diff --git a/.sync.yml b/.sync.yml
index ac94402..29435db 100644
--- a/.sync.yml
+++ b/.sync.yml
@@ -1,10 +1,19 @@
 spec/spec_helper.rb:
   mock_with: ':rspec'
+  strict_level: ':error'
 Rakefile:
   extras:
     - |
       Blacksmith::RakeTask.new do |t|
+        t.commit_message_pattern = "Bump version to %s"
+        t.tag_message_pattern = "Release %s"
         t.tag_pattern = "%s"
-        t.tag_message_pattern = "Release ssm-hitch %s"
         t.tag_sign = true
       end
+Gemfile:
+  required:
+    ':system_tests':
+      - gem: ed25519
+        version: '~> 1.2'
+      - gem: bcrypt_pbkdf
+        version: '~> 1.0'
diff --git a/Gemfile b/Gemfile
index 8007ad0..3b7c692 100644
--- a/Gemfile
+++ b/Gemfile
@@ -1,72 +1,76 @@
 source ENV['GEM_SOURCE'] || 'https://rubygems.org'
 
 def location_for(place_or_version, fake_version = nil)
   git_url_regex = %r{\A(?<url>(https?|git)[:@][^#]*)(#(?<branch>.*))?}
   file_url_regex = %r{\Afile:\/\/(?<path>.*)}
 
   if place_or_version && (git_url = place_or_version.match(git_url_regex))
     [fake_version, { git: git_url[:url], branch: git_url[:branch], require: false }].compact
   elsif place_or_version && (file_url = place_or_version.match(file_url_regex))
     ['>= 0', { path: File.expand_path(file_url[:path]), require: false }]
   else
     [place_or_version, { require: false }]
   end
 end
 
 ruby_version_segments = Gem::Version.new(RUBY_VERSION.dup).segments
 minor_version = ruby_version_segments[0..1].join('.')
 
 group :development do
   gem "fast_gettext", '1.1.0',                                   require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.1.0')
   gem "fast_gettext",                                            require: false if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.1.0')
   gem "json_pure", '<= 2.0.1',                                   require: false if Gem::Version.new(RUBY_VERSION.dup) < Gem::Version.new('2.0.0')
   gem "json", '= 1.8.1',                                         require: false if Gem::Version.new(RUBY_VERSION.dup) == Gem::Version.new('2.1.9')
   gem "json", '= 2.0.4',                                         require: false if Gem::Requirement.create('~> 2.4.2').satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.1.0',                                         require: false if Gem::Requirement.create(['>= 2.5.0', '< 2.7.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "rb-readline", '= 0.5.5',                                  require: false, platforms: [:mswin, :mingw, :x64_mingw]
   gem "puppet-module-posix-default-r#{minor_version}", '~> 0.4', require: false, platforms: [:ruby]
   gem "puppet-module-posix-dev-r#{minor_version}", '~> 0.4',     require: false, platforms: [:ruby]
   gem "puppet-module-win-default-r#{minor_version}", '~> 0.4',   require: false, platforms: [:mswin, :mingw, :x64_mingw]
   gem "puppet-module-win-dev-r#{minor_version}", '~> 0.4',       require: false, platforms: [:mswin, :mingw, :x64_mingw]
 end
+group :system_tests do
+  gem "ed25519", '~> 1.2',      require: false
+  gem "bcrypt_pbkdf", '~> 1.0', require: false
+end
 
 puppet_version = ENV['PUPPET_GEM_VERSION']
 facter_version = ENV['FACTER_GEM_VERSION']
 hiera_version = ENV['HIERA_GEM_VERSION']
 
 gems = {}
 
 gems['puppet'] = location_for(puppet_version)
 
 # If facter or hiera versions have been specified via the environment
 # variables
 
 gems['facter'] = location_for(facter_version) if facter_version
 gems['hiera'] = location_for(hiera_version) if hiera_version
 
 if Gem.win_platform? && puppet_version =~ %r{^(file:///|git://)}
   # If we're using a Puppet gem on Windows which handles its own win32-xxx gem
   # dependencies (>= 3.5.0), set the maximum versions (see PUP-6445).
   gems['win32-dir'] =      ['<= 0.4.9', require: false]
   gems['win32-eventlog'] = ['<= 0.6.5', require: false]
   gems['win32-process'] =  ['<= 0.7.5', require: false]
   gems['win32-security'] = ['<= 0.2.5', require: false]
   gems['win32-service'] =  ['0.8.8', require: false]
 end
 
 gems.each do |gem_name, gem_params|
   gem gem_name, *gem_params
 end
 
 # Evaluate Gemfile.local and ~/.gemfile if they exist
 extra_gemfiles = [
   "#{__FILE__}.local",
   File.join(Dir.home, '.gemfile'),
 ]
 
 extra_gemfiles.each do |gemfile|
   if File.file?(gemfile) && File.readable?(gemfile)
     eval(File.read(gemfile), binding)
   end
 end
 # vim: syntax=ruby
diff --git a/Rakefile b/Rakefile
index f3e3aa1..ea6f999 100644
--- a/Rakefile
+++ b/Rakefile
@@ -1,94 +1,95 @@
 # frozen_string_literal: true
 
 require 'puppet_litmus/rake_tasks' if Bundler.rubygems.find_name('puppet_litmus').any?
 require 'puppetlabs_spec_helper/rake_tasks'
 require 'puppet-syntax/tasks/puppet-syntax'
 require 'puppet_blacksmith/rake_tasks' if Bundler.rubygems.find_name('puppet-blacksmith').any?
 require 'github_changelog_generator/task' if Bundler.rubygems.find_name('github_changelog_generator').any?
 require 'puppet-strings/tasks' if Bundler.rubygems.find_name('puppet-strings').any?
 
 def changelog_user
   return unless Rake.application.top_level_tasks.include? "changelog"
   returnVal = nil || JSON.load(File.read('metadata.json'))['author']
   raise "unable to find the changelog_user in .sync.yml, or the author in metadata.json" if returnVal.nil?
   puts "GitHubChangelogGenerator user:#{returnVal}"
   returnVal
 end
 
 def changelog_project
   return unless Rake.application.top_level_tasks.include? "changelog"
 
   returnVal = nil
   returnVal ||= begin
     metadata_source = JSON.load(File.read('metadata.json'))['source']
     metadata_source_match = metadata_source && metadata_source.match(%r{.*\/([^\/]*?)(?:\.git)?\Z})
 
     metadata_source_match && metadata_source_match[1]
   end
 
   raise "unable to find the changelog_project in .sync.yml or calculate it from the source in metadata.json" if returnVal.nil?
 
   puts "GitHubChangelogGenerator project:#{returnVal}"
   returnVal
 end
 
 def changelog_future_release
   return unless Rake.application.top_level_tasks.include? "changelog"
   returnVal = "v%s" % JSON.load(File.read('metadata.json'))['version']
   raise "unable to find the future_release (version) in metadata.json" if returnVal.nil?
   puts "GitHubChangelogGenerator future_release:#{returnVal}"
   returnVal
 end
 
 PuppetLint.configuration.send('disable_relative')
 
 if Bundler.rubygems.find_name('github_changelog_generator').any?
   GitHubChangelogGenerator::RakeTask.new :changelog do |config|
     raise "Set CHANGELOG_GITHUB_TOKEN environment variable eg 'export CHANGELOG_GITHUB_TOKEN=valid_token_here'" if Rake.application.top_level_tasks.include? "changelog" and ENV['CHANGELOG_GITHUB_TOKEN'].nil?
     config.user = "#{changelog_user}"
     config.project = "#{changelog_project}"
     config.future_release = "#{changelog_future_release}"
     config.exclude_labels = ['maintenance']
     config.header = "# Change log\n\nAll notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org)."
     config.add_pr_wo_labels = true
     config.issues = false
     config.merge_prefix = "### UNCATEGORIZED PRS; GO LABEL THEM"
     config.configure_sections = {
       "Changed" => {
         "prefix" => "### Changed",
         "labels" => ["backwards-incompatible"],
       },
       "Added" => {
         "prefix" => "### Added",
         "labels" => ["feature", "enhancement"],
       },
       "Fixed" => {
         "prefix" => "### Fixed",
         "labels" => ["bugfix"],
       },
     }
   end
 else
   desc 'Generate a Changelog from GitHub'
   task :changelog do
     raise <<EOM
 The changelog tasks depends on unreleased features of the github_changelog_generator gem.
 Please manually add it to your .sync.yml for now, and run `pdk update`:
 ---
 Gemfile:
   optional:
     ':development':
       - gem: 'github_changelog_generator'
         git: 'https://github.com/skywinder/github-changelog-generator'
         ref: '20ee04ba1234e9e83eb2ffb5056e23d641c7a018'
         condition: "Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new('2.2.2')"
 EOM
   end
 end
 
 Blacksmith::RakeTask.new do |t|
+  t.commit_message_pattern = "Bump version to %s"
+  t.tag_message_pattern = "Release %s"
   t.tag_pattern = "%s"
-  t.tag_message_pattern = "Release ssm-hitch %s"
   t.tag_sign = true
 end
 
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index b367fde..1b662b6 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -1,61 +1,61 @@
 # frozen_string_literal: true
 
 RSpec.configure do |c|
   c.mock_with :rspec
 end
 
 require 'puppetlabs_spec_helper/module_spec_helper'
 require 'rspec-puppet-facts'
 
 require 'spec_helper_local' if File.file?(File.join(File.dirname(__FILE__), 'spec_helper_local.rb'))
 
 include RspecPuppetFacts
 
 default_facts = {
   puppetversion: Puppet.version,
   facterversion: Facter.version,
 }
 
 default_fact_files = [
   File.expand_path(File.join(File.dirname(__FILE__), 'default_facts.yml')),
   File.expand_path(File.join(File.dirname(__FILE__), 'default_module_facts.yml')),
 ]
 
 default_fact_files.each do |f|
   next unless File.exist?(f) && File.readable?(f) && File.size?(f)
 
   begin
     default_facts.merge!(YAML.safe_load(File.read(f), [], [], true))
   rescue => e
     RSpec.configuration.reporter.message "WARNING: Unable to load #{f}: #{e}"
   end
 end
 
 # read default_facts and merge them over what is provided by facterdb
 default_facts.each do |fact, value|
   add_custom_fact fact, value
 end
 
 RSpec.configure do |c|
   c.default_facts = default_facts
   c.before :each do
     # set to strictest setting for testing
     # by default Puppet runs at warning level
-    Puppet.settings[:strict] = :warning
+    Puppet.settings[:strict] = :error
     Puppet.settings[:strict_variables] = true
   end
   c.filter_run_excluding(bolt: true) unless ENV['GEM_BOLT']
   c.after(:suite) do
   end
 end
 
 # Ensures that a module is defined
 # @param module_name Name of the module
 def ensure_module_defined(module_name)
   module_name.split('::').reduce(Object) do |last_module, next_module|
     last_module.const_set(next_module, Module.new) unless last_module.const_defined?(next_module, false)
     last_module.const_get(next_module, false)
   end
 end
 
 # 'spec_overrides' from sync.yml will appear below this line