I encountered this today while trying out CFEngine for the first time, and was very confused why my changes in /var/lib/cfengine/masterfiles were being ignored and not copied into /var/lib/cfengine/input as they should. As noted in the original report, cf-agent is using /usr/share/cfengine/masterfiles as the policy source, instead of /var/lib/cfengine/masterfiles.
The reason why it's looking in the wrong place is that the controls/update_def.cf policy file sets the mpf_update_policy_master_location variable to /usr/share/cfengine3/masterfiles (when running on the policy hub). The upstream copy of that file uses /var/cfengine/masterfiles, so Debian is patching the file to use a different path, but mistakenly patching it to say /usr/share instead of /var/lib. The package's /usr/share/cfengine3/masterfiles/controls/update_def.cf file ought to say /var/lib/cfengine3/masterfiles as the value of mpf_update_policy_master_location, so that when the directory is copied to /var/lib/cfengine/masterfiles by the package's postinst, the file there will correctly point to its own location. In the meantime, the workaround is to manually edit /var/lib/cfengine3/masterfiles/controls/update_def.cf and change it to the correct path. If the bootstrap has already been done, the copy in /var/lib/cfengine3/inputs must be manually edited too.
