puppet 4.4.0-universal-darwin

data/lib/puppet/ssl/validator/no_validator.rb

@@ -0,0 +1,20 @@
+require 'openssl'
+require 'puppet/ssl'
+
+# Performs no SSL verification
+# @api private
+#
+class Puppet::SSL::Validator::NoValidator < Puppet::SSL::Validator
+
+  def setup_connection(connection)
+    connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
+  end
+
+  def peer_certs
+    []
+  end
+
+  def verify_errors
+    []
+  end
+end

data/lib/puppet/status.rb

@@ -0,0 +1,40 @@
+require 'puppet/indirector'
+
+class Puppet::Status
+  extend Puppet::Indirector
+  indirects :status, :terminus_class => :local
+
+  attr_accessor :status
+
+  def initialize( status = nil )
+    @status = status || {"is_alive" => true}
+  end
+
+  def to_data_hash
+    @status
+  end
+
+  def self.from_data_hash(data)
+    if data.include?('status')
+      self.new(data['status'])
+    else
+      self.new(data)
+    end
+  end
+
+  def name
+    "status"
+  end
+
+  def name=(name)
+    # NOOP
+  end
+
+  def version
+    @status['version']
+  end
+
+  def version=(version)
+    @status['version'] = version
+  end
+end

data/lib/puppet/syntax_checkers.rb

@@ -0,0 +1,3 @@
+# A name space for syntax checkers provided by Puppet.
+module Puppet::SyntaxCheckers
+end

data/lib/puppet/syntax_checkers/json.rb

@@ -0,0 +1,37 @@
+# A syntax checker for JSON.
+# @api public
+require 'puppet/syntax_checkers'
+class Puppet::SyntaxCheckers::Json < Puppet::Plugins::SyntaxCheckers::SyntaxChecker
+
+  # Checks the text for JSON syntax issues and reports them to the given acceptor.
+  # This implementation is abstract, it raises {NotImplementedError} since a subclass should have implemented the
+  # method.
+  #
+  # Error messages from the checker are capped at 100 chars from the source text.
+  #
+  # @param text [String] The text to check
+  # @param syntax [String] The syntax identifier in mime style (e.g. 'json', 'json-patch+json', 'xml', 'myapp+xml'
+  # @param acceptor [#accept] A Diagnostic acceptor
+  # @param source_pos [Puppet::Pops::Adapters::SourcePosAdapter] A source pos adapter with location information
+  # @api public
+  #
+  def check(text, syntax, acceptor, source_pos)
+    raise ArgumentError.new("Json syntax checker: the text to check must be a String.") unless text.is_a?(String)
+    raise ArgumentError.new("Json syntax checker: the syntax identifier must be a String, e.g. json, data+json") unless syntax.is_a?(String)
+    raise ArgumentError.new("Json syntax checker: invalid Acceptor, got: '#{acceptor.class.name}'.") unless acceptor.is_a?(Puppet::Pops::Validation::Acceptor)
+    #raise ArgumentError.new("Json syntax checker: location_info must be a Hash") unless location_info.is_a?(Hash)
+
+    begin
+      JSON.parse(text)
+    rescue => e
+      # Cap the message to 100 chars and replace newlines
+      msg = "JSON syntax checker: Cannot parse invalid JSON string. \"#{e.message().slice(0,100).gsub(/\r?\n/, "\\n")}\""
+
+      # TODO: improve the pops API to allow simpler diagnostic creation while still maintaining capabilities
+      # and the issue code. (In this case especially, where there is only a single error message being issued).
+      #
+      issue = Puppet::Pops::Issues::issue(:ILLEGAL_JSON) { msg }
+      acceptor.accept(Puppet::Pops::Validation::Diagnostic.new(:error, issue, source_pos.locator.file, source_pos, {}))
+    end
+  end
+end

data/lib/puppet/test/test_helper.rb

@@ -0,0 +1,254 @@
+require 'puppet/indirector/data_binding/hiera'
+
+require 'tmpdir'
+require 'fileutils'
+
+module Puppet::Test
+  # This class is intended to provide an API to be used by external projects
+  #  when they are running tests that depend on puppet core.  This should
+  #  allow us to vary the implementation details of managing puppet's state
+  #  for testing, from one version of puppet to the next--without forcing
+  #  the external projects to do any of that state management or be aware of
+  #  the implementation details.
+  #
+  # For now, this consists of a few very simple signatures.  The plan is
+  #  that it should be the responsibility of the puppetlabs_spec_helper
+  #  to broker between external projects and this API; thus, if any
+  #  hacks are required (e.g. to determine whether or not a particular)
+  #  version of puppet supports this API, those hacks will be consolidated in
+  #  one place and won't need to be duplicated in every external project.
+  #
+  # This should also alleviate the anti-pattern that we've been following,
+  #  wherein each external project starts off with a copy of puppet core's
+  #  test_helper.rb and is exposed to risk of that code getting out of
+  #  sync with core.
+  #
+  # Since this class will be "library code" that ships with puppet, it does
+  #  not use API from any existing test framework such as rspec.  This should
+  #  theoretically allow it to be used with other unit test frameworks in the
+  #  future, if desired.
+  #
+  # Note that in the future this API could potentially be expanded to handle
+  #  other features such as "around_test", but we didn't see a compelling
+  #  reason to deal with that right now.
+  class TestHelper
+    # Call this method once, as early as possible, such as before loading tests
+    # that call Puppet.
+    # @return nil
+    def self.initialize()
+      # This meta class instance variable is used as a guard to ensure that
+      # before_each, and after_each are only called once. This problem occurs
+      # when there are more than one puppet test infrastructure "orchestrator in us.
+      # The use of both puppetabs-spec_helper, and rodjek-rspec_puppet will cause
+      # two resets of the puppet environment, and will cause problem rolling back to
+      # a known point as there is no way to differentiate where the calls are coming
+      # from. See more information in #before_each_test, and #after_each_test
+      # Note that the variable is only initialized to 0 if nil. This is important
+      # as more than one orchestrator will call initialize. A second call can not
+      # simply set it to 0 since that would potentially destroy an active guard.
+      #
+      @@reentry_count ||= 0
+
+      @environmentpath = Dir.mktmpdir('environments')
+      Dir.mkdir("#{@environmentpath}/production")
+      owner = Process.pid
+      Puppet.push_context(Puppet.base_context({
+        :environmentpath => @environmentpath,
+        :basemodulepath => "",
+      }), "Initial for specs")
+      Puppet::Parser::Functions.reset
+
+      ObjectSpace.define_finalizer(Puppet.lookup(:environments), proc {
+        if Process.pid == owner
+          FileUtils.rm_rf(@environmentpath)
+        end
+      })
+      Puppet::SSL::Oids.register_puppet_oids
+    end
+
+    # Call this method once, when beginning a test run--prior to running
+    #  any individual tests.
+    # @return nil
+    def self.before_all_tests()
+      # Make sure that all of the setup is also done for any before(:all) blocks
+    end
+
+    # Call this method once, at the end of a test run, when no more tests
+    #  will be run.
+    # @return nil
+    def self.after_all_tests()
+    end
+
+    # The name of the rollback mark used in the Puppet.context. This is what
+    # the test infrastructure returns to for each test.
+    #
+    ROLLBACK_MARK = "initial testing state"
+
+    # Call this method once per test, prior to execution of each invididual test.
+    # @return nil
+    def self.before_each_test()
+      # When using both rspec-puppet and puppet-rspec-helper, there are two packages trying
+      # to be helpful and orchestrate the callback sequence. We let only the first win, the
+      # second callback results in a no-op.
+      # Likewise when entering after_each_test(), a check is made to make tear down happen
+      # only once.
+      #
+      return unless @@reentry_count == 0
+      @@reentry_count = 1
+
+      Puppet.mark_context(ROLLBACK_MARK)
+
+      # We need to preserve the current state of all our indirection cache and
+      # terminus classes.  This is pretty important, because changes to these
+      # are global and lead to order dependencies in our testing.
+      #
+      # We go direct to the implementation because there is no safe, sane public
+      # API to manage restoration of these to their default values.  This
+      # should, once the value is proved, be moved to a standard API on the
+      # indirector.
+      #
+      # To make things worse, a number of the tests stub parts of the
+      # indirector.  These stubs have very specific expectations that what
+      # little of the public API we could use is, well, likely to explode
+      # randomly in some tests.  So, direct access.  --daniel 2011-08-30
+      $saved_indirection_state = {}
+      indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
+      indirections.each do |indirector|
+        $saved_indirection_state[indirector.name] = {
+            :@terminus_class => indirector.instance_variable_get(:@terminus_class),
+            :@cache_class    => indirector.instance_variable_get(:@cache_class)
+        }
+      end
+
+      # The process environment is a shared, persistent resource.
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      $old_env = Puppet::Util.get_environment(mode)
+
+      # So is the load_path
+      $old_load_path = $LOAD_PATH.dup
+
+      initialize_settings_before_each()
+
+      Puppet.push_context(
+        {
+          :trusted_information =>
+            Puppet::Context::TrustedInformation.new('local', 'testing', {}),
+        },
+        "Context for specs")
+
+      Puppet::Parser::Functions.reset
+      Puppet::Application.clear!
+      Puppet::Util::Profiler.clear
+
+      Puppet.clear_deprecation_warnings
+
+      Puppet::DataBinding::Hiera.instance_variable_set("@hiera", nil)
+    end
+
+    # Call this method once per test, after execution of each individual test.
+    # @return nil
+    def self.after_each_test()
+      # Ensure that a matching tear down only happens once per completed setup
+      # (see #before_each_test).
+      return unless @@reentry_count == 1
+      @@reentry_count = 0
+
+      Puppet.settings.send(:clear_everything_for_tests)
+
+      Puppet::Util::Storage.clear
+      Puppet::Util::ExecutionStub.reset
+
+      Puppet.clear_deprecation_warnings
+
+      # uncommenting and manipulating this can be useful when tracking down calls to deprecated code
+      #Puppet.log_deprecations_to_file("deprecations.txt", /^Puppet::Util.exec/)
+
+      # Restore the indirector configuration.  See before hook.
+      indirections = Puppet::Indirector::Indirection.send(:class_variable_get, :@@indirections)
+      indirections.each do |indirector|
+        $saved_indirection_state.fetch(indirector.name, {}).each do |variable, value|
+          indirector.instance_variable_set(variable, value)
+        end
+      end
+      $saved_indirection_state = nil
+
+      # Can't use Puppet.features.microsoft_windows? as it may be mocked out in a test.  This can cause test recurring test failures
+      if (!!File::ALT_SEPARATOR)
+        mode = :windows
+      else
+        mode = :posix
+      end
+      # Restore the global process environment.  Can't just assign because this
+      # is a magic variable, sadly, and doesn't do that™.  It is sufficiently
+      # faster to use the compare-then-set model to avoid excessive work that it
+      # justifies the complexity.  --daniel 2012-03-15
+      unless Puppet::Util.get_environment(mode) == $old_env
+        Puppet::Util.clear_environment(mode)
+        $old_env.each {|k, v| Puppet::Util.set_env(k, v, mode) }
+      end
+
+      # Restore the load_path late, to avoid messing with stubs from the test.
+      $LOAD_PATH.clear
+      $old_load_path.each {|x| $LOAD_PATH << x }
+
+      Puppet.rollback_context(ROLLBACK_MARK)
+    end
+
+
+    #########################################################################################
+    # PRIVATE METHODS (not part of the public TestHelper API--do not call these from outside
+    #  of this class!)
+    #########################################################################################
+
+    def self.app_defaults_for_tests()
+      {
+          :logdir     => "/dev/null",
+          :confdir    => "/dev/null",
+          :codedir    => "/dev/null",
+          :vardir     => "/dev/null",
+          :rundir     => "/dev/null",
+          :hiera_config => "/dev/null",
+      }
+    end
+    private_class_method :app_defaults_for_tests
+
+    def self.initialize_settings_before_each()
+      Puppet.settings.preferred_run_mode = "user"
+      # Initialize "app defaults" settings to a good set of test values
+      Puppet.settings.initialize_app_defaults(app_defaults_for_tests)
+
+      # Avoid opening ports to the outside world
+      Puppet.settings[:bindaddress] = "127.0.0.1"
+
+      # We don't want to depend upon the reported domain name of the
+      # machine running the tests, nor upon the DNS setup of that
+      # domain.
+      Puppet.settings[:use_srv_records] = false
+
+      # Longer keys are secure, but they sure make for some slow testing - both
+      # in terms of generating keys, and in terms of anything the next step down
+      # the line doing validation or whatever.  Most tests don't care how long
+      # or secure it is, just that it exists, so these are better and faster
+      # defaults, in testing only.
+      #
+      # I would make these even shorter, but OpenSSL doesn't support anything
+      # below 512 bits.  Sad, really, because a 0 bit key would be just fine.
+      Puppet[:req_bits]  = 512
+      Puppet[:keylength] = 512
+
+      # Although we setup a testing context during initialization, some tests
+      # will end up creating their own context using the real context objects
+      # and use the setting for the environments. In order to avoid those tests
+      # having to deal with a missing environmentpath we can just set it right
+      # here.
+      Puppet[:environmentpath] = @environmentpath
+      Puppet[:environment_timeout] = 0
+    end
+    private_class_method :initialize_settings_before_each
+  end
+end

data/lib/puppet/transaction.rb

@@ -0,0 +1,405 @@
+require 'puppet'
+require 'puppet/util/tagging'
+require 'puppet/util/skip_tags'
+require 'puppet/application'
+require 'digest/sha1'
+require 'set'
+
+# the class that actually walks our resource/property tree, collects the changes,
+# and performs them
+#
+# @api private
+class Puppet::Transaction
+  require 'puppet/transaction/additional_resource_generator'
+  require 'puppet/transaction/event'
+  require 'puppet/transaction/event_manager'
+  require 'puppet/transaction/resource_harness'
+  require 'puppet/resource/status'
+
+  attr_accessor :catalog, :ignoreschedules, :for_network_device
+
+  # The report, once generated.
+  attr_reader :report
+
+  # Routes and stores any events and subscriptions.
+  attr_reader :event_manager
+
+  # Handles most of the actual interacting with resources
+  attr_reader :resource_harness
+
+  attr_reader :prefetched_providers
+
+  include Puppet::Util
+  include Puppet::Util::Tagging
+
+  def initialize(catalog, report, prioritizer)
+    @catalog = catalog
+
+    @report = report || Puppet::Transaction::Report.new("apply", catalog.version, catalog.environment)
+
+    @prioritizer = prioritizer
+
+    @report.add_times(:config_retrieval, @catalog.retrieval_duration || 0)
+
+    @event_manager = Puppet::Transaction::EventManager.new(self)
+
+    @resource_harness = Puppet::Transaction::ResourceHarness.new(self)
+
+    @prefetched_providers = Hash.new { |h,k| h[k] = {} }
+  end
+
+  # Invoke the pre_run_check hook in every resource in the catalog.
+  # This should (only) be called by Transaction#evaluate before applying
+  # the catalog.
+  #
+  # @see Puppet::Transaction#evaluate
+  # @see Puppet::Type#pre_run_check
+  # @raise [Puppet::Error] If any pre-run checks failed.
+  # @return [void]
+  def perform_pre_run_checks
+    prerun_errors = {}
+
+    @catalog.vertices.each do |res|
+      begin
+        res.pre_run_check
+      rescue Puppet::Error => detail
+        prerun_errors[res] = detail
+      end
+    end
+
+    unless prerun_errors.empty?
+      prerun_errors.each do |res, detail|
+        res.log_exception(detail)
+      end
+      raise Puppet::Error, "Some pre-run checks failed"
+    end
+  end
+
+  # This method does all the actual work of running a transaction.  It
+  # collects all of the changes, executes them, and responds to any
+  # necessary events.
+  def evaluate(&block)
+    block ||= method(:eval_resource)
+    generator = AdditionalResourceGenerator.new(@catalog, nil, @prioritizer)
+    @catalog.vertices.each { |resource| generator.generate_additional_resources(resource) }
+
+    perform_pre_run_checks
+
+    Puppet.info "Applying configuration version '#{catalog.version}'" if catalog.version
+
+    continue_while = lambda { !stop_processing? }
+
+    post_evalable_providers = Set.new
+    pre_process = lambda do |resource|
+      prov_class = resource.provider.class
+      post_evalable_providers << prov_class if prov_class.respond_to?(:post_resource_eval)
+
+      prefetch_if_necessary(resource)
+
+      # If we generated resources, we don't know what they are now
+      # blocking, so we opt to recompute it, rather than try to track every
+      # change that would affect the number.
+      relationship_graph.clear_blockers if generator.eval_generate(resource)
+    end
+
+    providerless_types = []
+    overly_deferred_resource_handler = lambda do |resource|
+      # We don't automatically assign unsuitable providers, so if there
+      # is one, it must have been selected by the user.
+      return if missing_tags?(resource)
+      if resource.provider
+        resource.err "Provider #{resource.provider.class.name} is not functional on this host"
+      else
+        providerless_types << resource.type
+      end
+
+      resource_status(resource).failed = true
+    end
+
+    canceled_resource_handler = lambda do |resource|
+      resource_status(resource).skipped = true
+      resource.debug "Transaction canceled, skipping"
+    end
+
+    teardown = lambda do
+      # Just once per type. No need to punish the user.
+      providerless_types.uniq.each do |type|
+        Puppet.err "Could not find a suitable provider for #{type}"
+      end
+
+      post_evalable_providers.each do |provider|
+        begin
+          provider.post_resource_eval
+        rescue => detail
+          Puppet.log_exception(detail, "post_resource_eval failed for provider #{provider}")
+        end
+      end
+    end
+
+    # Generate the relationship graph, set up our generator to use it
+    # for eval_generate, then kick off our traversal.
+    generator.relationship_graph = relationship_graph
+    relationship_graph.traverse(:while => continue_while,
+                                :pre_process => pre_process,
+                                :overly_deferred_resource_handler => overly_deferred_resource_handler,
+                                :canceled_resource_handler => canceled_resource_handler,
+                                :teardown => teardown) do |resource|
+      if resource.is_a?(Puppet::Type::Component)
+        Puppet.warning "Somehow left a component in the relationship graph"
+      else
+        resource.info "Starting to evaluate the resource" if Puppet[:evaltrace] and @catalog.host_config?
+        seconds = thinmark { block.call(resource) }
+        resource.info "Evaluated in %0.2f seconds" % seconds if Puppet[:evaltrace] and @catalog.host_config?
+      end
+    end
+
+    Puppet.debug "Finishing transaction #{object_id}"
+  end
+
+  # Wraps application run state check to flag need to interrupt processing
+  def stop_processing?
+    Puppet::Application.stop_requested? && catalog.host_config?
+  end
+
+  # Are there any failed resources in this transaction?
+  def any_failed?
+    report.resource_statuses.values.detect { |status| status.failed? }
+  end
+
+  # Find all of the changed resources.
+  def changed?
+    report.resource_statuses.values.find_all { |status| status.changed }.collect { |status| catalog.resource(status.resource) }
+  end
+
+  def relationship_graph
+    catalog.relationship_graph(@prioritizer)
+  end
+
+  def resource_status(resource)
+    report.resource_statuses[resource.to_s] || add_resource_status(Puppet::Resource::Status.new(resource))
+  end
+
+  # The tags we should be checking.
+  def tags
+    self.tags = Puppet[:tags] unless defined?(@tags)
+
+    super
+  end
+
+  def skip_tags
+    @skip_tags ||= Puppet::Util::SkipTags.new(Puppet[:skip_tags]).tags
+  end
+
+  def prefetch_if_necessary(resource)
+    provider_class = resource.provider.class
+    return unless provider_class.respond_to?(:prefetch) and !prefetched_providers[resource.type][provider_class.name]
+
+    resources = resources_by_provider(resource.type, provider_class.name)
+
+    if provider_class == resource.class.defaultprovider
+      providerless_resources = resources_by_provider(resource.type, nil)
+      providerless_resources.values.each {|res| res.provider = provider_class.name}
+      resources.merge! providerless_resources
+    end
+
+    prefetch(provider_class, resources)
+  end
+
+  private
+
+  # Apply all changes for a resource
+  def apply(resource, ancestor = nil)
+    status = resource_harness.evaluate(resource)
+    add_resource_status(status)
+    event_manager.queue_events(ancestor || resource, status.events) unless status.failed?
+  rescue => detail
+    resource.err "Could not evaluate: #{detail}"
+  end
+
+  # Evaluate a single resource.
+  def eval_resource(resource, ancestor = nil)
+    propagate_failure(resource)
+    if skip?(resource)
+      resource_status(resource).skipped = true
+      resource.debug("Resource is being skipped, unscheduling all events")
+      event_manager.dequeue_all_events_for_resource(resource)
+    else
+      resource_status(resource).scheduled = true
+      apply(resource, ancestor)
+      event_manager.process_events(resource)
+    end
+  end
+
+  def failed?(resource)
+    s = resource_status(resource) and s.failed?
+  end
+
+  # Does this resource have any failed dependencies?
+  def failed_dependencies?(resource)
+    # When we introduced the :whit into the graph, to reduce the combinatorial
+    # explosion of edges, we also ended up reporting failures for containers
+    # like class and stage.  This is undesirable; while just skipping the
+    # output isn't perfect, it is RC-safe. --daniel 2011-06-07
+    suppress_report = (resource.class == Puppet::Type.type(:whit))
+
+    s = resource_status(resource)
+    if s && s.dependency_failed?
+      # See above. --daniel 2011-06-06
+      unless suppress_report then
+        s.failed_dependencies.each do |dep|
+          resource.notice "Dependency #{dep} has failures: #{resource_status(dep).failed}"
+        end
+      end
+    end
+
+    s && s.dependency_failed?
+  end
+
+  # We need to know if a resource has any failed dependencies before
+  # we try to process it. We keep track of this by keeping a list on
+  # each resource of the failed dependencies, and incrementally
+  # computing it as the union of the failed dependencies of each
+  # first-order dependency. We have to do this as-we-go instead of
+  # up-front at failure time because the graph may be mutated as we
+  # walk it.
+  def propagate_failure(resource)
+    failed = Set.new
+    relationship_graph.direct_dependencies_of(resource).each do |dep|
+      if (s = resource_status(dep))
+        failed.merge(s.failed_dependencies) if s.dependency_failed?
+        if s.failed?
+          failed.add(dep)
+        end
+      end
+    end
+    resource_status(resource).failed_dependencies = failed.to_a
+  end
+
+  # A general method for recursively generating new resources from a
+  # resource.
+  def generate_additional_resources(resource)
+    return unless resource.respond_to?(:generate)
+    begin
+      made = resource.generate
+    rescue => detail
+      resource.log_exception(detail, "Failed to generate additional resources using 'generate': #{detail}")
+    end
+    return unless made
+    made = [made] unless made.is_a?(Array)
+    made.uniq.each do |res|
+      begin
+        res.tag(*resource.tags)
+        @catalog.add_resource(res)
+        res.finish
+        add_conditional_directed_dependency(resource, res)
+        generate_additional_resources(res)
+      rescue Puppet::Resource::Catalog::DuplicateResourceError
+        res.info "Duplicate generated resource; skipping"
+      end
+    end
+  end
+
+  # Should we ignore tags?
+  def ignore_tags?
+    ! @catalog.host_config?
+  end
+
+  def resources_by_provider(type_name, provider_name)
+    unless @resources_by_provider
+      @resources_by_provider = Hash.new { |h, k| h[k] = Hash.new { |h1, k1| h1[k1] = {} } }
+
+      @catalog.vertices.each do |resource|
+        if resource.class.attrclass(:provider)
+          prov = resource.provider && resource.provider.class.name
+          @resources_by_provider[resource.type][prov][resource.name] = resource
+        end
+      end
+    end
+
+    @resources_by_provider[type_name][provider_name] || {}
+  end
+
+  # Prefetch any providers that support it, yo.  We don't support prefetching
+  # types, just providers.
+  def prefetch(provider_class, resources)
+    type_name = provider_class.resource_type.name
+    return if @prefetched_providers[type_name][provider_class.name]
+    Puppet.debug "Prefetching #{provider_class.name} resources for #{type_name}"
+    begin
+      provider_class.prefetch(resources)
+    rescue LoadError, Puppet::MissingCommand => detail
+      Puppet.log_exception(detail, "Could not prefetch #{type_name} provider '#{provider_class.name}': #{detail}")
+    end
+    @prefetched_providers[type_name][provider_class.name] = true
+  end
+
+  def add_resource_status(status)
+    report.add_resource_status(status)
+  end
+
+  # Is the resource currently scheduled?
+  def scheduled?(resource)
+    self.ignoreschedules or resource_harness.scheduled?(resource)
+  end
+
+  # Should this resource be skipped?
+  def skip?(resource)
+    if skip_tags?(resource)
+      resource.debug "Skipping with skip tags #{skip_tags.join(", ")}"
+    elsif missing_tags?(resource)
+      resource.debug "Not tagged with #{tags.join(", ")}"
+    elsif ! scheduled?(resource)
+      resource.debug "Not scheduled"
+    elsif failed_dependencies?(resource)
+      # When we introduced the :whit into the graph, to reduce the combinatorial
+      # explosion of edges, we also ended up reporting failures for containers
+      # like class and stage.  This is undesirable; while just skipping the
+      # output isn't perfect, it is RC-safe. --daniel 2011-06-07
+      unless resource.class == Puppet::Type.type(:whit) then
+        resource.warning "Skipping because of failed dependencies"
+      end
+    elsif resource.virtual?
+      resource.debug "Skipping because virtual"
+    elsif !host_and_device_resource?(resource) && resource.appliable_to_host? && for_network_device
+      resource.debug "Skipping host resources because running on a device"
+    elsif !host_and_device_resource?(resource) && resource.appliable_to_device? && !for_network_device
+      resource.debug "Skipping device resources because running on a posix host"
+    else
+      return false
+    end
+    true
+  end
+
+  def host_and_device_resource?(resource)
+    resource.appliable_to_host? && resource.appliable_to_device?
+  end
+
+  # Is this resource tagged appropriately?
+  def missing_tags?(resource)
+    return false if ignore_tags?
+    return false if tags.empty?
+
+    not resource.tagged?(*tags)
+  end
+
+  def skip_tags?(resource)
+    return false if ignore_tags?
+    return false if skip_tags.empty?
+
+    resource.tagged?(*skip_tags)
+  end
+
+  def split_qualified_tags?
+    false
+  end
+
+  # These two methods are only made public to enable the existing spec tests to run
+  # under rspec 3 (apparently rspec 2 didn't enforce access controls?). Please do not
+  # treat these as part of a public API.
+  # Possible future improvement: rewrite to not require access to private methods.
+  public :skip?
+  public :missing_tags?
+
+end
+
+require 'puppet/transaction/report'