(#16160) handle aclmode and shareiscsi removal.

Two properties aclmode and shareiscsi was removed from solaris 11 in two different builds.
of these aclmode may have been added back in some builds. Earlier, puppet used to fail to list
instances in solaris 11 due to these properties being absent. This patch ensures that failures
due to these properties are caught and a default value returned if we get an error.
(maint) Ignore the packaging workdirs

This patch adds the pkg and ext/packaging directories to .gitignore
(#13563) Verify CSRs against the embedded public key

This adds a verification check when signing a certificate to ensure proof of
possession of the private key used to sign the CSR.
(packaging) add ips packaging for solaris 11

This patch adds ips packaging support for using the packaging repo ips
tasks.

This checkin contains:
- ips_repo in buidl_defaults.yaml
- smf services for puppet master and agent (manifests and methods)
- rules for ensuring that the puppet is installed in correct places
- transforms on the manifest that ensures that correct permissions and
  attributes are set for files and directories.
Merge pull request #1108 from vrthra/packaging/ips_repo

packaging/ips_repo
Merge pull request #1106 from pcarlisle/ticket/3.x/13563-verify-crl

(#13563) Verify CSRs against the embedded public key
(#16275) Don't set $environment as a local fact

The environment set by set_local_facts was not always correct. Since the node
object should always have the correct environment now we should just use that.
Merge pull request #1115 from pcarlisle/ticket/3.x/16275-catalog-environment

(#16275) Don't set $environment as a local fact
(#7962) Added settings class for handling time intervals.

The DurationSetting converts strings with units into a number of
seconds, but more importantly guarantees that the setting will be an
integer. The following settings can now be specified as durations:

  configtimeout
  filetimeout
  waitforcert
  splaylimit
  runinterval
  rrdinterval
  ca_ttl

Since multiple settings can use this format, the description was removed
from `ca_ttl` to be added to the config section of puppet-docs.

Also note, since many of these settings specify sub-hour times, the unit
'm' was added for specifying times in minutes.
(#7962) Added rate-limiting logger utility

`Puppet::Util::Log::RateLimitedLogger` is a class that includes the
standard logging module and so responds to `info`, `warning`, etc. It
uses log messages themselves as keys to a hash that records the last time
they were logged and at which level. When a message is logged, it first
checks the record and ignores the call if the given time interval has
not yet elapsed since the last time it was logged.
(#7962) Added `from_instance()` method to base SSL class

Instead of creating certificates by turning OpenSSL::X509::Certificate
instances into strings then back into a new instance, just reuse them.
This method is on the base SSL class, so it can be used for keys,
certificate requests, etc.

The side effect of this change is that extracting the certificate 'name'
out of its subject is abstracted (`name_from_subject()`), and it no
longer calls downcase on the name. This is safe since it's downcased in
the base class constructor, and also provides a prettier 'name' if
needed.
(#7962) Added certificate expiration 'nearness' logic

`Puppet::SSL::Certificate` now has a `near_expiration?` method that
takes a time interval and returns whether its expiration is within that
window from now. The time interval defaults to a new config setting
called `certificate_expire_warning` which defaults to 60 days.
(#7962) Added certificate expiration checks.

Warnings are logged both when receiving a request and issuing a request
so that both the master and agent logs contain warnings. This increases
visibilty since the master logs are looked at more frequently, but also
ensures that the warnings make it into agent reports.

The new `Puppet::Network::Authentication` module contains the logic for
logging the expiration warnings (certificates are part of the
authentication process, hence the name). It uses a rate-limited logger
so that identical warnings as a result of multiple requests in the same
run are not logged. The minimum time between log messages is set to the
`runinterval` setting, since it is a good tradeoff between ensuring
visibility and noisiness.
(maint) Update to tests for solaris

This patch updates the acceptance tests to run under solaris.
- avoid -v option for rm
- do not use -q for grep
- hostname returns fqdn in solaris so do not use hostname -f
(acceptance) utils: add zoneutils to acceptance lib

This commit adds two methods clean, and setup to zoneutils. These are to
be used for teardown and prepare on all zone test cases.
(acceptance) zone: add test case to check for ip functionality

This commit adds test cases to zone that checks for the ip parameter usability
(acceptance) zone: add test case to check for dataset functionality

This commit adds test cases to zone to check the dataset functionality
- idempotency
- single elements
- array features.
(acceptance) zone: path test cases

This patch adds test cases for checking path functionality and its validation
it also checks if the zone can be installed. Additionally, we increment the
default size of the partition to be created to 1G
(acceptance) zone: step zone states one at a time

This patch adds test cases to verify that the zone provider can
transition from each state to the next. (We do not make use of
statemachine for listing states)
(acceptance) zone: test cases for the included statemachine

This patch adds test cases to verify that the state machine included in
zone does indded make the zone provider pass thourgh intermediate states.