source function library *before* client sysconfig overrides

My client's environment mandates strict umask settings:
  - 027 for init scripts
  - 077 for normal users
This causes problems when using exec resources or any add-on functions
that exec external scripts/programs.

The fix is relatively simple - run umask in /etc/sysconfig/puppet
and set a more lenient umask for puppet.
However, the /etc/sysconfig/puppet is sourced before the init
function library so any umask changes made in the former are
overridden by any in the latter.

Looking in other init scripts (including the puppetmaster init
script), it is usual for the function library to be sourced at the
start of the init script, ie. before the sysconfig override.

This change simply moves the lines that source the init function
library to the start of the init script.
(maint) Simplify the CA use of the autosign setting

Commit bca628dc adds proper conversion of autosign input values to
booleans, but Puppet::SSL::CertificateAuthority was still trying to
handle string values. This commit simplifies the checking logic and lets
the autosign setting handle data normalization.
(#PUP-1046) Add spec test for skeleton for generated modules

This patch adds a simple spec test to ensure that by including the
class with default values for all the parameters, that the class is
contained within the catalog.
(#FORGE-38) Add Rakefile to skeleton for generated modules

This patch adds a simple Rakefile that provides rake tasks `lint` for
puppet-lint, `validate` for validation of manifests, templates, and ruby
files, and the tasks provided by the puppetlabs_spec_helper.
(PUP-1174) enable the purging of authorized ssh keys

Purging authorized ssh keys is difficult because there is no way know
where key files may be located. Users commented that for most it should
be sufficient to clean the keys from users that puppet manages.
John Bollinger suggested a design that's based on a new parameter to the
user type. There are two ways to use it:

user { "name": purge_ssh_keys => true }

to make puppet purge from the default ~/.ssh/authorized_keys file, or

user { "name": purge_ssh_keys => [ "/etc/keyfiles/name" ] }

to specify one or more files in non-standard locations.

The implementation is similar to the file type's purging code. The user
type now has an eval_trace method that searches the specified files for keys
and adds any unmanaged keys to the catalog with ensure => absent.
(PUP-1174) amend resources type documentation

Add a reference to the new purging feature to the documentation of the
resources type description.
(PUP-1174) add tests for the purge_ssh_keys parameter of the user type
Clarified `pattern` parameter for Service type (DOCUMENT-1)
Clarified the use of slashes around RegEx for `pattern` attribute
(PUP-1586) allow managing existing cronjobs without caring for command

When the catalog contains a cron resource that does not specify a value
for the command property, the transaction would fail with the cryptic
error message 'no command, somehow' under certain conditions.

This error is spurious. Generally, it's quite allowable to manage a subset
of cron properties that does not include the command. Fixed by removing
the devfail invocation. The command property is now handled just like
the 'special' property.
(PUP-1586) remove obsolete unit test

The cron type unit test titled "it should require a command when adding
a new entry" did not quite do what it said. What it actually tested was
that the type would raise an exception when an empty command should-value
was accessed.

This can be safely removed, as PUP-1587 will implement a more sensible
protection against the creation of cronjobs that lack a command, including
a working integration test.
(PUP-1587) crontab: make sure that invalid crontabs aren't written out

It is permissible to manage cron entries and not manage the command
property. However, if the entry doesn't exist on the target system yet,
puppet should not try to create it.

In other words, a cron resource without a should value for the command
property can only be synced to a valid state if the corresponding resource
on the target system has a valid command value already.

cron { "foo": minute => 1 }

is alright with an existing crontab of

 # Puppet Name: foo
 * * * * * /some/command

but not with a crontab not yet containing the entry named 'foo'.

This change prevents the sync operation in the error scenario.
(PUP-1749) Fix module_tool extract for non-gnu tar

This commit refactors how tar is called when the module tool extracts a
downloaded archive so that it is compatible with generic Unix tar, and
does not require GNU extensions. The commit allows the module tool to
work out of the box on Solaris 10, without requiring access to the gtar
command, and presumably this aspect of the module tool will now work
with tar on other old-style unix platforms as well.
Add tests for module_tool changes

I'm not entirely sure if I'm using #yields() correctly but this allows
me to expect that Dir.chdir is called, and still expect all the calls to
Puppet::Util::Execution.execute to be made.
(PUP-1041) nagios: parse empty parameter values in definitions

This is a valid nagios defintion:

define host {
	parents
	use       linux-server
}

That's because an empty parents list has distinct semantics. There may be
other variables that can take an empty value, possibly in conjunction with
object inheritance.

The naginator provider will not accept this definition, because the
nagios config parser expects a value for each and every parameter.

Fix this by adding an according rule to the grammar.

Also, the lexer must be altered, because parameters and values are lexed
differently and returned as distinct tokens. When encountering newline
while scanning for a parameter value, the lexer must give up and reset
its internal state. (Otherwise, it would not accept another parameter
name or the end of the current definition block.)
(PUP-1085) Make Pacman provider group-aware

The Archlinux Pacman package manager has a concept of package groups,
which due to the provider not checking for a group being installed
caused all contained packages to be reinstalled.

This commit uses `pacman -Qg` in addition to `pacman -Q` to check for
installed groups.

Because groups don't have versions this will still cause all packages in
a group to be reinstalled if ensure is set to latest.
(PUP-1585) cron: fix resource duplication in crontab provider

The regression fix for #19876 caused yet another regression in cron
resources that manage the target property, but not the user property.
The earlier fix made sure that a cron resource would not try and manage
a matching record from another user's crontab. It did so by comparing
the record's target to the resource's user property.

When the user is unmanaged, but the target is specified instead, this
would cause puppet to ignore the record on disk and add it once more.

This is fixed by comparing the record's target to either the user
property or the target property. If there is a should-value for the
user, it is used, otherwise the provider falls back to the target
should-value.
(PUP-1585) amend unit test to match corrected behavior

Just a simple addition to the mock object used for some tests, because
the crontab provider will now perform an additional property value lookup
to find an on-disk resource.
(PUP-1624) cron: move the default value logic from user to target

Crontab is an oddball example for parsedfile resources, because resources don't
end up in actual files, but I/O is indirected through crontab(1) instead.
Therefor, the target property doesn't really apply and maps to the user
property instead, after a fashion - the user that runs the cron task is
determined by which crontab the entry is stored in.

For default values, it was determined that the user property should be
processed before the target property (on type level) and choose the default
(i.e. the user running puppet). The target property would use the value
of user as its default.

This leads to a peculiar situation when target is managed but user is not.
User *will* use its default value then, which will often differ from the
choice made for target. Puppet will then try and bring the user property
in sync with the default value.

To evade this, a default value for the user property should be avoided,
at least for resources that use the crontab provider. The current rules:

1. The 'user' property uses the user running puppet as default.
2. When crontab is in use, 'target' uses the 'user' value as default.
3. For other parsedfile providers, 'target' uses the provider's default.

Instead, apply the following rules:

1. When crontab is in use, 'user' has no default value.
2. Otherwise, the default is the user running puppet.
3. If crontab is in use and there is a 'user' value, 'target' defaults to that.
4. If crontab is in use and there is no 'user' value, 'target' defaults to the
user running puppet.
5. For other parsedfile providers, 'target' uses the provider's default.
(PUP-1624) cron: fix a unit test regression

The cron unit tests make use of an artificial trivial provider.
Therefor the type code should not traverse code paths that apply only
when the crontab provider is used. For some reason, this didn't work
correctly when the provider was stubbed in place 'before :all' instead of
'before :each'.

As a result, this following test failed because of the change to the
behavior of the user property when using crontab:

Puppet::Type::Cron should default to user => root
  if Etc.getpwuid(Process.uid) returns nil (#12357)

Restructure the hooks to make the behavioral check pass again.