puppet depends on 'diff' being available
clean up puppet permissions
provide example config, especially one cooked to move 'ssldir' to var/lib/puppet instead of etc/puppet/ssl