(SERVER-11) Added source to log message output
(SERVER-30) Copy cacert to localcacert and remove from master fail-fast

This commit removes the check for localcacert from the master fail-fast
logic and replaces with a new CA protocol function,
`retrieve-ca-cert!`, which populates the localcacert from cacert.  The
new protocol function separates the certificate generation logic in
`initialize-master-ssl!` from the CA cert acquisition logic, allowing the
latter to be reused sometime in the future.

In the previous commit, master initialization would fail if the master cert
and private key were not present but the localcacert were present.  The
latter is valid, for example, if the master certname is changed sometime
after the server is initially booted.  The new logic more closely
matches the error handling in Ruby Puppet master initialization.
Merge pull request #221 from camlow325/bug/master/SERVER-30-handle-localcacert-presence-or-absence

(SERVER-30) Copy cacert to localcacert and remove from master fail-fast
Merge pull request #219 from dankreek/SERVER-11/log-report-processor

(SERVER-11) Added source to log message output
(SERVER-68) Fix gem cli script bug
(SERVER-61) improvements to the ExecutionStub

* The execution stub now returns an instance of
  Puppet::Util::Execution::ProcessOutput, as per the contract of
  Puppet::Util::Execution.execute.

* Add basic spec/unit tests

* In java, close the reader used to read the process's STDOUT.

* In ruby, close the file handles passed-in for STDIN, STDOUT, and
  STDERR; we're not using these (this is implemented in java instead),
  but Puppet::Util::Execution.execute does not close them when an
  execution stub is installed.
Merge pull request #223 from dankreek/SERVER-68/fix-gem-cli-script-bug

(SERVER-68) Fix gem cli script bug
(MAINT) Minor presuite cleanup.

* Temporary file should use 'puppetserver' instead of 'puppetdb' in its name.
* Restructure code so it's a little easier to read.

Signed-off-by: Wayne <wayne@puppetlabs.com>
(PUP-3459) Reports dierctory created with wrong owner.

This is a workaround for a more general problem with the puppety approach to
creating application-level resources--creation of directories whose paths are
known in advance is an installation task, not a runtime task.

Signed-off-by: Wayne <wayne@puppetlabs.com>
Merge pull request #222 from waynr/maint

(PUP-3459) Pre-suite puppet bug workaround to avoid permissions errors during acceptance test.
(SERVER-61) more execution stub improvments

* Create 'ExecutionStubResult' class.
* Add a comment with link to a JIRA ticket.
(SERVER-69) Upgrade to tk-jetty9 v0.9.0
Merge pull request #226 from cprice404/maint/master/SERVER-69-upgrade-to-jetty9-0.9.0

(SERVER-69) Upgrade to tk-jetty9 v0.9.0
(SERVER-38) Store JRuby scripting containers in pool queue

This commit stores JRuby `ScriptingContainer` objects created during
JRubyPuppet pool initialization into a hash along with their associated
`JRubyPuppet` object and puts the result into the pool queue in the
service context.  The consumers of pool instances were updated to borrow
the `JRubyPuppet` object from the new hash instead of just being able to
access the `JRubyPuppet` object directly.

In the previous commit, the `ScriptingContainer` objects were not stored
in the service context and would fall out of scope when the
`create-jruby-instance` function returned.  The container objects could
then be garbage collected later on.  During garbage collection, the
terminate logic on the container would clean up -- decrement the ref
count for -- any open `ChannelDescriptor`s.  If the ref count for the
`ChannelDescriptor` had been bumped up because a file had been opened
during a JRubyPuppet request and the associated container was
terminated while the file was still open, the call that the JRubyPuppet
request would make to close the file handle would result in JRuby
throwing a `BadFileDescriptor` exception -- an assert fired because an
attempt was being made to decrement the ref count on the descriptor
below 0.  By always holding a reference to the `ScriptingContainer`s,
the containers will not be garbage collected and, therefore, the race
condition around closing descriptors would be eliminated.
(SERVER-76) Update puppet dependency

Update puppet dependency to be >= 3.7.1, rather than tying it
directly to 3.7.1.
Merge pull request #229 from fpringvaldsen/SERVER-76-puppet-dependency

(SERVER-76) Update puppet dependency
(SERVER-61) ExecutionStub: consume STDERR/STDOUT

Add a ProcessWrapper class for use by the ExecutionStub, which ensures
that the child process used to execute the command safely gets its STDOUT and
STDERR consumed by the parent process.  If this is not done, deadlock
can occur, if the child process is blocked on writing to either STDOUT
or STDERR, and the parent process is waiting on the child process to
terminate.
(SERVER-77) Enable/disabled cert status access control

This commit adds a new ca.conf setting to toggle on/off
access control to the certificate_status(es) endpoints.
The setting is optional, but defaults to true. When
false, the client-whitelist is ignored and plaintext
access is allowed.
Merge pull request #231 from nwolfe/svr77-disable-cert-status-auth

(SERVER-77) Enable/disabled cert status access control
(SERVER-39) Allow a certificate to be passed into a request via X header

This commit adds the ability for a certificate to be supplied in a web
request as the payload of a custom HTTP header, X-Client-Cert.  The
header will only be parsed for a value if the `allow-header-cert-info`
master setting is set to true.  When the certificate is retrieved, it
will be supplied as the client certificate to the Ruby request handler
stack, as a direct replacement for a certificate object that would be
typically be provided over SSL.