Merge pull request #141 from johnduarte/beaker_tests

Add beaker tests to complete test plan

78 files changed, 3934 insertions, 0 deletions

diff --git a/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb b/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb
new file mode 100644
index 0000000..192c4f3
--- /dev/null
+++ b/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_http.rb
@@ -0,0 +1,65 @@
+test_name 'C3492 - checkout with basic auth (http protocol)'
+skip_test 'HTTP not supported yet for basic auth using git. See FM-1331'
+
+# Globals
+repo_name = 'testrepo_checkout'
+user      = 'foo'
+password  = 'bar'
+http_server_script = 'basic_auth_http_daemon.rb'
+
+hosts.each do |host|
+  ruby = '/opt/puppet/bin/ruby' if host.is_pe? || 'ruby'
+  gem = '/opt/puppet/bin/gem' if host.is_pe? || 'gem'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    script =<<-EOF
+    require 'sinatra'
+
+    set :bind, '0.0.0.0'
+    set :static, true
+    set :public_folder, '#{tmpdir}'
+
+
+    use Rack::Auth::Basic do |username, password|
+        username == '#{user}' && password == '#{password}'
+    end
+    EOF
+    create_remote_file(host, "#{tmpdir}/#{http_server_script}", script)
+    on(host, "#{gem} install sinatra")
+    on(host, "#{ruby} #{tmpdir}/#{http_server_script} &")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} #{tmpdir}/#{http_server_script}' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'checkout with puppet using basic auth' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:4567/testrepo.git",
+      provider => git,
+      basic_auth_username => '#{user}',
+      basic_auth_password => '#{password}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb b/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb
new file mode 100644
index 0000000..32e3ef4
--- /dev/null
+++ b/spec/acceptance/beaker/git/basic_auth/basic_auth_checkout_https.rb
@@ -0,0 +1,73 @@
+test_name 'C3493 - checkout with basic auth (https protocol)'
+skip_test 'waiting for CA trust solution'
+
+# Globals
+repo_name = 'testrepo_checkout'
+user      = 'foo'
+password  = 'bar'
+http_server_script = 'basic_auth_https_daemon.rb'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start https server' do
+    script =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+
+    authenticate = Proc.new do |req, res|
+      WEBrick::HTTPAuth.basic_auth(req, res, '') do |user, password|
+        user == '#{user}' && password == '#{password}'
+      end
+    end
+
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :DocumentRootOptions=> {:HandlerCallback => authenticate},
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, "#{tmpdir}/#{http_server_script}", script)
+    on(host, "#{ruby} #{tmpdir}/#{http_server_script}")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} #{tmpdir}/#{http_server_script}' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'checkout with puppet using basic auth' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8443/testrepo.git",
+      provider => git,
+      basic_auth_username => '#{user}',
+      basic_auth_password => '#{password}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb b/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb
new file mode 100644
index 0000000..60a4fc2
--- /dev/null
+++ b/spec/acceptance/beaker/git/basic_auth/negative/basic_auth_checkout_git.rb
@@ -0,0 +1,49 @@
+test_name 'C3494 - checkout with basic auth (git protocol)'
+
+# Globals
+repo_name = 'testrepo_checkout'
+user      = 'foo'
+password  = 'bar'
+http_server_script = 'basic_auth_http_daemon.rb'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+  end
+
+  step 'checkout with puppet using basic auth' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      basic_auth_username => '#{user}',
+      basic_auth_password => '#{password}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout (silent error for basic auth using git protocol)" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb
new file mode 100644
index 0000000..6ed945b
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file.rb
@@ -0,0 +1,44 @@
+test_name 'C3438 - checkout a branch (file protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb
new file mode 100644
index 0000000..441a2bc
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_file_path.rb
@@ -0,0 +1,44 @@
+test_name 'C3437 - checkout a branch (file path)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb
new file mode 100644
index 0000000..baeb5ec
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_git.rb
@@ -0,0 +1,49 @@
+test_name 'C3436 - checkout a branch (git protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb
new file mode 100644
index 0000000..6da34e8
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_http.rb
@@ -0,0 +1,57 @@
+test_name 'C3441 - checkout a branch (http protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb
new file mode 100644
index 0000000..6ebd9fd
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_https.rb
@@ -0,0 +1,64 @@
+test_name 'C3442 - checkout a branch (https protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb
new file mode 100644
index 0000000..0a4e07a
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_scp.rb
@@ -0,0 +1,54 @@
+test_name 'C3439 - checkout a branch (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb
new file mode 100644
index 0000000..ea9fb4a
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/branch_checkout_ssh.rb
@@ -0,0 +1,54 @@
+test_name 'C3440 - checkout a branch (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+branch = 'a_branch'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'checkout a branch with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{branch}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is on the #{branch} branch" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/#{branch}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb b/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb
new file mode 100644
index 0000000..f8c85d0
--- /dev/null
+++ b/spec/acceptance/beaker/git/branch_checkout/negative/branch_checkout_not_exists.rb
@@ -0,0 +1,43 @@
+test_name 'C3609 - checkout a branch that does not exist'
+
+# Globals
+repo_name = 'testrepo_branch_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout branch that does not exist with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => 'non_existent_branch',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify that master branch is checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('branch not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb b/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb
new file mode 100644
index 0000000..626d807
--- /dev/null
+++ b/spec/acceptance/beaker/git/clone/clone_over_different_exiting_repo_with_force.rb
@@ -0,0 +1,44 @@
+test_name 'C3511 - clone over an existing repo with force'
+
+# Globals
+repo_name = 'testrepo_already_exists'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+    on(host, "mkdir #{tmpdir}/#{repo_name}")
+    on(host, "cd #{tmpdir}/#{repo_name} && git init")
+    on(host, "cd #{tmpdir}/#{repo_name} && touch a && git add a && git commit -m 'a'")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone over existing repo with force using puppet' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      @existing_sha = res.stdout
+    end
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      force => true,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify new repo has replaced old one' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      fail_test('original repo not replaced by force') if res.stdout.include? "#{@existing_sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb b/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb
new file mode 100644
index 0000000..0a5a1a8
--- /dev/null
+++ b/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_in_repo.rb
@@ -0,0 +1,42 @@
+test_name 'C3507 - clone repo with excludes in repo'
+
+# Globals
+repo_name = 'testrepo_with_excludes_in_repo'
+exclude1 = 'file1.txt'
+exclude2 ='file2.txt'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone repo with excludes in repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      excludes => [ '#{exclude1}', '#{exclude2}' ],
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify exludes are known to git' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/info/exclude") do |res|
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude1}"
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude2}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb b/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb
new file mode 100644
index 0000000..c533aa5
--- /dev/null
+++ b/spec/acceptance/beaker/git/clone/clone_repo_with_excludes_not_in_repo.rb
@@ -0,0 +1,42 @@
+test_name 'C3508 - clone repo with excludes not in repo'
+
+# Globals
+repo_name = 'testrepo_with_excludes_not_in_repo'
+exclude1 = 'worh02o'
+exclude2 ='ho398b'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone repo with excludes not in repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      excludes => [ '#{exclude1}', '#{exclude2}' ],
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify exludes are known to git' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/info/exclude") do |res|
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude1}"
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude2}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb b/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb
new file mode 100644
index 0000000..67fea06
--- /dev/null
+++ b/spec/acceptance/beaker/git/clone/negative/clone_over_different_exiting_repo.rb
@@ -0,0 +1,43 @@
+test_name 'C3482 - clone over an existing repo'
+
+# Globals
+repo_name = 'testrepo_already_exists'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+    on(host, "mkdir #{tmpdir}/#{repo_name}")
+    on(host, "cd #{tmpdir}/#{repo_name} && git init")
+    on(host, "cd #{tmpdir}/#{repo_name} && touch a && git add a && git commit -m 'a'")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone over existing repo using puppet' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      @existing_sha = res.stdout
+    end
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify original repo was not replaced' do
+    on(host, "cd #{tmpdir}/#{repo_name} && git log --pretty=format:\"%h\"") do |res|
+      fail_test('original repo was replaced without force') unless res.stdout.include? "#{@existing_sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb b/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb
new file mode 100644
index 0000000..b994a6a
--- /dev/null
+++ b/spec/acceptance/beaker/git/clone/negative/clone_repo_with_exec_excludes.rb
@@ -0,0 +1,41 @@
+test_name 'C3509 - clone repo with excludes not in repo'
+skip_test 'expectations not defined'
+
+# Globals
+repo_name = 'testrepo_with_excludes_not_in_repo'
+exclude1 = "`exec \"rm -rf /tmp\"`"
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'clone repo with excludes not in repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      excludes => [ '#{exclude1}' ],
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify excludes are known to git' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/info/exclude") do |res|
+      fail_test('exclude not found') unless res.stdout.include? "#{exclude1}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_0_checkout.rb b/spec/acceptance/beaker/git/compression/compression_0_checkout.rb
new file mode 100644
index 0000000..ee5a171
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_0_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3495 - checkout with compression 0'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 0 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 0,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_1_checkout.rb b/spec/acceptance/beaker/git/compression/compression_1_checkout.rb
new file mode 100644
index 0000000..01478a1
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_1_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3496 - checkout with compression 1'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 1 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_2_checkout.rb b/spec/acceptance/beaker/git/compression/compression_2_checkout.rb
new file mode 100644
index 0000000..b3413ea
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_2_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3497 - checkout with compression 2'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 2 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 2,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_3_checkout.rb b/spec/acceptance/beaker/git/compression/compression_3_checkout.rb
new file mode 100644
index 0000000..b8459a5
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_3_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3498 - checkout with compression 3'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 3 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 3,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_4_checkout.rb b/spec/acceptance/beaker/git/compression/compression_4_checkout.rb
new file mode 100644
index 0000000..f6fb5ec
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_4_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3499 - checkout with compression 4'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 4 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 4,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_5_checkout.rb b/spec/acceptance/beaker/git/compression/compression_5_checkout.rb
new file mode 100644
index 0000000..a09507c
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_5_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3500 - checkout with compression 5'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 5 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 5,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/compression_6_checkout.rb b/spec/acceptance/beaker/git/compression/compression_6_checkout.rb
new file mode 100644
index 0000000..0a2d5d5
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/compression_6_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3501 - checkout with compression 6'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 6 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 6,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb b/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb
new file mode 100644
index 0000000..a6be973
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/negative/compression_7_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3503 - checkout with compression 7'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 7 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 7,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb b/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb
new file mode 100644
index 0000000..8acdb57
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/negative/compression_alpha_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3505 - checkout with compression alpha'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression alpha with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => abcde,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb b/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb
new file mode 100644
index 0000000..5597646
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/negative/compression_eval_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3504 - checkout with compression 10-5'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression 10-5 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => 10-5,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb b/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb
new file mode 100644
index 0000000..c85818d
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/negative/compression_exec_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3506 - checkout with compression exec'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression exec with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => "exec 'rm -rf /tmp'",
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb b/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb
new file mode 100644
index 0000000..b89f6f6
--- /dev/null
+++ b/spec/acceptance/beaker/git/compression/negative/compression_negative_checkout.rb
@@ -0,0 +1,39 @@
+test_name 'C3502 - checkout with compression -1'
+
+# Globals
+repo_name = 'testrepo_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout with compression -1 with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      compression => -1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify git repo was checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb b/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb
new file mode 100644
index 0000000..663c758
--- /dev/null
+++ b/spec/acceptance/beaker/git/create/create_bare_repo_that_already_exists.rb
@@ -0,0 +1,35 @@
+test_name 'C3472 - create bare repo that already exists'
+
+# Globals
+repo_name = 'testrepo_bare_repo_already_exists.git'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create bare repo' do
+    install_package(host, 'git')
+    on(host, "mkdir #{tmpdir}/#{repo_name}")
+    on(host, "cd #{tmpdir}/#{repo_name} && git --bare init")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'create bare repo that already exists using puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => bare,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify repo does not contain .git directory' do
+    on(host, "ls -al #{tmpdir}/#{repo_name}") do |res|
+      fail_test "found .git for #{repo_name}" if res.stdout.include? ".git"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb b/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb
new file mode 100644
index 0000000..b1cdeae
--- /dev/null
+++ b/spec/acceptance/beaker/git/create/create_repo_that_already_exists.rb
@@ -0,0 +1,37 @@
+test_name 'C3470 - create repo that already exists'
+
+# Globals
+repo_name = 'testrepo_already_exists'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+    on(host, "cd #{tmpdir} && git clone file://#{tmpdir}/testrepo.git #{repo_name}")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'create repo that already exists using puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify repo is on master branch' do
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      assert_match(/ref: refs\/heads\/master/, stdout, "Git checkout not on master on #{host}")
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb b/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb
new file mode 100644
index 0000000..6cd4f72
--- /dev/null
+++ b/spec/acceptance/beaker/git/create/negative/create_bare_repo_specifying_revision.rb
@@ -0,0 +1,34 @@
+test_name 'C3473 - create bare repo specifying revision'
+
+# Globals
+repo_name = 'testrepo_bare.git'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup' do
+    install_package(host, 'git')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'create bare repo specifying revision using puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => bare,
+      revision => master,
+      provider => git,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify repo does not contain .git directory' do
+    on(host, "ls -al #{tmpdir}/#{repo_name}") do |res|
+      fail_test "found .git for #{repo_name}" if res.stdout.include? ".git"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb
new file mode 100644
index 0000000..6913bd5
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_file.rb
@@ -0,0 +1,49 @@
+test_name 'C3487 - checkout as a group (file protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb
new file mode 100644
index 0000000..6701dda
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_file_path.rb
@@ -0,0 +1,49 @@
+test_name 'C3486 - checkout as a group (file path)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb
new file mode 100644
index 0000000..31ef286
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_git.rb
@@ -0,0 +1,54 @@
+test_name 'C3485 - checkout as a group (git protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb
new file mode 100644
index 0000000..0c86c77
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_http.rb
@@ -0,0 +1,62 @@
+test_name 'C3490 - checkout as a group (http protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb
new file mode 100644
index 0000000..0bcbd97
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_https.rb
@@ -0,0 +1,69 @@
+test_name 'C3491 - checkout as a group (https protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb
new file mode 100644
index 0000000..d8f5bb5
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_scp.rb
@@ -0,0 +1,59 @@
+test_name 'C3488 - checkout as a group (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout as a group with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb b/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb
new file mode 100644
index 0000000..1255864
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/group_checkout_ssh.rb
@@ -0,0 +1,59 @@
+test_name 'C3489 - checkout as a group (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is own by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') unless res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb b/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb
new file mode 100644
index 0000000..5bce264
--- /dev/null
+++ b/spec/acceptance/beaker/git/group_checkout/negative/group_checkout_file_non_existent_group.rb
@@ -0,0 +1,48 @@
+test_name 'C3484 - checkout as a group that is not on system'
+
+# Globals
+repo_name = 'testrepo_group_checkout'
+group = 'mygroup'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - delete group' do
+    apply_manifest_on(host, "group { '#{group}': ensure => absent, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout as a group with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      group => '#{group}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is NOT owned by group #{group}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by group') if res.stdout.include? ":#{group}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb b/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb
new file mode 100644
index 0000000..d1ee531
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/negative/revision_checkout_not_exists.rb
@@ -0,0 +1,43 @@
+test_name 'C3614 - checkout a revision that does not exist'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout revision that does not exist with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '11111111111111111',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify that master revision is checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb
new file mode 100644
index 0000000..8ca10bd
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file.rb
@@ -0,0 +1,49 @@
+test_name 'C3452 - checkout a revision (file protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify repo is checked out to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb
new file mode 100644
index 0000000..2410e2e
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_file_path.rb
@@ -0,0 +1,49 @@
+test_name 'C3451 - checkout a revision (file path)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify repo is checked out to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb
new file mode 100644
index 0000000..3fa6cbd
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_git.rb
@@ -0,0 +1,54 @@
+test_name 'C3450 - checkout a revision (git protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb
new file mode 100644
index 0000000..9755d8e
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_http.rb
@@ -0,0 +1,62 @@
+test_name 'C3455 - checkout a revision (http protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb
new file mode 100644
index 0000000..16b5145
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_https.rb
@@ -0,0 +1,70 @@
+test_name 'C3456 - checkout a revision (https protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git clone https://github.com/johnduarte/testrepo.git #{tmpdir}/foo")
+    on(host, "git --git-dir=#{tmpdir}/foo/.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb
new file mode 100644
index 0000000..c920fb4
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_scp.rb
@@ -0,0 +1,59 @@
+test_name 'C3453 - checkout a revision (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb
new file mode 100644
index 0000000..24b507e
--- /dev/null
+++ b/spec/acceptance/beaker/git/revision_checkout/revision_checkout_ssh.rb
@@ -0,0 +1,59 @@
+test_name 'C3454 - checkout a revision (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_revision_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'get revision sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a revision with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{@sha}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout is set to revision #{@sha}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('revision not found') unless res.stdout.include? "#{@sha}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb
new file mode 100644
index 0000000..caef5a6
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_exec_depth.rb
@@ -0,0 +1,39 @@
+test_name 'C3608 - shallow clone repo depth hostile input'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (bad input ignored, full clone checkedout)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => "exec 'rm -rf /tmp'",
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb
new file mode 100644
index 0000000..c336842
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_file_path.rb
@@ -0,0 +1,40 @@
+test_name 'C3475 - shallow clone repo minimal depth = 1 (file path protocol)'
+skip_test 'Not currently supported. See FM-1285'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'git does not support shallow clone via file path: verify checkout is NOT created' do
+    on(host, "ls #{tmpdir}") do |res|
+      fail_test('checkout found') if res.stdout.include? "#{repo_name}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb
new file mode 100644
index 0000000..ecd51ad
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_http.rb
@@ -0,0 +1,52 @@
+test_name 'C3479 - shallow clone repo minimal depth = 1 (http protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'ps ax | grep "#{ruby} /tmp/http_daemon.rb" | grep -v grep | awk \'{print "kill -9 " $1}\' | sh')
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'git does not support shallow clone via HTTP: verify checkout is NOT created' do
+    on(host, "ls #{tmpdir}") do |res|
+      fail_test('checkout found') if res.stdout.include? "#{repo_name}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb
new file mode 100644
index 0000000..2ba1f0f
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_negative_depth.rb
@@ -0,0 +1,39 @@
+test_name 'C3607 - shallow clone repo depth = -1'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (bad input ignored, full clone checkedout)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => -1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb
new file mode 100644
index 0000000..55ff878
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/negative/shallow_clone_overflow_depth.rb
@@ -0,0 +1,39 @@
+test_name 'C3606 - shallow clone repo depth overflow 64bit integer'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (bad input ignored, full clone checkedout)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 18446744073709551616,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb
new file mode 100644
index 0000000..52eb3d2
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_file.rb
@@ -0,0 +1,43 @@
+test_name 'C3476 - shallow clone repo minimal depth = 1 (file protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "2 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb
new file mode 100644
index 0000000..d7c81fb
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_git.rb
@@ -0,0 +1,48 @@
+test_name 'C3474 - shallow clone repo minimal depth = 1 (git protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "2 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb
new file mode 100644
index 0000000..9220e27
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_https.rb
@@ -0,0 +1,64 @@
+test_name 'C3480 - shallow clone repo minimal depth = 1 (https protocol)'
+skip_test 'Not currently supported. See FM-1286'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'ps ax | grep "#{ruby} /tmp/https_daemon.rb" | grep -v grep | awk \'{print "kill -9 " $1}\' | sh')
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "2 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb
new file mode 100644
index 0000000..6837802
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_scp.rb
@@ -0,0 +1,53 @@
+test_name 'C3478 - shallow clone repo minimal depth = 1 (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'shallow clone repo with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "2 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb
new file mode 100644
index 0000000..fda9bf4
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_ssh.rb
@@ -0,0 +1,53 @@
+test_name 'C3477 - shallow clone repo minimal depth = 1 (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'shallow clone repo with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 1,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is shallow and of the correct depth' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "shallow"
+    end
+
+    on(host, "wc -l #{tmpdir}/#{repo_name}/.git/shallow") do |res|
+      fail_test('shallow not found') unless res.stdout.include? "2 #{tmpdir}/#{repo_name}/.git/shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb
new file mode 100644
index 0000000..6cec2a1
--- /dev/null
+++ b/spec/acceptance/beaker/git/shallow_clone/shallow_clone_zero_depth.rb
@@ -0,0 +1,39 @@
+test_name 'C3404 - shallow clone repo depth = 0 non shallow'
+
+# Globals
+repo_name = 'testrepo_shallow_clone'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'shallow clone repo with puppet (zero depth means not shallow)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      depth => 0,
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify checkout is NOT shallow' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('shallow found') if res.stdout.include? "shallow"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb b/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb
new file mode 100644
index 0000000..5869513
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/negative/tag_checkout_not_exists.rb
@@ -0,0 +1,43 @@
+test_name 'C3612 - checkout a tag that does not exist'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout tag that does not exist with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      tag => '11111111111111111',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step 'verify that master tag is checked out' do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "cat #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "ref: refs/heads/master"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb
new file mode 100644
index 0000000..4ab8a6a
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file.rb
@@ -0,0 +1,44 @@
+test_name 'C3445 - checkout a tag (file protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb
new file mode 100644
index 0000000..f73d4f9
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_file_path.rb
@@ -0,0 +1,44 @@
+test_name 'C3444 - checkout a tag (file path)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb
new file mode 100644
index 0000000..45a737e
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_git.rb
@@ -0,0 +1,55 @@
+test_name 'C3443 - checkout a tag (git protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb
new file mode 100644
index 0000000..cff6071
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_http.rb
@@ -0,0 +1,63 @@
+test_name 'C3448 - checkout a tag (http protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb
new file mode 100644
index 0000000..1e3cc51
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_https.rb
@@ -0,0 +1,70 @@
+test_name 'C3449 - checkout a tag (https protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb
new file mode 100644
index 0000000..d602689
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_scp.rb
@@ -0,0 +1,60 @@
+test_name 'C3446 - checkout a tag (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb
new file mode 100644
index 0000000..f57f605
--- /dev/null
+++ b/spec/acceptance/beaker/git/tag_checkout/tag_checkout_ssh.rb
@@ -0,0 +1,60 @@
+test_name 'C3447 - checkout a tag (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_tag_checkout'
+tag = '0.0.2'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+  end
+
+  step 'get tag sha from repo' do
+    on(host, "git --git-dir=#{tmpdir}/testrepo.git rev-list HEAD | tail -1") do |res|
+      @sha = res.stdout.chomp
+    end
+  end
+
+  step 'checkout a tag with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      revision => '#{tag}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify checkout out tag is #{tag}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host,"git --git-dir=#{tmpdir}/#{repo_name}/.git name-rev HEAD") do |res|
+      fail_test('tag not found') unless res.stdout.include? "#{tag}"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb b/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb
new file mode 100644
index 0000000..98099ee
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/negative/user_checkout_file_non_existent_user.rb
@@ -0,0 +1,48 @@
+test_name 'C3483 - checkout as a user that is not on system'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - delete user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is NOT owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') if res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb
new file mode 100644
index 0000000..9920b0b
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_file.rb
@@ -0,0 +1,49 @@
+test_name 'C3459 - checkout as a user (file protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "file://#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb
new file mode 100644
index 0000000..1817229
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_file_path.rb
@@ -0,0 +1,49 @@
+test_name 'C3458 - checkout as a user (file path)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb
new file mode 100644
index 0000000..d7504b0
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_git.rb
@@ -0,0 +1,54 @@
+test_name 'C3457 - checkout as a user (git protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start git daemon' do
+    install_package(host, 'git-daemon')
+    on(host, "git daemon --base-path=#{tmpdir}  --export-all --reuseaddr --verbose --detach")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, 'pkill -9 git-daemon')
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "git://#{host}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb
new file mode 100644
index 0000000..07f5c1c
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_http.rb
@@ -0,0 +1,62 @@
+test_name 'C3462 - checkout as a user (http protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+
+  step 'setup - start http server' do
+    http_daemon =<<-EOF
+    require 'webrick'
+    server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/http_daemon.rb', http_daemon)
+    on(host, "#{ruby} /tmp/http_daemon.rb")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/http_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "http://#{host}:8000/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb
new file mode 100644
index 0000000..7187586
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_https.rb
@@ -0,0 +1,69 @@
+test_name 'C3463 - checkout as a user (https protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  ruby = (host.is_pe? && '/opt/puppet/bin/ruby') || 'ruby'
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - start https server' do
+    https_daemon =<<-EOF
+    require 'webrick'
+    require 'webrick/https'
+    server = WEBrick::HTTPServer.new(
+    :Port               => 8443,
+    :DocumentRoot       => "#{tmpdir}",
+    :SSLEnable          => true,
+    :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+    :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+    :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+    :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+    WEBrick::Daemon.start
+    server.start
+    EOF
+    create_remote_file(host, '/tmp/https_daemon.rb', https_daemon)
+    #on(host, "#{ruby} /tmp/https_daemon.rb")
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    on(host, "ps ax | grep '#{ruby} /tmp/https_daemon.rb' | grep -v grep | awk '{print \"kill -9 \" $1}' | sh")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "https://github.com/johnduarte/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb
new file mode 100644
index 0000000..a4f7261
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_scp.rb
@@ -0,0 +1,59 @@
+test_name 'C3460 - checkout as a user (ssh protocol, scp syntax)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout as a user with puppet (scp syntax)' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "root@#{host}:#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb b/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb
new file mode 100644
index 0000000..50c73f4
--- /dev/null
+++ b/spec/acceptance/beaker/git/user_checkout/user_checkout_ssh.rb
@@ -0,0 +1,59 @@
+test_name 'C3461 - checkout as a user (ssh protocol)'
+
+# Globals
+repo_name = 'testrepo_user_checkout'
+user = 'myuser'
+
+hosts.each do |host|
+  tmpdir = host.tmpdir('vcsrepo')
+  step 'setup - create repo' do
+    install_package(host, 'git')
+    my_root = File.expand_path(File.join(File.dirname(__FILE__), '../../../..'))
+    scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+    on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+  end
+  step 'setup - establish ssh keys' do
+    # create ssh keys
+    on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+    # copy public key to authorized_keys
+    on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+    on(host, 'chown -R root:root /root/.ssh')
+  end
+
+  step 'setup - create user' do
+    apply_manifest_on(host, "user { '#{user}': ensure => present, }")
+  end
+
+  teardown do
+    on(host, "rm -fr #{tmpdir}")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+    apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+    apply_manifest_on(host, "user { '#{user}': ensure => absent, }")
+  end
+
+  step 'checkout as a user with puppet' do
+    pp = <<-EOS
+    vcsrepo { "#{tmpdir}/#{repo_name}":
+      ensure => present,
+      source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+      provider => git,
+      owner => '#{user}',
+    }
+    EOS
+
+    apply_manifest_on(host, pp)
+    apply_manifest_on(host, pp)
+  end
+
+  step "verify git checkout is owned by user #{user}" do
+    on(host, "ls #{tmpdir}/#{repo_name}/.git/") do |res|
+      fail_test('checkout not found') unless res.stdout.include? "HEAD"
+    end
+
+    on(host, "stat --format '%U:%G' #{tmpdir}/#{repo_name}/.git/HEAD") do |res|
+      fail_test('checkout not owned by user') unless res.stdout.include? "#{user}:"
+    end
+  end
+
+end
diff --git a/spec/acceptance/files/create_git_repo.sh b/spec/acceptance/files/create_git_repo.sh
index 03c4f44..40f341a 100755
--- a/spec/acceptance/files/create_git_repo.sh
+++ b/spec/acceptance/files/create_git_repo.sh
@@ -34,3 +34,6 @@ cd ..
 git --git-dir=testrepo/.git config core.bare true
 cp -r testrepo/.git testrepo.git
 rm -rf testrepo
+cd testrepo.git
+touch git-daemon-export-ok
+git update-server-info
diff --git a/spec/acceptance/files/server.crt b/spec/acceptance/files/server.crt
new file mode 100644
index 0000000..ef1de5a
--- /dev/null
+++ b/spec/acceptance/files/server.crt
@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIICATCCAWoCCQCS3fQotV10LzANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQGEwJB
+VTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0
+cyBQdHkgTHRkMB4XDTE0MDQyMzIyMzEyM1oXDTE1MDQyMzIyMzEyM1owRTELMAkG
+A1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0
+IFdpZGdpdHMgUHR5IEx0ZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAyRTv
+uX6328aQ5Auc8PI+xNaCiE0UZNYcs+xq3AEkR/Tnz0HGXdx3+PnFG7MIRSS65hXA
+VGenZk3wP4vNIe9gu+G9jtOFTJOgoOBUnJ/Hcs79Zgcmz3cAWQpqww+CZpyngUDS
+msZ5HoEbNS+qaIron3IrYCgPsy1BHFs5ze7JrtcCAwEAATANBgkqhkiG9w0BAQUF
+AAOBgQA2uLvdc1cf+nt7d8Lmu0SdaoIsCzh6DjVscCpFJKXdDjGT2Ys40iKbLRnY
+Tt98wa6uRzEhSKfx+zVi8n3PSkQHlER7jzKFXMVx8NEt2/O/APKXVizmLFjk5WcT
+FvGmmbkqX+Nj9TUTuSRZEmF776r5k8U5ABu/VarxvAzyoXAhqA==
+-----END CERTIFICATE-----
diff --git a/spec/acceptance/files/server.key b/spec/acceptance/files/server.key
new file mode 100644
index 0000000..b594f13
--- /dev/null
+++ b/spec/acceptance/files/server.key
@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDJFO+5frfbxpDkC5zw8j7E1oKITRRk1hyz7GrcASRH9OfPQcZd
+3Hf4+cUbswhFJLrmFcBUZ6dmTfA/i80h72C74b2O04VMk6Cg4FScn8dyzv1mBybP
+dwBZCmrDD4JmnKeBQNKaxnkegRs1L6poiuifcitgKA+zLUEcWznN7smu1wIDAQAB
+AoGAQPnD8OOyk5DZVuctwmn0wHQ0X8jQczkAs18MtKSlzZ6knUM6zy+jkM9c0vOK
+E5Wn0xtqN5v66sL6g/4vvex1DA5Q6YsXvZ48VpVliZXXK/1pdTv0qwMyHdlBhmgJ
+MhnZbyNy61QHdOTsWDR1YrELpDyFMJ9cZZD0NOnsuhd2DbECQQDq7W/zlJBZPWNR
+ab2dP+HLpm/PiEBT13SuEEskh3GEEfZlwz/cGu0Z8DHA4E3Z60KFjwgnc92GNFMg
+m0t3hHtpAkEA2x5PsDxBk9sWwdIvu57vjQLdotvAfyb+W9puIaZS1JRSVLTsUVEj
+Y0KxgsPHtcjrVoN//zGymn4ePxWOzlrQPwJBAN5thEuZY7o6dyiD9zVFYKGSqdZS
+aKV5H04Wuy6Q1pd28lWTMYlSLR8b3d+B//PN3SPbMps4BoukSvhaUG+OjdECQFzF
+KZIBAPa7pJftCH6UHPIDy5ifF5H+DWUQRt6CT8FnBrCMZR1MkAH/g65Me6pwZYsc
+Y73E6cxVJzMoSmz9r/sCQQCOhPflFCxZ23ocsuRBo9O/mMUDaLoHZXWuJ2DqAUN2
+mS6UUR/lpyc7Cmy0VOyhS8783D7MUfji5ddfVxb5tWgm
+-----END RSA PRIVATE KEY-----
diff --git a/spec/acceptance/git_clone_protocols_spec.rb b/spec/acceptance/git_clone_protocols_spec.rb
new file mode 100644
index 0000000..4d9129e
--- /dev/null
+++ b/spec/acceptance/git_clone_protocols_spec.rb
@@ -0,0 +1,230 @@
+require 'spec_helper_acceptance'
+
+hosts.each do |host|
+
+  describe 'clones a repo with git' do
+    tmpdir =  host.tmpdir('vcsrepo')
+
+    before(:all) do
+      # {{{ setup
+      apply_manifest_on(host, "user{'testuser': ensure => present, managehome => true }")
+      apply_manifest_on(host, "user{'vagrant': ensure => present, }")
+      # install git
+      install_package(host, 'git')
+      install_package(host, 'git-daemon')
+      # create ssh keys
+      on(host, 'mkdir -p /home/testuser/.ssh')
+      on(host, 'ssh-keygen -q -t rsa -f /root/.ssh/id_rsa -N ""')
+
+      # copy public key to authorized_keys
+      on(host, 'cat /root/.ssh/id_rsa.pub >> /home/testuser/.ssh/authorized_keys')
+      on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /home/testuser/.ssh/config')
+      on(host, 'echo -e "Host *\n\tStrictHostKeyChecking no\n" >> /root/.ssh/config')
+      on(host, 'chown -R testuser:testuser /home/testuser/.ssh')
+      on(host, 'chown -R root:root /root/.ssh')
+
+      # create git repo
+      my_root = File.expand_path(File.join(File.dirname(__FILE__), '..'))
+      scp_to(host, "#{my_root}/acceptance/files/create_git_repo.sh", tmpdir)
+      on(host, "cd #{tmpdir} && ./create_git_repo.sh")
+
+      # copy ssl keys
+      scp_to(host, "#{my_root}/acceptance/files/server.crt", tmpdir)
+      scp_to(host, "#{my_root}/acceptance/files/server.key", tmpdir)
+      # }}}
+    end
+
+    after(:all) do
+      # {{{ teardown
+      apply_manifest_on(host, "user{'testuser': ensure => absent, managehome => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa': ensure => absent, force => true }")
+      apply_manifest_on(host, "file{'/root/.ssh/id_rsa.pub': ensure => absent, force => true }")
+      # }}}
+    end
+
+
+    #---------------  TESTS ----------------------#
+
+    context 'using local protocol (file URL)' do
+      before(:all) do
+        apply_manifest_on(host, "file {'#{tmpdir}/testrepo': ensure => directory, purge => true, recurse => true, recurselimit => 1, force => true; }")
+      end
+
+      it 'should have HEAD pointing to master' do
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo":
+          ensure => present,
+          provider => git,
+          source => "file://#{tmpdir}/testrepo.git",
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest_on(host, pp, :catch_failures => true)
+        apply_manifest_on(host, pp, :catch_changes => true)
+      end
+
+      describe file("#{tmpdir}/testrepo/.git/HEAD") do
+        it { should contain 'ref: refs/heads/master' }
+      end
+
+    end
+
+    context 'using local protocol (file path)' do
+      before(:all) do
+        apply_manifest_on(host, "file {'#{tmpdir}/testrepo': ensure => directory, purge => true, recurse => true, recurselimit => 1, force => true; }")
+      end
+
+      it 'should have HEAD pointing to master' do
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo":
+          ensure => present,
+          provider => git,
+          source => "#{tmpdir}/testrepo.git",
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest_on(host, pp, :catch_failures => true)
+        apply_manifest_on(host, pp, :catch_changes => true)
+      end
+
+      describe file("#{tmpdir}/testrepo/.git/HEAD") do
+        it { should contain 'ref: refs/heads/master' }
+      end
+
+    end
+
+    context 'using git protocol' do
+      before(:all) do
+        apply_manifest_on(host, "file {'#{tmpdir}/testrepo': ensure => directory, purge => true, recurse => true, recurselimit => 1, force => true; }")
+        on(host, "nohup git daemon  --detach --base-path=/#{tmpdir}")
+      end
+
+      it 'should have HEAD pointing to master' do
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo":
+          ensure => present,
+          provider => git,
+          source => "git://#{host}/testrepo.git",
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest_on(host, pp, :catch_failures => true)
+        apply_manifest_on(host, pp, :catch_changes => true)
+      end
+      describe file("#{tmpdir}/testrepo/.git/HEAD") do
+        it { should contain 'ref: refs/heads/master' }
+      end
+
+      after(:all) do
+        on(host, 'pkill -9 git')
+      end
+    end
+
+    context 'using http protocol' do
+      before(:all) do
+        apply_manifest_on(host, "file {'#{tmpdir}/testrepo': ensure => directory, purge => true, recurse => true, recurselimit => 1, force => true; }")
+        daemon =<<-EOF
+        require 'webrick'
+        server = WEBrick::HTTPServer.new(:Port => 8000, :DocumentRoot => "#{tmpdir}")
+        WEBrick::Daemon.start
+        server.start
+        EOF
+        create_remote_file(host, '/tmp/daemon.rb', daemon)
+        on(host, "ruby /tmp/daemon.rb")
+      end
+
+      it 'should have HEAD pointing to master' do
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo":
+          ensure => present,
+          provider => git,
+          source => "http://#{host}:8000/testrepo.git",
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest_on(host, pp, :catch_failures => true)
+        apply_manifest_on(host, pp, :catch_changes => true)
+      end
+      describe file("#{tmpdir}/testrepo/.git/HEAD") do
+        it { should contain 'ref: refs/heads/master' }
+      end
+
+      after(:all) do
+        on(host, 'pkill -9 ruby')
+      end
+    end
+
+    context 'using https protocol' do
+      before(:all) do
+        apply_manifest_on(host, "file {'#{tmpdir}/testrepo': ensure => directory, purge => true, recurse => true, recurselimit => 1, force => true; }")
+        daemon =<<-EOF
+        require 'webrick'
+        require 'webrick/https'
+        server = WEBrick::HTTPServer.new(
+        :Port               => 8443,
+        :DocumentRoot       => "#{tmpdir}",
+        :SSLEnable          => true,
+        :SSLVerifyClient    => OpenSSL::SSL::VERIFY_NONE,
+        :SSLCertificate     => OpenSSL::X509::Certificate.new(  File.open("#{tmpdir}/server.crt").read),
+        :SSLPrivateKey      => OpenSSL::PKey::RSA.new(          File.open("#{tmpdir}/server.key").read),
+        :SSLCertName        => [ [ "CN",WEBrick::Utils::getservername ] ])
+        WEBrick::Daemon.start
+        server.start
+        EOF
+        create_remote_file(host, '/tmp/daemon.rb', daemon)
+        on(host, "ruby /tmp/daemon.rb")
+      end
+
+      it 'should have HEAD pointing to master' do
+        # howto whitelist ssl cert
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo":
+          ensure => present,
+          provider => git,
+          source => "https://#{host}:8443/testrepo.git",
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest_on(host, pp, :catch_failures => true)
+        apply_manifest_on(host, pp, :catch_changes => true)
+      end
+
+      describe file("#{tmpdir}/testrepo/.git/HEAD") do
+        it { should contain 'ref: refs/heads/master' }
+      end
+
+      after(:all) do
+        on(host, 'pkill -9 ruby')
+      end
+    end
+
+    context 'using ssh protocol' do
+      before(:all) do
+        apply_manifest_on(host, "file {'#{tmpdir}/testrepo': ensure => directory, purge => true, recurse => true, recurselimit => 1, force => true; }")
+      end
+      it 'should have HEAD pointing to master' do
+        pp = <<-EOS
+        vcsrepo { "#{tmpdir}/testrepo":
+          ensure => present,
+          provider => git,
+          source => "ssh://root@#{host}#{tmpdir}/testrepo.git",
+        }
+        EOS
+
+        # Run it twice and test for idempotency
+        apply_manifest_on(host, pp, :catch_failures => true)
+        apply_manifest_on(host, pp, :catch_changes => true)
+      end
+
+      describe file("#{tmpdir}/testrepo/.git/HEAD") do
+        it { should contain 'ref: refs/heads/master' }
+      end
+    end
+
+  end
+end