Add recognizable prefix string to profiling log statements

This commit simply prefixes the profiling log strings with
the word "PROFILE", so that they are easy to grep for in
the output.
Maint: Fix a markdown glitch in hiera_include doc string

Without a line break, markdown parsers would fail to render the
yaml example as a code block.
Add test for new PROFILE prefix on log messages
Merge pull request #1581 from nfagerlund/hiera_markdown

Maint: Fix a markdown glitch in hiera_include doc string
Merge pull request #1545 from cprice-puppet/maint/master/make-profiling-output-greppable

Add recognizable prefix string to profiling log statements
Add example external CA data provided by Dustin Mitchell

Without this patch applied we don't have an easy way to create a set of
CA and SSL certificates that are representative of how end users are
currently using external CA's with Puppet.

This is a problem because we're left to guess how users are using Puppet
while trying to support external CA's.

This patch adds additional data created by Dustin's `certchain.sh`
script which are not being actively used in the acceptance tests.
They're included in Puppet in an effort to reduce roadblocks to
augmenting the existing acceptance tests.
Add PuppetX::Acceptance::ExternalCertFixtures class

This patch adds the static fixture data that is explicitly used by the
ExternalCertFixtures class.  This class will make the fixture data
located in the filesystem available to the acceptance test itself.
(#15561) Add External CA acceptance test

This patch adds three acceptance tests:

  1: Externally issued certificate chains work.
  2: Email addresses in certificate names work.
  3: Certificate revocation works.

              +-----------------+
              |     Root CA     |
              |  (Self Signed)  |
              +--+------------+-+
                 |            |
           +-----+            +------+
           |                         |
           v                         v
    +-------------+            +------------+
    | Issuing CA  |            | Issuing CA |
    | For Masters |            | For Agents |
    +-------+-----+            +------+-----+
            |                         |
            |                         |
            v                         v
    +-------------+            +-------------+
    | Master SSL  |            | Agent SSL   |
    | Certificate |            | Certificate |
    +-------------+            +-------------+

A master may restrict clients to those with a certificate issued by a
specific DN.  For example, the Apache `SSLRequire %{SSL_CLIENT_I_DN_CN}
== "Agent CA"` directive will only allow agent with certificates issued
by "Agent CA"

These examples exercise Puppet agents checking for revoked master
certificates by populating a CRL file out of band.

Finally, subject names with email addresses in the name are checked in
an effort to prevent regressions on #15561.  For example,
`CN=agent-email3.example.org/emailAddress=test@example.com`.

This fixture data is intended for, and supported on, EL-6 master hosts
with Apache 2.2 or later and Passenger 3.0.17 from EPEL.

This test is confined to the `el-6` platform.

Expected output on the agent when the master certificate has been
revoked is:

    Error: Could not retrieve catalog from remote server:
    SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
    [certificate revoked for /CN=master1.example.org]
    Error: Could not retrieve catalog; skipping run
Remove ServerName from Apache Virtualhost

I'm including this small patch because this mis-configuration caused
quite a bit of hurt for me.

Without this patch applied, both virtual hosts running on 8140 and 8141
use the same SSL certificate, the one configured in 8140.  This is a
problem because the second, 8141, virtual host is configured to use a
different certificate that is intended to be rejected by the agent.

Because the first cert is being used the agent does not know to reject
the connection.  This, in turn, caused a false-positive success in the
acceptance test that validates an agent refuses to connect to a rogue
master.

This patch fixes the problem by removing the ServerName statements
included in the virtualhost blocks.  With these statements removed from
the configuration the server on 8140 presents a cert issued by the
Master CA and the server on 8141 presents a cert issued by the Agent CA,
as expected.
(maint) Clean up the httpd.conf used in testing
(#20027) Add acceptance test for ssl_client_ca_auth
(#20027) Spec examples of how ssl_client_ca_auth behaves
(#20027) Fix ssl_client_ca_auth validation

Without this patch applied the `ssl_client_ca_auth` setting does not
cause the behavior documented with the option.

The expected behavior is that the agent should refuse to connect to a
Puppet master which presents a SSL certificate whose chain does not
include a certificate listed in the `ssl_client_ca_auth`.

This patch addresses the problem by scanning through the peer
certificate chain, checking each certificate in the chain against the
set of certificates listed in the `ssl_client_ca_auth` file.  If this
setting is not configured then the `localcacert` file is used instead,
which should be the root, self signed certificate in default
configurations.
(#20027) Refactor connection verify_callback Proc

Without this patch the Proc assigned to `Net::HTTP#verify_callback=` is
difficult to test.  This is a problem because this Proc handles critical
behavior related to authorization and security.

This patch addresses the problem by extracting the anonymous proc into a
class named Puppet::SSL::Validator.  The #call method implements the
Proc API and behaves in the same manner as the anonymous Proc.

This patch also adds explicit behavior tests to cover the #call method
and related authorization checking methods.
Merge branch 'external_ca_support'

* external_ca_support:
  (#20027) Refactor connection verify_callback Proc
  (#20027) Fix ssl_client_ca_auth validation
  (#20027) Spec examples of how ssl_client_ca_auth behaves
  (#20027) Add acceptance test for ssl_client_ca_auth
  (maint) Clean up the httpd.conf used in testing
  Remove ServerName from Apache Virtualhost
  (#15561) Add External CA acceptance test
  Add PuppetX::Acceptance::ExternalCertFixtures class
  Add example external CA data provided by Dustin Mitchell

closes #1572
Revert "Revert "Merge branch 'pull-1540'""

This reverts commit c992fb536d9fd87ad23b2fc0b88592bfe1dea0f5.
(#2251) Rewrite parsedfile method names for clarity

This renames the ParsedFile `self.find_resource` method to
`self.resource_for_record` and changes the method return to return the
resource found. It also adds some yardoc for the methods involved.
(#2251) add specs around resource_for_record
(maint) Mark parsedfile match_providers_with_resources as private
(#2251) correct crontab matching specs

The previous implementation of this spec was exhibiting failures on
windows and was testing behavior out of the scope of the unit test. This
narrows the scope of the given test.