(PUP-1069) Implement feature :upgradeable for OpenBSD package provider.
(PUP-2478) Remove current directory from Ruby load path.

The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
puppet is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by puppet.
(PUP-2533) Apache 2.4 requires explicit CRL configuration

In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
directives were specified then the specified file(s) would be checked
when establishing an SSL connection. Apache 2.4+ the
SSLCARevocationCheck directive was added to control how CRLs were
checked when verifying a connection and had a default value of none.
This means that Apache defaults to ignoring CRLs even if paths are
specified to CRL files.

This commit updates the debian postinst script for the
puppetmaster-passenger package to set SSLCARevocationCheck directive to
'chain' when Apache 2.4 is installed. This ensures that the the
puppetmaster-passenger vhost respects CRL files in the same way that
Apache 2.2 does by default.
Apache 2.2
(maint) extract initial Passenger configuration
(PUP-2533) Insert SSLCARevocationCheck on upgrade
(packaging) Update PUPPETVERSION to 3.6.2
(PUP-2683) Fix fact terminus to load facts without '.' on the load path.

The fix to PUP-2478 removed '.' from the load path, which only affected
Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
longer on the load path.  In Ruby 1.9.3+, loading with just a filename
assumes the current directory even without '.' on the load path.

This commit fixes the issue by joining '.' with the filename which
works in all currently supported Ruby versions.
Merge pull request #38 from peterhuene/PUP-2478/3.6.1/security_fixes

(PUP-2683) Fix fact terminus to load facts without '.' on the load path.
(PUP-2454) Use 999 as the max system uid for certain operating systems.

User ID's below 1000, not 500, are generally considered system users on
OpenBSD, FreeBSD, and Debian operating systems.

Users can still modify this with 'uid_start' in adduser.conf, but in that
case they'd need to provide an actual value instead of 'true'.

Also fixing the fact that 500 should not be included as a system ID.
The inclusive maximum should be 499 for other operating systems.
(PUP-2454) Add spec examples for testing unless_system_user special casing.

Adding examples to test for handling unless_system_user being
automatically set to 999 on certain operating systems.

Changing an existing example to ensure that user 500 is purged
correctly.
(PUP-2569) Revoke all certificate matching a given name

puppet cert revoke <name> was revoking only the first certificate
when the certificate file wasn't present on the system.
This patch makes sure all issued certificate matching a given name
are now revoked.

Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
(maint) Reduce redundancy in Puppet::Util::Posix

Before this commit `Puppet::Util::Posix` had duplicate error
handling code for retrieving the actual ID, either of a group or
user. This commit refactors those two methods to abstract away
the location of the source of truth, either the `group` file
or the `passwd` file, and the logic for handling whether or not
a numeric ID or a name was passed in.
(maint) stop enforcing the random prioritizer for evaluation in spectests

Before 95ddc530 the integration tests for Type::User purging authorized
SSH keys did not work when using the SequentialPrioritizer that is
actually the default in the transaction runner methods defined in
PuppetSpec::Compiler.

Since the cause has been removed, so should we do with the workaround.
The tests should rely on the defaults and not impose a (random) preference
unnecessarily.
(packaging) Update PUPPETVERSION to 3.6.2
Merge remote-tracking branch 'upstream/stable'

* upstream/stable:
  (packaging) Update PUPPETVERSION to 3.6.2
Merge branch 'PUP-2478/3.6.1/security_fixes' into stable

* PUP-2478/3.6.1/security_fixes:
  (PUP-2683) Fix fact terminus to load facts without '.' on the load path.
  (packaging) Update PUPPETVERSION to 3.6.2
  (PUP-2533) Insert SSLCARevocationCheck on upgrade
  (maint) extract initial Passenger configuration
  (PUP-2533) Apache 2.4 requires explicit CRL configuration
  (PUP-2478) Remove current directory from Ruby load path.
(PUP-2426) Add missing fields to environment http json

This adds the two new properties environment_timeout, and config_version
to the returned settings properties.
The timeout is either an integer measured in seconds from min 0, or
the string 'unlimited'.
Merge pull request #2757 from hlindberg/PUP-2426_add-missing-setting-to-environment-listing

(PUP-2426) Add missing fields to environment http json
Merge branch 'pr/2736'

* pr/2736:
  (PUP-2454) Add spec examples for testing unless_system_user special casing.
  (PUP-2454) Use 999 as the max system uid for certain operating systems.
Merge pull request #2744 from ffrank/maint/spectest-manifest-ordering

(maint) stop enforcing the random prioritizer for evaluation in spectests