puppet 3.2.4 → 3.3.0.rc2

data/lib/puppet/settings/boolean_setting.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/base_setting'
-
 # A simple boolean.
 class Puppet::Settings::BooleanSetting < Puppet::Settings::BaseSetting
   # get the arguments in getopt format

data/lib/puppet/settings/config_file.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/errors'
-
 ##
 # @api private
 #

data/lib/puppet/settings/directory_setting.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/file_setting'
-
 class Puppet::Settings::DirectorySetting < Puppet::Settings::FileSetting
   def type
     :directory

data/lib/puppet/settings/duration_setting.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/base_setting'
-
 # A setting that represents a span of time, and evaluates to an integer
 # number of seconds after being parsed
 class Puppet::Settings::DurationSetting < Puppet::Settings::BaseSetting

data/lib/puppet/settings/enum_setting.rb

@@ -0,0 +1,16 @@
+class Puppet::Settings::EnumSetting < Puppet::Settings::BaseSetting
+  attr_accessor :values
+
+  def type
+    :enum
+  end
+
+  def munge(value)
+    if values.include?(value)
+      value
+    else
+      raise Puppet::Settings::ValidationError,
+        "Invalid value '#{value}' for parameter #{@name}. Allowed values are '#{values.join("', '")}'"
+    end
+  end
+end

data/lib/puppet/settings/file_setting.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/string_setting'
-
 # A file.
 class Puppet::Settings::FileSetting < Puppet::Settings::StringSetting
   class SettingError < StandardError; end

data/lib/puppet/settings/path_setting.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/string_setting'
-
 class Puppet::Settings::PathSetting < Puppet::Settings::StringSetting
   def munge(value)
     if value.is_a?(String)

data/lib/puppet/settings/string_setting.rb

@@ -1,6 +1,3 @@
-# The base element type.
-require 'puppet/settings/base_setting'
-
 class Puppet::Settings::StringSetting < Puppet::Settings::BaseSetting
   def type
     :string

data/lib/puppet/settings/terminus_setting.rb

@@ -1,5 +1,3 @@
-require 'puppet/settings/base_setting'
-
 class Puppet::Settings::TerminusSetting < Puppet::Settings::BaseSetting
   def munge(value)
     case value

data/lib/puppet/ssl/certificate_authority.rb

@@ -84,7 +84,10 @@ class Puppet::SSL::CertificateAuthority
     store = autosign_store(auto) if auto != true
 
     Puppet::SSL::CertificateRequest.indirection.search("*").each do |csr|
-      sign(csr.name) if auto == true or store.allowed?(csr.name, "127.1.1.1")
+      if auto == true or store.allowed?(csr.name, "127.1.1.1")
+        Puppet.info "Autosigning #{csr.name}"
+        sign(csr.name)
+      end
     end
   end
 
@@ -128,16 +131,18 @@ class Puppet::SSL::CertificateAuthority
   end
 
   # Generate a new certificate.
+  # @return Puppet::SSL::Certificate
   def generate(name, options = {})
     raise ArgumentError, "A Certificate already exists for #{name}" if Puppet::SSL::Certificate.indirection.find(name)
-    host = Puppet::SSL::Host.new(name)
 
     # Pass on any requested subjectAltName field.
     san = options[:dns_alt_names]
 
     host = Puppet::SSL::Host.new(name)
     host.generate_certificate_request(:dns_alt_names => san)
-    sign(name, !!san)
+    # CSR may have been implicitly autosigned, generating a certificate
+    # Or sign explicitly
+    host.certificate || sign(name, !!san)
   end
 
   # Generate our CA certificate.
@@ -192,9 +197,26 @@ class Puppet::SSL::CertificateAuthority
     pass
   end
 
-  # List all signed certificates.
+  # Lists the names of all signed certificates.
+  #
+  # @return [Array<String>]
   def list
-    Puppet::SSL::Certificate.indirection.search("*").collect { |c| c.name }
+    list_certificates.collect { |c| c.name }
+  end
+
+  # Return all the certificate objects as found by the indirector
+  # API for PE license checking.
+  #
+  # Created to prevent the case of reading all certs from disk, getting
+  # just their names and verifying the cert for each name, which then
+  # causes the cert to again be read from disk.
+  #
+  # @author Jeff Weiss <jeff.weiss@puppetlabs.com>
+  # @api Puppet Enterprise Licensing
+  #
+  # @return [Array<Puppet::SSL::Certificate>]
+  def list_certificates
+    Puppet::SSL::Certificate.indirection.search("*")
   end
 
   # Read the next serial from the serial file, and increment the
@@ -354,16 +376,87 @@ class Puppet::SSL::CertificateAuthority
     return true                 # good enough for us!
   end
 
-  # Verify a given host's certificate.
-  def verify(name)
-    unless cert = Puppet::SSL::Certificate.indirection.find(name)
-      raise ArgumentError, "Could not find a certificate for #{name}"
+  # Utility method for optionally caching the X509 Store for verifying a
+  # large number of certificates in a short amount of time--exactly the
+  # case we have during PE license checking.
+  #
+  # @example Use the cached X509 store
+  #   x509store(:cache => true)
+  #
+  # @example Use a freshly create X509 store
+  #   x509store
+  #   x509store(:cache => false)
+  #
+  # @param [Hash] options the options used for retrieving the X509 Store
+  # @option options [Boolean] :cache whether or not to use a cached version
+  #   of the X509 Store
+  #
+  # @return [OpenSSL::X509::Store]
+  def x509_store(options = {})
+    if (options[:cache]) 
+      return @x509store unless @x509store.nil?
+      @x509store = create_x509_store
+    else
+      create_x509_store
     end
+  end
+  private :x509_store
+
+  # Creates a brand new OpenSSL::X509::Store with the appropriate
+  # Certificate Revocation List and flags
+  #
+  # @return [OpenSSL::X509::Store]
+  def create_x509_store
     store = OpenSSL::X509::Store.new
     store.add_file Puppet[:cacert]
     store.add_crl crl.content if self.crl
     store.purpose = OpenSSL::X509::PURPOSE_SSL_CLIENT
     store.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL|OpenSSL::X509::V_FLAG_CRL_CHECK if Puppet.settings[:certificate_revocation]
+    store
+  end
+  private :create_x509_store
+
+  # Utility method which is API for PE license checking.
+  # This is used rather than `verify` because 
+  #  1) We have already read the certificate from disk into memory.
+  #     To read the certificate from disk again is just wasteful.
+  #  2) Because we're checking a large number of certificates against
+  #     a transient CertificateAuthority, we can relatively safely cache
+  #     the X509 Store that actually does the verification.
+  #
+  # Long running instances of CertificateAuthority will certainly
+  # want to use `verify` because it will recreate the X509 Store with
+  # the absolutely latest CRL.
+  #
+  # Additionally, this method explicitly returns a boolean whereas
+  # `verify` will raise an error if the certificate has been revoked.
+  #
+  # @author Jeff Weiss <jeff.weiss@puppetlabs.com>
+  # @api Puppet Enterprise Licensing
+  #
+  # @param cert [Puppet::SSL::Certificate] the certificate to check validity of
+  #
+  # @return [Boolean] true if signed, false if unsigned or revoked
+  def certificate_is_alive?(cert)
+    x509_store(:cache => true).verify(cert.content)
+  end
+
+  # Verify a given host's certificate. The certname is passed in, and
+  # the indirector will be used to locate the actual contents of the
+  # certificate with that name.
+  #
+  # @param name [String] certificate name to verify
+  #
+  # @raise [ArgumentError] if the certificate name cannot be found
+  #   (i.e. doesn't exist or is unsigned)
+  # @raise [CertificateVerficationError] if the certificate has been revoked
+  #
+  # @return [Boolean] true if signed, there are no cases where false is returned
+  def verify(name)
+    unless cert = Puppet::SSL::Certificate.indirection.find(name)
+      raise ArgumentError, "Could not find a certificate for #{name}"
+    end
+    store = x509_store
 
     raise CertificateVerificationError.new(store.error), store.error_string unless store.verify(cert.content)
   end

data/lib/puppet/test/test_helper.rb

@@ -83,6 +83,7 @@ module Puppet::Test
 
       Puppet::Node::Environment.clear
       Puppet::Parser::Functions.reset
+      Puppet::Application.clear!
 
       Puppet.clear_deprecation_warnings
     end

data/lib/puppet/transaction.rb

@@ -1,12 +1,14 @@
-# the class that actually walks our resource/property tree, collects the changes,
-# and performs them
-
 require 'puppet'
 require 'puppet/util/tagging'
 require 'puppet/application'
 require 'digest/sha1'
 
+# the class that actually walks our resource/property tree, collects the changes,
+# and performs them
+#
+# @api private
 class Puppet::Transaction
+  require 'puppet/transaction/additional_resource_generator'
   require 'puppet/transaction/event'
   require 'puppet/transaction/event_manager'
   require 'puppet/transaction/resource_harness'
@@ -23,19 +25,93 @@ class Puppet::Transaction
   # Handles most of the actual interacting with resources
   attr_reader :resource_harness
 
+  attr_reader :prefetched_providers
+
   include Puppet::Util
   include Puppet::Util::Tagging
 
-  # Wraps application run state check to flag need to interrupt processing
-  def stop_processing?
-    Puppet::Application.stop_requested?
+  def initialize(catalog, report, prioritizer)
+    @catalog = catalog
+
+    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
+
+    @prioritizer = prioritizer
+
+    @report.add_times(:config_retrieval, @catalog.retrieval_duration || 0)
+
+    @event_manager = Puppet::Transaction::EventManager.new(self)
+
+    @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
+
+    @prefetched_providers = Hash.new { |h,k| h[k] = {} }
   end
 
-  # Add some additional times for reporting
-  def add_times(hash)
-    hash.each do |name, num|
-      report.add_times(name, num)
+  # This method does all the actual work of running a transaction.  It
+  # collects all of the changes, executes them, and responds to any
+  # necessary events.
+  def evaluate(&block)
+    block ||= method(:eval_resource)
+    generator = AdditionalResourceGenerator.new(@catalog, relationship_graph, @prioritizer)
+    @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
+
+    Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
+
+    continue_while = lambda { !stop_processing? }
+
+    pre_process = lambda do |resource|
+      prefetch_if_necessary(resource)
+
+      # If we generated resources, we don't know what they are now
+      # blocking, so we opt to recompute it, rather than try to track every
+      # change that would affect the number.
+      relationship_graph.clear_blockers if generator.eval_generate(resource)
     end
+
+    providerless_types = []
+    overly_deferred_resource_handler = lambda do |resource|
+      # We don't automatically assign unsuitable providers, so if there
+      # is one, it must have been selected by the user.
+      if resource.provider
+        resource.err "Provider #{resource.provider.class.name} is not functional on this host"
+      else
+        providerless_types << resource.type
+      end
+
+      resource_status(resource).failed = true
+    end
+
+    canceled_resource_handler = lambda do |resource|
+      resource_status(resource).skipped = true
+      resource.debug "Transaction canceled, skipping"
+    end
+
+    teardown = lambda do
+      # Just once per type. No need to punish the user.
+      providerless_types.uniq.each do |type|
+        Puppet.err "Could not find a suitable provider for #{type}"
+      end
+    end
+
+    relationship_graph.traverse(:while => continue_while,
+                                :pre_process => pre_process,
+                                :overly_deferred_resource_handler => overly_deferred_resource_handler,
+                                :canceled_resource_handler => canceled_resource_handler,
+                                :teardown => teardown) do |resource|
+      if resource.is_a?(Puppet::Type::Component)
+        Puppet.warning "Somehow left a component in the relationship graph"
+      else
+        resource.info "Starting to evaluate the resource" if Puppet[:evaltrace] and @catalog.host_config?
+        seconds = thinmark { block.call(resource) }
+        resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
+      end
+    end
+
+    Puppet.debug "Finishing transaction #{object_id}"
+  end
+
+  # Wraps application run state check to flag need to interrupt processing
+  def stop_processing?
+    Puppet::Application.stop_requested? && catalog.host_config?
   end
 
   # Are there any failed resources in this transaction?
@@ -43,35 +119,50 @@ class Puppet::Transaction
     report.resource_statuses.values.detect { |status| status.failed? }
   end
 
-  # Apply all changes for a resource
-  def apply(resource, ancestor = nil)
-    status = resource_harness.evaluate(resource)
-    add_resource_status(status)
-    event_manager.queue_events(ancestor || resource, status.events) unless status.failed?
-  rescue => detail
-    resource.err "Could not evaluate: #{detail}"
-  end
-
   # Find all of the changed resources.
   def changed?
     report.resource_statuses.values.find_all { |status| status.changed }.collect { |status| catalog.resource(status.resource) }
   end
 
-  # Find all of the applied resources (including failed attempts).
-  def applied_resources
-    report.resource_statuses.values.collect { |status| catalog.resource(status.resource) }
+  def relationship_graph
+    catalog.relationship_graph
   end
 
-  # Copy an important relationships from the parent to the newly-generated
-  # child resource.
-  def add_conditional_directed_dependency(parent, child, label=nil)
-    relationship_graph.add_vertex(child)
-    edge = parent.depthfirst? ? [child, parent] : [parent, child]
-    if relationship_graph.edge?(*edge.reverse)
-      parent.debug "Skipping automatic relationship to #{child}"
-    else
-      relationship_graph.add_edge(edge[0],edge[1],label)
+  def resource_status(resource)
+    report.resource_statuses[resource.to_s] || add_resource_status(Puppet::Resource::Status.new(resource))
+  end
+
+  # The tags we should be checking.
+  def tags
+    self.tags = Puppet[:tags] unless defined?(@tags)
+
+    super
+  end
+
+  def prefetch_if_necessary(resource)
+    provider_class = resource.provider.class
+    return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
+
+    resources = resources_by_provider(resource.type, provider_class.name)
+
+    if provider_class == resource.class.defaultprovider
+      providerless_resources = resources_by_provider(resource.type, nil)
+      providerless_resources.values.each {|res| res.provider = provider_class.name}
+      resources.merge! providerless_resources
     end
+
+    prefetch(provider_class, resources)
+  end
+
+  private
+
+  # Apply all changes for a resource
+  def apply(resource, ancestor = nil)
+    status = resource_harness.evaluate(resource)
+    add_resource_status(status)
+    event_manager.queue_events(ancestor || resource, status.events) unless status.failed?
+  rescue => detail
+    resource.err "Could not evaluate: #{detail}"
   end
 
   # Evaluate a single resource.
@@ -87,31 +178,6 @@ class Puppet::Transaction
     event_manager.process_events(resource)
   end
 
-  # This method does all the actual work of running a transaction.  It
-  # collects all of the changes, executes them, and responds to any
-  # necessary events.
-  def evaluate
-    add_dynamically_generated_resources
-
-    Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
-
-    relationship_graph.traverse do |resource|
-      if resource.is_a?(Puppet::Type::Component)
-        Puppet.warning "Somehow left a component in the relationship graph"
-      else
-        resource.info "Starting to evaluate the resource" if Puppet[:evaltrace] and @catalog.host_config?
-        seconds = thinmark { eval_resource(resource) }
-        resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
-      end
-    end
-
-    Puppet.debug "Finishing transaction #{object_id}"
-  end
-
-  def events
-    event_manager.events
-  end
-
   def failed?(resource)
     s = resource_status(resource) and s.failed?
   end
@@ -144,56 +210,6 @@ class Puppet::Transaction
     found_failed
   end
 
-  def eval_generate(resource)
-    return false unless resource.respond_to?(:eval_generate)
-    raise Puppet::DevError,"Depthfirst resources are not supported by eval_generate" if resource.depthfirst?
-    begin
-      made = resource.eval_generate.uniq
-      return false if made.empty?
-      made = Hash[made.map(&:name).zip(made)]
-    rescue => detail
-      resource.log_exception(detail, "Failed to generate additional resources using 'eval_generate: #{detail}")
-      return false
-    end
-    made.values.each do |res|
-      begin
-        res.tag(*resource.tags)
-        @catalog.add_resource(res)
-        res.finish
-      rescue Puppet::Resource::Catalog::DuplicateResourceError
-        res.info "Duplicate generated resource; skipping"
-      end
-    end
-    sentinel = Puppet::Type.type(:whit).new(:name => "completed_#{resource.title}", :catalog => resource.catalog)
-
-    # The completed whit is now the thing that represents the resource is done
-    relationship_graph.adjacent(resource,:direction => :out,:type => :edges).each { |e|
-      # But children run as part of the resource, not after it
-      next if made[e.target.name]
-
-      add_conditional_directed_dependency(sentinel, e.target, e.label)
-      relationship_graph.remove_edge! e
-    }
-
-    default_label = Puppet::Resource::Catalog::Default_label
-    made.values.each do |res|
-      # Depend on the nearest ancestor we generated, falling back to the
-      # resource if we have none
-      parent_name = res.ancestors.find { |a| made[a] and made[a] != res }
-      parent = made[parent_name] || resource
-
-      add_conditional_directed_dependency(parent, res)
-
-      # This resource isn't 'completed' until each child has run
-      add_conditional_directed_dependency(res, sentinel, default_label)
-    end
-
-    # This edge allows the resource's events to propagate, though it isn't
-    # strictly necessary for ordering purposes
-    add_conditional_directed_dependency(resource, sentinel, default_label)
-    true
-  end
-
   # A general method for recursively generating new resources from a
   # resource.
   def generate_additional_resources(resource)
@@ -218,29 +234,11 @@ class Puppet::Transaction
     end
   end
 
-  def add_dynamically_generated_resources
-    @catalog.vertices.each { |resource| generate_additional_resources(resource) }
-  end
-
   # Should we ignore tags?
   def ignore_tags?
     ! @catalog.host_config?
   end
 
-  # this should only be called by a Puppet::Type::Component resource now
-  # and it should only receive an array
-  def initialize(catalog, report = nil)
-    @catalog = catalog
-
-    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
-
-    @event_manager = Puppet::Transaction::EventManager.new(self)
-
-    @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
-
-    @prefetched_providers = Hash.new { |h,k| h[k] = {} }
-  end
-
   def resources_by_provider(type_name, provider_name)
     unless @resources_by_provider
       @resources_by_provider = Hash.new { |h, k| h[k] = Hash.new { |h, k| h[k] = {} } }
@@ -256,23 +254,6 @@ class Puppet::Transaction
     @resources_by_provider[type_name][provider_name] || {}
   end
 
-  def prefetch_if_necessary(resource)
-    provider_class = resource.provider.class
-    return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
-
-    resources = resources_by_provider(resource.type, provider_class.name)
-
-    if provider_class == resource.class.defaultprovider
-      providerless_resources = resources_by_provider(resource.type, nil)
-      providerless_resources.values.each {|res| res.provider = provider_class.name}
-      resources.merge! providerless_resources
-    end
-
-    prefetch(provider_class, resources)
-  end
-
-  attr_reader :prefetched_providers
-
   # Prefetch any providers that support it, yo.  We don't support prefetching
   # types, just providers.
   def prefetch(provider_class, resources)
@@ -287,155 +268,13 @@ class Puppet::Transaction
     @prefetched_providers[type_name][provider_class.name] = true
   end
 
-  # We want to monitor changes in the relationship graph of our
-  # catalog but this is complicated by the fact that the catalog
-  # both is_a graph and has_a graph, by the fact that changes to
-  # the structure of the object can have adverse serialization
-  # effects, by threading issues, by order-of-initialization issues,
-  # etc.
-  #
-  # Since the proper lifetime/scope of the monitoring is a transaction
-  # and the transaction is already commiting a mild law-of-demeter
-  # transgression, we cut the Gordian knot here by simply wrapping the
-  # transaction's view of the resource graph to capture and maintain
-  # the information we need.  Nothing outside the transaction needs
-  # this information, and nothing outside the transaction can see it
-  # except via the Transaction#relationship_graph
-
-  class Relationship_graph_wrapper
-    require 'puppet/rb_tree_map'
-    attr_reader :real_graph,:transaction,:ready,:generated,:done,:blockers,:unguessable_deterministic_key
-    def initialize(real_graph,transaction)
-      @real_graph = real_graph
-      @transaction = transaction
-      @ready = Puppet::RbTreeMap.new
-      @generated = {}
-      @done = {}
-      @blockers = {}
-      @unguessable_deterministic_key = Hash.new { |h,k| h[k] = Digest::SHA1.hexdigest("NaCl, MgSO4 (salts) and then #{k.ref}") }
-      @providerless_types = []
-    end
-    def method_missing(*args,&block)
-      real_graph.send(*args,&block)
-    end
-    def add_vertex(v)
-      real_graph.add_vertex(v)
-    end
-    def add_edge(f,t,label=nil)
-      key = unguessable_deterministic_key[t]
-
-      ready.delete(key)
-
-      real_graph.add_edge(f,t,label)
-    end
-    # Enqueue the initial set of resources, those with no dependencies.
-    def enqueue_roots
-      vertices.each do |v|
-        blockers[v] = direct_dependencies_of(v).length
-        enqueue(v) if blockers[v] == 0
-      end
-    end
-    # Decrement the blocker count for the resource by 1. If the number of
-    # blockers is unknown, count them and THEN decrement by 1.
-    def unblock(resource)
-      blockers[resource] ||= direct_dependencies_of(resource).select { |r2| !done[r2] }.length
-      if blockers[resource] > 0
-        blockers[resource] -= 1
-      else
-        resource.warning "appears to have a negative number of dependencies"
-      end
-      blockers[resource] <= 0
-    end
-    def enqueue(*resources)
-      resources.each do |resource|
-        key = unguessable_deterministic_key[resource]
-        ready[key] = resource
-      end
-    end
-    def finish(resource)
-      direct_dependents_of(resource).each do |v|
-        enqueue(v) if unblock(v)
-      end
-      done[resource] = true
-    end
-    def next_resource
-      ready.delete_min
-    end
-    def traverse(&block)
-      real_graph.report_cycles_in_graph
-
-      enqueue_roots
-
-      deferred_resources = []
-
-      while (resource = next_resource) && !transaction.stop_processing?
-        if resource.suitable?
-          made_progress = true
-
-          transaction.prefetch_if_necessary(resource)
-
-          # If we generated resources, we don't know what they are now
-          # blocking, so we opt to recompute it, rather than try to track every
-          # change that would affect the number.
-          blockers.clear if transaction.eval_generate(resource)
-
-          yield resource
-
-          finish(resource)
-        else
-          deferred_resources << resource
-        end
-
-        if ready.empty? and deferred_resources.any?
-          if made_progress
-            enqueue(*deferred_resources)
-          else
-            fail_unsuitable_resources(deferred_resources)
-          end
-
-          made_progress = false
-          deferred_resources = []
-        end
-      end
-
-      # Just once per type. No need to punish the user.
-      @providerless_types.uniq.each do |type|
-        Puppet.err "Could not find a suitable provider for #{type}"
-      end
-    end
-
-    def fail_unsuitable_resources(resources)
-      resources.each do |resource|
-        # We don't automatically assign unsuitable providers, so if there
-        # is one, it must have been selected by the user.
-        if resource.provider
-          resource.err "Provider #{resource.provider.class.name} is not functional on this host"
-        else
-          @providerless_types << resource.type
-        end
-
-        transaction.resource_status(resource).failed = true
-
-        finish(resource)
-      end
-    end
-  end
-
-  def relationship_graph
-    @relationship_graph ||= Relationship_graph_wrapper.new(catalog.relationship_graph,self)
-  end
-
   def add_resource_status(status)
-    report.add_resource_status status
-  end
-
-  def resource_status(resource)
-    report.resource_statuses[resource.to_s] || add_resource_status(Puppet::Resource::Status.new(resource))
+    report.add_resource_status(status)
   end
 
   # Is the resource currently scheduled?
   def scheduled?(resource)
-    self.ignoreschedules or resource_harness.scheduled?(resource_status(resource), resource)
+    self.ignoreschedules or resource_harness.scheduled?(resource)
   end
 
   # Should this resource be skipped?
@@ -454,19 +293,18 @@ class Puppet::Transaction
       end
     elsif resource.virtual?
       resource.debug "Skipping because virtual"
-    elsif resource.appliable_to_device? ^ for_network_device
-      resource.debug "Skipping #{resource.appliable_to_device? ? 'device' : 'host'} resources because running on a #{for_network_device ? 'device' : 'host'}"
+    elsif !host_and_device_resource?(resource) && resource.appliable_to_host? && for_network_device
+      resource.debug "Skipping host resources because running on a device"
+    elsif !host_and_device_resource?(resource) && resource.appliable_to_device? && !for_network_device
+      resource.debug "Skipping device resources because running on a posix host"
     else
       return false
     end
     true
   end
 
-  # The tags we should be checking.
-  def tags
-    self.tags = Puppet[:tags] unless defined?(@tags)
-
-    super
+  def host_and_device_resource?(resource)
+    resource.appliable_to_host? && resource.appliable_to_device?
   end
 
   def handle_qualified_tags( qualified )