(PUP-1069) Implement feature :upgradeable for OpenBSD package provider.
(PUP-2511) Add parser function digest: uses digest_algorithm to hash, not strictly md5

Puppet has an md5 parser function, which returns the MD5 digest of its
argument. On hosts configured for compliance with U.S. Federal
Information Processing Standard (FIPS) 140-2, attempts to use the MD5
algorithm cause errors, because MD5 is no longer FIPS Approved. This
patch adds a parser function called digest, which returns the digest
of its argument using the algorithm named by the digest_algorithm
setting in puppet.conf. Therefore, where md5 may fail on some hosts,
the digest function should always return a value; but the value may
vary if the digest_algorithm setting is changed.
(PUP-2399) Add mailalias acceptance tests

Add basic acceptance tests for mailalias type. This adds acceptance
tests for create, query, modify, and destroy.

The tests assume that the mailalias type manages the default
/etc/aliases text file as well as updating the binary database
that the aliases file is the source for.
(PUP-2399) Remove testing of newaliases

As per PUP-1143, the mailalias type does not manage the state of
the aliases.db file via 'newaliases', 'sendmail -bi', or any other
mechanism due to compatibility issues. Since this is the case,
all testing of the aliases.db file have been removed from the
mailaliases tests in this commit.
(PUP-2401) Add ssh_authorized_key acceptance tests

Add basic acceptance tests for ssh_authorized_key type.
This adds acceptance tests for create, query, modify, and destroy.

The query test is set to be skipped because the type cannot
currently be queried by username (see PUP-1605).
(PUP-2578) Unbreak services from packages which set local flags.

So don't add _flags="" for pkg_scripts if no :flags were set, as it
may override the default flags from inside the script.
(PUP-2578) Keep order for pkg_scripts.

Do not unconditionally alphabetically sort the list of pkg_scripts
as order matters. Explicit ordering will need to be forced through
resources dependencies.
(PUP-2578) Tweak #in_base? by not relying on pkg_info, but on /etc/rc.conf which is faster
(PUP-121) Make include, require, and contain enforce non relative names

This makes include, require, and contain functions transform
relative names to absolute names before doing any lookup.

The transformation is controlled by a metho on scope that is
always called, and that performs the transformation when Puppet[:parser]
== future. This design was selected to ensure that there is one place to
later change (other flags, or in Puppet 4 when the future will
be something else).
(maint) Change dev-puppet-master script not to log debug and trace

It is more useful to set this yourself when calling the script,
depending on whether you want --verbose or --debug and/or --trace.
So just:

$ util/dev-puppet-master foo --debug --trace

Also fixed copying of auth.conf (from basic case running script from
repository root).
(PUP-121) Add more tests, doc, and correct behavior

This generalizes the "make names absolute" to a transformation
of given arguments to class names strings suitable for lookup, and
also applying the transformation to Class and Resource reference types.
(maint) Resolve some documentation TODOs in Puppet::Type

Fix some descriptions according to the @todo tags. Some todos were just
to check if the existing documentation was correct. Those were removed
after checking.
(PUP-121) Make examples for relative/absolute shared

This makes the examples that test include, require, contain
share the same tests.

This also adds one missing error condition.
(PUP-2478) Remove current directory from Ruby load path.

The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
puppet is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by puppet.
(PUP-2533) Apache 2.4 requires explicit CRL configuration

In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
directives were specified then the specified file(s) would be checked
when establishing an SSL connection. Apache 2.4+ the
SSLCARevocationCheck directive was added to control how CRLs were
checked when verifying a connection and had a default value of none.
This means that Apache defaults to ignoring CRLs even if paths are
specified to CRL files.

This commit updates the debian postinst script for the
puppetmaster-passenger package to set SSLCARevocationCheck directive to
'chain' when Apache 2.4 is installed. This ensures that the the
puppetmaster-passenger vhost respects CRL files in the same way that
Apache 2.2 does by default.
Apache 2.2
(maint) extract initial Passenger configuration
(PUP-2533) Insert SSLCARevocationCheck on upgrade
(packaging) Update PUPPETVERSION to 3.6.2
(PUP-121) Improve documentation of include, require and contain
(PUP-2683) Fix fact terminus to load facts without '.' on the load path.

The fix to PUP-2478 removed '.' from the load path, which only affected
Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
longer on the load path.  In Ruby 1.9.3+, loading with just a filename
assumes the current directory even without '.' on the load path.

This commit fixes the issue by joining '.' with the filename which
works in all currently supported Ruby versions.