removed in-place modification of "states" dict in client tools

18 files changed, 1198 insertions, 1241 deletions

diff --git a/src/lib/Bcfg2/Client/Client.py b/src/lib/Bcfg2/Client/Client.py
index 08f56a720..e2521c0f8 100644
--- a/src/lib/Bcfg2/Client/Client.py
+++ b/src/lib/Bcfg2/Client/Client.py
@@ -53,7 +53,7 @@ class Client(object):
                 raise SystemExit(1)
         if 'drivers' in self.setup and self.setup['drivers'] == 'help':
             self.logger.info("The following drivers are available:")
-            self.logger.info(Bcfg2.Client.Tools.drivers)
+            self.logger.info(Bcfg2.Client.Tools.__all__)
             raise SystemExit(0)
         if self.setup['remove'] and 'services' in self.setup['remove'].lower():
             self.logger.error("Service removal is nonsensical; "
diff --git a/src/lib/Bcfg2/Client/Frame.py b/src/lib/Bcfg2/Client/Frame.py
index 3f6eef893..82512130c 100644
--- a/src/lib/Bcfg2/Client/Frame.py
+++ b/src/lib/Bcfg2/Client/Frame.py
@@ -56,6 +56,10 @@ class Frame(object):
         self.dryrun = self.setup['dryrun']
         self.times['initialization'] = time.time()
         self.tools = []
+
+        #: A dict of the state of each entry.  Keys are the entries.
+        #: Values are boolean: True means that the entry is good,
+        #: False means that the entry is bad.
         self.states = {}
         self.whitelist = []
         self.blacklist = []
@@ -63,7 +67,7 @@ class Frame(object):
         self.logger = logging.getLogger(__name__)
         drivers = self.setup['drivers']
         for driver in drivers[:]:
-            if driver not in Bcfg2.Client.Tools.drivers and \
+            if driver not in Bcfg2.Client.Tools.__all__ and \
                    isinstance(driver, str):
                 self.logger.error("Tool driver %s is not available" % driver)
                 drivers.remove(driver)
@@ -263,7 +267,7 @@ class Frame(object):
                 self.states[entry] = False
         for tool in self.tools:
             try:
-                tool.Inventory(self.states)
+                self.states.update(tool.Inventory())
             except:
                 self.logger.error("%s.Inventory() call failed:" % tool.name,
                                   exc_info=1)
@@ -382,7 +386,7 @@ class Frame(object):
             if not handled:
                 continue
             try:
-                tool.Install(handled, self.states)
+                self.states.update(tool.Install(handled))
             except:
                 self.logger.error("%s.Install() call failed:" % tool.name,
                                   exc_info=1)
@@ -402,7 +406,7 @@ class Frame(object):
             tbm = [(t, b) for t in self.tools for b in mbundles]
             for tool, bundle in tbm:
                 try:
-                    tool.Inventory(self.states, [bundle])
+                    self.states.update(tool.Inventory(structures=[bundle]))
                 except:
                     self.logger.error("%s.Inventory() call failed:" %
                                       tool.name,
@@ -428,7 +432,7 @@ class Frame(object):
                 else:
                     func = tool.BundleNotUpdated
                 try:
-                    func(bundle, self.states)
+                    self.states.update(func(bundle))
                 except:
                     self.logger.error("%s.%s(%s:%s) call failed:" %
                                       (tool.name, func.im_func.func_name,
@@ -438,7 +442,7 @@ class Frame(object):
         for indep in self.config.findall('.//Independent'):
             for tool in self.tools:
                 try:
-                    tool.BundleNotUpdated(indep, self.states)
+                    self.states.update(tool.BundleNotUpdated(indep))
                 except:
                     self.logger.error("%s.BundleNotUpdated(%s:%s) call failed:"
                                       % (tool.name, indep.tag,
diff --git a/src/lib/Bcfg2/Client/Tools/APT.py b/src/lib/Bcfg2/Client/Tools/APT.py
index e44668bf2..cc2f657d0 100644
--- a/src/lib/Bcfg2/Client/Tools/APT.py
+++ b/src/lib/Bcfg2/Client/Tools/APT.py
@@ -217,7 +217,7 @@ class APT(Bcfg2.Client.Tools.Tool):
             self.modified += packages
             self.extra = self.FindExtra()
 
-    def Install(self, packages, states):
+    def Install(self, packages):
         # it looks like you can't install arbitrary versions of software
         # out of the pkg cache, we will still need to call apt-get
         ipkgs = []
@@ -257,10 +257,12 @@ class APT(Bcfg2.Client.Tools.Tool):
             self.logger.error("APT command failed")
         self.pkg_cache = apt.cache.Cache()
         self.extra = self.FindExtra()
+        states = dict()
         for package in packages:
             states[package] = self.VerifyPackage(package, [], checksums=False)
             if states[package]:
                 self.modified.append(package)
+        return states
 
     def VerifyPath(self, entry, _):
         """Do nothing here since we only verify Path type=ignore."""
diff --git a/src/lib/Bcfg2/Client/Tools/Action.py b/src/lib/Bcfg2/Client/Tools/Action.py
index 7e8366928..7b62f61c7 100644
--- a/src/lib/Bcfg2/Client/Tools/Action.py
+++ b/src/lib/Bcfg2/Client/Tools/Action.py
@@ -68,19 +68,23 @@ class Action(Bcfg2.Client.Tools.Tool):
             return self.RunAction(entry)
         return True
 
-    def BundleUpdated(self, bundle, states):
+    def BundleUpdated(self, bundle):
         """Run postinstalls when bundles have been updated."""
+        states = dict()
         for action in bundle.findall("Action"):
             if action.get('timing') in ['post', 'both']:
                 if not self._action_allowed(action):
                     continue
                 states[action] = self.RunAction(action)
+        return states
 
-    def BundleNotUpdated(self, bundle, states):
+    def BundleNotUpdated(self, bundle):
         """Run Actions when bundles have not been updated."""
+        states = dict()
         for action in bundle.findall("Action"):
             if (action.get('timing') in ['post', 'both'] and
                 action.get('when') != 'modified'):
                 if not self._action_allowed(action):
                     continue
                 states[action] = self.RunAction(action)
+        return states
diff --git a/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py b/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py
index cfb433c9c..4f1f8e5aa 100644
--- a/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py
+++ b/src/lib/Bcfg2/Client/Tools/POSIX/__init__.py
@@ -53,7 +53,7 @@ class POSIX(Bcfg2.Client.Tools.Tool):
             if POSIXTool in hdlr.__mro__:
                 # figure out what entry type this handler handles
                 etype = hdlr.__name__[5:].lower()
-                rv[etype] = hdlr(self.logger, self.setup, self.config)
+                rv[etype] = hdlr(self.config)
         return rv
 
     def canVerify(self, entry):
diff --git a/src/lib/Bcfg2/Client/Tools/POSIXUsers.py b/src/lib/Bcfg2/Client/Tools/POSIXUsers.py
index 84db04b83..8ba1944d8 100644
--- a/src/lib/Bcfg2/Client/Tools/POSIXUsers.py
+++ b/src/lib/Bcfg2/Client/Tools/POSIXUsers.py
@@ -86,7 +86,7 @@ class POSIXUsers(Bcfg2.Client.Tools.Tool):
             return False
         return True
 
-    def Inventory(self, states, structures=None):
+    def Inventory(self, structures=None):
         if not structures:
             structures = self.config.getchildren()
         # we calculate a list of all POSIXUser and POSIXGroup entries,
@@ -106,7 +106,8 @@ class POSIXUsers(Bcfg2.Client.Tools.Tool):
                                       (group, entry.get("name")))
                     struct.append(Bcfg2.Client.XML.Element("POSIXGroup",
                                                            name=group))
-        return Bcfg2.Client.Tools.Tool.Inventory(self, states, structures)
+        return Bcfg2.Client.Tools.Tool.Inventory(self, structures)
+    Inventory.__doc__ = Bcfg2.Client.Tools.Tool.Inventory.__doc__
 
     def FindExtra(self):
         extra = []
@@ -206,7 +207,8 @@ class POSIXUsers(Bcfg2.Client.Tools.Tool):
             entry.set('qtext', "\n".join([entry.get('qtext', '')] + errors))
         return len(errors) == 0
 
-    def Install(self, entries, states):
+    def Install(self, entries):
+        states = dict()
         for entry in entries:
             # install groups first, so that all groups exist for
             # users that might need them
@@ -216,6 +218,7 @@ class POSIXUsers(Bcfg2.Client.Tools.Tool):
             if entry.tag == 'POSIXUser':
                 states[entry] = self._install(entry)
         self._existing = None
+        return states
 
     def _install(self, entry):
         """ add or modify a user or group using the appropriate command """
diff --git a/src/lib/Bcfg2/Client/Tools/Pacman.py b/src/lib/Bcfg2/Client/Tools/Pacman.py
index fd310441c..15fab53bd 100644
--- a/src/lib/Bcfg2/Client/Tools/Pacman.py
+++ b/src/lib/Bcfg2/Client/Tools/Pacman.py
@@ -61,7 +61,7 @@ class Pacman(Bcfg2.Client.Tools.PkgTool):
         self.RefreshPackages()
         self.extra = self.FindExtra()
 
-    def Install(self, packages, states):
+    def Install(self, packages):
         '''
         Pacman Install
         '''
diff --git a/src/lib/Bcfg2/Client/Tools/RPM.py b/src/lib/Bcfg2/Client/Tools/RPM.py
index 18eddbb44..be5ad01e2 100644
--- a/src/lib/Bcfg2/Client/Tools/RPM.py
+++ b/src/lib/Bcfg2/Client/Tools/RPM.py
@@ -1,9 +1,1077 @@
 """Bcfg2 Support for RPMS"""
 
-import os.path
+import os
 import rpm
-import rpmtools
 import Bcfg2.Client.Tools
+import grp
+import optparse
+import pwd
+import stat
+import sys
+try:
+    import hashlib
+    py24compat = False
+except ImportError:
+    # FIXME: Remove when client python dep is 2.5 or greater
+    py24compat = True
+    import md5
+
+# Determine what prelink tools we have available.
+# The isprelink module is a python extension that examines the ELF headers
+# to see if the file has been prelinked.  If it is not present a lot of files
+# are unnecessarily run through the prelink command.
+try:
+    from isprelink import *
+    isprelink_imported = True
+except ImportError:
+    isprelink_imported = False
+
+# If the prelink command is installed on the system then we need to do
+# prelink -y on files.
+if os.access('/usr/sbin/prelink', os.X_OK):
+    prelink_exists = True
+else:
+    prelink_exists = False
+
+# If we don't have isprelink then we will use the prelink configuration file to
+# filter what we have to put through prelink -y.
+import re
+blacklist = []
+whitelist = []
+try:
+    f = open('/etc/prelink.conf', mode='r')
+    for line in f:
+        if line.startswith('#'):
+            continue
+        option, pattern = line.split()
+        if pattern.startswith('*.'):
+            pattern = pattern.replace('*.', '\.')
+            pattern += '$'
+        elif pattern.startswith('/'):
+            pattern = '^' + pattern
+        if option == '-b':
+            blacklist.append(pattern)
+        elif option == '-l':
+            whitelist.append(pattern)
+    f.close()
+except IOError:
+    pass
+
+blacklist_re = re.compile('|'.join(blacklist))
+whitelist_re = re.compile('|'.join(whitelist))
+
+# Flags that are not defined in rpm-python.
+# They are defined in lib/rpmcli.h
+# Bit(s) for verifyFile() attributes.
+#
+RPMVERIFY_NONE            = 0                      #  /*!< */
+RPMVERIFY_MD5             = 1          # 1 << 0    #  /*!< from %verify(md5) */
+RPMVERIFY_FILESIZE        = 2          # 1 << 1    #  /*!< from %verify(size) */
+RPMVERIFY_LINKTO          = 4          # 1 << 2    #  /*!< from %verify(link) */
+RPMVERIFY_USER            = 8          # 1 << 3    #  /*!< from %verify(user) */
+RPMVERIFY_GROUP           = 16         # 1 << 4    #  /*!< from %verify(group) */
+RPMVERIFY_MTIME           = 32         # 1 << 5    #  /*!< from %verify(mtime) */
+RPMVERIFY_MODE            = 64         # 1 << 6    #  /*!< from %verify(mode) */
+RPMVERIFY_RDEV            = 128        # 1 << 7    #  /*!< from %verify(rdev) */
+RPMVERIFY_CONTEXTS        = 32768      # (1 << 15) #  /*!< from --nocontexts */
+RPMVERIFY_READLINKFAIL    = 268435456  # (1 << 28) #  /*!< readlink failed */
+RPMVERIFY_READFAIL        = 536870912  # (1 << 29) #  /*!< file read failed */
+RPMVERIFY_LSTATFAIL       = 1073741824 # (1 << 30) #  /*!< lstat failed */
+RPMVERIFY_LGETFILECONFAIL = 2147483648 # (1 << 31) #  /*!< lgetfilecon failed */
+
+RPMVERIFY_FAILURES =    \
+ (RPMVERIFY_LSTATFAIL|RPMVERIFY_READFAIL|RPMVERIFY_READLINKFAIL| \
+  RPMVERIFY_LGETFILECONFAIL)
+
+# Bit(s) to control rpm_verify() operation.
+#
+VERIFY_DEFAULT       = 0,       #  /*!< */
+VERIFY_MD5           = 1 << 0   #  /*!< from --nomd5 */
+VERIFY_SIZE          = 1 << 1   #  /*!< from --nosize */
+VERIFY_LINKTO        = 1 << 2   #  /*!< from --nolinkto */
+VERIFY_USER          = 1 << 3   #  /*!< from --nouser */
+VERIFY_GROUP         = 1 << 4   #  /*!< from --nogroup */
+VERIFY_MTIME         = 1 << 5   #  /*!< from --nomtime */
+VERIFY_MODE          = 1 << 6   #  /*!< from --nomode */
+VERIFY_RDEV          = 1 << 7   #  /*!< from --nodev */
+#        /* bits 8-14 unused, reserved for rpmVerifyAttrs */
+VERIFY_CONTEXTS      = 1 << 15  #  /*!< verify: from --nocontexts */
+VERIFY_FILES         = 1 << 16  #  /*!< verify: from --nofiles */
+VERIFY_DEPS          = 1 << 17  #  /*!< verify: from --nodeps */
+VERIFY_SCRIPT        = 1 << 18  #  /*!< verify: from --noscripts */
+VERIFY_DIGEST        = 1 << 19  #  /*!< verify: from --nodigest */
+VERIFY_SIGNATURE     = 1 << 20  #  /*!< verify: from --nosignature */
+VERIFY_PATCHES       = 1 << 21  #  /*!< verify: from --nopatches */
+VERIFY_HDRCHK        = 1 << 22  #  /*!< verify: from --nohdrchk */
+VERIFY_FOR_LIST      = 1 << 23  #  /*!< query:  from --list */
+VERIFY_FOR_STATE     = 1 << 24  #  /*!< query:  from --state */
+VERIFY_FOR_DOCS      = 1 << 25  #  /*!< query:  from --docfiles */
+VERIFY_FOR_CONFIG    = 1 << 26  #  /*!< query:  from --configfiles */
+VERIFY_FOR_DUMPFILES = 1 << 27  #  /*!< query:  from --dump */
+#        /* bits 28-31 used in rpmVerifyAttrs */
+
+# Comes from C cource.  lib/rpmcli.h
+VERIFY_ATTRS =   \
+  (VERIFY_MD5 | VERIFY_SIZE | VERIFY_LINKTO | VERIFY_USER | VERIFY_GROUP | \
+   VERIFY_MTIME | VERIFY_MODE | VERIFY_RDEV | VERIFY_CONTEXTS)
+
+VERIFY_ALL =     \
+  (VERIFY_ATTRS | VERIFY_FILES | VERIFY_DEPS | VERIFY_SCRIPT | VERIFY_DIGEST |\
+   VERIFY_SIGNATURE | VERIFY_HDRCHK)
+
+
+# Some masks for what checks to NOT do on these file types.
+# The C code actiually resets these up for every file.
+DIR_FLAGS = ~(RPMVERIFY_MD5 | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | \
+              RPMVERIFY_LINKTO)
+
+# These file types all have the same mask, but hopefully this will make the
+# code more readable.
+FIFO_FLAGS = CHR_FLAGS = BLK_FLAGS = GHOST_FLAGS = DIR_FLAGS
+
+LINK_FLAGS = ~(RPMVERIFY_MD5 | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | \
+               RPMVERIFY_MODE | RPMVERIFY_USER | RPMVERIFY_GROUP)
+
+REG_FLAGS = ~(RPMVERIFY_LINKTO)
+
+
+def s_isdev(mode):
+    """
+        Check to see if a file is a device.
+
+    """
+    return stat.S_ISBLK(mode) | stat.S_ISCHR(mode)
+
+def rpmpackagelist(rts):
+    """
+        Equivalent of rpm -qa.  Intended for RefreshPackages() in the RPM Driver.
+        Requires rpmtransactionset() to be run first to get a ts.
+        Returns a list of pkgspec dicts.
+
+        e.g. [ {'name':'foo', 'epoch':'20', 'version':'1.2', 'release':'5', 'arch':'x86_64' },
+               {'name':'bar', 'epoch':'10', 'version':'5.2', 'release':'2', 'arch':'x86_64' } ]
+
+    """
+    return [{'name':header[rpm.RPMTAG_NAME],
+             'epoch':header[rpm.RPMTAG_EPOCH],
+             'version':header[rpm.RPMTAG_VERSION],
+             'release':header[rpm.RPMTAG_RELEASE],
+             'arch':header[rpm.RPMTAG_ARCH],
+             'gpgkeyid':header.sprintf("%|SIGGPG?{%{SIGGPG:pgpsig}}:{None}|").split()[-1]}
+             for header in rts.dbMatch()]
+
+def getindexbykeyword(index_ts, **kwargs):
+    """
+        Return list of indexs from the rpmdb matching keywords
+        ex: getHeadersByKeyword(name='foo', version='1', release='1')
+
+        Can be passed any structure that can be indexed by the pkgspec
+        keyswords as other keys are filtered out.
+
+    """
+    lst = []
+    name = kwargs.get('name')
+    if name:
+        index_mi = index_ts.dbMatch(rpm.RPMTAG_NAME, name)
+    else:
+        index_mi = index_ts.dbMatch()
+
+    if 'epoch' in kwargs:
+        if kwargs['epoch'] != None and kwargs['epoch'] != 'None':
+            kwargs['epoch'] = int(kwargs['epoch'])
+        else:
+            del(kwargs['epoch'])
+
+    keywords = [key for key in list(kwargs.keys()) \
+                         if key in ('name', 'epoch', 'version', 'release', 'arch')]
+    keywords_len = len(keywords)
+    for hdr in index_mi:
+        match = 0
+        for keyword in keywords:
+            if hdr[keyword] == kwargs[keyword]:
+                match += 1
+        if match == keywords_len:
+            lst.append(index_mi.instance())
+    del index_mi
+    return lst
+
+def getheadersbykeyword(header_ts, **kwargs):
+    """
+        Borrowed parts of this from from Yum.  Need to fix it though.
+        Epoch is not handled right.
+
+        Return list of headers from the rpmdb matching keywords
+        ex: getHeadersByKeyword(name='foo', version='1', release='1')
+
+        Can be passed any structure that can be indexed by the pkgspec
+        keyswords as other keys are filtered out.
+
+    """
+    lst = []
+    name = kwargs.get('name')
+    if name:
+        header_mi = header_ts.dbMatch(rpm.RPMTAG_NAME, name)
+    else:
+        header_mi = header_ts.dbMatch()
+
+    if 'epoch' in kwargs:
+        if kwargs['epoch'] != None and kwargs['epoch'] != 'None':
+            kwargs['epoch'] = int(kwargs['epoch'])
+        else:
+            del(kwargs['epoch'])
+
+    keywords = [key for key in list(kwargs.keys()) \
+                         if key in ('name', 'epoch', 'version', 'release', 'arch')]
+    keywords_len = len(keywords)
+    for hdr in header_mi:
+        match = 0
+        for keyword in keywords:
+            if hdr[keyword] == kwargs[keyword]:
+                match += 1
+        if match == keywords_len:
+            lst.append(hdr)
+    del header_mi
+    return lst
+
+def prelink_md5_check(filename):
+    """
+        Checks if a file is prelinked.  If it is run it through prelink -y
+        to get the unprelinked md5 and file size.
+
+        Return 0 if the file was not prelinked, otherwise return the file size.
+        Always return the md5.
+
+    """
+    prelink = False
+    try:
+        plf = open(filename, "rb")
+    except IOError:
+        return False, 0
+
+    if prelink_exists:
+        if isprelink_imported:
+            plfd = plf.fileno()
+            if isprelink(plfd):
+                plf.close()
+                cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
+                                            % (re.escape(filename))
+                plf = os.popen(cmd, 'rb')
+                prelink = True
+        elif whitelist_re.search(filename) and not blacklist_re.search(filename):
+            plf.close()
+            cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
+                                        % (re.escape(filename))
+            plf = os.popen(cmd, 'rb')
+            prelink = True
+
+    fsize = 0
+    if py24compat:
+        chksum = md5.new()
+    else:
+        chksum = hashlib.md5()
+    while 1:
+        data = plf.read()
+        if not data:
+            break
+        fsize += len(data)
+        chksum.update(data)
+    plf.close()
+    file_md5 = chksum.hexdigest()
+    if prelink:
+        return file_md5, fsize
+    else:
+        return file_md5, 0
+
+def prelink_size_check(filename):
+    """
+       This check is only done if the prelink_md5_check() is not done first.
+
+       Checks if a file is prelinked.  If it is run it through prelink -y
+       to get the unprelinked file size.
+
+       Return 0 if the file was not prelinked, otherwise return the file size.
+
+    """
+    fsize = 0
+    try:
+        plf = open(filename, "rb")
+    except IOError:
+        return False
+
+    if prelink_exists:
+        if isprelink_imported:
+            plfd = plf.fileno()
+            if isprelink(plfd):
+                plf.close()
+                cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
+                                            % (re.escape(filename))
+                plf = os.popen(cmd, 'rb')
+
+                while 1:
+                    data = plf.read()
+                    if not data:
+                        break
+                    fsize += len(data)
+
+        elif whitelist_re.search(filename) and not blacklist_re.search(filename):
+            plf.close()
+            cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
+                                        % (re.escape(filename))
+            plf = os.popen(cmd, 'rb')
+
+            while 1:
+                data = plf.read()
+                if not data:
+                    break
+                fsize += len(data)
+
+    plf.close()
+
+    return fsize
+
+def debug_verify_flags(vflags):
+    """
+        Decodes the verify flags bits.
+    """
+    if vflags & RPMVERIFY_MD5:
+        print('RPMVERIFY_MD5')
+    if vflags & RPMVERIFY_FILESIZE:
+        print('RPMVERIFY_FILESIZE')
+    if vflags & RPMVERIFY_LINKTO:
+        print('RPMVERIFY_LINKTO')
+    if vflags & RPMVERIFY_USER:
+        print('RPMVERIFY_USER')
+    if vflags & RPMVERIFY_GROUP:
+        print('RPMVERIFY_GROUP')
+    if vflags & RPMVERIFY_MTIME:
+        print('RPMVERIFY_MTIME')
+    if vflags & RPMVERIFY_MODE:
+        print('RPMVERIFY_MODE')
+    if vflags & RPMVERIFY_RDEV:
+        print('RPMVERIFY_RDEV')
+    if vflags & RPMVERIFY_CONTEXTS:
+        print('RPMVERIFY_CONTEXTS')
+    if vflags & RPMVERIFY_READLINKFAIL:
+        print('RPMVERIFY_READLINKFAIL')
+    if vflags & RPMVERIFY_READFAIL:
+        print('RPMVERIFY_READFAIL')
+    if vflags & RPMVERIFY_LSTATFAIL:
+        print('RPMVERIFY_LSTATFAIL')
+    if vflags & RPMVERIFY_LGETFILECONFAIL:
+        print('RPMVERIFY_LGETFILECONFAIL')
+
+def debug_file_flags(fflags):
+    """
+        Decodes the file flags bits.
+    """
+    if fflags & rpm.RPMFILE_CONFIG:
+        print('rpm.RPMFILE_CONFIG')
+
+    if fflags & rpm.RPMFILE_DOC:
+        print('rpm.RPMFILE_DOC')
+
+    if fflags & rpm.RPMFILE_ICON:
+        print('rpm.RPMFILE_ICON')
+
+    if fflags & rpm.RPMFILE_MISSINGOK:
+        print('rpm.RPMFILE_MISSINGOK')
+
+    if fflags & rpm.RPMFILE_NOREPLACE:
+        print('rpm.RPMFILE_NOREPLACE')
+
+    if fflags & rpm.RPMFILE_GHOST:
+        print('rpm.RPMFILE_GHOST')
+
+    if fflags & rpm.RPMFILE_LICENSE:
+        print('rpm.RPMFILE_LICENSE')
+
+    if fflags & rpm.RPMFILE_README:
+        print('rpm.RPMFILE_README')
+
+    if fflags & rpm.RPMFILE_EXCLUDE:
+        print('rpm.RPMFILE_EXLUDE')
+
+    if fflags & rpm.RPMFILE_UNPATCHED:
+        print('rpm.RPMFILE_UNPATCHED')
+
+    if fflags & rpm.RPMFILE_PUBKEY:
+        print('rpm.RPMFILE_PUBKEY')
+
+def rpm_verify_file(fileinfo, rpmlinktos, omitmask):
+    """
+        Verify all the files in a package.
+
+        Returns a list of error flags, the file type and file name.  The list
+        entries are strings that are the same as the labels for the bitwise
+        flags used in the C code.
+
+    """
+    (fname, fsize, fmode, fmtime, fflags, frdev, finode, fnlink, fstate, \
+            vflags, fuser, fgroup, fmd5) = fileinfo
+
+    # 1. rpmtsRootDir stuff.  What does it do and where to I get it from?
+
+    file_results = []
+    flags = vflags
+
+    # Check to see if the file was installed - if not pretend all is ok.
+    # This is what the rpm C code does!
+    if fstate != rpm.RPMFILE_STATE_NORMAL:
+        return file_results
+
+    # Get the installed files stats
+    try:
+        lstat = os.lstat(fname)
+    except OSError:
+        if not (fflags & (rpm.RPMFILE_MISSINGOK|rpm.RPMFILE_GHOST)):
+            file_results.append('RPMVERIFY_LSTATFAIL')
+            #file_results.append(fname)
+        return file_results
+
+    # 5. Contexts?  SELinux stuff?
+
+    # Setup what checks to do.  This is straight out of the C code.
+    if stat.S_ISDIR(lstat.st_mode):
+        flags &= DIR_FLAGS
+    elif stat.S_ISLNK(lstat.st_mode):
+        flags &= LINK_FLAGS
+    elif stat.S_ISFIFO(lstat.st_mode):
+        flags &= FIFO_FLAGS
+    elif stat.S_ISCHR(lstat.st_mode):
+        flags &= CHR_FLAGS
+    elif stat.S_ISBLK(lstat.st_mode):
+        flags &= BLK_FLAGS
+    else:
+        flags &= REG_FLAGS
+
+    if (fflags & rpm.RPMFILE_GHOST):
+        flags &= GHOST_FLAGS
+
+    flags &= ~(omitmask | RPMVERIFY_FAILURES)
+
+    # 8. SELinux stuff.
+
+    prelink_size = 0
+    if flags & RPMVERIFY_MD5:
+        prelink_md5, prelink_size = prelink_md5_check(fname)
+        if prelink_md5 == False:
+            file_results.append('RPMVERIFY_MD5')
+            file_results.append('RPMVERIFY_READFAIL')
+        elif  prelink_md5 != fmd5:
+            file_results.append('RPMVERIFY_MD5')
+
+    if flags & RPMVERIFY_LINKTO:
+        linkto = os.readlink(fname)
+        if not linkto:
+            file_results.append('RPMVERIFY_READLINKFAIL')
+            file_results.append('RPMVERIFY_LINKTO')
+        else:
+            if len(rpmlinktos) == 0  or linkto != rpmlinktos:
+                file_results.append('RPMVERIFY_LINKTO')
+
+    if flags & RPMVERIFY_FILESIZE:
+        if not (flags & RPMVERIFY_MD5): # prelink check hasn't been done.
+            prelink_size = prelink_size_check(fname)
+        if (prelink_size != 0):         # This is a prelinked file.
+            if (prelink_size != fsize):
+                file_results.append('RPMVERIFY_FILESIZE')
+        elif lstat.st_size != fsize:    # It wasn't a prelinked file.
+            file_results.append('RPMVERIFY_FILESIZE')
+
+    if flags & RPMVERIFY_MODE:
+        metamode = fmode
+        filemode = lstat.st_mode
+
+        # Comparing the type of %ghost files is meaningless, but perms are ok.
+        if fflags & rpm.RPMFILE_GHOST:
+            metamode &= ~0xf000
+            filemode &= ~0xf000
+
+        if (stat.S_IFMT(metamode) != stat.S_IFMT(filemode)) or \
+           (stat.S_IMODE(metamode) != stat.S_IMODE(filemode)):
+            file_results.append('RPMVERIFY_MODE')
+
+    if flags & RPMVERIFY_RDEV:
+        if (stat.S_ISCHR(fmode) != stat.S_ISCHR(lstat.st_mode) or
+            stat.S_ISBLK(fmode) != stat.S_ISBLK(lstat.st_mode)):
+            file_results.append('RPMVERIFY_RDEV')
+        elif (s_isdev(fmode) & s_isdev(lstat.st_mode)):
+            st_rdev = lstat.st_rdev
+            if frdev != st_rdev:
+                file_results.append('RPMVERIFY_RDEV')
+
+    if flags & RPMVERIFY_MTIME:
+        if lstat.st_mtime != fmtime:
+            file_results.append('RPMVERIFY_MTIME')
+
+    if flags & RPMVERIFY_USER:
+        try:
+            user = pwd.getpwuid(lstat.st_uid)[0]
+        except KeyError:
+            user = None
+        if not user or not fuser or (user != fuser):
+            file_results.append('RPMVERIFY_USER')
+
+    if flags & RPMVERIFY_GROUP:
+        try:
+            group = grp.getgrgid(lstat.st_gid)[0]
+        except KeyError:
+            group = None
+        if not group or not fgroup or (group != fgroup):
+            file_results.append('RPMVERIFY_GROUP')
+
+    return file_results
+
+def rpm_verify_dependencies(header):
+    """
+        Check package dependencies. Header is an rpm.hdr.
+
+        Don't like opening another ts to do this, but
+        it was the only way I could find of clearing the ts
+        out.
+
+        Have asked on the rpm-maint list on how to do
+        this the right way (28 Feb 2007).
+
+        ts.check() returns:
+
+        ((name, version, release), (reqname, reqversion), \
+            flags, suggest, sense)
+
+    """
+    _ts1 = rpmtransactionset()
+    _ts1.addInstall(header, 'Dep Check', 'i')
+    dep_errors = _ts1.check()
+    _ts1.closeDB()
+    return dep_errors
+
+def rpm_verify_package(vp_ts, header, verify_options):
+    """
+        Verify a single package specified by header.  Header is an rpm.hdr.
+
+        If errors are found it returns a dictionary of errors.
+
+    """
+    # Set some transaction level flags.
+    vsflags = 0
+    if 'nodigest' in verify_options:
+        vsflags |= rpm._RPMVSF_NODIGESTS
+    if 'nosignature' in verify_options:
+        vsflags |= rpm._RPMVSF_NOSIGNATURES
+    ovsflags = vp_ts.setVSFlags(vsflags)
+
+    # Map from the Python options to the rpm bitwise flags.
+    omitmask = 0
+
+    if 'nolinkto' in verify_options:
+        omitmask |= VERIFY_LINKTO
+    if 'nomd5' in verify_options:
+        omitmask |= VERIFY_MD5
+    if 'nosize' in verify_options:
+        omitmask |= VERIFY_SIZE
+    if 'nouser' in verify_options:
+        omitmask |= VERIFY_USER
+    if 'nogroup' in verify_options:
+        omitmask |= VERIFY_GROUP
+    if 'nomtime' in verify_options:
+        omitmask |= VERIFY_MTIME
+    if 'nomode' in verify_options:
+        omitmask |= VERIFY_MODE
+    if 'nordev' in verify_options:
+        omitmask |= VERIFY_RDEV
+
+    omitmask = ((~omitmask & VERIFY_ATTRS) ^ VERIFY_ATTRS)
+
+    package_results = {}
+
+    # Check Signatures and Digests.
+    # No idea what this might return.  Need to break something to see.
+    # Setting the vsflags above determines what gets checked in the header.
+    hdr_stat = vp_ts.hdrCheck(header.unload())
+    if hdr_stat:
+        package_results['hdr'] = hdr_stat
+
+    # Check Package Depencies.
+    if 'nodeps' not in verify_options:
+        dep_stat = rpm_verify_dependencies(header)
+        if dep_stat:
+            package_results['deps'] = dep_stat
+
+    # Check all the package files.
+    if 'nofiles' not in verify_options:
+        vp_fi = header.fiFromHeader()
+        for fileinfo in vp_fi:
+            # Do not bother doing anything with ghost files.
+            # This is what RPM does.
+            if fileinfo[4] & rpm.RPMFILE_GHOST:
+                continue
+
+            # This is only needed because of an inconsistency in the
+            # rpm.fi interface.
+            linktos = vp_fi.FLink()
+
+            file_stat = rpm_verify_file(fileinfo, linktos, omitmask)
+
+            #if len(file_stat) > 0 or options.verbose:
+            if len(file_stat) > 0:
+                fflags = fileinfo[4]
+                if fflags & rpm.RPMFILE_CONFIG:
+                    file_stat.append('c')
+                elif fflags & rpm.RPMFILE_DOC:
+                    file_stat.append('d')
+                elif fflags & rpm.RPMFILE_GHOST:
+                    file_stat.append('g')
+                elif fflags & rpm.RPMFILE_LICENSE:
+                    file_stat.append('l')
+                elif fflags & rpm.RPMFILE_PUBKEY:
+                    file_stat.append('P')
+                elif fflags & rpm.RPMFILE_README:
+                    file_stat.append('r')
+                else:
+                    file_stat.append(' ')
+
+                file_stat.append(fileinfo[0]) # The filename.
+                package_results.setdefault('files', []).append(file_stat)
+
+    # Run the verify script if there is one.
+    # Do we want this?
+    #if 'noscripts' not in verify_options:
+    #    script_stat = rpmVerifyscript()
+    #    if script_stat:
+    #        package_results['script'] = script_stat
+
+    # If there have been any errors, add the package nevra to the result.
+    if len(package_results) > 0:
+        package_results.setdefault('nevra', (header[rpm.RPMTAG_NAME], \
+                                             header[rpm.RPMTAG_EPOCH], \
+                                             header[rpm.RPMTAG_VERSION], \
+                                             header[rpm.RPMTAG_RELEASE], \
+                                             header[rpm.RPMTAG_ARCH]))
+    else:
+        package_results = None
+
+    # Put things back the way we found them.
+    vsflags = vp_ts.setVSFlags(ovsflags)
+
+    return package_results
+
+def rpm_verify(verify_ts, verify_pkgspec, verify_options=[]):
+    """
+       Requires rpmtransactionset() to be run first to get a ts.
+
+       pkgspec is a dict specifying the package
+       e.g.:
+           For a single package
+           { name='foo', epoch='20', version='1', release='1', arch='x86_64'}
+
+           For all packages
+           {}
+
+       Or any combination of keywords to select one or more packages to verify.
+
+       options is a list of 'rpm --verify' options. Default is to check everything.
+       e.g.:
+           [ 'nodeps', 'nodigest', 'nofiles', 'noscripts', 'nosignature',
+             'nolinkto' 'nomd5', 'nosize', 'nouser', 'nogroup', 'nomtime',
+             'nomode', 'nordev' ]
+
+       Returns a list.  One list entry per package.  Each list entry is a
+       dictionary.  Dict keys are 'files', 'deps', 'nevra' and 'hdr'.
+       Entries only get added for the failures. If nothing failed, None is
+       returned.
+
+       Its all a bit messy and probably needs reviewing.
+
+       [ { 'hdr': [???],
+           'deps: [((name, version, release), (reqname, reqversion),
+                    flags, suggest, sense), .... ]
+           'files': [ ['filename1', 'RPMVERIFY_GROUP', 'RPMVERIFY_USER' ],
+                      ['filename2', 'RPMVERFIY_LSTATFAIL']]
+           'nevra': ['name1', 'epoch1', 'version1', 'release1', 'arch1'] }
+         { 'hdr': [???],
+           'deps: [((name, version, release), (reqname, reqversion),
+                    flags, suggest, sense), .... ]
+           'files': [ ['filename', 'RPMVERIFY_GROUP', 'RPMVERIFY_USER" ],
+                      ['filename2', 'RPMVERFIY_LSTATFAIL']]
+           'nevra': ['name2', 'epoch2', 'version2', 'release2', 'arch2'] } ]
+
+    """
+    verify_results = []
+    headers = getheadersbykeyword(verify_ts, **verify_pkgspec)
+    for header in headers:
+        result = rpm_verify_package(verify_ts, header, verify_options)
+        if result:
+            verify_results.append(result)
+
+    return verify_results
+
+def rpmtransactionset():
+    """
+        A simple wrapper for rpm.TransactionSet() to keep everthiing together.
+        Might use it to set some ts level flags later.
+
+    """
+    ts = rpm.TransactionSet()
+    return ts
+
+class Rpmtscallback(object):
+    """
+        Callback for ts.run().  Used for adding, upgrading and removing packages.
+        Starting with all possible reasons codes, but bcfg2 will probably only
+        make use of a few of them.
+
+        Mostly just printing stuff at the moment to understand how the callback
+        is used.
+
+    """
+    def __init__(self):
+        self.fdnos = {}
+
+    def callback(self, reason, amount, total, key, client_data):
+        """
+            Generic rpmts call back.
+        """
+        if   reason == rpm.RPMCALLBACK_INST_OPEN_FILE:
+            pass
+        elif reason == rpm.RPMCALLBACK_INST_CLOSE_FILE:
+            pass
+        elif reason == rpm.RPMCALLBACK_INST_START:
+            pass
+        elif reason == rpm.RPMCALLBACK_TRANS_PROGRESS or \
+             reason == rpm.RPMCALLBACK_INST_PROGRESS:
+            pass
+            #       rpm.RPMCALLBACK_INST_PROGRESS'
+        elif reason == rpm.RPMCALLBACK_TRANS_START:
+            pass
+        elif reason == rpm.RPMCALLBACK_TRANS_STOP:
+            pass
+        elif reason == rpm.RPMCALLBACK_REPACKAGE_START:
+            pass
+        elif reason == rpm.RPMCALLBACK_REPACKAGE_PROGRESS:
+            pass
+        elif reason == rpm.RPMCALLBACK_REPACKAGE_STOP:
+            pass
+        elif reason == rpm.RPMCALLBACK_UNINST_PROGRESS:
+            pass
+        elif reason == rpm.RPMCALLBACK_UNINST_START:
+            pass
+        elif reason == rpm.RPMCALLBACK_UNINST_STOP:
+            pass
+            # How do we get at this?
+            # RPM.modified += key
+        elif reason == rpm.RPMCALLBACK_UNPACK_ERROR:
+            pass
+        elif reason == rpm.RPMCALLBACK_CPIO_ERROR:
+            pass
+        elif reason == rpm.RPMCALLBACK_UNKNOWN:
+            pass
+        else:
+            print('ERROR - Fell through callBack')
+
+
+def rpm_erase(erase_pkgspecs, erase_flags):
+    """
+       pkgspecs is a list of pkgspec dicts specifying packages
+       e.g.:
+           For a single package
+           { name='foo', epoch='20', version='1', release='1', arch='x86_64'}
+
+    """
+    erase_ts_flags = 0
+    if 'noscripts' in erase_flags:
+        erase_ts_flags |= rpm.RPMTRANS_FLAG_NOSCRIPTS
+    if 'notriggers' in erase_flags:
+        erase_ts_flags |= rpm.RPMTRANS_FLAG_NOTRIGGERS
+    if 'repackage' in erase_flags:
+        erase_ts_flags |= rpm.RPMTRANS_FLAG_REPACKAGE
+
+    erase_ts = rpmtransactionset()
+    erase_ts.setFlags(erase_ts_flags)
+
+    for pkgspec in erase_pkgspecs:
+        idx_list = getindexbykeyword(erase_ts, **pkgspec)
+        if len(idx_list) > 1 and not 'allmatches' in erase_flags:
+            #pass
+            print('ERROR - Multiple package match for erase', pkgspec)
+        else:
+            for idx in idx_list:
+                erase_ts.addErase(idx)
+
+    #for te in erase_ts:
+
+    erase_problems = []
+    if 'nodeps' not in erase_flags:
+        erase_problems = erase_ts.check()
+
+    if erase_problems == []:
+        erase_ts.order()
+        erase_callback = Rpmtscallback()
+        erase_ts.run(erase_callback.callback, 'Erase')
+    #else:
+
+    erase_ts.closeDB()
+    del erase_ts
+    return erase_problems
+
+def display_verify_file(file_results):
+    '''
+        Display file results similar to rpm --verify.
+    '''
+    filename = file_results[-1]
+    filetype = file_results[-2]
+
+    result_string = ''
+
+    if 'RPMVERIFY_LSTATFAIL' in file_results:
+        result_string = 'missing '
+    else:
+        if 'RPMVERIFY_FILESIZE' in file_results:
+            result_string = result_string + 'S'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_MODE' in file_results:
+            result_string = result_string + 'M'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_MD5' in file_results:
+            if 'RPMVERIFY_READFAIL' in file_results:
+                result_string = result_string + '?'
+            else:
+                result_string = result_string + '5'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_RDEV' in file_results:
+            result_string = result_string + 'D'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_LINKTO' in file_results:
+            if 'RPMVERIFY_READLINKFAIL' in file_results:
+                result_string = result_string + '?'
+            else:
+                result_string = result_string + 'L'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_USER' in file_results:
+            result_string = result_string + 'U'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_GROUP' in file_results:
+            result_string = result_string + 'G'
+        else:
+            result_string = result_string + '.'
+
+        if 'RPMVERIFY_MTIME' in file_results:
+            result_string = result_string + 'T'
+        else:
+            result_string = result_string + '.'
+
+    print(result_string + '  ' + filetype + ' ' + filename)
+    sys.stdout.flush()
+
+#===============================================================================
+# Some options and output to assist with development and testing.
+# These are not intended for normal use.
+if __name__ == "__main__":
+
+    p = optparse.OptionParser()
+
+    p.add_option('--name', action='store', \
+                 default=None, \
+                 help='''Package name to verify.
+
+                         ******************************************
+                         NOT SPECIFYING A NAME MEANS 'ALL' PACKAGES.
+                         ******************************************
+
+                         The specified operation will be carried out on  all
+                         instances of packages that match the package specification
+                         (name, epoch, version, release, arch).''')
+
+    p.add_option('--epoch', action='store', \
+                 default=None, \
+                 help='''Package epoch.''')
+
+    p.add_option('--version', action='store', \
+                 default=None, \
+                 help='''Package version.''')
+
+    p.add_option('--release', action='store', \
+                 default=None, \
+                 help='''Package release.''')
+
+    p.add_option('--arch', action='store', \
+                 default=None, \
+                 help='''Package arch.''')
+
+    p.add_option('--erase', '-e', action='store_true', \
+                 default=None, \
+                 help='''****************************************************
+                         REMOVE PACKAGES.  THERE ARE NO WARNINGS.  MULTIPLE
+                         PACKAGES WILL BE REMOVED IF A FULL PACKAGE SPEC IS NOT
+                         GIVEN. E.G. IF JUST A NAME IS GIVEN ALL INSTALLED
+                         INSTANCES OF THAT PACKAGE WILL BE REMOVED PROVIDED
+                         DEPENDENCY CHECKS PASS.  IF JUST AN EPOCH IS GIVEN
+                         ALL PACKAGE INSTANCES WITH THAT EPOCH WILL BE REMOVED.
+                         ****************************************************''')
+
+    p.add_option('--list', '-l', action='store_true', \
+                 help='''List package identity info. rpm -qa ish equivalent
+                         intended for use in RefreshPackages().''')
+
+    p.add_option('--verify', action='store_true', \
+                 help='''Verify Package(s).  Output is only produced after all
+                         packages has been verified. Be patient.''')
+
+    p.add_option('--verbose', '-v', action='store_true', \
+                 help='''Verbose output for --verify option.  Output is the
+                         same as rpm -v --verify.''')
+
+    p.add_option('--nodeps', action='store_true', \
+                 default=False, \
+                 help='Do not do dependency testing.')
+
+    p.add_option('--nodigest', action='store_true', \
+                 help='Do not check package digests.')
+
+    p.add_option('--nofiles', action='store_true', \
+                 help='Do not do file checks.')
+
+    p.add_option('--noscripts', action='store_true', \
+                 help='Do not run verification scripts.')
+
+    p.add_option('--nosignature', action='store_true', \
+                 help='Do not do package signature verification.')
+
+    p.add_option('--nolinkto', action='store_true', \
+                 help='Do not do symlink tests.')
+
+    p.add_option('--nomd5', action='store_true', \
+                 help='''Do not do MD5 checksums on files.  Note that this does
+                                            not work for prelink files yet.''')
+
+    p.add_option('--nosize', action='store_true', \
+                 help='''Do not do file size tests. Note that this does not work
+                                            for prelink files yet.''')
+
+    p.add_option('--nouser', action='store_true', \
+                 help='Do not check file user ownership.')
+
+    p.add_option('--nogroup', action='store_true', \
+                 help='Do not check file group ownership.')
+
+    p.add_option('--nomtime', action='store_true', \
+                 help='Do not check file modification times.')
+
+    p.add_option('--nomode', action='store_true', \
+                 help='Do not check file modes (permissions).')
+
+    p.add_option('--nordev', action='store_true', \
+                 help='Do not check device node.')
+
+    p.add_option('--notriggers', action='store_true', \
+                 help='Do not do not generate triggers on erase.')
+
+    p.add_option('--repackage', action='store_true', \
+                 help='''Do repackage on erase.i Packages are put
+                                            in /var/spool/repackage.''')
+
+    p.add_option('--allmatches', action='store_true', \
+                 help='''Remove all package instances that match the
+                         pkgspec.
+
+                         ***************************************************
+                         NO WARNINGS ARE GIVEN.  IF THERE IS NO PACKAGE SPEC
+                         THAT MEANS ALL PACKAGES!!!!
+                         ***************************************************''')
+
+    options, arguments = p.parse_args()
+
+    pkgspec = {}
+    rpm_options = []
+
+    if options.nodeps:
+        rpm_options.append('nodeps')
+
+    if options.nodigest:
+        rpm_options.append('nodigest')
+
+    if options.nofiles:
+        rpm_options.append('nofiles')
+
+    if options.noscripts:
+        rpm_options.append('noscripts')
+
+    if options.nosignature:
+        rpm_options.append('nosignature')
+
+    if options.nolinkto:
+        rpm_options.append('nolinkto')
+
+    if options.nomd5:
+        rpm_options.append('nomd5')
+
+    if options.nosize:
+        rpm_options.append('nosize')
+
+    if options.nouser:
+        rpm_options.append('nouser')
+
+    if options.nogroup:
+        rpm_options.append('nogroup')
+
+    if options.nomtime:
+        rpm_options.append('nomtime')
+
+    if options.nomode:
+        rpm_options.append('nomode')
+
+    if options.nordev:
+        rpm_options.append('nordev')
+
+    if options.repackage:
+        rpm_options.append('repackage')
+
+    if options.allmatches:
+        rpm_options.append('allmatches')
+
+    main_ts = rpmtransactionset()
+
+    cmdline_pkgspec = {}
+    if options.name != 'all':
+        if options.name:
+            cmdline_pkgspec['name'] = str(options.name)
+        if options.epoch:
+            cmdline_pkgspec['epoch'] = str(options.epoch)
+        if options.version:
+            cmdline_pkgspec['version'] = str(options.version)
+        if options.release:
+            cmdline_pkgspec['release'] = str(options.release)
+        if options.arch:
+            cmdline_pkgspec['arch'] = str(options.arch)
+
+    if options.verify:
+        results = rpm_verify(main_ts, cmdline_pkgspec, rpm_options)
+        for r in results:
+            files = r.get('files', '')
+            for f in files:
+                display_verify_file(f)
+
+    elif options.list:
+        for p in rpmpackagelist(main_ts):
+            print(p)
+
+    elif options.erase:
+        if options.name:
+            rpm_erase([cmdline_pkgspec], rpm_options)
+        else:
+            print('You must specify the "--name" option')
+
 
 class RPM(Bcfg2.Client.Tools.PkgTool):
     """Support for RPM packages."""
@@ -102,11 +1170,11 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                                        'arch':'x86_64'} ]
         """
         self.installed = {}
-        refresh_ts = rpmtools.rpmtransactionset()
+        refresh_ts = rpmtransactionset()
         # Don't bother with signature checks at this stage. The GPG keys might
         # not be installed.
         refresh_ts.setVSFlags(rpm._RPMVSF_NODIGESTS|rpm._RPMVSF_NOSIGNATURES)
-        for nevra in rpmtools.rpmpackagelist(refresh_ts):
+        for nevra in rpmpackagelist(refresh_ts):
             self.installed.setdefault(nevra['name'], []).append(nevra)
         if self.setup['debug']:
             print("The following package instances are installed:")
@@ -213,7 +1281,7 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                                         self.logger.debug('         Disabling signature check.')
 
                                     if self.setup.get('quick', False):
-                                        if rpmtools.prelink_exists:
+                                        if prelink_exists:
                                             flags += ['nomd5', 'nosize']
                                         else:
                                             flags += ['nomd5']
@@ -222,9 +1290,9 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                                     if inst.get('verify', 'true') == 'false':
                                         self.instance_status[inst]['verify'] = None
                                     else:
-                                        vp_ts = rpmtools.rpmtransactionset()
+                                        vp_ts = rpmtransactionset()
                                         self.instance_status[inst]['verify'] = \
-                                                                             rpmtools.rpm_verify( vp_ts, pkg, flags)
+                                                                             rpm_verify( vp_ts, pkg, flags)
                                         vp_ts.closeDB()
                                         del vp_ts
 
@@ -272,7 +1340,7 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                                             self.logger.info('         Disabling signature check.')
 
                                         if self.setup.get('quick', False):
-                                            if rpmtools.prelink_exists:
+                                            if prelink_exists:
                                                 flags += ['nomd5', 'nosize']
                                             else:
                                                 flags += ['nomd5']
@@ -281,9 +1349,9 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                                         if inst.get('verify', 'true') == 'false':
                                             self.instance_status[inst]['verify'] = None
                                         else:
-                                            vp_ts = rpmtools.rpmtransactionset()
+                                            vp_ts = rpmtransactionset()
                                             self.instance_status[inst]['verify'] = \
-                                                                                 rpmtools.rpm_verify( vp_ts, pkg, flags )
+                                                                                 rpm_verify( vp_ts, pkg, flags )
                                             vp_ts.closeDB()
                                             del vp_ts
 
@@ -434,7 +1502,7 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                     self.logger.info("         This package will be deleted in a future version of the RPM driver.")
                 #pkgspec_list.append(pkg_spec)
 
-        erase_results = rpmtools.rpm_erase(pkgspec_list, self.erase_flags)
+        erase_results = rpm_erase(pkgspec_list, self.erase_flags)
         if erase_results == []:
             self.modified += packages
             for pkg in pkgspec_list:
@@ -462,7 +1530,7 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                                                    % (pkgspec.get('name'), self.str_evra(pkgspec)))
                         self.logger.info("         This package will be deleted in a future version of the RPM driver.")
                         continue # Don't delete the gpg-pubkey packages for now.
-                    erase_results = rpmtools.rpm_erase([pkgspec], self.erase_flags)
+                    erase_results = rpm_erase([pkgspec], self.erase_flags)
                     if erase_results == []:
                         pkg_modified = True
                         self.logger.info("Deleted %s %s" % \
@@ -536,7 +1604,7 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
 
         return fix
 
-    def Install(self, packages, states):
+    def Install(self, packages):
         """
            Try and fix everything that RPM.VerifyPackages() found wrong for
            each Package Entry.  This can result in individual RPMs being
@@ -557,6 +1625,7 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
         """
         self.logger.info('Runing RPM.Install()')
 
+        states = dict()
         install_only_pkgs = []
         gpg_keys = []
         upgrade_pkgs = []
@@ -681,8 +1750,8 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
                 states[pkg_entry] = self.VerifyPackage(pkg_entry, \
                                                        self.modlists.get(pkg_entry, []))
 
-        for entry in [ent for ent in packages if states[ent]]:
-            self.modified.append(entry)
+        self.modified.extend(ent for ent in packages if states[ent])
+        return states
 
     def canInstall(self, entry):
         """Test if entry has enough information to be installed."""
@@ -964,9 +2033,9 @@ class RPM(Bcfg2.Client.Tools.PkgTool):
            (big-endian) of the key ID which is good enough for our purposes.
 
         """
-        init_ts = rpmtools.rpmtransactionset()
+        init_ts = rpmtransactionset()
         init_ts.setVSFlags(rpm._RPMVSF_NODIGESTS|rpm._RPMVSF_NOSIGNATURES)
-        gpg_hdrs = rpmtools.getheadersbykeyword(init_ts, **{'name':'gpg-pubkey'})
+        gpg_hdrs = getheadersbykeyword(init_ts, **{'name':'gpg-pubkey'})
         keyids = [ header[rpm.RPMTAG_VERSION] for header in gpg_hdrs]
         keyids.append('None')
         init_ts.closeDB()
diff --git a/src/lib/Bcfg2/Client/Tools/SELinux.py b/src/lib/Bcfg2/Client/Tools/SELinux.py
index e6408922f..baf930610 100644
--- a/src/lib/Bcfg2/Client/Tools/SELinux.py
+++ b/src/lib/Bcfg2/Client/Tools/SELinux.py
@@ -13,7 +13,6 @@ import seobject
 import Bcfg2.Client.XML
 import Bcfg2.Client.Tools
 from Bcfg2.Client.Tools.POSIX.File import POSIXFile
-from Bcfg2.Options import get_option_parser
 
 
 def pack128(int_val):
@@ -100,10 +99,6 @@ class SELinux(Bcfg2.Client.Tools.Tool):
         # http://docs.python.org/2/reference/datamodel.html#object.__getattr__
         # for details
 
-    def BundleUpdated(self, _, states):
-        for handler in self.handlers.values():
-            handler.BundleUpdated(states)
-
     def FindExtra(self):
         extra = []
         for handler in self.handlers.values():
@@ -119,7 +114,7 @@ class SELinux(Bcfg2.Client.Tools.Tool):
         in the specification """
         return self.handlers[entry.tag].primarykey(entry)
 
-    def Install(self, entries, states):
+    def Install(self, entries):
         # start a transaction
         semanage = seobject.semanageRecords("")
         if hasattr(semanage, "start"):
@@ -129,13 +124,14 @@ class SELinux(Bcfg2.Client.Tools.Tool):
         else:
             self.logger.debug("SELinux transactions not supported; this may "
                               "slow things down considerably")
-        Bcfg2.Client.Tools.Tool.Install(self, entries, states)
+        states = Bcfg2.Client.Tools.Tool.Install(self, entries)
         if hasattr(semanage, "finish"):
             self.logger.debug("Committing SELinux transaction")
             semanage.finish()
             self.txn = False
             for func, arg, kwargs in self.post_txn_queue:
                 states[arg] = func(*arg, **kwargs)
+        return states
 
     def GenericSEInstall(self, entry):
         """Dispatch install to the proper method according to entry tag"""
@@ -177,7 +173,7 @@ class SELinuxEntryHandler(object):
     def __init__(self, tool, config):
         self.tool = tool
         self.logger = logging.getLogger(self.__class__.__name__)
-        self.setup = get_option_parser()
+        self.setup = tool.setup
         self.config = config
         self._records = None
         self._all = None
@@ -370,11 +366,6 @@ class SELinuxEntryHandler(object):
                 for key in records.keys()
                 if key not in specified]
 
-    def BundleUpdated(self, states):
-        """ perform any additional magic tasks that need to be run
-        when a bundle is updated """
-        pass
-
 
 class SELinuxSebooleanHandler(SELinuxEntryHandler):
     """ handle SELinux boolean entries """
diff --git a/src/lib/Bcfg2/Client/Tools/YUM.py b/src/lib/Bcfg2/Client/Tools/YUM.py
index 4d86ac8fe..648d30d15 100644
--- a/src/lib/Bcfg2/Client/Tools/YUM.py
+++ b/src/lib/Bcfg2/Client/Tools/YUM.py
@@ -13,7 +13,7 @@ import yum.misc
 import rpmUtils.arch
 import Bcfg2.Client.XML
 import Bcfg2.Client.Tools
-from Bcfg2.Options import get_option_parser
+import Bcfg2.Options
 
 
 def build_yname(pkgname, inst):
@@ -204,7 +204,7 @@ class YUM(Bcfg2.Client.Tools.PkgTool):
         if hasattr(self, "setup"):
             setup = self.setup
         else:
-            setup = get_option_parser()
+            setup = Bcfg2.Options.get_option_parser()
         if hasattr(self, "logger"):
             logger = self.logger
         else:
@@ -797,7 +797,7 @@ class YUM(Bcfg2.Client.Tools.PkgTool):
 
         cleanup()
 
-    def Install(self, packages, states):  # pylint: disable=R0912,R0914
+    def Install(self, packages):  # pylint: disable=R0912,R0914
         """ Try and fix everything that Yum.VerifyPackages() found
         wrong for each Package Entry.  This can result in individual
         RPMs being installed (for the first time), deleted, downgraded
@@ -815,6 +815,7 @@ class YUM(Bcfg2.Client.Tools.PkgTool):
              entry is set to True. """
         self.logger.debug('Running Yum.Install()')
 
+        states = dict()
         install_pkgs = []
         gpg_keys = []
         upgrade_pkgs = []
@@ -944,8 +945,8 @@ class YUM(Bcfg2.Client.Tools.PkgTool):
                 states[pkg_entry] = self.VerifyPackage(pkg_entry,
                         self.modlists.get(pkg_entry, []))
 
-        for entry in [ent for ent in packages if states[ent]]:
-            self.modified.append(entry)
+        self.modified.extend(ent for ent in packages if states[ent])
+        return states
 
     def Remove(self, packages):
         """
diff --git a/src/lib/Bcfg2/Client/Tools/__init__.py b/src/lib/Bcfg2/Client/Tools/__init__.py
index f604e6198..39a664df1 100644
--- a/src/lib/Bcfg2/Client/Tools/__init__.py
+++ b/src/lib/Bcfg2/Client/Tools/__init__.py
@@ -6,21 +6,12 @@ import stat
 import logging
 import Bcfg2.Client
 import Bcfg2.Client.XML
-from Bcfg2.Options import get_option_parser
 from Bcfg2.Utils import Executor, ClassName
 from Bcfg2.Compat import walk_packages  # pylint: disable=W0622
+import Bcfg2.Options
 
 __all__ = [m[1] for m in walk_packages(path=__path__)]
 
-# pylint: disable=C0103
-#: All available tools
-drivers = [item for item in __all__ if item not in ['rpmtools']]
-
-#: The default set of tools that will be used if "drivers" is not set
-#: in bcfg2.conf
-default = drivers[:]
-# pylint: enable=C0103
-
 
 class ToolInstantiationError(Exception):
     """ This error is raised if the toolset cannot be instantiated. """
@@ -88,7 +79,7 @@ class Tool(object):
         """
         #: A :class:`Bcfg2.Options.OptionParser` object describing the
         #: option set Bcfg2 was invoked with
-        self.setup = get_option_parser()
+        self.setup = Bcfg2.Options.get_option_parser()
 
         #: A :class:`logging.Logger` object that will be used by this
         #: tool for logging
@@ -140,27 +131,27 @@ class Tool(object):
                                              (self.name, filename))
 
 
-    def BundleUpdated(self, bundle, states):  # pylint: disable=W0613
+    def BundleUpdated(self, bundle):  # pylint: disable=W0613
         """ Callback that is invoked when a bundle has been updated.
 
         :param bundle: The bundle that has been updated
         :type bundle: lxml.etree._Element
-        :param states: The :attr:`Bcfg2.Client.Frame.Frame.states` dict
-        :type states: dict
-        :returns: None """
-        return
+        :returns: dict - A dict of the state of entries suitable for
+                  updating :attr:`Bcfg2.Client.Frame.Frame.states`
+        """
+        return dict()
 
-    def BundleNotUpdated(self, bundle, states):  # pylint: disable=W0613
+    def BundleNotUpdated(self, bundle):  # pylint: disable=W0613
         """ Callback that is invoked when a bundle has been updated.
 
         :param bundle: The bundle that has been updated
         :type bundle: lxml.etree._Element
-        :param states: The :attr:`Bcfg2.Client.Frame.Frame.states` dict
-        :type states: dict
-        :returns: None """
-        return
+        :returns: dict - A dict of the state of entries suitable for
+                  updating :attr:`Bcfg2.Client.Frame.Frame.states`
+        """
+        return dict()
 
-    def Inventory(self, states, structures=None):
+    def Inventory(self, structures=None):
         """ Take an inventory of the system as it exists.  This
         involves two steps:
 
@@ -175,18 +166,19 @@ class Tool(object):
         is the entry tag.  E.g., a Path entry would be verified by
         calling :func:`VerifyPath`.
 
-        :param states: The :attr:`Bcfg2.Client.Frame.Frame.states` dict
-        :type states: dict
         :param structures: The list of structures (i.e., bundles) to
                            get entries from.  If this is not given,
                            all children of
                            :attr:`Bcfg2.Client.Tools.Tool.config` will
                            be used.
         :type structures: list of lxml.etree._Element
-        :returns: None """
+        :returns: dict - A dict of the state of entries suitable for
+                  updating :attr:`Bcfg2.Client.Frame.Frame.states`
+        """
         if not structures:
             structures = self.config.getchildren()
         mods = self.buildModlist()
+        states = dict()
         for struct in structures:
             for entry in struct.getchildren():
                 if self.canVerify(entry):
@@ -204,8 +196,9 @@ class Tool(object):
                                              self.primarykey(entry)),
                                           exc_info=1)
         self.extra = self.FindExtra()
+        return states
 
-    def Install(self, entries, states):
+    def Install(self, entries):
         """ Install entries.  'Install' in this sense means either
         initially install, or update as necessary to match the
         specification.
@@ -217,9 +210,10 @@ class Tool(object):
 
         :param entries: The entries to install
         :type entries: list of lxml.etree._Element
-        :param states: The :attr:`Bcfg2.Client.Frame.Frame.states` dict
-        :type states: dict
-        :returns: None """
+        :returns: dict - A dict of the state of entries suitable for
+                  updating :attr:`Bcfg2.Client.Frame.Frame.states`
+        """
+        states = dict()
         for entry in entries:
             try:
                 func = getattr(self, "Install%s" % entry.tag)
@@ -235,6 +229,7 @@ class Tool(object):
                 self.logger.error("%s: Unexpected failure installing %s" %
                                   (self.name, self.primarykey(entry)),
                                   exc_info=1)
+        return states
 
     def Remove(self, entries):
         """ Remove specified extra entries.
@@ -433,30 +428,27 @@ class PkgTool(Tool):
                            for pkg in packages)
         return self.pkgtool[0] % pkgargs
 
-    def Install(self, packages, states):
+    def Install(self, packages):
         """ Run a one-pass install where all required packages are
         installed with a single command, followed by single package
         installs in case of failure.
 
         :param entries: The entries to install
         :type entries: list of lxml.etree._Element
-        :param states: The :attr:`Bcfg2.Client.Frame.Frame.states` dict
-        :type states: dict
-        :returns: None """
+        :returns: dict - A dict of the state of entries suitable for
+                  updating :attr:`Bcfg2.Client.Frame.Frame.states`
+        """
         self.logger.info("Trying single pass package install for pkgtype %s" %
                          self.pkgtype)
 
+        states = dict()
         if self.cmd.run(self._get_package_command(packages)):
             self.logger.info("Single Pass Succeded")
             # set all package states to true and flush workqueues
-            pkgnames = [pkg.get('name') for pkg in packages]
-            for entry in list(states.keys()):
-                if (entry.tag == 'Package'
-                    and entry.get('type') == self.pkgtype
-                    and entry.get('name') in pkgnames):
-                    self.logger.debug('Setting state to true for pkg %s' %
-                                      entry.get('name'))
-                    states[entry] = True
+            for entry in packages:
+                self.logger.debug('Setting state to true for %s' %
+                                  self.primarykey(entry))
+                states[entry] = True
             self.RefreshPackages()
         else:
             self.logger.error("Single Pass Failed")
@@ -474,10 +466,13 @@ class PkgTool(Tool):
                     if self.cmd.run(self._get_package_command([pkg])):
                         states[pkg] = True
                     else:
+                        states[pkg] = False
                         self.logger.error("Failed to install package %s" %
                                           pkg.get('name'))
             self.RefreshPackages()
-        self.modified.extend(entry for entry in packages if states[entry])
+        self.modified.extend(entry for entry in packages
+                             if entry in states and states[entry])
+        return states
 
     def RefreshPackages(self):
         """ Refresh the internal representation of the package
@@ -567,7 +562,7 @@ class SvcTool(Tool):
                 self.InstallService(entry)
     Remove.__doc__ = Tool.Remove.__doc__
 
-    def BundleUpdated(self, bundle, states):
+    def BundleUpdated(self, bundle):
         if self.setup['servicemode'] == 'disabled':
             return
 
@@ -597,9 +592,10 @@ class SvcTool(Tool):
             if not success:
                 self.logger.error("Failed to manipulate service %s" %
                                   (entry.get('name')))
+        return dict()
     BundleUpdated.__doc__ = Tool.BundleUpdated.__doc__
 
-    def Install(self, entries, states):
+    def Install(self, entries):
         install_entries = []
         for entry in entries:
             if entry.get('install', 'true').lower() == 'false':
@@ -607,7 +603,7 @@ class SvcTool(Tool):
                                  (entry.tag, entry.get('name')))
             else:
                 install_entries.append(entry)
-        return Tool.Install(self, install_entries, states)
+        return Tool.Install(self, install_entries)
     Install.__doc__ = Tool.Install.__doc__
 
     def InstallService(self, entry):
diff --git a/src/lib/Bcfg2/Client/Tools/launchd.py b/src/lib/Bcfg2/Client/Tools/launchd.py
index 64aa45e4e..a4aeab6c7 100644
--- a/src/lib/Bcfg2/Client/Tools/launchd.py
+++ b/src/lib/Bcfg2/Client/Tools/launchd.py
@@ -117,9 +117,11 @@ class launchd(Bcfg2.Client.Tools.Tool):  # pylint: disable=C0103
                                          status='on')
                 for name in allsrv]
 
-    def BundleUpdated(self, bundle, states):
+    def BundleUpdated(self, bundle):
         """Reload launchd plist."""
-        for entry in [entry for entry in bundle if self.handlesEntry(entry)]:
+        for entry in bundle:
+            if not self.handlesEntry(entry):
+                continue
             if not self.canInstall(entry):
                 self.logger.error("Insufficient information to restart "
                                   "service %s" % entry.get('name'))
diff --git a/src/lib/Bcfg2/Client/Tools/rpmtools.py b/src/lib/Bcfg2/Client/Tools/rpmtools.py
deleted file mode 100755
index 32a04262d..000000000
--- a/src/lib/Bcfg2/Client/Tools/rpmtools.py
+++ /dev/null
@@ -1,1091 +0,0 @@
-#!/usr/bin/env python
-"""
-    Module that uses rpm-python to implement the following rpm
-    functionality for the bcfg2 RPM and YUM client drivers:
-
-        rpm -qa
-        rpm --verify
-        rpm --erase
-
-    The code closely follows the rpm C code.
-
-    The code was written to be used in the bcfg2 RPM/YUM drivers.
-
-    Some command line options have been provided to assist with
-    testing and development, but the output isn't pretty and looks
-    nothing like rpm output.
-
-    Run 'rpmtools' -h for the options.
-
-"""
-
-import grp
-import optparse
-import os
-import pwd
-import rpm
-import stat
-import sys
-if sys.version_info >= (2, 5):
-    import hashlib
-    py24compat = False
-else:
-    # FIXME: Remove when client python dep is 2.5 or greater
-    py24compat = True
-    import md5
-
-# Determine what prelink tools we have available.
-# The isprelink module is a python extension that examines the ELF headers
-# to see if the file has been prelinked.  If it is not present a lot of files
-# are unnecessarily run through the prelink command.
-try:
-    from isprelink import *
-    isprelink_imported = True
-except ImportError:
-    isprelink_imported = False
-
-# If the prelink command is installed on the system then we need to do
-# prelink -y on files.
-if os.access('/usr/sbin/prelink', os.X_OK):
-    prelink_exists = True
-else:
-    prelink_exists = False
-
-# If we don't have isprelink then we will use the prelink configuration file to
-# filter what we have to put through prelink -y.
-import re
-blacklist = []
-whitelist = []
-try:
-    f = open('/etc/prelink.conf', mode='r')
-    for line in f:
-        if line.startswith('#'):
-            continue
-        option, pattern = line.split()
-        if pattern.startswith('*.'):
-            pattern = pattern.replace('*.', '\.')
-            pattern += '$'
-        elif pattern.startswith('/'):
-            pattern = '^' + pattern
-        if option == '-b':
-            blacklist.append(pattern)
-        elif option == '-l':
-            whitelist.append(pattern)
-    f.close()
-except IOError:
-    pass
-
-blacklist_re = re.compile('|'.join(blacklist))
-whitelist_re = re.compile('|'.join(whitelist))
-
-# Flags that are not defined in rpm-python.
-# They are defined in lib/rpmcli.h
-# Bit(s) for verifyFile() attributes.
-#
-RPMVERIFY_NONE            = 0                      #  /*!< */
-RPMVERIFY_MD5             = 1          # 1 << 0    #  /*!< from %verify(md5) */
-RPMVERIFY_FILESIZE        = 2          # 1 << 1    #  /*!< from %verify(size) */
-RPMVERIFY_LINKTO          = 4          # 1 << 2    #  /*!< from %verify(link) */
-RPMVERIFY_USER            = 8          # 1 << 3    #  /*!< from %verify(user) */
-RPMVERIFY_GROUP           = 16         # 1 << 4    #  /*!< from %verify(group) */
-RPMVERIFY_MTIME           = 32         # 1 << 5    #  /*!< from %verify(mtime) */
-RPMVERIFY_MODE            = 64         # 1 << 6    #  /*!< from %verify(mode) */
-RPMVERIFY_RDEV            = 128        # 1 << 7    #  /*!< from %verify(rdev) */
-RPMVERIFY_CONTEXTS        = 32768      # (1 << 15) #  /*!< from --nocontexts */
-RPMVERIFY_READLINKFAIL    = 268435456  # (1 << 28) #  /*!< readlink failed */
-RPMVERIFY_READFAIL        = 536870912  # (1 << 29) #  /*!< file read failed */
-RPMVERIFY_LSTATFAIL       = 1073741824 # (1 << 30) #  /*!< lstat failed */
-RPMVERIFY_LGETFILECONFAIL = 2147483648 # (1 << 31) #  /*!< lgetfilecon failed */
-
-RPMVERIFY_FAILURES =    \
- (RPMVERIFY_LSTATFAIL|RPMVERIFY_READFAIL|RPMVERIFY_READLINKFAIL| \
-  RPMVERIFY_LGETFILECONFAIL)
-
-# Bit(s) to control rpm_verify() operation.
-#
-VERIFY_DEFAULT       = 0,       #  /*!< */
-VERIFY_MD5           = 1 << 0   #  /*!< from --nomd5 */
-VERIFY_SIZE          = 1 << 1   #  /*!< from --nosize */
-VERIFY_LINKTO        = 1 << 2   #  /*!< from --nolinkto */
-VERIFY_USER          = 1 << 3   #  /*!< from --nouser */
-VERIFY_GROUP         = 1 << 4   #  /*!< from --nogroup */
-VERIFY_MTIME         = 1 << 5   #  /*!< from --nomtime */
-VERIFY_MODE          = 1 << 6   #  /*!< from --nomode */
-VERIFY_RDEV          = 1 << 7   #  /*!< from --nodev */
-#        /* bits 8-14 unused, reserved for rpmVerifyAttrs */
-VERIFY_CONTEXTS      = 1 << 15  #  /*!< verify: from --nocontexts */
-VERIFY_FILES         = 1 << 16  #  /*!< verify: from --nofiles */
-VERIFY_DEPS          = 1 << 17  #  /*!< verify: from --nodeps */
-VERIFY_SCRIPT        = 1 << 18  #  /*!< verify: from --noscripts */
-VERIFY_DIGEST        = 1 << 19  #  /*!< verify: from --nodigest */
-VERIFY_SIGNATURE     = 1 << 20  #  /*!< verify: from --nosignature */
-VERIFY_PATCHES       = 1 << 21  #  /*!< verify: from --nopatches */
-VERIFY_HDRCHK        = 1 << 22  #  /*!< verify: from --nohdrchk */
-VERIFY_FOR_LIST      = 1 << 23  #  /*!< query:  from --list */
-VERIFY_FOR_STATE     = 1 << 24  #  /*!< query:  from --state */
-VERIFY_FOR_DOCS      = 1 << 25  #  /*!< query:  from --docfiles */
-VERIFY_FOR_CONFIG    = 1 << 26  #  /*!< query:  from --configfiles */
-VERIFY_FOR_DUMPFILES = 1 << 27  #  /*!< query:  from --dump */
-#        /* bits 28-31 used in rpmVerifyAttrs */
-
-# Comes from C cource.  lib/rpmcli.h
-VERIFY_ATTRS =   \
-  (VERIFY_MD5 | VERIFY_SIZE | VERIFY_LINKTO | VERIFY_USER | VERIFY_GROUP | \
-   VERIFY_MTIME | VERIFY_MODE | VERIFY_RDEV | VERIFY_CONTEXTS)
-
-VERIFY_ALL =     \
-  (VERIFY_ATTRS | VERIFY_FILES | VERIFY_DEPS | VERIFY_SCRIPT | VERIFY_DIGEST |\
-   VERIFY_SIGNATURE | VERIFY_HDRCHK)
-
-
-# Some masks for what checks to NOT do on these file types.
-# The C code actiually resets these up for every file.
-DIR_FLAGS = ~(RPMVERIFY_MD5 | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | \
-              RPMVERIFY_LINKTO)
-
-# These file types all have the same mask, but hopefully this will make the
-# code more readable.
-FIFO_FLAGS = CHR_FLAGS = BLK_FLAGS = GHOST_FLAGS = DIR_FLAGS
-
-LINK_FLAGS = ~(RPMVERIFY_MD5 | RPMVERIFY_FILESIZE | RPMVERIFY_MTIME | \
-               RPMVERIFY_MODE | RPMVERIFY_USER | RPMVERIFY_GROUP)
-
-REG_FLAGS = ~(RPMVERIFY_LINKTO)
-
-
-def s_isdev(mode):
-    """
-        Check to see if a file is a device.
-
-    """
-    return stat.S_ISBLK(mode) | stat.S_ISCHR(mode)
-
-def rpmpackagelist(rts):
-    """
-        Equivalent of rpm -qa.  Intended for RefreshPackages() in the RPM Driver.
-        Requires rpmtransactionset() to be run first to get a ts.
-        Returns a list of pkgspec dicts.
-
-        e.g. [ {'name':'foo', 'epoch':'20', 'version':'1.2', 'release':'5', 'arch':'x86_64' },
-               {'name':'bar', 'epoch':'10', 'version':'5.2', 'release':'2', 'arch':'x86_64' } ]
-
-    """
-    return [{'name':header[rpm.RPMTAG_NAME],
-             'epoch':header[rpm.RPMTAG_EPOCH],
-             'version':header[rpm.RPMTAG_VERSION],
-             'release':header[rpm.RPMTAG_RELEASE],
-             'arch':header[rpm.RPMTAG_ARCH],
-             'gpgkeyid':header.sprintf("%|SIGGPG?{%{SIGGPG:pgpsig}}:{None}|").split()[-1]}
-             for header in rts.dbMatch()]
-
-def getindexbykeyword(index_ts, **kwargs):
-    """
-        Return list of indexs from the rpmdb matching keywords
-        ex: getHeadersByKeyword(name='foo', version='1', release='1')
-
-        Can be passed any structure that can be indexed by the pkgspec
-        keyswords as other keys are filtered out.
-
-    """
-    lst = []
-    name = kwargs.get('name')
-    if name:
-        index_mi = index_ts.dbMatch(rpm.RPMTAG_NAME, name)
-    else:
-        index_mi = index_ts.dbMatch()
-
-    if 'epoch' in kwargs:
-        if kwargs['epoch'] != None and kwargs['epoch'] != 'None':
-            kwargs['epoch'] = int(kwargs['epoch'])
-        else:
-            del(kwargs['epoch'])
-
-    keywords = [key for key in list(kwargs.keys()) \
-                         if key in ('name', 'epoch', 'version', 'release', 'arch')]
-    keywords_len = len(keywords)
-    for hdr in index_mi:
-        match = 0
-        for keyword in keywords:
-            if hdr[keyword] == kwargs[keyword]:
-                match += 1
-        if match == keywords_len:
-            lst.append(index_mi.instance())
-    del index_mi
-    return lst
-
-def getheadersbykeyword(header_ts, **kwargs):
-    """
-        Borrowed parts of this from from Yum.  Need to fix it though.
-        Epoch is not handled right.
-
-        Return list of headers from the rpmdb matching keywords
-        ex: getHeadersByKeyword(name='foo', version='1', release='1')
-
-        Can be passed any structure that can be indexed by the pkgspec
-        keyswords as other keys are filtered out.
-
-    """
-    lst = []
-    name = kwargs.get('name')
-    if name:
-        header_mi = header_ts.dbMatch(rpm.RPMTAG_NAME, name)
-    else:
-        header_mi = header_ts.dbMatch()
-
-    if 'epoch' in kwargs:
-        if kwargs['epoch'] != None and kwargs['epoch'] != 'None':
-            kwargs['epoch'] = int(kwargs['epoch'])
-        else:
-            del(kwargs['epoch'])
-
-    keywords = [key for key in list(kwargs.keys()) \
-                         if key in ('name', 'epoch', 'version', 'release', 'arch')]
-    keywords_len = len(keywords)
-    for hdr in header_mi:
-        match = 0
-        for keyword in keywords:
-            if hdr[keyword] == kwargs[keyword]:
-                match += 1
-        if match == keywords_len:
-            lst.append(hdr)
-    del header_mi
-    return lst
-
-def prelink_md5_check(filename):
-    """
-        Checks if a file is prelinked.  If it is run it through prelink -y
-        to get the unprelinked md5 and file size.
-
-        Return 0 if the file was not prelinked, otherwise return the file size.
-        Always return the md5.
-
-    """
-    prelink = False
-    try:
-        plf = open(filename, "rb")
-    except IOError:
-        return False, 0
-
-    if prelink_exists:
-        if isprelink_imported:
-            plfd = plf.fileno()
-            if isprelink(plfd):
-                plf.close()
-                cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
-                                            % (re.escape(filename))
-                plf = os.popen(cmd, 'rb')
-                prelink = True
-        elif whitelist_re.search(filename) and not blacklist_re.search(filename):
-            plf.close()
-            cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
-                                        % (re.escape(filename))
-            plf = os.popen(cmd, 'rb')
-            prelink = True
-
-    fsize = 0
-    if py24compat:
-        chksum = md5.new()
-    else:
-        chksum = hashlib.md5()
-    while 1:
-        data = plf.read()
-        if not data:
-            break
-        fsize += len(data)
-        chksum.update(data)
-    plf.close()
-    file_md5 = chksum.hexdigest()
-    if prelink:
-        return file_md5, fsize
-    else:
-        return file_md5, 0
-
-def prelink_size_check(filename):
-    """
-       This check is only done if the prelink_md5_check() is not done first.
-
-       Checks if a file is prelinked.  If it is run it through prelink -y
-       to get the unprelinked file size.
-
-       Return 0 if the file was not prelinked, otherwise return the file size.
-
-    """
-    fsize = 0
-    try:
-        plf = open(filename, "rb")
-    except IOError:
-        return False
-
-    if prelink_exists:
-        if isprelink_imported:
-            plfd = plf.fileno()
-            if isprelink(plfd):
-                plf.close()
-                cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
-                                            % (re.escape(filename))
-                plf = os.popen(cmd, 'rb')
-
-                while 1:
-                    data = plf.read()
-                    if not data:
-                        break
-                    fsize += len(data)
-
-        elif whitelist_re.search(filename) and not blacklist_re.search(filename):
-            plf.close()
-            cmd = '/usr/sbin/prelink -y %s 2> /dev/null' \
-                                        % (re.escape(filename))
-            plf = os.popen(cmd, 'rb')
-
-            while 1:
-                data = plf.read()
-                if not data:
-                    break
-                fsize += len(data)
-
-    plf.close()
-
-    return fsize
-
-def debug_verify_flags(vflags):
-    """
-        Decodes the verify flags bits.
-    """
-    if vflags & RPMVERIFY_MD5:
-        print('RPMVERIFY_MD5')
-    if vflags & RPMVERIFY_FILESIZE:
-        print('RPMVERIFY_FILESIZE')
-    if vflags & RPMVERIFY_LINKTO:
-        print('RPMVERIFY_LINKTO')
-    if vflags & RPMVERIFY_USER:
-        print('RPMVERIFY_USER')
-    if vflags & RPMVERIFY_GROUP:
-        print('RPMVERIFY_GROUP')
-    if vflags & RPMVERIFY_MTIME:
-        print('RPMVERIFY_MTIME')
-    if vflags & RPMVERIFY_MODE:
-        print('RPMVERIFY_MODE')
-    if vflags & RPMVERIFY_RDEV:
-        print('RPMVERIFY_RDEV')
-    if vflags & RPMVERIFY_CONTEXTS:
-        print('RPMVERIFY_CONTEXTS')
-    if vflags & RPMVERIFY_READLINKFAIL:
-        print('RPMVERIFY_READLINKFAIL')
-    if vflags & RPMVERIFY_READFAIL:
-        print('RPMVERIFY_READFAIL')
-    if vflags & RPMVERIFY_LSTATFAIL:
-        print('RPMVERIFY_LSTATFAIL')
-    if vflags & RPMVERIFY_LGETFILECONFAIL:
-        print('RPMVERIFY_LGETFILECONFAIL')
-
-def debug_file_flags(fflags):
-    """
-        Decodes the file flags bits.
-    """
-    if fflags & rpm.RPMFILE_CONFIG:
-        print('rpm.RPMFILE_CONFIG')
-
-    if fflags & rpm.RPMFILE_DOC:
-        print('rpm.RPMFILE_DOC')
-
-    if fflags & rpm.RPMFILE_ICON:
-        print('rpm.RPMFILE_ICON')
-
-    if fflags & rpm.RPMFILE_MISSINGOK:
-        print('rpm.RPMFILE_MISSINGOK')
-
-    if fflags & rpm.RPMFILE_NOREPLACE:
-        print('rpm.RPMFILE_NOREPLACE')
-
-    if fflags & rpm.RPMFILE_GHOST:
-        print('rpm.RPMFILE_GHOST')
-
-    if fflags & rpm.RPMFILE_LICENSE:
-        print('rpm.RPMFILE_LICENSE')
-
-    if fflags & rpm.RPMFILE_README:
-        print('rpm.RPMFILE_README')
-
-    if fflags & rpm.RPMFILE_EXCLUDE:
-        print('rpm.RPMFILE_EXLUDE')
-
-    if fflags & rpm.RPMFILE_UNPATCHED:
-        print('rpm.RPMFILE_UNPATCHED')
-
-    if fflags & rpm.RPMFILE_PUBKEY:
-        print('rpm.RPMFILE_PUBKEY')
-
-def rpm_verify_file(fileinfo, rpmlinktos, omitmask):
-    """
-        Verify all the files in a package.
-
-        Returns a list of error flags, the file type and file name.  The list
-        entries are strings that are the same as the labels for the bitwise
-        flags used in the C code.
-
-    """
-    (fname, fsize, fmode, fmtime, fflags, frdev, finode, fnlink, fstate, \
-            vflags, fuser, fgroup, fmd5) = fileinfo
-
-    # 1. rpmtsRootDir stuff.  What does it do and where to I get it from?
-
-    file_results = []
-    flags = vflags
-
-    # Check to see if the file was installed - if not pretend all is ok.
-    # This is what the rpm C code does!
-    if fstate != rpm.RPMFILE_STATE_NORMAL:
-        return file_results
-
-    # Get the installed files stats
-    try:
-        lstat = os.lstat(fname)
-    except OSError:
-        if not (fflags & (rpm.RPMFILE_MISSINGOK|rpm.RPMFILE_GHOST)):
-            file_results.append('RPMVERIFY_LSTATFAIL')
-            #file_results.append(fname)
-        return file_results
-
-    # 5. Contexts?  SELinux stuff?
-
-    # Setup what checks to do.  This is straight out of the C code.
-    if stat.S_ISDIR(lstat.st_mode):
-        flags &= DIR_FLAGS
-    elif stat.S_ISLNK(lstat.st_mode):
-        flags &= LINK_FLAGS
-    elif stat.S_ISFIFO(lstat.st_mode):
-        flags &= FIFO_FLAGS
-    elif stat.S_ISCHR(lstat.st_mode):
-        flags &= CHR_FLAGS
-    elif stat.S_ISBLK(lstat.st_mode):
-        flags &= BLK_FLAGS
-    else:
-        flags &= REG_FLAGS
-
-    if (fflags & rpm.RPMFILE_GHOST):
-        flags &= GHOST_FLAGS
-
-    flags &= ~(omitmask | RPMVERIFY_FAILURES)
-
-    # 8. SELinux stuff.
-
-    prelink_size = 0
-    if flags & RPMVERIFY_MD5:
-        prelink_md5, prelink_size = prelink_md5_check(fname)
-        if prelink_md5 == False:
-            file_results.append('RPMVERIFY_MD5')
-            file_results.append('RPMVERIFY_READFAIL')
-        elif  prelink_md5 != fmd5:
-            file_results.append('RPMVERIFY_MD5')
-
-    if flags & RPMVERIFY_LINKTO:
-        linkto = os.readlink(fname)
-        if not linkto:
-            file_results.append('RPMVERIFY_READLINKFAIL')
-            file_results.append('RPMVERIFY_LINKTO')
-        else:
-            if len(rpmlinktos) == 0  or linkto != rpmlinktos:
-                file_results.append('RPMVERIFY_LINKTO')
-
-    if flags & RPMVERIFY_FILESIZE:
-        if not (flags & RPMVERIFY_MD5): # prelink check hasn't been done.
-            prelink_size = prelink_size_check(fname)
-        if (prelink_size != 0):         # This is a prelinked file.
-            if (prelink_size != fsize):
-                file_results.append('RPMVERIFY_FILESIZE')
-        elif lstat.st_size != fsize:    # It wasn't a prelinked file.
-            file_results.append('RPMVERIFY_FILESIZE')
-
-    if flags & RPMVERIFY_MODE:
-        metamode = fmode
-        filemode = lstat.st_mode
-
-        # Comparing the type of %ghost files is meaningless, but perms are ok.
-        if fflags & rpm.RPMFILE_GHOST:
-            metamode &= ~0xf000
-            filemode &= ~0xf000
-
-        if (stat.S_IFMT(metamode) != stat.S_IFMT(filemode)) or \
-           (stat.S_IMODE(metamode) != stat.S_IMODE(filemode)):
-            file_results.append('RPMVERIFY_MODE')
-
-    if flags & RPMVERIFY_RDEV:
-        if (stat.S_ISCHR(fmode) != stat.S_ISCHR(lstat.st_mode) or
-            stat.S_ISBLK(fmode) != stat.S_ISBLK(lstat.st_mode)):
-            file_results.append('RPMVERIFY_RDEV')
-        elif (s_isdev(fmode) & s_isdev(lstat.st_mode)):
-            st_rdev = lstat.st_rdev
-            if frdev != st_rdev:
-                file_results.append('RPMVERIFY_RDEV')
-
-    if flags & RPMVERIFY_MTIME:
-        if lstat.st_mtime != fmtime:
-            file_results.append('RPMVERIFY_MTIME')
-
-    if flags & RPMVERIFY_USER:
-        try:
-            user = pwd.getpwuid(lstat.st_uid)[0]
-        except KeyError:
-            user = None
-        if not user or not fuser or (user != fuser):
-            file_results.append('RPMVERIFY_USER')
-
-    if flags & RPMVERIFY_GROUP:
-        try:
-            group = grp.getgrgid(lstat.st_gid)[0]
-        except KeyError:
-            group = None
-        if not group or not fgroup or (group != fgroup):
-            file_results.append('RPMVERIFY_GROUP')
-
-    return file_results
-
-def rpm_verify_dependencies(header):
-    """
-        Check package dependencies. Header is an rpm.hdr.
-
-        Don't like opening another ts to do this, but
-        it was the only way I could find of clearing the ts
-        out.
-
-        Have asked on the rpm-maint list on how to do
-        this the right way (28 Feb 2007).
-
-        ts.check() returns:
-
-        ((name, version, release), (reqname, reqversion), \
-            flags, suggest, sense)
-
-    """
-    _ts1 = rpmtransactionset()
-    _ts1.addInstall(header, 'Dep Check', 'i')
-    dep_errors = _ts1.check()
-    _ts1.closeDB()
-    return dep_errors
-
-def rpm_verify_package(vp_ts, header, verify_options):
-    """
-        Verify a single package specified by header.  Header is an rpm.hdr.
-
-        If errors are found it returns a dictionary of errors.
-
-    """
-    # Set some transaction level flags.
-    vsflags = 0
-    if 'nodigest' in verify_options:
-        vsflags |= rpm._RPMVSF_NODIGESTS
-    if 'nosignature' in verify_options:
-        vsflags |= rpm._RPMVSF_NOSIGNATURES
-    ovsflags = vp_ts.setVSFlags(vsflags)
-
-    # Map from the Python options to the rpm bitwise flags.
-    omitmask = 0
-
-    if 'nolinkto' in verify_options:
-        omitmask |= VERIFY_LINKTO
-    if 'nomd5' in verify_options:
-        omitmask |= VERIFY_MD5
-    if 'nosize' in verify_options:
-        omitmask |= VERIFY_SIZE
-    if 'nouser' in verify_options:
-        omitmask |= VERIFY_USER
-    if 'nogroup' in verify_options:
-        omitmask |= VERIFY_GROUP
-    if 'nomtime' in verify_options:
-        omitmask |= VERIFY_MTIME
-    if 'nomode' in verify_options:
-        omitmask |= VERIFY_MODE
-    if 'nordev' in verify_options:
-        omitmask |= VERIFY_RDEV
-
-    omitmask = ((~omitmask & VERIFY_ATTRS) ^ VERIFY_ATTRS)
-
-    package_results = {}
-
-    # Check Signatures and Digests.
-    # No idea what this might return.  Need to break something to see.
-    # Setting the vsflags above determines what gets checked in the header.
-    hdr_stat = vp_ts.hdrCheck(header.unload())
-    if hdr_stat:
-        package_results['hdr'] = hdr_stat
-
-    # Check Package Depencies.
-    if 'nodeps' not in verify_options:
-        dep_stat = rpm_verify_dependencies(header)
-        if dep_stat:
-            package_results['deps'] = dep_stat
-
-    # Check all the package files.
-    if 'nofiles' not in verify_options:
-        vp_fi = header.fiFromHeader()
-        for fileinfo in vp_fi:
-            # Do not bother doing anything with ghost files.
-            # This is what RPM does.
-            if fileinfo[4] & rpm.RPMFILE_GHOST:
-                continue
-
-            # This is only needed because of an inconsistency in the
-            # rpm.fi interface.
-            linktos = vp_fi.FLink()
-
-            file_stat = rpm_verify_file(fileinfo, linktos, omitmask)
-
-            #if len(file_stat) > 0 or options.verbose:
-            if len(file_stat) > 0:
-                fflags = fileinfo[4]
-                if fflags & rpm.RPMFILE_CONFIG:
-                    file_stat.append('c')
-                elif fflags & rpm.RPMFILE_DOC:
-                    file_stat.append('d')
-                elif fflags & rpm.RPMFILE_GHOST:
-                    file_stat.append('g')
-                elif fflags & rpm.RPMFILE_LICENSE:
-                    file_stat.append('l')
-                elif fflags & rpm.RPMFILE_PUBKEY:
-                    file_stat.append('P')
-                elif fflags & rpm.RPMFILE_README:
-                    file_stat.append('r')
-                else:
-                    file_stat.append(' ')
-
-                file_stat.append(fileinfo[0]) # The filename.
-                package_results.setdefault('files', []).append(file_stat)
-
-    # Run the verify script if there is one.
-    # Do we want this?
-    #if 'noscripts' not in verify_options:
-    #    script_stat = rpmVerifyscript()
-    #    if script_stat:
-    #        package_results['script'] = script_stat
-
-    # If there have been any errors, add the package nevra to the result.
-    if len(package_results) > 0:
-        package_results.setdefault('nevra', (header[rpm.RPMTAG_NAME], \
-                                             header[rpm.RPMTAG_EPOCH], \
-                                             header[rpm.RPMTAG_VERSION], \
-                                             header[rpm.RPMTAG_RELEASE], \
-                                             header[rpm.RPMTAG_ARCH]))
-    else:
-        package_results = None
-
-    # Put things back the way we found them.
-    vsflags = vp_ts.setVSFlags(ovsflags)
-
-    return package_results
-
-def rpm_verify(verify_ts, verify_pkgspec, verify_options=[]):
-    """
-       Requires rpmtransactionset() to be run first to get a ts.
-
-       pkgspec is a dict specifying the package
-       e.g.:
-           For a single package
-           { name='foo', epoch='20', version='1', release='1', arch='x86_64'}
-
-           For all packages
-           {}
-
-       Or any combination of keywords to select one or more packages to verify.
-
-       options is a list of 'rpm --verify' options. Default is to check everything.
-       e.g.:
-           [ 'nodeps', 'nodigest', 'nofiles', 'noscripts', 'nosignature',
-             'nolinkto' 'nomd5', 'nosize', 'nouser', 'nogroup', 'nomtime',
-             'nomode', 'nordev' ]
-
-       Returns a list.  One list entry per package.  Each list entry is a
-       dictionary.  Dict keys are 'files', 'deps', 'nevra' and 'hdr'.
-       Entries only get added for the failures. If nothing failed, None is
-       returned.
-
-       Its all a bit messy and probably needs reviewing.
-
-       [ { 'hdr': [???],
-           'deps: [((name, version, release), (reqname, reqversion),
-                    flags, suggest, sense), .... ]
-           'files': [ ['filename1', 'RPMVERIFY_GROUP', 'RPMVERIFY_USER' ],
-                      ['filename2', 'RPMVERFIY_LSTATFAIL']]
-           'nevra': ['name1', 'epoch1', 'version1', 'release1', 'arch1'] }
-         { 'hdr': [???],
-           'deps: [((name, version, release), (reqname, reqversion),
-                    flags, suggest, sense), .... ]
-           'files': [ ['filename', 'RPMVERIFY_GROUP', 'RPMVERIFY_USER" ],
-                      ['filename2', 'RPMVERFIY_LSTATFAIL']]
-           'nevra': ['name2', 'epoch2', 'version2', 'release2', 'arch2'] } ]
-
-    """
-    verify_results = []
-    headers = getheadersbykeyword(verify_ts, **verify_pkgspec)
-    for header in headers:
-        result = rpm_verify_package(verify_ts, header, verify_options)
-        if result:
-            verify_results.append(result)
-
-    return verify_results
-
-def rpmtransactionset():
-    """
-        A simple wrapper for rpm.TransactionSet() to keep everthiing together.
-        Might use it to set some ts level flags later.
-
-    """
-    ts = rpm.TransactionSet()
-    return ts
-
-class Rpmtscallback(object):
-    """
-        Callback for ts.run().  Used for adding, upgrading and removing packages.
-        Starting with all possible reasons codes, but bcfg2 will probably only
-        make use of a few of them.
-
-        Mostly just printing stuff at the moment to understand how the callback
-        is used.
-
-    """
-    def __init__(self):
-        self.fdnos = {}
-
-    def callback(self, reason, amount, total, key, client_data):
-        """
-            Generic rpmts call back.
-        """
-        if   reason == rpm.RPMCALLBACK_INST_OPEN_FILE:
-            pass
-        elif reason == rpm.RPMCALLBACK_INST_CLOSE_FILE:
-            pass
-        elif reason == rpm.RPMCALLBACK_INST_START:
-            pass
-        elif reason == rpm.RPMCALLBACK_TRANS_PROGRESS or \
-             reason == rpm.RPMCALLBACK_INST_PROGRESS:
-            pass
-            #       rpm.RPMCALLBACK_INST_PROGRESS'
-        elif reason == rpm.RPMCALLBACK_TRANS_START:
-            pass
-        elif reason == rpm.RPMCALLBACK_TRANS_STOP:
-            pass
-        elif reason == rpm.RPMCALLBACK_REPACKAGE_START:
-            pass
-        elif reason == rpm.RPMCALLBACK_REPACKAGE_PROGRESS:
-            pass
-        elif reason == rpm.RPMCALLBACK_REPACKAGE_STOP:
-            pass
-        elif reason == rpm.RPMCALLBACK_UNINST_PROGRESS:
-            pass
-        elif reason == rpm.RPMCALLBACK_UNINST_START:
-            pass
-        elif reason == rpm.RPMCALLBACK_UNINST_STOP:
-            pass
-            # How do we get at this?
-            # RPM.modified += key
-        elif reason == rpm.RPMCALLBACK_UNPACK_ERROR:
-            pass
-        elif reason == rpm.RPMCALLBACK_CPIO_ERROR:
-            pass
-        elif reason == rpm.RPMCALLBACK_UNKNOWN:
-            pass
-        else:
-            print('ERROR - Fell through callBack')
-
-
-def rpm_erase(erase_pkgspecs, erase_flags):
-    """
-       pkgspecs is a list of pkgspec dicts specifying packages
-       e.g.:
-           For a single package
-           { name='foo', epoch='20', version='1', release='1', arch='x86_64'}
-
-    """
-    erase_ts_flags = 0
-    if 'noscripts' in erase_flags:
-        erase_ts_flags |= rpm.RPMTRANS_FLAG_NOSCRIPTS
-    if 'notriggers' in erase_flags:
-        erase_ts_flags |= rpm.RPMTRANS_FLAG_NOTRIGGERS
-    if 'repackage' in erase_flags:
-        erase_ts_flags |= rpm.RPMTRANS_FLAG_REPACKAGE
-
-    erase_ts = rpmtransactionset()
-    erase_ts.setFlags(erase_ts_flags)
-
-    for pkgspec in erase_pkgspecs:
-        idx_list = getindexbykeyword(erase_ts, **pkgspec)
-        if len(idx_list) > 1 and not 'allmatches' in erase_flags:
-            #pass
-            print('ERROR - Multiple package match for erase', pkgspec)
-        else:
-            for idx in idx_list:
-                erase_ts.addErase(idx)
-
-    #for te in erase_ts:
-
-    erase_problems = []
-    if 'nodeps' not in erase_flags:
-        erase_problems = erase_ts.check()
-
-    if erase_problems == []:
-        erase_ts.order()
-        erase_callback = Rpmtscallback()
-        erase_ts.run(erase_callback.callback, 'Erase')
-    #else:
-
-    erase_ts.closeDB()
-    del erase_ts
-    return erase_problems
-
-def display_verify_file(file_results):
-    '''
-        Display file results similar to rpm --verify.
-    '''
-    filename = file_results[-1]
-    filetype = file_results[-2]
-
-    result_string = ''
-
-    if 'RPMVERIFY_LSTATFAIL' in file_results:
-        result_string = 'missing '
-    else:
-        if 'RPMVERIFY_FILESIZE' in file_results:
-            result_string = result_string + 'S'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_MODE' in file_results:
-            result_string = result_string + 'M'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_MD5' in file_results:
-            if 'RPMVERIFY_READFAIL' in file_results:
-                result_string = result_string + '?'
-            else:
-                result_string = result_string + '5'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_RDEV' in file_results:
-            result_string = result_string + 'D'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_LINKTO' in file_results:
-            if 'RPMVERIFY_READLINKFAIL' in file_results:
-                result_string = result_string + '?'
-            else:
-                result_string = result_string + 'L'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_USER' in file_results:
-            result_string = result_string + 'U'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_GROUP' in file_results:
-            result_string = result_string + 'G'
-        else:
-            result_string = result_string + '.'
-
-        if 'RPMVERIFY_MTIME' in file_results:
-            result_string = result_string + 'T'
-        else:
-            result_string = result_string + '.'
-
-    print(result_string + '  ' + filetype + ' ' + filename)
-    sys.stdout.flush()
-
-#===============================================================================
-# Some options and output to assist with development and testing.
-# These are not intended for normal use.
-if __name__ == "__main__":
-
-    p = optparse.OptionParser()
-
-    p.add_option('--name', action='store', \
-                 default=None, \
-                 help='''Package name to verify.
-
-                         ******************************************
-                         NOT SPECIFYING A NAME MEANS 'ALL' PACKAGES.
-                         ******************************************
-
-                         The specified operation will be carried out on  all
-                         instances of packages that match the package specification
-                         (name, epoch, version, release, arch).''')
-
-    p.add_option('--epoch', action='store', \
-                 default=None, \
-                 help='''Package epoch.''')
-
-    p.add_option('--version', action='store', \
-                 default=None, \
-                 help='''Package version.''')
-
-    p.add_option('--release', action='store', \
-                 default=None, \
-                 help='''Package release.''')
-
-    p.add_option('--arch', action='store', \
-                 default=None, \
-                 help='''Package arch.''')
-
-    p.add_option('--erase', '-e', action='store_true', \
-                 default=None, \
-                 help='''****************************************************
-                         REMOVE PACKAGES.  THERE ARE NO WARNINGS.  MULTIPLE
-                         PACKAGES WILL BE REMOVED IF A FULL PACKAGE SPEC IS NOT
-                         GIVEN. E.G. IF JUST A NAME IS GIVEN ALL INSTALLED
-                         INSTANCES OF THAT PACKAGE WILL BE REMOVED PROVIDED
-                         DEPENDENCY CHECKS PASS.  IF JUST AN EPOCH IS GIVEN
-                         ALL PACKAGE INSTANCES WITH THAT EPOCH WILL BE REMOVED.
-                         ****************************************************''')
-
-    p.add_option('--list', '-l', action='store_true', \
-                 help='''List package identity info. rpm -qa ish equivalent
-                         intended for use in RefreshPackages().''')
-
-    p.add_option('--verify', action='store_true', \
-                 help='''Verify Package(s).  Output is only produced after all
-                         packages has been verified. Be patient.''')
-
-    p.add_option('--verbose', '-v', action='store_true', \
-                 help='''Verbose output for --verify option.  Output is the
-                         same as rpm -v --verify.''')
-
-    p.add_option('--nodeps', action='store_true', \
-                 default=False, \
-                 help='Do not do dependency testing.')
-
-    p.add_option('--nodigest', action='store_true', \
-                 help='Do not check package digests.')
-
-    p.add_option('--nofiles', action='store_true', \
-                 help='Do not do file checks.')
-
-    p.add_option('--noscripts', action='store_true', \
-                 help='Do not run verification scripts.')
-
-    p.add_option('--nosignature', action='store_true', \
-                 help='Do not do package signature verification.')
-
-    p.add_option('--nolinkto', action='store_true', \
-                 help='Do not do symlink tests.')
-
-    p.add_option('--nomd5', action='store_true', \
-                 help='''Do not do MD5 checksums on files.  Note that this does
-                                            not work for prelink files yet.''')
-
-    p.add_option('--nosize', action='store_true', \
-                 help='''Do not do file size tests. Note that this does not work
-                                            for prelink files yet.''')
-
-    p.add_option('--nouser', action='store_true', \
-                 help='Do not check file user ownership.')
-
-    p.add_option('--nogroup', action='store_true', \
-                 help='Do not check file group ownership.')
-
-    p.add_option('--nomtime', action='store_true', \
-                 help='Do not check file modification times.')
-
-    p.add_option('--nomode', action='store_true', \
-                 help='Do not check file modes (permissions).')
-
-    p.add_option('--nordev', action='store_true', \
-                 help='Do not check device node.')
-
-    p.add_option('--notriggers', action='store_true', \
-                 help='Do not do not generate triggers on erase.')
-
-    p.add_option('--repackage', action='store_true', \
-                 help='''Do repackage on erase.i Packages are put
-                                            in /var/spool/repackage.''')
-
-    p.add_option('--allmatches', action='store_true', \
-                 help='''Remove all package instances that match the
-                         pkgspec.
-
-                         ***************************************************
-                         NO WARNINGS ARE GIVEN.  IF THERE IS NO PACKAGE SPEC
-                         THAT MEANS ALL PACKAGES!!!!
-                         ***************************************************''')
-
-    options, arguments = p.parse_args()
-
-    pkgspec = {}
-    rpm_options = []
-
-    if options.nodeps:
-        rpm_options.append('nodeps')
-
-    if options.nodigest:
-        rpm_options.append('nodigest')
-
-    if options.nofiles:
-        rpm_options.append('nofiles')
-
-    if options.noscripts:
-        rpm_options.append('noscripts')
-
-    if options.nosignature:
-        rpm_options.append('nosignature')
-
-    if options.nolinkto:
-        rpm_options.append('nolinkto')
-
-    if options.nomd5:
-        rpm_options.append('nomd5')
-
-    if options.nosize:
-        rpm_options.append('nosize')
-
-    if options.nouser:
-        rpm_options.append('nouser')
-
-    if options.nogroup:
-        rpm_options.append('nogroup')
-
-    if options.nomtime:
-        rpm_options.append('nomtime')
-
-    if options.nomode:
-        rpm_options.append('nomode')
-
-    if options.nordev:
-        rpm_options.append('nordev')
-
-    if options.repackage:
-        rpm_options.append('repackage')
-
-    if options.allmatches:
-        rpm_options.append('allmatches')
-
-    main_ts = rpmtransactionset()
-
-    cmdline_pkgspec = {}
-    if options.name != 'all':
-        if options.name:
-            cmdline_pkgspec['name'] = str(options.name)
-        if options.epoch:
-            cmdline_pkgspec['epoch'] = str(options.epoch)
-        if options.version:
-            cmdline_pkgspec['version'] = str(options.version)
-        if options.release:
-            cmdline_pkgspec['release'] = str(options.release)
-        if options.arch:
-            cmdline_pkgspec['arch'] = str(options.arch)
-
-    if options.verify:
-        results = rpm_verify(main_ts, cmdline_pkgspec, rpm_options)
-        for r in results:
-            files = r.get('files', '')
-            for f in files:
-                display_verify_file(f)
-
-    elif options.list:
-        for p in rpmpackagelist(main_ts):
-            print(p)
-
-    elif options.erase:
-        if options.name:
-            rpm_erase([cmdline_pkgspec], rpm_options)
-        else:
-            print('You must specify the "--name" option')
diff --git a/src/lib/Bcfg2/Options.py b/src/lib/Bcfg2/Options.py
index 3f4e9a83c..74c488b45 100644
--- a/src/lib/Bcfg2/Options.py
+++ b/src/lib/Bcfg2/Options.py
@@ -9,8 +9,8 @@ import shlex
 import sys
 import grp
 import pwd
-import Bcfg2.Client.Tools
-from Bcfg2.Compat import ConfigParser
+from Bcfg2.Client.Tools import __path__ as toolpath
+from Bcfg2.Compat import ConfigParser, walk_packages
 from Bcfg2.version import __version__
 
 
@@ -723,7 +723,7 @@ CLIENT_PARANOID = \
            cook=get_bool)
 CLIENT_DRIVERS = \
     Option('Specify tool driver set',
-           default=Bcfg2.Client.Tools.default,
+           default=[m[1] for m in walk_packages(path=toolpath)],
            cmd='-D',
            odesc='<driver1,driver2>',
            cf=('client', 'drivers'),
diff --git a/src/sbin/bcfg2-info b/src/sbin/bcfg2-info
index 60b099284..287d0a161 100755
--- a/src/sbin/bcfg2-info
+++ b/src/sbin/bcfg2-info
@@ -281,9 +281,8 @@ Bcfg2 client itself.""")
             posix = Bcfg2.Client.Tools.POSIX.POSIX(MockLog(),
                                                    self.setup,
                                                    client_config)
-            states = dict()
-            posix.Inventory(states)
-            posix.Install(list(states.keys()), states)
+            states = posix.Inventory()
+            posix.Install(list(states.keys()))
         else:
             print('Error: Incorrect number of parameters.')
             self.help_builddir()
diff --git a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Test__init.py b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Test__init.py
index f01082e86..c2c6c5d4c 100644
--- a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Test__init.py
+++ b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIX/Test__init.py
@@ -49,7 +49,6 @@ class TestPOSIX(TestTool):
         mock_canVerify.assert_called_with(posix, entry)
 
         # next, test fully_specified failure
-        posix.logger.error.reset_mock()
         mock_canVerify.reset_mock()
         mock_canVerify.return_value = True
         mock_fully_spec = Mock()
@@ -59,17 +58,14 @@ class TestPOSIX(TestTool):
         self.assertFalse(posix.canVerify(entry))
         mock_canVerify.assert_called_with(posix, entry)
         mock_fully_spec.assert_called_with(entry)
-        self.assertTrue(posix.logger.error.called)
 
         # finally, test success
-        posix.logger.error.reset_mock()
         mock_canVerify.reset_mock()
         mock_fully_spec.reset_mock()
         mock_fully_spec.return_value = True
         self.assertTrue(posix.canVerify(entry))
         mock_canVerify.assert_called_with(posix, entry)
         mock_fully_spec.assert_called_with(entry)
-        self.assertFalse(posix.logger.error.called)
 
     @patch("Bcfg2.Client.Tools.Tool.canInstall")
     def test_canInstall(self, mock_canInstall):
@@ -82,7 +78,6 @@ class TestPOSIX(TestTool):
         mock_canInstall.assert_called_with(posix, entry)
 
         # next, test fully_specified failure
-        posix.logger.error.reset_mock()
         mock_canInstall.reset_mock()
         mock_canInstall.return_value = True
         mock_fully_spec = Mock()
@@ -92,17 +87,14 @@ class TestPOSIX(TestTool):
         self.assertFalse(posix.canInstall(entry))
         mock_canInstall.assert_called_with(posix, entry)
         mock_fully_spec.assert_called_with(entry)
-        self.assertTrue(posix.logger.error.called)
 
         # finally, test success
-        posix.logger.error.reset_mock()
         mock_canInstall.reset_mock()
         mock_fully_spec.reset_mock()
         mock_fully_spec.return_value = True
         self.assertTrue(posix.canInstall(entry))
         mock_canInstall.assert_called_with(posix, entry)
         mock_fully_spec.assert_called_with(entry)
-        self.assertFalse(posix.logger.error.called)
 
     def test_InstallPath(self):
         posix = self.get_obj()
@@ -152,7 +144,6 @@ class TestPOSIX(TestTool):
         def inner(mock_listdir):
             mock_listdir.side_effect = OSError
             posix._prune_old_backups(entry)
-            self.assertTrue(posix.logger.error.called)
             self.assertFalse(mock_remove.called)
             mock_listdir.assert_called_with(setup['ppath'])
 
@@ -170,7 +161,6 @@ class TestPOSIX(TestTool):
             mock_listdir.reset_mock()
             mock_remove.reset_mock()
             mock_remove.side_effect = OSError
-            posix.logger.error.reset_mock()
             # test to ensure that we call os.remove() for all files that
             # need to be removed even if we get an error
             posix._prune_old_backups(entry)
@@ -178,7 +168,6 @@ class TestPOSIX(TestTool):
             self.assertItemsEqual(mock_remove.call_args_list,
                                   [call(os.path.join(setup['ppath'], p))
                                    for p in remove])
-            self.assertTrue(posix.logger.error.called)
 
         inner()
 
diff --git a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py
index 4fcd63a60..211c39732 100644
--- a/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py
+++ b/testsuite/Testsrc/Testlib/TestClient/TestTools/TestPOSIXUsers.py
@@ -24,11 +24,11 @@ from TestTools.Test_init import TestTool
 class TestPOSIXUsers(TestTool):
     test_obj = POSIXUsers
 
-    def get_obj(self, logger=None, setup=None, config=None):
+    def get_obj(self, setup=None, config=None):
         if setup is None:
             setup = MagicMock()
             setup.__getitem__.return_value = []
-        return TestTool.get_obj(self, logger, setup, config)
+        return TestTool.get_obj(self, setup, config)
 
     @patch("pwd.getpwall")
     @patch("grp.getgrall")
@@ -134,10 +134,9 @@ class TestPOSIXUsers(TestTool):
         users.set_defaults['POSIXUser'] = Mock()
         users.set_defaults['POSIXUser'].side_effect = lambda e: e
 
-        states = dict()
-        self.assertEqual(users.Inventory(states),
+        self.assertEqual(users.Inventory(),
                          mock_Inventory.return_value)
-        mock_Inventory.assert_called_with(users, states, config.getchildren())
+        mock_Inventory.assert_called_with(users, config.getchildren())
         lxml.etree.SubElement(orig_bundle, "POSIXGroup", name="test")
         self.assertXMLEqual(orig_bundle, bundle)
 
@@ -301,9 +300,8 @@ class TestPOSIXUsers(TestTool):
         entries = [lxml.etree.Element("POSIXUser", name="test"),
                    lxml.etree.Element("POSIXGroup", name="test"),
                    lxml.etree.Element("POSIXUser", name="test2")]
-        states = dict()
 
-        users.Install(entries, states)
+        states = users.Install(entries)
         self.assertItemsEqual(entries, states.keys())
         for state in states.values():
             self.assertEqual(state, users._install.return_value)
diff --git a/testsuite/Testsrc/Testlib/TestClient/TestTools/Test_init.py b/testsuite/Testsrc/Testlib/TestClient/TestTools/Test_init.py
index 6fdafa2ab..063257863 100644
--- a/testsuite/Testsrc/Testlib/TestClient/TestTools/Test_init.py
+++ b/testsuite/Testsrc/Testlib/TestClient/TestTools/Test_init.py
@@ -21,24 +21,23 @@ from common import *
 class TestTool(Bcfg2TestCase):
     test_obj = Tool
 
-    def get_obj(self, logger=None, setup=None, config=None):
+    def get_obj(self, setup=None, config=None):
         if config is None:
             config = lxml.etree.Element("Configuration")
-        if not logger:
-            def print_msg(msg):
-                print(msg)
-            logger = Mock()
-            logger.error = Mock(side_effect=print_msg)
-            logger.warning = Mock(side_effect=print_msg)
-            logger.info = Mock(side_effect=print_msg)
-            logger.debug = Mock(side_effect=print_msg)
         if not setup:
             setup = MagicMock()
         if 'command_timeout' not in setup:
             setup['command_timeout'] = None
+
         execs = self.test_obj.__execs__
         self.test_obj.__execs__ = []
-        rv = self.test_obj(logger, setup, config)
+
+        @patch("Bcfg2.Options.get_option_parser")
+        def inner(mock_option_parser):
+            mock_option_parser.return_value = setup
+            return self.test_obj(config)
+
+        rv = inner()
         self.test_obj.__execs__ = execs
         return rv
 
@@ -166,14 +165,12 @@ class TestTool(Bcfg2TestCase):
             self.assertItemsEqual(states, expected_states)
             self.assertEqual(t.extra, t.FindExtra.return_value)
 
-        actual_states = dict()
-        t.Inventory(actual_states, structures=[bundle1, bundle2])
+        actual_states = t.Inventory(structures=[bundle1, bundle2])
         perform_assertions(actual_states)
 
         reset()
-        actual_states = dict()
         t.config = config
-        t.Inventory(actual_states)
+        actual_states = t.Inventory()
         perform_assertions(actual_states)
 
     def test_Install(self):
@@ -199,9 +196,8 @@ class TestTool(Bcfg2TestCase):
         expected_states.update(dict([(e, t.InstallService.return_value)
                                      for e in entries if e.tag == "Service"]))
 
-        actual_states = dict()
         t.modified = []
-        t.Install(entries, actual_states)
+        actual_states = t.Install(entries)
         self.assertItemsEqual(t.InstallPath.call_args_list,
                               [call(e) for e in entries if e.tag == "Path"])
         self.assertItemsEqual(t.InstallPackage.call_args_list,
@@ -385,8 +381,7 @@ class TestPkgTool(TestTool):
         # test single-pass install success
         reset()
         pt.cmd.run.return_value = (0, '')
-        states = dict([(p, False) for p in packages])
-        pt.Install(packages, states)
+        states = pt.Install(packages)
         pt._get_package_command.assert_called_with(packages)
         pt.cmd.run.assert_called_with([p.get("name") for p in packages])
         self.assertItemsEqual(states,
@@ -406,8 +401,7 @@ class TestPkgTool(TestTool):
         pt.VerifyPackage.side_effect = lambda p, m: p.get("name") == "bar"
 
         pt.cmd.run.side_effect = run
-        states = dict([(p, False) for p in packages])
-        pt.Install(packages, states)
+        states = pt.Install(packages)
         pt._get_package_command.assert_any_call(packages)
         for pkg in packages:
             pt.VerifyPackage.assert_any_call(pkg, [])
@@ -592,8 +586,7 @@ class TestSvcTool(TestTool):
 
         # test in non-interactive mode
         reset()
-        states = dict()
-        st.BundleUpdated(bundle, states)
+        states = st.BundleUpdated(bundle)
         self.assertItemsEqual(st.handlesEntry.call_args_list,
                               [call(e) for e in entries])
         st.stop_service.assert_called_with(stop)
@@ -606,8 +599,7 @@ class TestSvcTool(TestTool):
         reset()
         mock_prompt.side_effect = lambda p: "interactive2" not in p
         st.setup['interactive'] = True
-        states = dict()
-        st.BundleUpdated(bundle, states)
+        states = st.BundleUpdated(bundle)
         self.assertItemsEqual(st.handlesEntry.call_args_list,
                               [call(e) for e in entries])
         st.stop_service.assert_called_with(stop)
@@ -621,8 +613,7 @@ class TestSvcTool(TestTool):
         reset()
         st.setup['interactive'] = False
         st.setup['servicemode'] = 'build'
-        states = dict()
-        st.BundleUpdated(bundle, states)
+        states = st.BundleUpdated(bundle)
         self.assertItemsEqual(st.handlesEntry.call_args_list,
                               [call(e) for e in entries])
         self.assertItemsEqual(st.stop_service.call_args_list,
@@ -638,10 +629,9 @@ class TestSvcTool(TestTool):
         services = install + [lxml.etree.Element("Service", type="test",
                                                  name="bar", install="false")]
         st = self.get_obj()
-        states = Mock()
-        self.assertEqual(st.Install(services, states),
+        self.assertEqual(st.Install(services),
                          mock_Install.return_value)
-        mock_Install.assert_called_with(st, install, states)
+        mock_Install.assert_called_with(st, install)
 
     def test_InstallService(self):
         st = self.get_obj()