(PUP-3174) Make settings catalog skip manifestdir if environmentpath

This makes the settings catalog skip managment of manifestdir if
environmentpath is set.
(PUP-3190) Don't assume puppet is in a lib dir

The loaders previously assumed that any installation of puppet would be
under a directory called lib. This holds true when running puppet from
source (during development), or in some package cases, but is not
generally true. This simplifying assumption was made so that the loading
path for both puppet system extensions (built in functions) and module
extensions could be loaded in the same manner: find the root of the
extender and loading code from `lib/puppet/...`.

This changes to loading to instead only assume that there is a `puppet`
directory and not the name of the parent. This, however, forces the
loader for modules to become specialized to only be able to find ruby
extentions, because they are in the 'lib' directory, which is how the
loader must now be configured.
(maint) Remove unused constant from default_manifest_spec
(PUP-3162) Prevent $environment interpolation in directory environments

There are a few settings for which interpolation of $environment does
not make sense when using directory environments.

* default_manifest -> defines either the relative path to manifests
within a directory environment, or an absolute path to manifests to be
used by all directory environments. It is currently a configuration
error to set $environment within default_manifest.
* basemodulepath -> conceptually, this is intended for supplemental
modules required for all environments, and should not vary by
environment.
* environmentpath -> this is the base path defining what directory
environments can be found. Interpolating $environment within it makes no
sense.

Additionally, both environmentpath and basemodulepath are required by
the environment loaders during initialization. They will interpolate
relative to a specified environment if you interogate config, but in a
running master instance, will have interpolated to the default
environment regardless of the current environment being processed for a
catalog, for instance.

A last case, irregardless of type of environment, is the pathological
case of attempting to interpolate $environment within environment.
This, unsurprisingly, causes a stack overflow.

This patch adjusts the Puppet::Settings interpolation code so that
$environment is not interpolated within any of these four settings when
using directory environments (so, when the environmentpath has been
set).* So assuming a confdir=/etc/puppet,
basemodulepath=$confdir/modules/$environment will be interpolated as
'/etc/puppet/modules/$environment' and a warning will be logged.

*Currently setting $environment in default_manifest will error out
when puppet loads as a setting validation error, and this behavior will
never be reached.
(maint) Correct parameter type from SSLContext to StoreContext

Previously, our verify callback stated that it received an SSLContext
parameter, but that is not correct. While there are SSLContext classes
in ruby, the actual object passed is of type StoreContext.

    (rdb:1) store_context.class
    OpenSSL::X509::StoreContext
(maint) Only append to peer_certs if verify succeeded

Previously, we assumed that verify_callback was only called once for each
cert in the chain, with preverify_ok set to true or false depending on
whether the cert is verified.

However, openssl call invoke the verify_callback for a number of other
reasons, e.g. CRL not yet valid. In that case, the error is not with
the current_cert, but with the current_crl.

This commit moves the logic for appending the current_cert to the
@peer_certs array only in the case that preverify_ok is true. Does not
cause problems, because we only looked at @peer_certs array if every
cert in the chain was successfully verified.

This commit makes it easier to handle other types of verify errors.
(maint) Cleanup test to be more readable

The formatting was a little off, which made it hard to see what code was
in the test. This fixes the formatting and uses the resource matcher so
that it can provide a better error message.
Merge branch 'pr/3054' into stable

* pr/3054:
  (maint) Cleanup test to be more readable
  (PUP-3174) Make settings catalog skip manifestdir if environmentpath

Closes GH-3054
(PUP-3190) Add acceptance test for 4x function calls
(PUP-3191) Fix symlink checking

Prior to this commit we were trying to use Pathname.realpath to find where a
symlink points to. This throws a file not found when the symlink doesn't point
at anything valid in the filesystem.
This commit fixes that problem by only using File.readlink and not attempting
to find the symlinked file relative to the module unpacking directory.
Merge pull request #3064 from highb/fix/master/symlink_check

(PUP-3191) Fix symlink checking
(PUP-3162) Switch to a whitelist for $environment interpolation

Previous commit blacklisted a small set of settings from having
$environment interpolated.  After some discussion, we decided to broaden
this to a whitelist, and the only setting we can currently think of
needing $environment interpolation when using directory environments is
config_version.

We also decided to not halt startup for default_manifest with
$environment in it, as these errors are difficult to read with the
current error reporting from a rack master.  So the validation for
default_manifest is removed.
(PUP-3157) Allow variable DNS name order in helpful error cert name test

This commit updates the
`helpful_error_message_when_hostname_not_match_server_certificate.rb`
test to allow for the order in which the DNS names are enumerated back
from the master server's certificate to be variable.  This allows the
test to not errantly fail depending upon the order in which the names
were actually signed into the certificate.
(PUP-3151) Added acceptance test for External CA on Jetty

This commit adds an acceptance test which exercises External CA
functionality against a Jetty configuration.
(PUP-3151) Removed newline from host_entry test fixture

This commit removes the newline character from the end of the host_entry
method in the acceptance test ExternalCertFixtures.  The presence of this
character was causing the jetty_external_root_ca.rb test, when run on
Debian, to not properly set the needed hostname entry into the
/etc/hosts file.
Merge pull request #3067 from waynr/maint/stable/pup-3151

Add acceptance test for External CA on Jetty
Merge pull request #3066 from waynr/maint/stable/pup-3157

(PUP-3157) Allow variable DNS name order in helpful error cert name test
(PUP-894) Add specs for current bebavior

This commit adds specs for current behavior, especially that the verify
callback rejects the connection if preverify_ok is false, and we reject
CRLs whose last_update time is more than 5 minutes in the future.
(PUP-894) Accept CRLs that were "recently" updated

Previously, the agent would reject an SSL connection if the CRL it
downloaded from the CA had a `last_update` time that was slightly in the
future. The agent reports this as "CRL is not yet valid." This issue can
happen when the CA's time is slightly ahead of the agent's time, the CRL
is recently updated, and the agent doesn't already have a cached version
of the CRL (due to PUP-2103).

The CRL not yet valid error sometimes happens during acceptance testing
when we delete the agent's ssl directory, revoke a cert on the master
(which updates the CRL's last_update field), and run the agent (which
downloads the latest CRL).

This commit modifies the verify callback to ignore CRL not yet valid
errors provided all of the following are true:

 * current_crl is not nil
 * current_crl.last_update is not nil
 * current_crl.last_update is strictly less than 5 minutes from now

It also adds specs around unspecified behavior, e.g. ensure the verify
callback returns false when errors are detected.
(PUP-3222) Rescue StandardError instead of non-existent exception

Previously, the windows service provider rescued exceptions of type
Win32::Service::Error. However, FFI-based versions of win32-service (v0.8.x)
no longer raise that type of error. Instead they raise SystemCallError.

So previously, if puppet failed to manage a service, e.g. service didn't
exist, puppet would try to rescue the exception specifying a class that
was not defined:

    puppet resource service foo ensure=stopped
    Error: /Service[foo]: Could not evaluate: uninitialized constant Win32::Service::Error

This regression was introduced as part of PUP-1283 when we migrated from
win32-service version 0.7.x to 0.8.x.

This commit modifies the various provider methods to more broadly rescue
StandardErrors and updates the spec tests to handle the negative cases.

Paired-with: Ethan J Brown <ethan@puppetlabs.com>