(PUP-3190) Don't assume puppet is in a lib dir

The loaders previously assumed that any installation of puppet would be
under a directory called lib. This holds true when running puppet from
source (during development), or in some package cases, but is not
generally true. This simplifying assumption was made so that the loading
path for both puppet system extensions (built in functions) and module
extensions could be loaded in the same manner: find the root of the
extender and loading code from `lib/puppet/...`.

This changes to loading to instead only assume that there is a `puppet`
directory and not the name of the parent. This, however, forces the
loader for modules to become specialized to only be able to find ruby
extentions, because they are in the 'lib' directory, which is how the
loader must now be configured.
(maint) Correct parameter type from SSLContext to StoreContext

Previously, our verify callback stated that it received an SSLContext
parameter, but that is not correct. While there are SSLContext classes
in ruby, the actual object passed is of type StoreContext.

    (rdb:1) store_context.class
    OpenSSL::X509::StoreContext
(maint) Only append to peer_certs if verify succeeded

Previously, we assumed that verify_callback was only called once for each
cert in the chain, with preverify_ok set to true or false depending on
whether the cert is verified.

However, openssl call invoke the verify_callback for a number of other
reasons, e.g. CRL not yet valid. In that case, the error is not with
the current_cert, but with the current_crl.

This commit moves the logic for appending the current_cert to the
@peer_certs array only in the case that preverify_ok is true. Does not
cause problems, because we only looked at @peer_certs array if every
cert in the chain was successfully verified.

This commit makes it easier to handle other types of verify errors.
(PUP-3190) Add acceptance test for 4x function calls
(PUP-894) Add specs for current bebavior

This commit adds specs for current behavior, especially that the verify
callback rejects the connection if preverify_ok is false, and we reject
CRLs whose last_update time is more than 5 minutes in the future.
(PUP-894) Accept CRLs that were "recently" updated

Previously, the agent would reject an SSL connection if the CRL it
downloaded from the CA had a `last_update` time that was slightly in the
future. The agent reports this as "CRL is not yet valid." This issue can
happen when the CA's time is slightly ahead of the agent's time, the CRL
is recently updated, and the agent doesn't already have a cached version
of the CRL (due to PUP-2103).

The CRL not yet valid error sometimes happens during acceptance testing
when we delete the agent's ssl directory, revoke a cert on the master
(which updates the CRL's last_update field), and run the agent (which
downloads the latest CRL).

This commit modifies the verify callback to ignore CRL not yet valid
errors provided all of the following are true:

 * current_crl is not nil
 * current_crl.last_update is not nil
 * current_crl.last_update is strictly less than 5 minutes from now

It also adds specs around unspecified behavior, e.g. ensure the verify
callback returns false when errors are detected.
(maint) Fix typos in comments in acceptance test
(PUP-3136) Fix Intermittent Acceptance Test Failures

It was discovered that when puppet attempted to start apache the
provider would say that it was stopped even though it was starting. On
agents where a puppet master was installed with passenger the apache
service would take longer than usual to start lengthening the starting
process. By the time puppet tested if the service was running or not
apache would still be attempting to start causing the test to fail.

This commit replaces the apache2 package with rabbitmq since it is not
used by puppet and therefore tests down the road will not fail with us
managing it with puppet. It also uses a manifest instead of the
`puppet_resource` function to ensure that there is not any more timing
problems giving us the errors.
(PUP-3136) Add detailed exit codes to tests

This commit modifies the existing test to include detailed exit codes on
the `apply_manifest_on` step so that when the test fails errors will be
helpful.
Merge pull request #3071 from jpartlow/issue/stable/pup-3136-upstart-acceptance

Issue/stable/pup 3136 upstart acceptance
Merge pull request #3068 from joshcooper/ticket/stable/PUP-894-crl-not-yet-valid

(PUP-894) Be more lenient about CRL not yet valid errors
(PUP-3191) Use FileSystem.readlink in unpacker

Prior to this commit we were using File.readlink, which does not work properly
on Windows platforms, to tell the user about symlinks found when unpacking.
This commit changes that behavior to instead use the Puppet::Filesystem.readlink
function, which should work on all platforms that support symlinks.
(PUP-3190) Improve readability of function creation logic.
Merge pull request #3072 from highb/fix/stable/pup-3191_fix_readlink

(PUP-3191) Use FileSystem.readlink in unpacker
(PUP-3190) Change acceptance test to use directory environment

This changes the fun4x_loadable_from_modules acceptance test
from using the deprecated modulepath to using a directory environment.
(PUP-3162) Expand expected config_version

Previously the test failed on windows, because we were expecting the
environment config_version to return on POSIX path. But on Windows it is
expanded based on the current drive.

Paired-with: Josh Partlow <joshua.partlow@puppetlabs.com>
(PUP-3186) Skip creation of symlinked default directory env

To provide a better out of the box user experience, Puppet will ensure
the existence of the default production directory environment.  However
if this path has already been created as a symlink, the File resource
will ensure it is replaced with an empty directory.

Since an existing symlink is an indication that the user has already
made configuration changes, and the purpose of ensuring the existence of
the production directory environment is purely for assisting in new,
unmodified installations, this commit skips ensuring anything about the
production directory environment when a symlink is detected.

With Josh Partlow <jpartlow@puppetlabs.com>
Merge pull request #3075 from jpartlow/issue/stable/pup-3186-symlinked-production-envdir

(PUP-3186) Skip creation of symlinked default directory env
(PUP-3190) Correct acceptance test to ensure output
Merge pull request #3056 from zaphod42/issues/stable/pup-3190-cannot-load-4x-funcs-from-system

(PUP-3190) Don't assume puppet is in a lib dir