Merge branch 'maint'

Conflicts:
	src/lib/Bcfg2/Server/Admin/Compare.py
	src/lib/Bcfg2/Server/Admin/Snapshots.py
	src/lib/Bcfg2/Server/MultiprocessingCore.py
	src/lib/Bcfg2/Server/Plugins/Probes.py
	src/sbin/bcfg2-crypt
	src/sbin/bcfg2-reports
	tools/upgrade/1.3/migrate_configs.py
	tools/upgrade/1.3/migrate_perms_to_mode.py

24 files changed, 150 insertions, 70 deletions

diff --git a/debian/changelog b/debian/changelog
index 5da9d27aa..7f6e2f637 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+bcfg2 (1.3.3-0.0) unstable; urgency=low
+
+  * New upstream release
+
+ -- Sol Jerome <sol.jerome@gmail.com>  Thu, 07 Nov 2013 08:09:57 -0600
+
 bcfg2 (1.3.2-0.0) unstable; urgency=low
 
   * New upstream release
diff --git a/doc/conf.py b/doc/conf.py
index d1bb029d2..0e4009cd3 100644
--- a/doc/conf.py
+++ b/doc/conf.py
@@ -66,7 +66,7 @@ else:
 # The short X.Y version.
 version = '1.3'
 # The full version, including alpha/beta/rc tags.
-release = '1.3.2'
+release = '1.3.3'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.
diff --git a/doc/contents.txt b/doc/contents.txt
index 8af0d808a..8220d0d1d 100644
--- a/doc/contents.txt
+++ b/doc/contents.txt
@@ -7,7 +7,7 @@ Bcfg2 documentation |release|
 =============================
 
 .. toctree::
-   :maxdepth: 2
+   :maxdepth: 3
 
    introduction/index
    installation/index
diff --git a/misc/bcfg2-selinux.spec b/misc/bcfg2-selinux.spec
index fa70d2c42..d694783b5 100644
--- a/misc/bcfg2-selinux.spec
+++ b/misc/bcfg2-selinux.spec
@@ -7,9 +7,17 @@
 %global selinux_types %(%{__awk} '/^#[[:space:]]*SELINUXTYPE=/,/^[^#]/ { if ($3 == "-") printf "%s ", $2 }' /etc/selinux/config 2>/dev/null)
 %global selinux_variants %([ -z "%{selinux_types}" ] && echo mls strict targeted || echo %{selinux_types})
 
+# For -pre or -rc releases, remove the initial <hash><percent>
+# characters from the appropriate line below.
+#
+# Don't forget to change the Release: tag below to something like 0.1
+#%%global _rc 1
+#%%global _pre 2
+%global _pre_rc %{?_pre:.pre%{_pre}}%{?_rc:.rc%{_rc}}
+
 Name:             bcfg2-selinux
-Version:          1.3.2
-Release:          1
+Version:          1.3.3
+Release:          1%{?_pre_rc}%{?dist}
 Summary:          Bcfg2 Client and Server SELinux policy
 
 %if 0%{?suse_version}
@@ -65,7 +73,7 @@ deployment strategies.
 This package includes the Bcfg2 server and client SELinux policy.
 
 %prep
-%setup -q -n %{name}-%{version}
+%setup -q -n %{name}-%{version}%{?_pre_rc}
 
 %build
 cd redhat/selinux
@@ -120,6 +128,9 @@ if [ $1 -eq 0 ] ; then
 fi
 
 %changelog
+* Thu Nov 07 2013 Sol Jerome <sol.jerome@gmail.com> 1.3.3-1
+- New upstream release
+
 * Mon Jul 01 2013 Sol Jerome <sol.jerome@gmail.com> 1.3.2-1
 - New upstream release
 
diff --git a/misc/bcfg2.spec b/misc/bcfg2.spec
index 788ec1cf3..0399e9356 100644
--- a/misc/bcfg2.spec
+++ b/misc/bcfg2.spec
@@ -23,8 +23,8 @@
 %global _pre_rc %{?_pre:.pre%{_pre}}%{?_rc:.rc%{_rc}}
 
 Name:             bcfg2
-Version:          1.3.2
-Release:          2%{?_pre_rc}%{?dist}
+Version:          1.3.3
+Release:          1%{?_pre_rc}%{?dist}
 Summary:          A configuration management system
 
 %if 0%{?suse_version}
@@ -753,6 +753,9 @@ sed "s@http://www.w3.org/2001/xml.xsd@file://$(pwd)/schemas/xml.xsd@" \
 
 
 %changelog
+* Thu Nov 07 2013 Sol Jerome <sol.jerome@gmail.com> 1.3.3-1
+- New upstream release
+
 * Sun Aug 04 2013 John Morris <john@zultron.com> - 1.3.2-2
 - Reconcile divergences with Fedora specfile, as requested by upstream
   (equally large changes made in Fedora version to reconcile with
diff --git a/osx/Makefile b/osx/Makefile
index d6c63e249..7714fa4d8 100644
--- a/osx/Makefile
+++ b/osx/Makefile
@@ -28,9 +28,9 @@ SITELIBDIR = /Library/Python/${PYVERSION}/site-packages
 # an Info.plist file for packagemaker to look at for package creation
 # and substitute the version strings. Major/Minor versions can only be
 # integers (e.g. "1" and "00" for bcfg2 version 1.0.0.
-BCFGVER = 1.3.2
+BCFGVER = 1.3.3
 MAJOR = 1
-MINOR = 32
+MINOR = 33
 
 default: clean client
 
diff --git a/osx/macports/Portfile b/osx/macports/Portfile
index 11c1d1908..83c7f4075 100644
--- a/osx/macports/Portfile
+++ b/osx/macports/Portfile
@@ -5,7 +5,7 @@ PortSystem          1.0
 PortGroup           python26 1.0
 
 name                bcfg2
-version             1.3.2
+version             1.3.3
 categories          sysutils python
 maintainers         gmail.com:sol.jerome
 license             BSD
diff --git a/schemas/types.xsd b/schemas/types.xsd
index b05a4ac33..c91a66110 100644
--- a/schemas/types.xsd
+++ b/schemas/types.xsd
@@ -329,6 +329,13 @@
         </xsd:documentation>
       </xsd:annotation>
     </xsd:attribute>
+    <xsd:attribute type="xsd:boolean" name="important">
+      <xsd:annotation>
+        <xsd:documentation>
+          Important entries are installed first during client execution.
+        </xsd:documentation>
+      </xsd:annotation>
+    </xsd:attribute>
     <xsd:attribute type="xsd:boolean" name="recursive">
       <xsd:annotation>
         <xsd:documentation>
diff --git a/solaris-ips/MANIFEST.bcfg2-server.header b/solaris-ips/MANIFEST.bcfg2-server.header
index 382595338..59929fcfa 100644
--- a/solaris-ips/MANIFEST.bcfg2-server.header
+++ b/solaris-ips/MANIFEST.bcfg2-server.header
@@ -1,4 +1,4 @@
 license ../../LICENSE  license=simplified_bsd
 set name=description value="Configuration management server"
 set name=pkg.summary value="Configuration management server"
-set name=pkg.fmri value="pkg://bcfg2/bcfg2-server@1.3.2"
+set name=pkg.fmri value="pkg://bcfg2/bcfg2-server@1.3.3"
diff --git a/solaris-ips/MANIFEST.bcfg2.header b/solaris-ips/MANIFEST.bcfg2.header
index 2896b94ed..5f48a60a1 100644
--- a/solaris-ips/MANIFEST.bcfg2.header
+++ b/solaris-ips/MANIFEST.bcfg2.header
@@ -1,5 +1,5 @@
 license ../../LICENSE  license=simplified_bsd
 set name=description value="Configuration management client"
 set name=pkg.summary value="Configuration management client"
-set name=pkg.fmri value="pkg://bcfg2/bcfg2@1.3.2"
+set name=pkg.fmri value="pkg://bcfg2/bcfg2@1.3.3"
 file usr/bin/bcfg2 group=bin mode=0755 owner=root path=usr/bin/bcfg2
diff --git a/solaris-ips/Makefile b/solaris-ips/Makefile
index 6d55881dc..71523f48e 100644
--- a/solaris-ips/Makefile
+++ b/solaris-ips/Makefile
@@ -1,6 +1,6 @@
 #!/usr/bin/gmake
 
-VERS=1.3.2-1
+VERS=1.3.3-1
 PYVERSION := $(shell python -c "import sys; print sys.version[0:3]")
 
 default: clean package
diff --git a/solaris-ips/pkginfo.bcfg2 b/solaris-ips/pkginfo.bcfg2
index 47fc96244..00483f961 100644
--- a/solaris-ips/pkginfo.bcfg2
+++ b/solaris-ips/pkginfo.bcfg2
@@ -1,7 +1,7 @@
 PKG="SCbcfg2"
 NAME="bcfg2"
 ARCH="sparc"
-VERSION="1.3.2"
+VERSION="1.3.3"
 CATEGORY="application"
 VENDOR="Argonne National Labratory"
 EMAIL="bcfg-dev@mcs.anl.gov"
diff --git a/solaris-ips/pkginfo.bcfg2-server b/solaris-ips/pkginfo.bcfg2-server
index c9dd0c45b..ecc5e72c1 100644
--- a/solaris-ips/pkginfo.bcfg2-server
+++ b/solaris-ips/pkginfo.bcfg2-server
@@ -1,7 +1,7 @@
 PKG="SCbcfg2-server"
 NAME="bcfg2-server"
 ARCH="sparc"
-VERSION="1.3.2"
+VERSION="1.3.3"
 CATEGORY="application"
 VENDOR="Argonne National Labratory"
 EMAIL="bcfg-dev@mcs.anl.gov"
diff --git a/solaris/Makefile b/solaris/Makefile
index e0c005f88..3b367ef71 100644
--- a/solaris/Makefile
+++ b/solaris/Makefile
@@ -1,7 +1,7 @@
 #!/usr/sfw/bin/gmake
 
 PYTHON="/usr/local/bin/python"
-VERS=1.3.2-1
+VERS=1.3.3-1
 PYVERSION := $(shell $(PYTHON) -c "import sys; print sys.version[0:3]")
 
 default: clean package
diff --git a/solaris/pkginfo.bcfg2 b/solaris/pkginfo.bcfg2
index 47fc96244..00483f961 100644
--- a/solaris/pkginfo.bcfg2
+++ b/solaris/pkginfo.bcfg2
@@ -1,7 +1,7 @@
 PKG="SCbcfg2"
 NAME="bcfg2"
 ARCH="sparc"
-VERSION="1.3.2"
+VERSION="1.3.3"
 CATEGORY="application"
 VENDOR="Argonne National Labratory"
 EMAIL="bcfg-dev@mcs.anl.gov"
diff --git a/solaris/pkginfo.bcfg2-server b/solaris/pkginfo.bcfg2-server
index c9dd0c45b..ecc5e72c1 100644
--- a/solaris/pkginfo.bcfg2-server
+++ b/solaris/pkginfo.bcfg2-server
@@ -1,7 +1,7 @@
 PKG="SCbcfg2-server"
 NAME="bcfg2-server"
 ARCH="sparc"
-VERSION="1.3.2"
+VERSION="1.3.3"
 CATEGORY="application"
 VENDOR="Argonne National Labratory"
 EMAIL="bcfg-dev@mcs.anl.gov"
diff --git a/src/lib/Bcfg2/Reporting/templates/base.html b/src/lib/Bcfg2/Reporting/templates/base.html
index 0b2b7dd36..7edf3a949 100644
--- a/src/lib/Bcfg2/Reporting/templates/base.html
+++ b/src/lib/Bcfg2/Reporting/templates/base.html
@@ -93,7 +93,7 @@ This is needed for Django versions less than 1.5
   <div style='clear:both'></div>
 </div><!-- document -->
   <div id="footer">
-    <span>Bcfg2 Version 1.3.2</span>
+    <span>Bcfg2 Version 1.3.3</span>
     </div>
 
 <div id="calendar_div" style='position:absolute; visibility:hidden; background-color:white; layer-background-color:white;'></div>
diff --git a/src/lib/Bcfg2/Server/Encryption.py b/src/lib/Bcfg2/Server/Encryption.py
index c0c2816ac..02c7a0eb8 100755
--- a/src/lib/Bcfg2/Server/Encryption.py
+++ b/src/lib/Bcfg2/Server/Encryption.py
@@ -197,6 +197,33 @@ def bruteforce_decrypt(crypted, passphrases=None, algorithm=None):
     raise EVPError("Failed to decrypt")
 
 
+def print_xml(element, keep_text=False):
+    """ Render an XML element for error output.  This prefixes the
+    line number and removes children for nicer display.
+
+    :param element: The element to render
+    :type element: lxml.etree._Element
+    :param keep_text: Do not discard text content from the element for
+                      display
+    :type keep_text: boolean
+    """
+    xml = None
+    if len(element) or element.text:
+        el = copy.copy(element)
+        if el.text and not keep_text:
+            el.text = '...'
+        for child in el.iterchildren():
+            el.remove(child)
+        xml = lxml.etree.tostring(
+            el,
+            xml_declaration=False).decode("UTF-8").strip()
+    else:
+        xml = lxml.etree.tostring(
+            element,
+            xml_declaration=False).decode("UTF-8").strip()
+    return "%s (line %s)" % (xml, element.sourceline)
+
+
 class PassphraseError(Exception):
     """ Exception raised when there's a problem determining the
     passphrase to encrypt or decrypt with """
@@ -403,6 +430,7 @@ class PropertiesEncryptor(Encryptor, PropertiesCryptoMixin):
             except PassphraseError:
                 self.logger.error(str(sys.exc_info()[1]))
                 return False
+            self.logger.debug("Encrypting %s" % print_xml(elt))
             elt.text = ssl_encrypt(elt.text, passphrase).strip()
             elt.set("encrypted", pname)
         return xdata
@@ -423,10 +451,14 @@ class PropertiesDecryptor(Decryptor, PropertiesCryptoMixin):
             except PassphraseError:
                 self.logger.error(str(sys.exc_info()[1]))
                 return False
-            decrypted = ssl_decrypt(elt.text, passphrase).strip()
+            self.logger.debug("Decrypting %s" % print_xml(elt))
             try:
+                decrypted = ssl_decrypt(elt.text, passphrase).strip()
                 elt.text = decrypted.encode('ascii', 'xmlcharrefreplace')
                 elt.set("encrypted", pname)
+            except Bcfg2.Encryption.EVPError:
+                self.logger.error("Could not decrypt %s, skipping" %
+                                  print_xml(elt))
             except UnicodeDecodeError:
                 # we managed to decrypt the value, but it contains
                 # content that can't even be encoded into xml
diff --git a/src/lib/Bcfg2/Server/MultiprocessingCore.py b/src/lib/Bcfg2/Server/MultiprocessingCore.py
index 58a05c85d..f58d53c42 100644
--- a/src/lib/Bcfg2/Server/MultiprocessingCore.py
+++ b/src/lib/Bcfg2/Server/MultiprocessingCore.py
@@ -19,7 +19,7 @@ import Bcfg2.Options
 import Bcfg2.Server.Cache
 import Bcfg2.Server.Plugin
 from itertools import cycle
-from Bcfg2.Compat import Queue, Empty, wraps
+from Bcfg2.Compat import Empty, wraps
 from Bcfg2.Server.Core import Core, exposed
 from Bcfg2.Server.BuiltinCore import BuiltinCore
 from multiprocessing.connection import Listener, Client
@@ -41,8 +41,7 @@ class RPCQueue(Bcfg2.Server.Plugin.Debuggable):
         Bcfg2.Server.Plugin.Debuggable.__init__(self)
         self._terminate = threading.Event()
         self._queues = dict()
-        self._available_listeners = Queue()
-        self._blocking_listeners = []
+        self._listeners = []
 
     def add_subscriber(self, name):
         """ Add a subscriber to the queue.  This returns the
@@ -63,23 +62,14 @@ class RPCQueue(Bcfg2.Server.Plugin.Debuggable):
         :class:`multiprocessing.connection.Listener` and passes the
         Listener address to the child as part of the RPC call, so that
         the child can connect to the Listener to submit its results.
-
-        Listeners are reused when possible to minimize overhead.
         """
-        try:
-            listener = self._available_listeners.get_nowait()
-            self.logger.debug("Reusing existing RPC listener at %s" %
-                              listener.address)
-        except Empty:
-            listener = Listener()
-            self.logger.debug("Created new RPC listener at %s" %
-                              listener.address)
-        self._blocking_listeners.append(listener)
+        listener = Listener()
+        self.logger.debug("Created new RPC listener at %s" % listener.address)
+        self._listeners.append(listener)
         try:
             self._queues[dest].put((listener.address,
                                     (method, args or [], kwargs or dict())))
             conn = listener.accept()
-            self._blocking_listeners.remove(listener)
             try:
                 while not self._terminate.is_set():
                     if conn.poll(self.poll_wait):
@@ -87,7 +77,8 @@ class RPCQueue(Bcfg2.Server.Plugin.Debuggable):
             finally:
                 conn.close()
         finally:
-            self._available_listeners.put(listener)
+            listener.close()
+            self._listeners.remove(listener)
 
     def close(self):
         """ Close queues and connections. """
@@ -99,21 +90,11 @@ class RPCQueue(Bcfg2.Server.Plugin.Debuggable):
 
         # close any listeners that are waiting for connections
         self.logger.debug("Closing RPC connections")
-        for listener in self._blocking_listeners:
+        for listener in self._listeners:
             self.logger.debug("Closing RPC connection at %s" %
                               listener.address)
             listener.close()
 
-        self.logger.debug("Closing RPC listeners")
-        try:
-            while True:
-                listener = self._available_listeners.get_nowait()
-                self.logger.debug("Closing RPC listener at %s" %
-                                  listener.address)
-                listener.close()
-        except Empty:
-            pass
-
 
 class DualEvent(object):
     """ DualEvent is a clone of :class:`threading.Event` that
diff --git a/src/lib/Bcfg2/Server/Plugins/Probes.py b/src/lib/Bcfg2/Server/Plugins/Probes.py
index ec5c1ab9f..9f2375fcd 100644
--- a/src/lib/Bcfg2/Server/Plugins/Probes.py
+++ b/src/lib/Bcfg2/Server/Plugins/Probes.py
@@ -175,9 +175,16 @@ class DBProbeStore(ProbeStore, Bcfg2.Server.Plugin.DatabaseBacked):
         expire_metadata = False
         for probe, pdata in data.items():
             self._datacache[hostname][probe] = pdata
-            record, created = ProbesDataModel.objects.get_or_create(
-                hostname=hostname,
-                probe=probe)
+            try:
+                record, created = ProbesDataModel.objects.get_or_create(
+                    hostname=hostname,
+                    probe=probe)
+            except ProbesDataModel.MultipleObjectsReturned:
+                ProbesDataModel.objects.filter(hostname=hostname,
+                                               probe=probe).delete()
+                record, created = ProbesDataModel.objects.get_or_create(
+                    hostname=hostname,
+                    probe=probe)
             expire_metadata |= created
             if record.data != pdata:
                 record.data = pdata
@@ -447,7 +454,6 @@ class Probes(Bcfg2.Server.Plugin.Probing,
     def GetProbes(self, metadata):
         return self.probes.get_probe_data(metadata)
 
-    @track_statistics()
     def ReceiveData(self, client, datalist):
         cgroups = set()
         cdata = dict()
diff --git a/src/lib/Bcfg2/version.py b/src/lib/Bcfg2/version.py
index 140fb6937..35d4cfa0a 100644
--- a/src/lib/Bcfg2/version.py
+++ b/src/lib/Bcfg2/version.py
@@ -2,7 +2,7 @@
 
 import re
 
-__version__ = "1.3.2"
+__version__ = "1.3.3"
 
 
 class Bcfg2VersionInfo(tuple):  # pylint: disable=E0012,R0924
diff --git a/tools/export.py b/tools/export.py
index 0ea6df2af..bdb85de41 100755
--- a/tools/export.py
+++ b/tools/export.py
@@ -220,12 +220,12 @@ E.G. 1.2.0pre1 is a valid version.
                      dryrun=options.dryrun)
     find_and_replace('solaris-ips/MANIFEST.bcfg2.header',
                      'set name=pkg.fmri value="pkg://bcfg2/bcfg2@',
-                     'set name=pkg.fmri value="pkg://bcfg2/bcfg2@%s"' % version,
+                     'set name=pkg.fmri value="pkg://bcfg2/bcfg2@%s"\n' % version,
                      startswith=True,
                      dryrun=options.dryrun)
     find_and_replace('solaris-ips/MANIFEST.bcfg2-server.header',
                      'set name=pkg.fmri value="pkg://bcfg2/bcfg2-server@',
-                     'set name=pkg.fmri value="pkg://bcfg2/bcfg2-server@%s"' % version,
+                     'set name=pkg.fmri value="pkg://bcfg2/bcfg2-server@%s"\n' % version,
                      startswith=True,
                      dryrun=options.dryrun)
     find_and_replace('solaris-ips/pkginfo.bcfg2', 'VERSION=',
@@ -248,30 +248,49 @@ E.G. 1.2.0pre1 is a valid version.
     find_and_replace('misc/bcfg2-selinux.spec', 'Version:',
                      'Version:          %s\n' % version_release,
                      dryrun=options.dryrun)
-    if version_info['build'] == '':
-        find_and_replace('misc/bcfg2.spec', 'Release: ',
-                         'Release:          1\n',
+    if version_info['build'].startswith('rc'):
+        find_and_replace('misc/bcfg2.spec', 'global _rc ',
+                         '%%global _rc %s\n' % version_info['build'],
                          dryrun=options.dryrun)
-        find_and_replace('misc/bcfg2-selinux.spec', 'Release: ',
-                         'Release:          1\n',
+        find_and_replace('misc/bcfg2-selinux.spec', 'global _rc ',
+                         '%%global _rc %s\n' % version_info['build'],
+                         dryrun=options.dryrun)
+    elif version_info['build'].startswith('pre'):
+        find_and_replace('misc/bcfg2.spec', 'global _pre ',
+                         '%%global _pre %s\n' % version_info['build'],
+                         dryrun=options.dryrun)
+        find_and_replace('misc/bcfg2-selinux.spec', 'global _pre ',
+                         '%%global _pre %s\n' % version_info['build'],
                          dryrun=options.dryrun)
     else:
+        # comment out pre/rc
+        find_and_replace('misc/bcfg2.spec', 'global _pre ',
+                         '#%%global _pre 2\n',
+                         dryrun=options.dryrun)
+        find_and_replace('misc/bcfg2-selinux.spec', 'global _pre ',
+                         '#%%global _pre 2\n',
+                         dryrun=options.dryrun)
+        find_and_replace('misc/bcfg2.spec', 'global _rc ',
+                         '#%%global _rc 1\n',
+                         dryrun=options.dryrun)
+        find_and_replace('misc/bcfg2-selinux.spec', 'global _rc ',
+                         '#%%global _rc 1\n',
+                         dryrun=options.dryrun)
+
         find_and_replace('misc/bcfg2.spec', 'Release: ',
-                         'Release:          0.%s.%s\n' %
-                         (version_info['build'][-1], version_info['build']),
+                         'Release:          1%{?_pre_rc}%{?dist}\n',
+                         startswith=True,
                          dryrun=options.dryrun)
         find_and_replace('misc/bcfg2-selinux.spec', 'Release: ',
-                         'Release:          0.%s.%s\n' %
-                         (version_info['build'][-1], version_info['build']),
+                         'Release:          1%{?_pre_rc}%{?dist}\n',
+                         startswith=True,
                          dryrun=options.dryrun)
     find_and_replace('misc/bcfg2.spec', '%setup',
-                     '%%setup -q -n %%{name}-%%{version}%s\n' %
-                     version_info['build'],
+                     '%setup -q -n %{name}-%{version}%{?_pre_rc}\n',
                      startswith=True,
                      dryrun=options.dryrun)
     find_and_replace('misc/bcfg2-selinux.spec', '%setup',
-                     '%%setup -q -n %%{name}-%%{version}%s\n' %
-                     version_info['build'],
+                     '%setup -q -n %{name}-%{version}%{?_pre_rc}\n',
                      startswith=True,
                      dryrun=options.dryrun)
     find_and_replace('misc/bcfg2.spec', 'BuildRoot',
diff --git a/tools/upgrade/1.3/migrate_configs.py b/tools/upgrade/1.3/migrate_configs.py
index 9fa362acf..547ce61e4 100755
--- a/tools/upgrade/1.3/migrate_configs.py
+++ b/tools/upgrade/1.3/migrate_configs.py
@@ -5,6 +5,7 @@ import sys
 from Bcfg2.Compat import ConfigParser
 import Bcfg2.Options
 
+
 def copy_section(src_file, tgt_cfg, section, newsection=None):
     if newsection is None:
         newsection = section
diff --git a/tools/upgrade/1.3/migrate_perms_to_mode.py b/tools/upgrade/1.3/migrate_perms_to_mode.py
index 786df0de6..2dfb70388 100755
--- a/tools/upgrade/1.3/migrate_perms_to_mode.py
+++ b/tools/upgrade/1.3/migrate_perms_to_mode.py
@@ -3,13 +3,15 @@
 import lxml.etree
 import os
 import sys
-
+from fnmatch import fnmatch
+from Bcfg2.Compat import any  # pylint: disable=W0622
+from Bcfg2.Server.FileMonitor import FileMonitor
 import Bcfg2.Options
 
 
 def setmodeattr(elem):
     """Set the mode attribute for a given element."""
-    if elem.attrib.has_key('perms'):
+    if 'perms' in elem.attrib:
         elem.set('mode', elem.get('perms'))
         del elem.attrib['perms']
         return True
@@ -53,10 +55,16 @@ def convertstructure(structfile):
         writefile(structfile, xdata)
 
 
+def skip_path(path):
+    return any(fnmatch(path, p) or fnmatch(os.path.basename(path), p)
+               for p in Bcfg2.Options.setup.ignore_files)
+
+
 def main():
     parser = Bcfg2.Options.get_parser(
         description="Migrate from Bcfg2 1.2 'perms' attribute to 1.3 'mode' "
-        "attribute")
+        "attribute",
+        components=FileMonitor)
     parser.add_options([Bcfg2.Options.Common.repository,
                         Bcfg2.Options.Common.plugins])
     parser.parse()
@@ -65,11 +73,17 @@ def main():
     for plugin in Bcfg2.Options.setup.plugins:
         if plugin in ['Base', 'Bundler', 'Rules']:
             for root, _, files in os.walk(os.path.join(repo, plugin)):
+                if skip_path(root):
+                    continue
                 for fname in files:
+                    if skip_path(fname):
+                        continue
                     convertstructure(os.path.join(root, fname))
         if plugin not in ['Cfg', 'TGenshi', 'TCheetah', 'SSHbase', 'SSLCA']:
             continue
         for root, dirs, files in os.walk(os.path.join(repo, plugin)):
+            if skip_path(root):
+                continue
             for fname in files:
                 if fname == 'info.xml':
                     convertinfo(os.path.join(root, fname))