(#13204) Workaround duplicate Augeas save events

Bug #264 in Augeas causes duplicate save events to be returned when editing
under /boot in newfile mode.  Because we loop around these events, diffing and
unlinking the files, this causes an ENOENT error when we process the same event
twice.

This commit checks that the file we intend to operate on exists.
Quote strings containing hex numbers when generating ZAML

When generating ZAML, we prefer to write bare strings when possible. To
that end, we have rules about which sorts of strings are not safe to
write bare. One of those rules is strings containing numbers (for if we
wrote those bare, they would be revived as numbers). However, ZAML
wasn't properly considering hex digits when identifying a string
containing a number, resulting in those strings being written unquoted,
and revived incorrectly as numbers.

That is, YAML.load(ZAML.dump("0xffff")) would return 65535, when it ought
to be "0xffff".
(#12466) unset X-Forwarded-For header

Without this patch the handling of
X-Forwarded-For headers is insecure in a
default apache conf supplied with puppet.
This patch ensures X-Forwarded-For headers
are dropped.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Removed text/marshal support

Removing text/marshal support in order to close the security
vulnerability described in Bug #13552.
Fix for bucket_path security vulnerability

This is a fix for Bugs #13553, #13418, #13511. The bucket_path parameter
allowed control over where the filebucket will try to read and write to.
The only place available to stop this parameter is in the resolution
from a URI to an indirectory terminus. The bucket_path is used
internally for local filebuckets and so cannot be removed completely
without a larger change to the design.
Remove telnet Output_log parameter

The puppet telnet util opened an output log by default with a predictable name.
This left the log open to a write-through symlink attack as the puppet user.
This fix addresses that by removing the Output_log parameter from the
Net::Telnet::new call. Without the parameter, Net::Telnet defaults to no output
logging. The same is true for the dump_log parameter. The spec test for telnet
has been updated to test and ensure that no files are opened during connect. It
also stubs the TCPSocket for the telnet connection so that no connection is
attempted if @transport.connect isn't stubbed.
Refactor pkgdmg specs

Refactor to a more current spec style. Several of these specs didn't actually
test anything. They have either been deleted or made more specific.
(#13260) Use mktmpdir when downloading packages

This fixes a security vulnerability in the appdmg and pkgdmg providers where
they would curl packages directly into /tmp and the install them, allowing an
attacker to craft a symlink and overwrite arbitrary files or install arbitrary
packages.
(#12392) Created Windows eventlog message resource dll

This commit adds the ability to build a message resource dll used to
display localized eventlog messages on Windows. Windows eventlog expects
that each log event has a unique id, which can then be localized in a
resource dll, one for each locale. However, puppet does not yet support
this, see #11076. So this commit defines three puppet event ids
corresponding to the three levels of Windows events that we support
(info, warn, and error).

In order to build the dll, you need the Windows SDK installed that
contains the mc, rc, and link utilities.
(#13260) Spec test to verify that mktmpdir is used
Stub mktmpdir and remove_entry_secure in os x package providers
(#12392) Add eventlog destination and log to it by default on Windows

Previously, puppet logged by default to syslog or a file.

This commit changes puppet to log to syslog, the eventlog, or a file, in
that order. Puppet uses `Puppet.features.eventlog?` to determine if the
Windows eventlog is available on the current platform (which requires
the win32-eventlog gem). If the feature is false, then the eventlog
destination is not created, and the next suitable destination is used.
(#13690) Update 2.7.x for spec_helper compatibility with external projects

This basically entails:

* Introducing a new class Puppet::Test::TestHelper that will contain
  basic setup / teardown methods, which external projects can use to
  make sure that puppet is initialized properly during testing.
* Remove or abstract the Puppet::Util::Settings#initialize_for_tests /
  clear_for_tests methods in P::U::S
* Modify puppet core spec_helper.rb to use the new API.
Updating CHANGELOG and lib/puppet.rb for 2.7.13
Merge branch 'ticket/2.7.x/12392-eventlog' into 2.7.x

* ticket/2.7.x/12392-eventlog:
  (#12392) Add eventlog destination and log to it by default on Windows
  (#12392) Created Windows eventlog message resource dll
(#12392) Don't require eventlog gem on non-Windows platforms

Commit `8d2ff89` attempted to require the windows eventlog gem within a
`:if => Puppet.features.microsoft_windows?` describe block, but I forgot
that requires within the block are still evaluated on non-Windows
platform, although the tests themselves won't be run.

This commit just conditionally requires the gem.
Merge pull request #650 from joshcooper/maint/2.7.x/eventlog

Don't require eventlog gem on non-Windows platforms
Merge branch 'security/2.7.13/filebucket-telnet-macos-security' into 2.7.x
(#13690) add comments to spec_helper
Tests for deprecation warnings for dynamic scoping

The tests for dynamic scoping were non existent and thus dynamic scoping
was implemented incorrectly. This allows us to check for correct
warnings.