Don't overwrite credential states from the script

Also adds logging if the script did not add UserCredentialStates. In
that case the client generates them based on the state of the whole
script execution.

task.go

@@ -366,22 +366,27 @@ func (c *config) handleTask(t task) (err error) {
 		t.Log("Output: %s", output)
 	}
 
-	// TODO change the API towards the scripts so the can tell us which credentials they actually deploy
-	// here we just expect the script to make them all reach the StateTarget
+	// if the script does not provide any credential specific states we expect all
+	// credentials to have the same state as the whole execution (output.State)
+	if output.UserCredentialStates == nil {
+		if *scriptDebugging {
+			t.Log("The script did not provided credential specific states")
+		}
+
 		var userCredentialStates = make(s.UserCredentialStates)
 		for credType, credList := range t.Credentials {
 			for _, credential := range credList {
 				if stateMap, ok := userCredentialStates[credType]; !ok {
 					userCredentialStates[credType] = map[string]s.State{
-					credential.Name: t.StateTarget,
+						credential.Name: output.State,
 					}
 				} else {
-				stateMap[credential.Name] = t.StateTarget
+					stateMap[credential.Name] = output.State
 				}
 			}
 		}
-
 		output.UserCredentialStates = userCredentialStates
+	}
 
 	c.DoneTasks <- taskReply{
 		ID:      t.ID,