source function library *before* client sysconfig overrides

My client's environment mandates strict umask settings:
  - 027 for init scripts
  - 077 for normal users
This causes problems when using exec resources or any add-on functions
that exec external scripts/programs.

The fix is relatively simple - run umask in /etc/sysconfig/puppet
and set a more lenient umask for puppet.
However, the /etc/sysconfig/puppet is sourced before the init
function library so any umask changes made in the former are
overridden by any in the latter.

Looking in other init scripts (including the puppetmaster init
script), it is usual for the function library to be sourced at the
start of the init script, ie. before the sysconfig override.

This change simply moves the lines that source the init function
library to the start of the init script.
(PUP-1174) enable the purging of authorized ssh keys

Purging authorized ssh keys is difficult because there is no way know
where key files may be located. Users commented that for most it should
be sufficient to clean the keys from users that puppet manages.
John Bollinger suggested a design that's based on a new parameter to the
user type. There are two ways to use it:

user { "name": purge_ssh_keys => true }

to make puppet purge from the default ~/.ssh/authorized_keys file, or

user { "name": purge_ssh_keys => [ "/etc/keyfiles/name" ] }

to specify one or more files in non-standard locations.

The implementation is similar to the file type's purging code. The user
type now has an eval_trace method that searches the specified files for keys
and adds any unmanaged keys to the catalog with ensure => absent.
(PUP-1174) amend resources type documentation

Add a reference to the new purging feature to the documentation of the
resources type description.
(PUP-1174) add tests for the purge_ssh_keys parameter of the user type
(PUP-1749) Fix module_tool extract for non-gnu tar

This commit refactors how tar is called when the module tool extracts a
downloaded archive so that it is compatible with generic Unix tar, and
does not require GNU extensions. The commit allows the module tool to
work out of the box on Solaris 10, without requiring access to the gtar
command, and presumably this aspect of the module tool will now work
with tar on other old-style unix platforms as well.
Add tests for module_tool changes

I'm not entirely sure if I'm using #yields() correctly but this allows
me to expect that Dir.chdir is called, and still expect all the calls to
Puppet::Util::Execution.execute to be made.
(PUP-1041) nagios: parse empty parameter values in definitions

This is a valid nagios defintion:

define host {
	parents
	use       linux-server
}

That's because an empty parents list has distinct semantics. There may be
other variables that can take an empty value, possibly in conjunction with
object inheritance.

The naginator provider will not accept this definition, because the
nagios config parser expects a value for each and every parameter.

Fix this by adding an according rule to the grammar.

Also, the lexer must be altered, because parameters and values are lexed
differently and returned as distinct tokens. When encountering newline
while scanning for a parameter value, the lexer must give up and reset
its internal state. (Otherwise, it would not accept another parameter
name or the end of the current definition block.)
Remove now-redundant Tar::Solaris from module_tool

Changes to the way Puppet::ModuleTool::Tar::Gnu works means that the
*::Tar::Solaris variant should now be redundant. It existed to require
gtar when the underlying platform did not support GNU-tar options, but
the changes to the core Tar::Gnu class mean that we no longer use any
flags or options that don't work just fine with oldschool unix tar
executables. Remove Puppet::ModuleTool::Tar::Solaris.

On a side note, Tar::Gnu should probably be renamed to something more
generic.
Merge pull request #2247 from ffrank/ticket/master/1581-purge-all-ssh-keys

(PUP-1174) enable the purging of authorized ssh keys
(maint) Fix face_collection_spec to properly restore global state.

The spec attempts to restore global state stored in
Puppet::Interface::FaceCollection so that it doesn't interfere with
other specs that may use faces.

It fails to clear any files required by the autoloader, but clears the
@faces member.  The result is that if a face is referenced again from
another spec, it doesn't get defined and added to @faces and cannot be
found.

The fix is to clear the state before and after each example.

The problem can be observed with the following:
rspec spec/unit/interface/face_collection_spec.rb spec/unit/application/face_base_spec.rb

This closes GH-2422.
(maint) Use provider property accessors in the Cron type

ParsedFiles is the only provider which actually creates an accessor to expose
the internal `@property_hash` of provider instances. This patch replaces
uses of `property_hash` in the Cron type with the `target` accessor method that
providers define for the `target` property.
Merge pull request #2385 from ffrank/ticket/master/PUP-1041-nagios-parse-blank

(PUP-1041) nagios: parse empty parameter values in definitions
(maint) Revert "Fix face_collection_spec to properly restore global state."

This reverts commit 1b8a7ea2b8e5835c7d563e23609bb74fd84b43ba.

This backs out the change because it causes Jenkins to fail due to its
spec order.

Will investigate a proper solution to both problems.
Maint: Fix wrong description of valid start_date values for scheduled_task triggers

This said special dates like "today" would work, but it actually uses
Date.parse, which doesn't accept anything like that.
Merge pull request #2430 from nfagerlund/docs_scheduled_task

Maint: Fix wrong description of valid start_date values for scheduled_ta...
Merge pull request #2425 from Sharpie/fix-cron-purging

Use provider property accessors in the Cron type
(PUP-1174) Use Puppet::Util.absolute_path? to validate purge_ssh_keys

Previously, the `purge_ssh_keys` parameter was validated as either starting
with '/', '~' or '%h', but the first one is not a valid absolute path on
Windows.

This commit uses the Puppet::Util.absolute_path? to check for absoluteness.
Also updates the spec tests to be specific about the type of exception and
message that they expect. And in cases where we don't expect an exception, we
don't need to expect { .. }.to_not raise_error, since rspec will fail any
test that does raise.

Paired-with: Charlie Sharpsteen <chuck@puppetlabs.com>
(maint) Fix face specs to not pollute global state.

The face_collection_base spec attempts to restore global state stored in
Puppet::Interface::FaceCollection so that it doesn't interfere with
other specs that may use faces.

It fails to clear any files required by the autoloader, but clears the
@faces member.  The result is that if a face is referenced again from
another spec, it doesn't get defined and added to @faces and cannot be
found.

The fix is to clear the state before and after each example.

The problem can be observed with the following:
rspec spec/unit/interface/face_collection_spec.rb spec/unit/application/face_base_spec.rb

Additionally, the indirection_base spec registers a face but does not remove the face
after the examples have fun.  The fix is to remove the face from the FaceCollection after
all examples.
Merge pull request #2112 from yo61/develop

source function library *before* client sysconfig overrides
Merge pull request #2378 from reidmv/fix_moduletool_tar_non_gnu

(PUP-1749) Fix module_tool extract for non-gnu tar