diff --git a/bin/_blackbox_common.sh b/bin/_blackbox_common.sh
index 23ea5ed..0c0e290 100755
--- a/bin/_blackbox_common.sh
+++ b/bin/_blackbox_common.sh
@@ -380,6 +380,23 @@ function md5sum_file() {
   esac
 }
 
+function cp_permissions() {
+  # Copy the perms of $1 onto $2 .. end.
+  case $(uname -s) in
+    Darwin )
+      chmod $( stat -f '%p' "$1" ) "${@:2}"
+      ;;
+    Linux | CYGWIN* )
+      chmod --reference "$1" "${@:2}"
+      ;;
+    * )
+      echo 'ERROR: Unknown OS. Exiting.'
+      exit 1
+      ;;
+  esac
+}
+
+
 #
 # Abstract the difference between git and hg:
 #
diff --git a/bin/_blackbox_common_test.sh b/bin/_blackbox_common_test.sh
new file mode 100755
index 0000000..47cef52
--- /dev/null
+++ b/bin/_blackbox_common_test.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+#
+# _blackbox_common_test.sh -- Unit tests of functions from _blackbox_common.sh
+#
+
+set -e
+. "${0%/*}/_blackbox_common.sh"
+. tools/test_functions.sh
+
+PHASE 'Test cp-permissions: TestA'
+touch TestA TestB TestC TestD
+chmod 0347 TestA
+chmod 0700 TestB
+chmod 0070 TestC
+chmod 0070 TestD
+cp_permissions TestA TestB TestC
+assert_file_perm '--wxr--rwx' TestA
+assert_file_perm '--wxr--rwx' TestB
+assert_file_perm '--wxr--rwx' TestC
+assert_file_perm '----rwx---' TestD
+
+echo '========== DONE.'
diff --git a/bin/blackbox_postdeploy b/bin/blackbox_postdeploy
index a095c90..4d40d64 100755
--- a/bin/blackbox_postdeploy
+++ b/bin/blackbox_postdeploy
@@ -30,7 +30,7 @@ echo '========== Decrypting new/changed files: START'
 while IFS= read <&99 -r unencrypted_file; do
   encrypted_file=$(get_encrypted_filename "$unencrypted_file")
   decrypt_file_overwrite "$encrypted_file" "$unencrypted_file"
-  chmod --reference "$encrypted_file" "$unencrypted_file"
+  cp_permissions "$encrypted_file" "$unencrypted_file"
   if [[ ! -z "$FILE_GROUP" ]]; then
     chmod g+r "$unencrypted_file"
     chgrp "$FILE_GROUP" "$unencrypted_file"
diff --git a/tools/confidence_test.sh b/tools/confidence_test.sh
index 23e6591..0e1f0cb 100755
--- a/tools/confidence_test.sh
+++ b/tools/confidence_test.sh
@@ -3,117 +3,15 @@
 blackbox_home=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )/../bin
 export PATH="${blackbox_home}:/usr/local/bin:/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/sbin:/opt/local/bin"
 
-. _stack_lib.sh
-
 set -e
+. _stack_lib.sh
+. tools/test_functions.sh
 
-function PHASE() {
-  echo '********************'
-  echo '********************'
-  echo '*********' """$@"""
-  echo '********************'
-  echo '********************'
-}
+PHASE 'UNIT TESTS'
 
-function md5sum_file() {
-  # Portably generate the MD5 hash of file $1.
-  case $(uname -s) in
-    Darwin )
-      md5 -r "$1" | awk '{ print $1 }'
-      ;;
-    Linux )
-      md5sum "$1" | awk '{ print $1 }'
-      ;;
-    CYGWIN* )
-      md5sum "$1" | awk '{ print $1 }'
-      ;;
-    * )
-      echo 'ERROR: Unknown OS. Exiting.'
-      exit 1
-      ;;
-  esac
-}
+_blackbox_common_test.sh
 
-function assert_file_missing() {
-  if [[ -e "$1" ]]; then
-    echo "ASSERT FAILED: ${1} should not exist."
-    exit 1
-  fi
-}
-
-function assert_file_exists() {
-  if [[ ! -e "$1" ]]; then
-    echo "ASSERT FAILED: ${1} should exist."
-    echo "PWD=$(/bin/pwd -P)"
-    #echo "LS START"
-    #ls -la
-    #echo "LS END"
-    exit 1
-  fi
-}
-function assert_file_md5hash() {
-  local file="$1"
-  local wanted="$2"
-  assert_file_exists "$file"
-  local found
-  found=$(md5sum_file "$file")
-  if [[ "$wanted" != "$found" ]]; then
-    echo "ASSERT FAILED: $file hash wanted=$wanted found=$found"
-    exit 1
-  fi
-}
-function assert_file_group() {
-  local file="$1"
-  local wanted="$2"
-  local found
-  assert_file_exists "$file"
-
-  case $(uname -s) in
-    Darwin|FreeBSD )
-      found=$(stat -f '%Sg' "$file")
-      ;;
-    Linux )
-      found=$(stat -c '%G' "$file")
-      ;;
-    CYGWIN* )
-      echo "ASSERT_FILE_GROUP: Running on Cygwin. Not being tested."
-      return 0
-      ;;
-    * )
-      echo 'ERROR: Unknown OS. Exiting.'
-      exit 1
-      ;;
-  esac
-
-  if [[ "$wanted" != "$found" ]]; then
-    echo "ASSERT FAILED: $file chgrp wanted=$wanted found=$found"
-    exit 1
-  fi
-}
-function assert_line_not_exists() {
-  local target="$1"
-  local file="$2"
-  assert_file_exists "$file"
-  if grep -F -x -s -q >/dev/null "$target" "$file" ; then
-    echo "ASSERT FAILED: line '$target' should not exist in file $file"
-    echo "==== file contents: START $file"
-    cat "$file"
-    echo "==== file contents: END $file"
-    exit 1
-  fi
-}
-function assert_line_exists() {
-  local target="$1"
-  local file="$2"
-  assert_file_exists "$file"
-  if ! grep -F -x -s -q >/dev/null "$target" "$file" ; then
-    echo "ASSERT FAILED: line '$target' should exist in file $file"
-    echo "==== file contents: START $file"
-    cat "$file"
-    echo "==== file contents: END $file"
-    exit 1
-  fi
-}
+PHASE 'SYSTEM TESTS'
 
 make_tempdir test_repository
 cd "$test_repository"
@@ -143,7 +41,6 @@ function become_bob() {
   git config --global user.email bob@example.com
 }
 
-
 PHASE 'Alice creates a repo.  She creates secret.txt.'
 
 become_alice
diff --git a/tools/test_functions.sh b/tools/test_functions.sh
new file mode 100755
index 0000000..aa774c6
--- /dev/null
+++ b/tools/test_functions.sh
@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+
+function PHASE() {
+  echo '********************'
+  echo '********************'
+  echo '*********' """$@"""
+  echo '********************'
+  echo '********************'
+}
+
+function md5sum_file() {
+  # Portably generate the MD5 hash of file $1.
+  case $(uname -s) in
+    Darwin )
+      md5 -r "$1" | awk '{ print $1 }'
+      ;;
+    Linux )
+      md5sum "$1" | awk '{ print $1 }'
+      ;;
+    CYGWIN* )
+      md5sum "$1" | awk '{ print $1 }'
+      ;;
+    * )
+      echo 'ERROR: Unknown OS. Exiting.'
+      exit 1
+      ;;
+  esac
+}
+
+function assert_file_missing() {
+  if [[ -e "$1" ]]; then
+    echo "ASSERT FAILED: ${1} should not exist."
+    exit 1
+  fi
+}
+
+function assert_file_exists() {
+  if [[ ! -e "$1" ]]; then
+    echo "ASSERT FAILED: ${1} should exist."
+    echo "PWD=$(/bin/pwd -P)"
+    #echo "LS START"
+    #ls -la
+    #echo "LS END"
+    exit 1
+  fi
+}
+function assert_file_md5hash() {
+  local file="$1"
+  local wanted="$2"
+  assert_file_exists "$file"
+  local found
+  found=$(md5sum_file "$file")
+  if [[ "$wanted" != "$found" ]]; then
+    echo "ASSERT FAILED: $file hash wanted=$wanted found=$found"
+    exit 1
+  fi
+}
+function assert_file_group() {
+  local file="$1"
+  local wanted="$2"
+  local found
+  assert_file_exists "$file"
+
+  case $(uname -s) in
+    Darwin|FreeBSD )
+      found=$(stat -f '%Sg' "$file")
+      ;;
+    Linux )
+      found=$(stat -c '%G' "$file")
+      ;;
+    CYGWIN* )
+      echo "ASSERT_FILE_GROUP: Running on Cygwin. Not being tested."
+      return 0
+      ;;
+    * )
+      echo 'ERROR: Unknown OS. Exiting.'
+      exit 1
+      ;;
+  esac
+
+  if [[ "$wanted" != "$found" ]]; then
+    echo "ASSERT FAILED: $file chgrp wanted=$wanted found=$found"
+    exit 1
+  fi
+}
+function assert_file_perm() {
+  local wanted="$1"
+  local file="$2"
+  local found
+  assert_file_exists "$file"
+
+  case $(uname -s) in
+    Darwin|FreeBSD )
+      found=$(stat -f '%Sp' "$file")
+      ;;
+    # NB(tlim): CYGWIN hasn't been tested. It might be more like Darwin.
+    Linux | CYGWIN* )
+      found=$(stat -c '%A' "$file")
+      ;;
+    * )
+      echo 'ERROR: Unknown OS. Exiting.'
+      exit 1
+      ;;
+  esac
+
+  if [[ "$wanted" != "$found" ]]; then
+    echo "ASSERT FAILED: $file chgrp wanted=$wanted found=$found"
+    exit 1
+  fi
+}
+function assert_line_not_exists() {
+  local target="$1"
+  local file="$2"
+  assert_file_exists "$file"
+  if grep -F -x -s -q >/dev/null "$target" "$file" ; then
+    echo "ASSERT FAILED: line '$target' should not exist in file $file"
+    echo "==== file contents: START $file"
+    cat "$file"
+    echo "==== file contents: END $file"
+    exit 1
+  fi
+}
+function assert_line_exists() {
+  local target="$1"
+  local file="$2"
+  assert_file_exists "$file"
+  if ! grep -F -x -s -q >/dev/null "$target" "$file" ; then
+    echo "ASSERT FAILED: line '$target' should exist in file $file"
+    echo "==== file contents: START $file"
+    cat "$file"
+    echo "==== file contents: END $file"
+    exit 1
+  fi
+}