(PUP-2478) Remove current directory from Ruby load path.

The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
puppet is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by puppet.
(PUP-2533) Apache 2.4 requires explicit CRL configuration

In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
directives were specified then the specified file(s) would be checked
when establishing an SSL connection. Apache 2.4+ the
SSLCARevocationCheck directive was added to control how CRLs were
checked when verifying a connection and had a default value of none.
This means that Apache defaults to ignoring CRLs even if paths are
specified to CRL files.

This commit updates the debian postinst script for the
puppetmaster-passenger package to set SSLCARevocationCheck directive to
'chain' when Apache 2.4 is installed. This ensures that the the
puppetmaster-passenger vhost respects CRL files in the same way that
Apache 2.2 does by default.
Apache 2.2
(maint) extract initial Passenger configuration
(PUP-2533) Insert SSLCARevocationCheck on upgrade
(packaging) Update PUPPETVERSION to 3.6.2
(PUP-2683) Fix fact terminus to load facts without '.' on the load path.

The fix to PUP-2478 removed '.' from the load path, which only affected
Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
longer on the load path.  In Ruby 1.9.3+, loading with just a filename
assumes the current directory even without '.' on the load path.

This commit fixes the issue by joining '.' with the filename which
works in all currently supported Ruby versions.
Merge pull request #38 from peterhuene/PUP-2478/3.6.1/security_fixes

(PUP-2683) Fix fact terminus to load facts without '.' on the load path.
(maint) stop enforcing the random prioritizer for evaluation in spectests

Before 95ddc530 the integration tests for Type::User purging authorized
SSH keys did not work when using the SequentialPrioritizer that is
actually the default in the transaction runner methods defined in
PuppetSpec::Compiler.

Since the cause has been removed, so should we do with the workaround.
The tests should rely on the defaults and not impose a (random) preference
unnecessarily.
(packaging) Update PUPPETVERSION to 3.6.2
Merge branch 'PUP-2478/3.6.1/security_fixes' into stable

* PUP-2478/3.6.1/security_fixes:
  (PUP-2683) Fix fact terminus to load facts without '.' on the load path.
  (packaging) Update PUPPETVERSION to 3.6.2
  (PUP-2533) Insert SSLCARevocationCheck on upgrade
  (maint) extract initial Passenger configuration
  (PUP-2533) Apache 2.4 requires explicit CRL configuration
  (PUP-2478) Remove current directory from Ruby load path.
Merge pull request #2744 from ffrank/maint/spectest-manifest-ordering

(maint) stop enforcing the random prioritizer for evaluation in spectests
(maint) Refactor file content remote source specs

The "from an explicit fileserver" describe block mostly duplicted the original
"from remote source" block and so the two have been merged. Additionally, some
specific improvements have been made to the tests:

  - Tests for `puppet:///` vs. `puppet://` have been fixed and moved to
    explicit scenarios rather than implicit expectations in the global
    `before` block

  - The number of lines written to test files has been reduced from
    10000 to 10. This speeds up the suite and prevents failing tests from
    belching a wall of red text.

  - Replace instances of `.should` with `expect().to`.
(PUP-2700) Fix regression in file_content requests

The resolution of PUP-1892 caused percent encoding of file_content requests to
be doubled. This created a regression where Puppet file servers would respond
with a 404 not found status unless multiple decode operations were applied.

This patch fixes the issue by building the file_content indirector request
directly from the file source parameter instead of casting it to an escaped
URI. The `Indirector::Request` class handles the necessary URI escaping during
initialization.
Merge pull request #2772 from Sharpie/fix-double-uri-escape

(PUP-2700) Fix double uri escape