Upgrade to Ring 1.1.1

Ring 1.1.1 contains the necessary changes to its servlet adapter to allow for
inspection of client-supplied SSL certificates. Upgrading also requires an
upgrade to Jetty 7. This required some changes in the handful of monkeypatches
we made to ring-jetty-adapter, though the new versions of ring obviate some of
them (ring now includes support for client-auth, so we no longer need to roll
our own).

The new version of Jetty pulls in its own version of various logging libraries,
and one of these conflicts with the version required by some of the other
libraries we're using. To resolve this conflict, I've excluded the problematic
library from each dependency that tries to fold it in itself, and instead
explicitly require a specific version.

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Utility func for creating a lazy sequence of lines from a file

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Funcs for extracting the CN from an x509 certificate

The JDK helpfully includes a set of classes for parsing x509 certificates and
RFC 2253 LDAP distinguished names, which makes extracting the CN
straightforward.

When encountering a DN with multiple CN's contained within, I opt for the
most-specific CN (which, according to the RFC, is the one that appears last).

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
(#14947) Restrict acceptable client certificates by CN

This patchset implements an optional whitelist for HTTPS clients. If
enabled by the user, we validate that the CN of the supplied client
certificate exactly matches an entry in the whitelist. This feature is
off by default.

This is implemented as ring middleware and a single, additional
configuration option. For plain HTTP connections, all clients are
allowed (as no client certificate will be present).

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Acceptance tests for certificate whitelisting

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Port node query compiler to the resource form

This makes the code much more similar for the two types of queries, and
probably also much faster for complex queries. Right now that means a
lot of duplication, but hopefully it will allow for future unification
into a single query API.
Properly handle non-string node queries

Previously, these would result in 500 errors as the database failed the
comparisons because of mismatched types. Now, all equality comparisons
will be done against strings, and all numeric comparisons will be done
against numbers.

For equality comparisons, non-string arguments will be converted. This
allows natural queries against numbers or booleans to work despite all
fact values technically being strings.

For numeric comparisons, non-numeric arguments will be converted.
However, if the argument doesn't represent a number, the query will
be rejected.
Add a shutdown hook with a log message

This commit basically does two things:

* creates a "shutdown-hook" function that we can potentially use
  for any cleanup that we need to do when we receive an interrupt.
* logs a message that indicates that we're shutting down.
Merge pull request #205 from cprice-puppet/feature/master/shutdown-hook-with-log-msg

Add a shutdown hook with a log message
Use correct puppetlabs-release package for platform

This used to be a single package, but now is platform-specific. So we'll
use lsb_release to figure that out and install the right one.
Merge pull request #206 from nicklewis/use-correct-puppetlabs-release-package

Use correct puppetlabs-release package for platform
Merge pull request #191 from grimradical/client-cert-restriction

Client whitelisting
Simplify function usage

There are cases where threading is used, but doesn't necessarily add
anything by doing so. In the cases where a single function is called on
the data, it reads cleaner to just call that function on the data you
hold.

Also update use of greater-than function as the check is simply for
positive values.
Merge pull request #207 from KushalP/master

Simplify function usage
(#15075) Improve handling of service start/stop during rpm upgrade/uninstall

Prior to this commit there were a few issues with the way we were
handling interacting with the system's puppetdb service during
rpm upgrade and downgrade.  Basically, we were *always* stopping
(and disabling) the service whenever an uninstall occurred; however,
during an upgrade, rpm does an install of the new package followed
by an uninstall of the old package.  We weren't treating this
situation differently, so the service was being stopped.  This
commit does the following:

* On uninstall, we now check to see if this is part of an upgrade
  or not, and we only stop and disable the service if this is
  *not* part of an upgrade.

* On upgrade, we stop the service before we install the new package,
  and restart it after we finish removing the old package.
(#15446) Improve handling of user/group removal on rpm removal

Prior to this commit, we had a few bugs in our handling of
user/group removal during rpm removal:

1. We were not conditioning the calls to groupdel / userdel to
   avoid running them during an upgrade, which meant that we
   were trying to delete them even during upgrades... which would
   have been bad.
2. We had an || where we needed an &&, so we weren't actually
   calling the groupdel / userdel commands.
3. We were hard-coding the user's home dir to a bad path.
4. We had some '-r' flags that were wrong and/or unnecessary.

This commit fixes those issues.
(#15075) State cleanup at the beginning of rpm 'pre' step

This commit just adds a bit of pre-emptive state cleanup
at the beginning of the rpm 'pre' step, to protect against
possible bad behavior if there were any problems during
previous installs / uninstalls.
Merge pull request #208 from cprice-puppet/bug/master/15075-rpm-update-stops-service

(#15075) Improve handling of service start/stop during rpm upgrade/unins...
Improve pre/postconditions for node query
Remove unnecessary, commented tests for node query compiler

These were commented because they test the SQL generated by the
compiler, which is unnecessary and prone to breakage. This is already
tested end-to-end by issuing actual queries.