(#21817) Ignore duplicate certs

Previously, SSL connections initiated by the puppet agent on windows, e.g
puppet module install, would cause the agent to terminate if the 'Root' store
on Windows contained duplicate certificates.

This commit ensures that we only add unique certificates to the X509 store.
Also, if we fail to add a certificate to the store, we issue a warning and
continue.
(maint) Remove stale files from ext/rack

The ext/rack directory had an outdated README file and an ancient manifest.pp
file, and the useful files (config.ru and the example vhost) were buried in a
subdirectory.

This commit removes the old files, moves the good files up a level, and adds a
comment to the vhost pointing to the maintained passenger documentation.
(maint) Update debian packaging to reference new rack support location

As updated in commit 4c9b63f, the sample files for rack passenger deployment
have been moved up a directory. The puppetmaster-passenger package for debian
uses those files, so this commit updates the debian/rules file with their new
location. It also updates the README_DEVELOPER.md, which references the same
files.
Merge pull request #1951 from nfagerlund/stale_rack_files

(maint) Remove stale files from ext/rack
(maint) Add specs for parser resource parameters

Classes Puppet::Parser::AST::ResourceParam and Puppet::Parser::Resource::Param
(#23115) Include manifest context in Puppet::DevError

When a 'devfail' or Puppet::DevError is thrown, include the user's manifest
file/line context as it can help in finding the problem.
(#23115) Convert nil resource parameter values to undef

If a resource parameter evaluates to nil (e.g. a return value from a parser
function), then convert the value to undef.  This prevents an error in
Puppet::Parser::Resource::Param which requires a non-nil value on
instantiation.
(#9546) Preserve permissions in 'puppet module build'

Previously, 'puppet module build' made no attempt to preserve
permissions. This could render any external fact scripts
unexecutable.  This patch simply preserves permissions when
creating the pkg directory which is tarred up to build the
module.
(#22938) fix Windows tests for symbolic file modes

 - lower nibble must be set to 4 for Ruby to properly be able to return
   the file mode under Windows
(maint) Ensure that the autosign setting is validated.

Original patch by Patrick Hemmer <patrick.hemmer@gmail.com>
(#7244) Add autosign_command for programmatic CSR autosigning

This commit adds support for delegating control of autosigning to an
outside command. This allows users to define their own criteria for
signing CSRs. This commit adds a new setting, 'autosign_command', for
the command to use for testing CSRs, and extends the logic of the CA to
test for autosigning based on both the 'autosign' setting and the
output of the autosign_command.

Original patch by Patrick Hemmer <patrick.hemmer@gmail.com>
(maint) Extract common ssl setup for acceptance tests

Extracts cert initialization from git/package certificate provisioning,
and common ssl reset steps from the autosign_command and
puppet_cert_generate_and_autosign tests into the
puppet/acceptance/common_utils helper lib.
Merge pull request #2053 from Iristyle/ticket/master/22938-fix-mode-test-windows

(#22938) fix Windows tests for symbolic file modes
(maint) more explicit stdout tests for autosign_command acceptance

We were assert_no_matching for the same string in both cases; instead
assert_match output for more surety.
Merge pull request #2022 from adrienthebo/feature/7244/add_autosign_command

(#7244) Add autosign command
(#23126) Allow facter and hiera gem locations to be SSH git URLs

Previously, git urls could only be specified as `git://`. This works
fine for pulling down the puppetlabs facter and hiera repos, but
doesn't allow private forks of those to be pulled down. This is
problematic because the Gemfile is used for setting up our test
environments and the PE versions of facter and hiera are accessed over
SSH.

This commit allows git@ urls in addition to the curreng git: urls.
(maint) stub $CHILD_STATUS for autosign_command specs

Without this commit, the value of $CHILD_STATUS in the autosign_command specs
is not stubbed, so is dependent on the return value of the last command in the
specs. This can lead to spurious test failures because this leaks
information between tests. This commit stubs the $CHILD_STATUS global
variable so that the autosign_command tests are always isolated.
Merge branch 'maint/master/autosign_command-solaris-specs'
(#9546) Preserve execute permissions on 'module install'

Previously (even with the patch to 'module build') execute
permissions were stripped from everything in a module.  This
was introduced to fix the security holes discussed in #14333.
However that fix (which set all files to 644) had the unneeded
side effect of discarding the executable bit.

So this change preserves permissions from the tarball, but
removes sticky/setuid/setgid bits (which are the security hole)
and removes file write permissions (which aren't needed).  This
should address the needs of both #9546 and #14333.
(#9546) Update test to reflect changed permissions