- Vendor in hex_core at v0.6.8
 - Rename checksum to inner_checksum and deprecate in favor of new outer_checksum key/val
 - Change warn_vsn_once/0 to warn_vsn_once/1 so we can give a proper error message and
   take appropriate action.
 - Update rebar.lock to 1.2.0 format with continued support third-party
   that still may make use of inner checksum via continued persistence of
   inner checksums.
 - Changed app info tuple (package representation) to support inner and
   outer hashes for backwards compat support (see above)

Fixes #2159; this is done by force-reloading the handlers to match the
config.
This can create a bit of a funny effect if sys.config specifies an INFO
log level (or lower) is specified. While apps are booted for config
changes before the cth_failonly hook is enabled, supervision and other
application log messages can start being output. They will start being
suppressed once the CT run begins.

This is not a bug, it's a race in instantiation of control and enabling
of log levels. Nothing we can do about that. It might however surprise
people a good bit. If non-default stdout handlers are added, they are
similarly likely to become noisy; specifying a test-specific sys.config
file may be necessary then.

Also includes a bump of cth_readable version, which now checks for
updates to the log formatter on every test output.

fixed #2063

- vendor in hex_core at v0.5.0
  - Change where repo_name should be the org and not the parent
  - Changed rebar_utils:url_append_path/2 to not explicitly add a '?',
    this is returned in the Query chunk by http_uri:parse/1 (e.g., "?foo=bar")
  - update organization_merging test to expect the sub-repo as the repo_name
  - Add tests for rebar_utils:url_append_path/2
  - Stop referencing/setting "organization" in config and use new
     organization settings (api_repository and repo_organization)
  - Do not set (assume) the read key is valid for any/every repo
  - Set repo_organization and api_repository to org
  - Update tests to check for new config opts

Handles some internal changes in logger in OTP-21.2 that broke the
follow-up error printouts after the first failure of a CT run

* bump bbmustache to version 1.6.0

* Use alternative bbmustache brackets in templates

This fixes the problems where literal nested tuples (`{{a,b},c}` or
`{{a,b}}`) would blow up and spaces needed to be inserted.

* update to hex_core for hex-v2 repo support (#1865)

* update to hex_core for hex-v2 repo support

This patch adds only single repo hex-v2 support through hex_core.
Packages no longer filtered out by buildtool metadata and the
package index is updated per-package instead of fetched as one
large ets dump.

* tell travis to also build hex_core branch

* support list of repos for hex packages (#1866)

* support list of repos for hex packages

repos are defined under the hex key in rebar configs. They can be
defined at the top level of a project or globally, but not in
profiles and the repos configured in dependencies are also ignored.

Searching for packages involves first checking for a match in the
local repo index cache, in the order repos are defined. If not found
each repo is checked through the hex api for any known versions of
the package and the first repo with a version that fits the constraint
is used.

* add {repos, replace, []} for overriding the global & default repos

* add hex auth handling for repos (#1874)

auth token are kept in a hex.config file that is modified by the
rebar3 hex plugin.

Repo names that have a : separating a parent and child are considered
organizations. The parent repo's auth will be included with the child.
So an organization named hexpm:rebar3_test will include any hexpm
auth tokens found in the rebar3_test organization's configuration.

* move packages to top level of of hexpm cache dir (#1876)

* move packages to top level of of hexpm cache dir

* append organization name to parent's repo_url when parsing repos

* only eval config scripts and apply overrides once per app (#1879)

* only eval config scripts and apply overrides once per app

* move new resource behaviour to rebar_resource_v2 and keep v1

* cleanup use of rebar_resource module and unused functions

* cleanup error messages and unused code

* when discovering apps support mix packages as unbuilt apps (#1882)

* use hex_core tarball unpacking support in pkg resource (#1883)

* use hex_core tarball unpacking support in pkg resource

* ignore etag if package doesn't exist and delete if checksum fails

* add back tests for bad package checksums

* improve bad registry checksum error message

Includes an update to parse_trans on an OTP-21 friendly version

Also small output fix in rebar3 shell

cth_readable 1.4.0 supports the new logger interface from OTP-21, which
likely breaks compatibility with R16 builds.

It also includes a new compact interface, displaying output such as:

    ===> Running Common Test suites...
    %%% rebar_alias_SUITE: ......
    %%% rebar_as_SUITE: ...........
    %%% rebar_compile_SUITE:................................
    ............................
    %%% rebar_compile_SUITE ==> test_name: SKIPPED
    %%% rebar_compile_SUITE ==>
    {tc_user_skip,"compile:env_compiler_options/0 available"}
    ..
    %%% rebar_cover_SUITE: .............
    %%% rebar_ct_SUITE: ....................................

Allowing to display more tests within less screen space.
This mode has been added to the ct_readable option under the name
'compact' (now supporting true | false | compact), and has been made
default for rebar3.

Fixes some lager warnings since config changes

Eliminates a lager warning due to config format deprecation

This replaces all deprecated function usage by alternative ones based on
a version switch enacted at compile time, preventing all warnings.

This will likely introduce some possible runtime errors in using a
Rebar3 compiled on OTP-20 or OTP-21 back in versions 19 and earlier, but
we can't really work around that.

A bunch of dependencies have been updated to support OTP-21 without
warnings as well.

Get more up-to-date root certs. This was blocked for a while because
certifi wouldn't build on windows, but this is now fixed, with minimal
changes to the use case -- only a small change in the bootstrap script
is required.

The new certifi lib is also a few megabytes lighter than before, which
is good for rebar3.

This fixes the output of end_per_testcase crash notifications when the
test passes.

This also detect an issue of the kind with rebar_pkg_SUITE which is now
fixed.