Merge commit '2.6.2rc1'

45 files changed, 375 insertions, 219 deletions

diff --git a/lib/puppet/application.rb b/lib/puppet/application.rb
index 2fec38bf2..f0159a65d 100644
--- a/lib/puppet/application.rb
+++ b/lib/puppet/application.rb
@@ -254,19 +254,6 @@ class Application
   def preinit
   end
 
-  def option_parser
-    return @option_parser if defined?(@option_parser)
-
-    @option_parser = OptionParser.new(self.class.banner)
-
-    self.class.option_parser_commands.each do |options, fname|
-      @option_parser.on(*options) do |value|
-        self.send(fname, value)
-      end
-    end
-    @option_parser
-  end
-
   def initialize(command_line = nil)
     require 'puppet/util/command_line'
     @command_line = command_line || Puppet::Util::CommandLine.new
@@ -323,20 +310,29 @@ class Application
   end
 
   def parse_options
-    # get all puppet options
-    optparse_opt = []
-    optparse_opt = Puppet.settings.optparse_addargs(optparse_opt)
+    # Create an option parser
+    option_parser = OptionParser.new(self.class.banner)
 
-    # convert them to OptionParser format
-    optparse_opt.each do |option|
-      self.option_parser.on(*option) do |arg|
+    # Add all global options to it.
+    Puppet.settings.optparse_addargs([]).each do |option|
+      option_parser.on(*option) do |arg|
         handlearg(option[0], arg)
       end
     end
 
-    # scan command line argument
+    # Add options that are local to this application, which were
+    # created using the "option()" metaprogramming method.  If there
+    # are any conflicts, this application's options will be favored.
+    self.class.option_parser_commands.each do |options, fname|
+      option_parser.on(*options) do |value|
+        # Call the method that "option()" created.
+        self.send(fname, value)
+      end
+    end
+
+    # scan command line.
     begin
-      self.option_parser.parse!(self.command_line.args)
+      option_parser.parse!(self.command_line.args)
     rescue OptionParser::ParseError => detail
       $stderr.puts detail
       $stderr.puts "Try 'puppet #{command_line.subcommand_name} --help'"
diff --git a/lib/puppet/defaults.rb b/lib/puppet/defaults.rb
index 318ff416b..972e9e66c 100644
--- a/lib/puppet/defaults.rb
+++ b/lib/puppet/defaults.rb
@@ -268,7 +268,7 @@ module Puppet
 
     setdefaults(
     :ca,
-    :ca_name => ["$certname", "The name to use the Certificate Authority certificate."],
+    :ca_name => ["Puppet CA: $certname", "The name to use the Certificate Authority certificate."],
     :cadir => {  :default => "$ssldir/ca",
       :owner => "service",
       :group => "service",
diff --git a/lib/puppet/dsl.rb b/lib/puppet/dsl.rb
index abdb78f67..97a310436 100644
--- a/lib/puppet/dsl.rb
+++ b/lib/puppet/dsl.rb
@@ -5,7 +5,3 @@ end
 
 require 'puppet/dsl/resource_type_api'
 require 'puppet/dsl/resource_api'
-
-class Object
-  include Puppet::DSL::ResourceTypeAPI
-end
diff --git a/lib/puppet/dsl/resource_type_api.rb b/lib/puppet/dsl/resource_type_api.rb
index 487aab99d..ecb914189 100644
--- a/lib/puppet/dsl/resource_type_api.rb
+++ b/lib/puppet/dsl/resource_type_api.rb
@@ -1,33 +1,39 @@
 require 'puppet/resource/type'
 
-module Puppet::DSL::ResourceTypeAPI
+class Puppet::DSL::ResourceTypeAPI
   def define(name, *args, &block)
-    result = mk_resource_type(:definition, name, Hash.new, block)
-    result.set_arguments(munge_type_arguments(args))
-    result
+    result = __mk_resource_type__(:definition, name, Hash.new, block)
+    result.set_arguments(__munge_type_arguments__(args))
+    nil
   end
 
   def hostclass(name, options = {}, &block)
-    mk_resource_type(:hostclass, name, options, block)
+    __mk_resource_type__(:hostclass, name, options, block)
+    nil
   end
 
   def node(name, options = {}, &block)
-    mk_resource_type(:node, name, options, block)
+    __mk_resource_type__(:node, name, options, block)
+    nil
   end
 
-  private
+  # Note: we don't want the user to call the following methods
+  # directly.  However, we can't stop them by making the methods
+  # private because the user's .rb code gets instance_eval'ed on an
+  # instance of this class.  So instead we name the methods using
+  # double underscores to discourage customers from calling them.
 
-  def mk_resource_type(type, name, options, code)
+  def __mk_resource_type__(type, name, options, code)
     klass = Puppet::Resource::Type.new(type, name, options)
 
     klass.ruby_code = code if code
 
-    Puppet::Node::Environment.new.known_resource_types.add klass
+    Thread.current[:known_resource_types].add klass
 
     klass
   end
 
-  def munge_type_arguments(args)
+  def __munge_type_arguments__(args)
     args.inject([]) do |result, item|
       if item.is_a?(Hash)
         item.each { |p, v| result << [p, v] }
diff --git a/lib/puppet/external/event-loop/event-loop.rb b/lib/puppet/external/event-loop/event-loop.rb
index dc51a55ae..3b40f6e71 100644
--- a/lib/puppet/external/event-loop/event-loop.rb
+++ b/lib/puppet/external/event-loop/event-loop.rb
@@ -75,8 +75,10 @@ class EventLoop
     @notify_src, @notify_snk = IO.pipe
 
     # prevent file descriptor leaks
-    @notify_src.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
-    @notify_snk.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+    if @notify_src.respond_to?(:fcntl) and defined?(Fcntl) and defined?(Fcntl::F_SETFD) and defined?(Fcntl::FD_CLOEXEC)
+      @notify_src.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+      @notify_snk.fcntl(Fcntl::F_SETFD, Fcntl::FD_CLOEXEC)
+    end
 
     @notify_src.will_block = false
     @notify_snk.will_block = false
@@ -234,19 +236,21 @@ class IO
   end
 
   def will_block?
-    require "fcntl"
-    fcntl(Fcntl::F_GETFL, 0) & Fcntl::O_NONBLOCK == 0
+    if respond_to?(:fcntl) and defined?(Fcntl) and defined?(Fcntl::F_GETFL) and defined?(Fcntl::O_NONBLOCK)
+      fcntl(Fcntl::F_GETFL, 0) & Fcntl::O_NONBLOCK == 0
+    end
   end
 
   def will_block= (wants_blocking)
-    require "fcntl"
-    flags = fcntl(Fcntl::F_GETFL, 0)
-    if wants_blocking
-      flags &= ~Fcntl::O_NONBLOCK
-    else
-      flags |= Fcntl::O_NONBLOCK
+    if respond_to?(:fcntl) and defined?(Fcntl) and defined?(Fcntl::F_GETFL) and defined?(Fcntl::O_NONBLOCK)
+      flags = fcntl(Fcntl::F_GETFL, 0)
+      if wants_blocking
+        flags &= ~Fcntl::O_NONBLOCK
+      else
+        flags |= Fcntl::O_NONBLOCK
+      end
+      fcntl(Fcntl::F_SETFL, flags)
     end
-    fcntl(Fcntl::F_SETFL, flags)
   end
 end
 
diff --git a/lib/puppet/feature/base.rb b/lib/puppet/feature/base.rb
index c153fba98..c983f5c12 100644
--- a/lib/puppet/feature/base.rb
+++ b/lib/puppet/feature/base.rb
@@ -27,7 +27,8 @@ Puppet.features.add :diff, :libs => %w{diff/lcs diff/lcs/hunk}
 Puppet.features.add(:augeas, :libs => ["augeas"])
 
 # We have RRD available
-Puppet.features.add(:rrd, :libs => ["RRDtool"])
+Puppet.features.add(:rrd_legacy, :libs => ["RRDtool"])
+Puppet.features.add(:rrd, :libs => ["RRD"])
 
 # We have OpenSSL
 Puppet.features.add(:openssl, :libs => ["openssl"])
diff --git a/lib/puppet/feature/rails.rb b/lib/puppet/feature/rails.rb
index e0e14ebeb..74ed09aa6 100644
--- a/lib/puppet/feature/rails.rb
+++ b/lib/puppet/feature/rails.rb
@@ -24,9 +24,7 @@ Puppet.features.add(:rails) do
     end
   end
 
-  if ! (defined?(::ActiveRecord) and defined?(::ActiveRecord::VERSION) and defined?(::ActiveRecord::VERSION::MAJOR) and defined?(::ActiveRecord::VERSION::MINOR))
-    false
-  elsif ! (::ActiveRecord::VERSION::MAJOR == 2 and ::ActiveRecord::VERSION::MINOR >= 1)
+  unless (Puppet::Util.activerecord_version >= 2.1)
     Puppet.info "ActiveRecord 2.1 or later required for StoreConfigs"
     false
   else
diff --git a/lib/puppet/network/http/webrick/rest.rb b/lib/puppet/network/http/webrick/rest.rb
index 91008aa1a..d5c146d88 100644
--- a/lib/puppet/network/http/webrick/rest.rb
+++ b/lib/puppet/network/http/webrick/rest.rb
@@ -1,5 +1,6 @@
 require 'puppet/network/http/handler'
 require 'resolv'
+require 'webrick'
 
 class Puppet::Network::HTTP::WEBrickREST < WEBrick::HTTPServlet::AbstractServlet
 
diff --git a/lib/puppet/network/http_pool.rb b/lib/puppet/network/http_pool.rb
index a3b055572..7d227b4d4 100644
--- a/lib/puppet/network/http_pool.rb
+++ b/lib/puppet/network/http_pool.rb
@@ -58,18 +58,6 @@ module Puppet::Network::HttpPool
     http.cert = ssl_host.certificate.content
     http.verify_mode = OpenSSL::SSL::VERIFY_PEER
     http.key = ssl_host.key.content
-    http.verify_callback = self.method(:ssl_verify_callback).to_proc if Puppet[:debug]
-  end
-
-  def self.ssl_verify_callback(peer_ok, x509_store_ctx)
-    if not peer_ok
-      Puppet.debug "OpenSSL: Error(#{x509_store_ctx.error}): #{x509_store_ctx.error_string}"
-      Puppet.debug "OpenSSL: Cert: #{x509_store_ctx.current_cert.issuer}"
-      Puppet.debug "OpenSSL: Current CRL: #{x509_store_ctx.current_crl}"
-      Puppet.debug "OpenSSL: Chain:"
-      x509_store_ctx.chain.each_index { |i| Puppet.debug "OpenSSL: \t#{i} #{x509_store_ctx.chain[i].issuer}" }
-    end
-    peer_ok
   end
 
   # Retrieve a cached http instance if caching is enabled, else return
diff --git a/lib/puppet/parser/ast/function.rb b/lib/puppet/parser/ast/function.rb
index 74023f631..80e6e6512 100644
--- a/lib/puppet/parser/ast/function.rb
+++ b/lib/puppet/parser/ast/function.rb
@@ -28,7 +28,7 @@ class Puppet::Parser::AST
       end
 
       # We don't need to evaluate the name, because it's plaintext
-      args = @arguments.safeevaluate(scope)
+      args = @arguments.safeevaluate(scope).map { |x| x == :undef ? '' : x }
 
       scope.send("function_#{@name}", args)
     end
diff --git a/lib/puppet/parser/ast/resource.rb b/lib/puppet/parser/ast/resource.rb
index 0c58538d5..6909c85c2 100644
--- a/lib/puppet/parser/ast/resource.rb
+++ b/lib/puppet/parser/ast/resource.rb
@@ -46,7 +46,6 @@ class Resource < AST::ResourceReference
           :virtual => virt,
           :source => scope.source,
           :scope => scope,
-        
           :strict => true
         )
 
@@ -64,12 +63,9 @@ class Resource < AST::ResourceReference
     if params.is_a?(AST::ASTArray)
       @parameters = params
     else
-
-            @parameters = AST::ASTArray.new(
-                
+      @parameters = AST::ASTArray.new(
         :line => params.line,
         :file => params.file,
-        
         :children => [params]
       )
     end
diff --git a/lib/puppet/parser/functions/extlookup.rb b/lib/puppet/parser/functions/extlookup.rb
index 63d49e563..bc55410b9 100644
--- a/lib/puppet/parser/functions/extlookup.rb
+++ b/lib/puppet/parser/functions/extlookup.rb
@@ -52,7 +52,7 @@ the exact same outcome:
 
    $snmp_contact = extlookup(\"snmp_contact\")
 
-The obove code shows some other features, you can use any fact or variable that
+The above code shows some other features, you can use any fact or variable that
 is in scope by simply using %{varname} in your data files, you can return arrays
 by just having multiple values in the csv after the initial variable name.
 
diff --git a/lib/puppet/parser/functions/versioncmp.rb b/lib/puppet/parser/functions/versioncmp.rb
index 94ba3886f..6091e0923 100644
--- a/lib/puppet/parser/functions/versioncmp.rb
+++ b/lib/puppet/parser/functions/versioncmp.rb
@@ -14,9 +14,9 @@ Where a and b are arbitrary version strings
 
 This functions returns a number:
 
-* > 0 if version a is greater than version b
-* == 0 if both version are equals
-* < 0 if version a is less than version b
+* Greater than 0 if version a is greater than version b
+* Equal to 0 if both version are equals
+* Less than 0 if version a is less than version b
 
 Example:
 
diff --git a/lib/puppet/parser/lexer.rb b/lib/puppet/parser/lexer.rb
index a25a17e3f..9036d652e 100644
--- a/lib/puppet/parser/lexer.rb
+++ b/lib/puppet/parser/lexer.rb
@@ -520,7 +520,7 @@ class Puppet::Parser::Lexer
   def slurpstring(terminators,escapes=%w{ \\  $ ' " n t s }+["\n"],ignore_invalid_escapes=false)
     # we search for the next quote that isn't preceded by a
     # backslash; the caret is there to match empty strings
-    str = @scanner.scan_until(/([^\\]|^)[#{terminators}]/) or lex_error "Unclosed quote after '#{last}' in '#{rest}'"
+    str = @scanner.scan_until(/([^\\]|^|[^\\])([\\]{2})*[#{terminators}]/) or lex_error "Unclosed quote after '#{last}' in '#{rest}'"
     @line += str.count("\n") # literal carriage returns add to the line count.
     str.gsub!(/\\(.)/) {
       ch = $1
diff --git a/lib/puppet/parser/parser_support.rb b/lib/puppet/parser/parser_support.rb
index c0fd37178..c90c1978f 100644
--- a/lib/puppet/parser/parser_support.rb
+++ b/lib/puppet/parser/parser_support.rb
@@ -111,7 +111,7 @@ class Puppet::Parser::Parser
   end
 
   def import(file)
-    known_resource_types.loader.import_if_possible(file, @lexer.file)
+    known_resource_types.loader.import(file, @lexer.file)
   end
 
   def initialize(env)
@@ -215,7 +215,9 @@ class Puppet::Parser::Parser
   end
 
   def parse_ruby_file
-    require self.file
+    # Execute the contents of the file inside its own "main" object so
+    # that it can call methods in the resource type API.
+    Puppet::DSL::ResourceTypeAPI.new.instance_eval(File.read(self.file))
   end
 
   def string=(string)
diff --git a/lib/puppet/parser/resource.rb b/lib/puppet/parser/resource.rb
index 8a5ae886c..c007d4dbe 100644
--- a/lib/puppet/parser/resource.rb
+++ b/lib/puppet/parser/resource.rb
@@ -64,6 +64,7 @@ class Puppet::Parser::Resource < Puppet::Resource
 
   # Retrieve the associated definition and evaluate it.
   def evaluate
+    return if evaluated?
     @evaluated = true
     if klass = resource_type and ! builtin_type?
       finish
@@ -93,6 +94,7 @@ class Puppet::Parser::Resource < Puppet::Resource
     @finished = true
     add_defaults
     add_metaparams
+    add_scope_tags
     validate
   end
 
@@ -259,6 +261,12 @@ class Puppet::Parser::Resource < Puppet::Resource
     end
   end
 
+  def add_scope_tags
+    if scope_resource = scope.resource
+      tag(*scope_resource.tags)
+    end
+  end
+
   # Accept a parameter from an override.
   def override_parameter(param)
     # This can happen if the override is defining a new parameter, rather
diff --git a/lib/puppet/parser/type_loader.rb b/lib/puppet/parser/type_loader.rb
index 09aa636e1..bae560381 100644
--- a/lib/puppet/parser/type_loader.rb
+++ b/lib/puppet/parser/type_loader.rb
@@ -3,25 +3,56 @@ require 'puppet/node/environment'
 class Puppet::Parser::TypeLoader
   include Puppet::Node::Environment::Helper
 
-  class Helper < Hash
+  # Helper class that makes sure we don't try to import the same file
+  # more than once from either the same thread or different threads.
+  class Helper
     include MonitorMixin
-    def done_with(item)
-      synchronize do
-        delete(item)[:busy].signal if self.has_key?(item) and self[item][:loader] == Thread.current
-      end
+    def initialize
+      super
+      # These hashes are indexed by filename
+      @state = {} # :doing or :done
+      @thread = {} # if :doing, thread that's doing the parsing
+      @cond_var = {} # if :doing, condition var that will be signaled when done.
     end
-    def owner_of(item)
-      synchronize do
-        if !self.has_key? item
-          self[item] = { :loader => Thread.current, :busy => self.new_cond}
-          :nobody
-        elsif self[item][:loader] == Thread.current
-          :this_thread
+
+    # Execute the supplied block exactly once per file, no matter how
+    # many threads have asked for it to run.  If another thread is
+    # already executing it, wait for it to finish.  If this thread is
+    # already executing it, return immediately without executing the
+    # block.
+    #
+    # Note: the reason for returning immediately if this thread is
+    # already executing the block is to handle the case of a circular
+    # import--when this happens, we attempt to recursively re-parse a
+    # file that we are already in the process of parsing.  To prevent
+    # an infinite regress we need to simply do nothing when the
+    # recursive import is attempted.
+    def do_once(file)
+      need_to_execute = synchronize do
+        case @state[file]
+        when :doing
+          if @thread[file] != Thread.current
+            @cond_var[file].wait
+          end
+          false
+        when :done
+          false
         else
-          flag = self[item][:busy]
-          flag.wait
-          flag.signal
-          :another_thread
+          @state[file] = :doing
+          @thread[file] = Thread.current
+          @cond_var[file] = new_cond
+          true
+        end
+      end
+      if need_to_execute
+        begin
+          yield
+        ensure
+          synchronize do
+            @state[file] = :done
+            @thread.delete(file)
+            @cond_var.delete(file).broadcast
+          end
         end
       end
     end
@@ -51,8 +82,7 @@ class Puppet::Parser::TypeLoader
       unless file =~ /^#{File::SEPARATOR}/
         file = File.join(dir, file)
       end
-      unless imported? file
-        @imported[file] = true
+      @loading_helper.do_once(file) do
         parse_file(file)
       end
     end
@@ -60,27 +90,20 @@ class Puppet::Parser::TypeLoader
     modname
   end
 
-  def imported?(file)
-    @imported.has_key?(file)
-  end
-
   def known_resource_types
     environment.known_resource_types
   end
 
   def initialize(env)
     self.environment = env
-    @loaded = {}
-    @loading = Helper.new
-
-    @imported = {}
+    @loading_helper = Helper.new
   end
 
   def load_until(namespaces, name)
     return nil if name == "" # special-case main.
     name2files(namespaces, name).each do |filename|
       modname = begin
-        import_if_possible(filename)
+        import(filename)
       rescue Puppet::ImportError => detail
         # We couldn't load the item
         # I'm not convienced we should just drop these errors, but this
@@ -96,10 +119,6 @@ class Puppet::Parser::TypeLoader
     nil
   end
 
-  def loaded?(name)
-    @loaded.include?(name)
-  end
-
   def name2files(namespaces, name)
     return [name.sub(/^::/, '').gsub("::", File::SEPARATOR)] if name =~ /^::/
 
@@ -126,21 +145,4 @@ class Puppet::Parser::TypeLoader
     parser.file = file
     parser.parse
   end
-
-  # Utility method factored out of load for handling thread-safety.
-  # This isn't tested in the specs, because that's basically impossible.
-  def import_if_possible(file, current_file = nil)
-    @loaded[file] || begin
-      case @loading.owner_of(file)
-      when :this_thread
-        nil
-      when :another_thread
-        import_if_possible(file,current_file)
-      when :nobody
-        @loaded[file] = import(file,current_file)
-      end
-    ensure
-      @loading.done_with(file)
-    end
-  end
 end
diff --git a/lib/puppet/provider/nameservice.rb b/lib/puppet/provider/nameservice.rb
index 7339b646e..9830fab54 100644
--- a/lib/puppet/provider/nameservice.rb
+++ b/lib/puppet/provider/nameservice.rb
@@ -165,6 +165,7 @@ class Puppet::Provider::NameService < Puppet::Provider
 
     begin
       execute(self.addcmd)
+      execute(self.passcmd) if self.feature? :manages_password_age
     rescue Puppet::ExecutionFailure => detail
       raise Puppet::Error, "Could not create #{@resource.class.name} #{@resource.name}: #{detail}"
     end
diff --git a/lib/puppet/provider/nameservice/objectadd.rb b/lib/puppet/provider/nameservice/objectadd.rb
index 80c142982..dbb9f306f 100644
--- a/lib/puppet/provider/nameservice/objectadd.rb
+++ b/lib/puppet/provider/nameservice/objectadd.rb
@@ -13,7 +13,8 @@ class ObjectAdd < Puppet::Provider::NameService
   end
 
   def modifycmd(param, value)
-    cmd = [command(:modify), flag(param), value]
+    cmd = [command(param.to_s =~ /password_.+_age/ ? :password : :modify)]
+    cmd << flag(param) << value
     if @resource.allowdupe? && ((param == :uid) || (param == :gid and self.class.name == :groupadd))
       cmd << "-o"
     end
diff --git a/lib/puppet/provider/package/rpm.rb b/lib/puppet/provider/package/rpm.rb
index 72dc260a4..ec6121743 100755
--- a/lib/puppet/provider/package/rpm.rb
+++ b/lib/puppet/provider/package/rpm.rb
@@ -60,7 +60,8 @@ Puppet::Type.type(:package).provide :rpm, :source => :rpm, :parent => Puppet::Pr
     begin
       output = rpm(*cmd)
     rescue Puppet::ExecutionFailure
-      return nil
+      # rpm exits 1 if the package is not found.
+      return {:ensure => :purged, :status => 'missing', :name => @resource[:name], :error => 'ok'}    
     end
 
     # FIXME: We could actually be getting back multiple packages
diff --git a/lib/puppet/provider/service/freebsd.rb b/lib/puppet/provider/service/freebsd.rb
index 10970e4da..c75c3c9ab 100644
--- a/lib/puppet/provider/service/freebsd.rb
+++ b/lib/puppet/provider/service/freebsd.rb
@@ -78,7 +78,7 @@ Puppet::Type.type(:service).provide :freebsd, :parent => :init do
 
   # Add a new setting to the rc files
   def rc_add(service, rcvar, yesno)
-    append = "\n\# Added by Puppet\n#{rcvar}_enable=\"#{yesno}\""
+    append = "\# Added by Puppet\n#{rcvar}_enable=\"#{yesno}\"\n"
     # First, try the one-file-per-service style
     if File.exists?(@@rcconf_dir)
       File.open(@@rcconf_dir + "/#{service}", File::WRONLY | File::APPEND | File::CREAT, 0644) {
diff --git a/lib/puppet/provider/service/launchd.rb b/lib/puppet/provider/service/launchd.rb
index 970359539..b296e0a38 100644
--- a/lib/puppet/provider/service/launchd.rb
+++ b/lib/puppet/provider/service/launchd.rb
@@ -38,6 +38,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
 
   commands :launchctl => "/bin/launchctl"
   commands :sw_vers => "/usr/bin/sw_vers"
+  commands :plutil => "/usr/bin/plutil"
 
   defaultfor :operatingsystem => :darwin
   confine :operatingsystem => :darwin
@@ -52,6 +53,12 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
   Launchd_Overrides = "/var/db/launchd.db/com.apple.launchd/overrides.plist"
 
 
+  # Read a plist, whether its format is XML or in Apple's "binary1"
+  # format.
+  def self.read_plist(path)
+    Plist::parse_xml(plutil('-convert', 'xml1', '-o', '-', path))
+  end
+
   # returns a label => path map for either all jobs, or just a single
   # job if the label is specified
   def self.jobsearch(label=nil)
@@ -62,8 +69,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
           next if f =~ /^\..*$/
           next if FileTest.directory?(f)
           fullpath = File.join(path, f)
-          job = Plist::parse_xml(fullpath)
-          if job and job.has_key?("Label")
+          if FileTest.file?(fullpath) and job = read_plist(fullpath) and job.has_key?("Label")
             if job["Label"] == label
               return { label => fullpath }
             else
@@ -118,8 +124,11 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
   def plist_from_label(label)
     job = self.class.jobsearch(label)
     job_path = job[label]
-    job_plist = Plist::parse_xml(job_path)
-    raise Puppet::Error.new("Unable to parse launchd plist at path: #{job_path}") if not job_plist
+    if FileTest.file?(job_path)
+      job_plist = self.class.read_plist(job_path)
+    else
+      raise Puppet::Error.new("Unable to parse launchd plist at path: #{job_path}")
+    end
     [job_path, job_plist]
   end
 
@@ -200,9 +209,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
     job_plist_disabled = job_plist["Disabled"] if job_plist.has_key?("Disabled")
 
     if self.class.get_macosx_version_major == "10.6":
-      overrides = Plist::parse_xml(Launchd_Overrides)
-
-      unless overrides.nil?
+      if FileTest.file?(Launchd_Overrides) and overrides = self.class.read_plist(Launchd_Overrides)
         if overrides.has_key?(resource[:name])
           overrides_disabled = overrides[resource[:name]]["Disabled"] if overrides[resource[:name]].has_key?("Disabled")
         end
@@ -227,7 +234,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
   # versions this is stored in the job plist itself.
   def enable
     if self.class.get_macosx_version_major == "10.6"
-      overrides = Plist::parse_xml(Launchd_Overrides)
+      overrides = self.class.read_plist(Launchd_Overrides)
       overrides[resource[:name]] = { "Disabled" => false }
       Plist::Emit.save_plist(overrides, Launchd_Overrides)
     else
@@ -242,7 +249,7 @@ Puppet::Type.type(:service).provide :launchd, :parent => :base do
 
   def disable
     if self.class.get_macosx_version_major == "10.6"
-      overrides = Plist::parse_xml(Launchd_Overrides)
+      overrides = self.class.read_plist(Launchd_Overrides)
       overrides[resource[:name]] = { "Disabled" => true }
       Plist::Emit.save_plist(overrides, Launchd_Overrides)
     else
diff --git a/lib/puppet/provider/ssh_authorized_key/parsed.rb b/lib/puppet/provider/ssh_authorized_key/parsed.rb
index 82f6b8881..6a3855c0e 100644
--- a/lib/puppet/provider/ssh_authorized_key/parsed.rb
+++ b/lib/puppet/provider/ssh_authorized_key/parsed.rb
@@ -61,6 +61,13 @@ require 'puppet/provider/parsedfile'
       Dir.mkdir(dir, dir_perm)
       File.chown(uid, nil, dir)
     end
+
+    # ParsedFile usually calls backup_target much later in the flush process,
+    # but our SUID makes that fail to open filebucket files for writing.
+    # Fortunately, there's already logic to make sure it only ever happens once,
+    # so calling it here supresses the later attempt by our superclass's flush method.
+    self.class.backup_target(target)
+
     Puppet::Util::SUIDManager.asuser(@resource.should(:user)) { super }
     File.chown(uid, nil, target)
     File.chmod(file_perm, target)
diff --git a/lib/puppet/provider/user/hpux.rb b/lib/puppet/provider/user/hpux.rb
index 50506c4cd..983970935 100644
--- a/lib/puppet/provider/user/hpux.rb
+++ b/lib/puppet/provider/user/hpux.rb
@@ -26,5 +26,4 @@ Puppet::Type.type(:user).provide :hpuxuseradd, :parent => :useradd do
   def modifycmd(param,value)
     super.insert(1,"-F")
   end
-
 end
diff --git a/lib/puppet/provider/user/user_role_add.rb b/lib/puppet/provider/user/user_role_add.rb
index c13125925..7e7ad78e5 100644
--- a/lib/puppet/provider/user/user_role_add.rb
+++ b/lib/puppet/provider/user/user_role_add.rb
@@ -6,13 +6,15 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
 
   defaultfor :operatingsystem => :solaris
 
-  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :role_add => "roleadd", :role_delete => "roledel", :role_modify => "rolemod"
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage", :role_add => "roleadd", :role_delete => "roledel", :role_modify => "rolemod"
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos
   options :groups, :flag => "-G"
   options :roles, :flag => "-R"
   options :auths, :flag => "-A"
   options :profiles, :flag => "-P"
+  options :password_min_age, :flag => "-m"
+  options :password_max_age, :flag => "-M"
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
@@ -22,14 +24,14 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     value !~ /\s/
   end
 
-  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords
+  has_features :manages_homedir, :allows_duplicates, :manages_solaris_rbac, :manages_passwords, :manages_password_age
 
   #must override this to hand the keyvalue pairs
   def add_properties
     cmd = []
     Puppet::Type.type(:user).validproperties.each do |property|
       #skip the password because we can't create it with the solaris useradd
-      next if [:ensure, :password].include?(property)
+      next if [:ensure, :password, :password_min_age, :password_max_age].include?(property)
       # 1680 Now you can set the hashed passwords on solaris:lib/puppet/provider/user/user_role_add.rb
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
@@ -79,6 +81,7 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
       run(transition("normal"), "transition role to")
     else
       run(addcmd, "create")
+      run(passcmd, "change password policy for")
     end
     # added to handle case when password is specified
     self.password = @resource[:password] if @resource[:password]
@@ -140,14 +143,23 @@ Puppet::Type.type(:user).provide :user_role_add, :parent => :useradd, :source =>
     run([command(:modify)] + build_keys_cmd(keys_hash) << @resource[:name], "modify attribute key pairs")
   end
 
-  #Read in /etc/shadow, find the line for this user (skipping comments, because who knows) and return the hashed pw (the second entry)
+  #Read in /etc/shadow, find the line for this user (skipping comments, because who knows) and return it
   #No abstraction, all esoteric knowledge of file formats, yay
+  def shadow_entry
+    return @shadow_entry if defined? @shadow_entry
+    @shadow_entry = File.readlines("/etc/shadow").reject { |r| r =~ /^[^\w]/ }.collect { |l| l.chomp.split(':') }.find { |user, _| user == @resource[:name] }
+  end
+
   def password
-    #got perl?
-    if ary = File.readlines("/etc/shadow").reject { |r| r =~ /^[^\w]/}.collect { |l| l.split(':')[0..1] }.find { |user, passwd| user == @resource[:name] }
-      pass = ary[1]
-    end
-    pass
+    shadow_entry[1] if shadow_entry
+  end
+
+  def min_age
+    shadow_entry ? shadow_entry[3] : :absent
+  end
+
+  def max_age
+    shadow_entry ? shadow_entry[4] : :absent
   end
 
   #Read in /etc/shadow, find the line for our used and rewrite it with the new pw
diff --git a/lib/puppet/provider/user/useradd.rb b/lib/puppet/provider/user/useradd.rb
index 7ef217d9e..9a62db464 100644
--- a/lib/puppet/provider/user/useradd.rb
+++ b/lib/puppet/provider/user/useradd.rb
@@ -3,11 +3,13 @@ require 'puppet/provider/nameservice/objectadd'
 Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameService::ObjectAdd do
   desc "User management via `useradd` and its ilk.  Note that you will need to install the `Shadow Password` Ruby library often known as ruby-libshadow to manage user passwords."
 
-  commands :add => "useradd", :delete => "userdel", :modify => "usermod"
+  commands :add => "useradd", :delete => "userdel", :modify => "usermod", :password => "chage"
 
   options :home, :flag => "-d", :method => :dir
   options :comment, :method => :gecos
   options :groups, :flag => "-G"
+  options :password_min_age, :flag => "-m"
+  options :password_max_age, :flag => "-M"
 
   verify :gid, "GID must be an integer" do |value|
     value.is_a? Integer
@@ -17,9 +19,9 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     value !~ /\s/
   end
 
-  has_features :manages_homedir, :allows_duplicates
+  has_features :manages_homedir, :allows_duplicates, :manages_expiry
 
-  has_feature :manages_passwords if Puppet.features.libshadow?
+  has_features :manages_passwords, :manages_password_age if Puppet.features.libshadow?
 
   def check_allow_dup
     @resource.allowdupe? ? ["-o"] : []
@@ -35,10 +37,20 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     cmd
   end
 
+  def check_manage_expiry
+    cmd = []
+    if @resource[:expiry]
+      cmd << "-e #{@resource[:expiry]}"
+    end
+
+    cmd
+  end
+
   def add_properties
     cmd = []
     Puppet::Type.type(:user).validproperties.each do |property|
       next if property == :ensure
+      next if property.to_s =~ /password_.+_age/
       # the value needs to be quoted, mostly because -c might
       # have spaces in it
       if value = @resource.should(property) and value != ""
@@ -53,9 +65,38 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     cmd += add_properties
     cmd += check_allow_dup
     cmd += check_manage_home
+    cmd += check_manage_expiry
     cmd << @resource[:name]
   end
 
+  def passcmd
+    cmd = [command(:password)]
+    [:password_min_age, :password_max_age].each do |property|
+      if value = @resource.should(property)
+        cmd << flag(property) << value
+      end
+    end
+    cmd << @resource[:name]
+  end
+
+  def min_age
+    if Puppet.features.libshadow?
+      if ent = Shadow::Passwd.getspnam(@resource.name)
+        return ent.sp_min
+      end
+    end
+    :absent
+  end
+
+  def max_age
+    if Puppet.features.libshadow?
+      if ent = Shadow::Passwd.getspnam(@resource.name)
+        return ent.sp_max
+      end
+    end
+    :absent
+  end
+
   # Retrieve the password using the Shadow Password library
   def password
     if Puppet.features.libshadow?
diff --git a/lib/puppet/rails.rb b/lib/puppet/rails.rb
index 414b1bc18..c2d492fdd 100644
--- a/lib/puppet/rails.rb
+++ b/lib/puppet/rails.rb
@@ -2,6 +2,7 @@
 
 require 'facter'
 require 'puppet'
+require 'logger'
 
 module Puppet::Rails
   TIME_DEBUG = true
@@ -22,9 +23,8 @@ module Puppet::Rails
       ActiveRecord::Base.logger.level = Logger::DEBUG
     end
 
-    if (::ActiveRecord::VERSION::MAJOR == 2 and ::ActiveRecord::VERSION::MINOR <= 1)
-      ActiveRecord::Base.allow_concurrency = true
-    end
+    # As of ActiveRecord 2.2 allow_concurrency has been deprecated and no longer has any effect.
+    ActiveRecord::Base.allow_concurrency = true if Puppet::Util.activerecord_version < 2.2
 
     ActiveRecord::Base.verify_active_connections!
 
diff --git a/lib/puppet/reference/configuration.rb b/lib/puppet/reference/configuration.rb
index fadd1a423..e6a8dc20f 100644
--- a/lib/puppet/reference/configuration.rb
+++ b/lib/puppet/reference/configuration.rb
@@ -42,11 +42,10 @@ config = Puppet::Util::Reference.newreference(:configuration, :depth => 1, :doc
 end
 
 config.header = "
-Specifying Configuration Parameters
------------------------------------
+## Specifying Configuration Parameters
+
+### On The Command-Line
 
-On The Command-Line
-+++++++++++++++++++
 Every Puppet executable (with the exception of `puppetdoc`) accepts all of
 the parameters below, but not all of the arguments make sense for every executable.
 
@@ -69,8 +68,7 @@ syntax on the command line:
 The invocations above will enable and disable, respectively, the storage of
 the client configuration.
 
-Configuration Files
-+++++++++++++++++++
+### Configuration Files
 
 As mentioned above, the configuration parameters can also be stored in a
 configuration file, located in the configuration directory.  As root, the
@@ -84,8 +82,7 @@ executables look for `puppet.conf` in their configuration directory
 All executables will set any parameters set within the `[main]` section,
 and each executable will also use one of the `[master]`, `[agent]`.
 
-File Format
-'''''''''''
+#### File Format
 
 The file follows INI-style formatting.  Here is an example of a very simple
 `puppet.conf` file:
@@ -127,8 +124,7 @@ and one `puppet` user) if it is invoked as `root` with the `--mkusers` argument:
 
     $ puppet agent --mkusers
 
-Signals
--------
+## Signals
 
 The `puppet agent` and `puppet master` executables catch some signals for special
 handling.  Both daemons catch (`SIGHUP`), which forces the server to restart
@@ -139,8 +135,7 @@ Sending the `SIGUSR1` signal to an instance of `puppet agent` will cause it to
 immediately begin a new configuration transaction with the server.  This
 signal has no effect on `puppet master`.
 
-Configuration Parameter Reference
----------------------------------
+## Configuration Parameter Reference
 
 Below is a list of all documented parameters.  Not all of them are valid with all
 Puppet executables, but the executables will ignore any inappropriate values.
diff --git a/lib/puppet/reference/indirection.rb b/lib/puppet/reference/indirection.rb
index 0cdbb2510..e5b076508 100644
--- a/lib/puppet/reference/indirection.rb
+++ b/lib/puppet/reference/indirection.rb
@@ -8,12 +8,12 @@ reference = Puppet::Util::Reference.newreference :indirection, :doc => "Indirect
   Puppet::Indirector::Indirection.instances.sort { |a,b| a.to_s <=> b.to_s }.each do |indirection|
     ind = Puppet::Indirector::Indirection.instance(indirection)
     name = indirection.to_s.capitalize
-    text += indirection.to_s + "\n" + ("-" * name.length) + "\n\n"
+    text += "## " + indirection.to_s + "\n\n"
 
     text += ind.doc + "\n\n"
 
     Puppet::Indirector::Terminus.terminus_classes(ind.name).sort { |a,b| a.to_s <=> b.to_s }.each do |terminus|
-      text += terminus.to_s + "\n" + ("+" * terminus.to_s.length) + "\n\n"
+      text += "### " + terminus.to_s + "\n\n"
 
       term_class = Puppet::Indirector::Terminus.terminus_class(ind.name, terminus)
 
diff --git a/lib/puppet/reference/metaparameter.rb b/lib/puppet/reference/metaparameter.rb
index 39c4b7f5f..c16a1d33a 100644
--- a/lib/puppet/reference/metaparameter.rb
+++ b/lib/puppet/reference/metaparameter.rb
@@ -9,16 +9,17 @@ metaparameter = Puppet::Util::Reference.newreference :metaparameter, :doc => "Al
   }
 
   str = %{
-    Metaparameters
-    --------------
-    Metaparameters are parameters that work with any resource type; they are part of the
-    Puppet framework itself rather than being part of the implementation of any
-    given instance.  Thus, any defined metaparameter can be used with any instance
-    in your manifest, including defined components.
 
-    Available Metaparameters
-    ++++++++++++++++++++++++
-    }
+# Metaparameters
+    
+Metaparameters are parameters that work with any resource type; they are part of the 
+Puppet framework itself rather than being part of the implementation of any
+given instance.  Thus, any defined metaparameter can be used with any instance
+in your manifest, including defined components.
+
+## Available Metaparameters
+
+}
   begin
     params = []
     Puppet::Type.eachmetaparam { |param|
diff --git a/lib/puppet/reference/type.rb b/lib/puppet/reference/type.rb
index 2378bb83a..b423387e9 100644
--- a/lib/puppet/reference/type.rb
+++ b/lib/puppet/reference/type.rb
@@ -5,15 +5,15 @@ type = Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource
   Puppet::Type.eachtype { |type|
     next if type.name == :puppet
     next if type.name == :component
+    next if type.name == :whit
     types[type.name] = type
   }
 
   str = %{
 
-    Resource Types
-    --------------
+## Resource Types
 
-    - The *namevar* is the parameter used to uniquely identify a type instance.
+- The *namevar* is the parameter used to uniquely identify a type instance.
   This is the parameter that gets assigned when a string is provided before
   the colon in a type declaration.  In general, only developers will need to
   worry about which parameter is the `namevar`.
@@ -30,11 +30,11 @@ type = Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource
   dependency handling), and because `path` is the namevar for `file`, that
   string is assigned to the `path` parameter.
 
-  - *Parameters* determine the specific configuration of the instance.  They either
+- *Parameters* determine the specific configuration of the instance.  They either
   directly modify the system (internally, these are called properties) or they affect
   how the instance behaves (e.g., adding a search path for `exec` instances or determining recursion on `file` instances).
 
-  - *Providers* provide low-level functionality for a given resource type.  This is
+- *Providers* provide low-level functionality for a given resource type.  This is
   usually in the form of calling out to external commands.
 
   When required binaries are specified for providers, fully qualifed paths
@@ -42,7 +42,7 @@ type = Puppet::Util::Reference.newreference :type, :doc => "All Puppet resource
   binaries indicate that Puppet will search for the binary using the shell
   path.
 
-  - *Features* are abilities that some providers might not support.  You can use the list
+- *Features* are abilities that some providers might not support.  You can use the list
   of supported features to determine how a given provider can be used.
 
   Resource types define features they can use, and providers can be tested to see
diff --git a/lib/puppet/reports/rrdgraph.rb b/lib/puppet/reports/rrdgraph.rb
index 2357e233e..517fa8f03 100644
--- a/lib/puppet/reports/rrdgraph.rb
+++ b/lib/puppet/reports/rrdgraph.rb
@@ -122,7 +122,7 @@ Puppet::Reports.register_report(:rrdgraph) do
   # that means we record the total time, the config time, and that's about
   # it.  We should probably send each type's time as a separate metric.
   def timeclean(metric)
-    metric.values = metric.values.find_all { |name, label, value| [:total, :config_retrieval].include?(name) }
+    metric.values = metric.values.find_all { |name, label, value| ['total', 'config_retrieval'].include?(name.to_s) }
   end
 end
 
diff --git a/lib/puppet/reports/tagmail.rb b/lib/puppet/reports/tagmail.rb
index 71bafb2da..e17143e2f 100644
--- a/lib/puppet/reports/tagmail.rb
+++ b/lib/puppet/reports/tagmail.rb
@@ -84,7 +84,7 @@ Puppet::Reports.register_report(:tagmail) do
       pos = []
       neg = []
       taglist.sub(/\s+$/,'').split(/\s*,\s*/).each do |tag|
-        unless tag =~ /^!?[-\w]+$/
+        unless tag =~ /^!?[-\w\.]+$/
           raise ArgumentError, "Invalid tag #{tag.inspect}"
         end
         case tag
diff --git a/lib/puppet/ssl/certificate_request.rb b/lib/puppet/ssl/certificate_request.rb
index e4d06a039..2f6cae3f5 100644
--- a/lib/puppet/ssl/certificate_request.rb
+++ b/lib/puppet/ssl/certificate_request.rb
@@ -29,7 +29,7 @@ class Puppet::SSL::CertificateRequest < Puppet::SSL::Base
     # Support either an actual SSL key, or a Puppet key.
     key = key.content if key.is_a?(Puppet::SSL::Key)
 
-    # If we're a CSR for the CA, then use the real certname, rather than the
+    # If we're a CSR for the CA, then use the real ca_name, rather than the
     # fake 'ca' name.  This is mostly for backward compatibility with 0.24.x,
     # but it's also just a good idea.
     common_name = name == Puppet::SSL::CA_NAME ? Puppet.settings[:ca_name] : name
diff --git a/lib/puppet/sslcertificates/ca.rb b/lib/puppet/sslcertificates/ca.rb
index 63e6b922a..f3321bd29 100644
--- a/lib/puppet/sslcertificates/ca.rb
+++ b/lib/puppet/sslcertificates/ca.rb
@@ -147,21 +147,19 @@ class Puppet::SSLCertificates::CA
 
   # Create the root certificate.
   def mkrootcert
-    # Make the root cert's name the FQDN of the host running the CA.
-    name = Facter["hostname"].value
+    # Make the root cert's name "Puppet CA: " plus the FQDN of the host running the CA.
+    name = "Puppet CA: #{Facter["hostname"].value}"
     if domain = Facter["domain"].value
       name += ".#{domain}"
     end
 
-          cert = Certificate.new(
-                
+    cert = Certificate.new(
       :name => name,
       :cert => @config[:cacert],
       :encrypt => @config[:capass],
       :key => @config[:cakey],
       :selfsign => true,
       :ttl => ttl,
-        
       :type => :ca
     )
 
@@ -241,19 +239,15 @@ class Puppet::SSLCertificates::CA
       f << "%04X" % (serial + 1)
     }
 
-
-          newcert = Puppet::SSLCertificates.mkcert(
-                
+    newcert = Puppet::SSLCertificates.mkcert(
       :type => :server,
       :name => csr.subject,
       :ttl => ttl,
       :issuer => @cert,
       :serial => serial,
-        
       :publickey => csr.public_key
     )
 
-
     sign_with_key(newcert)
 
     self.storeclientcert(newcert)
diff --git a/lib/puppet/type.rb b/lib/puppet/type.rb
index f9aacece8..1b6e7dcd7 100644
--- a/lib/puppet/type.rb
+++ b/lib/puppet/type.rb
@@ -965,7 +965,7 @@ class Type
       the value, and any changes already get logged."
 
     validate do |list|
-      list = Array(list)
+      list = Array(list).collect {|p| p.to_sym}
       unless list == [:all]
         list.each do |param|
           next if @resource.class.validattr?(param)
@@ -990,8 +990,8 @@ class Type
     end
 
     def properties_to_audit(list)
-      if list == :all
-        list = all_properties if list == :all
+      if !list.kind_of?(Array) && list.to_sym == :all
+        list = all_properties
       else
         list = Array(list).collect { |p| p.to_sym }
       end
diff --git a/lib/puppet/type/cron.rb b/lib/puppet/type/cron.rb
index c42f0df55..76399d693 100755
--- a/lib/puppet/type/cron.rb
+++ b/lib/puppet/type/cron.rb
@@ -230,7 +230,7 @@ Puppet::Type.newtype(:cron) do
   end
 
   newproperty(:special) do
-    desc "Special schedules only supported on FreeBSD."
+    desc "Special schedules"
 
     def specials
       %w{reboot yearly annually monthly weekly daily midnight hourly}
diff --git a/lib/puppet/type/tidy.rb b/lib/puppet/type/tidy.rb
index 64a7a1a88..65cc077cf 100755
--- a/lib/puppet/type/tidy.rb
+++ b/lib/puppet/type/tidy.rb
@@ -1,5 +1,6 @@
 Puppet::Type.newtype(:tidy) do
   require 'puppet/file_serving/fileset'
+  require 'puppet/file_bucket/dipper'
 
   @doc = "Remove unwanted files based on specific criteria.  Multiple
     criteria are OR'd together, so a file that is too large but is not
diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index 007b760bc..c8110bb69 100755
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -24,9 +24,16 @@ module Puppet
       "The provider can modify user passwords, by accepting a password
       hash."
 
+    feature :manages_password_age,
+      "The provider can set age requirements and restrictions for
+      passwords."
+
     feature :manages_solaris_rbac,
       "The provider can manage roles and normal users"
 
+    feature :manages_expiry,
+      "The provider can manage the expiry date for a user."
+
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
@@ -157,6 +164,43 @@ module Puppet
       end
     end
 
+    newproperty(:password_min_age, :required_features => :manages_password_age) do
+      desc "The minimum amount of time in days a password must be used before it may be changed"
+
+      munge do |value|
+        case value
+        when String
+          Integer(value)
+        else
+          value
+        end
+      end
+
+      validate do |value|
+        if value.to_s !~ /^\d+$/
+          raise ArgumentError, "Password minimum age must be provided as a number"
+        end
+      end
+    end
+
+    newproperty(:password_max_age, :required_features => :manages_password_age) do
+      desc "The maximum amount of time in days a password may be used before it must be changed"
+
+      munge do |value|
+        case value
+        when String
+          Integer(value)
+        else
+          value
+        end
+      end
+
+      validate do |value|
+        if value.to_s !~ /^\d+$/
+          raise ArgumentError, "Password maximum age must be provided as a number"
+        end
+      end
+    end
 
     newproperty(:groups, :parent => Puppet::Property::List) do
       desc "The groups of which the user is a member.  The primary
@@ -210,6 +254,17 @@ module Puppet
       end
     end
 
+    newproperty(:expiry, :required_features => :manages_expiry) do
+      desc "The expiry date for this user. Must be provided in
+           a zero padded YYYY-MM-DD format - e.g 2010-02-19."
+
+      validate do |value|
+        if value !~ /^\d{4}-\d{2}-\d{2}$/
+          raise ArgumentError, "Expiry dates must be YYYY-MM-DD"
+        end
+      end
+    end
+
     # Autorequire the group, if it's around
     autorequire(:group) do
       autos = []
diff --git a/lib/puppet/type/whit.rb b/lib/puppet/type/whit.rb
index 6e5ba9eab..55bfcfb46 100644
--- a/lib/puppet/type/whit.rb
+++ b/lib/puppet/type/whit.rb
@@ -4,4 +4,8 @@ Puppet::Type.newtype(:whit) do
   newparam :name do
     desc "The name of the whit, because it must have one."
   end
+
+  def to_s
+    "Class[#{name}]"
+  end
 end
diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index bb4127089..f2eaf0d06 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -20,6 +20,14 @@ module Util
   # Create a hash to store the different sync objects.
   @@syncresources = {}
 
+  def self.activerecord_version
+    if (defined?(::ActiveRecord) and defined?(::ActiveRecord::VERSION) and defined?(::ActiveRecord::VERSION::MAJOR) and defined?(::ActiveRecord::VERSION::MINOR))
+      ([::ActiveRecord::VERSION::MAJOR, ::ActiveRecord::VERSION::MINOR].join('.').to_f)
+    else
+      0
+    end
+  end
+
   # Return the sync object associated with a given resource.
   def self.sync(resource)
     @@syncresources[resource] ||= Sync.new
diff --git a/lib/puppet/util/metric.rb b/lib/puppet/util/metric.rb
index 7e14a5fec..00898472f 100644
--- a/lib/puppet/util/metric.rb
+++ b/lib/puppet/util/metric.rb
@@ -31,9 +31,12 @@ class Puppet::Util::Metric
 
     start ||= Time.now.to_i - 5
 
-    @rrd = RRDtool.new(self.path)
     args = []
 
+    if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+      @rrd = RRDtool.new(self.path)
+    end
+
     values.each { |value|
       # the 7200 is the heartbeat -- this means that any data that isn't
       # more frequently than every two hours gets thrown away
@@ -42,14 +45,22 @@ class Puppet::Util::Metric
     args.push "RRA:AVERAGE:0.5:1:300"
 
     begin
-      @rrd.create( Puppet[:rrdinterval].to_i, start, args)
+      if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+        @rrd.create( Puppet[:rrdinterval].to_i, start, args)
+      else
+        RRD.create( self.path, '-s', Puppet[:rrdinterval].to_i.to_s, '-b', start.to_i.to_s, *args)
+      end
     rescue => detail
       raise "Could not create RRD file #{path}: #{detail}"
     end
   end
 
   def dump
-    puts @rrd.info
+    if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+      puts @rrd.info
+    else
+      puts RRD.info self.path
+    end
   end
 
   def graph(range = nil)
@@ -82,14 +93,26 @@ class Puppet::Util::Metric
       args << lines
       args.flatten!
       if range
-        args.push("--start",range[0],"--end",range[1])
+        if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+          args.push("--start",range[0],"--end",range[1])
+        else
+          args.push("--start",range[0].to_i.to_s,"--end",range[1].to_i.to_s)
+        end
       else
-        args.push("--start", Time.now.to_i - time, "--end", Time.now.to_i)
+        if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+          args.push("--start", Time.now.to_i - time, "--end", Time.now.to_i)
+        else
+          args.push("--start", (Time.now.to_i - time).to_s, "--end", Time.now.to_i.to_s)
+        end
       end
 
       begin
         #Puppet.warning "args = #{args}"
-        RRDtool.graph( args )
+        if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+          RRDtool.graph( args )
+        else
+          RRD.graph( *args )
+        end
       rescue => detail
         Puppet.err "Failed to graph #{self.name}: #{detail}"
       end
@@ -114,13 +137,15 @@ class Puppet::Util::Metric
   end
 
   def store(time)
-    unless Puppet.features.rrd?
+    unless Puppet.features.rrd? || Puppet.features.rrd_legacy?
       Puppet.warning "RRD library is missing; cannot store metrics"
       return
     end
     self.create(time - 5) unless FileTest.exists?(self.path)
 
-    @rrd ||= RRDtool.new(self.path)
+    if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+      @rrd ||= RRDtool.new(self.path)
+    end
 
     # XXX this is not terribly error-resistant
     args = [time]
@@ -133,7 +158,11 @@ class Puppet::Util::Metric
     arg = args.join(":")
     template = temps.join(":")
     begin
-      @rrd.update( template, [ arg ] )
+      if Puppet.features.rrd_legacy? && ! Puppet.features.rrd?
+        @rrd.update( template, [ arg ] )
+      else
+        RRD.update( self.path, '-t', template, arg )
+      end
       #system("rrdtool updatev #{self.path} '#{arg}'")
     rescue => detail
       raise Puppet::Error, "Failed to update #{self.name}: #{detail}"
diff --git a/lib/puppet/util/rdoc/parser.rb b/lib/puppet/util/rdoc/parser.rb
index 63df38ab9..f9becede1 100644
--- a/lib/puppet/util/rdoc/parser.rb
+++ b/lib/puppet/util/rdoc/parser.rb
@@ -33,13 +33,16 @@ class Parser
 
   # main entry point
   def scan
-    Puppet.info "rdoc: scanning #{@input_file_name}"
-    if @input_file_name =~ /\.pp$/
-      @parser = Puppet::Parser::Parser.new(Puppet[:environment])
-      @parser.file = @input_file_name
-      @ast = @parser.parse
+    env = Puppet::Node::Environment.new
+    unless env.known_resource_types.watching_file?(@input_file_name)
+      Puppet.info "rdoc: scanning #{@input_file_name}"
+      if @input_file_name =~ /\.pp$/
+        @parser = Puppet::Parser::Parser.new(env)
+        @parser.file = @input_file_name
+        @ast = @parser.parse
+      end
+      scan_top_level(@top_level)
     end
-    scan_top_level(@top_level)
     @top_level
   end
 
@@ -205,7 +208,7 @@ class Parser
           Puppet.debug "rdoc: found resource: #{type}[#{title}]"
 
           param = []
-          stmt.params.children.each do |p|
+          stmt.parameters.children.each do |p|
             res = {}
             res["name"] = p.param
             res["value"] = "#{p.value.to_s}" unless p.value.nil?
diff --git a/lib/puppet/util/reference.rb b/lib/puppet/util/reference.rb
index 4f2058e69..99458aa57 100644
--- a/lib/puppet/util/reference.rb
+++ b/lib/puppet/util/reference.rb
@@ -32,7 +32,7 @@ class Puppet::Util::Reference
       section = reference(name) or raise "Could not find section #{name}"
       depth = section.depth if section.depth < depth
     end
-    text = "{:toc}\n\n"
+    text = "* TOC text.\n{:toc}\n\n"
   end
 
   def self.pdf(text)
@@ -72,7 +72,7 @@ class Puppet::Util::Reference
     loaded_instances(:reference).sort { |a,b| a.to_s <=> b.to_s }
   end
 
-  HEADER_LEVELS = [nil, "=", "-", "+", "'", "~"]
+  HEADER_LEVELS = [nil, "#", "##", "###", "####", "#####"]
 
   attr_accessor :page, :depth, :header, :title, :dynamic
   attr_writer :doc
@@ -90,7 +90,7 @@ class Puppet::Util::Reference
   end
 
   def h(name, level)
-    "#{name}\n#{HEADER_LEVELS[level] * name.to_s.length}\n\n"
+    "#{HEADER_LEVELS[level]} #{name}\n\n"
   end
 
   def initialize(name, options = {}, &block)
@@ -141,7 +141,7 @@ class Puppet::Util::Reference
     # First the header
     text = h(@title, 1)
     text += "\n\n**This page is autogenerated; any changes will get overwritten** *(last generated on #{Time.now.to_s})*\n\n"
-    text +=  "{:toc}\n\n" if withcontents
+    text +=  "* TOC Text.\n{:toc}\n\n" if withcontents
 
     text += @header
 
diff --git a/lib/puppet/util/zaml.rb b/lib/puppet/util/zaml.rb
index 8ecc2c8bd..64c58f9a3 100644
--- a/lib/puppet/util/zaml.rb
+++ b/lib/puppet/util/zaml.rb
@@ -243,7 +243,6 @@ class String
         when self =~ /\n/
           if self[-1..-1] == "\n" then z.emit('|+') else z.emit('|-') end
           z.nested { split("\n",-1).each { |line| z.nl; z.emit(line.chomp("\n")) } }
-          z.nl
         else
           z.emit(self)
       end