(PUP-1069) Implement feature :upgradeable for OpenBSD package provider.
(PUP-2478) Remove current directory from Ruby load path.

The current directory ('.') is on the load path for Ruby 1.8.7.
This is a security vulnerability as it allows arbitrary code loading if
users create ruby source files with names that correspond to those that
puppet is trying to load.

The fix is to explicitly remove '.' from the load path before any code
is loaded by puppet.
(PUP-2533) Apache 2.4 requires explicit CRL configuration

In Apache 2.2, if either the SSLCARevocationFile or SSLCARevocationPath
directives were specified then the specified file(s) would be checked
when establishing an SSL connection. Apache 2.4+ the
SSLCARevocationCheck directive was added to control how CRLs were
checked when verifying a connection and had a default value of none.
This means that Apache defaults to ignoring CRLs even if paths are
specified to CRL files.

This commit updates the debian postinst script for the
puppetmaster-passenger package to set SSLCARevocationCheck directive to
'chain' when Apache 2.4 is installed. This ensures that the the
puppetmaster-passenger vhost respects CRL files in the same way that
Apache 2.2 does by default.
Apache 2.2
(maint) extract initial Passenger configuration
(PUP-2533) Insert SSLCARevocationCheck on upgrade
(packaging) Update PUPPETVERSION to 3.6.2
(PUP-2683) Fix fact terminus to load facts without '.' on the load path.

The fix to PUP-2478 removed '.' from the load path, which only affected
Ruby 1.8.7.  However, the fact terminus does "load <filename>" to load
module facts.  In Ruby 1.8.7, this will fail to load because '.' is no
longer on the load path.  In Ruby 1.9.3+, loading with just a filename
assumes the current directory even without '.' on the load path.

This commit fixes the issue by joining '.' with the filename which
works in all currently supported Ruby versions.
Merge pull request #38 from peterhuene/PUP-2478/3.6.1/security_fixes

(PUP-2683) Fix fact terminus to load facts without '.' on the load path.
(PUP-2622) Use non-zero exit codes for unknown subcommands.

Previously, if users execute 'puppet foo', an error message is displayed
about unknown subcommand 'foo', but puppet still exits with a zero exit
code indicating success.

Additionally, if users execute 'puppet --option <valid_subcommand>',
puppet silently ignores the option, prints a message, and exits with a
zero exit code.  As a result, a user accidentally transposed a valid
option for a subcommand with the subcommand itself in an automated context
and puppet did not report a failure.

This commit fixes both conditions by exiting with 1 from the nil and unknown
subcommands where appropriate.  It also prints error messages using the same
colorized output we use for usual puppet errors.
(PUP-2454) Use 999 as the max system uid for certain operating systems.

User ID's below 1000, not 500, are generally considered system users on
OpenBSD, FreeBSD, and Debian operating systems.

Users can still modify this with 'uid_start' in adduser.conf, but in that
case they'd need to provide an actual value instead of 'true'.

Also fixing the fact that 500 should not be included as a system ID.
The inclusive maximum should be 499 for other operating systems.
(PUP-2454) Add spec examples for testing unless_system_user special casing.

Adding examples to test for handling unless_system_user being
automatically set to 999 on certain operating systems.

Changing an existing example to ensure that user 500 is purged
correctly.
(PUP-2569) Revoke all certificate matching a given name

puppet cert revoke <name> was revoking only the first certificate
when the certificate file wasn't present on the system.
This patch makes sure all issued certificate matching a given name
are now revoked.

Signed-off-by: Brice Figureau <brice-puppet@daysofwonder.com>
(maint) Reduce redundancy in Puppet::Util::Posix

Before this commit `Puppet::Util::Posix` had duplicate error
handling code for retrieving the actual ID, either of a group or
user. This commit refactors those two methods to abstract away
the location of the source of truth, either the `group` file
or the `passwd` file, and the logic for handling whether or not
a numeric ID or a name was passed in.
(maint) stop enforcing the random prioritizer for evaluation in spectests

Before 95ddc530 the integration tests for Type::User purging authorized
SSH keys did not work when using the SequentialPrioritizer that is
actually the default in the transaction runner methods defined in
PuppetSpec::Compiler.

Since the cause has been removed, so should we do with the workaround.
The tests should rely on the defaults and not impose a (random) preference
unnecessarily.
Merge branch 'PUP-2478/3.6.1/security_fixes' into stable

* PUP-2478/3.6.1/security_fixes:
  (PUP-2683) Fix fact terminus to load facts without '.' on the load path.
  (packaging) Update PUPPETVERSION to 3.6.2
  (PUP-2533) Insert SSLCARevocationCheck on upgrade
  (maint) extract initial Passenger configuration
  (PUP-2533) Apache 2.4 requires explicit CRL configuration
  (PUP-2478) Remove current directory from Ruby load path.
Merge branch 'pr/2736'

* pr/2736:
  (PUP-2454) Add spec examples for testing unless_system_user special casing.
  (PUP-2454) Use 999 as the max system uid for certain operating systems.
Merge pull request #2744 from ffrank/maint/spectest-manifest-ordering

(maint) stop enforcing the random prioritizer for evaluation in spectests
Merge remote-tracking branch 'upstream/stable'

* upstream/stable:
  (maint) stop enforcing the random prioritizer for evaluation in spectests
  (PUP-2683) Fix fact terminus to load facts without '.' on the load path.
  (packaging) Update PUPPETVERSION to 3.6.2
  (PUP-2533) Insert SSLCARevocationCheck on upgrade
  (maint) extract initial Passenger configuration
  (PUP-2533) Apache 2.4 requires explicit CRL configuration
  (PUP-2478) Remove current directory from Ruby load path.
Merge pull request #2738 from gchronis/maint/master/remove_duplication_from_posix_util

(maint) Reduce redundancy in Puppet::Util::Posix
Merge pull request #2558 from jasperla/openbsd/upgradeable

(PUP-1069) Implement feature :upgradeable for OpenBSD package provider.