(docs) Note that the path setting only works in main section of puppet.conf

See PUP-3023 for more info.
(PUP-1106) Unschedule refreshes on skipped resources

If a given resource is being skipped (e.g. has failed dependencies, is
unscheduled, untagged, etc) that resource should not trigger any
additional behavior. However a resource could be skipped and still have
events trigger behavior. This commit changes the event processing logic
to only process events for resources that should be applied and dequeues
events on resources that should not be applied.
(maint) Use correct data type when unscheduling events

Commit 9d59f204 added the ability to dequeue events on a given resource,
but it did so by setting the value of the target callbacks to an empty
hash. However the value of target callbacks is an array, so if events
were re-queued for a given resource we would get an error like so:

    {}.concat(%w{one two three})
    NoMethodError: undefined method `concat' for {}:Hash

Currently we can't requeue events after dequeuing events, but if this
changes then this code is very incorrect.

This commit fixes the event reset to behave as expected.
(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-3654) Deprecate Puppet.newtype

The `newtype` class method of the Puppet module includes a comment from
2011 stating that the method should be deprecated, but was under heavy
use at the time.

This commit adds a deprecation warning to this method to indicate that
it will be removed in a future release. Types using the old method have
also been updated to use `Puppet::Type.newtype`.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3388) Differentiate between single and multi mirror and raidz pools

Previously, the acceptance test attempted to create a single mirrored
pool with 3 virtual devices, and a single raidz with 3 virtual devices.
The syntax does not match the type specification, which says:

    List of all the devices to mirror for this pool. Each mirror should be a
    space separated string.

And the same thing for raidz.

This commit modifies the acceptance test so that it uses valid mirror
and raidz syntax. It can either be a single pool with multiple devices,
e.g. mirror => ['a b'], or multiple pools each with multiple devices,
e.g. mirror => ['a b', 'c d'].
Merge pull request #3314 from joshcooper/ticket/master/PUP-3388-zpool-acceptance

(PUP-3388) Differentiate between single and multi mirror and raidz pools
(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
(PUP-3666) Add settings for http connect and read timeouts
(maint) Deduplicate spec helper methods
(PUP-3666) Respect http timeout settings for Forge
(PUP-3666) Deprecate and redirect configtimeout
(maint) Use Ruby 1.9 for Solaris acceptance tests

Prior to this commit, pre_suite for Solaris templates would install Ruby
1.8. This commit installs Ruby 1.9.3 on our Solaris 10 and 11 templates
as part of the Ruby 1.8.7 deprecation in Puppet 4.0.
Merge pull request #3317 from rji/maint/master/solaris-use-ruby19

(maint) Use Ruby 1.9 for Solaris acceptance tests
Merge pull request #3090 from adrienthebo/issue/master/pup-1106-check-for-failed-deps-on-refresh

(PUP-1106) Check for failed deps on refresh
Merge pull request #3306 from whopper/pup-3654/deprecate/puppet-newtype

(PUP-3654) Deprecate Puppet.newtype
Merge pull request #3305 from adrienthebo/feature/master/pup-3666-configtimeout

(PUP-3666) Replace and deprecate configtimeout setting
* adrienthebo-feature/master/pup-3666-configtimeout:
   (PUP-3666) Deprecate and redirect configtimeout
   (PUP-3666) Respect http timeout settings for Forge
   (maint) Deduplicate spec helper methods
   (PUP-3666) Add settings for http connect and read timeouts