(#21869) Fix recursion in cert expiration check

During every authenticated request, the expiration date of the involved
certificates is checked. However, if the localhost cert is loaded when the CA
cert is not present an authenticated request will be initiated to download the
CA cert. This triggers another expiration check for authenticated requests,
which loads the localhost cert, which initiates another authenticated request
to download the CA cert... and so on until stack space is exhausted.

This patch skips the expiration check for the localhost cert if the CA cert is
missing.
(maint) Handle empty or malformed JSON lockfiles

If a JSON lockfile was empty or had malformed JSON, it would raise a
PSON::ParserError and could lead to application failures with an unclear
cause. This commit changes the JSON lockfile behavior to treat empty or
malformed file contents to be nil and generate warnings when the file
contents are malformed JSON.
(packaging) Update PUPPETVERSION to 3.4.0-rc1
Merge tag '3.4.0-rc1' into stable

3.4.0-rc1

* tag '3.4.0-rc1': (465 commits)
  (packaging) Update PUPPETVERSION to 3.4.0-rc1
  Maint: Note that mount points autorequire any parent mounts
  (#11563) Create an explicit ace if the old ace is inherited
  Maint: Explain the format and effect of install_options for the RPM provider
  (#11563) Output human readable security descriptor
  (maint) Extract common acceptance setup script for Jenkins
  (#11563) Implement pending tests for when permissions are insync
  (#11563) Fix issues when running as SYSTEM
  (#11563) Cleanup tests
  (Maint) Change usages of `and` to `&&`, and `or` to `||`
  (#11563) Return INHERIT_ONLY_ACEs
  (#11563) Preserve deny ACEs
  (#11563) Only rewrite the DACL if the mode changes
  (#11563) Refactor DACL parsing
  (#11563) Model Windows security descriptors
  (Maint) Eliminate Windows network lookups
  (Maint) Refactor method names in file_spec
  (Maint) Refactor expectations for at least one inherited system ace
  (Maint) Refactor expectations when system granted full access explicitly
  (Maint) Be more explicit about when the SYSTEM ACE is overwritten
  ...
(maint) Skip enc test on lucid

Currently the lucid runs of this test are failing pretty frequently because
of difficulties getting to rubyforge.org.  This change would skip this
test on lucid.

We're already skipping this test on other platforms due to various difficulties
(read the log for this file). And activerecord is a deprecated feature, so this
test won't be around for too much longer.  Meanwhile, we have decent coverage
of this feature since it still runs against RHEL5 and newer Ubuntus.
Merge pull request #2121 from kylog/maint/stable/enc-confine-off-lucid

(maint) Skip enc test on lucid
Merge remote-tracking branch 'upstream/stable'

* upstream/stable:
  (maint) Skip enc test on lucid
Merge pull request #2097 from adrienthebo/maint-empty-lockfile

(maint) Handle empty or malformed JSON lockfiles
(#22363) Add [] method to PPatternType to create regexp.

The future evaluator makes it possible to reference types and perform
operations on them. This implements an operation that allows a regular
expression to be created from a string. Thus, String interpolation can
be performed when constructing a regular expression.

Example:
  $name = 'Fred'
  $a ~= Pattern["[a-z]*:${name}"]
  $b = Pattern['.*']
(#22363) Extend type system with PHostClassType and PResourceType

This extends the type system with support for host classes and
resources. The primary reason for adding these to the type system is
that the evaluator needs to expose something that represents references
to types. In the 3.x these were simply qualified
references/names/strings that only resolved to a type when passed as
values to certain methods in the runtime.
(#22363) Add type parameter to PType

This adds a type parameter to PType (the type of types). Without this it
is not possible to infer types (everything reduces to PType).

As an example, the evaluator want to assert that an Array only contains
Resources (e.g. when evaluating x -> y). In the language, it is not
possible to directly manipulate instances of resources (they are in the
catalog, only the handles can be passed around and be manipulated).

The idea is that instead of using strings, or qualified references or
stringified 'File[foo]' as references, these are instead represented as
types! This centrailizes the handling of what a "resource reference" is.

This change thus infers(T) to be Type[T]. As an example the array
[PIntegerType, PStringType] is infered to have the type
Array[Type[Literal]].
(#22363) Add abstract type PCatalogEntryType

An abstract type for things that are catalog types (host classes and
resources) is needed to be able to assert things like
Array[CatalogEntry].
(#22363) Remove super type from PHostClassType

It was a bad idea. The super_class has to be resolved at runtime after
having loaded the class. (The same way it is done for Ruby types).

This commit just removes the ability to declare a PHostClass with a
super type.
(#22363) Add [] type operation to subtypes of PCatalogType

The [] operator is defined for PHostClassType and PResourceType to
allow unspecific types to be used as templates for creating specific
type references.

i.e. to support the expressions
File['a'], Class['a']
more naturally by applying [] to the LHS base type.
(#22363) Add test of capability to create array of types using []

This checks the feature that class and resource references support
the shorthand notation X[a,b,c] to produce [X[a], X[b], X[c]].

This applies only to subtypes of PCatalogType. It is not possible to
create an Array of other parameterized types.
(#22454) Fix partial shadowing of match variables.

Scope only performed partial shadowing of match variables. This was
caused by a search of missing numeric variables in outer scopes.

This commit changes that by making the most nested match scope
authoritative wrt numerical variables. It also changes the scope to use
individually stored variables to simply looking them up in the match
data that is used to construct the match scope.

The scope_spec is changed to test for this. Some other tests changes as
a consequence of the internal refactor.
(maint) Remove unused ephemeral?(name) from scope.

The method was only used from scope_spec.rb
(#22363) Add "future evaluator"

This commit contains the initial work on a new evaluator. It operates
on the output of the future parser.
(#22363) Add variables tests and fix evaluation implementation.

This adds testing of variables, assignment and += assignment in various
forms. The + operator has been broken out to a separate method to be
used by both + and +=.

Corrects calls in runtime support (3x must have string variables names).
Corrects problems in the rspec helper w.r.t top/local scope and making
sure there is a topscope (to lookup ::x namespaced variables).
(#22363) Remove defunct testing of type operations

The functionality was moved to streamline the type model. The operations
are now implemented (and tested) as part of AccessExpression (i.e. it is
a language feature to apply [] operator on types, not an intrinsic
capability of a type).