(maint) Update link to the contributor license agreement

New link: http://links.puppetlabs.com/cla as per Eric.

[ci skip]
Merge branch 'maint/master/cla_link'

* maint/master/cla_link:
  (maint) Update link to the contributor license agreement
(#19379) Clarify documentation for exec logoutput

Re-wording to address two issues:

  - Explicitly state that logging the exit code is different from the logging
    the output and that this always happens.

  - Fix incorrect statement that `on_failure` triggers for non-zero exit codes.
    `on_failure` triggers when the exit code does not match any value specified
    by `returns`.
Merge pull request #1524 from Sharpie/19379-clarify-exec-logoutput

(#19379) Clarify documentation for exec logoutput
Merge branch 'security/3.1.0/february_code_orange' into 3.1.x

* security/3.1.0/february_code_orange: (26 commits)
  Update PUPPETVERSION for 3.1.1
  (#19392) Don't validate key for certificate_status
  run curl against the master on the master
  remove tests that do not run on 3.1+
  add quotes around paths for windows interop
  We can ( and should ) use grep instead of grep -E
  Don't assume master supports SSLv2
  Don't require openssl client to return 0 on failure
  Display SSL messages so we can match our regex
  Don't assume puppetbindir is defined
  Remove unnecessary rubygems require
  Run openssl from windows when trying to downgrade master
  Separate tests for same CVEs into separate files
  Fix order-dependent test failure in network/authorization_spec
  Always read request body when using Rack
  Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654, 2274, 2275)
  (#19531) (CVE-2013-2275) Only allow report save from the node matching the certname
  Fix module tool acceptance test
  Updating module tool acceptance tests with new expectations.
  (#19392) (CVE-2013-1653) Validate instances passed to indirector
  ...
Merge branch 'security/2.7.20/february_code_orange' into 2.7.x

* security/2.7.20/february_code_orange: (23 commits)
  Update CHANGELOG, PUPPETVERSION for 2.7.21
  Add missing 2.7.20 CHANGELOG entries
  (#19391) Find the catalog for the specified node name
  (#19392) Don't validate key for certificate_status
  Don't assume master supports SSLv2
  Don't require openssl client to return 0 on failure
  Display SSL messages so we can match our regex
  Don't assume puppetbindir is defined
  Remove unnecessary rubygems require
  Run openssl from windows when trying to downgrade master
  Separate tests for same CVEs into separate files
  Fix order-dependent test failure in rest_authconfig_spec
  Always read request body when using Rack
  Acceptance tests for CVEs 2013 (1640, 1652, 1653, 1654, 2274, 2275)
  (#19531) (CVE-2013-2275) Only allow report save from the node matching the certname
  Fix module tool acceptance test
  Updating module tool acceptance tests with new expectations.
  (#19392) (CVE-2013-1653) Validate instances passed to indirector
  (#19151) Reject SSLv2 SSL handshakes and ciphers
  (#19391) (CVE-2013-1652) Disallow use_node compiler parameter for remote requests
  ...
Merge branch '2.7.x' into 3.1.x

Merge the 2.7.21 security release into 3.1.x, using the ours strategy. The
fixes differed between 2.7.x and 3.1.x, so the code is different between the
two branches. However 2.7.x needs to be merged in, so we use the ours strategy
to make sure the keep the 3.1.x changes and don't bring in changes from 2.7.x.
Merge remote-tracking branch 'upstream/3.1.x'

* upstream/3.1.x: (49 commits)
  Update CHANGELOG, PUPPETVERSION for 2.7.21
  Add missing 2.7.20 CHANGELOG entries
  (#19391) Find the catalog for the specified node name
  Update PUPPETVERSION for 3.1.1
  (#19392) Don't validate key for certificate_status
  (#19392) Don't validate key for certificate_status
  run curl against the master on the master
  remove tests that do not run on 3.1+
  add quotes around paths for windows interop
  We can ( and should ) use grep instead of grep -E
  Don't assume master supports SSLv2
  Don't require openssl client to return 0 on failure
  Display SSL messages so we can match our regex
  Don't assume puppetbindir is defined
  Remove unnecessary rubygems require
  Run openssl from windows when trying to downgrade master
  Don't assume master supports SSLv2
  Don't require openssl client to return 0 on failure
  Display SSL messages so we can match our regex
  Don't assume puppetbindir is defined
  ...

Conflicts:
	lib/puppet/indirector/indirection.rb
	lib/puppet/parser/templatewrapper.rb
	lib/puppet/util/monkey_patches.rb
	spec/unit/parser/templatewrapper_spec.rb
(#16809) Use only one record_type in cron provider

The cronprovider defines two record_types :crontab and :freebsd_special
to handle the following crontab records:

    @daily /bin/my_daily_command
    0 0 * * * /bin/my_daily_command

This has a few issues:

a)
The merging of the name (the comment before the cronentry itself) and
the environment variables only happens for the :crontab record_type
but not for the :freebsd_special record_type so information may get
lost (#16809)

b)
When parsing an existing record the record_type can be automatically
determined (depending on which regex matched) but when creating a new
entry the record_type is undefined and the default :crontab is used.
So if a new cronentry is created with the :special property set it is
still treated as a crontab entry (so the to_line hook of the :crontab
record_type is used and not of the :freebsd_special record_type)
which is kind of confusing.

c)
It is really hard to change the time of a cronentry from the special
format to a normal format (or vise versa) e.g. if we already have the
following cronentry

    # Puppet Name: foo
    * * * * * /bin/foo

and we have defined the following resource

    cron { "foo":
      special => daily,
    }

the resource is treatd as in sync because the existing cronentry is
parsed as a :crontab record_type and this record_type doesn't define a
:special field that could be out of sync

This patch now only uses one record_type that internally parses the
timefield as either the old format (minute,hour,monthday,month,weekday)
or the special format. This way the above issues go away (but the
different to_line, post_parse hooks get a bit more difficult to handle
both entries)
(#16809) Refactor crontab provider with block_eval

Ruby 1.9 was failing to parse the previous implementation of the custom
crontab record_line provider methods. This commit uses the FileParsing
block_eval syntax to attach methods to the record_line object instead of
using anonymous procs.
(#16809) Remove refs to freebsd_special cron type

The legacy test::unit crontab tests contained checks for the
freebsd_special record line. Since those were not getting run by the
normal rspec coverage it got missed when the freebsd_special line type
was removed. This commit removes the outdated references.
(#19713) Add tests for non-String exec commands

Add tests that ensure `exec` resources raise errors if the value given for
`command` is not of type `String`.
(#19713) Validate exec commands to be type String

The `exec` type calls a pile of string-specific methods, such as `scan` and
`split`, on the value of `command`. Validate that `command` is of type `String`
so that Puppet can fail with a helpful message if the value was passed as a
type such as `Array`.
Merge pull request #1525 from Sharpie/19713-exec-commands-must-be-strings

(#19713) Validate exec commands to be type String
(maint) Fix exec type test failures on 1.8.7
Merge branch 'maint-exec_type_test_failures_187'
(#5752) Handle read errors in parsedfile provider

The parsedfile provider can handle multiple targets (multiple files,
multiple crontabs, etc) but the provider does not handle the case when
retrieving a target during prefetch fails. When the provider does only
handle one target this doesn't really matter because a possible error is
caught at a higher level (inside Puppet::Transaction). But if the
provider handles multiple targets, one error will cause the whole
prefetching method to fail and all targets are treated as empty.

One example of the issue is described in #5752: Multiple crontabs are
manages with crontab resources and one cronresource describes a
cronentry of an absent user. Because prefetching the crontab of the
absent user fails, the crontab of *all* users are purged and every
crontab entry which is not managed by puppet is lost.

The change now handles the error inside the parsedfile provider itself,
so only the target that is causing troubles is treated as empty.
(#17190) Provide more benchmarking info during compile

Many users find that they have very little insight into what the
compiler is doing and spending time on during compilation. This provides
extra logging for getting much finer grained information.
(#17190) Create Profiler components

The existing Puppet::Util#benchmark method makes it hard to easily put
in place because it does not retain the return value of the block
measured. It also does not give great control over whether or not to
profile, nor does it provide nesting information. This adds a profiler
structure that incorporates all of these features.
(#17190) Undo extra marking of benchmark output

The initial pass at adding compiler profiling added extra text to make
the benchmark output more "grepable". That isn't really needed once the
Profiler system is used.