(#23141) Add OpenBSD to the exclusion list for 'remounts' in mount type
On systems without "-o remount", use "-o update" except for AIX.
(#21869) Fix recursion in cert expiration check

During every authenticated request, the expiration date of the involved
certificates is checked. However, if the localhost cert is loaded when the CA
cert is not present an authenticated request will be initiated to download the
CA cert. This triggers another expiration check for authenticated requests,
which loads the localhost cert, which initiates another authenticated request
to download the CA cert... and so on until stack space is exhausted.

This patch skips the expiration check for the localhost cert if the CA cert is
missing.
(maint) Handle empty or malformed JSON lockfiles

If a JSON lockfile was empty or had malformed JSON, it would raise a
PSON::ParserError and could lead to application failures with an unclear
cause. This commit changes the JSON lockfile behavior to treat empty or
malformed file contents to be nil and generate warnings when the file
contents are malformed JSON.
allow configuration of Bundler source
Maint: Copyedit description of source_permissions attribute for clarity
(Maint) Eliminate Windows network lookups

When using a UNC style file path, the windows file provider invokes
File.expand_path('//server/...'), which results in a failed Windows
network lookup. Executing these two tests was previously taking 15.4
seconds.

This commit instead provides a `localhost` server to short-circuit the
lookup. The tests now only take 1.7 seconds.
(#11563) Model Windows security descriptors

Creates objects for modeling windows security descriptors, access control
lists, and access control entries.
(#11563) Refactor DACL parsing

This commit moves the parsing of the DACL into a separate method,
so that it is not coupled with the loading of the DACL.
(#11563) Only rewrite the DACL if the mode changes

Previously, the owner, group, mode getter and setter methods each managed their
part of the security descriptor. This lead to similar, but slightly different
methods, such as GetSecurityInfo being invoked once to get the owner, and
another time to get the dacl.

This commits adds methods for getting and setting the security descriptor,
and updates the owner/group/mode methods to call it. This eliminated duplicate
logic many places, e.g. change_sid, get_sid, set_acl, get_dacl, get_dacl_ptr,
get_security_info, and set_security_info.

This commit also means that if you change the owner and/or group, but not mode,
then the security descriptor will not be marked as protected, and the DACL
will not be rewritten. In other words, puppet won't mess up your file
permissions.

Only if you choose to manage the mode will puppet mark the SD as protected and
rewrite the DACL based on the security descriptors owner/group and specified
mode.
(#11563) Preserve deny ACEs

Previously, puppet would warn if it encountered a deny ACE, and ignore it.
This is a problem now, because we need to be able to accurately round-trip
an ACL when modifying the owner/group.

This commit modifies the DACL parsing code to return the deny ACE in the
returned ACE.
(#11563) Return INHERIT_ONLY_ACEs

Previously, when reading a DACL, puppet excluded `INHERIT_ONLY_ACE`s which are
ACEs set on a directory that only serve to apply permissions to child
containers (dir) and objects (file). In other words, the ACE didn't affect the
permissions of the directory, and wasn't needed to determine the file mode.

However, now we need to be able to roundtrip a security descriptor, e.g. to
only change the owner, but leave other ACEs intact.

This commit modifies puppet to include inherit only aces when reading the
DACL, but continue to exclude them when determining the file mode.
(Maint) Change usages of `and` to `&&`, and `or` to `||`

The operators `and`, `or` have a lower precedence than `&&`,
`||`. This can lead to unexpected results in certain cases. While this
commit is not subject to one of those cases, the change is still made
for consistency sake.
(#11563) Cleanup tests

Cleanup spec test. Use the Everyone sid constants, remove unused
reference to INHERITED_ACE constant, and more robustly assert the
desired outcomes when "preserving aces for other users" and when
"changing the sid for all aces that were assigned to the old
owner".
(#11563) Fix issues when running as SYSTEM

Previously, the tests were failing when running as SYSTEM, because
many of the preconditions were no longer true, as a result of
puppet no longer breaking inheritance when only the owner and mode
are changed, and ensuring the SYSTEM ace grants full control,
unless explicitly specified otherwise.

This commit updates the tests to account for the new behavior.
(#11563) Implement pending tests for when permissions are insync

When permissions are insync, i.e. puppet is actively managing the
owner, group, and mode, then we ensure that an explicit SYSTEM ace has
been added. When source_permissions is set to ignore, we ensure that
an inherited SYSTEM ace has been added.
Merge pull request #2110 from nfagerlund/source_permissions_copyedit

Maint: Copyedit description of source_permissions attribute for clarity
(maint) Extract common acceptance setup script for Jenkins

We have six Jenkins jobs which currently run acceptance, and will soon
have another four for per commit tests.  There is a shell script used to
prepare each job for Rake execution of the actual test run.  This script
currently exists in every job and is slightly divergent across jobs, and
makes updating the prep for each job time consuming and error prone.  So
I'm pulling it into acceptance as a single script to handle untarring of
the artifact and bundle set up for any acceptance job.

This change also provides a means for specifying the git daemon along
with the fork so that you can install from local commits.

Finally it moves repo_proxy and add_el_extras beaker settings into the
common options.
(#11563) Output human readable security descriptor

Overrides `inspect` methods to return human readable sid and flags.
Maint: Explain the format and effect of install_options for the RPM provider