diff --git a/lib/puppet/application.rb b/lib/puppet/application.rb
index 51a309454..b958c2ce9 100644
--- a/lib/puppet/application.rb
+++ b/lib/puppet/application.rb
@@ -1,420 +1,435 @@
 require 'optparse'
 require 'puppet/util/plugins'
 
 # This class handles all the aspects of a Puppet application/executable
 # * setting up options
 # * setting up logs
 # * choosing what to run
 # * representing execution status
 #
 # === Usage
 # An application is a subclass of Puppet::Application.
 #
 # For legacy compatibility,
 #      Puppet::Application[:example].run
 # is equivalent to
 #      Puppet::Application::Example.new.run
 #
 #
 # class Puppet::Application::Example << Puppet::Application
 #
 #     def preinit
 #         # perform some pre initialization
 #         @all = false
 #     end
 #
 #     # run_command is called to actually run the specified command
 #     def run_command
 #         send Puppet::Util::CommandLine.new.args.shift
 #     end
 #
 #     # option uses metaprogramming to create a method
 #     # and also tells the option parser how to invoke that method
 #     option("--arg ARGUMENT") do |v|
 #         @args << v
 #     end
 #
 #     option("--debug", "-d") do |v|
 #         @debug = v
 #     end
 #
 #     option("--all", "-a:) do |v|
 #         @all = v
 #     end
 #
 #     def handle_unknown(opt,arg)
 #         # last chance to manage an option
 #         ...
 #         # let's say to the framework we finally handle this option
 #         true
 #     end
 #
 #     def read
 #         # read action
 #     end
 #
 #     def write
 #         # writeaction
 #     end
 #
 # end
 #
 # === Preinit
 # The preinit block is the first code to be called in your application, before option parsing,
 # setup or command execution.
 #
 # === Options
 # Puppet::Application uses +OptionParser+ to manage the application options.
 # Options are defined with the +option+ method to which are passed various
 # arguments, including the long option, the short option, a description...
 # Refer to +OptionParser+ documentation for the exact format.
 # * If the option method is given a block, this one will be called whenever
 # the option is encountered in the command-line argument.
 # * If the option method has no block, a default functionnality will be used, that
 # stores the argument (or true/false if the option doesn't require an argument) in
 # the global (to the application) options array.
 # * If a given option was not defined by a the +option+ method, but it exists as a Puppet settings:
 #  * if +unknown+ was used with a block, it will be called with the option name and argument
 #  * if +unknown+ wasn't used, then the option/argument is handed to Puppet.settings.handlearg for
 #    a default behavior
 #
 # --help is managed directly by the Puppet::Application class, but can be overriden.
 #
 # === Setup
 # Applications can use the setup block to perform any initialization.
 # The defaul +setup+ behaviour is to: read Puppet configuration and manage log level and destination
 #
 # === What and how to run
 # If the +dispatch+ block is defined it is called. This block should return the name of the registered command
 # to be run.
 # If it doesn't exist, it defaults to execute the +main+ command if defined.
 #
 # === Execution state
 # The class attributes/methods of Puppet::Application serve as a global place to set and query the execution
 # status of the application: stopping, restarting, etc.  The setting of the application status does not directly
 # aftect its running status; it's assumed that the various components within the application will consult these
 # settings appropriately and affect their own processing accordingly.  Control operations (signal handlers and
 # the like) should set the status appropriately to indicate to the overall system that it's the process of
 # stopping or restarting (or just running as usual).
 #
 # So, if something in your application needs to stop the process, for some reason, you might consider:
 #
 #  def stop_me!
 #      # indicate that we're stopping
 #      Puppet::Application.stop!
 #      # ...do stuff...
 #  end
 #
 # And, if you have some component that involves a long-running process, you might want to consider:
 #
 #  def my_long_process(giant_list_to_munge)
 #      giant_list_to_munge.collect do |member|
 #          # bail if we're stopping
 #          return if Puppet::Application.stop_requested?
 #          process_member(member)
 #      end
 #  end
 module Puppet
 class Application
   require 'puppet/util'
   include Puppet::Util
 
   DOCPATTERN = ::File.expand_path(::File.dirname(__FILE__) + "/util/command_line/*" )
 
   class << self
     include Puppet::Util
 
     attr_accessor :run_status
 
     def clear!
       self.run_status = nil
     end
 
     def stop!
       self.run_status = :stop_requested
     end
 
     def restart!
       self.run_status = :restart_requested
     end
 
     # Indicates that Puppet::Application.restart! has been invoked and components should
     # do what is necessary to facilitate a restart.
     def restart_requested?
       :restart_requested == run_status
     end
 
     # Indicates that Puppet::Application.stop! has been invoked and components should do what is necessary
     # for a clean stop.
     def stop_requested?
       :stop_requested == run_status
     end
 
     # Indicates that one of stop! or start! was invoked on Puppet::Application, and some kind of process
     # shutdown/short-circuit may be necessary.
     def interrupted?
       [:restart_requested, :stop_requested].include? run_status
     end
 
     # Indicates that Puppet::Application believes that it's in usual running run_mode (no stop/restart request
     # currently active).
     def clear?
       run_status.nil?
     end
 
     # Only executes the given block if the run status of Puppet::Application is clear (no restarts, stops,
     # etc. requested).
     # Upon block execution, checks the run status again; if a restart has been requested during the block's
     # execution, then controlled_run will send a new HUP signal to the current process.
     # Thus, long-running background processes can potentially finish their work before a restart.
     def controlled_run(&block)
       return unless clear?
       result = block.call
       Process.kill(:HUP, $PID) if restart_requested?
       result
     end
 
     def should_parse_config
       @parse_config = true
     end
 
     def should_not_parse_config
       @parse_config = false
     end
 
     def should_parse_config?
       @parse_config = true if ! defined?(@parse_config)
       @parse_config
     end
 
     # used to declare code that handle an option
     def option(*options, &block)
       long = options.find { |opt| opt =~ /^--/ }.gsub(/^--(?:\[no-\])?([^ =]+).*$/, '\1' ).gsub('-','_')
       fname = symbolize("handle_#{long}")
       if (block_given?)
         define_method(fname, &block)
       else
         define_method(fname) do |value|
           self.options["#{long}".to_sym] = value
         end
       end
       self.option_parser_commands << [options, fname]
     end
 
     def banner(banner = nil)
       @banner ||= banner
     end
 
     def option_parser_commands
       @option_parser_commands ||= (
         superclass.respond_to?(:option_parser_commands) ? superclass.option_parser_commands.dup : []
       )
       @option_parser_commands
     end
 
     def find(name)
       klass = name.to_s.capitalize
 
       begin
         require ::File.join('puppet', 'application', name.to_s.downcase)
       rescue LoadError => e
         puts "Unable to find application '#{name}'.  #{e}"
         Kernel::exit(1)
       end
 
       self.const_get(klass)
     end
 
     def [](name)
       find(name).new
     end
 
+    #
+    # TODO: look into changing this into two methods (getter/setter)
+    #  --cprice 2012-03-06
+    #
+
     # Sets or gets the run_mode name. Sets the run_mode name if a mode_name is
     # passed. Otherwise, gets the run_mode or a default run_mode
     #
     def run_mode( mode_name = nil)
       return @run_mode if @run_mode and not mode_name
 
       require 'puppet/util/run_mode'
       @run_mode = Puppet::Util::RunMode[ mode_name || :user ]
     end
   end
 
   attr_reader :options, :command_line
 
   # Every app responds to --version
   option("--version", "-V") do |arg|
     puts "#{Puppet.version}"
     exit
   end
 
   # Every app responds to --help
   option("--help", "-h") do |v|
     puts help
     exit
   end
 
   def should_parse_config?
     self.class.should_parse_config?
   end
 
   # override to execute code before running anything else
   def preinit
   end
 
   def initialize(command_line = nil)
 
     require 'puppet/util/command_line'
     @command_line = command_line || Puppet::Util::CommandLine.new
     set_run_mode self.class.run_mode
     @options = {}
 
     require 'puppet'
     require 'puppet/util/instrumentation'
     Puppet::Util::Instrumentation.init
   end
 
   # WARNING: This is a totally scary, frightening, and nasty internal API.  We
   # strongly advise that you do not use this, and if you insist, we will
   # politely allow you to keep both pieces of your broken code.
   #
   # We plan to provide a supported, long-term API to deliver this in a way
   # that you can use.  Please make sure that you let us know if you do require
   # this, and this message is still present in the code. --daniel 2011-02-03
   def set_run_mode(mode)
     @run_mode = mode
     $puppet_application_mode = @run_mode
     $puppet_application_name = name
 
+    # XXXXXXXXXXX TODO: this is crap.  need to refactor this so that applications have a hook to initialize
+    #  the settings that are specific to them; need to decide whether to formally specify the list of such
+    #  settings, or just allow them to run willy-nilly.
+    if (mode.name == :master)
+      Puppet.settings.set_value(:facts_terminus, "yaml", :mutable_defaults)
+    end
+
+
+    ## TODO: get rid of this whole block, push it to some kind of application-specific hook or something
+
     if Puppet.respond_to? :settings
       # This is to reduce the amount of confusion in rspec
       # because it might have loaded defaults.rb before the globals were set
       # and thus have the wrong defaults for the current application
       Puppet.settings.set_value(:confdir, Puppet.run_mode.conf_dir, :mutable_defaults)
       Puppet.settings.set_value(:vardir, Puppet.run_mode.var_dir, :mutable_defaults)
       Puppet.settings.set_value(:name, Puppet.application_name.to_s, :mutable_defaults)
-      Puppet.settings.set_value(:logdir, Puppet.run_mode.logopts, :mutable_defaults)
+      #Puppet.settings.set_value(:logdir, Puppet.run_mode.logopts, :mutable_defaults)
       Puppet.settings.set_value(:rundir, Puppet.run_mode.run_dir, :mutable_defaults)
       Puppet.settings.set_value(:run_mode, Puppet.run_mode.name.to_s, :mutable_defaults)
     end
   end
 
   # This is the main application entry point
   def run
     exit_on_fail("initialize")                                   { hook('preinit')       { preinit } }
     exit_on_fail("parse options")                                { hook('parse_options') { parse_options } }
     exit_on_fail("parse configuration file")                     { Puppet.settings.parse } if should_parse_config?
     exit_on_fail("prepare for execution")                        { hook('setup')         { setup } }
     exit_on_fail("configure routes from #{Puppet[:route_file]}") { configure_indirector_routes }
     exit_on_fail("run")                                          { hook('run_command')   { run_command } }
   end
 
   def main
     raise NotImplementedError, "No valid command or main"
   end
 
   def run_command
     main
   end
 
   def setup
     setup_logs
   end
 
   def setup_logs
     if options[:debug] or options[:verbose]
       Puppet::Util::Log.newdestination(:console)
       if options[:debug]
         Puppet::Util::Log.level = :debug
       else
         Puppet::Util::Log.level = :info
       end
     end
 
     Puppet::Util::Log.setup_default unless options[:setdest]
   end
 
   def configure_indirector_routes
     route_file = Puppet[:route_file]
     if ::File.exists?(route_file)
       routes = YAML.load_file(route_file)
       application_routes = routes[name.to_s]
       Puppet::Indirector.configure_routes(application_routes) if application_routes
     end
   end
 
   def parse_options
     # Create an option parser
     option_parser = OptionParser.new(self.class.banner)
 
     # Add all global options to it.
     Puppet.settings.optparse_addargs([]).each do |option|
       option_parser.on(*option) do |arg|
         handlearg(option[0], arg)
       end
     end
 
     # Add options that are local to this application, which were
     # created using the "option()" metaprogramming method.  If there
     # are any conflicts, this application's options will be favored.
     self.class.option_parser_commands.each do |options, fname|
       option_parser.on(*options) do |value|
         # Call the method that "option()" created.
         self.send(fname, value)
       end
     end
 
     # Scan command line.  We just hand any exceptions to our upper levels,
     # rather than printing help and exiting, so that we can meaningfully
     # respond with context-sensitive help if we want to. --daniel 2011-04-12
     option_parser.parse!(self.command_line.args)
   end
 
   def handlearg(opt, arg)
     # rewrite --[no-]option to --no-option if that's what was given
     if opt =~ /\[no-\]/ and !arg
       opt = opt.gsub(/\[no-\]/,'no-')
     end
     # otherwise remove the [no-] prefix to not confuse everybody
     opt = opt.gsub(/\[no-\]/, '')
     unless respond_to?(:handle_unknown) and send(:handle_unknown, opt, arg)
       # Puppet.settings.handlearg doesn't handle direct true/false :-)
       if arg.is_a?(FalseClass)
         arg = "false"
       elsif arg.is_a?(TrueClass)
         arg = "true"
       end
       Puppet.settings.handlearg(opt, arg)
     end
   end
 
   # this is used for testing
   def self.exit(code)
     exit(code)
   end
 
   def name
     self.class.to_s.sub(/.*::/,"").downcase.to_sym
   end
 
   def help
     "No help available for puppet #{name}"
   end
 
   private
 
   def exit_on_fail(message, code = 1)
     yield
   rescue ArgumentError, RuntimeError, NotImplementedError => detail
     Puppet.log_exception(detail, "Could not #{message}: #{detail}")
     exit(code)
   end
 
   def hook(step,&block)
     Puppet::Plugins.send("before_application_#{step}",:application_object => self)
     x = yield
     Puppet::Plugins.send("after_application_#{step}",:application_object => self, :return_value => x)
     x
   end
 end
 end
diff --git a/lib/puppet/defaults.rb b/lib/puppet/defaults.rb
index 7025fc21f..e8c4ddf16 100644
--- a/lib/puppet/defaults.rb
+++ b/lib/puppet/defaults.rb
@@ -1,953 +1,961 @@
+# !!!! TODO: get rid of all run_mode/application_name calls in here...
+
 # The majority of Puppet's configuration settings are set in this file.
 module Puppet
+
+  # TODO: get rid of all Puppet.run_mode and Puppet.application_name from this file.
+
   setdefaults(:main,
     :confdir => [Puppet.run_mode.conf_dir, "The main Puppet configuration directory.  The default for this setting is calculated based on the user.  If the process
     is running as root or the user that Puppet is supposed to run as, it defaults to a system directory, but if it's running as any other user,
     it defaults to being in the user's home directory."],
     :vardir => [Puppet.run_mode.var_dir, "Where Puppet stores dynamic and growing data.  The default for this setting is calculated specially, like `confdir`_."],
-    :name => [Puppet.application_name.to_s, "The name of the application, if we are running as one.  The
+  ### TODO: introduce a constant for this...
+    :name => ['apply', "The name of the application, if we are running as one.  The
       default is essentially $0 without the path or `.rb`."],
     :run_mode => [Puppet.run_mode.name.to_s, "The effective 'run mode' of the application: master, agent, or user."]
   )
 
   setdefaults(:main, :logdir => Puppet.run_mode.logopts)
 
   setdefaults(:main,
     :trace => [false, "Whether to print stack traces on some errors"],
     :autoflush => {
       :default => false,
       :desc    => "Whether log files should always flush to disk.",
       :hook    => proc { |value| Log.autoflush = value }
     },
     :syslogfacility => ["daemon", "What syslog facility to use when logging to
       syslog.  Syslog has a fixed list of valid facilities, and you must
       choose one of those; you cannot just make one up."],
     :statedir => { :default => "$vardir/state",
       :mode => 01755,
       :desc => "The directory where Puppet state is stored.  Generally,
         this directory can be removed without causing harm (although it
         might result in spurious service restarts)."
     },
     :rundir => {
       :default => Puppet.run_mode.run_dir,
       :mode => 01777,
       :desc => "Where Puppet PID files are kept."
     },
     :genconfig => [false,
       "Whether to just print a configuration to stdout and exit.  Only makes
       sense when used interactively.  Takes into account arguments specified
       on the CLI."],
     :genmanifest => [false,
       "Whether to just print a manifest to stdout and exit.  Only makes
       sense when used interactively.  Takes into account arguments specified
       on the CLI."],
     :configprint => ["",
       "Print the value of a specific configuration setting.  If the name of a
       setting is provided for this, then the value is printed and puppet
       exits.  Comma-separate multiple values.  For a list of all values,
       specify 'all'."],
     :color => {
       :default => (Puppet.features.microsoft_windows? ? "false" : "ansi"),
       :type    => :setting,
       :desc    => "Whether to use colors when logging to the console.  Valid values are
       `ansi` (equivalent to `true`), `html`, and `false`, which produces no color.
       Defaults to false on Windows, as its console does not support ansi colors.",
     },
     :mkusers => [false,
       "Whether to create the necessary user and group that puppet agent will
       run as."],
     :manage_internal_file_permissions => [true,
       "Whether Puppet should manage the owner, group, and mode of files
       it uses internally"
       ],
     :onetime => {:default => false,
       :desc => "Run the configuration once, rather than as a long-running
       daemon. This is useful for interactively running puppetd.",
       :short => 'o'
       },
     :path => {:default => "none",
       :desc => "The shell search path.  Defaults to whatever is inherited
         from the parent process.",
       :call_on_define => true, # Call our hook with the default value, so we always get the libdir set.
       :hook => proc do |value|
         ENV["PATH"] = "" if ENV["PATH"].nil?
         ENV["PATH"] = value unless value == "none"
         paths = ENV["PATH"].split(File::PATH_SEPARATOR)
         %w{/usr/sbin /sbin}.each do |path|
           ENV["PATH"] += File::PATH_SEPARATOR + path unless paths.include?(path)
         end
         value
       end
     },
     :libdir => {:default => "$vardir/lib",
       :desc => "An extra search path for Puppet.  This is only useful
         for those files that Puppet will load on demand, and is only
         guaranteed to work for those cases.  In fact, the autoload
         mechanism is responsible for making sure this directory
         is in Ruby's search path",
       :call_on_define => true, # Call our hook with the default value, so we always get the libdir set.
       :hook => proc do |value|
         $LOAD_PATH.delete(@oldlibdir) if defined?(@oldlibdir) and $LOAD_PATH.include?(@oldlibdir)
         @oldlibdir = value
         $LOAD_PATH << value
       end
     },
     :ignoreimport => [false, "If true, allows the parser to continue without requiring
       all files referenced with `import` statements to exist. This setting was primarily
       designed for use with commit hooks for parse-checking."],
     :authconfig => [ "$confdir/namespaceauth.conf",
       "The configuration file that defines the rights to the different
       namespaces and methods.  This can be used as a coarse-grained
       authorization system for both `puppet agent` and `puppet master`."
     ],
     :environment => {:default => "production", :desc => "The environment Puppet is running in.  For clients
       (e.g., `puppet agent`) this determines the environment itself, which
       is used to find modules and much more.  For servers (i.e., `puppet master`) this provides the default environment for nodes
       we know nothing about."
     },
     :diff_args => ["-u", "Which arguments to pass to the diff command when printing differences between
       files. The command to use can be chosen with the `diff` setting."],
     :diff => {
       :default => (Puppet.features.microsoft_windows? ? "" : "diff"),
       :desc    => "Which diff command to use when printing differences between files. This setting
         has no default value on Windows, as standard `diff` is not available, but Puppet can use many
         third-party diff tools.",
     },
     :show_diff => [false, "Whether to log and report a contextual diff when files are being replaced.  This causes
       partial file contents to pass through Puppet's normal logging and reporting system, so this setting should be
       used with caution if you are sending Puppet's reports to an insecure destination.
       This feature currently requires the `diff/lcs` Ruby library."],
     :daemonize => {
       :default => (Puppet.features.microsoft_windows? ? false : true),
       :desc => "Whether to send the process into the background.  This defaults to true on POSIX systems,
         and to false on Windows (where Puppet currently cannot daemonize).",
       :short => "D",
       :hook => proc do |value|
         if value and Puppet.features.microsoft_windows?
           raise "Cannot daemonize on Windows"
         end
       end
     },
     :maximum_uid => [4294967290, "The maximum allowed UID.  Some platforms use negative UIDs
       but then ship with tools that do not know how to handle signed ints, so the UIDs show up as
       huge numbers that can then not be fed back into the system.  This is a hackish way to fail in a
       slightly more useful way when that happens."],
     :route_file => ["$confdir/routes.yaml", "The YAML file containing indirector route configuration."],
     :node_terminus => ["plain", "Where to find information about nodes."],
     :catalog_terminus => ["compiler", "Where to get node catalogs.  This is useful to change if, for instance,
       you'd like to pre-compile catalogs and store them in memcached or some other easily-accessed store."],
     :facts_terminus => {
+      ### TODO: re-wire the master to override this to yaml
       :default => Puppet.application_name.to_s == "master" ? 'yaml' : 'facter',
+      #:default => 'facter',
       :desc => "The node facts terminus.",
       :hook => proc do |value|
         require 'puppet/node/facts'
         # Cache to YAML if we're uploading facts away
         if %w[rest inventory_service].include? value.to_s
           Puppet::Node::Facts.indirection.cache_class = :yaml
         end
       end
     },
     :inventory_terminus => [ "$facts_terminus", "Should usually be the same as the facts terminus" ],
     :httplog => { :default => "$logdir/http.log",
       :owner => "root",
       :mode => 0640,
       :desc => "Where the puppet agent web server logs."
     },
     :http_proxy_host => ["none",
       "The HTTP proxy host to use for outgoing connections.  Note: You
       may need to use a FQDN for the server hostname when using a proxy."],
     :http_proxy_port => [3128, "The HTTP proxy port to use for outgoing connections"],
     :filetimeout => [ 15,
       "The minimum time to wait (in seconds) between checking for updates in
       configuration files.  This timeout determines how quickly Puppet checks whether
       a file (such as manifests or templates) has changed on disk."
     ],
     :queue_type => ["stomp", "Which type of queue to use for asynchronous processing."],
     :queue_type => ["stomp", "Which type of queue to use for asynchronous processing."],
     :queue_source => ["stomp://localhost:61613/", "Which type of queue to use for asynchronous processing.  If your stomp server requires
       authentication, you can include it in the URI as long as your stomp client library is at least 1.1.1"],
     :async_storeconfigs => {:default => false, :desc => "Whether to use a queueing system to provide asynchronous database integration.
       Requires that `puppetqd` be running and that 'PSON' support for ruby be installed.",
       :hook => proc do |value|
         if value
           # This reconfigures the terminii for Node, Facts, and Catalog
           Puppet.settings[:storeconfigs] = true
 
           # But then we modify the configuration
           Puppet::Resource::Catalog.indirection.cache_class = :queue
         else
           raise "Cannot disable asynchronous storeconfigs in a running process"
         end
       end
     },
     :thin_storeconfigs => {:default => false, :desc =>
       "Boolean; whether storeconfigs store in the database only the facts and exported resources.
       If true, then storeconfigs performance will be higher and still allow exported/collected
       resources, but other usage external to Puppet might not work",
       :hook => proc do |value|
         Puppet.settings[:storeconfigs] = true if value
         end
       },
     :config_version => ["", "How to determine the configuration version.  By default, it will be the
       time that the configuration is parsed, but you can provide a shell script to override how the
       version is determined.  The output of this script will be added to every log message in the
       reports, allowing you to correlate changes on your hosts to the source version on the server."],
     :zlib => [true,
       "Boolean; whether to use the zlib library",
     ],
     :prerun_command => ["", "A command to run before every agent run.  If this command returns a non-zero
       return code, the entire Puppet run will fail."],
     :postrun_command => ["", "A command to run after every agent run.  If this command returns a non-zero
       return code, the entire Puppet run will be considered to have failed, even though it might have
       performed work during the normal run."],
     :freeze_main => [false, "Freezes the 'main' class, disallowing any code to be added to it.  This
       essentially means that you can't have any code outside of a node, class, or definition other
       than in the site manifest."]
   )
   Puppet.setdefaults(:module_tool,
     :module_repository  => ['http://forge.puppetlabs.com', "The module repository"],
     :module_working_dir => ['$vardir/puppet-module', "The directory into which module tool data is stored"]
   )
 
   hostname = Facter["hostname"].value
   domain = Facter["domain"].value
   if domain and domain != ""
     fqdn = [hostname, domain].join(".")
   else
     fqdn = hostname
   end
 
 
     Puppet.setdefaults(
     :main,
 
     # We have to downcase the fqdn, because the current ssl stuff (as oppsed to in master) doesn't have good facilities for
     # manipulating naming.
     :certname => {:default => fqdn.downcase, :desc => "The name to use when handling certificates.  Defaults
       to the fully qualified domain name.",
       :call_on_define => true, # Call our hook with the default value, so we're always downcased
       :hook => proc { |value| raise(ArgumentError, "Certificate names must be lower case; see #1168") unless value == value.downcase }},
     :certdnsnames => {
       :default => '',
       :hook    => proc do |value|
         unless value.nil? or value == '' then
           Puppet.warning <<WARN
 The `certdnsnames` setting is no longer functional,
 after CVE-2011-3872. We ignore the value completely.
 
 For your own certificate request you can set `dns_alt_names` in the
 configuration and it will apply locally.  There is no configuration option to
 set DNS alt names, or any other `subjectAltName` value, for another nodes
 certificate.
 
 Alternately you can use the `--dns_alt_names` command line option to set the
 labels added while generating your own CSR.
 WARN
         end
       end,
       :desc    => <<EOT
 The `certdnsnames` setting is no longer functional,
 after CVE-2011-3872. We ignore the value completely.
 
 For your own certificate request you can set `dns_alt_names` in the
 configuration and it will apply locally.  There is no configuration option to
 set DNS alt names, or any other `subjectAltName` value, for another nodes
 certificate.
 
 Alternately you can use the `--dns_alt_names` command line option to set the
 labels added while generating your own CSR.
 EOT
     },
     :dns_alt_names => {
       :default => '',
       :desc    => <<EOT,
 The comma-separated list of alternative DNS names to use for the local host.
 
 When the node generates a CSR for itself, these are added to the request
 as the desired `subjectAltName` in the certificate: additional DNS labels
 that the certificate is also valid answering as.
 
 This is generally required if you use a non-hostname `certname`, or if you
 want to use `puppet kick` or `puppet resource -H` and the primary certname
 does not match the DNS name you use to communicate with the host.
 
 This is unnecessary for agents, unless you intend to use them as a server for
 `puppet kick` or remote `puppet resource` management.
 
 It is rarely necessary for servers; it is usually helpful only if you need to
 have a pool of multiple load balanced masters, or for the same master to
 respond on two physically separate networks under different names.
 EOT
     },
     :certdir => {
       :default => "$ssldir/certs",
       :owner => "service",
       :desc => "The certificate directory."
     },
     :ssldir => {
       :default => "$confdir/ssl",
       :mode => 0771,
       :owner => "service",
       :desc => "Where SSL certificates are kept."
     },
     :publickeydir => {
       :default => "$ssldir/public_keys",
       :owner => "service",
       :desc => "The public key directory."
     },
     :requestdir => {
       :default => "$ssldir/certificate_requests",
       :owner => "service",
       :desc => "Where host certificate requests are stored."
     },
     :privatekeydir => { :default => "$ssldir/private_keys",
       :mode => 0750,
       :owner => "service",
       :desc => "The private key directory."
     },
     :privatedir => { :default => "$ssldir/private",
       :mode => 0750,
       :owner => "service",
       :desc => "Where the client stores private certificate information."
     },
     :passfile => { :default => "$privatedir/password",
       :mode => 0640,
       :owner => "service",
       :desc => "Where puppet agent stores the password for its private key.
         Generally unused."
     },
     :hostcsr => { :default => "$ssldir/csr_$certname.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where individual hosts store and look for their certificate requests."
     },
     :hostcert => { :default => "$certdir/$certname.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where individual hosts store and look for their certificates."
     },
     :hostprivkey => { :default => "$privatekeydir/$certname.pem",
       :mode => 0600,
       :owner => "service",
       :desc => "Where individual hosts store and look for their private key."
     },
     :hostpubkey => { :default => "$publickeydir/$certname.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where individual hosts store and look for their public key."
     },
     :localcacert => { :default => "$certdir/ca.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where each client stores the CA certificate."
     },
     :hostcrl => { :default => "$ssldir/crl.pem",
       :mode => 0644,
       :owner => "service",
       :desc => "Where the host's certificate revocation list can be found.
         This is distinct from the certificate authority's CRL."
     },
     :certificate_revocation => [true, "Whether certificate revocation should be supported by downloading a Certificate Revocation List (CRL)
       to all clients.  If enabled, CA chaining will almost definitely not work."]
   )
 
     setdefaults(
     :ca,
     :ca_name => ["Puppet CA: $certname", "The name to use the Certificate Authority certificate."],
     :cadir => {  :default => "$ssldir/ca",
       :owner => "service",
       :group => "service",
       :mode => 0770,
       :desc => "The root directory for the certificate authority."
     },
     :cacert => { :default => "$cadir/ca_crt.pem",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "The CA certificate."
     },
     :cakey => { :default => "$cadir/ca_key.pem",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "The CA private key."
     },
     :capub => { :default => "$cadir/ca_pub.pem",
       :owner => "service",
       :group => "service",
       :desc => "The CA public key."
     },
     :cacrl => { :default => "$cadir/ca_crl.pem",
       :owner => "service",
       :group => "service",
       :mode => 0664,
 
       :desc => "The certificate revocation list (CRL) for the CA. Will be used if present but otherwise ignored.",
       :hook => proc do |value|
         if value == 'false'
           Puppet.deprecation_warning "Setting the :cacrl to 'false' is deprecated; Puppet will just ignore the crl if yours is missing"
         end
       end
     },
     :caprivatedir => { :default => "$cadir/private",
       :owner => "service",
       :group => "service",
       :mode => 0770,
       :desc => "Where the CA stores private certificate information."
     },
     :csrdir => { :default => "$cadir/requests",
       :owner => "service",
       :group => "service",
       :desc => "Where the CA stores certificate requests"
     },
     :signeddir => { :default => "$cadir/signed",
       :owner => "service",
       :group => "service",
       :mode => 0770,
       :desc => "Where the CA stores signed certificates."
     },
     :capass => { :default => "$caprivatedir/ca.pass",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "Where the CA stores the password for the private key"
     },
     :serial => { :default => "$cadir/serial",
       :owner => "service",
       :group => "service",
       :mode => 0644,
       :desc => "Where the serial number for certificates is stored."
     },
     :autosign => { :default => "$confdir/autosign.conf",
       :mode => 0644,
       :desc => "Whether to enable autosign.  Valid values are true (which
         autosigns any key request, and is a very bad idea), false (which
         never autosigns any key request), and the path to a file, which
         uses that configuration file to determine which keys to sign."},
     :allow_duplicate_certs => [false, "Whether to allow a new certificate
       request to overwrite an existing certificate."],
     :ca_days => ["", "How long a certificate should be valid, in days.
       This setting is deprecated; use `ca_ttl` instead"],
     :ca_ttl => ["5y", "The default TTL for new certificates; valid values
       must be an integer, optionally followed by one of the units
       'y' (years of 365 days), 'd' (days), 'h' (hours), or
       's' (seconds). The unit defaults to seconds. If this setting
       is set, ca_days is ignored. Examples are '3600' (one hour)
       and '1825d', which is the same as '5y' (5 years) "],
     :ca_md => ["md5", "The type of hash used in certificates."],
     :req_bits => [4096, "The bit length of the certificates."],
     :keylength => [4096, "The bit length of keys."],
     :cert_inventory => {
       :default => "$cadir/inventory.txt",
       :mode => 0644,
       :owner => "service",
       :group => "service",
       :desc => "A Complete listing of all certificates"
     }
   )
 
   # Define the config default.
 
     setdefaults(
     Puppet.settings[:name],
     :config => ["$confdir/puppet.conf",
       "The configuration file for #{Puppet[:name]}."],
     :pidfile => ["$rundir/$name.pid", "The pid file"],
     :bindaddress => ["", "The address a listening server should bind to.  Mongrel servers
       default to 127.0.0.1 and WEBrick defaults to 0.0.0.0."],
     :servertype => {:default => "webrick", :desc => "The type of server to use.  Currently supported
       options are webrick and mongrel.  If you use mongrel, you will need
       a proxy in front of the process or processes, since Mongrel cannot
       speak SSL.",
 
       :call_on_define => true, # Call our hook with the default value, so we always get the correct bind address set.
       :hook => proc { |value|  value == "webrick" ? Puppet.settings[:bindaddress] = "0.0.0.0" : Puppet.settings[:bindaddress] = "127.0.0.1" if Puppet.settings[:bindaddress] == "" }
     }
   )
 
   setdefaults(:master,
     :user => ["puppet", "The user puppet master should run as."],
     :group => ["puppet", "The group puppet master should run as."],
     :manifestdir => ["$confdir/manifests", "Where puppet master looks for its manifests."],
     :manifest => ["$manifestdir/site.pp", "The entry-point manifest for puppet master."],
     :code => ["", "Code to parse directly.  This is essentially only used
       by `puppet`, and should only be set if you're writing your own Puppet
       executable"],
     :masterlog => { :default => "$logdir/puppetmaster.log",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :desc => "Where puppet master logs.  This is generally not used,
         since syslog is the default log destination."
     },
     :masterhttplog => { :default => "$logdir/masterhttp.log",
       :owner => "service",
       :group => "service",
       :mode => 0660,
       :create => true,
       :desc => "Where the puppet master web server logs."
     },
     :masterport => [8140, "Which port puppet master listens on."],
     :node_name => ["cert", "How the puppet master determines the client's identity
       and sets the 'hostname', 'fqdn' and 'domain' facts for use in the manifest,
       in particular for determining which 'node' statement applies to the client.
       Possible values are 'cert' (use the subject's CN in the client's
       certificate) and 'facter' (use the hostname that the client
       reported in its facts)"],
     :bucketdir => {
       :default => "$vardir/bucket",
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "Where FileBucket files are stored."
     },
     :rest_authconfig => [ "$confdir/auth.conf",
       "The configuration file that defines the rights to the different
       rest indirections.  This can be used as a fine-grained
       authorization system for `puppet master`."
     ],
     :ca => [true, "Wether the master should function as a certificate authority."],
     :modulepath => {
       :default => "$confdir/modules#{File::PATH_SEPARATOR}/usr/share/puppet/modules",
       :desc => "The search path for modules, as a list of directories separated by the system path separator character. (The POSIX path separator is ':', and the Windows path separator is ';'.)",
       :type => :setting # We don't want this to be considered a file, since it's multiple files.
     },
     :ssl_client_header => ["HTTP_X_CLIENT_DN", "The header containing an authenticated
       client's SSL DN.  Only used with Mongrel.  This header must be set by the proxy
       to the authenticated client's SSL DN (e.g., `/CN=puppet.puppetlabs.com`).
       See http://projects.puppetlabs.com/projects/puppet/wiki/Using_Mongrel for more information."],
     :ssl_client_verify_header => ["HTTP_X_CLIENT_VERIFY", "The header containing the status
       message of the client verification. Only used with Mongrel.  This header must be set by the proxy
       to 'SUCCESS' if the client successfully authenticated, and anything else otherwise.
       See http://projects.puppetlabs.com/projects/puppet/wiki/Using_Mongrel for more information."],
     # To make sure this directory is created before we try to use it on the server, we need
     # it to be in the server section (#1138).
     :yamldir => {:default => "$vardir/yaml", :owner => "service", :group => "service", :mode => "750",
       :desc => "The directory in which YAML data is stored, usually in a subdirectory."},
     :server_datadir => {:default => "$vardir/server_data", :owner => "service", :group => "service", :mode => "750",
       :desc => "The directory in which serialized data is stored, usually in a subdirectory."},
     :reports => ["store",
       "The list of reports to generate.  All reports are looked for
       in `puppet/reports/name.rb`, and multiple report names should be
       comma-separated (whitespace is okay)."
     ],
     :reportdir => {:default => "$vardir/reports",
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "The directory in which to store reports
         received from the client.  Each client gets a separate
         subdirectory."},
     :reporturl => ["http://localhost:3000/reports/upload",
       "The URL used by the http reports processor to send reports"],
     :fileserverconfig => ["$confdir/fileserver.conf", "Where the fileserver configuration is stored."],
     :strict_hostname_checking => [false, "Whether to only search for the complete
       hostname as it is in the certificate when searching for node information
       in the catalogs."]
   )
 
   setdefaults(:metrics,
     :rrddir => {:default => "$vardir/rrd",
       :mode => 0750,
       :owner => "service",
       :group => "service",
       :desc => "The directory where RRD database files are stored.
         Directories for each reporting host will be created under
         this directory."
     },
     :rrdinterval => ["$runinterval", "How often RRD should expect data.
       This should match how often the hosts report back to the server."]
   )
 
   setdefaults(:device,
     :devicedir =>  {:default => "$vardir/devices", :mode => "750", :desc => "The root directory of devices' $vardir"},
     :deviceconfig => ["$confdir/device.conf","Path to the device config file for puppet device"]
   )
 
   setdefaults(:agent,
     :node_name_value => { :default => "$certname",
       :desc => "The explicit value used for the node name for all requests the agent
         makes to the master. WARNING: This setting is mutually exclusive with
         node_name_fact.  Changing this setting also requires changes to the default
         auth.conf configuration on the Puppet Master.  Please see
         http://links.puppetlabs.com/node_name_value for more information."
     },
     :node_name_fact => { :default => "",
       :desc => "The fact name used to determine the node name used for all requests the agent
         makes to the master. WARNING: This setting is mutually exclusive with
         node_name_value.  Changing this setting also requires changes to the default
         auth.conf configuration on the Puppet Master.  Please see
         http://links.puppetlabs.com/node_name_fact for more information.",
       :hook => proc do |value|
         if !value.empty? and Puppet[:node_name_value] != Puppet[:certname]
           raise "Cannot specify both the node_name_value and node_name_fact settings"
         end
       end
     },
     :localconfig => { :default => "$statedir/localconfig",
       :owner => "root",
       :mode => 0660,
       :desc => "Where puppet agent caches the local configuration.  An
         extension indicating the cache format is added automatically."},
     :statefile => { :default => "$statedir/state.yaml",
       :mode => 0660,
       :desc => "Where puppet agent and puppet master store state associated
         with the running configuration.  In the case of puppet master,
         this file reflects the state discovered through interacting
         with clients."
       },
     :clientyamldir => {:default => "$vardir/client_yaml", :mode => "750", :desc => "The directory in which client-side YAML data is stored."},
     :client_datadir => {:default => "$vardir/client_data", :mode => "750", :desc => "The directory in which serialized data is stored on the client."},
     :classfile => { :default => "$statedir/classes.txt",
       :owner => "root",
       :mode => 0644,
       :desc => "The file in which puppet agent stores a list of the classes
         associated with the retrieved configuration.  Can be loaded in
         the separate `puppet` executable using the `--loadclasses`
         option."},
     :resourcefile => { :default => "$statedir/resources.txt",
       :owner => "root",
       :mode => 0644,
       :desc => "The file in which puppet agent stores a list of the resources
         associated with the retrieved configuration."  },
     :puppetdlog => { :default => "$logdir/puppetd.log",
       :owner => "root",
       :mode => 0640,
       :desc => "The log file for puppet agent.  This is generally not used."
     },
     :server => {
       :default => "puppet",
       :desc => "The server to which the puppet agent should connect"
     },
     :use_srv_records => [true, "Whether the server will search for SRV records in DNS for the current domain."],
     :srv_domain => [ "#{domain}", "The domain which will be queried to find the SRV records of servers to use."],
     :ignoreschedules => [false,
       "Boolean; whether puppet agent should ignore schedules.  This is useful
       for initial puppet agent runs."],
     :puppetport => [8139, "Which port puppet agent listens on."],
     :noop => [false, "Whether puppet agent should be run in noop mode."],
     :runinterval => [1800, # 30 minutes
       "How often puppet agent applies the client configuration; in seconds.
       Note that a runinterval of 0 means \"run continuously\" rather than
       \"never run.\" If you want puppet agent to never run, you should start
       it with the `--no-client` option."],
     :listen => [false, "Whether puppet agent should listen for
       connections.  If this is true, then puppet agent will accept incoming
       REST API requests, subject to the default ACLs and the ACLs set in
       the `rest_authconfig` file. Puppet agent can respond usefully to
       requests on the `run`, `facts`, `certificate`, and `resource` endpoints."],
     :ca_server => ["$server", "The server to use for certificate
       authority requests.  It's a separate server because it cannot
       and does not need to horizontally scale."],
     :ca_port => ["$masterport", "The port to use for the certificate authority."],
     :catalog_format => {
       :default => "",
       :desc => "(Deprecated for 'preferred_serialization_format') What format to
         use to dump the catalog.  Only supports 'marshal' and 'yaml'.  Only
         matters on the client, since it asks the server for a specific format.",
       :hook => proc { |value|
         if value
           Puppet.deprecation_warning "Setting 'catalog_format' is deprecated; use 'preferred_serialization_format' instead."
           Puppet.settings[:preferred_serialization_format] = value
         end
       }
     },
     :preferred_serialization_format => ["pson", "The preferred means of serializing
       ruby instances for passing over the wire.  This won't guarantee that all
       instances will be serialized using this method, since not all classes
       can be guaranteed to support this format, but it will be used for all
       classes that support it."],
     :puppetdlockfile => [ "$statedir/puppetdlock", "A lock file to temporarily stop puppet agent from doing anything."],
     :usecacheonfailure => [true,
       "Whether to use the cached configuration when the remote
       configuration will not compile.  This option is useful for testing
       new configurations, where you want to fix the broken configuration
       rather than reverting to a known-good one."
     ],
     :use_cached_catalog => [false,
       "Whether to only use the cached catalog rather than compiling a new catalog
       on every run.  Puppet can be run with this enabled by default and then selectively
       disabled when a recompile is desired."],
     :ignorecache => [false,
       "Ignore cache and always recompile the configuration.  This is
       useful for testing new configurations, where the local cache may in
       fact be stale even if the timestamps are up to date - if the facts
       change or if the server changes."
     ],
     :downcasefacts => [false, "Whether facts should be made all lowercase when sent to the server."],
     :dynamicfacts => ["memorysize,memoryfree,swapsize,swapfree",
       "Facts that are dynamic; these facts will be ignored when deciding whether
       changed facts should result in a recompile.  Multiple facts should be
       comma-separated."],
     :splaylimit => ["$runinterval",
       "The maximum time to delay before runs.  Defaults to being the same as the
       run interval."],
     :splay => [false,
       "Whether to sleep for a pseudo-random (but consistent) amount of time before
       a run."],
     :clientbucketdir => {
       :default => "$vardir/clientbucket",
       :mode => 0750,
       :desc => "Where FileBucket files are stored locally."
     },
     :configtimeout => [120,
       "How long the client should wait for the configuration to be retrieved
       before considering it a failure.  This can help reduce flapping if too
       many clients contact the server at one time."
     ],
     :reportserver => {
       :default => "$server",
       :call_on_define => false,
       :desc => "(Deprecated for 'report_server') The server to which to send transaction reports.",
       :hook => proc do |value|
         Puppet.settings[:report_server] = value if value
       end
     },
     :report_server => ["$server",
       "The server to send transaction reports to."
     ],
     :report_port => ["$masterport",
       "The port to communicate with the report_server."
     ],
     :inventory_server => ["$server",
       "The server to send facts to."
     ],
     :inventory_port => ["$masterport",
       "The port to communicate with the inventory_server."
     ],
     :report => [true,
       "Whether to send reports after every transaction."
     ],
     :lastrunfile =>  { :default => "$statedir/last_run_summary.yaml",
       :mode => 0644,
       :desc => "Where puppet agent stores the last run report summary in yaml format."
     },
     :lastrunreport =>  { :default => "$statedir/last_run_report.yaml",
       :mode => 0644,
       :desc => "Where puppet agent stores the last run report in yaml format."
     },
     :graph => [false, "Whether to create dot graph files for the different
       configuration graphs.  These dot files can be interpreted by tools
       like OmniGraffle or dot (which is part of ImageMagick)."],
     :graphdir => ["$statedir/graphs", "Where to store dot-outputted graphs."],
     :http_compression => [false, "Allow http compression in REST communication with the master.
       This setting might improve performance for agent -> master communications over slow WANs.
       Your puppet master needs to support compression (usually by activating some settings in a reverse-proxy
       in front of the puppet master, which rules out webrick).
       It is harmless to activate this settings if your master doesn't support
       compression, but if it supports it, this setting might reduce performance on high-speed LANs."],
     :waitforcert => [120, # 2 minutes
       "The time interval, specified in seconds, 'puppet agent' should connect to the server
       and ask it to sign a certificate request. This is useful for the initial setup of a
       puppet client. You can turn off waiting for certificates by specifying a time of 0."
     ]
   )
 
   setdefaults(:inspect,
       :archive_files => [false, "During an inspect run, whether to archive files whose contents are audited to a file bucket."],
       :archive_file_server => ["$server", "During an inspect run, the file bucket server to archive files to if archive_files is set."]
   )
 
   # Plugin information.
 
     setdefaults(
     :main,
     :plugindest => ["$libdir",
       "Where Puppet should store plugins that it pulls down from the central
       server."],
     :pluginsource => ["puppet://$server/plugins",
       "From where to retrieve plugins.  The standard Puppet `file` type
       is used for retrieval, so anything that is a valid file source can
       be used here."],
     :pluginsync => [true, "Whether plugins should be synced with the central server."],
 
     :pluginsignore => [".svn CVS .git", "What files to ignore when pulling down plugins."]
   )
 
   # Central fact information.
 
     setdefaults(
     :main,
     :factpath => {:default => "$vardir/lib/facter#{File::PATH_SEPARATOR}$vardir/facts",
       :desc => "Where Puppet should look for facts.  Multiple directories should
         be separated by the system path separator character. (The POSIX path separator is ':', and the Windows path separator is ';'.)",
 
       :call_on_define => true, # Call our hook with the default value, so we always get the value added to facter.
       :type => :setting, # Don't consider it a file, because it could be multiple colon-separated files
       :hook => proc { |value| Facter.search(value) if Facter.respond_to?(:search) }}
   )
 
 
     setdefaults(
     :tagmail,
     :tagmap => ["$confdir/tagmail.conf", "The mapping between reporting tags and email addresses."],
     :sendmail => [which('sendmail') || '', "Where to find the sendmail binary with which to send email."],
 
     :reportfrom => ["report@" + [Facter["hostname"].value, Facter["domain"].value].join("."), "The 'from' email address for the reports."],
     :smtpserver => ["none", "The server through which to send email reports."]
   )
 
     setdefaults(
     :rails,
     :dblocation => { :default => "$statedir/clientconfigs.sqlite3",
       :mode => 0660,
       :owner => "service",
       :group => "service",
       :desc => "The database cache for client configurations.  Used for
         querying within the language."
     },
     :dbadapter => [ "sqlite3", "The type of database to use." ],
     :dbmigrate => [ false, "Whether to automatically migrate the database." ],
     :dbname => [ "puppet", "The name of the database to use." ],
     :dbserver => [ "localhost", "The database server for caching. Only
       used when networked databases are used."],
     :dbport => [ "", "The database password for caching. Only
       used when networked databases are used."],
     :dbuser => [ "puppet", "The database user for caching. Only
       used when networked databases are used."],
     :dbpassword => [ "puppet", "The database password for caching. Only
       used when networked databases are used."],
     :dbconnections => [ '', "The number of database connections for networked
       databases.  Will be ignored unless the value is a positive integer."],
     :dbsocket => [ "", "The database socket location. Only used when networked
       databases are used.  Will be ignored if the value is an empty string."],
     :railslog => {:default => "$logdir/rails.log",
       :mode => 0600,
       :owner => "service",
       :group => "service",
       :desc => "Where Rails-specific logs are sent"
     },
 
     :rails_loglevel => ["info", "The log level for Rails connections.  The value must be
       a valid log level within Rails.  Production environments normally use `info`
       and other environments normally use `debug`."]
   )
 
     setdefaults(
     :couchdb,
 
     :couchdb_url => ["http://127.0.0.1:5984/puppet", "The url where the puppet couchdb database will be created"]
   )
 
     setdefaults(
     :transaction,
     :tags => ["", "Tags to use to find resources.  If this is set, then
       only resources tagged with the specified tags will be applied.
       Values must be comma-separated."],
     :evaltrace => [false, "Whether each resource should log when it is
       being evaluated.  This allows you to interactively see exactly
       what is being done."],
     :summarize => [false,
 
       "Whether to print a transaction summary."
     ]
   )
 
     setdefaults(
     :main,
     :external_nodes => ["none",
 
       "An external command that can produce node information.  The command's output
       must be a YAML dump of a hash, and that hash must have a `classes` key and/or
       a `parameters` key, where `classes` is an array or hash and
       `parameters` is a hash.  For unknown nodes, the command should
       exit with a non-zero exit code.
 
       This command makes it straightforward to store your node mapping
       information in other data sources like databases."])
 
         setdefaults(
         :ldap,
     :ldapnodes => [false,
       "Whether to search for node configurations in LDAP.  See
       http://projects.puppetlabs.com/projects/puppet/wiki/LDAP_Nodes for more information."],
     :ldapssl => [false,
       "Whether SSL should be used when searching for nodes.
       Defaults to false because SSL usually requires certificates
       to be set up on the client side."],
     :ldaptls => [false,
       "Whether TLS should be used when searching for nodes.
       Defaults to false because TLS usually requires certificates
       to be set up on the client side."],
     :ldapserver => ["ldap",
       "The LDAP server.  Only used if `ldapnodes` is enabled."],
     :ldapport => [389,
       "The LDAP port.  Only used if `ldapnodes` is enabled."],
 
     :ldapstring => ["(&(objectclass=puppetClient)(cn=%s))",
       "The search string used to find an LDAP node."],
     :ldapclassattrs => ["puppetclass",
       "The LDAP attributes to use to define Puppet classes.  Values
       should be comma-separated."],
     :ldapstackedattrs => ["puppetvar",
       "The LDAP attributes that should be stacked to arrays by adding
       the values in all hierarchy elements of the tree.  Values
       should be comma-separated."],
     :ldapattrs => ["all",
       "The LDAP attributes to include when querying LDAP for nodes.  All
       returned attributes are set as variables in the top-level scope.
       Multiple values should be comma-separated.  The value 'all' returns
       all attributes."],
     :ldapparentattr => ["parentnode",
       "The attribute to use to define the parent node."],
     :ldapuser => ["",
       "The user to use to connect to LDAP.  Must be specified as a
       full DN."],
     :ldappassword => ["", "The password to use to connect to LDAP."],
     :ldapbase => ["",
       "The search base for LDAP searches.  It's impossible to provide
       a meaningful default here, although the LDAP libraries might
       have one already set.  Generally, it should be the 'ou=Hosts'
       branch under your main directory."]
   )
 
   setdefaults(:master,
     :storeconfigs => {
       :default => false,
       :desc => "Whether to store each client's configuration, including catalogs, facts,
 and related data.  This also enables the import and export of resources in
 the Puppet language - a mechanism for exchange resources between nodes.
 
 By default this uses ActiveRecord and an SQL database to store and query
 the data; this, in turn, will depend on Rails being available.
 
 You can adjust the backend using the storeconfigs_backend setting.",
       # Call our hook with the default value, so we always get the libdir set.
       :call_on_define => true,
       :hook => proc do |value|
         require 'puppet/node'
         require 'puppet/node/facts'
         if value
           Puppet.settings[:async_storeconfigs] or
             Puppet::Resource::Catalog.indirection.cache_class = :store_configs
           Puppet::Node::Facts.indirection.cache_class = :store_configs
           Puppet::Node.indirection.cache_class = :store_configs
 
           Puppet::Resource.indirection.terminus_class = :store_configs
         end
       end
     },
     :storeconfigs_backend => {
       :default => "active_record",
       :desc => "Configure the backend terminus used for StoreConfigs.
 By default, this uses the ActiveRecord store, which directly talks to the
 database from within the Puppet Master process."
     }
   )
 
   # This doesn't actually work right now.
 
     setdefaults(
     :parser,
 
     :lexical => [false, "Whether to use lexical scoping (vs. dynamic)."],
     :templatedir => ["$vardir/templates",
       "Where Puppet looks for template files.  Can be a list of colon-separated
       directories."
     ]
   )
   setdefaults(
     :puppetdoc,
     :document_all => [false, "Document all resources"]
   )
 end
diff --git a/lib/puppet/util/command_line.rb b/lib/puppet/util/command_line.rb
index 409a08e26..84c0b0391 100644
--- a/lib/puppet/util/command_line.rb
+++ b/lib/puppet/util/command_line.rb
@@ -1,185 +1,174 @@
+require 'puppet'
 require "puppet/util/plugins"
 
 module Puppet
   module Util
     class CommandLine
 
-      LegacyName = Hash.new{|h,k| k}.update(
-        'agent'      => 'puppetd',
-        'cert'       => 'puppetca',
-        'doc'        => 'puppetdoc',
-        'filebucket' => 'filebucket',
-        'apply'      => 'puppet',
-        'describe'   => 'pi',
-        'queue'      => 'puppetqd',
-        'resource'   => 'ralsh',
-        'kick'       => 'puppetrun',
-        'master'     => 'puppetmasterd',
-        'device'     => 'puppetdevice'
-      )
-
       def initialize(zero = $0, argv = ARGV, stdin = STDIN)
         @zero  = zero
         @argv  = argv.dup
         @stdin = stdin
 
         @subcommand_name, @args = subcommand_and_args(@zero, @argv, @stdin)
         Puppet::Plugins.on_commandline_initialization(:command_line_object => self)
       end
 
       attr :subcommand_name
       attr :args
 
       def appdir
         File.join('puppet', 'application')
       end
 
       def self.available_subcommands
         absolute_appdirs = $LOAD_PATH.collect do |x|
           File.join(x,'puppet','application')
         end.select{ |x| File.directory?(x) }
         absolute_appdirs.inject([]) do |commands, dir|
           commands + Dir[File.join(dir, '*.rb')].map{|fn| File.basename(fn, '.rb')}
         end.uniq
       end
       # available_subcommands was previously an instance method, not a class
       # method, and we have an unknown number of user-implemented applications
       # that depend on that behaviour.  Forwarding allows us to preserve a
       # backward compatible API. --daniel 2011-04-11
       def available_subcommands
         self.class.available_subcommands
       end
 
       def require_application(application)
         require File.join(appdir, application)
       end
 
       def execute
         if subcommand_name and available_subcommands.include?(subcommand_name) then
           require_application subcommand_name
           app = Puppet::Application.find(subcommand_name).new(self)
           Puppet::Plugins.on_application_initialization(:appliation_object => self)
 
           # See the note in 'warn_later' down below. --daniel 2011-06-01
           if $delayed_deprecation_warning_for_p_u_cl.is_a? String then
             Puppet.deprecation_warning($delayed_deprecation_warning_for_p_u_cl)
             $delayed_deprecation_warning_for_p_u_cl = true
           end
 
           app.run
         elsif ! execute_external_subcommand then
           unless subcommand_name.nil? then
             puts "Error: Unknown Puppet subcommand '#{subcommand_name}'"
           end
           puts "See 'puppet help' for help on available puppet subcommands"
         end
       end
 
       def execute_external_subcommand
         external_command = "puppet-#{subcommand_name}"
 
         require 'puppet/util'
         path_to_subcommand = Puppet::Util.which(external_command)
         return false unless path_to_subcommand
 
         exec(path_to_subcommand, *args)
       end
 
       def legacy_executable_name
-        LegacyName[ subcommand_name ]
+        name = LegacyCommandLine::LEGACY_NAMES[ subcommand_name.intern ]
+        return name unless name.nil?
+        return subcommand_name.intern
       end
 
       private
 
       def subcommand_and_args(zero, argv, stdin)
         zero = File.basename(zero, '.rb')
 
         if zero == 'puppet'
           case argv.first
           when nil then
             if stdin.tty? then
               [nil, argv]       # ttys get usage info
             else
               # Killed for 2.7.0 --daniel 2011-06-01
               warn_later <<EOM
 Implicit invocation of 'puppet apply' by redirection into 'puppet' is deprecated,
 and will be removed in the 2.8 series. Please invoke 'puppet apply' directly
 in the future.
 EOM
               ["apply", argv]
             end
           when "--help", "-h" then
             # help should give you usage, not the help for `puppet apply`
             [nil, argv]
           when /^-|\.pp$|\.rb$/ then
             # Killed for 2.7.0 --daniel 2011-06-01
             warn_later <<EOM
 Implicit invocation of 'puppet apply' by passing files (or flags) directly
 to 'puppet' is deprecated, and will be removed in the 2.8 series.  Please
 invoke 'puppet apply' directly in the future.
 EOM
             ["apply", argv]
           else
             [argv.first, argv[1..-1]]
           end
         else
           [zero, argv]
         end
       end
 
       # So, this is more than a little bit of a horror.  You see, the process
       # of bootstrapping Puppet is ... complex.  This file, like many of our
       # early initialization files, has an incestuous relationship between the
       # order of files loaded, code executed at load time, and code executed
       # in other files at runtime.
       #
       # When we construct this object we have not yet actually loaded the
       # global puppet object, so we can't use any methods in it.  That
       # includes all the logging stuff, which is used by the deprecation
       # warning subsystem.
       #
       # On the other hand, we can't just load the logging system, because that
       # depends on the top level Puppet module being bootstrapped.  It doesn't
       # actually load the stuff it uses, though, for hysterical raisins.
       #
       # Finally, we can't actually just load the top level Puppet module.
       # This one is precious: it turns out that some of the code loaded in the
       # top level Puppet module has a dependency on the run mode values.
       #
       # Run mode is set correctly *only* when the application is loaded, and
       # if it is wrong when the top level code is brought in we end up with
       # the wrong settings scattered through some of the defaults.
       #
       # Which means that we have a dependency cycle that runs:
       # 1. The binary creates an instance of P::U::CL.
       # 2. That identifies the application to load.
       # 3. It does, then instantiates the application.
       #    4. That sets the run-mode.
       #    5. That then loads the top level Puppet module.
       # 6. Finally, we get to where we can use the top level stuff
       #
       # So, essentially, we see a dependency between runtime code in this
       # file, run-time code in the application, and load-time code in the top
       # level module.
       #
       # Which leads me to our current horrible hack: we stash away the message
       # we wanted to log about deprecation, then send it to our logging system
       # once we have done enough bootstrapping that it will, y'know, actually
       # work.
       #
       # I would have liked to fix this, but that is going to be a whole pile
       # of work digging through and decrufting all the global state from the
       # local state, and working out what depends on what else in the product.
       #
       # Oh, and we use a global because we have *two* instances of a P::U::CL
       # object during the startup sequence.  I don't know why.
       #
       # Maybe, one day, when I am not behind a deadline to ship code.
       # --daniel 2011-06-01
       def warn_later(text)
         return if $delayed_deprecation_warning_for_p_u_cl
         $delayed_deprecation_warning_for_p_u_cl = text
       end
     end
   end
 end
diff --git a/lib/puppet/util/legacy_command_line.rb b/lib/puppet/util/legacy_command_line.rb
new file mode 100644
index 000000000..735bd3eee
--- /dev/null
+++ b/lib/puppet/util/legacy_command_line.rb
@@ -0,0 +1,39 @@
+module Puppet
+  module Util
+    class LegacyCommandLine
+
+      # XXX need docs
+      class LegacyApp
+        attr_accessor :name, :run_mode
+        def initialize(name, run_mode)
+          @name = name
+          @run_mode = run_mode
+        end
+      end
+
+      # TODO: fix this!!
+      # might want to use 'nil' instead of user, because those apps don't explicitly specify their run mode... they just
+      # inherit the default of :user
+      LEGACY_APPS = {
+          :puppetd => LegacyApp.new(:agent, :agent),
+          :puppetca => LegacyApp.new(:cert, :master),
+          :puppetdoc => LegacyApp.new(:doc, :master),
+          :filebucket => LegacyApp.new(:filebucket, :user),
+          :puppet => LegacyApp.new(:apply, :user),
+          :pi => LegacyApp.new(:describe, :user),
+          :puppetqd => LegacyApp.new(:queue, :user),
+          :ralsh => LegacyApp.new(:resource, :user),
+          :puppetrun => LegacyApp.new(:kick, :user),
+          :puppetmasterd => LegacyApp.new(:master, :master),
+          :puppetdevice => LegacyApp.new(:device, :agent),
+      }
+
+      LEGACY_NAMES = LEGACY_APPS.inject({}) do |result, entry|
+        key, app = *entry
+        result[app.name] = key
+        result
+      end
+
+    end
+  end
+end
\ No newline at end of file
diff --git a/lib/puppet/util/network_device/transport.rb b/lib/puppet/util/network_device/transport.rb
index cef8f3859..307d4ba02 100644
--- a/lib/puppet/util/network_device/transport.rb
+++ b/lib/puppet/util/network_device/transport.rb
@@ -1,3 +1,5 @@
+require 'puppet/util/network_device'
+
 # stub
 module Puppet::Util::NetworkDevice::Transport
 end
\ No newline at end of file
diff --git a/lib/puppet/util/run_mode.rb b/lib/puppet/util/run_mode.rb
index 6028aef29..d8c4e244c 100644
--- a/lib/puppet/util/run_mode.rb
+++ b/lib/puppet/util/run_mode.rb
@@ -1,81 +1,83 @@
 module Puppet
   module Util
     class RunMode
       def initialize(name)
         @name = name.to_sym
       end
 
       @@run_modes = Hash.new {|h, k| h[k] = RunMode.new(k)}
 
       attr :name
 
       def self.[](name)
         @@run_modes[name]
       end
 
       def master?
         name == :master
       end
 
       def agent?
         name == :agent
       end
 
       def user?
         name == :user
       end
 
+      # TODO: None of the following three methods seems to do anything that relates to run mode in any way;
+      #  I wonder if this is the right place for them to be defined?  --cprice 2012-03-06
       def conf_dir
         which_dir(
           (Puppet.features.microsoft_windows? ? File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "etc") : "/etc/puppet"),
           "~/.puppet"
         )
       end
 
       def var_dir
         which_dir(
           (Puppet.features.microsoft_windows? ? File.join(Dir::COMMON_APPDATA, "PuppetLabs", "puppet", "var") : "/var/lib/puppet"),
           "~/.puppet/var"
         )
       end
 
       def run_dir
         "$vardir/run"
       end
 
       def logopts
         if master?
           {
             :default => "$vardir/log",
             :mode    => 0750,
             :owner   => "service",
             :group   => "service",
             :desc    => "The Puppet log directory."
           }
         else
           ["$vardir/log", "The Puppet log directory."]
         end
       end
 
       private
 
       def which_dir( global, user )
         #FIXME: we should test if we're user "puppet"
         #       there's a comment that suggests that we do that
         #       and we currently don't.
         expand_path case
           when name == :master; global
           when Puppet.features.root?; global
           else user
         end
       end
 
       def expand_path( dir )
         require 'etc'
         ENV["HOME"] ||= Etc.getpwuid(Process.uid).dir
         File.expand_path(dir)
       end
 
     end
   end
 end
diff --git a/lib/puppet/util/settings.rb b/lib/puppet/util/settings.rb
index fa99a13dd..ef6657500 100644
--- a/lib/puppet/util/settings.rb
+++ b/lib/puppet/util/settings.rb
@@ -1,932 +1,956 @@
 require 'puppet'
 require 'sync'
 require 'getoptlong'
 require 'puppet/external/event-loop'
 require 'puppet/util/loadedfile'
 
 # The class for handling configuration files.
 class Puppet::Util::Settings
   include Enumerable
 
   require 'puppet/util/settings/setting'
   require 'puppet/util/settings/file_setting'
   require 'puppet/util/settings/boolean_setting'
 
   attr_accessor :file
   attr_reader :timer
 
   ReadOnly = [:run_mode, :name]
 
   # Retrieve a config value
   def [](param)
     value(param)
   end
 
   # Set a config value.  This doesn't set the defaults, it sets the value itself.
   def []=(param, value)
     set_value(param, value, :memory)
   end
 
   # Generate the list of valid arguments, in a format that GetoptLong can
   # understand, and add them to the passed option list.
   def addargs(options)
     # Add all of the config parameters as valid options.
     self.each { |name, setting|
       setting.getopt_args.each { |args| options << args }
     }
 
     options
   end
 
   # Generate the list of valid arguments, in a format that OptionParser can
   # understand, and add them to the passed option list.
   def optparse_addargs(options)
     # Add all of the config parameters as valid options.
     self.each { |name, setting|
       options << setting.optparse_args
     }
 
     options
   end
 
   # Is our parameter a boolean parameter?
   def boolean?(param)
     param = param.to_sym
     !!(@config.include?(param) and @config[param].kind_of? BooleanSetting)
   end
 
   # Remove all set values, potentially skipping cli values.
-  def clear(exceptcli = false)
+  def clear
     @sync.synchronize do
-      unsafe_clear(exceptcli)
+      unsafe_clear
     end
   end
 
   # Remove all set values, potentially skipping cli values.
-  def unsafe_clear(exceptcli = false)
+  def unsafe_clear(clear_cli = true, clear_mutable_defaults = false)
     @values.each do |name, values|
-      @values.delete(name) unless exceptcli and name == :cli
+      next if ((name == :mutable_defaults) and !clear_mutable_defaults)
+      next if ((name == :cli) and !clear_cli)
+      @values.delete(name)
     end
 
+    # TODO: if this condition is really based on the fact that we are reparsing
+    #  the config file, then our parameters should be named more clearly.
+    #  --cprice 2012-03-06
+
     # Don't clear the 'used' in this case, since it's a config file reparse,
     # and we want to retain this info.
-    @used = [] unless exceptcli
+    @used = [] if clear_cli
 
     @cache.clear
   end
+  private :unsafe_clear
+
+  # Private method for internal test use only; allows to do a comprehensive clear of all settings between tests.
+  #
+  # @return nil
+  def clear_for_tests()
+    @sync.synchronize do
+      unsafe_clear(true, true)
+    end
+  end
+  private :clear_for_tests
 
   # This is mostly just used for testing.
   def clearused
     @cache.clear
     @used = []
   end
 
   # Do variable interpolation on the value.
   def convert(value, environment = nil)
-    return value unless value
+    return nil if value.nil?
     return value unless value.is_a? String
     newval = value.gsub(/\$(\w+)|\$\{(\w+)\}/) do |value|
       varname = $2 || $1
       if varname == "environment" and environment
         environment
       elsif pval = self.value(varname, environment)
         pval
       else
         raise Puppet::DevError, "Could not find value for #{value}"
       end
     end
 
     newval
   end
 
   # Return a value's description.
   def description(name)
     if obj = @config[name.to_sym]
       obj.desc
     else
       nil
     end
   end
 
   def each
     @config.each { |name, object|
       yield name, object
     }
   end
 
   # Iterate over each section name.
   def eachsection
     yielded = []
     @config.each do |name, object|
       section = object.section
       unless yielded.include? section
         yield section
         yielded << section
       end
     end
   end
 
   # Return an object by name.
   def setting(param)
     param = param.to_sym
     @config[param]
   end
 
   # Handle a command-line argument.
   def handlearg(opt, value = nil)
     @cache.clear
     value &&= munge_value(value)
     str = opt.sub(/^--/,'')
 
     bool = true
     newstr = str.sub(/^no-/, '')
     if newstr != str
       str = newstr
       bool = false
     end
     str = str.intern
 
     if @config[str].is_a?(Puppet::Util::Settings::BooleanSetting)
       if value == "" or value.nil?
         value = bool
       end
     end
 
     set_value(str, value, :cli)
   end
 
   def include?(name)
     name = name.intern if name.is_a? String
     @config.include?(name)
   end
 
   # check to see if a short name is already defined
   def shortinclude?(short)
     short = short.intern if name.is_a? String
     @shortnames.include?(short)
   end
 
   # Create a new collection of config settings.
   def initialize
     @config = {}
     @shortnames = {}
 
     @created = []
     @searchpath = nil
 
     # Mutex-like thing to protect @values
     @sync = Sync.new
 
     # Keep track of set values.
     @values = Hash.new { |hash, key| hash[key] = {} }
 
     # And keep a per-environment cache
     @cache = Hash.new { |hash, key| hash[key] = {} }
 
     # The list of sections we've used.
     @used = []
   end
 
   # NOTE: ACS ahh the util classes. . .sigh
   # as part of a fix for 1183, I pulled the logic for the following 5 methods out of the executables and puppet.rb
   # They probably deserve their own class, but I don't want to do that until I can refactor environments
   # its a little better than where they were
 
   # Prints the contents of a config file with the available config settings, or it
   # prints a single value of a config setting.
   def print_config_options
     env = value(:environment)
     val = value(:configprint)
     if val == "all"
       hash = {}
       each do |name, obj|
         val = value(name,env)
         val = val.inspect if val == ""
         hash[name] = val
       end
       hash.sort { |a,b| a[0].to_s <=> b[0].to_s }.each do |name, val|
         puts "#{name} = #{val}"
       end
     else
       val.split(/\s*,\s*/).sort.each do |v|
         if include?(v)
           #if there is only one value, just print it for back compatibility
           if v == val
             puts value(val,env)
             break
           end
           puts "#{v} = #{value(v,env)}"
         else
           puts "invalid parameter: #{v}"
           return false
         end
       end
     end
     true
   end
 
   def generate_config
     puts to_config
     true
   end
 
   def generate_manifest
     puts to_manifest
     true
   end
 
   def print_configs
     return print_config_options if value(:configprint) != ""
     return generate_config if value(:genconfig)
     generate_manifest if value(:genmanifest)
   end
 
   def print_configs?
     (value(:configprint) != "" || value(:genconfig) || value(:genmanifest)) && true
   end
 
   # Return a given object's file metadata.
   def metadata(param)
     if obj = @config[param.to_sym] and obj.is_a?(FileSetting)
       return [:owner, :group, :mode].inject({}) do |meta, p|
         if v = obj.send(p)
           meta[p] = v
         end
         meta
       end
     else
       nil
     end
   end
 
   # Make a directory with the appropriate user, group, and mode
   def mkdir(default)
     obj = get_config_file_default(default)
 
     Puppet::Util::SUIDManager.asuser(obj.owner, obj.group) do
       mode = obj.mode || 0750
       Dir.mkdir(obj.value, mode)
     end
   end
 
   # Figure out the section name for the run_mode.
   def run_mode
     Puppet.run_mode.name
   end
 
   # Return all of the parameters associated with a given section.
   def params(section = nil)
     if section
       section = section.intern if section.is_a? String
       @config.find_all { |name, obj|
         obj.section == section
       }.collect { |name, obj|
         name
       }
     else
       @config.keys
     end
   end
 
   # Parse the configuration file.  Just provides
   # thread safety.
   def parse
     raise "No :config setting defined; cannot parse unknown config file" unless self[:config]
 
     @sync.synchronize do
       unsafe_parse(self[:config])
     end
 
     # Create a timer so that this file will get checked automatically
     # and reparsed if necessary.
     set_filetimeout_timer
   end
 
   # Unsafely parse the file -- this isn't thread-safe and causes plenty of problems if used directly.
   def unsafe_parse(file)
     return unless FileTest.exist?(file)
     begin
       data = parse_file(file)
     rescue => detail
       Puppet.log_exception(detail, "Could not parse #{file}: #{detail}")
       return
     end
 
-    unsafe_clear(true)
+    unsafe_clear(false)
 
     metas = {}
     data.each do |area, values|
       metas[area] = values.delete(:_meta)
       values.each do |key,value|
         set_value(key, value, area, :dont_trigger_handles => true, :ignore_bad_settings => true )
       end
     end
 
     # Determine our environment, if we have one.
     if @config[:environment]
       env = self.value(:environment).to_sym
     else
       env = "none"
     end
 
     # Call any hooks we should be calling.
     settings_with_hooks.each do |setting|
       each_source(env) do |source|
         if value = @values[source][setting.name]
           # We still have to use value to retrieve the value, since
           # we want the fully interpolated value, not $vardir/lib or whatever.
           # This results in extra work, but so few of the settings
           # will have associated hooks that it ends up being less work this
           # way overall.
           setting.handle(self.value(setting.name, env))
           break
         end
       end
     end
 
     # We have to do it in the reverse of the search path,
     # because multiple sections could set the same value
     # and I'm too lazy to only set the metadata once.
     searchpath.reverse.each do |source|
       source = run_mode if source == :run_mode
       source = @name if (@name && source == :name)
       if meta = metas[source]
         set_metadata(meta)
       end
     end
   end
 
+
+  # The following method strikes me as a good example of how dynamic languages
+  #  can be abused; I'd really like to see some stronger typing on this stuff.
+  #  And I will totally try to do that if I get a chance.  :)
+  #  --cprice 2012-03-06
+
   # Create a new setting.  The value is passed in because it's used to determine
   # what kind of setting we're creating, but the value itself might be either
   # a default or a value, so we can't actually assign it.
   def newsetting(hash)
     klass = nil
     hash[:section] = hash[:section].to_sym if hash[:section]
     if type = hash[:type]
       unless klass = {:setting => Setting, :file => FileSetting, :boolean => BooleanSetting}[type]
         raise ArgumentError, "Invalid setting type '#{type}'"
       end
       hash.delete(:type)
     else
       case hash[:default]
       when true, false, "true", "false"
         klass = BooleanSetting
       when /^\$\w+\//, /^\//, /^\w:\//
         klass = FileSetting
       when String, Integer, Float # nothing
         klass = Setting
       else
         raise ArgumentError, "Invalid value '#{hash[:default].inspect}' for #{hash[:name]}"
       end
     end
     hash[:settings] = self
     setting = klass.new(hash)
 
     setting
   end
 
   # This has to be private, because it doesn't add the settings to @config
   private :newsetting
 
   # Iterate across all of the objects in a given section.
   def persection(section)
     section = section.to_sym
     self.each { |name, obj|
       if obj.section == section
         yield obj
       end
     }
   end
 
   def file
     return @file if @file
     if path = self[:config] and FileTest.exist?(path)
       @file = Puppet::Util::LoadedFile.new(path)
     end
   end
 
   # Reparse our config file, if necessary.
   def reparse
     if file and file.changed?
       Puppet.notice "Reparsing #{file.file}"
       parse
       reuse
     end
   end
 
   def reuse
     return unless defined?(@used)
     @sync.synchronize do # yay, thread-safe
       new = @used
       @used = []
       self.use(*new)
     end
   end
 
   # The order in which to search for values.
   def searchpath(environment = nil)
     if environment
       [:cli, :memory, environment, :run_mode, :main, :mutable_defaults]
     else
       [:cli, :memory, :run_mode, :main, :mutable_defaults]
     end
   end
 
   # Get a list of objects per section
   def sectionlist
     sectionlist = []
     self.each { |name, obj|
       section = obj.section || "puppet"
       sections[section] ||= []
       sectionlist << section unless sectionlist.include?(section)
       sections[section] << obj
     }
 
     return sectionlist, sections
   end
 
   def service_user_available?
     return @service_user_available if defined?(@service_user_available)
 
     return @service_user_available = false unless user_name = self[:user]
 
     user = Puppet::Type.type(:user).new :name => self[:user], :audit => :ensure
 
     @service_user_available = user.exists?
   end
 
   def legacy_to_mode(type, param)
-    if not defined?(@app_names)
-      require 'puppet/util/command_line'
-      command_line = Puppet::Util::CommandLine.new
-      @app_names = Puppet::Util::CommandLine::LegacyName.inject({}) do |hash, pair|
-        app, legacy = pair
-        command_line.require_application app
-        hash[legacy.to_sym] = Puppet::Application.find(app).run_mode.name
-        hash
-      end
-    end
-    if new_type = @app_names[type]
+    require 'puppet/util/legacy_command_line'
+    if Puppet::Util::LegacyCommandLine::LEGACY_APPS.has_key?(type)
+      new_type = Puppet::Util::LegacyCommandLine::LEGACY_APPS[type].run_mode
       Puppet.deprecation_warning "You have configuration parameter $#{param} specified in [#{type}], which is a deprecated section. I'm assuming you meant [#{new_type}]"
       return new_type
     end
     type
   end
 
   def set_value(param, value, type, options = {})
     param = param.to_sym
     unless setting = @config[param]
       if options[:ignore_bad_settings]
         return
       else
         raise ArgumentError,
           "Attempt to assign a value to unknown configuration parameter #{param.inspect}"
       end
     end
+
     value = setting.munge(value) if setting.respond_to?(:munge)
     setting.handle(value) if setting.respond_to?(:handle) and not options[:dont_trigger_handles]
     if ReadOnly.include? param and type != :mutable_defaults
       raise ArgumentError,
         "You're attempting to set configuration parameter $#{param}, which is read-only."
     end
     type = legacy_to_mode(type, param)
     @sync.synchronize do # yay, thread-safe
       # Allow later inspection to determine if the setting was set on the
       # command line, or through some other code path.  Used for the
       # `dns_alt_names` option during cert generate. --daniel 2011-10-18
       setting.setbycli = true if type == :cli
 
       @values[type][param] = value
       @cache.clear
 
       clearused
 
       # Clear the list of environments, because they cache, at least, the module path.
       # We *could* preferentially just clear them if the modulepath is changed,
       # but we don't really know if, say, the vardir is changed and the modulepath
       # is defined relative to it. We need the defined?(stuff) because of loading
       # order issues.
       Puppet::Node::Environment.clear if defined?(Puppet::Node) and defined?(Puppet::Node::Environment)
     end
 
     value
   end
 
   # Set a bunch of defaults in a given section.  The sections are actually pretty
   # pointless, but they help break things up a bit, anyway.
   def setdefaults(section, defs)
     section = section.to_sym
     call = []
     defs.each { |name, hash|
       if hash.is_a? Array
         unless hash.length == 2
           raise ArgumentError, "Defaults specified as an array must contain only the default value and the decription"
         end
         tmp = hash
         hash = {}
         [:default, :desc].zip(tmp).each { |p,v| hash[p] = v }
       end
       name = name.to_sym
       hash[:name] = name
       hash[:section] = section
       raise ArgumentError, "Parameter #{name} is already defined" if @config.include?(name)
       tryconfig = newsetting(hash)
       if short = tryconfig.short
         if other = @shortnames[short]
           raise ArgumentError, "Parameter #{other.name} is already using short name '#{short}'"
         end
         @shortnames[short] = tryconfig
       end
       @config[name] = tryconfig
 
       # Collect the settings that need to have their hooks called immediately.
       # We have to collect them so that we can be sure we're fully initialized before
       # the hook is called.
       call << tryconfig if tryconfig.call_on_define
     }
 
     call.each { |setting| setting.handle(self.value(setting.name)) }
   end
 
   # Create a timer to check whether the file should be reparsed.
   def set_filetimeout_timer
     return unless timeout = self[:filetimeout] and timeout = Integer(timeout) and timeout > 0
     timer = EventLoop::Timer.new(:interval => timeout, :tolerance => 1, :start? => true) { self.reparse }
   end
 
   # Convert the settings we manage into a catalog full of resources that model those settings.
   def to_catalog(*sections)
     sections = nil if sections.empty?
 
     catalog = Puppet::Resource::Catalog.new("Settings")
 
     @config.values.find_all { |value| value.is_a?(FileSetting) }.each do |file|
       next unless (sections.nil? or sections.include?(file.section))
       next unless resource = file.to_resource
       next if catalog.resource(resource.ref)
 
       catalog.add_resource(resource)
     end
 
     add_user_resources(catalog, sections)
 
     catalog
   end
 
   # Convert our list of config settings into a configuration file.
   def to_config
     str = %{The configuration file for #{Puppet[:name]}.  Note that this file
 is likely to have unused configuration parameters in it; any parameter that's
 valid anywhere in Puppet can be in any config file, even if it's not used.
 
 Every section can specify three special parameters: owner, group, and mode.
 These parameters affect the required permissions of any files specified after
 their specification.  Puppet will sometimes use these parameters to check its
 own configured state, so they can be used to make Puppet a bit more self-managing.
 
 Generated on #{Time.now}.
 
 }.gsub(/^/, "# ")
 
 #         Add a section heading that matches our name.
 if @config.include?(:run_mode)
   str += "[#{self[:run_mode]}]\n"
     end
     eachsection do |section|
       persection(section) do |obj|
         str += obj.to_config + "\n" unless ReadOnly.include? obj.name or obj.name == :genconfig
       end
     end
 
     return str
   end
 
   # Convert to a parseable manifest
   def to_manifest
     catalog = to_catalog
     catalog.resource_refs.collect do |ref|
       catalog.resource(ref).to_manifest
     end.join("\n\n")
   end
 
   # Create the necessary objects to use a section.  This is idempotent;
   # you can 'use' a section as many times as you want.
   def use(*sections)
     sections = sections.collect { |s| s.to_sym }
     @sync.synchronize do # yay, thread-safe
       sections = sections.reject { |s| @used.include?(s) }
 
       return if sections.empty?
 
       begin
         catalog = to_catalog(*sections).to_ral
       rescue => detail
         Puppet.log_exception(detail, "Could not create resources for managing Puppet's files and directories in sections #{sections.inspect}: #{detail}")
 
         # We need some way to get rid of any resources created during the catalog creation
         # but not cleaned up.
         return
       end
 
       catalog.host_config = false
       catalog.apply do |transaction|
         if transaction.any_failed?
           report = transaction.report
           failures = report.logs.find_all { |log| log.level == :err }
           raise "Got #{failures.length} failure(s) while initializing: #{failures.collect { |l| l.to_s }.join("; ")}"
         end
       end
 
       sections.each { |s| @used << s }
       @used.uniq!
     end
   end
 
   def valid?(param)
     param = param.to_sym
     @config.has_key?(param)
   end
 
   def uninterpolated_value(param, environment = nil)
     param = param.to_sym
     environment &&= environment.to_sym
 
+    ## do we really need to be using throw here? isn't that a fairly slow operation?
+    ##  I guess if we are caching the values then this shouldn't get called all that
+    ##  often.  --cprice 2012-03-06
+
     # See if we can find it within our searchable list of values
     val = catch :foundval do
       each_source(environment) do |source|
         # Look for the value.  We have to test the hash for whether
         # it exists, because the value might be false.
         @sync.synchronize do
           throw :foundval, @values[source][param] if @values[source].include?(param)
         end
       end
       throw :foundval, nil
     end
 
     # If we didn't get a value, use the default
     val = @config[param].default if val.nil?
 
     val
   end
 
   # Find the correct value using our search path.  Optionally accept an environment
   # in which to search before the other configuration sections.
   def value(param, environment = nil)
     param = param.to_sym
     environment &&= environment.to_sym
 
     # Short circuit to nil for undefined parameters.
     return nil unless @config.include?(param)
 
     # Yay, recursion.
     #self.reparse unless [:config, :filetimeout].include?(param)
 
     # Check the cache first.  It needs to be a per-environment
     # cache so that we don't spread values from one env
     # to another.
     if cached = @cache[environment||"none"][param]
       return cached
     end
 
     val = uninterpolated_value(param, environment)
 
     if param == :code
       # if we interpolate code, all hell breaks loose.
       return val
     end
 
     # Convert it if necessary
     val = convert(val, environment)
 
     # And cache it
     @cache[environment||"none"][param] = val
     val
   end
 
   # Open a file with the appropriate user, group, and mode
   def write(default, *args, &bloc)
     obj = get_config_file_default(default)
     writesub(default, value(obj.name), *args, &bloc)
   end
 
   # Open a non-default file under a default dir with the appropriate user,
   # group, and mode
   def writesub(default, file, *args, &bloc)
     obj = get_config_file_default(default)
     chown = nil
     if Puppet.features.root?
       chown = [obj.owner, obj.group]
     else
       chown = [nil, nil]
     end
 
     Puppet::Util::SUIDManager.asuser(*chown) do
       mode = obj.mode ? obj.mode.to_i : 0640
       args << "w" if args.empty?
 
       args << mode
 
       # Update the umask to make non-executable files
       Puppet::Util.withumask(File.umask ^ 0111) do
         File.open(file, *args) do |file|
           yield file
         end
       end
     end
   end
 
   def readwritelock(default, *args, &bloc)
     file = value(get_config_file_default(default).name)
     tmpfile = file + ".tmp"
     sync = Sync.new
     raise Puppet::DevError, "Cannot create #{file}; directory #{File.dirname(file)} does not exist" unless FileTest.directory?(File.dirname(tmpfile))
 
     sync.synchronize(Sync::EX) do
       File.open(file, ::File::CREAT|::File::RDWR, 0600) do |rf|
         rf.lock_exclusive do
           if File.exist?(tmpfile)
             raise Puppet::Error, ".tmp file already exists for #{file}; Aborting locked write. Check the .tmp file and delete if appropriate"
           end
 
           # If there's a failure, remove our tmpfile
           begin
             writesub(default, tmpfile, *args, &bloc)
           rescue
             File.unlink(tmpfile) if FileTest.exist?(tmpfile)
             raise
           end
 
           begin
             File.rename(tmpfile, file)
           rescue => detail
             Puppet.err "Could not rename #{file} to #{tmpfile}: #{detail}"
             File.unlink(tmpfile) if FileTest.exist?(tmpfile)
           end
         end
       end
     end
   end
 
   private
 
   def get_config_file_default(default)
     obj = nil
     unless obj = @config[default]
       raise ArgumentError, "Unknown default #{default}"
     end
 
     raise ArgumentError, "Default #{default} is not a file" unless obj.is_a? FileSetting
 
     obj
   end
 
   def add_user_resources(catalog, sections)
     return unless Puppet.features.root?
     return if Puppet.features.microsoft_windows?
     return unless self[:mkusers]
 
     @config.each do |name, setting|
       next unless setting.respond_to?(:owner)
       next unless sections.nil? or sections.include?(setting.section)
 
       if user = setting.owner and user != "root" and catalog.resource(:user, user).nil?
         resource = Puppet::Resource.new(:user, user, :parameters => {:ensure => :present})
         resource[:gid] = self[:group] if self[:group]
         catalog.add_resource resource
       end
       if group = setting.group and ! %w{root wheel}.include?(group) and catalog.resource(:group, group).nil?
         catalog.add_resource Puppet::Resource.new(:group, group, :parameters => {:ensure => :present})
       end
     end
   end
 
   # Yield each search source in turn.
   def each_source(environment)
     searchpath(environment).each do |source|
       # Modify the source as necessary.
       source = self.run_mode if source == :run_mode
       yield source
     end
   end
 
   # Return all settings that have associated hooks; this is so
   # we can call them after parsing the configuration file.
   def settings_with_hooks
     @config.values.find_all { |setting| setting.respond_to?(:handle) }
   end
 
   # Extract extra setting information for files.
   def extract_fileinfo(string)
     result = {}
     value = string.sub(/\{\s*([^}]+)\s*\}/) do
       params = $1
       params.split(/\s*,\s*/).each do |str|
         if str =~ /^\s*(\w+)\s*=\s*([\w\d]+)\s*$/
           param, value = $1.intern, $2
           result[param] = value
           raise ArgumentError, "Invalid file option '#{param}'" unless [:owner, :mode, :group].include?(param)
 
           if param == :mode and value !~ /^\d+$/
             raise ArgumentError, "File modes must be numbers"
           end
         else
           raise ArgumentError, "Could not parse '#{string}'"
         end
       end
       ''
     end
     result[:value] = value.sub(/\s*$/, '')
     result
   end
 
   # Convert arguments into booleans, integers, or whatever.
   def munge_value(value)
     # Handle different data types correctly
     return case value
       when /^false$/i; false
       when /^true$/i; true
       when /^\d+$/i; Integer(value)
       when true; true
       when false; false
       else
         value.gsub(/^["']|["']$/,'').sub(/\s+$/, '')
     end
   end
 
   # This method just turns a file in to a hash of hashes.
   def parse_file(file)
     text = read_file(file)
 
     result = Hash.new { |names, name|
       names[name] = {}
     }
 
     count = 0
 
     # Default to 'main' for the section.
     section = :main
     result[section][:_meta] = {}
-    text.split(/\n/).each { |line|
+    text.split(/\n/).each do |line|
       count += 1
       case line
       when /^\s*\[(\w+)\]\s*$/
         section = $1.intern # Section names
+        #disallow mutable_defaults in config file
+        if section == :mutable_defaults
+          raise Puppet::Error.new("Illegal section 'mutable_defaults' in config file", file, line)
+        end
         # Add a meta section
         result[section][:_meta] ||= {}
       when /^\s*#/; next # Skip comments
       when /^\s*$/; next # Skip blanks
       when /^\s*(\w+)\s*=\s*(.*?)\s*$/ # settings
         var = $1.intern
 
         # We don't want to munge modes, because they're specified in octal, so we'll
         # just leave them as a String, since Puppet handles that case correctly.
         if var == :mode
           value = $2
         else
           value = munge_value($2)
         end
 
         # Check to see if this is a file argument and it has extra options
         begin
           if value.is_a?(String) and options = extract_fileinfo(value)
             value = options[:value]
             options.delete(:value)
             result[section][:_meta][var] = options
           end
           result[section][var] = value
         rescue Puppet::Error => detail
           detail.file = file
           detail.line = line
           raise
         end
       else
         error = Puppet::Error.new("Could not match line #{line}")
         error.file = file
         error.line = line
         raise error
       end
-    }
+    end
 
     result
   end
 
   # Read the file in.
   def read_file(file)
     begin
       return File.read(file)
     rescue Errno::ENOENT
       raise ArgumentError, "No such file #{file}"
     rescue Errno::EACCES
       raise ArgumentError, "Permission denied to file #{file}"
     end
   end
 
   # Set file metadata.
   def set_metadata(meta)
     meta.each do |var, values|
       values.each do |param, value|
         @config[var].send(param.to_s + "=", value)
       end
     end
   end
 end
diff --git a/spec/integration/application/doc_spec.rb b/spec/integration/application/doc_spec.rb
index 2cf5fd1e9..0a323e0af 100755
--- a/spec/integration/application/doc_spec.rb
+++ b/spec/integration/application/doc_spec.rb
@@ -1,54 +1,55 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet_spec/files'
+require 'puppet/application/doc'
 
 describe Puppet::Application::Doc do
   include PuppetSpec::Files
 
   it "should not generate an error when module dir overlaps parent of site.pp (#4798)", :'fails_on_ruby_1.9.2' => true, :unless => Puppet.features.microsoft_windows? do
     begin
       # Note: the directory structure below is more complex than it
       # needs to be, but it's representative of the directory structure
       # used in bug #4798.
       old_dir = Dir.getwd # Note: can't use chdir with a block because it will generate bogus warnings
       tmpdir = tmpfile('doc_spec')
       Dir.mkdir(tmpdir)
       Dir.chdir(tmpdir)
       site_file = 'site.pp'
       File.open(site_file, 'w') do |f|
         f.puts '# A comment'
       end
       modules_dir = 'modules'
       Dir.mkdir(modules_dir)
       rt_dir = File.join(modules_dir, 'rt')
       Dir.mkdir(rt_dir)
       manifests_dir = File.join(rt_dir, 'manifests')
       Dir.mkdir(manifests_dir)
       rt_file = File.join(manifests_dir, 'rt.pp')
       File.open(rt_file, 'w') do |f|
         f.puts '# A class'
         f.puts 'class foo { }'
         f.puts '# A definition'
         f.puts 'define bar { }'
       end
 
       puppet = Puppet::Application[:doc]
       Puppet[:modulepath] = modules_dir
       Puppet[:manifest] = site_file
       puppet.options[:mode] = :rdoc
 
       expect { puppet.run_command }.to exit_with 0
 
       File.should be_exist('doc')
     ensure
       Dir.chdir(old_dir)
     end
   end
 
   it "should respect the -o option" do
     puppetdoc = Puppet::Application[:doc]
     puppetdoc.command_line.stubs(:args).returns(['foo', '-o', 'bar'])
     puppetdoc.parse_options
     puppetdoc.options[:outputdir].should == 'bar'
   end
 end
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index 84f720594..e367671b5 100755
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -1,143 +1,143 @@
 dir = File.expand_path(File.dirname(__FILE__))
 $LOAD_PATH.unshift File.join(dir, 'lib')
 
 # Don't want puppet getting the command line arguments for rake or autotest
 ARGV.clear
 
 require 'puppet'
 require 'mocha'
 gem 'rspec', '>=2.0.0'
 require 'rspec/expectations'
 
 # So everyone else doesn't have to include this base constant.
 module PuppetSpec
   FIXTURE_DIR = File.join(dir = File.expand_path(File.dirname(__FILE__)), "fixtures") unless defined?(FIXTURE_DIR)
 end
 
 require 'pathname'
 require 'tmpdir'
 
 require 'puppet_spec/verbose'
 require 'puppet_spec/files'
 require 'puppet_spec/fixtures'
 require 'puppet_spec/matchers'
 require 'puppet_spec/database'
 require 'monkey_patches/alias_should_to_must'
 require 'monkey_patches/publicize_methods'
 
 Pathname.glob("#{dir}/shared_behaviours/**/*.rb") do |behaviour|
   require behaviour.relative_path_from(Pathname.new(dir))
 end
 
 RSpec.configure do |config|
   include PuppetSpec::Fixtures
 
   config.mock_with :mocha
 
   config.before :each do
     # Disabling garbage collection inside each test, and only running it at
     # the end of each block, gives us an ~ 15 percent speedup, and more on
     # some platforms *cough* windows *cough* that are a little slower.
     GC.disable
 
     # We need to preserve the current state of all our indirection cache and
     # terminus classes.  This is pretty important, because changes to these
     # are global and lead to order dependencies in our testing.
     #
     # We go direct to the implementation because there is no safe, sane public
     # API to manage restoration of these to their default values.  This
     # should, once the value is proved, be moved to a standard API on the
     # indirector.
     #
     # To make things worse, a number of the tests stub parts of the
     # indirector.  These stubs have very specific expectations that what
     # little of the public API we could use is, well, likely to explode
     # randomly in some tests.  So, direct access.  --daniel 2011-08-30
     $saved_indirection_state = {}
     indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
     indirections.each do |indirector|
       $saved_indirection_state[indirector.name] = {
         :@terminus_class => indirector.instance_variable_get(:@terminus_class),
         :@cache_class    => indirector.instance_variable_get(:@cache_class)
       }
     end
 
     # these globals are set by Application
     $puppet_application_mode = nil
     $puppet_application_name = nil
 
     # REVISIT: I think this conceals other bad tests, but I don't have time to
     # fully diagnose those right now.  When you read this, please come tell me
     # I suck for letting this float. --daniel 2011-04-21
     Signal.stubs(:trap)
 
     # Longer keys are secure, but they sure make for some slow testing - both
     # in terms of generating keys, and in terms of anything the next step down
     # the line doing validation or whatever.  Most tests don't care how long
     # or secure it is, just that it exists, so these are better and faster
     # defaults, in testing only.
     #
     # I would make these even shorter, but OpenSSL doesn't support anything
     # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
     Puppet[:req_bits]  = 512
     Puppet[:keylength] = 512
 
     # Set the confdir and vardir to gibberish so that tests
     # have to be correctly mocked.
     Puppet[:confdir] = "/dev/null"
     Puppet[:vardir] = "/dev/null"
 
     # Avoid opening ports to the outside world
     Puppet.settings[:bindaddress] = "127.0.0.1"
 
     # We don't want to depend upon the reported domain name of the
     # machine running the tests, nor upon the DNS setup of that
     # domain.
     Puppet.settings[:use_srv_records] = false
 
     @logs = []
     Puppet::Util::Log.newdestination(Puppet::Test::LogCollector.new(@logs))
 
     @log_level = Puppet::Util::Log.level
   end
 
   config.after :each do
-    Puppet.settings.clear
+    Puppet.settings.send(:clear_for_tests)
     Puppet::Node::Environment.clear
     Puppet::Util::Storage.clear
     Puppet::Util::ExecutionStub.reset
 
     PuppetSpec::Files.cleanup
 
     @logs.clear
     Puppet::Util::Log.close_all
     Puppet::Util::Log.level = @log_level
 
     Puppet.clear_deprecation_warnings
 
     # uncommenting and manipulating this can be useful when tracking down calls to deprecated code
     #Puppet.log_deprecations_to_file("deprecations.txt", /^Puppet::Util.exec/)
 
     # Restore the indirector configuration.  See before hook.
     indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
     indirections.each do |indirector|
       $saved_indirection_state.fetch(indirector.name, {}).each do |variable, value|
         indirector.instance_variable_set(variable, value)
       end
     end
     $saved_indirection_state = {}
 
     # Some tests can cause us to connect, in which case the lingering
     # connection is a resource that can cause unexpected failure in later
     # tests, as well as sharing state accidentally.
     # We're testing if ActiveRecord::Base is defined because some test cases
     # may stub Puppet.features.rails? which is how we should normally
     # introspect for this functionality.
     ActiveRecord::Base.remove_connection if defined?(ActiveRecord::Base)
 
     # This will perform a GC between tests, but only if actually required.  We
     # experimented with forcing a GC run, and that was less efficient than
     # just letting it run all the time.
     GC.enable
   end
 end
diff --git a/spec/unit/util/command_line_spec.rb b/spec/unit/util/command_line_spec.rb
index d7bc7f8ad..3798c1960 100755
--- a/spec/unit/util/command_line_spec.rb
+++ b/spec/unit/util/command_line_spec.rb
@@ -1,140 +1,140 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 
 require 'puppet/face'
 require 'puppet/util/command_line'
 
 describe Puppet::Util::CommandLine do
   include PuppetSpec::Files
   before do
     @tty  = stub("tty",  :tty? => true )
     @pipe = stub("pipe", :tty? => false)
   end
 
   it "should pull off the first argument if it looks like a subcommand" do
     command_line = Puppet::Util::CommandLine.new("puppet", %w{ client --help whatever.pp }, @tty )
 
     command_line.subcommand_name.should == "client"
     command_line.args.should            == %w{ --help whatever.pp }
   end
 
   it "should use 'apply' if the first argument looks like a .pp file" do
     command_line = Puppet::Util::CommandLine.new("puppet", %w{ whatever.pp }, @tty )
 
     command_line.subcommand_name.should == "apply"
     command_line.args.should            == %w{ whatever.pp }
   end
 
   it "should use 'apply' if the first argument looks like a .rb file" do
     command_line = Puppet::Util::CommandLine.new("puppet", %w{ whatever.rb }, @tty )
 
     command_line.subcommand_name.should == "apply"
     command_line.args.should            == %w{ whatever.rb }
   end
 
   it "should use 'apply' if the first argument looks like a flag" do
     command_line = Puppet::Util::CommandLine.new("puppet", %w{ --debug }, @tty )
 
     command_line.subcommand_name.should == "apply"
     command_line.args.should            == %w{ --debug }
   end
 
   it "should use 'apply' if the first argument is -" do
     command_line = Puppet::Util::CommandLine.new("puppet", %w{ - }, @tty )
 
     command_line.subcommand_name.should == "apply"
     command_line.args.should            == %w{ - }
   end
 
   it "should return nil if the first argument is --help" do
     command_line = Puppet::Util::CommandLine.new("puppet", %w{ --help }, @tty )
 
     command_line.subcommand_name.should == nil
   end
 
 
   it "should return nil if there are no arguments on a tty" do
     command_line = Puppet::Util::CommandLine.new("puppet", [], @tty )
 
     command_line.subcommand_name.should == nil
     command_line.args.should            == []
   end
 
   it "should use 'apply' if there are no arguments on a pipe" do
     command_line = Puppet::Util::CommandLine.new("puppet", [], @pipe )
 
     command_line.subcommand_name.should == "apply"
     command_line.args.should            == []
   end
 
   it "should return the executable name if it is not puppet" do
     command_line = Puppet::Util::CommandLine.new("puppetmasterd", [], @tty )
 
     command_line.subcommand_name.should == "puppetmasterd"
   end
 
   it "should translate subcommand names into their legacy equivalent" do
     command_line = Puppet::Util::CommandLine.new("puppet", ["master"], @tty)
-    command_line.legacy_executable_name.should == "puppetmasterd"
+    command_line.legacy_executable_name.should == :puppetmasterd
   end
 
   it "should leave legacy command names alone" do
     command_line = Puppet::Util::CommandLine.new("puppetmasterd", [], @tty)
-    command_line.legacy_executable_name.should == "puppetmasterd"
+    command_line.legacy_executable_name.should == :puppetmasterd
   end
 
   describe "when the subcommand is not implemented" do
     it "should find and invoke an executable with a hyphenated name" do
       commandline = Puppet::Util::CommandLine.new("puppet", ['whatever', 'argument'], @tty)
       Puppet::Util.expects(:which).with('puppet-whatever').returns('/dev/null/puppet-whatever')
       commandline.expects(:exec).with('/dev/null/puppet-whatever', 'argument')
 
       commandline.execute
     end
 
     describe "and an external implementation cannot be found" do
       it "should abort and show the usage message" do
         commandline = Puppet::Util::CommandLine.new("puppet", ['whatever', 'argument'], @tty)
         Puppet::Util.expects(:which).with('puppet-whatever').returns(nil)
         commandline.expects(:exec).never
 
         expect {
           commandline.execute
         }.to have_printed(/Unknown Puppet subcommand 'whatever'/)
       end
     end
   end
   describe 'when loading commands' do
     before do
       @core_apps = %w{describe filebucket kick queue resource agent cert apply doc master}
       @command_line = Puppet::Util::CommandLine.new("foo", %w{ client --help whatever.pp }, @tty )
     end
     it "should expose available_subcommands as a class method" do
       @core_apps.each do |command|
         @command_line.available_subcommands.should include command
       end
     end
     it 'should be able to find all existing commands' do
       @core_apps.each do |command|
         @command_line.available_subcommands.should include command
       end
     end
     describe 'when multiple paths have applications' do
       before do
         @dir=tmpdir('command_line_plugin_test')
         @appdir="#{@dir}/puppet/application"
         FileUtils.mkdir_p(@appdir)
         FileUtils.touch("#{@appdir}/foo.rb")
         $LOAD_PATH.unshift(@dir) # WARNING: MUST MATCH THE AFTER ACTIONS!
       end
       it 'should be able to find commands from both paths' do
         found = @command_line.available_subcommands
         found.should include 'foo'
         @core_apps.each { |cmd| found.should include cmd }
       end
       after do
         $LOAD_PATH.shift        # WARNING: MUST MATCH THE BEFORE ACTIONS!
       end
     end
   end
 end