(docs) Note that the path setting only works in main section of puppet.conf

See PUP-3023 for more info.
(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
Revert "Merge pull request #3090 from adrienthebo/issue/master/pup-1106-check-for-failed-deps-on-refresh"

This broke the acceptance test tests.ticket_7728_don't_log_whits_on_failure.rb,
so I'm backing it out until I can update the whit acceptance test as
well.

This reverts commit ec03dee5ac403d0c110cb8c65103c0f4a2ee8391, reversing
changes made to 7b410fe1c94f37a8ad5732affb7e2d9355b38289.
(maint) Add Equifax cert for pmt acceptance

The forge SSL certificates are being updated to use SHA-256, and that's
introduced a new certificate dependency that's not present on Windows.
Add it as part of acceptance testing. This is a stop-gap until the PMT
is fixed to come with its own certs.
Merge pull request #3320 from MikaelSmith/maint/master/fix-acceptance-cert

(maint) Add Equifax cert for pmt acceptance
Revert "Revert "Merge pull request #3090 from adrienthebo/issue/master/pup-1106-check-for-failed-deps-on-refresh""

This reverts commit 03a279c3598554c309e0567a5e00c161e422ea04.
(PUP-1019) Remove ZAML

Before this commit we were using ZAML by monkey patching the `to_yaml`
function to use ZAML.dump instead of YAML.dump. After removing `zaml.rb`
tests started failing because of the way that ZAML serialized YAML so
assertions in those tests were changed.

This commit also adds in a patch to YAML.Psych to handle the cases where
ruby objects were being encoded improperly.

This commit removes the use of ZAML in puppet as part of the Puppet 4.x
code removal efforts.
Merge pull request #2966 from nfagerlund/docs_path_setting

(docs) Note that the path setting only works in main section of puppet.c...
(PUP-1106) Reduce log level when unscheduling events
(maint) Use less brittle regexps for whit check
(maint) Add Equifax cert for pmt acceptance

The forge SSL certificates are being updated to use SHA-256, and that's
introduced a new certificate dependency that's not present on Windows.
Add it as part of acceptance testing. This is a stop-gap until the PMT
is fixed to come with its own certs.
Merge branch 'backport/stable/equifax-cert' into stable

* backport/stable/equifax-cert:
  (maint) Add Equifax cert for pmt acceptance
Merge branch 'stable'

* stable:
  (maint) Add Equifax cert for pmt acceptance
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1019) Fix serializing environments.

This commit fixes a regression with Puppet::Node::Environment
serialization. When a Puppet::Node::Environment object would be
serialized the entire object was serialized instead of just the
environments name.
Merge pull request #3322 from adrienthebo/issue/master/pup-1106-check-for-failed-deps-on-refresh

(PUP-1106) Don't process events for skipped resources, take 2