(PUP-500) Translate acceptance tests to spec

These tests have nothing to do with the full application stack and are
only checking that the semantics of collections are correct. This
removes this acceptance test in favor of the existing integration spec
tests, which run about 100 times faster and many times more reliably.
(PUP-500) Test realize for realz

The realize() spec tests didn't really do much since they mocked out so
close to the function itself. This calls it in a manner that puts
resources in the catalog and checks that they are there.

The accpetance tests for the realize function are no longer needed.
(PUP-500) Increase coverage of collection queries

The tags and array handling of collection queries is "special". This
adds some test coverage around that behavior.
(PUP-500) Add coverage for +> on collection

The +> form of collection hadn't been covered in any test cases that I
could find. This adds some coverage.
(PUP-391) Fix INVALID_FILE_ATTRIBUTES on x64

 - The GetFileAttributes Win32 API call returns a DWORD, which is a
   platform independent 32-bit wide unsigned integer:
   http://msdn.microsoft.com/en-us/library/windows/desktop/aa364944(v=vs.85).aspx
   It's max value is 4294967295:
   http://msdn.microsoft.com/en-us/library/windows/desktop/aa383751(v=vs.85).aspx
 - FFI::Pointer.new(-1).address is platform dependent and on x64 is
   18446744073709551615, the max value of a 64-bit wide unsigned int.
 - The INVALID_FILE_ATTRIBUTES constant is a valid return value of
   GetFileAttributes and is defined in winbase.h as:
   #define INVALID_FILE_ATTRIBUTES ((DWORD)-1)
 - Therefore INVALID_FILE_ATTRIBUTES should be defined as 0xFFFFFFFF
(PUP-391) Remove unused file19windows.rb variable
(PUP-391) Use FFI.errno instead of GetLastError

 - In commit bf6f5c4e67c527d97da2dd3ee692692c8b9a8981, @@GetLastError
   was introduced as a band-aid to ensure the appropriate error code
   was read out of the thread local storage after a Win32 API call was
   made.  At that time, not all of the code had been converted to FFI
   compatible and not all gems had been upgraded to FFI compatible.
   Calls still made using Win32API were not captured by FFI.errno (which
   only calls GetLastError *after* making an FFI defined Win32 API call)
   resulting in a number of test fails.  The solution at the time was
   to manually call GetLastError instead to retrieve the value set by
   SetLastError.
 - Now that all Win32 API calls are made through FFI, FFI will
   automatically capture API results by calling GetLastError, and we
   can remove the unnecessary binding to GetLastError here.
(PUP-1281) Ensure don't override stdout/stderr (windows/ruby2)

This provides a more deterministic set of specs that determine whether we have
wrapped $stderr/$stdout or not based on ruby version.
(PUP-391) Fix Rdoc 4+ specs on Windows Ruby 2 x64

 - When calling the document method on RDoc and the root option has not
   been specified, RDoc will provide a default in the options class:
   @root = Pathname(Dir.pwd).  NOTE: This does not affect RDoc 3.9.5
   that ships with Ruby 1.9.3 on Windows, only RDoc 4.0.0+ that ships
   with Ruby 2.0.0+ on Windows.
 - The win32-dir monkey patches the Dir.pwd method, and instead of
   using / separators like the rest of Ruby, it uses \ as a path
   separator.
 - RDoc uses Pathname, specifically the relative_path_from method
   which expects / separators, and gets confused with \.  Therefore,
   provide a workaround to ensure that Windows uses the appropriate
   / in paths.
(PUP-391) Ruby 2 exception type changed to EISDIR

 - File.open now raises EISDIR when a path is a directory, prior to
   verifying permissions in Ruby 2.  Files continue to return EACCESS.
Merge pull request #2836 from zaphod42/issue/master/pup-500-define-collection-semantics

(PUP-500) Increase coverage of collection queries
Merge remote-tracking branch 'rob/ticket/master/PUP-1281-colors-specs'

* rob/ticket/master/PUP-1281-colors-specs:
  (PUP-1281) Ensure don't override stdout/stderr (windows/ruby2)
Merge branch 'pr/2829'

* pr/2829:
  (PUP-391) Ruby 2 exception type changed to EISDIR
  (PUP-391) Fix Rdoc 4+ specs on Windows Ruby 2 x64
  (PUP-391) Use FFI.errno instead of GetLastError
  (PUP-391) Remove unused file19windows.rb variable
  (PUP-391) Fix INVALID_FILE_ATTRIBUTES on x64
(maint) Remove duplicated logging of error.

This removes a duplicated logging of error when attempting to
override an already set resource parameter. This used to result in
the error showing up three times on the console instead of the expected
two.
Merge branch 'master' of ssh://github.com/puppetlabs/puppet.git
(PUP-2177) Change Crypto Spec in accordance to bettercrypto.org

We provide an Apache vhost configuration for users that want to run a
Puppet master using Apache and Passenger. The configuration was added in
d85d73c (five years ago, roughly) and set the SSLProtocol and
SSLCipherSuite directives using the assumptions about cryptography at
the time. As part of PUP-2582 commit 05af20b70 updated the SSL cipher
suite and protocol settings to remove some of the most vulnerable
ciphers, but still contained some relaxed settings to ensure
compatibility with as many platforms as possible.

-- Summary

This commit updates the SSLProtocol and SSLCipherSuite directives to
ensure we only use secure ciphers while continuing to function on all
supported platforms. The most notable difference is that this change
switches the cipher selection from a blacklist where all ciphers are
added and then selectively removed, to a whitelist where only known safe
ciphers are allowed. The cipher suite has been selected using the
guidelines laid out by the Applied Crypto Hardening paper[0].

-- Overall cipher selection

This cipher suite was chosen by selecting for the following criteria:

  * TLS 1.0, 1.1, 1.2
  * Perfect forward secrecy/ephemeral Diffie Hellman where possible
  * Preferring strong MACs (SHA-2) where possible
  * GCM as the authenticated encryption scheme where possible
  * Always falling back to reasonably acceptable schemes for maximum
    platform compatibility

The resulting cipher suite has the following implications:

TLSv1.2 is preferred over TLSv1.0, but is still provides reasonable
ciphers with TLSv1.0.

-- Key exchange

Ephemeral Diffie Hellman and Ephemeral Elliptic Curve Diffie Hellman are
used for key exchange. EDH is preferred over EECDH due to ongoing
concerns with potential weaknesses in elliptic curve cryptography, but
EECDH is still included due to the performance benefits of EECDH over
EDH.[1] Non-ephemeral Diffie Hellman is not used to ensure perfect
forward secrecy. If EDH or EECDH are not available, key exchange will be
done using RSA for compatibility with legacy SSL libraries.

-- Authentication

RSA is used for authentication as it works in most of today's setups and
modern implementations are resistant to attack for the foreseeable future.

-- Encryption

AES256 and CAMELLIA256 count as very strong ciphers at the moment, but
if these algorithms are not available then AES128 or CAMELLIA128 will be
used as fallbacks since they are still reasonably strong. CAMELLIA is
preferred over AES due to the decision by NSS to prefer CAMELLIA, with
the following rationale:

    National ciphers such as Camellia are listed before international ciphers
    such as AES and RC4 to allow servers that prefer Camellia to be able to
    negotiate Camellia without having to disable AES and RC4, which are needed
    for interoperability with clients that don't yet implement Camellia.[2]

-- Message Authentication (MAC)

Message authentication prefers AEAD with GCM, and then falls back to
SHA256. If ECDHE is used SHA384 will be used when available. If no
better option is available SHA1 will be used.

-- Fallback

When no better cipher is available, CAMELLIA128-SHA and then AES128-SHA
(with RSA for authentication) will be used, for cases such as OpenSSL
0.9.8 which does not provide support for ECC and TLSv1.1 or above.

-- Blacklisted algorithms

On top of the algorithms blacklisted in 05af20b7, ECDSA has been
disabled due to outstanding concerns about weaknesses to cache timing
attacks.[3]

[0] "Applied Crypto Hardening": https://bettercrypto.org/static/applied-crypto-hardening.pdf
[1] "A Note on Elliptic Curve Cryptography" "Applied Crypto Hardening section 3.7"
[2] "Document the policy for the order of cipher suites in SSL_ImplementedCiphers.": https://bugzilla.mozilla.org/show_bug.cgi?id=430875
[3] "How to design an elliptic-curve signature system" http://blog.cr.yp.to/20140323-ecdsa.html

Thanks to Aaron Zauner <azet@azet.org> and bettercrypto.org for
generating and submitting the updated cipher suite.

Commit message amended by Adrien Thebo <adrien@puppetlabs.com>
(PUP-1281) Simplify test for wide console behavior

Previously, we were verifying that stdout and stderr were wrapped in WideIO
objects in ruby 1.9. However, this doesn't work in CI, because jenkins
redirects stdout and stderr.

This commit simplifies the test to not be as environmentally sensitive. It
just verifies that the WideConsole and WideIO classes have been defined in
ruby 1.x, and not defined in 2.x.
(PUP-2711) Make manifest-directory load recursively

This changes the loaded of a manifest reference that is a directory
to include all .pp recursively in this directory. The content is
sorted so that all content of directory b comes before file c in its
parent directory (rule applied recursively).
(PUP-2711) Make recursive manifest parsing conditional to future parser

This makes the ability to load all .pp files under a manifest dir
recursively conditional to parser == future. (It will become the
standard in Puppet 4.0). This is done to avoid slurping in lots of files
in case users kept other files around in a subdirectory in the belief
that they would not be loaded. Thus making it harder to upgrade.

This also adds a test that runs for future parser.
(PUP-2711) Remove '*' without effect.