rsync()
also `agent_sudo()` i guess, but that whole thing is decidedly less convenient now than it used to be. need to figure out a way to temporarily enable agent forwarding from within the fabric, if possible...
contains()
append()
basically stolen from Fabric v1 source code
was able to bootstrap a complete machine with this, although there's lots missing yet...