(#21817) Ignore duplicate certs

Previously, SSL connections initiated by the puppet agent on windows, e.g
puppet module install, would cause the agent to terminate if the 'Root' store
on Windows contained duplicate certificates.

This commit ensures that we only add unique certificates to the X509 store.
Also, if we fail to add a certificate to the store, we issue a warning and
continue.
(#21241) Add a priority setting

This commit add a `:priority` type of setting that maps generic priority
labels to operating system specific priorities, e.g. normal priority is
0 on posix, but 32 on Windows.

If the value is specified as an integer, then it is passed as is, so
that specific priority levels can be specified.

This commit also adds the `priority` setting to the main section of
puppet's configuration.
(#21241) Set process priority if one is specified

This commit adds a Puppet::Util::Limits module for specifying process
priority, and mixes the module into Puppet::Util::CommandLine. Since
the CommandLine is the application entry point for puppet it seemed
sensible to have it set the process priority there, and to have it done
as early as possible.

Another option would have been to set the priority in the base
Application, after the application-specific settings have been
initialized. But this would mean you couldn't set the process priority
when puppet executes an ExternalSubcommand-based application.

As it stands now, it's not possible to have different priorities for
different sections, e.g. agent vs master, in puppet's configuration
file.
(#22878) Scope call to CloseHandle

Previously, the win32-process gem used to extend Windows::Handle from the
windows-pr gem, so that the Process.CloseHandle method was available.
However, newer versions of the win32-process gem that are based on ffi, do
not extend Windows::Handle, so the Process.CloseHandle method is not defined.

This commit modifies puppet to call a version of CloseHandle which we
control, and therefore is guaranteed to exist.
Merge branch 'ticket/stable/22878-close-handle' into stable

* ticket/stable/22878-close-handle:
  (#22878) Scope call to CloseHandle
init: Check if running if not configured to start.

The reasoning for this is explained in:
https://projects.puppetlabs.com/issues/23033

Currently the init-script does not actually check if we're running and
return accordingly when status is called if the puppet master is not
configured to start.

This causes it to always return 0, meaning we're actually running
regardless of if that is the case.
(#9546) Fix spec tests against facter 1.6.

Previously the facter_spec tests called directly into
Puppet::Nodes::Facts::Facter.setup_external_facts and
ran regardless of whether the facter version supports
external_facts_dirs=.

Note that facter 1.7 had external_facts_dir so this test passed,
but didn't have external_facts_dirs? and didn't support external
facts plugin sync, so really shouldn't have supported this test.
Facter 1.6 didn't have either so exposed this mismatch.

This change:
a) marks setup_external_facts as private, which was the intent
b) changes the affected tests to use the indirector's find method,
   which is intended to be public
c) changes the affected tests to be confined by Puppet.features.external_facts?
Merge pull request #1922 from joshcooper/ticket/master/21241-priority

(#21241) Allow process priority to be specified
(#21241) Use correct constant for low priority

Needs to be BELOW_NORMAL_PRIORITY_CLASS.
(maint) Remove stale files from ext/rack

The ext/rack directory had an outdated README file and an ancient manifest.pp
file, and the useful files (config.ru and the example vhost) were buried in a
subdirectory.

This commit removes the old files, moves the good files up a level, and adds a
comment to the vhost pointing to the maintained passenger documentation.
(maint) Update debian packaging to reference new rack support location

As updated in commit 4c9b63f, the sample files for rack passenger deployment
have been moved up a directory. The puppetmaster-passenger package for debian
uses those files, so this commit updates the debian/rules file with their new
location. It also updates the README_DEVELOPER.md, which references the same
files.
Maint: Reformat docs for Augeas type's "changes" attribute

I'm trying to get DL elements out of the docs, and this fragment works better as
a more compact list anyway.
Maint: Reformat indirection reference to use H4s instead of DLs for termini

A long time ago, I shortsightedly decided to use the definition list Markdown
extension in some of our docs. Time and the renderer ecosystem haven't been kind
to that syntax, so we need to get away from them if we want to be able to switch
relatively freely between various MD processors.

This commit removes them from the last embedded documentation that we still use.
The old-style type reference still uses them, but since we've stopped relying on
it and moved to our own implementation, that should be fine.
(#22925) Fall back to cached catalog if we can't connect to the master

Prior to commit 093a0745b4, puppet would attempt to download a catalog, and if
that failed, it would apply a previously cached catalog. Note this
behavior is controlled by the `usecacheonfailure` setting, which is
disabled when using `--test`.

In commit 093a0745b4, the ENC was made authoritative for specifying node
environment. In doing so, the agent makes a REST call to the master for
its Node object, and then reads the environment from it.

However, the call is made in a begin/rescue block that only catches
Puppet::Error and Net::HTTPErrors, but not errors like
Errno::ECONNREFUSED, etc.

This commit ensures that any standard error will be caught when
retrieving the node's environment, as is done when retrieving the
catalog. If we fail to obtain the node's environment, we warn, and
continue trying to apply the catalog.

This commit does not try to fix consistency issues between the node and
catalog requests. For example, the node request could fail, resulting in
the agent requesting a catalog using its agent-configured environment.
The catalog request could succeed, resulting in the agent applying a
catalog from an environment that doesn't match what the ENC thinks it
should be.
(maint) Fix acceptance harness and tests for windows vcloud templates

Changes the git/pre-suite environment setup step to rely on the
puppet-win32-ruby repo for a windows specific build of ruby with the
gems we require.  Currently we are copying this directly into /bin and
/lib and resetting /lib/ruby for full permissions.  This is ugly, but
Josh and I were having trouble setting PATH in a global way through
Beaker.

This patch also fixes a win2008 bug in tests/ticket_15560_managehome.rb,
which I believe we never hit before because we have only been testing
aginst win2003, clears up a problem in the
resource/scheduled_task/should_query.rb being unable to run against
multiple agents, and patches the sslv2_downgrade_agent test to absorb
exit code 28 (timeouts) from the curl test, which are probably cropping
up occasionally on slow vms.  Kylo applied a similar fix for the 2.7.x
branch fa1e8e0
(#23074) Add reinventory command to puppet cert

This adds a reinventory command to the puppet cert application.

Further work on this is to refactor the use of the #apply method
found in Puppet::SSL::CertificateAuthority as it delegates to
a subclass called Interface to do the work. This is all an application
concern and it is confusing with the back and forth between the classes
"the cert application", the CA and its Interface.
(#23074) Add text to warn that master should be inactive for reinventory.
(#23074) Cleanup logic

This makes a couple of the methods in the CertificateAuthority and
related Interface classes easier to read / understand.
(#23074) Remove header in inventory.txt when regenerating

The regenerate inventory wrote a header that was not there in the
original file.
(#23074) Make cert inventory not rebuild inventory.txt when adding

There is a race condition that requires protection if the inventory
performs rebuild of a missing inventory.txt file when adding a cert.
Without the protection the inventory may end up with double entries or
missing entries, and with the protection the processing of cert requests
become serialized over all processors creating a performance problem.

This change simply appends to the inventory.txt - if the file does not
exists, it is atomically created.

A users that wants to recreate the inventory should do so with the
command `puppet cert reinventory` which may be executed on an
inactive system.