Merge pull request #66842 from dwoz/merge/3007.x/3006.x

[3007.x] Merge 3006.x forward to 3007.x

.github/workflows/backport.yml

@@ -20,12 +20,14 @@ jobs:
       github.event.pull_request.merged == true
       && (
         contains(github.event.pull_request.labels.*.name, 'backport:master') ||
+        contains(github.event.pull_request.labels.*.name, 'backport:3007.x') ||
         contains(github.event.pull_request.labels.*.name, 'backport:3006.x') ||
         contains(github.event.pull_request.labels.*.name, 'backport:3005.x')
       )
       && (
         (github.event.action == 'labeled' && (
           contains(github.event.pull_request.labels.*.name, 'backport:master') ||
+          contains(github.event.pull_request.labels.*.name, 'backport:3007.x') ||
           contains(github.event.pull_request.labels.*.name, 'backport:3006.x') ||
           contains(github.event.pull_request.labels.*.name, 'backport:3005.x')
         ))

.github/workflows/build-docs.yml

@@ -32,7 +32,6 @@ jobs:
           - linkcheck
           - spellcheck
           - html
-          - epub
           # - pdf
 
     steps:

.github/workflows/staging.yml

@@ -2868,12 +2868,6 @@ jobs:
           name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-docs-html.tar.xz
           path: artifacts/release
 
-      - name: Download Release Documentation (ePub)
-        uses: actions/download-artifact@v4
-        with:
-          name: Salt-${{ needs.prepare-workflow.outputs.salt-version }}.epub
-          path: artifacts/release
-
       - name: Show Release Artifacts
         run: |
           tree -a artifacts/release

.github/workflows/templates/staging.yml.jinja

@@ -124,12 +124,6 @@ concurrency:
           name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-docs-html.tar.xz
           path: artifacts/release
 
-      - name: Download Release Documentation (ePub)
-        uses: actions/download-artifact@v4
-        with:
-          name: Salt-${{ needs.prepare-workflow.outputs.salt-version }}.epub
-          path: artifacts/release
-
       - name: Show Release Artifacts
         run: |
           tree -a artifacts/release

.github/workflows/test-action-windows.yml

@@ -374,8 +374,8 @@ jobs:
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success' && job.status != 'cancelled'
         run: |
           nox --force-color -e create-xml-coverage-reports
-          mv artifacts/coverage/salt.xml artifacts/coverage/salt..${{ inputs.distro-slug }}..${{ inputs.nox-session }}.xml
-          mv artifacts/coverage/tests.xml artifacts/coverage/tests..${{ inputs.distro-slug }}..${{ inputs.nox-session }}.xml
+          mv artifacts/coverage/salt.xml artifacts/coverage/salt..${{ inputs.distro-slug }}..${{ inputs.nox-session }}.xml || true
+          mv artifacts/coverage/tests.xml artifacts/coverage/tests..${{ inputs.distro-slug }}..${{ inputs.nox-session }}.xml || true
 
       - name: Report Salt Code Coverage
         if: always() && inputs.skip-code-coverage == false && steps.download-coverage-artifacts.outcome == 'success'

.github/workflows/test-installer-action-windows.yml

@@ -0,0 +1,38 @@
+---
+name: Test Windows Installer
+
+on: pull_request
+
+permissions:
+  contents: read
+
+jobs:
+  Test-Windows-Installer:
+    runs-on:
+      - windows-latest
+
+    steps:
+
+    - name: Checkout Salt
+      uses: actions/checkout@v4
+
+    - name: Set Up Python 3.10
+      uses: actions/setup-python@v5
+      with:
+        python-version: "3.10"
+
+    - name: Install NSIS
+      run: .\pkg\windows\install_nsis.cmd -CICD
+      shell: cmd
+
+    - name: Build Test Installer
+      run: .\pkg\windows\nsis\tests\setup.cmd -CICD
+      shell: cmd
+
+    - name: Run Stress Test
+      run: .\pkg\windows\nsis\tests\test.cmd -CICD .\stress_tests
+      shell: cmd
+
+    - name: Run Config Tests
+      run: .\pkg\windows\nsis\tests\test.cmd -CICD .\config_tests
+      shell: cmd

.github/workflows/test-packages-action-linux.yml

@@ -192,12 +192,6 @@ jobs:
         run: |
           tools --timestamps vm decompress-dependencies ${{ inputs.distro-slug }}
 
-      - name: Downgrade importlib-metadata
-        if: ${{ contains(fromJSON('["amazonlinux-2", "centos-7"]'), inputs.distro-slug) && contains(fromJSON('["upgrade-classic", "downgrade-classic"]'), matrix.tests-chunk) }}
-        run: |
-          # This step can go away once we stop testing classic packages upgrade/downgrades to/from 3005.x
-          tools --timestamps vm ssh ${{ inputs.distro-slug }} -- "sudo python3 -m pip install -U 'importlib-metadata<=4.13.0' 'virtualenv<=20.21.1'"
-
       - name: Show System Info
         run: |
           tools --timestamps --timeout-secs=1800 vm test --skip-requirements-install --print-system-information-only \

.github/workflows/test-packages-action-macos.yml

@@ -105,7 +105,7 @@ jobs:
   test:
     name: Test
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 120  # 2 Hours - More than this and something is wrong
+    timeout-minutes: 150  # 2 & 1/2 Hours - More than this and something is wrong (MacOS needs a little more time)
     needs:
       - generate-matrix
     strategy:

.github/workflows/test-packages-action-windows.yml

@@ -191,12 +191,6 @@ jobs:
         run: |
           tools --timestamps vm decompress-dependencies ${{ inputs.distro-slug }}
 
-      - name: Downgrade importlib-metadata
-        if: ${{ contains(fromJSON('["amazonlinux-2", "centos-7"]'), inputs.distro-slug) && contains(fromJSON('["upgrade-classic", "downgrade-classic"]'), matrix.tests-chunk) }}
-        run: |
-          # This step can go away once we stop testing classic packages upgrade/downgrades to/from 3005.x
-          tools --timestamps vm ssh ${{ inputs.distro-slug }} -- "sudo python3 -m pip install -U 'importlib-metadata<=4.13.0' 'virtualenv<=20.21.1'"
-
       - name: Show System Info
         run: |
           tools --timestamps --timeout-secs=1800 vm test --skip-requirements-install --print-system-information-only \

CHANGELOG.md

@@ -13,10 +13,23 @@ Versions are `MAJOR.PATCH`.
 ### Removed
 
 - The ``salt.utils.psutil_compat`` was deprecated and now removed in Salt 3008. Please use the ``psutil`` module directly. [#66160](https://github.com/saltstack/salt/issues/66160)
+## 3006.9 (2024-07-29)
+
+
+### Deprecated
+
+- Drop CentOS 7 support [#66623](https://github.com/saltstack/salt/issues/66623)
+- No longer build RPM packages with CentOS Stream 9 [#66624](https://github.com/saltstack/salt/issues/66624)
 
 
 ### Fixed
 
+- Made slsutil.renderer work with salt-ssh [#50196](https://github.com/saltstack/salt/issues/50196)
+- Fixed defaults.merge is not available when using salt-ssh [#51605](https://github.com/saltstack/salt/issues/51605)
+- Fixed config.get does not support merge option with salt-ssh [#56441](https://github.com/saltstack/salt/issues/56441)
+- Update to include croniter in pkg requirements [#57649](https://github.com/saltstack/salt/issues/57649)
+- Fixed state.test does not work with salt-ssh [#61100](https://github.com/saltstack/salt/issues/61100)
+- Made slsutil.findup work with salt-ssh [#61143](https://github.com/saltstack/salt/issues/61143)
 - Fixes multiple issues with the cmd module on Windows. Scripts are called using
   the ``-File`` parameter to the ``powershell.exe`` binary. ``CLIXML`` data in
   stderr is now removed (only applies to encoded commands). Commands can now be
@@ -35,6 +48,38 @@ Versions are `MAJOR.PATCH`.
 - Change log level of successful master cluster key exchange from error to info. [#66266](https://github.com/saltstack/salt/issues/66266)
 - Made `file.managed` skip download of a remote source if the managed file already exists with the correct hash [#66342](https://github.com/saltstack/salt/issues/66342)
 - Fixed nftables.build_rule breaks ipv6 rules by using the wrong syntax for source and destination addresses [#66382](https://github.com/saltstack/salt/issues/66382)
+- file.replace and file.search work properly with /proc files [#63102](https://github.com/saltstack/salt/issues/63102)
+- Fix utf8 handling in 'pass' renderer [#64300](https://github.com/saltstack/salt/issues/64300)
+- Fixed incorrect version argument will be ignored for multiple package targets warning when using pkgs argument to yumpkg module. [#64563](https://github.com/saltstack/salt/issues/64563)
+- salt-cloud honors root_dir config setting for log_file location and fixes for root_dir locations on windows. [#64728](https://github.com/saltstack/salt/issues/64728)
+- Fixed slsutil.update with salt-ssh during template rendering [#65067](https://github.com/saltstack/salt/issues/65067)
+- Fix config.items when called on minion [#65251](https://github.com/saltstack/salt/issues/65251)
+- Ensure on rpm and deb systems, that user and group for existing Salt, is maintained on upgrade [#65264](https://github.com/saltstack/salt/issues/65264)
+- Fix typo in nftables module to ensure unique nft family values [#65295](https://github.com/saltstack/salt/issues/65295)
+- pkg.installed state aggregate does not honors requires requisite [#65304](https://github.com/saltstack/salt/issues/65304)
+- Added SSH wrapper for logmod [#65630](https://github.com/saltstack/salt/issues/65630)
+- Fix for GitFS failure to unlock lock file, and resource cleanup for process SIGTERM [#65816](https://github.com/saltstack/salt/issues/65816)
+- Corrected x509_v2 CRL creation `last_update` and `next_update` values when system timezone is not UTC [#65837](https://github.com/saltstack/salt/issues/65837)
+- Make sure the root minion process handles SIGUSR1 and emits a traceback like it's child processes [#66095](https://github.com/saltstack/salt/issues/66095)
+- Replaced pyvenv with builtin venv for virtualenv_mod [#66132](https://github.com/saltstack/salt/issues/66132)
+- Made `file.managed` skip download of a remote source if the managed file already exists with the correct hash [#66342](https://github.com/saltstack/salt/issues/66342)
+- Fix win_task ExecutionTimeLimit and result/error code interpretation [#66347](https://github.com/saltstack/salt/issues/66347), [#66441](https://github.com/saltstack/salt/issues/66441)
+- Fixed nftables.build_rule breaks ipv6 rules by using the wrong syntax for source and destination addresses [#66382](https://github.com/saltstack/salt/issues/66382)
+- Fixed x509_v2 certificate.managed crash for locally signed certificates if the signing policy defines signing_private_key [#66414](https://github.com/saltstack/salt/issues/66414)
+- Fixed parallel state execution with Salt-SSH [#66514](https://github.com/saltstack/salt/issues/66514)
+- Fix support for FIPS approved encryption and signing algorithms. [#66579](https://github.com/saltstack/salt/issues/66579)
+- Fix relative file_roots paths [#66588](https://github.com/saltstack/salt/issues/66588)
+- Fixed an issue with cmd.run with requirements when the shell is not the
+  default [#66596](https://github.com/saltstack/salt/issues/66596)
+- Fix RPM package provides [#66604](https://github.com/saltstack/salt/issues/66604)
+- Upgrade relAenv to 0.16.1. This release fixes several package installs for salt-pip [#66632](https://github.com/saltstack/salt/issues/66632)
+- Upgrade relenv to 0.17.0 (https://github.com/saltstack/relenv/blob/v0.17.0/CHANGELOG.md) [#66663](https://github.com/saltstack/salt/issues/66663)
+- Upgrade dependencies due to security issues:
+  - pymysql>=1.1.1
+  - requests>=2.32.0
+  - docker>=7.1.0 [#66666](https://github.com/saltstack/salt/issues/66666)
+- Corrected missed line in branch 3006.x when backporting from PR 61620 and 65044 [#66683](https://github.com/saltstack/salt/issues/66683)
+- Remove debug output from shell scripts for packaging [#66747](https://github.com/saltstack/salt/issues/66747)
 
 
 ### Added
@@ -44,12 +89,18 @@ Versions are `MAJOR.PATCH`.
   unbootstrap chocolatey. [#64722](https://github.com/saltstack/salt/issues/64722)
 - Add Ubuntu 24.04 support [#66180](https://github.com/saltstack/salt/issues/66180)
 - Add Fedora 40 support, replacing Fedora 39 [#66300](https://github.com/saltstack/salt/issues/66300)
+- Add Ubuntu 24.04 support [#66180](https://github.com/saltstack/salt/issues/66180)
+- Add Fedora 40 support, replacing Fedora 39 [#66300](https://github.com/saltstack/salt/issues/66300)
+- Build RPM packages with Rocky Linux 9 (instead of CentOS Stream 9) [#66624](https://github.com/saltstack/salt/issues/66624)
 
 
 ### Security
 
 - Bump to `pydantic==2.6.4` due to https://github.com/advisories/GHSA-mr82-8j83-vxmv [#66433](https://github.com/saltstack/salt/issues/66433)
 - Bump to ``jinja2==3.1.4`` due to https://github.com/advisories/GHSA-h75v-3vvj-5mfj [#66488](https://github.com/saltstack/salt/issues/66488)
+- Bump to ``jinja2==3.1.4`` due to https://github.com/advisories/GHSA-h75v-3vvj-5mfj [#66488](https://github.com/saltstack/salt/issues/66488)
+- CVE-2024-37088 salt-call will fail with exit code 1 if bad pillar data is
+  encountered. [#66702](https://github.com/saltstack/salt/issues/66702)
 
 
 ## 3006.8 (2024-04-29)

changelog/33669.added.md

@@ -0,0 +1,3 @@
+Issue #33669: Fixes an issue with the ``ini_managed`` execution module
+where it would always wrap the separator with spaces. Adds a new parameter
+named ``no_spaces`` that will not warp the separator with spaces.

changelog/65104.fixed.md

@@ -0,0 +1 @@
+The 'profile' outputter does not crash with incorrectly formatted data

changelog/66249.fixed.md

@@ -0,0 +1 @@
+Fix batch mode hang indefinitely in some scenarios

changelog/66467.removed.md

@@ -0,0 +1 @@
+Remove psutil_compat.py file, which should have been removed when RHEL 6 EOL

changelog/66716.fixed.md

@@ -0,0 +1,2 @@
+Fixed an issue where ``status.master`` wasn't detecting a connection to the
+specified master properly

changelog/66718.fixed.md

@@ -0,0 +1,2 @@
+Fixed ``win_wua.available`` when some of the update objects are empty CDispatch
+objects. The ``available`` function no longer crashes

changelog/66726.fixed.md

@@ -0,0 +1 @@
+Clean up multiprocessing file handles on minion

changelog/66786.fixed.md

@@ -0,0 +1,2 @@
+Fix an issue where files created using `salt.utils.atomicile.atomic_open()`
+were created with restrictive permissions instead of respecting the umask.

changelog/66789.fixed.md

@@ -0,0 +1 @@
+Fix bad async_method name on AsyncPubClient class

changelog/66796.fixed.md

@@ -0,0 +1 @@
+Ensure Manjaro ARM reports the correct os_family of Arch.

doc/Makefile

@@ -16,7 +16,7 @@ ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
 # the i18n builder cannot share the environment and doctrees with the others
 I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
 
-.PHONY: help clean check_sphinx-build html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest
+.PHONY: help clean check_sphinx-build html dirhtml singlehtml pickle json htmlhelp qthelp devhelp latex latexpdf text man changes linkcheck doctest
 
 help:
 	@echo "Please use \`make <target>' where <target> is one of"
@@ -28,7 +28,6 @@ help:
 	@echo "  htmlhelp   to make HTML files and a HTML help project"
 	@echo "  qthelp     to make HTML files and a qthelp project"
 	@echo "  devhelp    to make HTML files and a Devhelp project"
-	@echo "  epub       to make an epub"
 	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
 	@echo "  pdf        to make Salt-all.pdf and splitted pdf using xelatex"
 	@echo "  cheatsheet to create salt-cheatsheet.pdf"
@@ -101,11 +100,6 @@ devhelp: check_sphinx-build
 	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/Salt"
 	@echo "# devhelp"
 
-epub: check_sphinx-build
-	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
-	@echo
-	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
-
 latex: check_sphinx-build
 	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
 	@echo

doc/_themes/saltstack2/layout.html

@@ -193,10 +193,8 @@
 
                                     {% if not (build_type == repo_primary_branch or build_type == "next") and on_saltstack %}
                                     <li><a class="icon-dl" href="/en/pdf/Salt-{{ release }}.pdf"><img height="25" width="25" class="nolightbox" src="{{ pathto('_static/images/pdf_icon.svg', 1) }}"></a></li>
-                                    <li><a class="icon-dl" href="/en/epub/Salt-{{ release }}.epub"><img height="25" width="18" class="nolightbox" src="{{ pathto('_static/images/epub_icon.svg', 1) }}"></a></li>
                                     {% elif build_type == repo_primary_branch and on_saltstack %}
                                     <li><a class="icon-dl" href="/en/pdf/Salt-{{ repo_primary_branch }}.pdf"><img height="25" width="25" class="nolightbox" src="{{ pathto('_static/images/pdf_icon.svg', 1) }}"></a></li>
-                                    <li><a class="icon-dl" href="/en/epub/Salt-{{ repo_primary_branch }}.epub"><img height="25" width="18" class="nolightbox" src="{{ pathto('_static/images/epub_icon.svg', 1) }}"></a></li>
                                     {% endif %}
                                 </ul>
                             </nav>