSL::X509::Certificate.new
     cert.subject = OpenSSL::X509::Name.new([["CN", 'issuer.local']])
     cert
   end
 
   describe "when generating the certificate" do
     it "should return a new X509 certificate" do
       subject.build(:server, csr, issuer, serial).should_not ==
         subject.build(:server, csr, issuer, serial)
     end
 
     it "should set the certificate's version to 2" do
       subject.build(:server, csr, issuer, serial).version.should == 2
     end
 
     it "should set the certificate's subject to the CSR's subject" do
       cert = subject.build(:server, csr, issuer, serial)
       cert.subject.should eql x509_name
     end
 
     it "should set the certificate's issuer to the Issuer's subject" do
       cert = subject.build(:server, csr, issuer, serial)
       cert.issuer.should eql issuer.subject
     end
 
     it "should set the certificate's public key to the CSR's public key" do
       cert = subject.build(:server, csr, issuer, serial)
       cert.public_key.should be_public
       cert.public_key.to_s.should == csr.content.public_key.to_s
     end
 
     it "should set the certificate's serial number to the provided serial number" do
       cert = subject.build(:server, csr, issuer, serial)
       cert.serial.should == serial
     end
 
     it "should have 24 hours grace on the start of the cert" do
       cert = subject.build(:server, csr, issuer, serial)
       cert.not_before.should be_within(1).of(Time.now - 24*60*60)
     end
 
     it "should set the default TTL of the certificate" do
       ttl  = Puppet::SSL::CertificateFactory.ttl
       cert = subject.build(:server, csr, issuer, serial)
       cert.not_after.should be_within(1).of(Time.now + ttl)
     end
 
     it "should respect a custom TTL for the CA" do
       Puppet[:ca_ttl] = 12
       cert = subject.build(:server, csr, issuer, serial)
       cert.not_after.should be_within(1).of(Time.now + 12)
     end
 
     it "should build extensions for the certificate" do
       cert = subject.build(:server, csr, issuer, serial)
-      exts = cert.extensions.map {|x| x.to_h }.group_by {|x| x["oid"] }
-      exts["nsComment"].should ==
-        [{ "oid"      => "nsComment",
-           "value"    => "Puppet Ruby/OpenSSL Internal Certificate",
-           "critical" => false }]
+      cert.extensions.map {|x| x.to_h }.find {|x| x["oid"] == "nsComment" }.should ==
+        { "oid"      => "nsComment",
+          "value"    => "Puppet Ruby/OpenSSL Internal Certificate",
+          "critical" => false }
     end
 
     # See #2848 for why we are doing this: we need to make sure that
     # subjectAltName is set if the CSR has it, but *not* if it is set when the
     # certificate is built!
     it "should not add subjectAltNames from dns_alt_names" do
       Puppet[:dns_alt_names] = 'one, two'
       # Verify the CSR still has no extReq, just in case...
       csr.request_extensions.should == []
       cert = subject.build(:server, csr, issuer, serial)
 
       cert.extensions.find {|x| x.oid == 'subjectAltName' }.should be_nil
     end
 
     it "should add subjectAltName when the CSR requests them" do
       Puppet[:dns_alt_names] = ''
 
       expect = %w{one two} + [name]
 
       csr = Puppet::SSL::CertificateRequest.new(name)
       csr.generate(key, :dns_alt_names => expect.join(', '))
 
       csr.request_extensions.should_not be_nil
       csr.subject_alt_names.should =~ expect.map{|x| "DNS:#{x}"}
 
       cert = subject.build(:server, csr, issuer, serial)
       san = cert.extensions.find {|x| x.oid == 'subjectAltName' }
       san.should_not be_nil
       expect.each do |name|
         san.value.should =~ /DNS:#{name}\b/i
       end
     end
 
     # Can't check the CA here, since that requires way more infrastructure
     # that I want to build up at this time.  We can verify the critical
     # values, though, which are non-CA certs. --daniel 2011-10-11
     { :ca            => 'CA:TRUE',
       :terminalsubca => ['CA:TRUE', 'pathlen:0'],
       :server        => 'CA:FALSE',
       :ocsp          => 'CA:FALSE',
       :client        => 'CA:FALSE',
     }.each do |name, value|
       it "should set basicConstraints for #{name} #{value.inspect}" do
         cert = subject.build(name, csr, issuer, serial)
         bc = cert.extensions.find {|x| x.oid == 'basicConstraints' }
         bc.should be
         bc.value.split(/\s*,\s*/).should =~ Array(value)
       end
     end
   end
 end