(PUP-2478) Remove current directory from Ruby load path.

The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
puppet is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by puppet.
(PUP-2533) Apache 2.4 requires explicit CRL configuration

In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
directives were specified then the specified file(s) would be checked
when establishing an SSL connection. Apache 2.4+ the
SSLCARevocationCheck directive was added to control how CRLs were
checked when verifying a connection and had a default value of none.
This means that Apache defaults to ignoring CRLs even if paths are
specified to CRL files.

This commit updates the debian postinst script for the
puppetmaster-passenger package to set SSLCARevocationCheck directive to
'chain' when Apache 2.4 is installed. This ensures that the the
puppetmaster-passenger vhost respects CRL files in the same way that
Apache 2.2 does by default.
Apache 2.2
(maint) extract initial Passenger configuration
(PUP-2533) Insert SSLCARevocationCheck on upgrade
(packaging) Update PUPPETVERSION to 3.6.2
(PUP-2683) Fix fact terminus to load facts without '.' on the load path.

The fix to PUP-2478 removed '.' from the load path, which only affected
Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
longer on the load path.  In Ruby 1.9.3+, loading with just a filename
assumes the current directory even without '.' on the load path.

This commit fixes the issue by joining '.' with the filename which
works in all currently supported Ruby versions.
Merge pull request #38 from peterhuene/PUP-2478/3.6.1/security_fixes

(PUP-2683) Fix fact terminus to load facts without '.' on the load path.
(maint) Remove unused Puppet::Parser::AST::Tag class

It has been hiding in a corner for 8 years. Unused.
Now removed.
(PUP-2689) Make AST Resource check tags against "inherited" tags

This overrides the tagged? method in AST Resource to also search
for tags in its containing resource. These tags will be set when
the resource is finalized (just before serialization on transformation
to external format).

If this is not done, resources will have a different tag set when
a search is made for the node itself (exported or virtual) vs. searching
external resources.

This also correct minor problems with passing an array (which could
result in an array being set as a tag).
It was also possible for empty tags to be set if a string tag contained
multiple :: in sequence, or if ending with ::. Now an error is raised
for these conditions (just like for empty segments generated by using a
sequence of commas (which was on a different code path).
(PUP-2692) Cache function info with the functions

The Puppet::Parser::Functions code used to hold onto two different sets
of information about the loaded functions: a hash of environment name to
environment module, and a hash of *environment* to a hash of function
name to function information. It was assumed that the
Puppet::Node::Environment class was written to properly work as a hash
key since it implemented both hash() and ==(). This assumption being
true would have meant that different instances for the same environment
would be the same key and the second hash above would not grow beyond a
reasonable size for the number of environments.

It turns out that to be a proper hash key a class must implement hash()
and eql?() (not ==()). Because Puppet::Node::Environment didn't do this
the hash of function information would just continually grow when
directory environments with an environment_timeout != unlimited was in
use. This is because the Puppet::Node::Environment instance would be
periodically thrown out by the Puppet::Environments::Cached loader and
be recreated, but the Puppet::Parser::Functions hash would hold onto the
old instance.

The fix for this here is to consolidate all of the function information
into a single structure. The function modules now have a few methods to
get the function metadata instead of it being stored separately. This is
completely backwards compatible and does not conflict with any existing
uses of the environment modules since the new methods are on the module
itself and will not be part of the mixin.
(PUP-2692) Correctly implement environment equality

This fixes environment equality to make it work as a hash key. It also
adds tests around this functionality.
Merge pull request #2714 from zaphod42/issue/stable/pup-2692-memory-leak-in-master

(PUP-2692) Fix memory leak in directory environments
(maint) Update file mode for future parser

The future parser preserves number literals as actual numbers. This
causes problems for modes on file resources because 640 is the decimal
number 640 and not the octal 640.
(maint) Stop leaking file handles

File.new(f) results in a file handle being used. The test manifest in
this case ended up leaking file handles which caused the master to run
out of file handles while serving a request. This lead to a consistent
failure on the first thread requesting the catalog where the error
reported was:

  Could not autoload puppet/type/notify: no such file to load -- /usr/lib/ruby/site_ruby/1.8/puppet/type/notify.rb

The error was misleading. The underlying problem was not an ENOENT, but
an EMFILE (Too many open files). By switching to File.read(f) the
manifest will no longer leak file handles.
(maint) Add sitemoduledir to env env tests

These two tests set up a 'special' environment, and made the assumption
that the modulepath could be reset to something that did not include the
sitemoduledir.  In PE, not having this directory on the modulepath will
case a pluginsync on the master to remove all of the PE modules,
potentially causing problems for subsequent runs.  Adding the
sitemoduledir to the modulepath if we are running a pe master ensures
the pluginsync libdir is not cleared.
(maint) Update test to use resource matcher

The other test added for checking the tagging behavior used the resource
matcher but the current compiler spec didn't. This updates it to be
consistent with the future compiler spec and use the matcher.
(maint) Remove failure for empty generated tags

Commit 0436eb1e0997a6f19ea734923a1b82625a4034f8 added an extra failure
condition for any generated tags that end up being empty strings. This
was to get it to handle that the same way that it handles a simple empty
string tag. However, this could break any installations that generate
"::" separated tags that could create 4 ":" in a row ("a::::b"), and it
also doesn't address enough of the odd tagging behavior to make it worth
it. This commit reverts that change and adds some more tests to cover
some more of the ways in which setting tags behaves.
Merge branch 'pr/2712' into stable

* pr/2712:
  (maint) Remove failure for empty generated tags
  (maint) Update test to use resource matcher
  (PUP-2689) Make AST Resource check tags against "inherited" tags
  (maint) Remove unused Puppet::Parser::AST::Tag class
(PUP-2364) Use the the puppet config vardir setting

instead of the beaker variable puppetvardir.  This change, while
pleasing in and of itself, was needed for testing on AIX.  The vardir
used there by puppet is different, and Beaker does not track a separate
set of defaults for AIX.
Merge branch 'pup_2364_spike_vars' into stable

* pup_2364_spike_vars:
  (PUP-2364) Use the the puppet config vardir setting