(#15791) isolate deterministic random function

We should not fiddle with the global seed, as other people
might still depend on Kernel.rand() not being that deterministic
as it is the idea with the fqdn_rand function.

However, as ruby < 1.9.2 does not provide such a nice solution, as
a dedicated Random class we simply call Kernel.srand() again on ruby
< 1.9.2 -> Reinitialize with a less deterministic seed.
Remove some duplicate code, simplify

The this_csr_is_for_the_current_host method appeared twice (apparently a
merge error), and produced more confusion than was removed by factoring
it out of the generate_certificate_request method, since "this" in this
case is a host, not a CSR.
Use the `message` method to get exception info

Withot this, the error is "Could not request certificate: system lib",
which is not very helpful.
Merge pull request #1563 from djmitche/log-exception-message

Use the `message` method to get exception info
Merge pull request #1558 from djmitche/dupcode

Remove some duplicate code, simplify
Merge pull request #1539 from duritong/fix/master/15791_do_not_fiddle_with_global_seed

(#15791) isolate deterministic random function
(Maint) Ensure that kick tests don't trigger an agent run

This commit fixes the infamous error that appeared periodically as:

````
  1) Puppet::Application::FaceBase#parse_options should stop if the first thing found is not an action
     Failure/Error: @logs.map(&:message).should == ["'basetest' has no 'banana' action.  See `puppet help basetest`."]
       expected: ["'basetest' has no 'banana' action.  See `puppet help basetest`."]
            got: ["Could not run Puppet configuration client: Not a directory - /dev/null/state/agent_catalog_run.lock", "'basetest' has no 'banana' action.  See `puppet help basetest`."] (using ==)
````

The error came from the spec for Puppet::Application::Kick, which tried
to test the error responses from the application calling Puppet::Run.
Unfortunately only one of the 4 tests actually stubbed out the call
which ends up invoking a puppet run via Puppet::Run.

The reason this was so hard to track down is that it only occured if the
thread that was created for the puppet run executed during the later
test and added a message into the log messages tracked in memory. To
find this the kick test and the face_base test were run repeatedly until
the error occurred.

In 2.7.x, this done using ruby 1.9 with the command:

$ rspec --tag "~@fails_on_ruby_1.9.2" spec/unit/application/kick_spec.rb
  spec/unit/application/face_base_spec.rb
Merge remote-tracking branch 'upstream/2.7.x' into 3.1.x

* upstream/2.7.x:
  (Maint) Ensure that kick tests don't trigger an agent run
Merge remote-tracking branch 'upstream/3.1.x'

* upstream/3.1.x:
  (Maint) Ensure that kick tests don't trigger an agent run
Merge pull request #1564 from ffrank/ticket/master/656-cron-dont-keep-refreshing

(#656) keep crontab from re-applying certain commands
(#15561) Extract CN from certificate subjects more carefully

When using certificate chaning or otherwise generating SSL certificates
outside of Puppet, the subject often has multiple components, e.g.,
  CN=hostname.foo.com,O=Foo\, Inc.,OU=Marketing
The hostname, which is later verified against a strict set of allowed
characters, is only extracted from the "CN" field, with all of the other
fields ignored.

This uses OpenSSL::X509::Name to parse the DN's, allowing both
rfc2253-formatted and openssl-formatted DNS, as seen from Apache and
nginx, respectively.
(#15561) Make implementation match spec examples

Without this patch applied, the following spec failure occurs.

    3) Puppet::Util::SSL when getting a CN from a subject should return nil for a bare string
       Failure/Error: described_class.cn_from_subject("/CN=foo").should == nil
       NoMethodError:
         undefined method `to_a' for "/CN=foo":String
       # ./lib/puppet/util/ssl.rb:23:in `cn_from_subject'
       # ./spec/unit/util/ssl_spec.rb:47:in `block (3 levels) in <top (required)>'

This failure is caused by the implementation of the `cn_from_subject` method
calling `to_a` on the string, which raises an exception.

This patch makes the implementation match the specified behavior by checking
for the `to_a` method.  If false, `nil` is returned as expected.
(#15561) Doc only YARD cleanup change
(#15561) Fix spec failure in certificate_request_spec

Without this patch applied, the x.509 CN extraction improvements cause
the following spec failure in the certificate_request_spec.rb file

      1) Puppet::SSL::CertificateRequest when converting from a string should create a CSR ...
         Failure/Error: described_class.from_s("my csr")
         NoMethodError:
           undefined method `to_a' for "/CN=Foo.madstop.com":String
         # ./lib/puppet/util/ssl.rb:23:in `cn_from_subject'
         # ./lib/puppet/ssl/base.rb:54:in `name_from_subject'
         # ./lib/puppet/ssl/base.rb:62:in `from_instance'
         # ./lib/puppet/ssl/base.rb:71:in `from_s'
         # ./spec/unit/ssl/certificate_request_spec.rb:42:in `block (3 levels) in <top (required)>'

Poor stubbing is the root cause of this problem.  The mock certificate
object returns a String from `#subject`, however the system expects a
kind of `OpenSSL::X509::Name`.

This patch addresses the problem by changing the mock object to return
an instance of `OpenSSL::X509::Name` when the mocked `#subject` instance
is called.
(#15561) Merge branch 'djmitche-bug15561-subject-fix'

* djmitche-bug15561-subject-fix:
  (#15561) Fix spec failure in certificate_request_spec
  (#15561) Doc only YARD cleanup change
  (#15561) Make implementation match spec examples
  (#15561) Extract CN from certificate subjects more carefully

closes #1556
Handle exceptions in verify_callback

These exceptions are otherwise ignored, with a message telling you the
exception was ignored but not actually telling you what the exception
was.
Merge branch 'djmitche-verify_callback_errors'

* djmitche-verify_callback_errors:
  Handle exceptions in verify_callback

closes #1561
(maint) update cron whitespace strip acceptance test

Since f5d236702 leading and trailing whitespace was stripped from the
cron command to ensure writing cron entries is idempotent. This made the
cron `should_not_rewrite_with_trailing_whitespace.rb` acceptance test
meaningless. This commit updates the acceptance test to confirm the fix
for #656 and updates the test name to reflect the expected behavior.
Merge pull request #1566 from adrienthebo/maint-cron_acceptance_test_failure

(maint) update cron whitespace strip acceptance test
(#12493) Add note that `user` defined in a scheduled_task resource must be a privileged user.

The scheduled_task resource includes a note about issues surrounding the use of the 'SYSTEM'
user and recommends choosing another user to run the scheduled task, or altering the security
policy to allow the 'SYSTEM' account to run scheduled tasks. The note does not mention
that puppet must be running as a privileged user to manage scheduled tasks in order to avoid
'access denied' errors.

This commit corrects the issue by adding a note that puppet must be running as a privileged
user to manage scheduled tasks and avoid 'access denied' errors.