improved perms on puppet checkout