(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
(PUP-1019) Remove ZAML

Before this commit we were using ZAML by monkey patching the `to_yaml`
function to use ZAML.dump instead of YAML.dump. After removing `zaml.rb`
tests started failing because of the way that ZAML serialized YAML so
assertions in those tests were changed.

This commit also adds in a patch to YAML.Psych to handle the cases where
ruby objects were being encoded improperly.

This commit removes the use of ZAML in puppet as part of the Puppet 4.x
code removal efforts.
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1019) Fix serializing environments.

This commit fixes a regression with Puppet::Node::Environment
serialization. When a Puppet::Node::Environment object would be
serialized the entire object was serialized instead of just the
environments name.
(PUP-1293) Don't ignore status when using upstart provider

Since the upstart provider is overriding the status function,
it also overrides the default behaviour from the base service provider.

With this patch, if the status resource exists or hasstatus is set to false,
the default behaviour, from the base provider, will be invoked.
(PUP-3682) Disable HTTP keepalive in webrick on 1.8.7

Previously, webrick would attempt to support HTTP keepalive so that HTTP
clients could send multiple HTTP messages on the same TCP (SSL)
connection. However, we found in practice that RHEL6 with system ruby
1.8.7-p352 with openssl 1.0.1e-fips does not reliably handle keepalive.
Most commonly the webrick server fails to read the agent's report, or
sometimes fails when handling the agent's catalog request:

    Server Error: SSL_read:: internal error

This commit causes the webrick rest handler to always include the HTTP
header `Connection: close` in the HTTP response. This indicates to the
HTTP client that the webrick server does not want to keep the connection
alive, and that the client should make a new connection the next time it
connects.

This change does not affect webrick running under 1.9 or later, nor does
it affect puppet masters running under passenger or puppet-server. As
these do reliably handle HTTP keepalive, and we want the performance
benefit that persistent http connections provide.

Note 1.8.7 support will be going away in Puppet 4, so this is a
short-term fix to the 3.7.x series.
Merge pull request #3325 from joshcooper/ticket/stable/PUP-3682-disable-webrick-keepalive

(PUP-3682) Disable HTTP keepalive in webrick on 1.8.7
(maint) Clarify Puppet::Util::PsychSupport#encode_with method

Add additional documentation on the encode_with method.
Merge pull request #3301 from demophoon/remove/master/zaml

(PUP-1019) Remove ZAML
(PUP-3091) Add test coverage for heredoc support

Before this commit the spec tests for heredoc support in Puppet did not
include tests to make sure that escaping new lines used the correct
margin on the preceding lines.

This commit adds in tests to ensure that we do not regress on this in
the future.
Merge pull request #3327 from demophoon/fix/stable/pup-3091-heredoc-support

(PUP-3091) Add test coverage for heredoc support
(maint) Install CA certs during git and package runs

Previously, the step for installing CA certs was only run during "git"
acceptance runs. This step is needed for module related acceptance tests
to work on platforms that don't already trust the forge's root
certificate, notably on Windows.

This commit makes the setup step common for both git and packages. This
doesn't actually change anything for "packages" because the step is only
executed on Windows, and we don't yet test against packages on Windows.
It also makes it easier to add support for other agent platforms that
have the same issue, e.g. Solaris

This commit also fixes the misspelling in the file name.
Merge pull request #3328 from joshcooper/ticket/stable/maint-refactor-install-ca-certs

(maint) Install CA certs during git and package runs
Merge branch 'stable'

* stable:
  (maint) Install CA certs during git and package runs
  (PUP-3091) Add test coverage for heredoc support
  (PUP-3682) Disable HTTP keepalive in webrick on 1.8.7
(PUP-3274) Make 4x recursive directory import the standard.

This behavior was conditional to the future parser being used.
With 3x, only the top level directory was scanned for .pp files
to import, and when future parser was in effect, the search for
.pp files were recursive.

Now the future parser behavior is standard.
(PUP-3274) Make the defined function support 4x arguments as standard

The defined function in 3x with future parser added support for type
references. This commit makes this behavior standard in 4x.
(PUP-3274) Make lookup function be available as standard.

The lookup function was conditional on future parser being used.
It is now always available.