(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1293) Don't ignore status when using upstart provider

Since the upstart provider is overriding the status function,
it also overrides the default behaviour from the base service provider.

With this patch, if the status resource exists or hasstatus is set to false,
the default behaviour, from the base provider, will be invoked.
(maint) Remove unused scope from closure call_by_name

The big removal of 3x parser/ast missed to remove the unused scope
that was present in Closure#call_by_name.

This commit removes the unused scope, and corrects a typo in code that
supports use cases not yet merged to master (if invoked would cause a
hard stop on undefined variable 'scope').
(PUP-3274) Remove acceptance setup step to set parser

The old parser/evaluator have been removed, and there is no longer a
:parser setting and switch. The acceptance setup step which allowed the
setting of 'parser' in puppet.conf prior to a run is therefore obselete
and now being removed.
Merge pull request #3332 from demophoon/improve/master/pup-3140-error-illegal-number

(PUP-3140) Include faulty number in Illegal Number Parser Error
(maint) Do not add delivery domain to generated hosts

...unless it is missing. Earlier versions of Beaker, I believe, provided
a host name that was not an fqdn, and when our Rakefile was creating a
config to allow Beaker to be re-run against preserved hosts, it would
add the delivery domain. Now, hostnames are being found fully qualified
in the logs, and we need to only add the domain if the hostname is not
qualified.

This commit also refactors the code that releases vms to make use of the
internal vmpooler rather than relying on Beaker::VcloudPooled, whose
interface may change.
Merge pull request #3333 from jpartlow/issue/master/pup-3274-remove-set-parser-acceptance-step

(PUP-3274) Issue/master/pup 3274 remove set parser acceptance step
(PUP-1362) (PUP-1775) remove :python command

No longer needed after removal of yumhelper.py
(PUP-1362) (PUP-1775) map yumhelper.py's -e & -d flags to yum

The -e & -d flags to yumhelper.py had different semantics than yum's -d & -e
flags.  The yum equivalent option flags are --enablerepo & --disablerepo.
(PUP-2927) Enable Facter debugging with debug option.

Enabling Facter debugging when the debug option is given to Puppet.
(PUP-2927) Enable Facter stack traces with trace option.

Enabling Facter stack traces when the trace option is given to Puppet.
(PUP-2927) Route Facter logging through Puppet's log.

If using a recent version of Facter that supports Facter.on_message,
Puppet will now route Facter's logging through Puppet's log with a
source of "Facter".

This supresses Facter debug/warning message output in favor of letting
Puppet handle the messages.  This also results in Facter's logging
ending up in the report.
(maint) Replace Facter[].value calls with just Facter.value.

There are a few remaining Facter[:name].value calls remaining.
We use the shortcut method Facter.value throughout Puppet's source, so
removing these calls in favor of the simplier Facter.value call.
(PUP-3700) Deactivate invalid actions on faces

Instead of documenting that certain actions are invalid they should
be removed instead.

Add the deactivate_action on faces to do this
Merge pull request #3331 from peterhuene/pup/2927

(PUP-2927) Improve Facter logging integration.