(maint) Whitespace only settings_spec.rb cleanup
Without this patch there was a bunch of whitespace related issues at the end of
the settings_spec.rb file.  This patch is a whitespace only change that cleans
these up.
Maint: Note in docs that the file type's "replace" attribute defaults to true
Update CHANGELOG lib/puppet.rb conf/redhat/puppet.spec for 2.7.18
Enforce "must not should" on Puppet::Type instances in tests.

Because we define a `should` method on Puppet::Type, and that conflicts with
the identically named method in RSpec, we have an alias for `must` defined in
the test helper.

Sadly, this isn't *complete*: if you call `should` on those instances you
actually get no failure, it just silently ignores your actual test.

This change monkey-patches Puppet::Type in the spec helper, and adds a type
check to fail hard if you supply something "illegal" as the argument to
Puppet::Type.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Fix all trivial "should to must" errors in our tests.

We had a bunch of places that used the wrong invocation to test something on a
resource instance, revealed by the previous change.

This fixes all the trivial instances - the places that are *correct* despite
not actually being tested for a long while.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Fix type check when transforming catalog.

Because `should` rather than `must` was called, this test previously didn't
do anything.  This hid the fact that it was actually bad: it asserted that we
had an instance of Puppet::Type, not a subclass of it, and we have the later.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Fix broken ability to remove resources from the catalog.

For the last forever, the Puppet catalog object has unable to remove resources
correctly - they used the wrong key to remove items from an internal map.

Because the test was broken we also ran into a situation where this simply
wasn't noticed - and, presumably, we simply didn't depend on this in the real
world enough to actually discover the failure.

This fixes that, as well as the bad test, to ensure that the feature works
correctly, and that it stays that way.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Fix broken TransBucket transformation tests.

This fixes the membership test to check actual resources rather than checking
if the TransBucket object itself is part of the catalog - it isn't, and hasn't
been for approximately ever.

It also eliminates a test that resources are "finalized" - a concept that
isn't valid in the code and hasn't been for years, if ever.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Eliminate require calls at runtime.

Calling `require` is a surprisingly expensive operation, especially if
ActiveRecord has been loaded.  Consequently, the places where we do that in
the body of a function are hot-spots in the profile.

They are also, generally, pretty simple and clear wins: almost all of them can
simply require the library the first time they are loaded and everything will
work fine.

In my testing with a complex, real-world set of manifests this reduces time
spent by ~ 3 wall-clock seconds in require and all children.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
Don't allow resource titles which aren't strings

It was possible to create resources whose titles weren't strings, by
using a variable containing a hash, or the result of a function which
doesn't return a string. This can cause problems resolving relationships
when the stringified version of the title differs between master and
agent.

Now we will only accept primitives, and will stringify them. That is:
string, symbol, number, boolean. Arrays or nested arrays will still be
flattened and used to create multiple resources. Any other value (for
instance: a hash) will cause a parse error.
Merge pull request #913 from daniel-pittman/perf/2.7.x/eliminate-require-in-functions

Perf/2.7.x/eliminate require in functions
Merge pull request #912 from daniel-pittman/maint/2.7.x/tests-must-use-must-not-should-on-resources

tests must use must not should on resources
(#3120) Disambiguate the localcacert setting

Without this patch applied the localcacert setting is woefully
overloaded.  The following behaviors are layered on top:

 * Client authentication of the SSL server
 * Server authentication of the SSL client
 * Puppet CA signing and issuing certificates

In addition, we plan to fully support CA chains in #3143 which will
introduce two additional scenarios of CA certificates that build trust
but are not used for authentication.

Puppet has assumed in the past that all of these behaviors built on top
of a single, self signed CA certificate.

This is a problem because there is no distinction between a bundle of CA
certificates that are usable to authenticate the peer in an SSL
connection.

This patch fixes the problem by introducing two new configuration
options, ssl_server_ca_auth and ssl_client_ca_auth.  Both of these
settings will default to the localcacert setting.

This is slightly confusing because the file pointed to by the
localcacert setting could contain a bundle of CA certificates.  However,
Puppet would treat this file as the CA certificate itself so any use of
multiple CA certificates would only work by accident.

With this patch we now explicitly support authenticating against
multiple certificate authorities but we do not yet fully support
authenticating against chained certificate authorities.

The patch also introduces ssl_client_ca_chain and ssl_server_ca_chain as
commented out options in defaults.rb because these options will be
required for #3143.

Paired-with: Patrick Carlisle <patrick@puppetlabs.com>
Merge pull request #916 from jeffmccune/ticket/3.0rc/3120_disambiguate_localcacert

(#3120) Disambiguate the localcacert setting
(#3120) Fixup default descriptions

PR 916 had some poorly formatted descriptions for the new options.  This
patch cleans up those descriptions and makes their relationship to
localcacert more clear.

The new look is:

    # Where each client stores the CA certificate.
    # The default value is '$certdir/ca.pem'.
    localcacert = /etc/puppet/ssl/certs/ca.pem

    # Certificate authorities who issue server certificates.  SSL servers will not be
    # considered authentic unless they posses a certificate issued by an authority
    # listed in this file.  If this setting has no value then the Puppet master's CA
    # certificate (localcacert) will be used.
    # ssl_client_ca_auth =

    # Certificate authorities who issue client certificates.  SSL clients will not be
    # considered authentic unless they posses a certificate issued by an authority
    # listed in this file.  If this setting has no value then the Puppet master's CA
    # certificate (localcacert) will be used.
    # ssl_server_ca_auth =
Merge branch 'fixup/3.0rc/defaults' into 3.0rc

* fixup/3.0rc/defaults:
  (#3120) Fixup default descriptions
(#11868) Use `Installer` automation interface to query package state

Previously, Puppet recorded MSI packages it had installed in a YAML
file. However, if the file was deleted or the system modified, e.g.
Add/Remove Programs, then Puppet did not know the package state had
changed.

Also, if the name of the package did not change across versions, e.g.
VMware Tools, then puppet would report the package as insync even though
the installed version could be different than the one pointed to by the
source parameter.

Also, `msiexec.exe` returns non-zero exit codes when either the package
requests a reboot (194), the system requires a reboot (3010), e.g. due
to a locked file, or the system initiates a reboot (1641). This would
cause puppet to think the install failed, and it would try to reinstall
the packge the next time it ran (since the YAML file didn't get
updated).

This commit changes the msi package provider to use the `Installer`
Automation (COM) interface to query the state of the system[1]. It will
now accurately report on installed packages, even those it did not
install, including Puppet itself (#13444). If a package is removed via
Add/Remove Programs, Puppet will re-install it the next time it runs.

The MSI package provider will now warn in the various reboot scenarios,
but report the overall install/uninstall as successful (#14055).

When using the msi package resource, the resource title should match the
'ProductName' property in the MSI Property table, which is also the
value displayed in Add/Remove Programs, e.g.

    package { 'Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148':
      ensure => installed,
      ...
    }

In cases where the ProductName does not change across versions, e.g.
VMware Tools, you MUST use the PackageCode as the name of the resource
in order for puppet to accurately determine the state of the system:

    package { '{0E3AA38E-EAD3-4348-B5C5-051B6852CED6}':
      ensure => installed,
      ...
    }

You can obtain the PackageCode in ruby using:

    require 'win32ole'
    installer = WIN32OLE.new('WindowsInstaller.Installer')
    db = installer.OpenDatabase(path, 0)
    puts db.SummaryInformation.Property(9)

where <path> is the path to the MSI.

The msi provider does not automatically compare PackageCodes when
determining if the resource is insync, because the source MSI could be
on a network share, and we do not want to copy the potentially large
file just to see if changes need to be made.

The msi provider does not use the `Installer` interface to perform
install and uninstall, because I have not found a way to obtain useful
error codes when reboots are requested. Instead the methods
`InstallProduct` and `ConfigureProduct` raise exceptions with the
general 0x80020009 error, which means 'Exception occurred'. So for now
we continue to use msiexec.exe for install and uninstall, though the msi
provider may not uninstall multi-instance transforms correctly, since
the transform (MST) used to install the package needs to be respecified
during uninstall. This could be resolved by allowing uninstall_options
to be specified, or figuring out how to obtain useful error codes when
using the `Installer` interface.

[1] http://msdn.microsoft.com/en-us/library/windows/desktop/aa369432(v=vs.85).aspx
Merge pull request #851 from joshcooper/ticket/2.7.x/11868-msi-provider

(#11868) Use `Installer` automation interface to query package state
Merge remote-tracking branch 'cve/2.7rc' into 2.7.x

* cve/2.7rc:
  Update CHANGELOG lib/puppet.rb conf/redhat/puppet.spec for 2.7.18
  Reject directory traversal in store report processor
  Tighten permissions on classfile, resourcefile, lastrunfile, and lastrunreport.
  Use "inspect" when listing certificates
  Don't allow the creation of SSL objects with invalid certnames
  Validate CSR CN and provided certname before signing
  Add specs for selector terminuses of file_{content,metadata}
  Fix whitespace inside parentheses
  Use head method to determine if file is in file bucket
  Always use the local file_bucket on master
  Fail more gracefully when finding module files if no file is specified
  Reject file requests containing ..
  Add Selector terminus for file_content/file_metadata
  Deprecate IP-based authentication
(Maint) Document common Windows issues

Added a section to README_DEVELOPER.md that describes common pitfalls to
avoid when developing puppet code that needs to run on Windows.