Don't keep Gemfile.lock checked in.
Add acceptance test for report processing

This replaces a test in the old "unit" suite that was broken but testing dead
code.
Add vendoring system into puppet

This adds support to Puppet for vendoring libraries.
Fix installation of vendored libs

Vendored libs were getting the path component 'lib' removed when only the
leading 'lib' should be removed.
Vendor safe_yaml 0.9.2
(#20584) Only deserialize expected objects from YAML

Puppet no longer allows the base YAML library to deserialize arbitrary
objects. By using the safe_yaml package, we deserialize only primitive data
structures. The remainder of the deserialization process is now unified
between YAML and PSON. This code will explicitly create only the expected
objects from the primitive data types.

As a side effect of this change the code for REST indirections now allows
specialized deserialization routines per method. The save method now returns
nil by default, and is only overridden in a couple of cases where Puppet was
using the return value to preserve previous behavior.
Remove acceptance test for yaml parsing that was no longer valid
Improve CVE 2013 1654 SSLv2 Downgrade Master test

Previously we were only checking for the applicability of the master
(since we're testing the master), but we run the check from an agent.
This ensures the agent we run the check from has the necessary openssl
client for the test.

Signed-off-by: Justin Stoller <justin@puppetlabs.com>
(packaging) Update build_defaults to remove EOL platforms (natty, f15, f16).
(packaging) Update debian build-depends to be ruby1.8 so that the shebang is correct after install and ruby1.9.1 isn't used on newer debians.
[packaging] Update mocks for rpmbuilder mock format

The Puppet Labs mocks created by rpmbuilder have assumed a new format, pl-el-*
vs el-*, in order to avoid overwriting the configurations supplied by the mock
package. This commit updates the mocks in puppet to reflect the new standard,
so that we can continue to build packages with builders created with the
rpmbuilder module. It also removes the "rc_mocks", which was deprecated in the
packaging repo some time ago and are no longer used.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>

Conflicts:
	ext/build_defaults.yaml
(packaging) Update CHANGELOG, PUPPETVERSION for 2.7.22
Merge branch 'release_2.7.22' into 2.7.x

Conflicts:
	ext/build_defaults.yaml
(#14333) Ensure module permissions are sane.

Prior to this change, tarballs unpacked by the root user would be unpacked
with the permissions and the ownership information present in the tarball.
In the best case, this made some modules fail to function after installation
since the newly installed module was owned by a different user. In the worst
case, this could be seen as a fairly serious security vulnerability.

This change ensures that the module's permissions are always owner-writable,
world-readable, and that the owner is always the same as the module's parent
directory.
Backporting acceptance tests.
Merge pull request #1815 from pvande/PF-166-2.7.x

(#14333) Ensure module permissions are sane – 2.7.x backport.
(Maint) Use dirname instead of regexes

A sequence of substitutions to strip off the trailing filename from a
path. This is actually just File.dirname in disguise.
(Maint) Clean up specs

The specs were distractingly bad. There was usage of instance variables
that were created in a loop, but caused the final value, which was used
by the tests, to not be what the author expected. This also pulls out
specific tests around how add() behaves in very important circumstances,
which the previous way of automatic test generation did not make clear.
(#21971) Check for possible directory traversal

The class name that is being looked for is translated to the directory
structure to search. In order to prevent directory traversal attacks we
need to make sure that the requested class name is valid and therefore
doesn't contain any directory traversal shortcuts.
(#21971) Split import and autoloading code paths

The codepaths for import and autoloading of manifest files were combined
at many levels, which made them share behaviors that were not wanted.
The import ability to load absolute paths leaked through into how
autoloading would try to find files for a particular class name, which
resulted in a possible vulnerability to injected class names (ENC
values, hiera data, etc). This splits those code paths to ensure that
the one used for autoloading only will ever look in modules that are
registered on the modulepath, while still allowing the import path to
look at absolute and relative file paths.