(docs) Note that the path setting only works in main section of puppet.conf

See PUP-3023 for more info.
(PUP-1106) Unschedule refreshes on skipped resources

If a given resource is being skipped (e.g. has failed dependencies, is
unscheduled, untagged, etc) that resource should not trigger any
additional behavior. However a resource could be skipped and still have
events trigger behavior. This commit changes the event processing logic
to only process events for resources that should be applied and dequeues
events on resources that should not be applied.
(maint) Use correct data type when unscheduling events

Commit 9d59f204 added the ability to dequeue events on a given resource,
but it did so by setting the value of the target callbacks to an empty
hash. However the value of target callbacks is an array, so if events
were re-queued for a given resource we would get an error like so:

    {}.concat(%w{one two three})
    NoMethodError: undefined method `concat' for {}:Hash

Currently we can't requeue events after dequeuing events, but if this
changes then this code is very incorrect.

This commit fixes the event reset to behave as expected.
(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(maint) Log invalid modules

Give notice when a module on the modulepath is invalid, explaining why.
To do this cleanly, we stop trying to add "." and ".." as modules since
these are always invalid.
(maint) Avoid checking for strings in module_references

module_references contains Hashes so there is no need to look for
strings within it, especially when the next line does what this one was
supposed to do.
(PUP-3511) refactor Application.run for reuse

Extract a small chunk of code from Puppet::Application.run into its own
method so that it can be reused.  This code is currently duplicated in
Puppet Server; the introduction of this new `reset_environment_context`
method enables the replacement of the duplicated code in Puppet Server
with a call to this method.
(PUP-3511) refactor 'configure_indirector_routes'

Add a `self` version of `configure_indirector_routes` which takes the
application name as a parameter.  This method is currently copied into
Puppet Server, and the new version of it will allow for the duplicated
version in Puppet Server to be deleted.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-3511) introduce 'ApplicationSupport' module

Introduce a new module named 'ApplicationSupport'.  Move
'configure_indirector_routes' into this module.  Move
'reset_environment_context' into this module, and rename it to
'push_application_context'.
(PUP-3511) yardoc for 'push_application_context'
(PUP-3654) Deprecate Puppet.newtype

The `newtype` class method of the Puppet module includes a comment from
2011 stating that the method should be deprecated, but was under heavy
use at the time.

This commit adds a deprecation warning to this method to indicate that
it will be removed in a future release. Types using the old method have
also been updated to use `Puppet::Type.newtype`.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3511) update docs in 'ApplicationSupport'
(PUP-3665) Fix resource overrides for 4x collector

Prior to this commit, the new implementation of collections caused
overrides to fail if the given attribute was a Resource. This was
because 3x required an instance of Resource rather than PResource
Type. In order to fix this issue, transform the override attribute
into the appropriate format for the 3x compiler.
Merge pull request #3307 from hkenney/issue/stable/PUP-3665_fix_collection_resource_overrides_with_future_parser

(PUP-3665) Fix resource overrides for 4x collector
(PUP-3096) Remove deprecated trusted_node_data and immutable_node_data options

This commit removes the deprecated trusted_node_data and
immutable_node_data options from puppet/defaults. This ensures
that $facts and $trusted are always available so that we can
start phasing out facts as top-scope variables.

This commit is part of the Puppet 4 code removal effort.
(maint) Verify module exception is logged

Verifies that if puppet fails to load a module, e.g. missing metadata,
that we log the exception:

     $ bundle exec puppet apply -e "include mymodule"
     Error: No dependencies module metadata provided for mymodule
     Error: Could not find class mymodule for ...
(maint) Refactor tests to use helper to create module directory

Refactor tests to use PuppetSpec::Modules.generate_files to create
the module directory. Note the order of arguments is reversed.