(PUP-1069) Implement feature :upgradeable for OpenBSD package provider.
(PUP-2399) Add mailalias acceptance tests

Add basic acceptance tests for mailalias type. This adds acceptance
tests for create, query, modify, and destroy.

The tests assume that the mailalias type manages the default
/etc/aliases text file as well as updating the binary database
that the aliases file is the source for.
(PUP-2399) Remove testing of newaliases

As per PUP-1143, the mailalias type does not manage the state of
the aliases.db file via 'newaliases', 'sendmail -bi', or any other
mechanism due to compatibility issues. Since this is the case,
all testing of the aliases.db file have been removed from the
mailaliases tests in this commit.
(PUP-121) Make include, require, and contain enforce non relative names

This makes include, require, and contain functions transform
relative names to absolute names before doing any lookup.

The transformation is controlled by a metho on scope that is
always called, and that performs the transformation when Puppet[:parser]
== future. This design was selected to ensure that there is one place to
later change (other flags, or in Puppet 4 when the future will
be something else).
(PUP-121) Add more tests, doc, and correct behavior

This generalizes the "make names absolute" to a transformation
of given arguments to class names strings suitable for lookup, and
also applying the transformation to Class and Resource reference types.
(PUP-121) Make examples for relative/absolute shared

This makes the examples that test include, require, contain
share the same tests.

This also adds one missing error condition.
(PUP-2478) Remove current directory from Ruby load path.

The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
puppet is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by puppet.
(PUP-2533) Apache 2.4 requires explicit CRL configuration

In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
directives were specified then the specified file(s) would be checked
when establishing an SSL connection. Apache 2.4+ the
SSLCARevocationCheck directive was added to control how CRLs were
checked when verifying a connection and had a default value of none.
This means that Apache defaults to ignoring CRLs even if paths are
specified to CRL files.

This commit updates the debian postinst script for the
puppetmaster-passenger package to set SSLCARevocationCheck directive to
'chain' when Apache 2.4 is installed. This ensures that the the
puppetmaster-passenger vhost respects CRL files in the same way that
Apache 2.2 does by default.
Apache 2.2
(maint) extract initial Passenger configuration
(PUP-2533) Insert SSLCARevocationCheck on upgrade
(packaging) Update PUPPETVERSION to 3.6.2
(PUP-121) Improve documentation of include, require and contain
(PUP-2683) Fix fact terminus to load facts without '.' on the load path.

The fix to PUP-2478 removed '.' from the load path, which only affected
Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
longer on the load path.  In Ruby 1.9.3+, loading with just a filename
assumes the current directory even without '.' on the load path.

This commit fixes the issue by joining '.' with the filename which
works in all currently supported Ruby versions.
Merge pull request #38 from peterhuene/PUP-2478/3.6.1/security_fixes

(PUP-2683) Fix fact terminus to load facts without '.' on the load path.
(PUP-2622) Use non-zero exit codes for unknown subcommands.

Previously, if users execute 'puppet foo', an error message is displayed
about unknown subcommand 'foo', but puppet still exits with a zero exit
code indicating success.

Additionally, if users execute 'puppet --option <valid_subcommand>',
puppet silently ignores the option, prints a message, and exits with a
zero exit code.  As a result, a user accidentally transposed a valid
option for a subcommand with the subcommand itself in an automated context
and puppet did not report a failure.

This commit fixes both conditions by exiting with 1 from the nil and unknown
subcommands where appropriate.  It also prints error messages using the same
colorized output we use for usual puppet errors.
(PUP-2454) Use 999 as the max system uid for certain operating systems.

User ID's below 1000, not 500, are generally considered system users on
OpenBSD, FreeBSD, and Debian operating systems.

Users can still modify this with 'uid_start' in adduser.conf, but in that
case they'd need to provide an actual value instead of 'true'.

Also fixing the fact that 500 should not be included as a system ID.
The inclusive maximum should be 499 for other operating systems.
(PUP-2454) Add spec examples for testing unless_system_user special casing.

Adding examples to test for handling unless_system_user being
automatically set to 999 on certain operating systems.

Changing an existing example to ensure that user 500 is purged
correctly.
(PUP-2569) Revoke all certificate matching a given name

puppet cert revoke <name> was revoking only the first certificate
when the certificate file wasn't present on the system.
This patch makes sure all issued certificate matching a given name
are now revoked.

Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
(maint) Reduce redundancy in Puppet::Util::Posix

Before this commit `Puppet::Util::Posix` had duplicate error
handling code for retrieving the actual ID, either of a group or
user. This commit refactors those two methods to abstract away
the location of the source of truth, either the `group` file
or the `passwd` file, and the logic for handling whether or not
a numeric ID or a name was passed in.
(maint) stop enforcing the random prioritizer for evaluation in spectests

Before 95ddc530 the integration tests for Type::User purging authorized
SSH keys did not work when using the SequentialPrioritizer that is
actually the default in the transaction runner methods defined in
PuppetSpec::Compiler.

Since the cause has been removed, so should we do with the workaround.
The tests should rely on the defaults and not impose a (random) preference
unnecessarily.