(#23141) Add OpenBSD to the exclusion list for 'remounts' in mount type
On systems without "-o remount", use "-o update" except for AIX.
(#21869) Fix recursion in cert expiration check

During every authenticated request, the expiration date of the involved
certificates is checked. However, if the localhost cert is loaded when the CA
cert is not present an authenticated request will be initiated to download the
CA cert. This triggers another expiration check for authenticated requests,
which loads the localhost cert, which initiates another authenticated request
to download the CA cert... and so on until stack space is exhausted.

This patch skips the expiration check for the localhost cert if the CA cert is
missing.
(maint) Handle empty or malformed JSON lockfiles

If a JSON lockfile was empty or had malformed JSON, it would raise a
PSON::ParserError and could lead to application failures with an unclear
cause. This commit changes the JSON lockfile behavior to treat empty or
malformed file contents to be nil and generate warnings when the file
contents are malformed JSON.
(maint) Adds vcloud pooling to the win*all beaker node definitions

Closes PR #2100
Merge branch 'maint/stable/use_vcloud_pooling_api' into stable

* maint/stable/use_vcloud_pooling_api:
  (maint) Adds vcloud pooling to the win*all beaker node definitions
Pack extension requests in a single sequence

The ASN.1 description of extension requests could be incorrectly read
that extensions should be packed in individual sequences, while in fact
the extensions themselves are sequences and should be all packed in a
single sequence. This commit fixes how CSRs create and return extension
requests.
Merge pull request #2101 from adrienthebo/defect/csr-extreq-pack-single-seq

Pack extension requests in a single sequence
Maint: Edit and clarify the autosign setting's docs
Maint: Complete and clarify the csr_attributes setting's docs

This was missing information about the extension_requests key.
(#18931) Deprecate instead of remove original windows behavior

The original windows behavior was to attempt to translate posix mode to
the windows file.  Although we want deprecate this behavior, this
previous work on #18931 was removing it entirely.

This patch returns original behavior and marks it as deprecated for
future removal.
Merge pull request #2103 from nfagerlund/autosign_docs

Autosign docs
(#18931) Only issue deprecation when owner/group/mode not specified

This updates the current behavior to only issue the deprecation message if
 owner, group, or mode is unspecified. When all three are specified, it should
 not issue the deprecation as it shouldn't be copying remote permissions.

Without this the deprecation message would come up when someone has specified
 group/owner/mode and would not be subject to copying remote source
 permissions, thus not subject to the message itself.
(#18931) Clarify deprecation warning for source file perms to windows

Specify a little more clearly that for Window's agents we are
deprecating the copying of permissions set on the source file on the
puppet master.  This is as opposed to mode, owner, group settings on the
File resource itself.
Merge branch 'issue/18931/return-existing-windows-behavior'
Maint: Change "inactive" to "stopped" in reinventory action's description

"Inactive" is ambiguous, and could describe a stopped master, a master which
is running but happens to be idle, a master which has no agents attempting to
reach it, a master which has been removed from the load balancer, or any number
of other things. Instead, we should use the unambiguous term "stopped."
Handle malformed CSR attributes and extension requests

When a CSR custom attribute or extension request was passed to a CSR for
inclusion, the resulting error would be raised up from the openssl error
and would not be handled by anything, resulting in error messages like
'first num too long'. Since this is all but useless from the perspective
of a user, this commit adds handling to CSR creation. Errors will be
wrapped to indicate which OID was causing the failure.
(maint) Reset hiera in test_helper to avoid order issues in specs

Andrew Parker ran into spec order issues when merging into pe-puppet
which came down to the hiera instance needing to be reset in the
test_helper.  We are back-porting these changes into puppet so that we
are insulated from the same issues and to keep parity.

pe-puppet/3.2.x: 5ba1392 and 14b36ef
Merge branch 'maint/master/reset-hiera-in-test-helper'

* maint/master/reset-hiera-in-test-helper:
  (maint) Reset hiera in test_helper to avoid order issues in specs
Merge pull request #2105 from adrienthebo/maint/handle-malformed-csr-attributes

Handle malformed CSR attributes and extension requests