Merge remote-tracking branch 'josh/ticket/2.7.x/10269-build-break' into 2.7.x

* josh/ticket/2.7.x/10269-build-break:
  (#10269) Make directories executable so they can be cleaned up
(#9983) Add method for reading binary files

The method IO#binread is not available prior to ruby 1.9, so this
commit adds a method Puppet::Util.binread that does just that.
(#9983) Checksum files in binary mode

Previously, we were opening files in text mode when calculating file
checksums. On Windows, '\r\n' characters are automatically translated
to '\n', which corrupts the resulting checksum.

This commit ensures we open files in binary mode, similar to what
Digest::MD5.file(path).hexdigest does. Binary mode is a noop on Unix.

Similarly, Puppet::Type::File#write was writing the file content in
text mode, which was later validated using the checksum code, now
reading in binary mode. So Puppet::Type::File was changed to use
binary mode as well.

Also, some of the tests were writing files in text mode, but
checksumming them in binary mode, and obviously failing. Changed the
spec tests to write in binary mode also.
(#9983) Restore files in binary mode

Previously we were restoring files in text mode, which causes Windows
to translate '\n' characters into '\r\n', thereby corrupting the file.

It also incorrectly computed the checksum for the to-be-restored file
for the same reason.

This commit sets the binary mode flag in both cases, which is a noop
on Unix.
(#9983) Read file content in binary mode when backing up

Previously, Puppet::FileBucket::Dipper#backup would read a file's
content in text mode, which on Windows causes '\r\n' to be translated
to '\n'. As a result, the backup method was calculating the wrong
checksum for the to-be-backed-up file.

This commit changes the backup method to open the file in binary mode,
which is a noop on Unix.
(#9983) Use binary mode when reading and writing FileBucketFiles

Previously, the Puppet::FileBucketFile terminus used text mode in its
save and find methods. It also used text mode when validating that a
file that it was asked to save matched what was already in the file
bucket.

This commit changes these methods to use binary mode, which is a noop
on Unix.
(#9983) Read file content from disk using binary mode

Previously, the file content property chunked local files in text
mode, which could corrupt binary files on Windows.

This commit changes it to open the file in binary mode.
(#9983) Serve file content in binary mode

Previously, Puppet::FileServing::Content opened files in text
mode. Changed to binary mode.
(#9983) Checksum file in binary mode when storing to filebucket

Previously, the 'store' action for the 'file' face read content in
text mode, resulting in incorrect checksums and corrupt binaries on
Windows.

This commit changes it to use binary mode, which is a noop on Unix.
(#9508) Default ACL of `auth any` makes sense where we had `auth no`

In `auth.conf`, a setting of `auth no` means that only unauthenticated
requests are allowed.  If you actually have a certificate you can't use the
service.  (Yes, anonymous users have *more* access than authenticated ones.)

This alters the default to `auth any` instead, which allows you to access
these endpoints even where you already have a certificate.

This better supports the distributed model of certificate management anyhow,
now that we have things like the cloud provisioner trying to manage
certificates for other nodes over the network.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Updated CHANGELOG for 2.7.7rc1
Merge pull request #193 from daniel-pittman/feature/2.7.x/9508-auth-any-rather-than-auth-no

Feature/2.7.x/9508 auth any rather than auth no
(#9508) Be explicit is setting `auth any` for default ACLs.

The previous change didn't actually work: while it ran through and claimed to
be doing the right thing, it actually skipped setting `auth any` into the
default ACL.

By being explicit that it is any we can force the code to do the right thing;
along the way simplify the notice about the default ACL to show more useful
information more cleanly.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#2744) Display file diffs through the Puppet log system.

When Puppet generated a diff between the file on disk, it previously just
printed it directly.  This means that the user can view it, but it is lost in
the rest of the system - monitoring, logs, and reports have no visibility of
this.

Better, then, to send it through our regular logging system, so that the
content is visible in all the places that it might be viewed by the user or
monitored by machines.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Merge branch 'ticket/2.7.x/2744' into 2.7.x
(#5617)  Puppet queue logging

  Simple patch that copies the code from agent.rb to queue.rb so that
  syslog logging is possible in the puppet queue applicaton.
Merge pull request #198 from ody/feature/2.6.x/5617

Feature/2.6.x/5617
(#9158) Support old and new versions of STOMP gem.

The STOMP gem, up to release 1.1.4, used `send` to push messages to the
queue.  From 1.1.5 onward this is replaced by `publish`, and `send` issues a
deprecation warning, but still works.

This commit dynamically adapts to the best available method: if `publish` is
present we use that, otherwise we fall back to `send`, and fail cleanly if we
drift further.

This should behave correctly with all known versions of the STOMP gem, avoid
deprecation warnings, and still end up with the right results.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#10614) Fix error checking for Windows BOOL return values

Previously, the agent could segfault when attempting to manage a DACL
on a non-NTFS filesystem. The problem was that we were incorrectly
checking the return value from several of the Windows APIs due to the
windows gems automatically converting BOOL values into ruby true/false
values.

For example, this call returns a ruby true/false value:

  API.new('IsValidAcl', 'P', 'B', 'advapi32')

But this one will return an integer value:

  API.new('GetSecurityInfo', 'LLLPPPPP', 'L', 'advapi32')

The crash is now fixed because we correctly raise an exception when
IsValidAcl returns false.

Paired-with: Nick Lewis <nick@puppetlabs.com>
Merge remote-tracking branch 'daniel-pittman/feature/2.7.x/9508-auth-any-rather-than-auth-no' into 2.7.x