(#14985) Fix hiera lookup for calling_module and calling_class
(#14985) Fix hiera does not lookup calling_class and calling_module
(#14985) Fix test, return downcase values and check for nil scope.source
(#14985) Fix exception when nil is returned from inner scope
(#14985) Ensure hostclass finder is private

The nested definition of the recurse_for_hostclass method caused that
method to be created lazily and as a public method. By pulling it out to
be declared outside the calling method it can be made private and
created only once. It has also been renamed to show the intention
instead of the mechanism (recursion).
(Maint) Require Hiera::Config to avoid warning

When the hiera tests were run alone the puppet_backend_spec.rb issued a
warning:

  /Users/andy/work/puppet/spec/unit/hiera/backend/puppet_backend_spec.rb:25:
  warning: toplevel constant Config referenced by Hiera::Config

The warning was caused by a reference to Hiera::Config where Hiera was
defined, but Hiera::Config was not. This resulted in getting the top
level Config constant and a warning being issued. By requiring
hiera/config this problem is avoided.
(Maint) Use real scope in testing

Using the real scope is completely possible in these tests since it has
no dependencies on the outside world and is essentially a value object.
Therefore it should be used in the tests to make them more
comprehensive.
(#14985) Describe behavior of calling_(class|module)

The original tests for calling_module and calling_class used a mock,
when this is really just a value that can be setup. It also didn't
separate out and describe the behavior of the two pieces in the
variations in which they can come up. Specifically the difference
between a `define` and a `class` for the meaning of calling_class.
(Maint) Clarify scope lookup rules

The lookup rules for variables in the puppet language have always been a
bit hard for me to understand. I knew the rules as

  the current scope => inherited => node => topscope

but the code never seemed to express that clearly. This refactors the
`lookupvar` method to extract out a few pieces to make that clearer.
Specifically the mechanism for walking from a class to the enclosing
node (which is why this gets the name "two-step" by some people) has
been called out as a lookup of the `enclosing_scope`. Calling out the
enclosing scope as a specific lookup allows for getting rid of the
`:origin` part of the options hash, which was to provide a mechanism for
skipping over some scope objects.

This also tries to remove some duplication that was occurring because
there was not a consistent symbol table concept. It turns out that the
existing `Ephemeral` fits that nicely and so it now used as the scope's
symbol table as well as for the ephemeral variables.
(#14985) Preserve casing on looked up values

The initial fix for looked up values downcased everything that was being
returned. This causes problems when the data is not a string that the
previous behavior was to only do this for the calling_class and
calling_module. This commit us returns to that behavior.
(Maint) Extract constant strings as constants
Add recognizable prefix string to profiling log statements

This commit simply prefixes the profiling log strings with
the word "PROFILE", so that they are easy to grep for in
the output.
Revert "Merge branch 'pull-1540'"

This is causing spec failures on windows, and the current implementation
of the crontab provider and the parsedfile provider is sufficiently
complex that it's not clear how to sanely fix this issue. This is
getting reverted until it's in a more understandable state.

This reverts commit f85ec37456095c06a7b0d99a752534d0caf9c97e, reversing
changes made to 138fc337c36715a7ab40b2b68b86aa71ec3ada64.
Maint: Fix a markdown glitch in hiera_include doc string

Without a line break, markdown parsers would fail to render the
yaml example as a code block.
Add test for new PROFILE prefix on log messages
Merge pull request #1581 from nfagerlund/hiera_markdown

Maint: Fix a markdown glitch in hiera_include doc string
Merge pull request #1545 from cprice-puppet/maint/master/make-profiling-output-greppable

Add recognizable prefix string to profiling log statements
Add example external CA data provided by Dustin Mitchell

Without this patch applied we don't have an easy way to create a set of
CA and SSL certificates that are representative of how end users are
currently using external CA's with Puppet.

This is a problem because we're left to guess how users are using Puppet
while trying to support external CA's.

This patch adds additional data created by Dustin's `certchain.sh`
script which are not being actively used in the acceptance tests.
They're included in Puppet in an effort to reduce roadblocks to
augmenting the existing acceptance tests.
Add PuppetX::Acceptance::ExternalCertFixtures class

This patch adds the static fixture data that is explicitly used by the
ExternalCertFixtures class.  This class will make the fixture data
located in the filesystem available to the acceptance test itself.
(#15561) Add External CA acceptance test

This patch adds three acceptance tests:

  1: Externally issued certificate chains work.
  2: Email addresses in certificate names work.
  3: Certificate revocation works.

              +-----------------+
              |     Root CA     |
              |  (Self Signed)  |
              +--+------------+-+
                 |            |
           +-----+            +------+
           |                         |
           v                         v
    +-------------+            +------------+
    | Issuing CA  |            | Issuing CA |
    | For Masters |            | For Agents |
    +-------+-----+            +------+-----+
            |                         |
            |                         |
            v                         v
    +-------------+            +-------------+
    | Master SSL  |            | Agent SSL   |
    | Certificate |            | Certificate |
    +-------------+            +-------------+

A master may restrict clients to those with a certificate issued by a
specific DN.  For example, the Apache `SSLRequire %{SSL_CLIENT_I_DN_CN}
== "Agent CA"` directive will only allow agent with certificates issued
by "Agent CA"

These examples exercise Puppet agents checking for revoked master
certificates by populating a CRL file out of band.

Finally, subject names with email addresses in the name are checked in
an effort to prevent regressions on #15561.  For example,
`CN=agent-email3.example.org/emailAddress=test@example.com`.

This fixture data is intended for, and supported on, EL-6 master hosts
with Apache 2.2 or later and Passenger 3.0.17 from EPEL.

This test is confined to the `el-6` platform.

Expected output on the agent when the master certificate has been
revoked is:

    Error: Could not retrieve catalog from remote server:
    SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
    [certificate revoked for /CN=master1.example.org]
    Error: Could not retrieve catalog; skipping run