Merge branch '2.6.x' into next

    * 2.6.x: (36 commits)
      Updated CHANGELOG for 2.6.7rc1
      (#5073) Download plugins even if you're filtering on tags
      Fix #5610: Prevent unnecessary RAL lookups
      Revert "Merge branch 'ticket/2.6.x/5605' of git://github.com/stschulte/puppet into 2.6.next"
      (#6723) Fix withenv environment restoration bug
      (#6689) Remove extraneous include of Puppet::Util in InventoryActiveRecord
      Remove extra trailing whitespace from lib/puppet/resource.rb
      (#5428) More fully "stub" Puppet::Resource::Reference for use with storedconfigs
      (#6707) Fix typo in rest_authconfig.rb
      (#6689) Make inventory_active_record terminus search quickly
      (#5392) Give a better error when realizing a non-existant resource
      (#2645) Adding a less-stubby test to verify the "system" attribute's behavior
      Update CHANGELOG for 2.6.6
      maint: Remove serialization of InventoryFact values
      maint: Rename InventoryHost to InventoryNode
      Fixed #2645 - Added support for creating system users
      maint: Remove spec run noise
      maint:Refactor of mount provider integration tests
      (#6338) Support searching on metadata in InventoryActiveRecord terminus
      (#6338) Implement search for InventoryActiveRecord facts terminus
      ...

    This merge includes essentially reverting #4904's change to the mount
    type since tests that came in from 2.6.x specified different
    behavior and what's correct is not clear to me.  I've reopened #4904 and
    added it to our backlog, and talked to Nigel about the RFC that's
    currently out on the puppet-users mailing list for a bigger refactor of
    how the mount provider works.

    Manually Resolved Conflicts:
        spec/spec_helper.rb
        spec/unit/indirector/queue_spec.rb

33 files changed, 333 insertions, 53 deletions

diff --git a/lib/puppet.rb b/lib/puppet.rb
index b13e06b9d..ef5fb7f06 100644
--- a/lib/puppet.rb
+++ b/lib/puppet.rb
@@ -24,7 +24,7 @@ require 'puppet/util/run_mode'
 # it's also a place to find top-level commands like 'debug'
 
 module Puppet
-  PUPPETVERSION = '2.6.6'
+  PUPPETVERSION = '2.6.7'
 
   def Puppet.version
     PUPPETVERSION
diff --git a/lib/puppet/configurer/downloader.rb b/lib/puppet/configurer/downloader.rb
index 1b587ed4b..b3696201a 100644
--- a/lib/puppet/configurer/downloader.rb
+++ b/lib/puppet/configurer/downloader.rb
@@ -50,6 +50,7 @@ class Puppet::Configurer::Downloader
 
   def catalog
     catalog = Puppet::Resource::Catalog.new
+    catalog.host_config = false
     catalog.add_resource(file)
     catalog
   end
diff --git a/lib/puppet/configurer/plugin_handler.rb b/lib/puppet/configurer/plugin_handler.rb
index cfc6b5a0b..ae088f26f 100644
--- a/lib/puppet/configurer/plugin_handler.rb
+++ b/lib/puppet/configurer/plugin_handler.rb
@@ -9,7 +9,14 @@ module Puppet::Configurer::PluginHandler
   # Retrieve facts from the central server.
   def download_plugins
     return nil unless download_plugins?
-    Puppet::Configurer::Downloader.new("plugin", Puppet[:plugindest], Puppet[:pluginsource], Puppet[:pluginsignore]).evaluate.each { |file| load_plugin(file) }
+    plugin_downloader = Puppet::Configurer::Downloader.new(
+      "plugin",
+      Puppet[:plugindest],
+      Puppet[:pluginsource],
+      Puppet[:pluginsignore]
+    )
+
+    plugin_downloader.evaluate.each { |file| load_plugin(file) }
   end
 
   def load_plugin(file)
diff --git a/lib/puppet/indirector/facts/inventory_active_record.rb b/lib/puppet/indirector/facts/inventory_active_record.rb
new file mode 100644
index 000000000..db4c63f00
--- /dev/null
+++ b/lib/puppet/indirector/facts/inventory_active_record.rb
@@ -0,0 +1,97 @@
+require 'puppet/rails'
+require 'puppet/rails/inventory_node'
+require 'puppet/rails/inventory_fact'
+require 'puppet/indirector/active_record'
+
+class Puppet::Node::Facts::InventoryActiveRecord < Puppet::Indirector::ActiveRecord
+  def find(request)
+    node = Puppet::Rails::InventoryNode.find_by_name(request.key)
+    return nil unless node
+    facts = Puppet::Node::Facts.new(node.name, node.facts_to_hash)
+    facts.timestamp = node.timestamp
+    facts
+  end
+
+  def save(request)
+    facts = request.instance
+    node = Puppet::Rails::InventoryNode.find_by_name(request.key) || Puppet::Rails::InventoryNode.create(:name => request.key, :timestamp => facts.timestamp)
+    node.timestamp = facts.timestamp
+
+    ActiveRecord::Base.transaction do
+      Puppet::Rails::InventoryFact.delete_all(:node_id => node.id)
+      # We don't want to save internal values as facts, because those are
+      # metadata that belong on the node
+      facts.values.each do |name,value|
+        next if name.to_s =~ /^_/
+        node.facts.build(:name => name, :value => value)
+      end
+      node.save
+    end
+  end
+
+  def search(request)
+    return [] unless request.options
+    matching_nodes = []
+    fact_names = []
+    fact_filters = Hash.new {|h,k| h[k] = []}
+    meta_filters = Hash.new {|h,k| h[k] = []}
+    request.options.each do |key,value|
+      type, name, operator = key.to_s.split(".")
+      operator ||= "eq"
+      if type == "facts"
+        fact_filters[operator] << [name,value]
+      elsif type == "meta" and name == "timestamp"
+        meta_filters[operator] << [name,value]
+      end
+    end
+
+    matching_nodes = nodes_matching_fact_filters(fact_filters) + nodes_matching_meta_filters(meta_filters)
+
+    # to_a because [].inject == nil
+    matching_nodes.inject {|nodes,this_set| nodes & this_set}.to_a.sort
+  end
+
+  private
+
+  def nodes_matching_fact_filters(fact_filters)
+    node_sets = []
+    fact_filters['eq'].each do |name,value|
+      node_sets << Puppet::Rails::InventoryNode.has_fact_with_value(name,value).map {|node| node.name}
+    end
+    fact_filters['ne'].each do |name,value|
+      node_sets << Puppet::Rails::InventoryNode.has_fact_without_value(name,value).map {|node| node.name}
+    end
+    {
+      'gt' => '>',
+      'lt' => '<',
+      'ge' => '>=',
+      'le' => '<='
+    }.each do |operator_name,operator|
+      fact_filters[operator_name].each do |name,value|
+        facts = Puppet::Rails::InventoryFact.find_by_sql(["SELECT inventory_facts.value, inventory_nodes.name AS node_name
+                                                           FROM inventory_facts INNER JOIN inventory_nodes
+                                                           ON inventory_facts.node_id = inventory_nodes.id
+                                                           WHERE inventory_facts.name = ?", name])
+        node_sets << facts.select {|fact| fact.value.to_f.send(operator, value.to_f)}.map {|fact| fact.node_name}
+      end
+    end
+    node_sets
+  end
+
+  def nodes_matching_meta_filters(meta_filters)
+    node_sets = []
+    {
+      'eq' => '=',
+      'ne' => '!=',
+      'gt' => '>',
+      'lt' => '<',
+      'ge' => '>=',
+      'le' => '<='
+    }.each do |operator_name,operator|
+      meta_filters[operator_name].each do |name,value|
+        node_sets << Puppet::Rails::InventoryNode.find(:all, :select => "name", :conditions => ["timestamp #{operator} ?", value]).map {|node| node.name}
+      end
+    end
+    node_sets
+  end
+end
diff --git a/lib/puppet/module.rb b/lib/puppet/module.rb
index 8da19c2ce..43266b2b5 100644
--- a/lib/puppet/module.rb
+++ b/lib/puppet/module.rb
@@ -191,7 +191,7 @@ class Puppet::Module
 
   def backward_compatible_plugins_dir
     if dir = File.join(path, "plugins") and FileTest.exist?(dir)
-      warning "using the deprecated 'plugins' directory for ruby extensions; please move to 'lib'"
+      Puppet.warning "using the deprecated 'plugins' directory for ruby extensions; please move to 'lib'"
       return dir
     else
       return File.join(path, "lib")
diff --git a/lib/puppet/network/rest_authconfig.rb b/lib/puppet/network/rest_authconfig.rb
index 9e3632499..cf76978fe 100644
--- a/lib/puppet/network/rest_authconfig.rb
+++ b/lib/puppet/network/rest_authconfig.rb
@@ -61,7 +61,7 @@ module Puppet
     def insert_default_acl
       DEFAULT_ACL.each do |acl|
         unless rights[acl[:acl]]
-          Puppet.info "Inserting default '#{acl[:acl]}'(#{acl[:authenticated] ? "auth" : "non-auth"}) acl because #{( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none where found in '#{@file}'")}"
+          Puppet.info "Inserting default '#{acl[:acl]}'(#{acl[:authenticated] ? "auth" : "non-auth"}) ACL because #{( !exists? ? "#{Puppet[:rest_authconfig]} doesn't exist" : "none were found in '#{@file}'")}"
           mk_acl(acl)
         end
       end
diff --git a/lib/puppet/parser/ast/collection.rb b/lib/puppet/parser/ast/collection.rb
index ef36b7143..565b83195 100644
--- a/lib/puppet/parser/ast/collection.rb
+++ b/lib/puppet/parser/ast/collection.rb
@@ -16,6 +16,7 @@ class Puppet::Parser::AST
       str, code = query && query.safeevaluate(scope)
 
       resource_type = scope.find_resource_type(@type)
+      fail "Resource type #{@type} doesn't exist" unless resource_type
       newcoll = Puppet::Parser::Collector.new(scope, resource_type.name, str, code, self.form)
 
       scope.compiler.add_collection(newcoll)
@@ -26,10 +27,10 @@ class Puppet::Parser::AST
         params = @override.collect { |param| param.safeevaluate(scope) }
         newcoll.add_override(
           :parameters => params,
-          :file => @file,
-          :line => @line,
-          :source => scope.source,        
-          :scope => scope
+          :file       => @file,
+          :line       => @line,
+          :source     => scope.source,
+          :scope      => scope
         )
       end
 
diff --git a/lib/puppet/provider/mount/parsed.rb b/lib/puppet/provider/mount/parsed.rb
index 42e543c15..11c5e21a9 100755
--- a/lib/puppet/provider/mount/parsed.rb
+++ b/lib/puppet/provider/mount/parsed.rb
@@ -97,4 +97,10 @@ Puppet::Type.type(:mount).provide(
     end
     instances
   end
+
+  def flush
+    needs_mount = @property_hash.delete(:needs_mount)
+    super
+    mount if needs_mount
+  end
 end
diff --git a/lib/puppet/provider/parsedfile.rb b/lib/puppet/provider/parsedfile.rb
index ffd36e59f..75a215f4b 100755
--- a/lib/puppet/provider/parsedfile.rb
+++ b/lib/puppet/provider/parsedfile.rb
@@ -334,7 +334,9 @@ class Puppet::Provider::ParsedFile < Puppet::Provider
       @property_hash[:target] = @resource.should(:target) || self.class.default_target
       self.class.modified(@property_hash[:target])
     end
-    @property_hash[:name] ||= @resource.name
+    @resource.class.key_attributes.each do |attr|
+      @property_hash[attr] ||= @resource[attr]
+    end
 
     self.class.flush(@property_hash)
 
diff --git a/lib/puppet/provider/user/useradd.rb b/lib/puppet/provider/user/useradd.rb
index ba406cc63..b87971738 100644
--- a/lib/puppet/provider/user/useradd.rb
+++ b/lib/puppet/provider/user/useradd.rb
@@ -19,7 +19,7 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     value !~ /\s/
   end
 
-  has_features :manages_homedir, :allows_duplicates, :manages_expiry
+  has_features :manages_homedir, :allows_duplicates, :manages_expiry, :system_users
 
   has_features :manages_passwords, :manages_password_age if Puppet.features.libshadow?
 
@@ -46,6 +46,10 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     cmd
   end
 
+  def check_system_users
+    @resource.system? ? ["-r"] : []
+  end
+
   def add_properties
     cmd = []
     Puppet::Type.type(:user).validproperties.each do |property|
@@ -66,6 +70,7 @@ Puppet::Type.type(:user).provide :useradd, :parent => Puppet::Provider::NameServ
     cmd += check_allow_dup
     cmd += check_manage_home
     cmd += check_manage_expiry
+    cmd += check_system_users
     cmd << @resource[:name]
   end
 
diff --git a/lib/puppet/rails/database/004_add_inventory_service_tables.rb b/lib/puppet/rails/database/004_add_inventory_service_tables.rb
new file mode 100644
index 000000000..6e6b28c0c
--- /dev/null
+++ b/lib/puppet/rails/database/004_add_inventory_service_tables.rb
@@ -0,0 +1,36 @@
+class AddInventoryServiceTables < ActiveRecord::Migration
+  def self.up
+    unless ActiveRecord::Base.connection.tables.include?("inventory_nodes")
+      create_table :inventory_nodes do |t|
+        t.column :name, :string, :null => false
+        t.column :timestamp, :datetime, :null => false
+        t.column :updated_at, :datetime
+        t.column :created_at, :datetime
+      end
+
+      add_index :inventory_nodes, :name, :unique => true
+    end
+
+    unless ActiveRecord::Base.connection.tables.include?("inventory_facts")
+      create_table :inventory_facts, :id => false do |t|
+        t.column :node_id, :integer, :null => false
+        t.column :name, :string, :null => false
+        t.column :value, :text, :null => false
+      end
+
+      add_index :inventory_facts, [:node_id, :name], :unique => true
+    end
+  end
+
+  def self.down
+    unless ActiveRecord::Base.connection.tables.include?("inventory_nodes")
+      remove_index :inventory_nodes, :name
+      drop_table :inventory_nodes
+    end
+
+    if ActiveRecord::Base.connection.tables.include?("inventory_facts")
+      remove_index :inventory_facts, [:node_id, :name]
+      drop_table :inventory_facts
+    end
+  end
+end
diff --git a/lib/puppet/rails/database/schema.rb b/lib/puppet/rails/database/schema.rb
index 8b389d773..7b75f4216 100644
--- a/lib/puppet/rails/database/schema.rb
+++ b/lib/puppet/rails/database/schema.rb
@@ -103,6 +103,23 @@ class Puppet::Rails::Schema
           t.column :created_at, :datetime
         end
         add_index :param_names, :name
+
+        create_table :inventory_nodes do |t|
+          t.column :name, :string, :null => false
+          t.column :timestamp, :datetime, :null => false
+          t.column :updated_at, :datetime
+          t.column :created_at, :datetime
+        end
+
+        add_index :inventory_nodes, :name, :unique => true
+
+        create_table :inventory_facts, :id => false do |t|
+          t.column :node_id, :integer, :null => false
+          t.column :name, :string, :null => false
+          t.column :value, :text, :null => false
+        end
+
+        add_index :inventory_facts, [:node_id, :name], :unique => true
       end
     end
   ensure
diff --git a/lib/puppet/rails/inventory_fact.rb b/lib/puppet/rails/inventory_fact.rb
new file mode 100644
index 000000000..aa6334eef
--- /dev/null
+++ b/lib/puppet/rails/inventory_fact.rb
@@ -0,0 +1,5 @@
+require 'puppet/rails/inventory_node'
+
+class Puppet::Rails::InventoryFact < ::ActiveRecord::Base
+  belongs_to :node, :class_name => "Puppet::Rails::InventoryNode"
+end
diff --git a/lib/puppet/rails/inventory_node.rb b/lib/puppet/rails/inventory_node.rb
new file mode 100644
index 000000000..52f8621a4
--- /dev/null
+++ b/lib/puppet/rails/inventory_node.rb
@@ -0,0 +1,25 @@
+require 'puppet/rails/inventory_fact'
+
+class Puppet::Rails::InventoryNode < ::ActiveRecord::Base
+  has_many :facts, :class_name => "Puppet::Rails::InventoryFact", :foreign_key => :node_id, :dependent => :delete_all
+
+  named_scope :has_fact_with_value, lambda { |name,value|
+    {
+      :conditions => ["inventory_facts.name = ? AND inventory_facts.value = ?", name, value],
+      :joins => :facts
+    }
+  }
+
+  named_scope :has_fact_without_value, lambda { |name,value|
+    {
+      :conditions => ["inventory_facts.name = ? AND inventory_facts.value != ?", name, value],
+      :joins => :facts
+    }
+  }
+
+  def facts_to_hash
+    facts.inject({}) do |fact_hash,fact|
+      fact_hash.merge(fact.name => fact.value)
+    end
+  end
+end
diff --git a/lib/puppet/reports/store.rb b/lib/puppet/reports/store.rb
index 99a9fc177..625a263b3 100644
--- a/lib/puppet/reports/store.rb
+++ b/lib/puppet/reports/store.rb
@@ -15,7 +15,10 @@ Puppet::Reports.register_report(:store) do
 
     dir = File.join(Puppet[:reportdir], client)
 
-    Dir.mkdir(dir, 0750) unless FileTest.exists?(dir)
+    if ! FileTest.exists?(dir)
+      FileUtils.mkdir_p(dir)
+      FileUtils.chmod_R(0750, dir)
+    end
 
     # Now store the report.
     now = Time.now.gmtime
diff --git a/lib/puppet/resource.rb b/lib/puppet/resource.rb
index a71675e11..214516908 100644
--- a/lib/puppet/resource.rb
+++ b/lib/puppet/resource.rb
@@ -5,6 +5,11 @@ require 'puppet/util/pson'
 # The simplest resource class.  Eventually it will function as the
 # base class for all resource-like behaviour.
 class Puppet::Resource
+  # This stub class is only needed for serialization compatibility with 0.25.x.
+  # Specifically, it exists to provide a compatibility API when using YAML
+  # serialized objects loaded from StoreConfigs.
+  Reference = Puppet::Resource
+
   include Puppet::Util::Tagging
 
   require 'puppet/resource/type_collection_helper'
@@ -87,7 +92,7 @@ class Puppet::Resource
   def yaml_property_munge(x)
     case x
     when Hash
-      x.inject({}) { |h,kv| 
+      x.inject({}) { |h,kv|
         k,v = kv
         h[k] = self.class.value_to_pson_data(v)
         h
@@ -104,7 +109,7 @@ class Puppet::Resource
   # be overridden at some point, but this works for now.
   %w{has_key? keys length delete empty? <<}.each do |method|
     define_method(method) do |*args|
-      @parameters.send(method, *args)
+      parameters.send(method, *args)
     end
   end
 
@@ -112,13 +117,13 @@ class Puppet::Resource
   # to lower-case symbols.
   def []=(param, value)
     validate_parameter(param) if validate_parameters
-    @parameters[parameter_name(param)] = value
+    parameters[parameter_name(param)] = value
   end
 
   # Return a given parameter's value.  Converts all passed names
   # to lower-case symbols.
   def [](param)
-    @parameters[parameter_name(param)]
+    parameters[parameter_name(param)]
   end
 
   def ==(other)
@@ -140,11 +145,11 @@ class Puppet::Resource
 
   # Iterate over each param/value pair, as required for Enumerable.
   def each
-    @parameters.each { |p,v| yield p, v }
+    parameters.each { |p,v| yield p, v }
   end
 
   def include?(parameter)
-    super || @parameters.keys.include?( parameter_name(parameter) )
+    super || parameters.keys.include?( parameter_name(parameter) )
   end
 
   # These two methods are extracted into a Helper
@@ -170,14 +175,6 @@ class Puppet::Resource
     end
   end
 
-  # This stub class is only needed for serialization compatibility with 0.25.x
-  class Reference
-    attr_accessor :type,:title
-    def initialize(type,title)
-      @type,@title = type,title
-    end
-  end
-
   # Create our resource.
   def initialize(type, title = nil, attributes = {})
     @parameters = {}
@@ -204,7 +201,7 @@ class Puppet::Resource
     tag(self.type)
     tag(self.title) if valid_tag?(self.title)
 
-    @reference = Reference.new(@type,@title) # for serialization compatibility with 0.25.x
+    @reference = self # for serialization compatibility with 0.25.x
     if strict? and ! resource_type
       if @type == 'Class'
         raise ArgumentError, "Could not find declared class #{title}"
@@ -234,7 +231,7 @@ class Puppet::Resource
 
   # Produce a simple hash of our parameters.
   def to_hash
-    parse_title.merge @parameters
+    parse_title.merge parameters
   end
 
   def to_s
@@ -256,7 +253,7 @@ class Puppet::Resource
   # Convert our resource to Puppet code.
   def to_manifest
     # Collect list of attributes to align => and move ensure first
-    attr = @parameters.keys
+    attr = parameters.keys
     attr_max = attr.inject(0) { |max,k| k.to_s.length > max ? k.to_s.length : max }
 
     attr.sort!
@@ -266,7 +263,7 @@ class Puppet::Resource
     end
 
     attributes = attr.collect { |k|
-      v = @parameters[k]
+      v = parameters[k]
       if v.is_a? Array
         "  %-#{attr_max}s => %s,\n" % [ k, "[\'#{v.join("', '")}\']" ]
       else
@@ -433,4 +430,10 @@ class Puppet::Resource
       return { :name => title.to_s }
     end
   end
+
+  def parameters
+    # @parameters could have been loaded from YAML, causing it to be nil (by
+    # bypassing initialize).
+    @parameters ||= {}
+  end
 end
diff --git a/lib/puppet/type.rb b/lib/puppet/type.rb
index f70a3ec0b..d24cc8554 100644
--- a/lib/puppet/type.rb
+++ b/lib/puppet/type.rb
@@ -200,7 +200,7 @@ class Type
   end
 
   def uniqueness_key
-    to_resource.uniqueness_key
+    self.class.key_attributes.sort_by { |attribute_name| attribute_name.to_s }.map{ |attribute_name| self[attribute_name] }
   end
 
   # Create a new parameter.  Requires a block and a name, stores it in the
@@ -382,8 +382,8 @@ class Type
 
     fail("Invalid parameter #{name}(#{name.inspect})") unless self.class.validattr?(name)
 
-    if name == :name
-      name = name_var
+    if name == :name && nv = name_var
+      name = nv
     end
 
     if obj = @parameters[name]
@@ -403,8 +403,8 @@ class Type
 
     fail("Invalid parameter #{name}") unless self.class.validattr?(name)
 
-    if name == :name
-      name = name_var
+    if name == :name && nv = name_var
+      name = nv
     end
     raise Puppet::Error.new("Got nil value for #{name}") if value.nil?
 
diff --git a/lib/puppet/type/computer.rb b/lib/puppet/type/computer.rb
index 89a0692bf..7a2c52d53 100644
--- a/lib/puppet/type/computer.rb
+++ b/lib/puppet/type/computer.rb
@@ -14,7 +14,11 @@ Puppet::Type.newtype(:computer) do
     type as per other platforms.
 
     This type primarily exists to create localhost Computer objects that MCX
-    policy can then be attached to."
+    policy can then be attached to.
+    
+    **Autorequires:** If Puppet is managing the plist file representing a
+    Computer object (located at `/var/db/dslocal/nodes/Default/computers/{name}.plist`),
+    the Computer resource will autorequire it."
 
   # ensurable
 
diff --git a/lib/puppet/type/exec.rb b/lib/puppet/type/exec.rb
index 033183ae7..ae579502a 100755
--- a/lib/puppet/type/exec.rb
+++ b/lib/puppet/type/exec.rb
@@ -22,7 +22,9 @@ module Puppet
       to native Puppet types as quickly as possible.  If you find that
       you are doing a lot of work with `exec`, please at least notify
       us at Puppet Labs what you are doing, and hopefully we can work with
-      you to get a native resource type for the work you are doing."
+      you to get a native resource type for the work you are doing.
+      
+      **Autorequires:** If Puppet is managing an exec's cwd or the executable file used in an exec's command, the exec resource will autorequire those files. If Puppet is managing the user that an exec should run as, the exec resource will autorequire that user."
 
     require 'open3'
 
diff --git a/lib/puppet/type/file.rb b/lib/puppet/type/file.rb
index 963b9e5dd..16b1f962d 100644
--- a/lib/puppet/type/file.rb
+++ b/lib/puppet/type/file.rb
@@ -22,7 +22,9 @@ Puppet::Type.newtype(:file) do
     If you find that you are often copying files in from a central
     location, rather than using native resources, please contact
     Puppet Labs and we can hopefully work with you to develop a
-    native resource to support what you are doing."
+    native resource to support what you are doing.
+    
+    **Autorequires:** If Puppet is managing the user or group that owns a file, the file resource will autorequire them. If Puppet is managing any parent directories of a file, the file resource will autorequire them."
 
   def self.title_patterns
     [ [ /^(.*?)\/*\Z/m, [ [ :path, lambda{|x| x} ] ] ] ]
diff --git a/lib/puppet/type/macauthorization.rb b/lib/puppet/type/macauthorization.rb
index ef6fbb6c1..e89aa7c89 100644
--- a/lib/puppet/type/macauthorization.rb
+++ b/lib/puppet/type/macauthorization.rb
@@ -1,7 +1,10 @@
 Puppet::Type.newtype(:macauthorization) do
 
   @doc = "Manage the Mac OS X authorization database.
-    See the [Apple developer site](http://developer.apple.com/documentation/Security/Conceptual/Security_Overview/Security_Services/chapter_4_section_5.html) for more information."
+    See the [Apple developer site](http://developer.apple.com/documentation/Security/Conceptual/Security_Overview/Security_Services/chapter_4_section_5.html) for more information.
+    
+    **Autorequires:** If Puppet is managing the `/etc/authorization` file, each
+    macauthorization resource will autorequire it."
 
   ensurable
 
diff --git a/lib/puppet/type/mcx.rb b/lib/puppet/type/mcx.rb
index 4f0a6c3c5..07c9348dd 100644
--- a/lib/puppet/type/mcx.rb
+++ b/lib/puppet/type/mcx.rb
@@ -27,8 +27,11 @@ content property of the file type in Puppet.
 
 The recommended method of using this type is to use Work Group Manager
 to manage users and groups on the local computer, record the resulting
-puppet manifest using the command 'ralsh mcx' then deploying this
+puppet manifest using the command `puppet resource mcx`, then deploy it
 to other machines.
+
+**Autorequires:** If Puppet is managing the user, group, or computer that these
+MCX settings refer to, the MCX resource will autorequire that user, group, or computer.
 "
   feature :manages_content, \
     "The provider can manage MCXSettings as a string.",
diff --git a/lib/puppet/type/mount.rb b/lib/puppet/type/mount.rb
index f0d5bcac4..5b8c5ca58 100755
--- a/lib/puppet/type/mount.rb
+++ b/lib/puppet/type/mount.rb
@@ -74,12 +74,13 @@ module Puppet
       newvalue(:mounted, :event => :mount_mounted) do
         # Create the mount point if it does not already exist.
         current_value = self.retrieve
+        currently_mounted = provider.mounted?
         provider.create if [nil, :absent, :ghost].include?(current_value)
 
         syncothers
 
         # The fs can be already mounted if it was absent but mounted
-        provider.mount unless provider.mounted?
+        provider.property_hash[:needs_mount] = true unless currently_mounted
       end
 
       # insync: mounted   -> present
@@ -225,7 +226,7 @@ module Puppet
 
     def refresh
       # Only remount if we're supposed to be mounted.
-      provider.remount if self.should(:fstype) != "swap" and self.should(:ensure) == :mounted
+      provider.remount if self.should(:fstype) != "swap" and provider.mounted?
     end
 
     def value(name)
diff --git a/lib/puppet/type/package.rb b/lib/puppet/type/package.rb
index d73d90dff..1222a5319 100644
--- a/lib/puppet/type/package.rb
+++ b/lib/puppet/type/package.rb
@@ -15,7 +15,11 @@ module Puppet
       using based on the platform you are on, but you can override it
       using the `provider` parameter; each provider defines what it
       requires in order to function, and you must meet those requirements
-      to use a given provider."
+      to use a given provider.
+      
+      **Autorequires:** If Puppet is managing the files specified as a package's
+      `adminfile`, `responsefile`, or `source`, the package resource will autorequire
+      those files."
 
     feature :installable, "The provider can install packages.",
       :methods => [:install]
diff --git a/lib/puppet/type/selmodule.rb b/lib/puppet/type/selmodule.rb
index 60be8a855..e76c18cc0 100644
--- a/lib/puppet/type/selmodule.rb
+++ b/lib/puppet/type/selmodule.rb
@@ -5,7 +5,9 @@
 Puppet::Type.newtype(:selmodule) do
   @doc = "Manages loading and unloading of SELinux policy modules
     on the system.  Requires SELinux support.  See man semodule(8)
-    for more information on SELinux policy modules."
+    for more information on SELinux policy modules.
+    
+    **Autorequires:** If Puppet is managing the file containing this SELinux policy module (which is either explicitly specified in the `selmodulepath` attribute or will be found at {`selmoduledir`}/{`name`}.pp), the selmodule resource will autorequire that file."
 
   ensurable
 
diff --git a/lib/puppet/type/ssh_authorized_key.rb b/lib/puppet/type/ssh_authorized_key.rb
index e3320140e..8338e2d64 100644
--- a/lib/puppet/type/ssh_authorized_key.rb
+++ b/lib/puppet/type/ssh_authorized_key.rb
@@ -1,7 +1,11 @@
 module Puppet
   newtype(:ssh_authorized_key) do
     @doc = "Manages SSH authorized keys. Currently only type 2 keys are
-    supported."
+    supported.
+    
+    **Autorequires:** If Puppet is managing the user account in which this 
+    SSH key should be installed, the `ssh_authorized_key` resource will autorequire
+    that user."
 
     ensurable
 
diff --git a/lib/puppet/type/user.rb b/lib/puppet/type/user.rb
index e7389a0d1..f74e4266f 100755
--- a/lib/puppet/type/user.rb
+++ b/lib/puppet/type/user.rb
@@ -12,7 +12,9 @@ module Puppet
 
       This resource type uses the prescribed native tools for creating
       groups and generally uses POSIX APIs for retrieving information
-      about them.  It does not directly modify `/etc/passwd` or anything."
+      about them.  It does not directly modify `/etc/passwd` or anything.
+      
+      **Autorequires:** If Puppet is managing the user's primary group (as provided in the `gid` attribute), the user resource will autorequire that group. If Puppet is managing any role accounts corresponding to the user's roles, the user resource will autorequire those role accounts."
 
     feature :allows_duplicates,
       "The provider supports duplicate users with the same UID."
@@ -34,6 +36,9 @@ module Puppet
     feature :manages_expiry,
       "The provider can manage the expiry date for a user."
 
+   feature :system_users,
+     "The provider allows you to create system users with lower UIDs."
+
     newproperty(:ensure, :parent => Puppet::Property::Ensure) do
       newvalue(:present, :event => :user_created) do
         provider.create
@@ -230,6 +235,14 @@ module Puppet
       defaultto :minimum
     end
 
+    newparam(:system, :boolean => true) do
+      desc "Whether the user is a system user with lower UID."
+
+      newvalues(:true, :false)
+
+      defaultto false
+    end
+
     newparam(:allowdupe, :boolean => true) do
       desc "Whether to allow duplicate UIDs."
 
diff --git a/lib/puppet/type/zfs.rb b/lib/puppet/type/zfs.rb
index be18ab5aa..7123f8ac9 100755
--- a/lib/puppet/type/zfs.rb
+++ b/lib/puppet/type/zfs.rb
@@ -1,6 +1,8 @@
 module Puppet
   newtype(:zfs) do
-    @doc = "Manage zfs. Create destroy and set properties on zfs instances."
+    @doc = "Manage zfs. Create destroy and set properties on zfs instances.
+
+**Autorequires:** If Puppet is managing the zpool at the root of this zfs instance, the zfs resource will autorequire it. If Puppet is managing any parent zfs instances, the zfs resource will autorequire them."
 
     ensurable
 
diff --git a/lib/puppet/type/zone.rb b/lib/puppet/type/zone.rb
index c7c2aa143..1bae93120 100644
--- a/lib/puppet/type/zone.rb
+++ b/lib/puppet/type/zone.rb
@@ -1,5 +1,7 @@
 Puppet::Type.newtype(:zone) do
-  @doc = "Solaris zones."
+  @doc = "Solaris zones.
+
+**Autorequires:** If Puppet is managing the directory specified as the root of the zone's filesystem (with the `path` attribute), the zone resource will autorequire that directory."
 
   # These properties modify the zone configuration, and they need to provide
   # the text separately from syncing it, so all config statements can be rolled
diff --git a/lib/puppet/util.rb b/lib/puppet/util.rb
index 850d147e2..d06f44808 100644
--- a/lib/puppet/util.rb
+++ b/lib/puppet/util.rb
@@ -4,6 +4,7 @@ require 'puppet/util/monkey_patches'
 require 'sync'
 require 'puppet/external/lock'
 require 'monitor'
+require 'puppet/util/execution_stub'
 
 module Puppet
   # A command failed to execute.
@@ -264,6 +265,10 @@ module Util
     arguments[:uid] = Puppet::Util::SUIDManager.convert_xid(:uid, arguments[:uid]) if arguments[:uid]
     arguments[:gid] = Puppet::Util::SUIDManager.convert_xid(:gid, arguments[:gid]) if arguments[:gid]
 
+    if execution_stub = Puppet::Util::ExecutionStub.current_value
+      return execution_stub.call(command, arguments)
+    end
+
     @@os ||= Facter.value(:operatingsystem)
     output = nil
     child_pid, child_status = nil
diff --git a/lib/puppet/util/execution.rb b/lib/puppet/util/execution.rb
index dd820f856..69f4f2c15 100644
--- a/lib/puppet/util/execution.rb
+++ b/lib/puppet/util/execution.rb
@@ -4,16 +4,15 @@ module Puppet::Util::Execution
   # Run some code with a specific environment.  Resets the environment back to
   # what it was at the end of the code.
   def withenv(hash)
-    oldvals = {}
+    saved = ENV.to_hash
     hash.each do |name, val|
-      name = name.to_s
-      oldvals[name] = ENV[name]
-      ENV[name] = val
+      ENV[name.to_s] = val
     end
 
     yield
   ensure
-    oldvals.each do |name, val|
+    ENV.clear
+    saved.each do |name, val|
       ENV[name] = val
     end
   end
diff --git a/lib/puppet/util/execution_stub.rb b/lib/puppet/util/execution_stub.rb
new file mode 100644
index 000000000..af74e0f72
--- /dev/null
+++ b/lib/puppet/util/execution_stub.rb
@@ -0,0 +1,26 @@
+module Puppet::Util
+  class ExecutionStub
+    class << self
+      # Set a stub block that Puppet::Util.execute() should invoke instead
+      # of actually executing commands on the target machine.  Intended
+      # for spec testing.
+      #
+      # The arguments passed to the block are |command, options|, where
+      # command is an array of strings and options is an options hash.
+      def set(&block)
+        @value = block
+      end
+
+      # Uninstall any execution stub, so that calls to
+      # Puppet::Util.execute() behave normally again.
+      def reset
+        @value = nil
+      end
+
+      # Retrieve the current execution stub, or nil if there is no stub.
+      def current_value
+        @value
+      end
+    end
+  end
+end
diff --git a/lib/puppet/util/settings.rb b/lib/puppet/util/settings.rb
index 626ed20eb..f243b8691 100644
--- a/lib/puppet/util/settings.rb
+++ b/lib/puppet/util/settings.rb
@@ -91,7 +91,7 @@ class Puppet::Util::Settings
       varname = $2 || $1
       if varname == "environment" and environment
         environment
-      elsif pval = self.value(varname)
+      elsif pval = self.value(varname, environment)
         pval
       else
         raise Puppet::DevError, "Could not find value for #{value}"