Removed text/marshal support

Removing text/marshal support in order to close the security
vulnerability described in Bug #13552.
Fix for bucket_path security vulnerability

This is a fix for Bugs #13553, #13418, #13511. The bucket_path parameter
allowed control over where the filebucket will try to read and write to.
The only place available to stop this parameter is in the resolution
from a URI to an indirectory terminus. The bucket_path is used
internally for local filebuckets and so cannot be removed completely
without a larger change to the design.

Conflicts:

	lib/puppet/network/http/api/v1.rb
	spec/unit/network/http/api/v1_spec.rb

Conflicts resolved by modifying the patch to fit the use of
Puppet::Indirector::Request in the code.
(#13260) Use mktmpdir when downloading packages

This fixes a security vulnerability in the appdmg and pkgdmg providers where
they would curl packages directly into /tmp and the install them, allowing an
attacker to craft a symlink and overwrite arbitrary files or install arbitrary
packages.

Conflicts:

	lib/puppet/provider/package/appdmg.rb
	lib/puppet/provider/package/pkgdmg.rb
Refactor pkgdmg specs

Refactor to a more current spec style. Several of these specs didn't actually
test anything. They have either been deleted or made more specific.

Conflicts:

	lib/puppet/provider/package/pkgdmg.rb
(#13260) Spec test to verify that mktmpdir is used
Stub mktmpdir and remove_entry_secure in os x package providers
Updating CHANGELOG and lib/puppet.rb for 2.6.15
Merge branch 'security/2.6.14/filebucket-bucket-path-security' into 2.6.x
Revert "(#5246) Puppetd does not remove it's pidfile when it exits"

This reverts commit e0e31d571f38a3f0436e43ea6662f6d6c1e525c5.

This commit caused spurious error messages when running `puppet agent -t` if
the agent was also running daemonized (#12188). It would display an error of
unable to remove pidfile, but the error would not affect the exit code.
Updating CHANGELOG and lib/puppet.rb for 2.6.16
(#12392): Colorize console output on Windows

Previously, `Puppet[:color]` was false on Windows, because the Windows
console does not support ANSI escape sequences.

The win32console gem converts ANSI color escape sequences into Win32
console API calls to change the foreground color, etc. If the output
stream has been redirected to a file, then the gem does not translate
the sequences, instead preserving them in the stream, as is done on
Unix.

To disable colorized output specify `color=false` or `--color=false` on
the command line.

This commit adds a `Puppet.features.ansicolor?` feature that defines
whether ANSI color escape sequences are supported. On Windows, this is
only true if the win32console gem can be loaded. On other platforms, the
value is always true.

The win32console gem will be packaged into the Windows installer, and
so, `Puppet[:color]` now defaults to true. If the gem can't be loaded,
then puppet will revert to its previous behavior.
(#13645) Do not open a smtp connection if nothing to report

If tagmail finds out that there are no messages that have to be sent to
anyone puppet will still open a smtp connection (if smtpserver is set)
and then close the connection without sending any data. This can lead
to a lot of syslogmessages on your smtp server like

   sendmail: puppet.example.com did not issue MAIL/EXPN/VRFY/ETRN
   during connection to MTA

The fix now does not even enter the send method if there are no reports
to be sent. This does also prevent unnecessary forking if there are no
reports.
(#13645) Add test cases to tagmail_spec

If puppet is configured to use tagmail as a report, it should not send
an email if no message match any tag in tagmail.conf

The former behaviour was that puppet opened an smtp connection, did not
send any mail and then closed the connection again leading to errors on
the smtp server. The added tests now prove that the send method is never
even called when no message match any positive tag.
(#14123) Puppet shouldn't explode if PATH contains ~nonexistent_user

As reported in http://bugs.debian.org/669650, when the PATH contained an
expansion for a user that doesn't exist, Puppet handled it the same way Ruby
does - to raise an exception, and explode.

Leaving aside the sanity of literal tilde in the PATH, we shouldn't explode in
that case - we should just skip that entry and carry on to the next element in
the path instead.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(#14127) ssh_authorized_keys grammer fails on blank lines.

The `ssh_authorized_keys` grammer, defined for ParsedFile, is wrong about both
comments and blank lines.  Specifically, it failed in two key ways:

It failed if a comment didn't start on character one; any whitespace caused
the comment to be ignored, which is absolutely incorrect by the official
OpenSSH implementation.

It also failed because a "blank" line was defined as a line that contained one
or more whitespace characters at the start - and nothing more!

This failed in a bunch of ways, starting with assuming that a comment on a
line with leading whitespace was actually a blank line.

This change fixes both of those bugs, as well as adding appropriate tests.

(See `rsa_key_allowed_in_file` in `auth-rsa.c` for the parser, at least in the
 current as of this commit version of OpenSSH.  That is official enough for me
 to assume that everyone will behave that way ;)

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>
(maint) Ensure every file has a trailing newlines

Without this patch some files exist in the tree that don't have trailing
newlines.  This is annoying because perl -pli.bak -e will automatically
add a newline to every file it modifies in place.  The files that
actually have modifications by the global search and replace need to be
separated from the files that only have newlines added.

This patch simply adds newlines to everything if they don't exist on the
last line.

Yes, the PNG's are perfectly fine with a trailing newline as well.
(#13682) Rename Puppet::Module::Tool to Puppet::ModuleTool

Without this patch, Puppet will monkey patch the existing implementation
of the puppet-module Gem if it is used.  This is bad because the two
implementations are all jumbled up inside of one another and behavior
may become unpredictable.  Warnings are also displayed directly to the
end user in the form of redefined constants.

This patch fixes the problem by renaming Puppet::Module::Tool inside of
Puppet to Puppet::ModuleTool  This fixes the problem because Puppet will
no longer monkey-patch the Puppet::Module::Tool module inside of the
puppet-module Gem.

This patch also has the added benefit of making the Module's name match
up with the CamelCase filepath (puppet/module_tool/ =>
Puppet::ModuleTool)  As a result, no file moves are necessary.
(#13682) Fix acceptance test failures

On Lucid, /usr/share/puppet may not exist.  The module upgrade tests all
make the assumption that this parent directory exists.  This causes
false positive failures when running systest against a Lucid system.

This patch modifies the setup code for all of the tests to ensure the
parent directory exists.
Merge branch 'ticket/2.7.x/13682_puppet_should_not_conflict_with_released_puppet-module_gem' into 2.7.x

* ticket/2.7.x/13682_puppet_should_not_conflict_with_released_puppet-module_gem:
  (#13682) Fix acceptance test failures
  (#13682) Rename Puppet::Module::Tool to Puppet::ModuleTool
  (maint) Ensure every file has a trailing newlines

Reviewed-by: Daniel Pittman
Reviewed-by: Matthaus Litteken
Reviewed-by: Kelsey Hightower
maint: refactor integration specs for ssh_authorized_key

Replace all before blocks and instance variables with rspec let methods
and move the stubbing of File.chmod that happened in all tests to the
top to reduce code duplication.