Merge branch '2017.7' into win_unit_test_local_cache

2025-04-17 10:10:20 +00:00 · 2017-08-30 12:16:52 -04:00 · 2017-08-30 12:16:52 -04:00 · 3777b34572
commit 3777b34572
parent 35b79ecde6 ec1bedc646
295 changed files with 7062 additions and 3719 deletions
--- a/conf/master
+++ b/conf/master
@ -59,15 +59,14 @@

 # Directory for custom modules. This directory can contain subdirectories for
 # each of Salt's module types such as "runners", "output", "wheel", "modules",
-# "states", "returners", etc.
-#extension_modules: <no default>
+# "states", "returners", "engines", "utils", etc.
+#extension_modules: /var/cache/salt/master/extmods

 # Directory for custom modules. This directory can contain subdirectories for
 # each of Salt's module types such as "runners", "output", "wheel", "modules",
-# "states", "returners", "engines", etc.
+# "states", "returners", "engines", "utils", etc.
 # Like 'extension_modules' but can take an array of paths
-#module_dirs: <no default>
-#   - /var/cache/salt/minion/extmods
+#module_dirs: []

 # Verify and set permissions on configuration directories at startup:
 #verify_env: True
@ -302,6 +301,9 @@
 # public keys from the minions. Note that this is insecure.
 #auto_accept: False

+# The size of key that should be generated when creating new keys.
+#keysize: 2048
+
 # Time in minutes that an incoming public key with a matching name found in
 # pki_dir/minion_autosign/keyid is automatically accepted. Expired autosign keys
 # are removed when the master checks the minion_autosign directory.
@ -959,6 +961,21 @@
 #pillar_cache_backend: disk


+######        Reactor Settings        #####
+###########################################
+# Define a salt reactor. See https://docs.saltstack.com/en/latest/topics/reactor/
+#reactor: []
+
+#Set the TTL for the cache of the reactor configuration.
+#reactor_refresh_interval: 60
+
+#Configure the number of workers for the runner/wheel in the reactor.
+#reactor_worker_threads: 10
+
+#Define the queue size for workers in the reactor.
+#reactor_worker_hwm: 10000
+
+
 #####          Syndic settings       #####
 ##########################################
 # The Salt syndic is used to pass commands through a master from a higher
--- a/conf/minion
+++ b/conf/minion
@ -620,6 +620,9 @@
 # you do so at your own risk!
 #open_mode: False

+# The size of key that should be generated when creating new keys.
+#keysize: 2048
+
 # Enable permissive access to the salt keys.  This allows you to run the
 # master or minion as root, but have a non-root group be given access to
 # your pki_dir.  To make the access explicit, root must belong to the group
@ -661,6 +664,21 @@
 #    ssl_version: PROTOCOL_TLSv1_2


+######        Reactor Settings        #####
+###########################################
+# Define a salt reactor. See https://docs.saltstack.com/en/latest/topics/reactor/
+#reactor: []
+
+#Set the TTL for the cache of the reactor configuration.
+#reactor_refresh_interval: 60
+
+#Configure the number of workers for the runner/wheel in the reactor.
+#reactor_worker_threads: 10
+
+#Define the queue size for workers in the reactor.
+#reactor_worker_hwm: 10000
+
+
 ######         Thread settings        #####
 ###########################################
 # Disable multiprocessing support, by default when a minion receives a
--- a/doc/conf.py
+++ b/doc/conf.py
@ -72,12 +72,12 @@ MOCK_MODULES = [
    'Crypto.Signature',
    'Crypto.Signature.PKCS1_v1_5',
    'M2Crypto',
+    'msgpack',
    'yaml',
    'yaml.constructor',
    'yaml.nodes',
    'yaml.parser',
    'yaml.scanner',
-    'salt.utils.yamlloader',
    'zmq',
    'zmq.eventloop',
    'zmq.eventloop.ioloop',
@ -126,7 +126,6 @@ MOCK_MODULES = [
    'ClusterShell',
    'ClusterShell.NodeSet',
    'django',
-    'docker',
    'libvirt',
    'MySQLdb',
    'MySQLdb.cursors',
@ -176,7 +175,7 @@ MOCK_MODULES = [

 for mod_name in MOCK_MODULES:
    if mod_name == 'psutil':
-        mock = Mock(mapping={'total': 0, 'version_info': (0, 6,0)})  # Otherwise it will crash Sphinx
+        mock = Mock(mapping={'total': 0})  # Otherwise it will crash Sphinx
    else:
        mock = Mock()
    sys.modules[mod_name] = mock
@ -246,9 +245,9 @@ on_saltstack = 'SALT_ON_SALTSTACK' in os.environ
 project = 'Salt'

 version = salt.version.__version__
-latest_release = '2016.11.6'  # latest release
-previous_release = '2016.3.6'  # latest release from previous branch
-previous_release_dir = '2016.3'  # path on web server for previous branch
+latest_release = '2017.7.1'  # latest release
+previous_release = '2016.11.7'  # latest release from previous branch
+previous_release_dir = '2016.11'  # path on web server for previous branch
 next_release = ''  # next release
 next_release_dir = ''  # path on web server for next release branch

@ -259,8 +258,8 @@ if on_saltstack:
    copyright = time.strftime("%Y")

 # < --- START do not merge these settings to other branches START ---> #
-build_type = 'develop'  # latest, previous, develop, next
-release = version  # version, latest_release, previous_release
+build_type = 'latest'  # latest, previous, develop, next
+release = latest_release # version, latest_release, previous_release
 # < --- END do not merge these settings to other branches END ---> #

 # Set google custom search engine
@ -321,11 +320,21 @@ rst_prolog = """\
 .. _`salt-packagers`: https://groups.google.com/forum/#!forum/salt-packagers
 .. |windownload| raw:: html

-     <p>x86: <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-x86-Setup.exe"><strong>Salt-Minion-{release}-x86-Setup.exe</strong></a>
-      | <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-x86-Setup.exe.md5"><strong>md5</strong></a></p>
+     <p>Python2 x86: <a
+     href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py2-x86-Setup.exe"><strong>Salt-Minion-{release}-x86-Setup.exe</strong></a>
+      | <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py2-x86-Setup.exe.md5"><strong>md5</strong></a></p>
+
+     <p>Python2 AMD64: <a
+     href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py2-AMD64-Setup.exe"><strong>Salt-Minion-{release}-AMD64-Setup.exe</strong></a>
+      | <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py2-AMD64-Setup.exe.md5"><strong>md5</strong></a></p>
+     <p>Python3 x86: <a
+     href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py3-x86-Setup.exe"><strong>Salt-Minion-{release}-x86-Setup.exe</strong></a>
+      | <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py3-x86-Setup.exe.md5"><strong>md5</strong></a></p>
+
+     <p>Python3 AMD64: <a
+     href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py3-AMD64-Setup.exe"><strong>Salt-Minion-{release}-AMD64-Setup.exe</strong></a>
+      | <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-Py3-AMD64-Setup.exe.md5"><strong>md5</strong></a></p>

-     <p>AMD64: <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-AMD64-Setup.exe"><strong>Salt-Minion-{release}-AMD64-Setup.exe</strong></a>
-      | <a href="https://repo.saltstack.com/windows/Salt-Minion-{release}-AMD64-Setup.exe.md5"><strong>md5</strong></a></p>

 .. |osxdownload| raw:: html

--- a/doc/faq.rst
+++ b/doc/faq.rst
@ -190,6 +190,8 @@ PATH using a :mod:`file.symlink <salt.states.file.symlink>` state.
      file.symlink:
        - target: /usr/local/bin/foo

+.. _which-version:
+
 Can I run different versions of Salt on my Master and Minion?
 -------------------------------------------------------------

@ -319,7 +321,27 @@ Restart using states
 ********************

 Now we can apply the workaround to restart the Minion in reliable way.
-The following example works on both UNIX-like and Windows operating systems:
+The following example works on UNIX-like operating systems:
+
+.. code-block:: jinja
+
+    {%- if grains['os'] != 'Windows' %
+    Restart Salt Minion:
+      cmd.run:
+        - name: 'salt-call --local service.restart salt-minion'
+        - bg: True
+        - onchanges:
+          - pkg: Upgrade Salt Minion
+    {%- endif %}
+
+Note that restarting the ``salt-minion`` service on Windows operating systems is
+not always necessary when performing an upgrade. The installer stops the
+``salt-minion`` service, removes it, deletes the contents of the ``\salt\bin``
+directory, installs the new code, re-creates the ``salt-minion`` service, and
+starts it (by default). The restart step **would** be necessary during the
+upgrade process, however, if the minion config was edited after the upgrade or
+installation. If a minion restart is necessary, the state above can be edited
+as follows:

 .. code-block:: jinja

@ -335,8 +357,8 @@ The following example works on both UNIX-like and Windows operating systems:
          - pkg: Upgrade Salt Minion

 However, it requires more advanced tricks to upgrade from legacy version of
-Salt (before ``2016.3.0``), where executing commands in the background is not
-supported:
+Salt (before ``2016.3.0``) on UNIX-like operating systems, where executing
+commands in the background is not supported:

 .. code-block:: jinja

--- a/doc/ref/cli/_includes/output-options.rst
+++ b/doc/ref/cli/_includes/output-options.rst
@ -33,6 +33,10 @@ Output Options

    Write the output to the specified file.

+.. option:: --out-file-append, --output-file-append
+
+    Append the output to the specified file.
+
 .. option:: --no-color

    Disable all colored output
@ -46,3 +50,14 @@ Output Options

        ``green`` denotes success, ``red`` denotes failure, ``blue`` denotes
        changes and success and ``yellow`` denotes a expected future change in configuration.
+
+.. option:: --state-output=STATE_OUTPUT, --state_output=STATE_OUTPUT
+
+    Override the configured state_output value for minion
+    output. One of 'full', 'terse', 'mixed', 'changes' or
+    'filter'. Default: 'none'.
+
+.. option:: --state-verbose=STATE_VERBOSE, --state_verbose=STATE_VERBOSE
+
+    Override the configured state_verbose value for minion
+    output. Set to True or False. Default: none.
--- a/doc/ref/cli/salt-cp.rst
+++ b/doc/ref/cli/salt-cp.rst
@ -39,6 +39,13 @@ specified target expression.
    desitination will be assumed to be a directory. Finally, recursion is now
    supported, allowing for entire directories to be copied.

+.. versionchanged:: 2016.11.7,2017.7.2
+    Reverted back to the old copy mode to preserve backward compatibility. The
+    new functionality added in 2016.6.6 and 2017.7.0 is now available using the
+    ``-C`` or ``--chunked`` CLI arguments. Note that compression, recursive
+    copying, and support for copying large files is only available in chunked
+    mode.
+
 Options
 =======

@ -56,9 +63,16 @@ Options
 .. include:: _includes/target-selection.rst


+.. option:: -C, --chunked
+
+    Use new chunked mode to copy files. This mode supports large files, recursive
+    directories copying and compression.
+
+    .. versionadded:: 2016.11.7,2017.7.2
+
 .. option:: -n, --no-compression

-    Disable gzip compression.
+    Disable gzip compression in chunked mode.

    .. versionadded:: 2016.3.7,2016.11.6,2017.7.0

--- a/doc/ref/configuration/master.rst
+++ b/doc/ref/configuration/master.rst
@ -94,64 +94,6 @@ The user to run the Salt processes

    user: root

-.. conf_master:: max_open_files
-
-``max_open_files``
------------------
-
-Default: ``100000``
-
-Each minion connecting to the master uses AT LEAST one file descriptor, the
-master subscription connection. If enough minions connect you might start
-seeing on the console(and then salt-master crashes):
-
-.. code-block:: bash
-
-    Too many open files (tcp_listener.cpp:335)
-    Aborted (core dumped)
-
-.. code-block:: yaml
-
-    max_open_files: 100000
-
-By default this value will be the one of `ulimit -Hn`, i.e., the hard limit for
-max open files.
-
-To set a different value than the default one, uncomment, and configure this
-setting. Remember that this value CANNOT be higher than the hard limit. Raising
-the hard limit depends on the OS and/or distribution, a good way to find the
-limit is to search the internet for something like this:
-
-.. code-block:: text
-
-    raise max open files hard limit debian
-
-.. conf_master:: worker_threads
-
-``worker_threads``
------------------
-
-Default: ``5``
-
-The number of threads to start for receiving commands and replies from minions.
-If minions are stalling on replies because you have many minions, raise the
-worker_threads value.
-
-Worker threads should not be put below 3 when using the peer system, but can
-drop down to 1 worker otherwise.
-
-.. note::
-    When the master daemon starts, it is expected behaviour to see
-    multiple salt-master processes, even if 'worker_threads' is set to '1'. At
-    a minimum, a controlling process will start along with a Publisher, an
-    EventPublisher, and a number of MWorker processes will be started. The
-    number of MWorker processes is tuneable by the 'worker_threads'
-    configuration value while the others are not.
-
-.. code-block:: yaml
-
-    worker_threads: 5
-
 .. conf_master:: ret_port

 ``ret_port``
@ -241,13 +183,16 @@ The directory to store the pki authentication keys.

 Directory for custom modules. This directory can contain subdirectories for
 each of Salt's module types such as ``runners``, ``output``, ``wheel``,
-``modules``, ``states``, ``returners``, ``engines``, etc. This path is appended to
-:conf_master:`root_dir`.
+``modules``, ``states``, ``returners``, ``engines``, ``utils``, etc.
+This path is appended to :conf_master:`root_dir`.

 .. code-block:: yaml

    extension_modules: /root/salt_extmods

+.. conf_master:: extmod_whitelist
+.. conf_master:: extmod_blacklist
+
 ``extmod_whitelist/extmod_blacklist``
 -------------------------------------

@ -943,6 +888,74 @@ to socket concurrently.

    sock_pool_size: 15

+.. conf_master:: ipc_mode
+
+``ipc_mode``
+------------
+
+Default: ``ipc``
+
+The ipc strategy. (i.e., sockets versus tcp, etc.) Windows platforms lack
+POSIX IPC and must rely on TCP based inter-process communications. ``ipc_mode``
+is set to ``tcp`` by default on Windows.
+
+.. code-block:: yaml
+
+    ipc_mode: ipc
+
+.. conf_master::
+
+``tcp_master_pub_port``
+-----------------------
+
+Default: ``4512``
+
+The TCP port on which events for the master should be published if ``ipc_mode`` is TCP.
+
+.. code-block:: yaml
+
+    tcp_master_pub_port: 4512
+
+.. conf_master:: tcp_master_pull_port
+
+``tcp_master_pull_port``
+------------------------
+
+Default: ``4513``
+
+The TCP port on which events for the master should be pulled if ``ipc_mode`` is TCP.
+
+.. code-block:: yaml
+
+    tcp_master_pull_port: 4513
+
+.. conf_master:: tcp_master_publish_pull
+
+``tcp_master_publish_pull``
+---------------------------
+
+Default: ``4514``
+
+The TCP port on which events for the master should be pulled fom and then republished onto
+the event bus on the master.
+
+.. code-block:: yaml
+
+    tcp_master_publish_pull: 4514
+
+.. conf_master:: tcp_master_workers
+
+``tcp_master_workers``
+----------------------
+
+Default: ``4515``
+
+The TCP port for ``mworkers`` to connect to on the master.
+
+.. code-block:: yaml
+
+    tcp_master_workers: 4515
+

 .. _salt-ssh-configuration:

@ -1189,6 +1202,19 @@ public keys from minions.

    auto_accept: False

+.. conf_master:: keysize
+
+``keysize``
+-----------
+
+Default: ``2048``
+
+The size of key that should be generated when creating new keys.
+
+.. code-block:: yaml
+
+    keysize: 2048
+
 .. conf_master:: autosign_timeout

 ``autosign_timeout``
@ -1233,6 +1259,24 @@ minion IDs for which keys will automatically be rejected. Will override both
 membership in the :conf_master:`autosign_file` and the
 :conf_master:`auto_accept` setting.

+.. conf_master:: permissive_pki_access
+
+``permissive_pki_access``
+-------------------------
+
+Default: ``False``
+
+Enable permissive access to the salt keys. This allows you to run the
+master or minion as root, but have a non-root group be given access to
+your pki_dir. To make the access explicit, root must belong to the group
+you've given access to. This is potentially quite insecure. If an autosign_file
+is specified, enabling permissive_pki_access will allow group access to that
+specific file.
+
+.. code-block:: yaml
+
+    permissive_pki_access: False
+
 .. conf_master:: publisher_acl

 ``publisher_acl``
@ -1275,6 +1319,20 @@ This is completely disabled by default.
        - cmd.*
        - test.echo

+.. conf_master:: sudo_acl
+
+``sudo_acl``
+------------
+
+Default: ``False``
+
+Enforce ``publisher_acl`` and ``publisher_acl_blacklist`` when users have sudo
+access to the salt command.
+
+.. code-block:: yaml
+
+    sudo_acl: False
+
 .. conf_master:: external_auth

 ``external_auth``
@ -1459,6 +1517,19 @@ Do not disable this unless it is absolutely clear what this does.

    rotate_aes_key: True

+.. conf_master:: publish_session
+
+``publish_session``
+-------------------
+
+Default: ``86400``
+
+The number of seconds between AES key rotations on the master.
+
+.. code-block:: yaml
+
+    publish_session: Default: 86400
+
 .. conf_master:: ssl

 ``ssl``
@ -1489,6 +1560,24 @@ constant names without ssl module prefix: ``CERT_REQUIRED`` or ``PROTOCOL_SSLv23
 ``allow_minion_key_revoke``
 ---------------------------

+Default: ``False``
+
+By default, the master deletes its cache of minion data when the key for that
+minion is removed. To preserve the cache after key deletion, set
+``preserve_minion_cache`` to True.
+
+WARNING: This may have security implications if compromised minions auth with
+a previous deleted minion ID.
+
+.. code-block:: yaml
+
+    preserve_minion_cache: False
+
+.. conf_master:: allow_minion_key_revoke
+
+``allow_minion_key_revoke``
+---------------------------
+
 Default: ``True``

 Controls whether a minion can request its own key revocation.  When True
@ -1501,6 +1590,127 @@ the master will drop the request and the minion's key will remain accepted.
    rotate_aes_key: True


+Master Large Scale Tuning Settings
+==================================
+
+.. conf_master:: max_open_files
+
+``max_open_files``
+------------------
+
+Default: ``100000``
+
+Each minion connecting to the master uses AT LEAST one file descriptor, the
+master subscription connection. If enough minions connect you might start
+seeing on the console(and then salt-master crashes):
+
+.. code-block:: bash
+
+    Too many open files (tcp_listener.cpp:335)
+    Aborted (core dumped)
+
+.. code-block:: yaml
+
+    max_open_files: 100000
+
+By default this value will be the one of `ulimit -Hn`, i.e., the hard limit for
+max open files.
+
+To set a different value than the default one, uncomment, and configure this
+setting. Remember that this value CANNOT be higher than the hard limit. Raising
+the hard limit depends on the OS and/or distribution, a good way to find the
+limit is to search the internet for something like this:
+
+.. code-block:: text
+
+    raise max open files hard limit debian
+
+.. conf_master:: worker_threads
+
+``worker_threads``
+------------------
+
+Default: ``5``
+
+The number of threads to start for receiving commands and replies from minions.
+If minions are stalling on replies because you have many minions, raise the
+worker_threads value.
+
+Worker threads should not be put below 3 when using the peer system, but can
+drop down to 1 worker otherwise.
+
+.. note::
+    When the master daemon starts, it is expected behaviour to see
+    multiple salt-master processes, even if 'worker_threads' is set to '1'. At
+    a minimum, a controlling process will start along with a Publisher, an
+    EventPublisher, and a number of MWorker processes will be started. The
+    number of MWorker processes is tuneable by the 'worker_threads'
+    configuration value while the others are not.
+
+.. code-block:: yaml
+
+    worker_threads: 5
+
+.. conf_master:: pub_hwm
+
+``pub_hwm``
+-----------
+
+Default: ``1000``
+
+The zeromq high water mark on the publisher interface.
+
+.. code-block:: yaml
+
+    pub_hwm: 1000
+
+.. conf_master:: zmq_backlog
+
+``zmq_backlog``
+---------------
+
+Default: ``1000``
+
+The listen queue size of the ZeroMQ backlog.
+
+.. code-block:: yaml
+
+    zmq_backlog: 1000
+
+.. conf_master:: salt_event_pub_hwm
+.. conf_master:: event_publisher_pub_hwm
+
+``salt_event_pub_hwm`` and ``event_publisher_pub_hwm``
+------------------------------------------------------
+
+These two ZeroMQ High Water Mark settings, ``salt_event_pub_hwm`` and
+``event_publisher_pub_hwm`` are significant for masters with thousands of
+minions. When these are insufficiently high it will manifest in random
+responses missing in the CLI and even missing from the job cache. Masters
+that have fast CPUs and many cores with appropriate ``worker_threads``
+will not need these set as high.
+
+The ZeroMQ high-water-mark for the ``SaltEvent`` pub socket default is:
+
+.. code-block:: yaml
+
+    salt_event_pub_hwm: 20000
+
+The ZeroMQ high-water-mark for the ``EventPublisher`` pub socket default is:
+
+.. code-block:: yaml
+
+    event_publisher_pub_hwm: 10000
+
+As an example, on single master deployment with 8,000 minions, 2.4GHz CPUs,
+24 cores, and 32GiB memory has these settings:
+
+.. code-block:: yaml
+
+    salt_event_pub_hwm: 128000
+    event_publisher_pub_hwm: 64000
+
+
 .. _master-module-management:

 Master Module Management
@ -3176,6 +3386,26 @@ configuration.

    pillar_opts: False

+.. conf_master:: pillar_safe_render_error
+
+``pillar_safe_render_error``
+----------------------------
+
+Default: ``True``
+
+The pillar_safe_render_error option prevents the master from passing pillar
+render errors to the minion. This is set on by default because the error could
+contain templating data which would give that minion information it shouldn't
+have, like a password! When set ``True`` the error message will only show:
+
+.. code-block:: shell
+
+    Rendering SLS 'my.sls' failed. Please see master log for details.
+
+.. code-block:: yaml
+
+    pillar_safe_render_error: True
+
 .. _master-configuration-ext-pillar:

 .. conf_master:: ext_pillar
@ -3846,6 +4076,62 @@ can be utilized:
    pillar_cache_backend: disk


+Master Reactor Settings
+=======================
+
+.. conf_master:: reactor
+
+``reactor``
+-----------
+
+Default: ``[]``
+
+Defines a salt reactor. See the :ref:`Reactor <reactor>` documentation for more
+information.
+
+.. code-block:: yaml
+
+    reactor: []
+
+.. conf_master:: reactor_refresh_interval
+
+``reactor_refresh_interval``
+----------------------------
+
+Default: ``60``
+
+The TTL for the cache of the reactor configuration.
+
+.. code-block:: yaml
+
+    reactor_refresh_interval: 60
+
+.. conf_master:: reactor_worker_threads
+
+``reactor_worker_threads``
+--------------------------
+
+Default: ``10``
+
+The number of workers for the runner/wheel in the reactor.
+
+.. code-block:: yaml
+    reactor_worker_threads: 10
+
+.. conf_master:: reactor_worker_hwm
+
+``reactor_worker_hwm``
+----------------------
+
+Default: ``10000``
+
+The queue size for workers in the reactor.
+
+.. code-block:: yaml
+
+    reactor_worker_hwm: 10000
+
+
 .. _syndic-server-settings:

 Syndic Server Settings
@ -4312,6 +4598,63 @@ option then the master will log a warning message.
      - /etc/roles/webserver


+Keepalive Settings
+==================
+
+.. conf_master:: tcp_keepalive
+
+``tcp_keepalive``
+-----------------
+
+Default: ``True``
+
+The tcp keepalive interval to set on TCP ports. This setting can be used to tune Salt
+connectivity issues in messy network environments with misbehaving firewalls.
+
+.. code-block:: yaml
+
+    tcp_keepalive: True
+
+.. conf_master:: tcp_keepalive_cnt
+
+``tcp_keepalive_cnt``
+---------------------
+
+Default: ``-1``
+
+Sets the ZeroMQ TCP keepalive count. May be used to tune issues with minion disconnects.
+
+.. code-block:: yaml
+
+    tcp_keepalive_cnt: -1
+
+.. conf_master:: tcp_keepalive_idle
+
+``tcp_keepalive_idle``
+----------------------
+
+Default: ``300``
+
+Sets ZeroMQ TCP keepalive idle. May be used to tune issues with minion disconnects.
+
+.. code-block:: yaml
+
+    tcp_keepalive_idle: 300
+
+.. conf_master:: tcp_keepalive_intvl
+
+``tcp_keepalive_intvl``
+-----------------------
+
+Default: ``-1``
+
+Sets ZeroMQ TCP keepalive interval. May be used to tune issues with minion disconnects.
+
+.. code-block:: yaml
+
+    tcp_keepalive_intvl': -1
+
+
 .. _winrepo-master-config-opts:

 Windows Software Repo Settings
@ -4450,7 +4793,7 @@ URL of the repository:

 .. code-block:: yaml

-    winrepo_remotes:
+    winrepo_remotes_ng:
      - '<commit_id> https://github.com/saltstack/salt-winrepo-ng.git'

 Replace ``<commit_id>`` with the SHA1 hash of a commit ID. Specifying a commit
--- a/doc/ref/configuration/minion.rst
+++ b/doc/ref/configuration/minion.rst
@ -750,6 +750,20 @@ seconds each iteration.

    acceptance_wait_time_max: 0

+.. conf_minion:: rejected_retry
+
+``rejected_retry``
+------------------
+
+Default: ``False``
+
+If the master rejects the minion's public key, retry instead of exiting.
+Rejected keys will be handled the same as waiting on acceptance.
+
+.. code-block:: yaml
+
+    rejected_retry: False
+
 .. conf_minion:: random_reauth_delay

 ``random_reauth_delay``
@ -1180,7 +1194,7 @@ If certain returners should be disabled, this is the place
 .. conf_minion:: enable_whitelist_modules

 ``whitelist_modules``
----------------------------
+---------------------

 Default: ``[]`` (Module whitelisting is disabled.  Adding anything to the config option
 will cause only the listed modules to be enabled.  Modules not in the list will
@ -1272,6 +1286,20 @@ A list of extra directories to search for Salt renderers
    render_dirs:
      - /var/lib/salt/renderers

+.. conf_minion:: utils_dirs
+
+``utils_dirs``
+--------------
+
+Default: ``[]``
+
+A list of extra directories to search for Salt utilities
+
+.. code-block:: yaml
+
+    utils_dirs:
+      - /var/lib/salt/utils
+
 .. conf_minion:: cython_enable

 ``cython_enable``
@ -1320,6 +1348,23 @@ below.
    providers:
      service: systemd

+.. conf_minion:: modules_max_memory
+
+``modules_max_memory``
+----------------------
+
+Default: ``-1``
+
+Specify a max size (in bytes) for modules on import. This feature is currently
+only supported on *nix operating systems and requires psutil.
+
+.. code-block:: yaml
+
+    modules_max_memory: -1
+
+.. conf_minion:: extmod_whitelist
+.. conf_minion:: extmod_blacklist
+
 ``extmod_whitelist/extmod_blacklist``
 -------------------------------------

@ -1342,8 +1387,8 @@ whitelist an empty list.
      modules:
        - specific_module

-
 Valid options:
+
  - beacons
  - clouds
  - sdb
@ -1489,6 +1534,52 @@ environment lacks one.

    default_top: dev

+.. conf_minion:: startup_states
+
+``startup_states``
+------------------
+
+Default: ``''``
+
+States to run when the minion daemon starts. To enable, set ``startup_states`` to:
+
+- ``highstate``: Execute state.highstate
+- ``sls``: Read in the sls_list option and execute the named sls files
+- ``top``: Read top_file option and execute based on that file on the Master
+
+.. code-block:: yaml
+
+    startup_states: ''
+
+.. conf_minion:: sls_list
+
+``sls_list``
+------------
+
+Default: ``[]``
+
+List of states to run when the minion starts up if ``startup_states`` is set to ``sls``.
+
+.. code-block:: yaml
+
+    sls_list:
+      - edit.vim
+      - hyper
+
+.. conf_minion:: top_file
+
+``top_file``
+------------
+
+Default: ``''``
+
+Top file to execute if ``startup_states`` is set to ``top``.
+
+.. code-block:: yaml
+
+    top_file: ''
+
+
 State Management Settings
 =========================

@ -1505,7 +1596,7 @@ The default renderer used for local state executions

    renderer: yaml_jinja

-.. conf_master:: test
+.. conf_minion:: test

 ``test``
 --------
@ -2023,6 +2114,35 @@ before the initial key exchange. The master fingerprint can be found by running

   master_finger: 'ba:30:65:2a:d6:9e:20:4f:d8:b2:f3:a7:d4:65:11:13'

+.. conf_minion:: keysize
+
+``keysize``
+-----------
+
+Default: ``2048``
+
+The size of key that should be generated when creating new keys.
+
+.. code-block:: yaml
+
+    keysize: 2048
+
+.. conf_minion:: permissive_pki_access
+
+``permissive_pki_access``
+-------------------------
+
+Default: ``False``
+
+Enable permissive access to the salt keys. This allows you to run the
+master or minion as root, but have a non-root group be given access to
+your pki_dir. To make the access explicit, root must belong to the group
+you've given access to. This is potentially quite insecure.
+
+.. code-block:: yaml
+
+    permissive_pki_access: False
+
 .. conf_minion:: verify_master_pubkey_sign

 ``verify_master_pubkey_sign``
@ -2130,7 +2250,7 @@ blocked. If `cmd_whitelist_glob` is NOT SET, then all shell commands are permitt
      - 'cat /etc/fstab'


-.. conf_master:: ssl
+.. conf_minion:: ssl

 ``ssl``
 -------
@ -2156,6 +2276,62 @@ constant names without ssl module prefix: ``CERT_REQUIRED`` or ``PROTOCOL_SSLv23
        ssl_version: PROTOCOL_TLSv1_2


+Reactor Settings
+================
+
+.. conf_minion:: reactor
+
+``reactor``
+-----------
+
+Default: ``[]``
+
+Defines a salt reactor. See the :ref:`Reactor <reactor>` documentation for more
+information.
+
+.. code-block:: yaml
+
+    reactor: []
+
+.. conf_minion:: reactor_refresh_interval
+
+``reactor_refresh_interval``
+----------------------------
+
+Default: ``60``
+
+The TTL for the cache of the reactor configuration.
+
+.. code-block:: yaml
+
+    reactor_refresh_interval: 60
+
+.. conf_minion:: reactor_worker_threads
+
+``reactor_worker_threads``
+--------------------------
+
+Default: ``10``
+
+The number of workers for the runner/wheel in the reactor.
+
+.. code-block:: yaml
+    reactor_worker_threads: 10
+
+.. conf_minion:: reactor_worker_hwm
+
+``reactor_worker_hwm``
+----------------------
+
+Default: ``10000``
+
+The queue size for workers in the reactor.
+
+.. code-block:: yaml
+
+    reactor_worker_hwm: 10000
+
+
 Thread Settings
 ===============

@ -2426,6 +2602,62 @@ option then the minion will log a warning message.
      - /etc/roles/webserver


+Keepalive Settings
+==================
+
+.. conf_minion:: tcp_keepalive
+
+``tcp_keepalive``
+-----------------
+
+Default: ``True``
+
+The tcp keepalive interval to set on TCP ports. This setting can be used to tune Salt
+connectivity issues in messy network environments with misbehaving firewalls.
+
+.. code-block:: yaml
+
+    tcp_keepalive: True
+
+.. conf_minion:: tcp_keepalive_cnt
+
+``tcp_keepalive_cnt``
+---------------------
+
+Default: ``-1``
+
+Sets the ZeroMQ TCP keepalive count. May be used to tune issues with minion disconnects.
+
+.. code-block:: yaml
+
+    tcp_keepalive_cnt: -1
+
+.. conf_minion:: tcp_keepalive_idle
+
+``tcp_keepalive_idle``
+----------------------
+
+Default: ``300``
+
+Sets ZeroMQ TCP keepalive idle. May be used to tune issues with minion disconnects.
+
+.. code-block:: yaml
+
+    tcp_keepalive_idle: 300
+
+.. conf_minion:: tcp_keepalive_intvl
+
+``tcp_keepalive_intvl``
+-----------------------
+
+Default: ``-1``
+
+Sets ZeroMQ TCP keepalive interval. May be used to tune issues with minion disconnects.
+
+.. code-block:: yaml
+
+    tcp_keepalive_intvl': -1
+

 Frozen Build Update Settings
 ============================
@ -2527,6 +2759,36 @@ out.

    winrepo_dir: 'D:\winrepo'

+.. conf_minion:: winrepo_dir_ng
+
+``winrepo_dir_ng``
+------------------
+
+.. versionadded:: 2015.8.0
+    A new :ref:`ng <windows-package-manager>` repo was added.
+
+Default: ``/srv/salt/win/repo-ng``
+
+Location on the minion where the :conf_minion:`winrepo_remotes_ng` are checked
+out for 2015.8.0 and later minions.
+
+.. code-block:: yaml
+
+    winrepo_dir_ng: /srv/salt/win/repo-ng
+
+.. conf_minion:: winrepo_source_dir
+
+``winrepo_source_dir``
+----------------------
+
+Default: ``salt://win/repo-ng/``
+
+The source location for the winrepo sls files.
+
+.. code-block:: yaml
+
+    winrepo_source_dir: salt://win/repo-ng/
+
 .. conf_minion:: winrepo_cachefile
 .. conf_minion:: win_repo_cachefile

@ -2579,3 +2841,33 @@ URL of the repository:
 Replace ``<commit_id>`` with the SHA1 hash of a commit ID. Specifying a commit
 ID is useful in that it allows one to revert back to a previous version in the
 event that an error is introduced in the latest revision of the repo.
+
+.. conf_minion:: winrepo_remotes_ng
+
+``winrepo_remotes_ng``
+----------------------
+
+.. versionadded:: 2015.8.0
+    A new :ref:`ng <windows-package-manager>` repo was added.
+
+Default: ``['https://github.com/saltstack/salt-winrepo-ng.git']``
+
+List of git repositories to checkout and include in the winrepo for
+2015.8.0 and later minions.
+
+.. code-block:: yaml
+
+    winrepo_remotes_ng:
+      - https://github.com/saltstack/salt-winrepo-ng.git
+
+To specify a specific revision of the repository, prepend a commit ID to the
+URL of the repository:
+
+.. code-block:: yaml
+
+    winrepo_remotes_ng:
+      - '<commit_id> https://github.com/saltstack/salt-winrepo-ng.git'
+
+Replace ``<commit_id>`` with the SHA1 hash of a commit ID. Specifying a commit
+ID is useful in that it allows one to revert back to a previous version in the
+event that an error is introduced in the latest revision of the repo.
--- a/doc/ref/modules/all/index.rst
+++ b/doc/ref/modules/all/index.rst
@ -195,6 +195,7 @@ execution modules
    keyboard
    keystone
    kmod
+    kubernetes
    launchctl
    layman
    ldap3
--- a/doc/ref/modules/all/salt.modules.kubernetes.rst
+++ b/doc/ref/modules/all/salt.modules.kubernetes.rst
@ -0,0 +1,6 @@
+=======================
+salt.modules.kubernetes
+=======================
+
+.. automodule:: salt.modules.kubernetes
+    :members:
--- a/doc/ref/modules/index.rst
+++ b/doc/ref/modules/index.rst
@ -405,6 +405,29 @@ similar to the following:
           return __virtualname__
       return False

+The ``__virtual__()`` function can return a ``True`` or ``False`` boolean, a tuple,
+or a string. If it returns a ``True`` value, this ``__virtualname__`` module-level
+attribute can be set as seen in the above example. This is the string that the module
+should be referred to as.
+
+When ``__virtual__()`` returns a tuple, the first item should be a boolean and the
+second should be a string. This is typically done when the module should not load. The
+first value of the tuple is ``False`` and the second is the error message to display
+for why the module did not load.
+
+For example:
+
+.. code-block:: python
+
+    def __virtual__():
+        '''
+        Only load if git exists on the system
+        '''
+        if salt.utils.which('git') is None:
+            return (False,
+                    'The git execution module cannot be loaded: git unavailable.')
+        else:
+            return True

 Documentation
 =============
--- a/doc/ref/states/all/index.rst
+++ b/doc/ref/states/all/index.rst
@ -74,6 +74,10 @@ state modules
    dellchassis
    disk
    docker
+    docker_container
+    docker_image
+    docker_network
+    docker_volume
    drac
    elasticsearch
    elasticsearch_index
@ -131,6 +135,7 @@ state modules
    keyboard
    keystone
    kmod
+    kubernetes
    layman
    ldap
    libcloud_dns
--- a/doc/ref/states/all/salt.states.kubernetes.rst
+++ b/doc/ref/states/all/salt.states.kubernetes.rst
@ -0,0 +1,6 @@
+======================
+salt.states.kubernetes
+======================
+
+.. automodule:: salt.states.kubernetes
+    :members:
--- a/doc/ref/states/requisites.rst
+++ b/doc/ref/states/requisites.rst
@ -519,7 +519,8 @@ runas

 .. versionadded:: 2017.7.0

-The ``runas`` global option is used to set the user which will be used to run the command in the ``cmd.run`` module.
+The ``runas`` global option is used to set the user which will be used to run
+the command in the ``cmd.run`` module.

 .. code-block:: yaml

@ -532,6 +533,26 @@ The ``runas`` global option is used to set the user which will be used to run th

 In the above state, the pip command run by ``cmd.run`` will be run by the daniel user.

+runas_password
+~~~~~~~~~~~~~~
+
+.. versionadded:: 2017.7.2
+
+The ``runas_password`` global option is used to set the password used by the
+runas global option. This is required by ``cmd.run`` on Windows when ``runas``
+is specified. It will be set when ``runas_password`` is defined in the state.
+
+.. code-block:: yaml
+
+    run_script:
+      cmd.run:
+        - name: Powershell -NonInteractive -ExecutionPolicy Bypass -File C:\\Temp\\script.ps1
+        - runas: frank
+        - runas_password: supersecret
+
+In the above state, the Powershell script run by ``cmd.run`` will be run by the
+frank user with the password ``supersecret``.
+
 .. _requisites-require-in:
 .. _requisites-watch-in:
 .. _requisites-onchanges-in:
--- a/doc/topics/cloud/action.rst
+++ b/doc/topics/cloud/action.rst
@ -21,7 +21,7 @@ Or you may specify a map which includes all VMs to perform the action on:

    $ salt-cloud -a reboot -m /path/to/mapfile

-The following is a list of actions currently supported by salt-cloud:
+The following is an example list of actions currently supported by ``salt-cloud``:

 .. code-block:: yaml

@ -36,5 +36,5 @@ The following is a list of actions currently supported by salt-cloud:
        - start
        - stop

-Another useful reference for viewing more salt-cloud actions is the
-:ref:Salt Cloud Feature Matrix <salt-cloud-feature-matrix>
+Another useful reference for viewing more ``salt-cloud`` actions is the
+:ref:`Salt Cloud Feature Matrix <salt-cloud-feature-matrix>`.
--- a/doc/topics/cloud/aws.rst
+++ b/doc/topics/cloud/aws.rst
@ -78,6 +78,7 @@ parameters are discussed in more detail below.
      # RHEL         -> ec2-user
      # CentOS       -> ec2-user
      # Ubuntu       -> ubuntu
+      # Debian       -> admin
      #
      ssh_username: ec2-user

--- a/doc/topics/cloud/config.rst
+++ b/doc/topics/cloud/config.rst
@ -97,7 +97,7 @@ Using the example configuration above:

 .. note::

-    Salt Cloud provider configurations within ``/etc/cloud.provider.d/ should not
+    Salt Cloud provider configurations within ``/etc/cloud.provider.d/`` should not
    specify the ``providers`` starting key.

 It is also possible to have multiple cloud configuration blocks within the same alias block.
@ -371,7 +371,6 @@ both.
      compute_name: cloudServersOpenStack
      protocol: ipv4
      compute_region: DFW
-      protocol: ipv4
      user: myuser
      tenant: 5555555
      password: mypass
--- a/doc/topics/cloud/function.rst
+++ b/doc/topics/cloud/function.rst
@ -26,5 +26,5 @@ gathering information about instances on a provider basis:
    $ salt-cloud -f list_nodes_full linode
    $ salt-cloud -f list_nodes_select linode

-Another useful reference for viewing salt-cloud functions is the
+Another useful reference for viewing ``salt-cloud`` functions is the
 :ref:`Salt Cloud Feature Matrix <salt-cloud-feature-matrix>`.
--- a/doc/topics/cloud/index.rst
+++ b/doc/topics/cloud/index.rst
@ -64,7 +64,9 @@ automatically installed salt-cloud for you. Use your distribution's package
 manager to install the ``salt-cloud`` package from the same repo that you
 used to install Salt.  These repos will automatically be setup by Salt Bootstrap.

-If there is no salt-cloud package, install with ``pip install salt-cloud``.
+Alternatively, the ``-L`` option can be passed to the `Salt Bootstrap`_ script when
+installing Salt. The ``-L`` option will install ``salt-cloud`` and the required
+``libcloud`` package.

 .. _`Salt Bootstrap`: https://github.com/saltstack/salt-bootstrap

--- a/doc/topics/cloud/joyent.rst
+++ b/doc/topics/cloud/joyent.rst
@ -49,7 +49,7 @@ Set up an initial profile at ``/etc/salt/cloud.profiles`` or in the

 .. code-block:: yaml

-    joyent_512
+    joyent_512:
      provider: my-joyent-config
      size: g4-highcpu-512M
      image: ubuntu-16.04
--- a/doc/topics/cloud/qs.rst
+++ b/doc/topics/cloud/qs.rst
@ -12,7 +12,9 @@ automatically installed salt-cloud for you. Use your distribution's package
 manager to install the ``salt-cloud`` package from the same repo that you
 used to install Salt.  These repos will automatically be setup by Salt Bootstrap.

-If there is no salt-cloud package, install with ``pip install salt-cloud``.
+Alternatively, the ``-L`` option can be passed to the `Salt Bootstrap`_ script when
+installing Salt. The ``-L`` option will install ``salt-cloud`` and the required
+``libcloud`` package.

 .. _`Salt Bootstrap`: https://github.com/saltstack/salt-bootstrap

--- a/doc/topics/development/contributing.rst
+++ b/doc/topics/development/contributing.rst
@ -260,6 +260,13 @@ The Salt development team will back-port bug fixes made to ``develop`` to the
 current release branch if the contributor cannot create the pull request
 against that branch.

+Release Branches
+----------------
+
+For each release a branch will be created when we are ready to tag. The branch will be the same name as the tag minus the v. For example, the v2017.7.1 release was created from the 2017.7.1 branch. This branching strategy will allow for more stability when there is a need for a re-tag during the testing phase of our releases.
+
+Once the branch is created, the fixes required for a given release, as determined by the SaltStack release team, will be added to this branch. All commits in this branch will be merged forward into the parent branch as well.
+
 Keeping Salt Forks in Sync
 ==========================

--- a/doc/topics/installation/eos.rst
+++ b/doc/topics/installation/eos.rst
@ -0,0 +1,154 @@
+=========================================
+Arista EOS Salt minion installation guide
+=========================================
+
+The Salt minion for Arista EOS is distributed as a SWIX extension and can be installed directly on the switch. The EOS network operating system is based on old Fedora distributions and the installation of the ``salt-minion`` requires backports. This SWIX extension contains the necessary backports, together with the Salt basecode.
+
+.. note::
+
+    This SWIX extension has been tested on Arista DCS-7280SE-68-R, running EOS 4.17.5M and vEOS 4.18.3F. 
+
+Important Notes
+===============
+
+This package is in beta, make sure to test it carefully before running it in production.
+
+If confirmed working correctly, please report and add a note on this page with the platform model and EOS version.
+
+If you want to uninstall this package, please refer to the uninstalling_ section.
+
+Installation from the Official SaltStack Repository
+===================================================
+
+Download the swix package and save it to flash.
+
+.. code-block:: bash
+
+   veos#copy https://salt-eos.netops.life/salt-eos-latest.swix flash:
+   veos#copy https://salt-eos.netops.life/startup.sh flash:
+
+Install the Extension
+=====================
+
+Copy the Salt package to extension
+
+.. code-block:: bash
+
+   veos#copy flash:salt-eos-latest.swix extension:
+
+Install the SWIX
+
+.. code-block:: bash
+
+   veos#extension salt-eos-latest.swix force
+
+Verify the installation
+
+.. code-block:: bash
+
+    veos#show extensions | include salt-eos      
+         salt-eos-2017-07-19.swix      1.0.11/1.fc25        A, F                27   
+
+Change the Salt master IP address or FQDN, by edit the variable (SALT_MASTER)
+
+.. code-block:: bash
+
+    veos#bash vi /mnt/flash/startup.sh
+
+Make sure you enable the eAPI with unix-socket 
+
+.. code-block:: bash
+
+    veos(config)#management api http-commands
+             protocol unix-socket
+             no shutdown
+
+Post-installation tasks
+=======================
+
+Generate Keys and host record and start Salt minion
+
+.. code-block:: bash
+
+   veos#bash 
+   #sudo /mnt/flash/startup.sh
+
+``salt-minion`` should be running
+
+Copy the installed extensions to boot-extensions
+
+.. code-block:: bash
+
+   veos#copy installed-extensions boot-extensions 
+
+Apply event-handler to let EOS start salt-minion during boot-up 
+
+.. code-block:: bash
+
+   veos(config)#event-handler boot-up-script       
+      trigger on-boot                 
+      action bash sudo /mnt/flash/startup.sh
+
+For more specific installation details of the ``salt-minion``, please refer to :ref:`Configuring Salt<configuring-salt>`.
+
+.. _uninstalling:
+
+Uninstalling
+============
+
+If you decide to uninstall this package, the following steps are recommended for safety:
+
+1. Remove the extension from boot-extensions
+
+.. code-block:: bash
+
+   veos#bash rm /mnt/flash/boot-extensions
+
+2. Remove the extension from extensions folder
+
+.. code-block:: bash
+
+   veos#bash rm /mnt/flash/.extensions/salt-eos-latest.swix
+
+2. Remove boot-up script
+
+.. code-block:: bash
+
+   veos(config)#no event-handler boot-up-script
+
+Additional Information
+======================
+
+This SWIX extension contains the following RPM packages:
+
+.. code-block:: text
+
+    libsodium-1.0.11-1.fc25.i686.rpm
+    libstdc++-6.2.1-2.fc25.i686.rpm
+    openpgm-5.2.122-6.fc24.i686.rpm
+    python-Jinja2-2.8-0.i686.rpm
+    python-PyYAML-3.12-0.i686.rpm
+    python-babel-0.9.6-5.fc18.noarch.rpm
+    python-backports-1.0-3.fc18.i686.rpm
+    python-backports-ssl_match_hostname-3.4.0.2-1.fc18.noarch.rpm
+    python-backports_abc-0.5-0.i686.rpm
+    python-certifi-2016.9.26-0.i686.rpm
+    python-chardet-2.0.1-5.fc18.noarch.rpm
+    python-crypto-1.4.1-1.noarch.rpm
+    python-crypto-2.6.1-1.fc18.i686.rpm
+    python-futures-3.1.1-1.noarch.rpm
+    python-jtextfsm-0.3.1-0.noarch.rpm
+    python-kitchen-1.1.1-2.fc18.noarch.rpm
+    python-markupsafe-0.18-1.fc18.i686.rpm
+    python-msgpack-python-0.4.8-0.i686.rpm
+    python-napalm-base-0.24.3-1.noarch.rpm
+    python-napalm-eos-0.6.0-1.noarch.rpm
+    python-netaddr-0.7.18-0.noarch.rpm
+    python-pyeapi-0.7.0-0.noarch.rpm
+    python-salt-2017.7.0_1414_g2fb986f-1.noarch.rpm
+    python-singledispatch-3.4.0.3-0.i686.rpm
+    python-six-1.10.0-0.i686.rpm
+    python-tornado-4.4.2-0.i686.rpm
+    python-urllib3-1.5-7.fc18.noarch.rpm
+    python2-zmq-15.3.0-2.fc25.i686.rpm
+    zeromq-4.1.4-5.fc25.i686.rpm
--- a/doc/topics/installation/index.rst
+++ b/doc/topics/installation/index.rst
@ -46,6 +46,7 @@ These guides go into detail how to install Salt on a given platform.

    arch
    debian
+    eos
    fedora
    freebsd
    gentoo
--- a/doc/topics/jinja/index.rst
+++ b/doc/topics/jinja/index.rst
@ -335,7 +335,7 @@ Returns:

 .. versionadded:: 2017.7.0

-Wraps a text around quoutes.
+This text will be wrapped in quotes.


 .. jinja_ref:: regex_search
@ -750,19 +750,43 @@ Returns:

 Check a whitelist and/or blacklist to see if the value matches it.

-Example:
+This filter can be used with either a whitelist or a blacklist individually,
+or a whitelist and a blacklist can be passed simultaneously.
+
+If whitelist is used alone, value membership is checked against the
+whitelist only. If the value is found, the function returns ``True``.
+Otherwise, it returns ``False``.
+
+If blacklist is used alone, value membership is checked against the
+blacklist only. If the value is found, the function returns ``False``.
+Otherwise, it returns ``True``.
+
+If both a whitelist and a blacklist are provided, value membership in the
+blacklist will be examined first. If the value is not found in the blacklist,
+then the whitelist is checked. If the value isn't found in the whitelist,
+the function returns ``False``.
+
+Whitelist Example:

 .. code-block:: jinja

-  {{ 5 | check_whitelist_blacklist(whitelist=[5, 6, 7]) }}
-  {{ 5 | check_whitelist_blacklist(blacklist=[5, 6, 7]) }}
+    {{ 5 | check_whitelist_blacklist(whitelist=[5, 6, 7]) }}

 Returns:

 .. code-block:: python

-  True
+    True

+Blacklist Example:
+
+.. code-block:: jinja
+
+    {{ 5 | check_whitelist_blacklist(blacklist=[5, 6, 7]) }}
+
+.. code-block:: python
+
+    False

 .. jinja_ref:: date_format

@ -825,6 +849,13 @@ Example:

  {{ 'wall of text' | to_bytes }}

+.. note::
+
+    This option may have adverse effects when using the default renderer, ``yaml_jinja``.
+    This is due to the fact that YAML requires proper handling in regard to special
+    characters. Please see the section on :ref:`YAML ASCII support <yaml_plain_ascii>`
+    in the :ref:`YAML Idiosyncracies <yaml-idiosyncrasies>` documentation for more
+    information.

 .. jinja_ref:: json_decode_list

@ -876,16 +907,22 @@ Returns:
 ------------

 .. versionadded:: 2017.7.0
+.. versionadded:: Oxygen
+    Renamed from ``rand_str`` to ``random_hash`` to more accurately describe
+    what the filter does.

-Generate a random string and applies a hash. Default hashing: md5.
+Generates a random number between 1 and the number passed to the filter, and
+then hashes it. The default hash type is the one specified by the minion's
+:conf_minion:`hash_type` config option, but an alternate hash type can be
+passed to the filter as an argument.

 Example:

 .. code-block:: jinja

-  {% set passwd_length = 17 %}
-  {{ passwd_length | rand_str }}
-  {{ passwd_length | rand_str('sha512') }}
+  {% set num_range = 99999999 %}
+  {{ num_range | rand_str }}
+  {{ num_range | rand_str('sha512') }}

 Returns:

@ -1186,7 +1223,7 @@ Example:

 .. code-block:: jinja

-  {{ ['192.168.0.1', 'foo', 'bar', 'fe80::'] | ipv4 }}
+  {{ ['192.168.0.1', 'foo', 'bar', 'fe80::'] | ipv6 }}

 Returns:

@ -1202,7 +1239,12 @@ Returns:

 .. versionadded:: 2017.7.0

-Return the list of hosts within a networks.
+Return the list of hosts within a networks. This utility works for both IPv4 and IPv6.
+
+.. note::
+
+    When running this command with a large IPv6 network, the command will
+    take a long time to gather all of the hosts.

 Example:

@ -1224,7 +1266,7 @@ Returns:

 .. versionadded:: 2017.7.0

-Return the size of the network.
+Return the size of the network. This utility works for both IPv4 and IPv6.

 Example:

@ -1284,6 +1326,13 @@ Example:

  {{ '00:11:22:33:44:55' | mac_str_to_bytes }}

+.. note::
+
+    This option may have adverse effects when using the default renderer, ``yaml_jinja``.
+    This is due to the fact that YAML requires proper handling in regard to special
+    characters. Please see the section on :ref:`YAML ASCII support <yaml_plain_ascii>`
+    in the :ref:`YAML Idiosyncracies <yaml-idiosyncrasies>` documentation for more
+    information.

 .. jinja_ref:: dns_check

--- a/doc/topics/releases/2016.11.7.rst
+++ b/doc/topics/releases/2016.11.7.rst
@ -0,0 +1,15 @@
+============================
+Salt 2016.11.7 Release Notes
+============================
+
+Version 2016.11.7 is a bugfix release for :ref:`2016.11.0 <release-2016-11-0>`.
+
+Changes for v2016.11.6..v2016.11.7
+----------------------------------
+
+Security Fix
+============
+
+CVE-2017-12791 Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master
+
+Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com
--- a/doc/topics/releases/2016.3.7.rst
+++ b/doc/topics/releases/2016.3.7.rst
@ -4,23 +4,12 @@ Salt 2016.3.7 Release Notes

 Version 2016.3.7 is a bugfix release for :ref:`2016.3.0 <release-2016-3-0>`.

-New master configuration option `allow_minion_key_revoke`, defaults to True.  This option
-controls whether a minion can request that the master revoke its key.  When True, a minion
-can request a key revocation and the master will comply.  If it is False, the key will not
-be revoked by the msater.
+Changes for v2016.3.6..v2016.3.7
+--------------------------------

-New master configuration option `require_minion_sign_messages`
-This requires that minions cryptographically sign the messages they
-publish to the master.  If minions are not signing, then log this information
-at loglevel 'INFO' and drop the message without acting on it.
+Security Fix
+============

-New master configuration option `drop_messages_signature_fail`
-Drop messages from minions when their signatures do not validate.
-Note that when this option is False but `require_minion_sign_messages` is True
-minions MUST sign their messages but the validity of their signatures
-is ignored.
+CVE-2017-12791 Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master

-New minion configuration option `minion_sign_messages`
-Causes the minion to cryptographically sign the payload of messages it places
-on the event bus for the master.  The payloads are signed with the minion's
-private key so the master can verify the signature with its public key.
+Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com
--- a/doc/topics/releases/2016.3.8.rst
+++ b/doc/topics/releases/2016.3.8.rst
@ -0,0 +1,29 @@
+===========================
+Salt 2016.3.8 Release Notes
+===========================
+
+Version 2016.3.8 is a bugfix release for :ref:`2016.3.0 <release-2016-3-0>`.
+
+Changes for v2016.3.7..v2016.3.8
+--------------------------------
+
+New master configuration option `allow_minion_key_revoke`, defaults to True.  This option
+controls whether a minion can request that the master revoke its key.  When True, a minion
+can request a key revocation and the master will comply.  If it is False, the key will not
+be revoked by the msater.
+
+New master configuration option `require_minion_sign_messages`
+This requires that minions cryptographically sign the messages they
+publish to the master.  If minions are not signing, then log this information
+at loglevel 'INFO' and drop the message without acting on it.
+
+New master configuration option `drop_messages_signature_fail`
+Drop messages from minions when their signatures do not validate.
+Note that when this option is False but `require_minion_sign_messages` is True
+minions MUST sign their messages but the validity of their signatures
+is ignored.
+
+New minion configuration option `minion_sign_messages`
+Causes the minion to cryptographically sign the payload of messages it places
+on the event bus for the master.  The payloads are signed with the minion's
+private key so the master can verify the signature with its public key.
--- a/doc/topics/releases/2017.7.0.rst
+++ b/doc/topics/releases/2017.7.0.rst
@ -28,12 +28,21 @@ The following salt-cloud drivers have known issues running with Python 3. These

 - Joyent

- Any driver that relies on the `apache-libcloud` library such as cloudstack, dimenstiondata, gce, nova, and openstack
-
 - When running under Python 3, users who require Unicode support should ensure that a locale is set on their machines.
  Users using the `C` locale are advised to switch to a UTF-aware locale to ensure proper functionality with Salt with Python 3.


+Remember to update the Salt Master first
+========================================
+Salt's policy has always been that when upgrading, the minion should never be
+on a newer version than the master.  Specifically with this update, because of
+changes in the fileclient, the 2017.7 minion requires a 2017.7 master.
+
+Backwards compatiblity is still maintained, so older minions can still be used.
+
+More information can be found in the :ref:`Salt FAQ<which-version>`
+
+
 States Added for Management of systemd Unit Masking
 ===================================================

@ -113,13 +122,12 @@ State Module Changes
      # After
      run_something:
        module.run:
-          mymodule.something:
+          - mymodule.something:
            - name: some name
            - first_arg: one
            - second_arg: two
            - do_stuff: True

-
  Since a lot of users are already using :py:func:`module.run
  <salt.states.module.run>` states, this new behavior must currently be
  explicitly turned on, to allow users to take their time updating their SLS
@ -127,6 +135,36 @@ State Module Changes
  the next feature release of Salt (Oxygen) and the old usage will no longer be
  supported at that time.

+  Another feature of the new :py:func:`module.run <salt.states.module.run>` is that
+  it allows calling many functions in a single batch, such as:
+
+  .. code-block:: yaml
+
+      run_something:
+        module.run:
+          - mymodule.function_without_parameters:
+          - mymodule.another_function:
+            - myparam
+            - my_other_param
+
+  In a rare case that you have a function that needs to be called several times but
+  with the different parameters, an additional feature of "tagging" is to the
+  rescue. In order to tag a function, use a colon delimeter. For example:
+
+  .. code-block:: yaml
+
+      run_something:
+        module.run:
+          - mymodule.same_function:1:
+          - mymodule.same_function:2:
+            - myparam
+            - my_other_param
+          - mymodule.same_function:3:
+            - foo: bar
+
+  The example above will run `mymodule.same_function` three times with the
+  different parameters.
+
  To enable the new behavior for :py:func:`module.run <salt.states.module.run>`,
  add the following to the minion config file:

@ -134,6 +172,7 @@ State Module Changes

      use_superseded:
        - module.run
+
 - The default for the ``fingerprint_hash_type`` option used in the ``present``
  function in the :mod:`ssh <salt.states.ssh_know_hosts>` state changed from
  ``md5`` to ``sha256``.
@ -573,6 +612,38 @@ Using the new ``roster_order`` configuration syntax it's now possible to compose
 of grains, pillar and mine data and even Salt SDB URLs.
 The new release is also fully IPv4 and IPv6 enabled and even has support for CIDR ranges.

+Salt-SSH Default Options
+========================
+
+Defaults for rosters can now be set, so that they don't have to be set on every
+entry in a roster or specified from the commandline.
+
+The new option is :ref:`roster_defaults<roster-defaults>` and is specified in
+the master config file.
+
+.. code-block:: yaml
+
+    roster_defaults:
+      user: daniel
+      sudo: True
+      priv: /root/.ssh/id_rsa
+      tty: True
+
+Blacklist or Whitelist Extmod Sync
+==================================
+
+The modules that are synced to minions can now be limited.
+
+The following configuration options have been added for the master:
+
+- :conf_master:`extmod_whitelist`
+- :conf_master:`extmod_blacklist`
+
+and for the minion:
+
+- :conf_minion:`extmod_whitelist`
+- :conf_minion:`extmod_blacklist`
+
 Additional Features
 ===================

@ -635,6 +706,7 @@ Execution modules
 - :mod:`salt.modules.grafana4 <salt.modules.grafana4>`
 - :mod:`salt.modules.heat <salt.modules.heat>`
 - :mod:`salt.modules.icinga2 <salt.modules.icinga2>`
+- :mod:`salt.modules.kubernetes <salt.modules.kubernetes>`
 - :mod:`salt.modules.logmod <salt.modules.logmod>`
 - :mod:`salt.modules.mattermost <salt.modules.mattermost>`
 - :mod:`salt.modules.namecheap_dns <salt.modules.namecheap_dns>`
@ -713,6 +785,7 @@ States
 - :mod:`salt.states.icinga2 <salt.states.icinga2>`
 - :mod:`salt.states.influxdb_continuous_query <salt.states.influxdb_continuous_query>`
 - :mod:`salt.states.influxdb_retention_policy <salt.states.influxdb_retention_policy>`
+- :mod:`salt.states.kubernetes <salt.states.kubernetes>`
 - :mod:`salt.states.logadm <salt.states.logadm>`
 - :mod:`salt.states.logrotate <salt.states.logrotate>`
 - :mod:`salt.states.msteams <salt.states.msteams>`
@ -902,3 +975,13 @@ The ``glusterfs`` state had the following function removed:
 The ``openvswitch_port`` state had the following change:

 - The ``type`` option was removed from the ``present`` function. Please use ``tunnel_type`` instead.
+
+Build Notes
+===========
+
+Windows Installer Packages
+--------------------------
+
+Windows Installer packages have been patched with the following PR: 42347_
+
+.. _42347: https://github.com/saltstack/salt/pull/42347
--- a/doc/topics/releases/2017.7.1.rst
+++ b/doc/topics/releases/2017.7.1.rst
@ -0,0 +1,190 @@
+============================
+Salt 2017.7.1 Release Notes
+============================
+
+Version 2017.7.1 is a bugfix release for :ref:`2017.7.0 <release-2017-7-0>`.
+
+Security Fix
+============
+
+CVE-2017-12791 Maliciously crafted minion IDs can cause unwanted directory traversals on the Salt-master
+
+Correct a flaw in minion id validation which could allow certain minions to authenticate to a master despite not having the correct credentials. To exploit the vulnerability, an attacker must create a salt-minion with an ID containing characters that will cause a directory traversal. Credit for discovering the security flaw goes to: Vernhk@qq.com
+
+Changes for v2017.7.0..v2017.7.1
+--------------------------------
+
+Extended changelog courtesy of Todd Stansell (https://github.com/tjstansell/salt-changelogs):
+
+*Generated at: 2017-07-26T01:09:40Z*
+
+Statistics:
+
+- Total Merges: **11**
+- Total Issue references: **9**
+- Total PR references: **22**
+
+Changes:
+
+
+- **PR** `#42548`_: (*gtmanfred*) pass in empty kwarg for reactor
+  @ *2017-07-26T00:41:20Z*
+
+  - **ISSUE** `#460`_: (*whiteinge*) Add a topic and a ref for modules/states/returners/renderers/runners
+    | refs: `#42548`_
+  * 711b742c54 Merge pull request `#42548`_ from gtmanfred/2017.7.1
+  * 0257c1dc32 pass in empty kwarg for reactor
+
+  * b948e980d2 update chunk, not kwarg in chunk
+
+- **PR** `#42522`_: (*gtmanfred*) pacman wildcard is only for repository installs
+  @ *2017-07-24T20:51:05Z*
+
+  - **ISSUE** `#42519`_: (*xuhcc*) Error when installing package from file under Arch Linux
+    | refs: `#42522`_
+  * 50c1635dcc Merge pull request `#42522`_ from gtmanfred/2017.7.1
+  * 7787fb9e1b pacman wildcard is only for repository installs
+
+- **PR** `#42508`_: (*rallytime*) Back-port `#42474`_ to 2017.7.1
+  @ *2017-07-24T20:49:51Z*
+
+  - **PR** `#42474`_: (*whiteinge*) Cmd arg kwarg parsing test
+    | refs: `#42508`_
+  - **PR** `#39646`_: (*terminalmage*) Handle deprecation of passing string args to load_args_and_kwargs
+    | refs: `#42474`_
+  * 05c07ac049 Merge pull request `#42508`_ from rallytime/`bp-42474`_
+  * 76fb074433 Add a test.arg variant that cleans the pub kwargs by default
+
+  * 624f63648e Lint fixes
+
+  * d246a5fc61 Add back support for string kwargs
+
+  * 854e098aa0 Add LocalClient.cmd test for arg/kwarg parsing
+
+- **PR** `#42472`_: (*rallytime*) Back-port `#42435`_ to 2017.7.1
+  @ *2017-07-24T15:11:13Z*
+
+  - **ISSUE** `#42427`_: (*grichmond-salt*) Issue Passing Variables created from load_json as Inline Pillar Between States
+    | refs: `#42435`_
+  - **PR** `#42435`_: (*terminalmage*) Modify our custom YAML loader to treat unicode literals as unicode strings
+    | refs: `#42472`_
+  * 95fe2558e4 Merge pull request `#42472`_ from rallytime/`bp-42435`_
+  * 5c47af5b98 Modify our custom YAML loader to treat unicode literals as unicode strings
+
+- **PR** `#42473`_: (*rallytime*) Back-port `#42436`_ to 2017.7.1
+  @ *2017-07-24T15:10:29Z*
+
+  - **ISSUE** `#42374`_: (*tyhunt99*) [2017.7.0] salt-run mange.versions throws exception if minion is offline or unresponsive
+    | refs: `#42436`_
+  - **PR** `#42436`_: (*garethgreenaway*) Fixes to versions function in manage runner
+    | refs: `#42473`_
+  * 5b99d45f54 Merge pull request `#42473`_ from rallytime/`bp-42436`_
+  * 82ed919803 Updating the versions function inside the manage runner to account for when a minion is offline and we are unable to determine it's version.
+
+- **PR** `#42471`_: (*rallytime*) Back-port `#42399`_ to 2017.7.1
+  @ *2017-07-24T15:09:50Z*
+
+  - **ISSUE** `#42381`_: (*zebooka*) Git.detached broken in 2017.7.0
+    | refs: `#42399`_
+  - **ISSUE** `#38878`_: (*tomlaredo*) [Naming consistency] git.latest "rev" option VS git.detached "ref" option
+    | refs: `#38898`_
+  - **PR** `#42399`_: (*rallytime*) Update old "ref" references to "rev" in git.detached state
+    | refs: `#42471`_
+  - **PR** `#38898`_: (*terminalmage*) git.detached: rename ref to rev for consistency
+    | refs: `#42399`_
+  * 3d1a2d3f9f Merge pull request `#42471`_ from rallytime/`bp-42399`_
+  * b9a4669e5a Update old "ref" references to "rev" in git.detached state
+
+- **PR** `#42470`_: (*rallytime*) Back-port `#42031`_ to 2017.7.1
+  @ *2017-07-24T15:09:30Z*
+
+  - **ISSUE** `#42400`_: (*Enquier*) Conflict in execution of passing pillar data to orch/reactor event executions 2017.7.0
+    | refs: `#42031`_
+  - **PR** `#42031`_: (*skizunov*) Fix: Reactor emits critical error
+    | refs: `#42470`_
+  * 09766bccbc Merge pull request `#42470`_ from rallytime/`bp-42031`_
+  * 0a0c6287a4 Fix: Reactor emits critical error
+
+- **PR** `#42469`_: (*rallytime*) Back-port `#42027`_ to 2017.7.1
+  @ *2017-07-21T22:41:02Z*
+
+  - **ISSUE** `#41949`_: (*jrporcaro*) Event returner doesn't work with Windows Master
+    | refs: `#42027`_
+  - **PR** `#42027`_: (*gtmanfred*) import salt.minion for EventReturn for Windows
+    | refs: `#42469`_
+  * d7b172a15b Merge pull request `#42469`_ from rallytime/`bp-42027`_
+  * ed612b4ee7 import salt.minion for EventReturn for Windows
+
+- **PR** `#42466`_: (*rallytime*) Back-port `#42452`_ to 2017.7.1
+  @ *2017-07-21T19:41:24Z*
+
+  - **PR** `#42452`_: (*Ch3LL*) update windows urls to new py2/py3 naming scheme
+    | refs: `#42466`_
+  * 8777b1a825 Merge pull request `#42466`_ from rallytime/`bp-42452`_
+  * c10196f68c update windows urls to new py2/py3 naming scheme
+
+- **PR** `#42439`_: (*rallytime*) Back-port `#42409`_ to 2017.7.1
+  @ *2017-07-21T17:38:10Z*
+
+  - **PR** `#42409`_: (*twangboy*) Add Scripts to build Py3 on Mac
+    | refs: `#42439`_
+  * fceaaf41d0 Merge pull request `#42439`_ from rallytime/`bp-42409`_
+  * 8176964b41 Remove build and dist, sign pkgs
+
+  * 2c14d92a07 Fix hard coded pip path
+
+  * 82fdd7c2e1 Add support for Py3
+
+  * 2478447246 Update Python and other reqs
+
+- **PR** `#42441`_: (*rallytime*) Back-port `#42433`_ to 2017.7.1
+  @ *2017-07-21T17:37:01Z*
+
+  - **ISSUE** `#42403`_: (*astronouth7303*) [2017.7] Pillar empty when state is applied from orchestrate
+    | refs: `#42433`_
+  - **PR** `#42433`_: (*terminalmage*) Only force saltenv/pillarenv to be a string when not None
+    | refs: `#42441`_
+  * 660400560b Merge pull request `#42441`_ from rallytime/`bp-42433`_
+  * 17f347123a Only force saltenv/pillarenv to be a string when not None
+
+
+.. _`#38878`: https://github.com/saltstack/salt/issues/38878
+.. _`#38898`: https://github.com/saltstack/salt/pull/38898
+.. _`#39646`: https://github.com/saltstack/salt/pull/39646
+.. _`#41949`: https://github.com/saltstack/salt/issues/41949
+.. _`#42027`: https://github.com/saltstack/salt/pull/42027
+.. _`#42031`: https://github.com/saltstack/salt/pull/42031
+.. _`#42374`: https://github.com/saltstack/salt/issues/42374
+.. _`#42381`: https://github.com/saltstack/salt/issues/42381
+.. _`#42399`: https://github.com/saltstack/salt/pull/42399
+.. _`#42400`: https://github.com/saltstack/salt/issues/42400
+.. _`#42403`: https://github.com/saltstack/salt/issues/42403
+.. _`#42409`: https://github.com/saltstack/salt/pull/42409
+.. _`#42427`: https://github.com/saltstack/salt/issues/42427
+.. _`#42433`: https://github.com/saltstack/salt/pull/42433
+.. _`#42435`: https://github.com/saltstack/salt/pull/42435
+.. _`#42436`: https://github.com/saltstack/salt/pull/42436
+.. _`#42439`: https://github.com/saltstack/salt/pull/42439
+.. _`#42441`: https://github.com/saltstack/salt/pull/42441
+.. _`#42452`: https://github.com/saltstack/salt/pull/42452
+.. _`#42466`: https://github.com/saltstack/salt/pull/42466
+.. _`#42469`: https://github.com/saltstack/salt/pull/42469
+.. _`#42470`: https://github.com/saltstack/salt/pull/42470
+.. _`#42471`: https://github.com/saltstack/salt/pull/42471
+.. _`#42472`: https://github.com/saltstack/salt/pull/42472
+.. _`#42473`: https://github.com/saltstack/salt/pull/42473
+.. _`#42474`: https://github.com/saltstack/salt/pull/42474
+.. _`#42508`: https://github.com/saltstack/salt/pull/42508
+.. _`#42519`: https://github.com/saltstack/salt/issues/42519
+.. _`#42522`: https://github.com/saltstack/salt/pull/42522
+.. _`#42548`: https://github.com/saltstack/salt/pull/42548
+.. _`#460`: https://github.com/saltstack/salt/issues/460
+.. _`bp-42027`: https://github.com/saltstack/salt/pull/42027
+.. _`bp-42031`: https://github.com/saltstack/salt/pull/42031
+.. _`bp-42399`: https://github.com/saltstack/salt/pull/42399
+.. _`bp-42409`: https://github.com/saltstack/salt/pull/42409
+.. _`bp-42433`: https://github.com/saltstack/salt/pull/42433
+.. _`bp-42435`: https://github.com/saltstack/salt/pull/42435
+.. _`bp-42436`: https://github.com/saltstack/salt/pull/42436
+.. _`bp-42452`: https://github.com/saltstack/salt/pull/42452
+.. _`bp-42474`: https://github.com/saltstack/salt/pull/42474
--- a/doc/topics/releases/releasecandidate.rst
+++ b/doc/topics/releases/releasecandidate.rst
@ -8,7 +8,7 @@ Installing/Testing a Salt Release Candidate

 It's time for a new feature release of Salt! Follow the instructions below to
 install the latest release candidate of Salt, and try :ref:`all the shiny new
-features <release-2016-11-0>`! Be sure to report any bugs you find on `Github
+features <release-2017-7-0>`! Be sure to report any bugs you find on `Github
 <https://github.com/saltstack/salt/issues/new/>`_.

 Installing Using Packages
@ -32,32 +32,12 @@ Builds for a few platforms are available as part of the RC at https://repo.salts

 Available builds:

- Amazon Linux
- Debian 8
- macOS
- RHEL 7
- SmartOS (see below)
- Ubuntu 16.04
+- Ubuntu16
+- Redhat7
 - Windows

 .. FreeBSD

-SmartOS
-------
-Release candidate builds for SmartOS are available at http://pkg.blackdot.be/extras/salt-2016.11rc/.
-
-On a base64 2015Q4-x86_64 based native zone the package can be installed by the following:
-
-.. code-block:: bash
-
-    pfexec pkg_add -U https://pkg.blackdot.be/extras/salt-2016.11rc/salt-2016.11.0rc2_2015Q4_x86_64.tgz
-
-When using the 2016Q2-tools release on the global zone by the following:
-
-.. code-block:: bash
-
-    pfexec pkg_add -U https://pkg.blackdot.be/extras/salt-2016.11rc/salt-2016.11.0rc2_2016Q2_TOOLS.tgz
-
 Installing Using Bootstrap
 ==========================

@ -67,14 +47,14 @@ You can install a release candidate of Salt using `Salt Bootstrap
 .. code-block:: bash

    curl -o install_salt.sh -L https://bootstrap.saltstack.com
-    sudo sh install_salt.sh -P git v2016.11.0rc2
+    sudo sh install_salt.sh -P git v2017.7.0rc1

 If you want to also install a master using Salt Bootstrap, use the ``-M`` flag:

 .. code-block:: bash

    curl -o install_salt.sh -L https://bootstrap.saltstack.com
-    sudo sh install_salt.sh -P -M git v2016.11.0rc2
+    sudo sh install_salt.sh -P -M git v2017.7.0rc1

 If you want to install only a master and not a minion using Salt Bootstrap, use
 the ``-M`` and ``-N`` flags:
@ -82,13 +62,13 @@ the ``-M`` and ``-N`` flags:
 .. code-block:: bash

    curl -o install_salt.sh -L https://bootstrap.saltstack.com
-    sudo sh install_salt.sh -P -M -N git v2016.11.0rc2
+    sudo sh install_salt.sh -P -M -N git v2017.7.0rc1

 Installing Using PyPI
 =====================

 Installing from the `source archive
-<https://pypi.python.org/packages/7a/87/3b29ac215208bed9559d6c4df24175ddd1d52e62c5c00ae3afb3b7d9144d/salt-2016.11.0rc2.tar.gz>`_ on
+<https://pypi.python.org/packages/5c/cf/13c14f8bcd7b5076b9a8c3580f9582c1c4ea8b0458793ac6744ea66c0baf/salt-2017.7.0rc1.tar.gz>`_ on
 `PyPI <https://pypi.python.org/pypi>`_ is fairly straightforward.

 .. note::
@ -126,4 +106,4 @@ Then install salt using the following command:

 .. code-block:: bash

-    sudo pip install salt==2016.11.0rc2
+    sudo pip install salt==2017.7.0rc1
--- a/doc/topics/ssh/index.rst
+++ b/doc/topics/ssh/index.rst
@ -64,7 +64,8 @@ Deploy ssh key for salt-ssh
 ===========================

 By default, salt-ssh will generate key pairs for ssh, the default path will be
-/etc/salt/pki/master/ssh/salt-ssh.rsa
+``/etc/salt/pki/master/ssh/salt-ssh.rsa``. The key generation happens when you run
+``salt-ssh`` for the first time.

 You can use ssh-copy-id, (the OpenSSH key deployment tool) to deploy keys to your servers.

--- a/doc/topics/ssh/roster.rst
+++ b/doc/topics/ssh/roster.rst
@ -61,6 +61,8 @@ The information which can be stored in a roster ``target`` is the following:
        cmd_umask:   # umask to enforce for the salt-call command. Should be in
                     # octal (so for 0o077 in YAML you would do 0077, or 63)

+.. _roster_defaults:
+
 Target Defaults
 ---------------

@ -71,10 +73,10 @@ not need to be passed with commandline arguments.
 .. code-block:: yaml

    roster_defaults:
-        user: daniel
-        sudo: True
-        priv: /root/.ssh/id_rsa
-        tty: True
+      user: daniel
+      sudo: True
+      priv: /root/.ssh/id_rsa
+      tty: True

 thin_dir
 --------
--- a/doc/topics/troubleshooting/yaml_idiosyncrasies.rst
+++ b/doc/topics/troubleshooting/yaml_idiosyncrasies.rst
@ -28,6 +28,7 @@ hit `Enter`. Also, you can convert tabs to 2 spaces by these commands in Vim:

 Indentation
 ===========
+
 The suggested syntax for YAML files is to use 2 spaces for indentation,
 but YAML will follow whatever indentation system that the individual file
 uses. Indentation of two spaces works very well for SLS files given the
@ -112,8 +113,24 @@ PyYAML will load these values as boolean ``True`` or ``False``. Un-capitalized
 versions will also be loaded as booleans (``true``, ``false``, ``yes``, ``no``,
 ``on``, and ``off``). This can be especially problematic when constructing
 Pillar data. Make sure that your Pillars which need to use the string versions
-of these values are enclosed in quotes.  Pillars will be parsed twice by salt,
-so you'll need to wrap your values in multiple quotes, for example '"false"'.
+of these values are enclosed in quotes. Pillars will be parsed twice by salt,
+so you'll need to wrap your values in multiple quotes, including double quotation
+marks (``" "``) and single quotation marks (``' '``). Note that spaces are included
+in the quotation type examples for clarity.
+
+Multiple quoting examples looks like this:
+
+.. code-block:: yaml
+
+    - '"false"'
+    - "'True'"
+    - "'YES'"
+    - '"No"'
+
+.. note::
+
+    When using multiple quotes in this manner, they must be different. Using ``"" ""``
+    or ``'' ''`` won't work in this case (spaces are included in examples for clarity).

 The '%' Sign
 ============
@ -248,8 +265,10 @@ Alternatively,  they can be defined the "old way",  or with multiple
        - require:
          - user: fred

-YAML support only plain ASCII
-=============================
+.. _yaml_plain_ascii:
+
+YAML supports only plain ASCII
+==============================

 According to YAML specification, only ASCII characters can be used.

--- a/doc/topics/tutorials/gitfs.rst
+++ b/doc/topics/tutorials/gitfs.rst
@ -166,13 +166,15 @@ Ubuntu 14.04 LTS and Debian Wheezy (7.x) also have a compatible version packaged

    # apt-get install python-git

-If your master is running an older version (such as Ubuntu 12.04 LTS or Debian
-Squeeze), then you will need to install GitPython using either pip_ or
-easy_install (it is recommended to use pip). Version 0.3.2.RC1 is now marked as
-the stable release in PyPI, so it should be a simple matter of running ``pip
-install GitPython`` (or ``easy_install GitPython``) as root.
+GitPython_ requires the ``git`` CLI utility to work. If installed from a system
+package, then git should already be installed, but if installed via pip_ then
+it may still be necessary to install git separately. For MacOS users,
+GitPython_ comes bundled in with the Salt installer, but git must still be
+installed for it to work properly. Git can be installed in several ways,
+including by installing XCode_.

-.. _`pip`: http://www.pip-installer.org/
+.. _pip: http://www.pip-installer.org/
+.. _XCode: https://developer.apple.com/xcode/

 .. warning::

--- a/doc/topics/tutorials/http.rst
+++ b/doc/topics/tutorials/http.rst
@ -110,7 +110,7 @@ To pass through a file that contains jinja + yaml templating (the default):
        method='POST',
        data_file='/srv/salt/somefile.jinja',
        data_render=True,
-        template_data={'key1': 'value1', 'key2': 'value2'}
+        template_dict={'key1': 'value1', 'key2': 'value2'}
    )

 To pass through a file that contains mako templating:
@ -123,7 +123,7 @@ To pass through a file that contains mako templating:
        data_file='/srv/salt/somefile.mako',
        data_render=True,
        data_renderer='mako',
-        template_data={'key1': 'value1', 'key2': 'value2'}
+        template_dict={'key1': 'value1', 'key2': 'value2'}
    )

 Because this function uses Salt's own rendering system, any Salt renderer can
@ -140,7 +140,7 @@ However, this can be changed to ``master`` if necessary.
        method='POST',
        data_file='/srv/salt/somefile.jinja',
        data_render=True,
-        template_data={'key1': 'value1', 'key2': 'value2'},
+        template_dict={'key1': 'value1', 'key2': 'value2'},
        opts=__opts__
    )

@ -149,7 +149,7 @@ However, this can be changed to ``master`` if necessary.
        method='POST',
        data_file='/srv/salt/somefile.jinja',
        data_render=True,
-        template_data={'key1': 'value1', 'key2': 'value2'},
+        template_dict={'key1': 'value1', 'key2': 'value2'},
        node='master'
    )

@ -170,11 +170,11 @@ a Python dict.
        header_file='/srv/salt/headers.jinja',
        header_render=True,
        header_renderer='jinja',
-        template_data={'key1': 'value1', 'key2': 'value2'}
+        template_dict={'key1': 'value1', 'key2': 'value2'}
    )

 Because much of the data that would be templated between headers and data may be
-the same, the ``template_data`` is the same for both. Correcting possible
+the same, the ``template_dict`` is the same for both. Correcting possible
 variable name collisions is up to the user.

 Authentication
--- a/doc/topics/tutorials/pillar.rst
+++ b/doc/topics/tutorials/pillar.rst
@ -75,7 +75,7 @@ The default location for the pillar is in /srv/pillar.

 .. note::

-    The pillar location can be configured via the `pillar_roots` option inside
+    The pillar location can be configured via the ``pillar_roots`` option inside
    the master configuration file. It must not be in a subdirectory of the state
    tree or file_roots. If the pillar is under file_roots, any pillar targeting
    can be bypassed by minions.
@ -242,7 +242,7 @@ set in the minion's pillar, then the default of ``httpd`` will be used.
 .. note::

    Under the hood, pillar is just a Python dict, so Python dict methods such
-    as `get` and `items` can be used.
+    as ``get`` and ``items`` can be used.

 Pillar Makes Simple States Grow Easily
 ======================================
@ -303,6 +303,18 @@ Where the vimrc source location can now be changed via pillar:

 Ensuring that the right vimrc is sent out to the correct minions.

+The pillar top file must include a reference to the new sls pillar file:
+
+``/srv/pillar/top.sls``:
+
+.. code-block:: yaml
+
+    base:
+      '*':
+        - pkg
+        - edit.vim
+
+
 Setting Pillar Data on the Command Line
 =======================================

--- a/doc/topics/utils/index.rst
+++ b/doc/topics/utils/index.rst
@ -54,7 +54,7 @@ types like so:

            salt '*' mymodule.observe_the_awesomeness
        '''
-        print __utils__['foo.bar']()
+        return __utils__['foo.bar']()

 Utility modules, like any other kind of Salt extension, support using a
 :ref:`__virtual__ function <modules-virtual-name>` to conditionally load them,
@ -81,11 +81,56 @@ the ``foo`` utility module with a ``__virtual__`` function.
    def bar():
        return 'baz'

+Also you could even write your utility modules in object oriented fashion:
+
+.. code-block:: python
+
+    # -*- coding: utf-8 -*-
+    '''
+    My OOP-style utils module
+    -------------------------
+
+    This module contains common functions for use in my other custom types.
+    '''
+
+    class Foo(object):
+
+        def __init__(self):
+            pass
+
+        def bar(self):
+            return 'baz'
+
+And import them into other custom modules:
+
+.. code-block:: python
+
+    # -*- coding: utf-8 -*-
+    '''
+    My awesome execution module
+    ---------------------------
+    '''
+
+    import mymodule
+
+    def observe_the_awesomeness():
+        '''
+        Prints information from my utility module
+
+        CLI Example:
+
+        .. code-block:: bash
+
+            salt '*' mymodule.observe_the_awesomeness
+        '''
+        foo = mymodule.Foo()
+        return foo.bar()
+
 These are, of course, contrived examples, but they should serve to show some of
 the possibilities opened up by writing utility modules. Keep in mind though
-that States still have access to all of the execution modules, so it is not
+that states still have access to all of the execution modules, so it is not
 necessary to write a utility module to make a function available to both a
-state and an execution module. One good use case for utililty modules is one
+state and an execution module. One good use case for utility modules is one
 where it is necessary to invoke the same function from a custom :ref:`outputter
 <all-salt.output>`/returner, as well as an execution module.

--- a/doc/topics/windows/windows-package-manager.rst
+++ b/doc/topics/windows/windows-package-manager.rst
@ -141,7 +141,7 @@ packages:
 - 2015.8.0 and later minions: https://github.com/saltstack/salt-winrepo-ng
 - Earlier releases: https://github.com/saltstack/salt-winrepo

-By default, these repositories are mirrored to ``/srv/salt/win/repo_ng``
+By default, these repositories are mirrored to ``/srv/salt/win/repo-ng``
 and ``/srv/salt/win/repo``.

 This location can be changed in the master config file by setting the
--- a/pkg/osx/build.sh
+++ b/pkg/osx/build.sh
@ -19,14 +19,16 @@
 #         $1 : <version> : the version of salt to build
 #                          (a git tag, not a branch)
 #                          (defaults to git-repo state)
-#         $2 : <package dir> : the staging area for the package
+#         $2 : <pythin ver> : The version of Python to use in the
+#                             build. Default is 2
+#         $3 : <package dir> : the staging area for the package
 #                              defaults to /tmp/salt_pkg
 #
 #     Example:
-#         The following will build Salt v2015.8.3 and stage all files
-#         in /tmp/custom_pkg:
+#         The following will build Salt v2015.8.3 with Python 2 and
+#         stage all files in /tmp/custom_pkg:
 #
-#         ./build.sh v2015.8.3 /tmp/custom_pkg
+#         ./build.sh v2015.8.3 2 /tmp/custom_pkg
 #
 ############################################################################
 echo -n -e "\033]0;Build: Variables\007"
@ -41,9 +43,15 @@ else
 fi

 if [ "$2" == "" ]; then
+    PYVER=2
+else
+    PYVER=$2
+fi
+
+if [ "$3" == "" ]; then
    PKGDIR=/tmp/salt_pkg
 else
-    PKGDIR=$2
+    PKGDIR=$3
 fi

 ############################################################################
@ -51,6 +59,12 @@ fi
 ############################################################################
 SRCDIR=`git rev-parse --show-toplevel`
 PKGRESOURCES=$SRCDIR/pkg/osx
+if [ "$PYVER" == "2" ]; then
+    PYTHON=/opt/salt/bin/python
+else
+    PYTHON=/opt/salt/bin/python3
+fi
+CPUARCH=`uname -m`

 ############################################################################
 # Make sure this is the Salt Repository
@ -66,16 +80,23 @@ fi
 # Create the Build Environment
 ############################################################################
 echo -n -e "\033]0;Build: Build Environment\007"
-sudo $PKGRESOURCES/build_env.sh
+sudo $PKGRESOURCES/build_env.sh $PYVER

 ############################################################################
 # Install Salt
 ############################################################################
 echo -n -e "\033]0;Build: Install Salt\007"
-sudo /opt/salt/bin/python $SRCDIR/setup.py install
+sudo rm -rf $SRCDIR/build
+sudo rm -rf $SRCDIR/dist
+sudo $PYTHON $SRCDIR/setup.py build -e "$PYTHON -E -s" install

 ############################################################################
 # Build Package
 ############################################################################
 echo -n -e "\033]0;Build: Package Salt\007"
-sudo $PKGRESOURCES/build_pkg.sh $VERSION $PKGDIR
+sudo $PKGRESOURCES/build_pkg.sh $VERSION $PYVER $PKGDIR
+
+############################################################################
+# Sign Package
+############################################################################
+sudo $PKGRESOURCES/build_sig.sh salt-$VERSION-py$PYVER-$CPUARCH.pkg salt-$VERSION-py$PYVER-$CPUARCH-signed.pkg
--- a/pkg/osx/build_env.sh
+++ b/pkg/osx/build_env.sh
@ -6,18 +6,21 @@
 # Authors: CR Oldham, Shane Lee
 # Date: December 2015
 #
-# Description: This script sets up a build environment for salt on macOS.
+# Description: This script sets up a build environment for Salt on macOS.
 #
 # Requirements:
 #     - XCode Command Line Tools (xcode-select --install)
 #
 # Usage:
-#     This script is not passed any parameters
+#     This script can be passed 1 parameter
+#       $1 : <python version> : the version of Python to use for the
+#                               build environment. Default is 2
 #
 #     Example:
-#         The following will set up a build environment for salt on macOS
+#         The following will set up a Python 3 build environment for Salt
+#         on macOS
 #
-#         ./dev_env.sh
+#         ./dev_env.sh 3
 #
 ############################################################################

@ -31,6 +34,15 @@ quit_on_error() {
    exit -1
 }

+############################################################################
+# Check passed parameters, set defaults
+############################################################################
+if [ "$1" == "" ]; then
+    PYVER=2
+else
+    PYVER=$1
+fi
+
 ############################################################################
 # Parameters Required for the script to function properly
 ############################################################################
@ -45,6 +57,15 @@ SHADIR=$SCRIPTDIR/shasums
 PKG_CONFIG_PATH=/opt/salt/lib/pkgconfig
 CFLAGS="-I/opt/salt/include"
 LDFLAGS="-L/opt/salt/lib"
+if [ "$PYVER" == "2" ]; then
+    PYDIR=/opt/salt/lib/python2.7
+    PYTHON=/opt/salt/bin/python
+    PIP=/opt/salt/bin/pip
+else
+    PYDIR=/opt/salt/lib/python3.5
+    PYTHON=/opt/salt/bin/python3
+    PIP=/opt/salt/bin/pip3
+fi

 ############################################################################
 # Determine Which XCode is being used (XCode or XCode Command Line Tools)
@ -121,8 +142,8 @@ BUILDDIR=$SCRIPTDIR/build
 ############################################################################
 echo -n -e "\033]0;Build_Env: pkg-config\007"

-PKGURL="http://pkgconfig.freedesktop.org/releases/pkg-config-0.29.tar.gz"
-PKGDIR="pkg-config-0.29"
+PKGURL="http://pkgconfig.freedesktop.org/releases/pkg-config-0.29.2.tar.gz"
+PKGDIR="pkg-config-0.29.2"

 download $PKGURL

@ -140,8 +161,8 @@ sudo -H $MAKE install
 ############################################################################
 echo -n -e "\033]0;Build_Env: libsodium\007"

-PKGURL="https://download.libsodium.org/libsodium/releases/libsodium-1.0.12.tar.gz"
-PKGDIR="libsodium-1.0.12"
+PKGURL="https://download.libsodium.org/libsodium/releases/libsodium-1.0.13.tar.gz"
+PKGDIR="libsodium-1.0.13"

 download $PKGURL

@ -159,8 +180,8 @@ sudo -H $MAKE install
 ############################################################################
 echo -n -e "\033]0;Build_Env: zeromq\007"

-PKGURL="http://download.zeromq.org/zeromq-4.1.3.tar.gz"
-PKGDIR="zeromq-4.1.3"
+PKGURL="http://download.zeromq.org/zeromq-4.1.4.tar.gz"
+PKGDIR="zeromq-4.1.4"

 download $PKGURL

@ -178,13 +199,13 @@ sudo -H $MAKE install
 ############################################################################
 echo -n -e "\033]0;Build_Env: OpenSSL\007"

-PKGURL="http://openssl.org/source/openssl-1.0.2f.tar.gz"
-PKGDIR="openssl-1.0.2f"
+PKGURL="http://openssl.org/source/openssl-1.0.2l.tar.gz"
+PKGDIR="openssl-1.0.2l"

 download $PKGURL

 echo "################################################################################"
-echo "Building OpenSSL 1.0.2f"
+echo "Building OpenSSL"
 echo "################################################################################"
 cd $PKGDIR
 ./Configure darwin64-x86_64-cc --prefix=/opt/salt --openssldir=/opt/salt/openssl
@ -197,13 +218,18 @@ sudo -H $MAKE install
 ############################################################################
 echo -n -e "\033]0;Build_Env: Python\007"

-PKGURL="https://www.python.org/ftp/python/2.7.12/Python-2.7.12.tar.xz"
-PKGDIR="Python-2.7.12"
+if [ "$PYVER" == "2" ]; then
+    PKGURL="https://www.python.org/ftp/python/2.7.13/Python-2.7.13.tar.xz"
+    PKGDIR="Python-2.7.13"
+else
+    PKGURL="https://www.python.org/ftp/python/3.5.3/Python-3.5.3.tar.xz"
+    PKGDIR="Python-3.5.3"
+fi

 download $PKGURL

 echo "################################################################################"
-echo "Building Python 2.7.12"
+echo "Building Python"
 echo "################################################################################"
 echo "Note there are some test failures"
 cd $PKGDIR
@ -215,7 +241,7 @@ sudo -H $MAKE install
 ############################################################################
 # upgrade pip
 ############################################################################
-sudo -H /opt/salt/bin/pip install --upgrade pip
+sudo -H $PIP install --upgrade pip

 ############################################################################
 # Download and install salt python dependencies
@ -227,23 +253,23 @@ cd $BUILDDIR
 echo "################################################################################"
 echo "Installing Salt Dependencies with pip (normal)"
 echo "################################################################################"
-sudo -H /opt/salt/bin/pip install \
-                          -r $SRCDIR/pkg/osx/req.txt \
-                          --no-cache-dir
+sudo -H $PIP install \
+     -r $SRCDIR/pkg/osx/req.txt \
+     --no-cache-dir

 echo "################################################################################"
 echo "Installing Salt Dependencies with pip (build_ext)"
 echo "################################################################################"
-sudo -H /opt/salt/bin/pip install \
-                          -r $SRCDIR/pkg/osx/req_ext.txt \
-                          --global-option=build_ext \
-                          --global-option="-I/opt/salt/include" \
-                          --no-cache-dir
+sudo -H $PIP install \
+     -r $SRCDIR/pkg/osx/req_ext.txt \
+     --global-option=build_ext \
+     --global-option="-I/opt/salt/include" \
+     --no-cache-dir

 echo "--------------------------------------------------------------------------------"
 echo "Create Symlink to certifi for openssl"
 echo "--------------------------------------------------------------------------------"
-sudo ln -s /opt/salt/lib/python2.7/site-packages/certifi/cacert.pem /opt/salt/openssl/cert.pem
+sudo ln -s $PYDIR/site-packages/certifi/cacert.pem /opt/salt/openssl/cert.pem

 echo -n -e "\033]0;Build_Env: Finished\007"

--- a/pkg/osx/build_pkg.sh
+++ b/pkg/osx/build_pkg.sh
@ -15,13 +15,16 @@
 #     This script can be passed 2 parameters
 #         $1 : <version> : the version name to give the package (overrides
 #              version of the git repo) (Defaults to the git repo version)
-#         $2 : <package dir> : the staging area for the package defaults to
+#         $2 : <python ver> : the version of python that was built (defaults
+#              to 2)
+#         $3 : <package dir> : the staging area for the package defaults to
 #              /tmp/salt_pkg
 #
 #     Example:
-#         The following will build Salt and stage all files in /tmp/salt_pkg:
+#         The following will build Salt version 2017.7.0 with Python 3 and
+#         stage all files in /tmp/salt_pkg:
 #
-#         ./build.sh
+#         ./build.sh 2017.7.0 3
 #
 ############################################################################

@ -45,11 +48,18 @@ else
    VERSION=$1
 fi

-# Get/Set temp directory
+# Get/Set Python Version
 if [ "$2" == "" ]; then
+    PYVER=2
+else
+    PYVER=$2
+fi
+
+# Get/Set temp directory
+if [ "$3" == "" ]; then
    PKGDIR=/tmp/salt_pkg
 else
-    PKGDIR=$2
+    PKGDIR=$3
 fi

 CPUARCH=`uname -m`
@ -114,7 +124,11 @@ sudo rm -rdf $PKGDIR/opt/salt/lib/engines
 sudo rm -rdf $PKGDIR/opt/salt/share/aclocal
 sudo rm -rdf $PKGDIR/opt/salt/share/doc
 sudo rm -rdf $PKGDIR/opt/salt/share/man/man1/pkg-config.1
-sudo rm -rdf $PKGDIR/opt/salt/lib/python2.7/test
+if [ "$PYVER" == "2" ]; then
+    sudo rm -rdf $PKGDIR/opt/salt/lib/python2.7/test
+else
+    sudo rm -rdf $PKGDIR/opt/salt/lib/python3.5/test
+fi

 echo -n -e "\033]0;Build_Pkg: Remove compiled python files\007"
 sudo find $PKGDIR/opt/salt -name '*.pyc' -type f -delete
@ -133,15 +147,30 @@ cp $SRCDIR/conf/master $PKGDIR/etc/salt/master.dist
 ############################################################################
 echo -n -e "\033]0;Build_Pkg: Add Version to .xml\007"

+if [ "$PYVER" == "2" ]; then
+    TITLE="Salt $VERSION"
+    DESC="Salt $VERSION with Python 2"
+else
+    TITLE="Salt $VERSION (Python 3)"
+    DESC="Salt $VERSION with Python 3"
+fi
+
 cd $PKGRESOURCES
 cp distribution.xml.dist distribution.xml
-SEDSTR="s/@VERSION@/$VERSION/"
-echo $SEDSTR
-sed -i '' $SEDSTR distribution.xml
+SEDSTR="s/@TITLE@/$TITLE/g"
+sed -E -i '' "$SEDSTR" distribution.xml

-SEDSTR="s/@CPUARCH@/$CPUARCH/"
-echo $SEDSTR
-sed -i '' $SEDSTR distribution.xml
+SEDSTR="s/@DESC@/$DESC/g"
+sed -E -i '' "$SEDSTR" distribution.xml
+
+SEDSTR="s/@VERSION@/$VERSION/g"
+sed -E -i '' "$SEDSTR" distribution.xml
+
+SEDSTR="s/@PYVER@/$PYVER/g"
+sed -E -i '' "$SEDSTR" distribution.xml
+
+SEDSTR="s/@CPUARCH@/$CPUARCH/g"
+sed -i '' "$SEDSTR" distribution.xml

 ############################################################################
 # Build the Package
@ -152,10 +181,10 @@ pkgbuild --root=$PKGDIR \
         --scripts=pkg-scripts \
         --identifier=com.saltstack.salt \
         --version=$VERSION \
-         --ownership=recommended salt-src-$VERSION-$CPUARCH.pkg
+         --ownership=recommended salt-src-$VERSION-py$PYVER-$CPUARCH.pkg

 productbuild --resources=pkg-resources \
             --distribution=distribution.xml  \
-             --package-path=salt-src-$VERSION-$CPUARCH.pkg \
-             --version=$VERSION salt-$VERSION-$CPUARCH.pkg
+             --package-path=salt-src-$VERSION-py$PYVER-$CPUARCH.pkg \
+             --version=$VERSION salt-$VERSION-py$PYVER-$CPUARCH.pkg

--- a/pkg/osx/distribution.xml.dist
+++ b/pkg/osx/distribution.xml.dist
@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8" standalone="no"?>
 <installer-gui-script minSpecVersion="2">
-    <title>Salt @VERSION@</title>
+    <title>@TITLE@</title>
    <organization>com.saltstack.salt</organization>
    <!-- Define minimum system requirements -->
    <volume-check>
@ -25,7 +25,7 @@
    <!-- List all component packages -->
    <pkg-ref id="com.saltstack.salt"
             version="@VERSION@"
-             auth="root">salt-src-@VERSION@-@CPUARCH@.pkg</pkg-ref>
+             auth="root">salt-src-@VERSION@-py@PYVER@-@CPUARCH@.pkg</pkg-ref>
    <!-- List them again here. They can now be organized
         as a hierarchy if you want. -->
    <choices-outline>
@ -34,8 +34,8 @@
    <!-- Define each choice above -->
    <choice id="com.saltstack.salt"
            visible="false"
-            title="Salt @VERSION@"
-            description="Salt @VERSION@"
+            title="@TITLE@"
+            description="@DESC@"
            start_selected="true">
        <pkg-ref id="com.saltstack.salt" />
    </choice>
--- a/pkg/osx/pkg-scripts/postinstall
+++ b/pkg/osx/pkg-scripts/postinstall
@ -15,91 +15,119 @@
 #     This script is run as a part of the macOS Salt Installation
 #
 ###############################################################################
-echo "Post install started on:" > /tmp/postinstall.txt
-date >> /tmp/postinstall.txt
+
+###############################################################################
+# Define Variables
+###############################################################################
+# Get Minor Version
+OSX_VERSION=$(sw_vers | grep ProductVersion | cut -f 2 -d: | tr -d '[:space:]')
+MINOR=$(echo ${OSX_VERSION} | cut -f 2 -d.)
+# Path Variables
+INSTALL_DIR="/opt/salt"
+BIN_DIR="$INSTALL_DIR/bin"
+CONFIG_DIR="/etc/salt"
+TEMP_DIR="/tmp"
+SBIN_DIR="/usr/local/sbin"
+
+###############################################################################
+# Set up logging and error handling
+###############################################################################
+echo "Post install script started on:" > "$TEMP_DIR/postinstall.txt"
+date "+%Y/%m/%d %H:%m:%S" >> "$TEMP_DIR/postinstall.txt"
 trap 'quit_on_error $LINENO $BASH_COMMAND' ERR

 quit_on_error() {
-    echo "$(basename $0) caught error on line : $1 command was: $2" >> /tmp/postinstall.txt
+    echo "$(basename $0) caught error on line : $1 command was: $2" >> "$TEMP_DIR/postinstall.txt"
    exit -1
 }

 ###############################################################################
 # Check for existing minion config, copy if it doesn't exist
 ###############################################################################
-if [ ! -f /etc/salt/minion ]; then
-    echo "Config copy: Started..." >> /tmp/postinstall.txt
-    cp /etc/salt/minion.dist /etc/salt/minion
-    echo "Config copy: Successful" >> /tmp/postinstall.txt
+if [ ! -f "$CONFIG_DIR/minion" ]; then
+    echo "Config: Copy Started..." >> "$TEMP_DIR/postinstall.txt"
+    cp "$CONFIG_DIR/minion.dist" "$CONFIG_DIR/minion"
+    echo "Config: Copied Successfully" >> "$TEMP_DIR/postinstall.txt"
 fi

 ###############################################################################
 # Create symlink to salt-config.sh
 ###############################################################################
-# echo "Symlink: Creating symlink for salt-config..." >> /tmp/postinstall.txt
-if [ ! -d "/usr/local/sbin" ]; then
-    mkdir /usr/local/sbin
+if [ ! -d "$SBIN_DIR" ]; then
+    echo "Symlink: Creating $SBIN_DIR..." >> "$TEMP_DIR/postinstall.txt"
+    mkdir "$SBIN_DIR"
+    echo "Symlink: Created Successfully" >> "$TEMP_DIR/postinstall.txt"
 fi
-ln -sf /opt/salt/bin/salt-config.sh /usr/local/sbin/salt-config
+echo "Symlink: Creating symlink for salt-config..." >> "$TEMP_DIR/postinstall.txt"
+ln -sf "$BIN_DIR/salt-config.sh" "$SBIN_DIR/salt-config"
+echo "Symlink: Created Successfully" >> "$TEMP_DIR/postinstall.txt"

 ###############################################################################
 # Add salt to paths.d
 ###############################################################################
-# echo "Path: Adding salt to the path..." >> /tmp/postinstall.txt
 if [ ! -d "/etc/paths.d" ]; then
+    echo "Path: Creating paths.d directory..." >> "$TEMP_DIR/postinstall.txt"
    mkdir /etc/paths.d
+    echo "Path: Created Successfully" >> "$TEMP_DIR/postinstall.txt"
 fi
-sh -c 'echo "/opt/salt/bin" > /etc/paths.d/salt'
-sh -c 'echo "/usr/local/sbin" >> /etc/paths.d/salt'
+echo "Path: Adding salt to the path..." >> "$TEMP_DIR/postinstall.txt"
+sh -c "echo \"$BIN_DIR\" > /etc/paths.d/salt"
+sh -c "echo \"$SBIN_DIR\" >> /etc/paths.d/salt"
+echo "Path: Added Successfully" >> "$TEMP_DIR/postinstall.txt"

 ###############################################################################
 # Register Salt as a service
 ###############################################################################
 setup_services_maverick() {
-    echo "Using old (< 10.10) launchctl interface" >> /tmp/postinstall.txt
+    echo "Service: Using old (< 10.10) launchctl interface" >> "$TEMP_DIR/postinstall.txt"
    if /bin/launchctl list "com.saltstack.salt.minion" &> /dev/null; then
-        echo "Stop running service..." >> /tmp/postinstall.txt
+        echo "Service: Stopping salt-minion..." >> "$TEMP_DIR/postinstall.txt"
        launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.minion.plist
+        echo "Service: Stopped Successfully" >> "$TEMP_DIR/postinstall.txt"
    fi;
+    echo "Service: Starting salt-minion..." >> "$TEMP_DIR/postinstall.txt"
    launchctl load -w /Library/LaunchDaemons/com.saltstack.salt.minion.plist || return 1
+    echo "Service: Started Successfully" >> "$TEMP_DIR/postinstall.txt"

-    echo "Service start: Successful" >> /tmp/postinstall.txt
-
-    echo "Service disable: Disabling Master, Syndic, and API" >> /tmp/postinstall.txt
-
+    echo "Service: Disabling Master, Syndic, and API services..." >> "$TEMP_DIR/postinstall.txt"
    launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.api.plist
    launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.master.plist
    launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.syndic.plist
+    echo "Service: Disabled Successfully" >> "$TEMP_DIR/postinstall.txt"

    return 0
 }

 setup_services_yosemite_and_later() {
-    echo "Using new (>= 10.10) launchctl interface" >> /tmp/postinstall.txt
+    echo "Service: Using new (>= 10.10) launchctl interface" >> "$TEMP_DIR/postinstall.txt"
+    echo "Service: Enabling salt-minion..." >> "$TEMP_DIR/postinstall.txt"
    launchctl enable system/com.saltstack.salt.minion
-    echo "Service start: Bootstrapping service..." >> /tmp/postinstall.txt
+    echo "Service: Enabled Successfully" >> "$TEMP_DIR/postinstall.txt"
+
+    echo "Service: Bootstrapping salt-minion..." >> "$TEMP_DIR/postinstall.txt"
    launchctl bootstrap system /Library/LaunchDaemons/com.saltstack.salt.minion.plist
+    echo "Service: Bootstrapped Successfully" >> "$TEMP_DIR/postinstall.txt"

    if /bin/launchctl list "com.saltstack.salt.minion" &> /dev/null; then
-        echo "Service is running" >> /tmp/postinstall.txt
+        echo "Service: Service Running" >> "$TEMP_DIR/postinstall.txt"
    else
-        echo "Service start: Kickstarting service..." >> /tmp/postinstall.txt
+        echo "Service: Kickstarting Service..." >> "$TEMP_DIR/postinstall.txt"
        launchctl kickstart -kp system/com.saltstack.salt.minion
+        echo "Service: Kickstarted Successfully" >> "$TEMP_DIR/postinstall.txt"
    fi

-    echo "Service start: Successful" >> /tmp/postinstall.txt
-
-    echo "Service disable: Disabling Master, Syndic, and API" >> /tmp/postinstall.txt
+    echo "Service: Started Successfully" >> "$TEMP_DIR/postinstall.txt"

+    echo "Service: Disabling Master, Syndic, and API services" >> "$TEMP_DIR/postinstall.txt"
    launchctl disable system/com.saltstack.salt.master
    launchctl disable system/com.saltstack.salt.syndic
    launchctl disable system/com.saltstack.salt.api
+    echo "Service: Disabled Successfully" >> "$TEMP_DIR/postinstall.txt"
+
+    return 0
 }

-OSX_VERSION=$(sw_vers | grep ProductVersion | cut -f 2 -d: | tr -d '[:space:]')
-MINOR=$(echo ${OSX_VERSION} | cut -f 2 -d.)
-
-echo "Service start: Enabling service..." >> /tmp/postinstall.txt
+echo "Service: Configuring..." >> "$TEMP_DIR/postinstall.txt"
 case $MINOR in
        9 )
                setup_services_maverick;
@ -108,7 +136,9 @@ case $MINOR in
                setup_services_yosemite_and_later;
                ;;
 esac
+echo "Service: Configured Successfully" >> "$TEMP_DIR/postinstall.txt"

-echo "Post install completed successfully" >> /tmp/postinstall.txt
+echo "Post install completed successfully on:" >> "$TEMP_DIR/postinstall.txt"
+date "+%Y/%m/%d %H:%m:%S" >> "$TEMP_DIR/postinstall.txt"

 exit 0
--- a/pkg/osx/pkg-scripts/preinstall
+++ b/pkg/osx/pkg-scripts/preinstall
@ -6,7 +6,8 @@
 # Date: December 2015
 #
 # Description: This script stops the salt minion service before attempting to
-#              install Salt on macOS
+#              install Salt on macOS. It also removes the /opt/salt/bin
+#              directory, symlink to salt-config, and salt from paths.d.
 #
 # Requirements:
 #    - None
@ -15,12 +16,29 @@
 #     This script is run as a part of the macOS Salt Installation
 #
 ###############################################################################
-echo "Preinstall started on:" > /tmp/preinstall.txt
-date >> /tmp/preinstall.txt
+
+###############################################################################
+# Define Variables
+###############################################################################
+# Get Minor Version
+OSX_VERSION=$(sw_vers | grep ProductVersion | cut -f 2 -d: | tr -d '[:space:]')
+MINOR=$(echo ${OSX_VERSION} | cut -f 2 -d.)
+# Path Variables
+INSTALL_DIR="/opt/salt"
+BIN_DIR="$INSTALL_DIR/bin"
+CONFIG_DIR="/etc/salt"
+TEMP_DIR="/tmp"
+SBIN_DIR="/usr/local/sbin"
+
+###############################################################################
+# Set up logging and error handling
+###############################################################################
+echo "Preinstall started on:" > "$TEMP_DIR/preinstall.txt"
+date "+%Y/%m/%d %H:%m:%S" >> "$TEMP_DIR/preinstall.txt"
 trap 'quit_on_error $LINENO $BASH_COMMAND' ERR

 quit_on_error() {
-    echo "$(basename $0) caught error on line : $1 command was: $2" >> /tmp/preinstall.txt
+    echo "$(basename $0) caught error on line : $1 command was: $2" >> "$TEMP_DIR/preinstall.txt"
    exit -1
 }

@ -31,24 +49,58 @@ MINOR=$(echo ${OSX_VERSION} | cut -f 2 -d.)
 # Stop the service
 ###############################################################################
 stop_service_maverick() {
-    echo "Using old (< 10.10) launchctl interface" >> /tmp/preinstall.txt
+    echo "Service: Using old (< 10.10) launchctl interface" >> "$TEMP_DIR/preinstall.txt"
    if /bin/launchctl list "com.saltstack.salt.minion" &> /dev/null; then
-        echo "Stop service: Started..." >> /tmp/preinstall.txt
+        echo "Service: Unloading minion..." >> "$TEMP_DIR/preinstall.txt"
        launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.minion.plist
-        echo "Stop service: Successful" >> /tmp/preinstall.txt
+        echo "Service: Unloaded Successfully" >> "$TEMP_DIR/preinstall.txt"
+    fi
+    if /bin/launchctl list "com.saltstack.salt.master" &> /dev/null; then
+        echo "Service: Unloading master..." >> "$TEMP_DIR/preinstall.txt"
+        launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.master.plist
+        echo "Service: Unloaded Successfully" >> "$TEMP_DIR/preinstall.txt"
+    fi
+    if /bin/launchctl list "com.saltstack.salt.syndic" &> /dev/null; then
+        echo "Service: Unloading syndic..." >> "$TEMP_DIR/preinstall.txt"
+        launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.syndic.plist
+        echo "Service: Unloaded Successfully" >> "$TEMP_DIR/preinstall.txt"
+    fi
+    if /bin/launchctl list "com.saltstack.salt.api" &> /dev/null; then
+        echo "Service: Unloading api..." >> "$TEMP_DIR/preinstall.txt"
+        launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.api.plist
+        echo "Service: Unloaded Successfully" >> "$TEMP_DIR/preinstall.txt"
    fi
 }

 stop_service_yosemite_and_later() {
-    echo "Using new (>= 10.10) launchctl interface" >> /tmp/preinstall.txt
+    echo "Service: Using new (>= 10.10) launchctl interface" >> "$TEMP_DIR/preinstall.txt"
    if /bin/launchctl list "com.saltstack.salt.minion" &> /dev/null; then
-        echo "Stop service: Started..." >> /tmp/preinstall.txt
+        echo "Service: Stopping minion..." >> "$TEMP_DIR/preinstall.txt"
        launchctl disable system/com.saltstack.salt.minion
        launchctl bootout system /Library/LaunchDaemons/com.saltstack.salt.minion.plist
-        echo "Stop service: Successful" >> /tmp/preinstall.txt
+        echo "Service: Stopped Successfully" >> "$TEMP_DIR/preinstall.txt"
+    fi
+    if /bin/launchctl list "com.saltstack.salt.master" &> /dev/null; then
+        echo "Service: Stopping master..." >> "$TEMP_DIR/preinstall.txt"
+        launchctl disable system/com.saltstack.salt.master
+        launchctl bootout system /Library/LaunchDaemons/com.saltstack.salt.master.plist
+        echo "Service: Stopped Successfully" >> "$TEMP_DIR/preinstall.txt"
+    fi
+    if /bin/launchctl list "com.saltstack.salt.syndic" &> /dev/null; then
+        echo "Service: Stopping syndic..." >> "$TEMP_DIR/preinstall.txt"
+        launchctl disable system/com.saltstack.salt.syndic
+        launchctl bootout system /Library/LaunchDaemons/com.saltstack.salt.syndic.plist
+        echo "Service: Stopped Successfully" >> "$TEMP_DIR/preinstall.txt"
+    fi
+    if /bin/launchctl list "com.saltstack.salt.api" &> /dev/null; then
+        echo "Service: Stopping api..." >> "$TEMP_DIR/preinstall.txt"
+        launchctl disable system/com.saltstack.salt.api
+        launchctl bootout system /Library/LaunchDaemons/com.saltstack.salt.api.plist
+        echo "Service: Stopped Successfully" >> "$TEMP_DIR/preinstall.txt"
    fi
 }

+echo "Service: Configuring..." >> "$TEMP_DIR/preinstall.txt"
 case $MINOR in
        9 )
                stop_service_maverick;
@ -57,6 +109,36 @@ case $MINOR in
                stop_service_yosemite_and_later;
                ;;
 esac
-echo "Preinstall Completed Successfully" >> /tmp/preinstall.txt
+echo "Service: Configured Successfully" >> "$TEMP_DIR/preinstall.txt"
+
+###############################################################################
+# Remove the Symlink to salt-config.sh
+###############################################################################
+if [ -L "$SBIN_DIR/salt-config" ]; then
+    echo "Cleanup: Removing Symlink $BIN_DIR/salt-config" >> "$TEMP_DIR/preinstall.txt"
+    rm "$SBIN_DIR/salt-config"
+    echo "Cleanup: Removed Successfully" >> "$TEMP_DIR/preinstall.txt"
+fi
+
+###############################################################################
+# Remove the $INSTALL_DIR directory
+###############################################################################
+if [ -d "$INSTALL_DIR" ]; then
+    echo "Cleanup: Removing $INSTALL_DIR" >> "$TEMP_DIR/preinstall.txt"
+    rm -rf "$INSTALL_DIR"
+    echo "Cleanup: Removed Successfully" >> "$TEMP_DIR/preinstall.txt"
+fi
+
+###############################################################################
+# Remove the salt from the paths.d
+###############################################################################
+if [ ! -f "/etc/paths.d/salt" ]; then
+    echo "Path: Removing salt from the path..." >> "$TEMP_DIR/preinstall.txt"
+    rm "/etc/paths.d/salt"
+    echo "Path: Removed Successfully" >> "$TEMP_DIR/preinstall.txt"
+fi
+
+echo "Preinstall Completed Successfully on:" >> "$TEMP_DIR/preinstall.txt"
+date "+%Y/%m/%d %H:%m:%S" >> "$TEMP_DIR/preinstall.txt"

 exit 0
--- a/pkg/osx/req.txt
+++ b/pkg/osx/req.txt
@ -1,34 +1,31 @@
-apache-libcloud==0.20.1
+apache-libcloud==2.1.0
 backports.ssl_match_hostname==3.5.0.1
-backports_abc==0.4
+backports_abc==0.5
 certifi
-cffi==1.5.0
-CherryPy==4.0.0
-click==6.2
-enum34==1.1.2
+cffi==1.10.0
+CherryPy==11.0.0
+click==6.7
+enum34==1.1.6
 gitdb==0.6.4
-GitPython==1.0.1
-idna==2.0
-ioflo==1.5.0
-ipaddress==1.0.16
-Jinja2==2.9.4
-libnacl==1.4.4
+GitPython==2.1.1
+idna==2.5
+ipaddress==1.0.18
+Jinja2==2.9.6
 linode-python==1.1.1
-Mako==1.0.3
-MarkupSafe==0.23
-msgpack-python==0.4.7
-pyasn1==0.1.9
-pycparser==2.14
+Mako==1.0.7
+MarkupSafe==1.0
+msgpack-python==0.4.8
+pyasn1==0.2.3
+pycparser==2.18
 pycrypto==2.6.1
-python-dateutil==2.4.2
-python-gnupg==0.3.8
-PyYAML==3.11
-pyzmq==15.2.0
-raet==0.6.5
-requests==2.9.1
+python-dateutil==2.6.1
+python-gnupg==0.4.1
+PyYAML==3.12
+pyzmq==16.0.2
+requests==2.18.1
 singledispatch==3.4.0.3
 six==1.10.0
 smmap==0.9.0
 timelib==0.2.4
-tornado==4.3
-vultr==0.1.2
+tornado==4.5.1
+vultr==1.0rc1
--- a/pkg/osx/req_ext.txt
+++ b/pkg/osx/req_ext.txt
@ -1,2 +1,2 @@
-cryptography==1.2.2
-pyOpenSSL==0.15.1
+cryptography==2.0
+pyOpenSSL==17.1.0
--- a/pkg/osx/shasums/Python-2.7.12.tar.xz.sha512
+++ b/pkg/osx/shasums/Python-2.7.12.tar.xz.sha512
@ -1 +0,0 @@
-6ddbbce47cc49597433d98ca05c2f62f07ed1070807b645602a8e9e9b996adc6fa66fa20a33cd7d23d4e7e925e25071d7301d288149fbe4e8c5f06d5438dda1f  ./Python-2.7.12.tar.xz
--- a/pkg/osx/shasums/Python-2.7.13.tar.xz.sha512
+++ b/pkg/osx/shasums/Python-2.7.13.tar.xz.sha512
@ -0,0 +1 @@
+f37c9a28ce129d01e63c84d7db627a06402854578f62d17927334ea21ede318e04bbf66e890e3f47c85333e6b19f6e5581fb3f3e27efd24be27017d1b6529c4b  ./Python-2.7.13.tar.xz
--- a/pkg/osx/shasums/Python-3.5.3.tar.xz.sha512
+++ b/pkg/osx/shasums/Python-3.5.3.tar.xz.sha512
@ -0,0 +1 @@
+bbcc20e315c63dbc8901d7e7bfa29d4dbdad9335720757d8d679730319fd1d9fcfdb55cf62d620c9b052134170f162c28d653a8af60923185b8932524d827864  ./Python-3.5.3.tar.xz
--- a/pkg/osx/shasums/libsodium-1.0.12.tar.gz.sha512
+++ b/pkg/osx/shasums/libsodium-1.0.12.tar.gz.sha512
@ -1 +0,0 @@
-1e63960da42bcc90945463ae1f5b1355849881dce5bba6d293391f8d6f0932063a5bfd433a071cb184af90ebeab469acc34710587116922144d61f3d7661901b  ./libsodium-1.0.12.tar.gz
--- a/pkg/osx/shasums/libsodium-1.0.13.tar.gz.sha512
+++ b/pkg/osx/shasums/libsodium-1.0.13.tar.gz.sha512
@ -0,0 +1 @@
+c619b12fdf0b2e59174b6e383a62d5499ebcd720fdbb2c1a41a98a46c285df075202423454b294fefee185432441e943805397d7656f7cd7837de425da623929  ./libsodium-1.0.13.tar.gz
--- a/pkg/osx/shasums/openssl-1.0.2f.tar.gz.sha512
+++ b/pkg/osx/shasums/openssl-1.0.2f.tar.gz.sha512
@ -1 +0,0 @@
-50abf6dc94cafd06e7fd20770808bdc675c88daa369e4f752bd584ab17f72a57357c1ca1eca3c83e6745b5a3c9c73c99dce70adaa904d73f6df4c75bc7138351  ./openssl-1.0.2f.tar.gz
--- a/pkg/osx/shasums/openssl-1.0.2l.tar.gz.sha512
+++ b/pkg/osx/shasums/openssl-1.0.2l.tar.gz.sha512
@ -0,0 +1 @@
+047d964508ad6025c79caabd8965efd2416dc026a56183d0ef4de7a0a6769ce8e0b4608a3f8393d326f6d03b26a2b067e6e0c750f35b20be190e595e8290c0e3  ./openssl-1.0.2l.tar.gz
--- a/pkg/osx/shasums/pkg-config-0.29.2.tar.gz.sha512
+++ b/pkg/osx/shasums/pkg-config-0.29.2.tar.gz.sha512
@ -0,0 +1 @@
+4861ec6428fead416f5cbbbb0bbad10b9152967e481d4b0ff2eb396a9f297f552984c9bb72f6864a37dcd8fca1d9ccceda3ef18d8f121938dbe4fdf2b870fe75  ./pkg-config-0.29.2.tar.gz
--- a/pkg/osx/shasums/pkg-config-0.29.tar.gz.sha512
+++ b/pkg/osx/shasums/pkg-config-0.29.tar.gz.sha512
@ -1 +0,0 @@
-c2857cd67801c0db5d204912453ff6bdc7da3ea61f8b1c6b38983d48dffb958725e7723f909abbc057c7b34a85c27290eec6943808312a75909306076064aa63  ./pkg-config-0.29.tar.gz
--- a/pkg/osx/shasums/zeromq-4.1.3.tar.gz.sha512
+++ b/pkg/osx/shasums/zeromq-4.1.3.tar.gz.sha512
@ -1 +0,0 @@
-2c993d18ea44e1cba890e024176af65b85b842ca4f8a22d319be4ace8388ab8828dd706b065f02754025bf271b1d7aa878c3f6655878248f7826452cb2a6134c  ./zeromq-4.1.3.tar.gz
--- a/pkg/osx/shasums/zeromq-4.1.4.tar.gz.sha512
+++ b/pkg/osx/shasums/zeromq-4.1.4.tar.gz.sha512
@ -0,0 +1 @@
+8a8cf4f52ad78dddfff104bfba0f80bbc12566920906a0fafb9fc340aa92f5577c2923cb2e5346c69835cd2ea1609647a8893c2883cd22c1f0340a720511460c  ./zeromq-4.1.4.tar.gz
--- a/pkg/windows/build.bat
+++ b/pkg/windows/build.bat
@ -110,6 +110,13 @@ if not %errorLevel%==0 (
 )
@echo.

+:: Remove build and dist directories
+@echo %0 :: Remove build and dist directories...
+@echo ---------------------------------------------------------------------
+rd /s /q "%SrcDir%\build"
+rd /s /q "%SrcDir%\dist"
+@echo.
+
 :: Install Current Version of salt
@echo %0 :: Install Current Version of salt...
@echo ---------------------------------------------------------------------
--- a/pkg/windows/build_pkg.bat
+++ b/pkg/windows/build_pkg.bat
@ -67,10 +67,13 @@ If not Exist "%PyDir%\python.exe" (
    exit /b 1
 )

-Set "CurrDir=%cd%"
-Set "BinDir=%cd%\buildenv\bin"
-Set "InsDir=%cd%\installer"
-Set "PreDir=%cd%\prereqs"
+Set "CurDir=%~dp0"
+Set "BldDir=%CurDir%\buildenv"
+Set "BinDir=%CurDir%\buildenv\bin"
+Set "CnfDir=%CurDir%\buildenv\conf"
+Set "InsDir=%CurDir%\installer"
+Set "PreDir=%CurDir%\prereqs"
+for /f "delims=" %%a in ('git rev-parse --show-toplevel') do @set "SrcDir=%%a"

 :: Find the NSIS Installer
 If Exist "C:\Program Files\NSIS\" (
@ -101,6 +104,15 @@ If Exist "%BinDir%\" (
 xcopy /E /Q "%PyDir%" "%BinDir%\"
@echo.

+:: Copy the default master and minion configs to buildenv\conf
+@echo Copying configs to buildenv\conf...
+@echo ----------------------------------------------------------------------
+@echo xcopy /E /Q "%SrcDir%\conf\master" "%CnfDir%\"
+xcopy /Q /Y "%SrcDir%\conf\master" "%CnfDir%\"
+@echo xcopy /E /Q "%SrcDir%\conf\minion" "%CnfDir%\"
+xcopy /Q /Y "%SrcDir%\conf\minion" "%CnfDir%\"
+@echo.
+
@echo Copying VCRedist to Prerequisites
@echo ----------------------------------------------------------------------
 :: Make sure the "prereq" directory exists
@ -127,12 +139,12 @@ If Defined ProgramFiles(x86) (
 :: Remove the fixed path in .exe files
@echo Removing fixed path from .exe files
@echo ----------------------------------------------------------------------
-"%PyDir%\python" "%CurrDir%\portable.py" -f "%BinDir%\Scripts\easy_install.exe"
-"%PyDir%\python" "%CurrDir%\portable.py" -f "%BinDir%\Scripts\easy_install-%PyVerMajor%.%PyVerMinor%.exe"
-"%PyDir%\python" "%CurrDir%\portable.py" -f "%BinDir%\Scripts\pip.exe"
-"%PyDir%\python" "%CurrDir%\portable.py" -f "%BinDir%\Scripts\pip%PyVerMajor%.%PyVerMinor%.exe"
-"%PyDir%\python" "%CurrDir%\portable.py" -f "%BinDir%\Scripts\pip%PyVerMajor%.exe"
-"%PyDir%\python" "%CurrDir%\portable.py" -f "%BinDir%\Scripts\wheel.exe"
+"%PyDir%\python" "%CurDir%\portable.py" -f "%BinDir%\Scripts\easy_install.exe"
+"%PyDir%\python" "%CurDir%\portable.py" -f "%BinDir%\Scripts\easy_install-%PyVerMajor%.%PyVerMinor%.exe"
+"%PyDir%\python" "%CurDir%\portable.py" -f "%BinDir%\Scripts\pip.exe"
+"%PyDir%\python" "%CurDir%\portable.py" -f "%BinDir%\Scripts\pip%PyVerMajor%.%PyVerMinor%.exe"
+"%PyDir%\python" "%CurDir%\portable.py" -f "%BinDir%\Scripts\pip%PyVerMajor%.exe"
+"%PyDir%\python" "%CurDir%\portable.py" -f "%BinDir%\Scripts\wheel.exe"
@echo.

@echo Cleaning up unused files and directories...
@ -534,12 +546,6 @@ If Exist "%BinDir%\Lib\site-packages\salt\states\zpool.py"^
 :: Remove Unneeded Components
 If Exist "%BinDir%\Lib\site-packages\salt\cloud"^
    rd /S /Q "%BinDir%\Lib\site-packages\salt\cloud" 1>nul
-If Exist "%BinDir%\Scripts\salt-key*"^
-    del /Q "%BinDir%\Scripts\salt-key*" 1>nul
-If Exist "%BinDir%\Scripts\salt-master*"^
-    del /Q "%BinDir%\Scripts\salt-master*" 1>nul
-If Exist "%BinDir%\Scripts\salt-run*"^
-    del /Q "%BinDir%\Scripts\salt-run*" 1>nul
 If Exist "%BinDir%\Scripts\salt-unity*"^
    del /Q "%BinDir%\Scripts\salt-unity*" 1>nul

@ -547,6 +553,40 @@ If Exist "%BinDir%\Scripts\salt-unity*"^

@echo Building the installer...
@echo ----------------------------------------------------------------------
+:: Make the Master installer if the nullsoft script exists
+If Exist "%InsDir%\Salt-Setup.nsi"^
+    makensis.exe /DSaltVersion=%Version% /DPythonVersion=%Python% "%InsDir%\Salt-Setup.nsi"
+
+:: Remove files not needed for Salt Minion
+:: salt
+:: salt has to be removed individually (can't wildcard it)
+If Exist "%BinDir%\Scripts\salt"^
+    del /Q "%BinDir%\Scripts\salt" 1>nul
+If Exist "%BinDir%\Scripts\salt.exe"^
+    del /Q "%BinDir%\Scripts\salt.exe" 1>nul
+If Exist "%BldDir%\salt.bat"^
+    del /Q "%BldDir%\salt.bat" 1>nul
+:: salt-key
+If Exist "%BinDir%\Scripts\salt-key*"^
+    del /Q "%BinDir%\Scripts\salt-key*" 1>nul
+If Exist "%BldDir%\salt-key.bat"^
+    del /Q "%BldDir%\salt-key.bat" 1>nul
+:: salt-master
+If Exist "%BinDir%\Scripts\salt-master*"^
+    del /Q "%BinDir%\Scripts\salt-master*" 1>nul
+If Exist "%BldDir%\salt-master.bat"^
+    del /Q "%BldDir%\salt-master.bat" 1>nul
+:: salt-run
+If Exist "%BinDir%\Scripts\salt-run*"^
+    del /Q "%BinDir%\Scripts\salt-run*" 1>nul
+If Exist "%BldDir%\salt-run.bat"^
+    del /Q "%BldDir%\salt-run.bat" 1>nul
+
+:: Remove the master config file
+if Exist "%CnfDir%\master"^
+    del /Q "%CnfDir%\master" 1>nul
+
+:: Make the Salt Minion Installer
 makensis.exe /DSaltVersion=%Version% /DPythonVersion=%Python% "%InsDir%\Salt-Minion-Setup.nsi"
@echo.

--- a/pkg/windows/buildenv/conf/minion
+++ b/pkg/windows/buildenv/conf/minion
@ -1,402 +0,0 @@
-##### Primary configuration settings #####
-##########################################
-
-ipc_mode: tcp
-
-# Per default the minion will automatically include all config files
-# from minion.d/*.conf (minion.d is a directory in the same directory
-# as the main minion config file).
-#default_include: minion.d/*.conf
-
-# Set the location of the salt master server, if the master server cannot be
-# resolved, then the minion will fail to start.
-# test
-#master: salt
-
-# Set the number of seconds to wait before attempting to resolve
-# the master hostname if name resolution fails. Defaults to 30 seconds.
-# Set to zero if the minion should shutdown and not retry.
-# retry_dns: 30
-
-# Set the port used by the master reply and authentication server
-#master_port: 4506
-
-# The user to run salt
-#user: root
-
-# Specify the location of the daemon process ID file
-#pidfile: /var/run/salt-minion.pid
-
-# The root directory prepended to these options: pki_dir, cachedir, log_file,
-# sock_dir, pidfile.
-root_dir: c:\salt
-
-# The directory to store the pki information in
-#pki_dir: /etc/salt/pki/minion
-pki_dir: /conf/pki/minion
-
-# Explicitly declare the id for this minion to use, if left commented the id
-# will be the hostname as returned by the python call: socket.getfqdn()
-# Since salt uses detached ids it is possible to run multiple minions on the
-# same machine but with different ids, this can be useful for salt compute
-# clusters.
-#id:
-
-# Append a domain to a hostname in the event that it does not exist.  This is
-# useful for systems where socket.getfqdn() does not actually result in a
-# FQDN (for instance, Solaris).
-#append_domain:
-
-# Custom static grains for this minion can be specified here and used in SLS
-# files just like all other grains. This example sets 4 custom grains, with
-# the 'roles' grain having two values that can be matched against:
-#grains:
-#  roles:
-#    - webserver
-#    - memcache
-#  deployment: datacenter4
-#  cabinet: 13
-#  cab_u: 14-15
-
-# Where cache data goes
-#cachedir: /var/cache/salt/minion
-
-# Verify and set permissions on configuration directories at startup
-#verify_env: True
-
-# The minion can locally cache the return data from jobs sent to it, this
-# can be a good way to keep track of jobs the minion has executed
-# (on the minion side). By default this feature is disabled, to enable
-# set cache_jobs to True
-#cache_jobs: False
-
-# set the directory used to hold unix sockets
-#sock_dir: /var/run/salt/minion
-
-# Backup files that are replaced by file.managed and file.recurse under
-# 'cachedir'/file_backups relative to their original location and appended
-# with a timestamp. The only valid setting is "minion". Disabled by default.
-#
-# Alternatively this can be specified for each file in state files:
-#
-# /etc/ssh/sshd_config:
-#   file.managed:
-#     - source: salt://ssh/sshd_config
-#       - backup: minion
-#
-#backup_mode: minion
-
-# When waiting for a master to accept the minion's public key, salt will
-# continuously attempt to reconnect until successful. This is the time, in
-# seconds, between those reconnection attempts.
-#acceptance_wait_time: 10
-
-# If this is set, the time between reconnection attempts will increase by
-# acceptance_wait_time seconds per iteration, up to this maximum. If this
-# is not set, the time between reconnection attempts will stay constant.
-#acceptance_wait_time_max: None
-
-# Windows platforms lack posix IPC and must rely on slower TCP based inter-
-# process communications. Set ipc_mode to 'tcp' on such systems
-#ipc_mode: ipc
-#
-# Overwrite the default tcp ports used by the minion when in tcp mode
-#tcp_pub_port: 4510
-#tcp_pull_port: 4511
-
-# The minion can include configuration from other files. To enable this,
-# pass a list of paths to this option. The paths can be either relative or
-# absolute; if relative, they are considered to be relative to the directory
-# the main minion configuration file lives in (this file). Paths can make use
-# of shell-style globbing. If no files are matched by a path passed to this
-# option then the minion will log a warning message.
-#
-#
-# Include a config file from some other path:
-# include: /etc/salt/extra_config
-#
-# Include config from several files and directories:
-# include:
-#  - /etc/salt/extra_config
-#  - /etc/roles/webserver
-
-#####   Minion module management     #####
-##########################################
-# Disable specific modules. This allows the admin to limit the level of
-# access the master has to the minion
-#disable_modules: [cmd,test]
-#disable_returners: []
-#
-# Modules can be loaded from arbitrary paths. This enables the easy deployment
-# of third party modules. Modules for returners and minions can be loaded.
-# Specify a list of extra directories to search for minion modules and
-# returners. These paths must be fully qualified!
-#module_dirs: []
-#returner_dirs: []
-#states_dirs: []
-#render_dirs: []
-#
-# A module provider can be statically overwritten or extended for the minion
-# via the providers option, in this case the default module will be
-# overwritten by the specified module. In this example the pkg module will
-# be provided by the yumpkg5 module instead of the system default.
-#
-# providers:
-#   pkg: yumpkg5
-#
-# Enable Cython modules searching and loading. (Default: False)
-#cython_enable: False
-#
-
-#####    State Management Settings    #####
-###########################################
-# The state management system executes all of the state templates on the minion
-# to enable more granular control of system state management. The type of
-# template and serialization used for state management needs to be configured
-# on the minion, the default renderer is yaml_jinja. This is a yaml file
-# rendered from a jinja template, the available options are:
-# yaml_jinja
-# yaml_mako
-# yaml_wempy
-# json_jinja
-# json_mako
-# json_wempy
-#
-#renderer: yaml_jinja
-#
-# The failhard option tells the minions to stop immediately after the first
-# failure detected in the state execution, defaults to False
-#failhard: False
-#
-# autoload_dynamic_modules Turns on automatic loading of modules found in the
-# environments on the master. This is turned on by default, to turn of
-# autoloading modules when states run set this value to False
-#autoload_dynamic_modules: True
-#
-# clean_dynamic_modules keeps the dynamic modules on the minion in sync with
-# the dynamic modules on the master, this means that if a dynamic module is
-# not on the master it will be deleted from the minion. By default this is
-# enabled and can be disabled by changing this value to False
-#clean_dynamic_modules: True
-#
-# Normally the minion is not isolated to any single environment on the master
-# when running states, but the environment can be isolated on the minion side
-# by statically setting it. Remember that the recommended way to manage
-# environments is to isolate via the top file.
-#environment: None
-#
-# If using the local file directory, then the state top file name needs to be
-# defined, by default this is top.sls.
-#state_top: top.sls
-#
-# Run states when the minion daemon starts. To enable, set startup_states to:
-# 'highstate' -- Execute state.highstate
-# 'sls' -- Read in the sls_list option and execute the named sls files
-# 'top' -- Read top_file option and execute based on that file on the Master
-#startup_states: ''
-#
-# list of states to run when the minion starts up if startup_states is 'sls'
-#sls_list:
-#  - edit.vim
-#  - hyper
-#
-# top file to execute if startup_states is 'top'
-#top_file: ''
-
-#####     File Directory Settings    #####
-##########################################
-# The Salt Minion can redirect all file server operations to a local directory,
-# this allows for the same state tree that is on the master to be used if
-# copied completely onto the minion. This is a literal copy of the settings on
-# the master but used to reference a local directory on the minion.
-
-# Set the file client, the client defaults to looking on the master server for
-# files, but can be directed to look at the local file directory setting
-# defined below by setting it to local.
-#file_client: remote
-
-# The file directory works on environments passed to the minion, each environment
-# can have multiple root directories, the subdirectories in the multiple file
-# roots cannot match, otherwise the downloaded files will not be able to be
-# reliably ensured. A base environment is required to house the top file.
-# Example:
-# file_roots:
-#   base:
-#     - /srv/salt/
-#   dev:
-#     - /srv/salt/dev/services
-#     - /srv/salt/dev/states
-#   prod:
-#     - /srv/salt/prod/services
-#     - /srv/salt/prod/states
-#
-# Default:
-#file_roots:
-#  base:
-#    - /srv/salt
-
-# The hash_type is the hash to use when discovering the hash of a file in
-# the minion directory, the default is md5, but sha1, sha224, sha256, sha384
-# and sha512 are also supported.
-#hash_type: md5
-
-# The Salt pillar is searched for locally if file_client is set to local. If
-# this is the case, and pillar data is defined, then the pillar_roots need to
-# also be configured on the minion:
-#pillar_roots:
-#  base:
-#    - /srv/pillar
-
-######        Security settings       #####
-###########################################
-# Enable "open mode", this mode still maintains encryption, but turns off
-# authentication, this is only intended for highly secure environments or for
-# the situation where your keys end up in a bad state. If you run in open mode
-# you do so at your own risk!
-#open_mode: False
-
-# Enable permissive access to the salt keys.  This allows you to run the
-# master or minion as root, but have a non-root group be given access to
-# your pki_dir.  To make the access explicit, root must belong to the group
-# you've given access to. This is potentially quite insecure.
-#permissive_pki_access: False
-
-# The state_verbose and state_output settings can be used to change the way
-# state system data is printed to the display. By default all data is printed.
-# The state_verbose setting can be set to True or False, when set to False
-# all data that has a result of True and no changes will be suppressed.
-#state_verbose: True
-#
-# The state_output setting changes if the output is the full multi line
-# output for each changed state if set to 'full', but if set to 'terse'
-# the output will be shortened to a single line.
-#state_output: full
-#
-# Fingerprint of the master public key to double verify the master is valid,
-# the master fingerprint can be found by running "salt-key -F master" on the
-# salt master.
-#master_finger: ''
-
-######         Thread settings        #####
-###########################################
-# Disable multiprocessing support, by default when a minion receives a
-# publication a new process is spawned and the command is executed therein.
-# multiprocessing: True
-
-######         Logging settings       #####
-###########################################
-# The location of the minion log file.
-# This can be a path for the log file, or, this can be, since 0.11.0, a system
-# logger address, for example:
-#	tcp://localhost:514/LOG_USER
-#	tcp://localhost/LOG_DAEMON
-#	udp://localhost:5145/LOG_KERN
-#	udp://localhost
-#	file:///dev/log
-#	file:///dev/log/LOG_SYSLOG
-#	file:///dev/log/LOG_DAEMON
-#
-# The above examples are self explanatory, but:
-#	<file|udp|tcp>://<host|socketpath>:<port-if-required>/<log-facility>
-#
-# Make sure you have a properly configured syslog or you won't get any warnings
-#
-#log_file: /var/log/salt/minion
-#
-#
-# The level of messages to send to the console.
-# One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
-# Default: 'warning'
-#log_level: warning
-#
-# The level of messages to send to the log file.
-# One of 'garbage', 'trace', 'debug', info', 'warning', 'error', 'critical'.
-# Default: 'warning'
-#log_level_logfile:
-#
-# The date and time format used in log messages. Allowed date/time formatting
-# can be seen on http://docs.python.org/library/time.html#time.strftime
-#log_datefmt: '%H:%M:%S'
-#log_datefmt_logfile: '%Y-%m-%d %H:%M:%S'
-#
-# The format of the console logging messages. Allowed formatting options can
-# be seen on http://docs.python.org/library/logging.html#logrecord-attributes
-#log_fmt_console: '[%(levelname)-8s] %(message)s'
-#log_fmt_logfile: '%(asctime)s,%(msecs)03d [%(name)-17s][%(levelname)-8s] %(message)s'
-#
-# Logger levels can be used to tweak specific loggers logging levels.
-# For example, if you want to have the salt library at the 'warning' level,
-# but you still wish to have 'salt.modules' at the 'debug' level:
-#   log_granular_levels: {
-#     'salt': 'warning',
-#     'salt.modules': 'debug'
-#   }
-#
-#log_granular_levels: {}
-
-######      Module configuration      #####
-###########################################
-# Salt allows for modules to be passed arbitrary configuration data, any data
-# passed here in valid yaml format will be passed on to the salt minion modules
-# for use. It is STRONGLY recommended that a naming convention be used in which
-# the module name is followed by a . and then the value. Also, all top level
-# data must be applied via the yaml dict construct, some examples:
-#
-# You can specify that all modules should run in test mode:
-#test: True
-#
-# A simple value for the test module:
-#test.foo: foo
-#
-# A list for the test module:
-#test.bar: [baz,quo]
-#
-# A dict for the test module:
-#test.baz: {spam: sausage, cheese: bread}
-
-
-######      Update settings          ######
-###########################################
-# Using the features in Esky, a salt minion can both run as a frozen app and
-# be updated on the fly. These options control how the update process
-# (saltutil.update()) behaves.
-#
-# The url for finding and downloading updates. Disabled by default.
-#update_url: False
-#
-# The list of services to restart after a successful update. Empty by default.
-#update_restart_services: []
-
-
-######      Keepalive settings        ######
-############################################
-# ZeroMQ now includes support for configuring SO_KEEPALIVE if supported by
-# the OS. If connections between the minion and the master pass through
-# a state tracking device such as a firewall or VPN gateway, there is
-# the risk that it could tear down the connection the master and minion
-# without informing either party that their connection has been taken away.
-# Enabling TCP Keepalives prevents this from happening.
-#
-# Overall state of TCP Keepalives, enable (1 or True), disable (0 or False)
-# or leave to the OS defaults (-1), on Linux, typically disabled. Default True, enabled.
-#tcp_keepalive: True
-#
-# How long before the first keepalive should be sent in seconds. Default 300
-# to send the first keepalive after 5 minutes, OS default (-1) is typically 7200 seconds
-# on Linux see /proc/sys/net/ipv4/tcp_keepalive_time.
-#tcp_keepalive_idle: 300
-#
-# How many lost probes are needed to consider the connection lost. Default -1
-# to use OS defaults, typically 9 on Linux, see /proc/sys/net/ipv4/tcp_keepalive_probes.
-#tcp_keepalive_cnt: -1
-#
-# How often, in seconds, to send keepalives after the first one. Default -1 to
-# use OS defaults, typically 75 seconds on Linux, see
-# /proc/sys/net/ipv4/tcp_keepalive_intvl.
-#tcp_keepalive_intvl: -1
-
-
-######      Windows Software settings ######
-############################################
-# Location of the repository cache file on the master
-# win_repo_cachefile: 'salt://win/repo/winrepo.p'
--- a/pkg/windows/buildenv/salt-call.bat
+++ b/pkg/windows/buildenv/salt-call.bat
@ -9,5 +9,4 @@ Set Python=%SaltDir%\bin\python.exe
 Set Script=%SaltDir%\bin\Scripts\salt-call

 :: Launch Script
-"%Python%" "%Script%" %*
-
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/buildenv/salt-cp.bat
+++ b/pkg/windows/buildenv/salt-cp.bat
@ -9,5 +9,4 @@ Set Python=%SaltDir%\bin\python.exe
 Set Script=%SaltDir%\bin\Scripts\salt-cp

 :: Launch Script
-"%Python%" "%Script%" %*
-
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/buildenv/salt-key.bat
+++ b/pkg/windows/buildenv/salt-key.bat
@ -9,5 +9,4 @@ Set Python=%SaltDir%\bin\python.exe
 Set Script=%SaltDir%\bin\Scripts\salt-key

 :: Launch Script
-"%Python%" "%Script%" %*
-
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/buildenv/salt-master.bat
+++ b/pkg/windows/buildenv/salt-master.bat
@ -9,5 +9,4 @@ Set Python=%SaltDir%\bin\python.exe
 Set Script=%SaltDir%\bin\Scripts\salt-master

 :: Launch Script
-"%Python%" "%Script%" %*
-
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/buildenv/salt-minion-debug.bat
+++ b/pkg/windows/buildenv/salt-minion-debug.bat
@ -12,5 +12,4 @@ Set Script=%SaltDir%\bin\Scripts\salt-minion
 net stop salt-minion

 :: Launch Script
-"%Python%" "%Script%" -l debug
-
+"%Python%" -E -s "%Script%" -l debug
--- a/pkg/windows/buildenv/salt-minion.bat
+++ b/pkg/windows/buildenv/salt-minion.bat
@ -9,5 +9,4 @@ Set Python=%SaltDir%\bin\python.exe
 Set Script=%SaltDir%\bin\Scripts\salt-minion

 :: Launch Script
-"%Python%" "%Script%" %*
-
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/buildenv/salt-run.bat
+++ b/pkg/windows/buildenv/salt-run.bat
@ -9,5 +9,4 @@ Set Python=%SaltDir%\bin\python.exe
 Set Script=%SaltDir%\bin\Scripts\salt-run

 :: Launch Script
-"%Python%" "%Script%" %*
-
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/buildenv/salt.bat
+++ b/pkg/windows/buildenv/salt.bat
@ -0,0 +1,12 @@
+@ echo off
+:: Script for starting the Salt CLI
+:: Accepts all parameters that Salt CLI accepts
+
+:: Define Variables
+Set SaltDir=%~dp0
+Set SaltDir=%SaltDir:~0,-1%
+Set Python=%SaltDir%\bin\python.exe
+Set Script=%SaltDir%\bin\Scripts\salt
+
+:: Launch Script
+"%Python%" -E -s "%Script%" %*
--- a/pkg/windows/installer/Salt-Minion-Setup.nsi
+++ b/pkg/windows/installer/Salt-Minion-Setup.nsi
@ -379,13 +379,12 @@ Section -Post
    WriteRegStr HKLM "${PRODUCT_MINION_REGKEY}" "Path" "$INSTDIR\bin\"

    ; Register the Salt-Minion Service
-    nsExec::Exec "nssm.exe install salt-minion $INSTDIR\bin\python.exe $INSTDIR\bin\Scripts\salt-minion -c $INSTDIR\conf -l quiet"
-    nsExec::Exec "nssm.exe set salt-minion AppEnvironmentExtra PYTHONHOME="
+    nsExec::Exec "nssm.exe install salt-minion $INSTDIR\bin\python.exe -E -s $INSTDIR\bin\Scripts\salt-minion -c $INSTDIR\conf -l quiet"
    nsExec::Exec "nssm.exe set salt-minion Description Salt Minion from saltstack.com"
    nsExec::Exec "nssm.exe set salt-minion Start SERVICE_AUTO_START"
    nsExec::Exec "nssm.exe set salt-minion AppNoConsole 1"
-
-    RMDir /R "$INSTDIR\var\cache\salt" ; removing cache from old version
+    nsExec::Exec "nssm.exe set salt-minion AppStopMethodConsole 24000"
+    nsExec::Exec "nssm.exe set salt-minion AppStopMethodWindow 2000"

    Call updateMinionConfig

--- a/salt/cache/init.py
+++ b/salt/cache/init.py
@ -77,6 +77,7 @@ class Cache(object):
        self.serial = Serial(opts)
        self._modules = None
        self._kwargs = kwargs
+        self._kwargs['cachedir'] = self.cachedir

    def __lazy_init(self):
        self._modules = salt.loader.cache(self.opts, self.serial)
@ -223,7 +224,7 @@ class Cache(object):
        fun = '{0}.flush'.format(self.driver)
        return self.modules[fun](bank, key=key, **self._kwargs)

-    def ls(self, bank):
+    def list(self, bank):
        '''
        Lists entries stored in the specified bank.

@ -239,11 +240,9 @@ class Cache(object):
            Raises an exception if cache driver detected an error accessing data
            in the cache backend (auth, permissions, etc).
        '''
-        fun = '{0}.ls'.format(self.driver)
+        fun = '{0}.list'.format(self.driver)
        return self.modules[fun](bank, **self._kwargs)

-    list = ls
-
    def contains(self, bank, key=None):
        '''
        Checks if the specified bank contains the specified key.
--- a/salt/cache/consul.py
+++ b/salt/cache/consul.py
@ -61,7 +61,7 @@ api = None
 # Define the module's virtual name
 __virtualname__ = 'consul'

-__func_alias__ = {'list': 'ls'}
+__func_alias__ = {'list_': 'list'}


 def __virtual__():
@ -139,7 +139,7 @@ def flush(bank, key=None):
        )


-def ls(bank):
+def list_(bank):
    '''
    Return an iterable object containing all entries stored in the specified bank.
    '''
--- a/salt/cache/localfs.py
+++ b/salt/cache/localfs.py
@ -23,7 +23,7 @@ import salt.utils.atomicfile

 log = logging.getLogger(__name__)

-__func_alias__ = {'list': 'ls'}
+__func_alias__ = {'list_': 'list'}


 def __cachedir(kwargs=None):
@ -143,7 +143,7 @@ def flush(bank, key=None, cachedir=None):
    return True


-def ls(bank, cachedir):
+def list_(bank, cachedir):
    '''
    Return an iterable object containing all entries stored in the specified bank.
    '''
--- a/salt/cache/redis_cache.py
+++ b/salt/cache/redis_cache.py
@ -114,9 +114,7 @@ from salt.exceptions import SaltCacheError
 # -----------------------------------------------------------------------------

 __virtualname__ = 'redis'
-__func_alias__ = {
-    'list_': 'list'
-}
+__func_alias__ = {'list_': 'list'}

 log = logging.getLogger(__file__)

@ -145,6 +143,9 @@ def __virtual__():
 # helper functions -- will not be exported
 # -----------------------------------------------------------------------------

+def init_kwargs(kwargs):
+    return {}
+

 def _get_redis_cache_opts():
    '''
--- a/salt/cli/cp.py
+++ b/salt/cli/cp.py
@ -21,7 +21,7 @@ import salt.client
 import salt.utils.gzip_util
 import salt.utils.itertools
 import salt.utils.minions
-from salt.utils import parsers, to_bytes
+from salt.utils import parsers, to_bytes, print_cli
 from salt.utils.verify import verify_log
 import salt.output

@ -101,10 +101,69 @@ class SaltCP(object):
            empty_dirs.update(empty_dirs_)
        return files, sorted(empty_dirs)

+    def _file_dict(self, fn_):
+        '''
+        Take a path and return the contents of the file as a string
+        '''
+        if not os.path.isfile(fn_):
+            err = 'The referenced file, {0} is not available.'.format(fn_)
+            sys.stderr.write(err + '\n')
+            sys.exit(42)
+        with salt.utils.fopen(fn_, 'r') as fp_:
+            data = fp_.read()
+        return {fn_: data}
+
+    def _load_files(self):
+        '''
+        Parse the files indicated in opts['src'] and load them into a python
+        object for transport
+        '''
+        files = {}
+        for fn_ in self.opts['src']:
+            if os.path.isfile(fn_):
+                files.update(self._file_dict(fn_))
+            elif os.path.isdir(fn_):
+                print_cli(fn_ + ' is a directory, only files are supported in non-chunked mode. '
+                                'Use "--chunked" command line argument.')
+                sys.exit(1)
+        return files
+
    def run(self):
        '''
        Make the salt client call
        '''
+        if self.opts['chunked']:
+            ret = self.run_chunked()
+        else:
+            ret = self.run_oldstyle()
+
+        salt.output.display_output(
+                ret,
+                self.opts.get('output', 'nested'),
+                self.opts)
+
+    def run_oldstyle(self):
+        '''
+        Make the salt client call in old-style all-in-one call method
+        '''
+        arg = [self._load_files(), self.opts['dest']]
+        local = salt.client.get_local_client(self.opts['conf_file'])
+        args = [self.opts['tgt'],
+                'cp.recv',
+                arg,
+                self.opts['timeout'],
+                ]
+
+        selected_target_option = self.opts.get('selected_target_option', None)
+        if selected_target_option is not None:
+            args.append(selected_target_option)
+
+        return local.cmd(*args)
+
+    def run_chunked(self):
+        '''
+        Make the salt client call in the new fasion chunked multi-call way
+        '''
        files, empty_dirs = self._list_files()
        dest = self.opts['dest']
        gzip = self.opts['gzip']
@ -166,7 +225,7 @@ class SaltCP(object):
                )
                args = [
                    tgt,
-                    'cp.recv',
+                    'cp.recv_chunked',
                    [remote_path, chunk, append, gzip, mode],
                    timeout,
                ]
@ -212,14 +271,11 @@ class SaltCP(object):
                    else '',
                tgt,
            )
-            args = [tgt, 'cp.recv', [remote_path, None], timeout]
+            args = [tgt, 'cp.recv_chunked', [remote_path, None], timeout]
            if selected_target_option is not None:
                args.append(selected_target_option)

            for minion_id, minion_ret in six.iteritems(local.cmd(*args)):
                ret.setdefault(minion_id, {})[remote_path] = minion_ret

-        salt.output.display_output(
-                ret,
-                self.opts.get('output', 'nested'),
-                self.opts)
+        return ret
--- a/salt/client/init.py
+++ b/salt/client/init.py
@ -544,6 +544,7 @@ class LocalClient(object):
            {'stewart': {...}}
        '''
        if 'expr_form' in kwargs:
+            import salt
            salt.utils.warn_until(
                'Fluorine',
                'The target type should be passed using the \'tgt_type\' '
@ -738,7 +739,7 @@ class LocalClient(object):
                        ret[mid] = (data if full_return
                                else data.get('ret', {}))

-            for failed in list(set(pub_data['minions']) ^ set(ret)):
+            for failed in list(set(pub_data['minions']) - set(ret)):
                ret[failed] = False
            return ret
        finally:
--- a/salt/client/mixins.py
+++ b/salt/client/mixins.py
@ -405,8 +405,6 @@ class SyncClientMixin(object):
                    )
            data['success'] = False

-        namespaced_event.fire_event(data, 'ret')
-
        if self.store_job:
            try:
                salt.utils.job.store_job(
@ -424,6 +422,9 @@ class SyncClientMixin(object):
                log.error('Could not store job cache info. '
                          'Job details for this run may be unavailable.')

+        # Outputters _can_ mutate data so write to the job cache first!
+        namespaced_event.fire_event(data, 'ret')
+
        # if we fired an event, make sure to delete the event object.
        # This will ensure that we call destroy, which will do the 0MQ linger
        log.info('Runner completed: {0}'.format(data['jid']))
--- a/salt/client/ssh/init.py
+++ b/salt/client/ssh/init.py
@ -467,6 +467,8 @@ class SSH(object):
                for default in self.defaults:
                    if default not in self.targets[host]:
                        self.targets[host][default] = self.defaults[default]
+                if 'host' not in self.targets[host]:
+                    self.targets[host]['host'] = host
                args = (
                        que,
                        self.opts,
--- a/salt/cloud/init.py
+++ b/salt/cloud/init.py
@ -381,10 +381,9 @@ class CloudClient(object):

        .. code-block:: python

-            client.create(names=['myinstance'], provider='my-ec2-config',
-                kwargs={'image': 'ami-1624987f', 'size': 't1.micro',
-                        'ssh_username': 'ec2-user', 'securitygroup': 'default',
-                        'delvol_on_destroy': True})
+            client.create(provider='my-ec2-config', names=['myinstance'],
+                image='ami-1624987f', size='t1.micro', ssh_username='ec2-user',
+                securitygroup='default', delvol_on_destroy=True)
        '''
        mapper = salt.cloud.Map(self._opts_defaults())
        providers = self.opts['providers']
@ -399,7 +398,16 @@ class CloudClient(object):
            vm_ = kwargs.copy()
            vm_['name'] = name
            vm_['driver'] = provider
+
+            # This function doesn't require a profile, but many cloud drivers
+            # check for profile information (which includes the provider key) to
+            # help with config file debugging and setting up instances. Setting
+            # the profile and provider defaults here avoids errors in other
+            # cloud functions relying on these keys. See SaltStack Issue #41971
+            # and PR #38166 for more information.
            vm_['profile'] = None
+            vm_['provider'] = provider
+
            ret[name] = salt.utils.simple_types_filter(
                mapper.create(vm_))
        return ret
@ -722,18 +730,9 @@ class Cloud(object):
                    continue

                for vm_name, details in six.iteritems(vms):
-                    # If VM was created with use_fqdn with either of the softlayer drivers,
-                    # we need to strip the VM name and only search for the short hostname.
-                    if driver == 'softlayer' or driver == 'softlayer_hw':
-                        ret = []
-                        for name in names:
-                            name = name.split('.')[0]
-                            ret.append(name)
-                        if vm_name not in ret:
-                            continue
                    # XXX: The logic below can be removed once the aws driver
                    # is removed
-                    elif vm_name not in names:
+                    if vm_name not in names:
                        continue

                    elif driver == 'ec2' and 'aws' in handled_drivers and \
--- a/salt/cloud/clouds/azurearm.py
+++ b/salt/cloud/clouds/azurearm.py
@ -407,13 +407,14 @@ def list_nodes_full(conn=None, call=None):  # pylint: disable=unused-argument
    for group in list_resource_groups():
        nodes = compconn.virtual_machines.list(group)
        for node in nodes:
+            private_ips, public_ips = __get_ips_from_node(group, node)
            ret[node.name] = object_to_dict(node)
            ret[node.name]['id'] = node.id
            ret[node.name]['name'] = node.name
            ret[node.name]['size'] = node.hardware_profile.vm_size
            ret[node.name]['state'] = node.provisioning_state
-            ret[node.name]['private_ips'] = node.network_profile.network_interfaces
-            ret[node.name]['public_ips'] = node.network_profile.network_interfaces
+            ret[node.name]['private_ips'] = private_ips
+            ret[node.name]['public_ips'] = public_ips
            ret[node.name]['storage_profile']['data_disks'] = []
            ret[node.name]['resource_group'] = group
            for disk in node.storage_profile.data_disks:
@ -433,6 +434,30 @@ def list_nodes_full(conn=None, call=None):  # pylint: disable=unused-argument
    return ret


+def __get_ips_from_node(resource_group, node):
+    '''
+    List private and public IPs from a VM interface
+    '''
+    global netconn  # pylint: disable=global-statement,invalid-name
+    if not netconn:
+        netconn = get_conn(NetworkManagementClient)
+
+    private_ips = []
+    public_ips = []
+    for node_iface in node.network_profile.network_interfaces:
+        node_iface_name = node_iface.id.split('/')[-1]
+        network_interface = netconn.network_interfaces.get(resource_group, node_iface_name)
+        for ip_configuration in network_interface.ip_configurations:
+            if ip_configuration.private_ip_address:
+                private_ips.append(ip_configuration.private_ip_address)
+            if ip_configuration.public_ip_address and ip_configuration.public_ip_address.id:
+                public_iface_name = ip_configuration.public_ip_address.id.split('/')[-1]
+                public_iface = netconn.public_ip_addresses.get(resource_group, public_iface_name)
+                public_ips.append(public_iface.ip_address)
+
+    return private_ips, public_ips
+
+
 def list_resource_groups(conn=None, call=None):  # pylint: disable=unused-argument
    '''
    List resource groups associated with the account
--- a/salt/cloud/clouds/ec2.py
+++ b/salt/cloud/clouds/ec2.py
@ -1030,10 +1030,18 @@ def ssh_interface(vm_):
    Return the ssh_interface type to connect to. Either 'public_ips' (default)
    or 'private_ips'.
    '''
-    return config.get_cloud_config_value(
+    ret = config.get_cloud_config_value(
        'ssh_interface', vm_, __opts__, default='public_ips',
        search_global=False
    )
+    if ret not in ('public_ips', 'private_ips'):
+        log.warning((
+            'Invalid ssh_interface: {0}. '
+            'Allowed options are ("public_ips", "private_ips"). '
+            'Defaulting to "public_ips".'
+        ).format(ret))
+        ret = 'public_ips'
+    return ret


 def get_ssh_gateway_config(vm_):
@ -3420,34 +3428,7 @@ def list_nodes_full(location=None, call=None):
            'or --function.'
        )

-    if not location:
-        ret = {}
-        locations = set(
-            get_location(vm_) for vm_ in six.itervalues(__opts__['profiles'])
-            if _vm_provider_driver(vm_)
-        )
-
-        # If there aren't any profiles defined for EC2, check
-        # the provider config file, or use the default location.
-        if not locations:
-            locations = [get_location()]
-
-        for loc in locations:
-            ret.update(_list_nodes_full(loc))
-        return ret
-
-    return _list_nodes_full(location)
-
-
-def _vm_provider_driver(vm_):
-    alias, driver = vm_['driver'].split(':')
-    if alias not in __opts__['providers']:
-        return None
-
-    if driver not in __opts__['providers'][alias]:
-        return None
-
-    return driver == 'ec2'
+    return _list_nodes_full(location or get_location())


 def _extract_name_tag(item):
--- a/salt/cloud/clouds/joyent.py
+++ b/salt/cloud/clouds/joyent.py
@ -1071,10 +1071,10 @@ def query(action=None,
    timenow = datetime.datetime.utcnow()
    timestamp = timenow.strftime('%a, %d %b %Y %H:%M:%S %Z').strip()
    with salt.utils.fopen(ssh_keyfile, 'r') as kh_:
-        rsa_key = RSA.importKey(kh_)
+        rsa_key = RSA.importKey(kh_.read())
    rsa_ = PKCS1_v1_5.new(rsa_key)
    hash_ = SHA256.new()
-    hash_.update(timestamp)
+    hash_.update(timestamp.encode(__salt_system_encoding__))
    signed = base64.b64encode(rsa_.sign(hash_))
    keyid = '/{0}/keys/{1}'.format(user.split('/')[0], ssh_keyname)

@ -1085,7 +1085,7 @@ def query(action=None,
        'Date': timestamp,
        'Authorization': 'Signature keyId="{0}",algorithm="rsa-sha256" {1}'.format(
            keyid,
-            signed
+            signed.decode(__salt_system_encoding__)
        ),
    }

--- a/salt/cloud/clouds/nova.py
+++ b/salt/cloud/clouds/nova.py
@ -728,12 +728,18 @@ def request_instance(vm_=None, call=None):

        else:
            pool = floating_ip_conf.get('pool', 'public')
-            for fl_ip, opts in six.iteritems(conn.floating_ip_list()):
-                if opts['fixed_ip'] is None and opts['pool'] == pool:
-                    floating_ip = fl_ip
-                    break
-            if floating_ip is None:
+            try:
                floating_ip = conn.floating_ip_create(pool)['ip']
+            except Exception:
+                log.info('A new IP address was unable to be allocated. '
+                         'An IP address will be pulled from the already allocated list, '
+                         'This will cause a race condition when building in parallel.')
+                for fl_ip, opts in six.iteritems(conn.floating_ip_list()):
+                    if opts['fixed_ip'] is None and opts['pool'] == pool:
+                        floating_ip = fl_ip
+                        break
+                if floating_ip is None:
+                    log.error('No IP addresses available to allocate for this server: {0}'.format(vm_['name']))

        def __query_node_data(vm_):
            try:
--- a/salt/cloud/clouds/openstack.py
+++ b/salt/cloud/clouds/openstack.py
@ -135,6 +135,14 @@ Alternatively, one could use the private IP to connect by specifying:
      ssh_interface: private_ips


+.. note::
+
+    When using floating ips from networks, if the OpenStack driver is unable to
+    allocate a new ip address for the server, it will check that for
+    unassociated ip addresses in the floating ip pool.  If SaltCloud is running
+    in parallel mode, it is possible that more than one server will attempt to
+    use the same ip address.
+
 '''

 # Import python libs
@ -855,40 +863,43 @@ def _assign_floating_ips(vm_, conn, kwargs):
                    pool = OpenStack_1_1_FloatingIpPool(
                        net['floating'], conn.connection
                    )
-                    for idx in pool.list_floating_ips():
-                        if idx.node_id is None:
-                            floating.append(idx)
+                    try:
+                        floating.append(pool.create_floating_ip())
+                    except Exception as e:
+                        log.debug('Cannot allocate IP from floating pool \'%s\'. Checking for unassociated ips.',
+                                  net['floating'])
+                        for idx in pool.list_floating_ips():
+                            if idx.node_id is None:
+                                floating.append(idx)
+                                break
                    if not floating:
-                        try:
-                            floating.append(pool.create_floating_ip())
-                        except Exception as e:
-                            raise SaltCloudSystemExit(
-                                'Floating pool \'{0}\' does not have any more '
-                                'please create some more or use a different '
-                                'pool.'.format(net['floating'])
-                            )
+                        raise SaltCloudSystemExit(
+                            'There are no more floating IP addresses '
+                            'available, please create some more'
+                        )
        # otherwise, attempt to obtain list without specifying pool
        # this is the same as 'nova floating-ip-list'
        elif ssh_interface(vm_) != 'private_ips':
            try:
                # This try/except is here because it appears some
-                # *cough* Rackspace *cough*
                # OpenStack providers return a 404 Not Found for the
                # floating ip pool URL if there are no pools setup
                pool = OpenStack_1_1_FloatingIpPool(
                    '', conn.connection
                )
-                for idx in pool.list_floating_ips():
-                    if idx.node_id is None:
-                        floating.append(idx)
+                try:
+                    floating.append(pool.create_floating_ip())
+                except Exception as e:
+                    log.debug('Cannot allocate IP from the default floating pool. Checking for unassociated ips.')
+                    for idx in pool.list_floating_ips():
+                        if idx.node_id is None:
+                            floating.append(idx)
+                            break
                if not floating:
-                    try:
-                        floating.append(pool.create_floating_ip())
-                    except Exception as e:
-                        raise SaltCloudSystemExit(
-                            'There are no more floating IP addresses '
-                            'available, please create some more'
-                        )
+                    log.warning(
+                        'There are no more floating IP addresses '
+                        'available, please create some more if necessary'
+                    )
            except Exception as e:
                if str(e).startswith('404'):
                    pass
--- a/salt/cloud/clouds/softlayer.py
+++ b/salt/cloud/clouds/softlayer.py
@ -508,7 +508,7 @@ def list_nodes_full(mask='mask[id]', call=None):
    conn = get_conn(service='SoftLayer_Account')
    response = conn.getVirtualGuests()
    for node_id in response:
-        hostname = node_id['hostname'].split('.')[0]
+        hostname = node_id['hostname']
        ret[hostname] = node_id
    __utils__['cloud.cache_node_list'](ret, __active_provider_name__.split(':')[0], __opts__)
    return ret
@ -594,9 +594,6 @@ def destroy(name, call=None):
        transport=__opts__['transport']
    )

-    # If the VM was created with use_fqdn, the short hostname will be used instead.
-    name = name.split('.')[0]
-
    node = show_instance(name, call='action')
    conn = get_conn()
    response = conn.deleteObject(id=node['id'])
--- a/salt/cloud/clouds/softlayer_hw.py
+++ b/salt/cloud/clouds/softlayer_hw.py
@ -526,9 +526,6 @@ def destroy(name, call=None):
        transport=__opts__['transport']
    )

-    # If the VM was created with use_fqdn, the short hostname will be used instead.
-    name = name.split('.')[0]
-
    node = show_instance(name, call='action')
    conn = get_conn(service='SoftLayer_Ticket')
    response = conn.createCancelServerTicket(
--- a/salt/cloud/deploy/bootstrap-salt.sh
+++ b/salt/cloud/deploy/bootstrap-salt.sh
--- a/salt/cloud/libcloudfuncs.py
+++ b/salt/cloud/libcloudfuncs.py
@ -25,7 +25,7 @@ try:
    )
    HAS_LIBCLOUD = True
    LIBCLOUD_VERSION_INFO = tuple([
-        int(part) for part in libcloud.__version__.replace('-', '.').split('.')[:3]
+        int(part) for part in libcloud.__version__.replace('-', '.').replace('rc', '.').split('.')[:3]
    ])

 except ImportError:
@ -150,7 +150,7 @@ def avail_locations(conn=None, call=None):

        ret[img_name] = {}
        for attr in dir(img):
-            if attr.startswith('_'):
+            if attr.startswith('_') or attr == 'driver':
                continue

            attr_value = getattr(img, attr)
@ -187,7 +187,7 @@ def avail_images(conn=None, call=None):

        ret[img_name] = {}
        for attr in dir(img):
-            if attr.startswith('_'):
+            if attr.startswith('_') or attr in ('driver', 'get_uuid'):
                continue
            attr_value = getattr(img, attr)
            if isinstance(attr_value, string_types) and not six.PY3:
@ -222,7 +222,7 @@ def avail_sizes(conn=None, call=None):

        ret[size_name] = {}
        for attr in dir(size):
-            if attr.startswith('_'):
+            if attr.startswith('_') or attr in ('driver', 'get_uuid'):
                continue

            try:
--- a/salt/config/init.py
+++ b/salt/config/init.py
@ -352,7 +352,7 @@ VALID_OPTS = {
    # The TCP port on which minion events should be pulled if ipc_mode is TCP
    'tcp_pull_port': int,

-    # The TCP port on which events for the master should be pulled if ipc_mode is TCP
+    # The TCP port on which events for the master should be published if ipc_mode is TCP
    'tcp_master_pub_port': int,

    # The TCP port on which events for the master should be pulled if ipc_mode is TCP
@ -1633,7 +1633,8 @@ DEFAULT_PROXY_MINION_OPTS = {
    'log_file': os.path.join(salt.syspaths.LOGS_DIR, 'proxy'),
    'add_proxymodule_to_opts': False,
    'proxy_merge_grains_in_module': True,
-    'append_minionid_config_dirs': ['cachedir', 'pidfile', 'default_include'],
+    'extension_modules': os.path.join(salt.syspaths.CACHE_DIR, 'proxy', 'extmods'),
+    'append_minionid_config_dirs': ['cachedir', 'pidfile', 'default_include', 'extension_modules'],
    'default_include': 'proxy.d/*.conf',

    # By default, proxies will preserve the connection.
@ -2282,7 +2283,7 @@ def syndic_config(master_config_path,
        'pki_dir', 'cachedir', 'pidfile', 'sock_dir', 'extension_modules',
        'autosign_file', 'autoreject_file', 'token_dir'
    ]
-    for config_key in ('syndic_log_file', 'log_file', 'key_logfile'):
+    for config_key in ('log_file', 'key_logfile', 'syndic_log_file'):
        # If this is not a URI and instead a local path
        if urlparse(opts.get(config_key, '')).scheme == '':
            prepend_root_dirs.append(config_key)
--- a/salt/crypt.py
+++ b/salt/crypt.py
@ -373,17 +373,18 @@ class AsyncAuth(object):
        loop_instance_map = AsyncAuth.instance_map[io_loop]

        key = cls.__key(opts)
-        if key not in loop_instance_map:
+        auth = loop_instance_map.get(key)
+        if auth is None:
            log.debug('Initializing new AsyncAuth for {0}'.format(key))
            # we need to make a local variable for this, as we are going to store
            # it in a WeakValueDictionary-- which will remove the item if no one
            # references it-- this forces a reference while we return to the caller
-            new_auth = object.__new__(cls)
-            new_auth.__singleton_init__(opts, io_loop=io_loop)
-            loop_instance_map[key] = new_auth
+            auth = object.__new__(cls)
+            auth.__singleton_init__(opts, io_loop=io_loop)
+            loop_instance_map[key] = auth
        else:
            log.debug('Re-using AsyncAuth for {0}'.format(key))
-        return loop_instance_map[key]
+        return auth

    @classmethod
    def __key(cls, opts, io_loop=None):
@ -1009,14 +1010,15 @@ class SAuth(AsyncAuth):
        Only create one instance of SAuth per __key()
        '''
        key = cls.__key(opts)
-        if key not in SAuth.instances:
+        auth = SAuth.instances.get(key)
+        if auth is None:
            log.debug('Initializing new SAuth for {0}'.format(key))
-            new_auth = object.__new__(cls)
-            new_auth.__singleton_init__(opts)
-            SAuth.instances[key] = new_auth
+            auth = object.__new__(cls)
+            auth.__singleton_init__(opts)
+            SAuth.instances[key] = auth
        else:
            log.debug('Re-using SAuth for {0}'.format(key))
-        return SAuth.instances[key]
+        return auth

    @classmethod
    def __key(cls, opts, io_loop=None):
--- a/salt/engines/docker_events.py
+++ b/salt/engines/docker_events.py
@ -50,8 +50,8 @@ def start(docker_url='unix://var/run/docker.sock',
    .. code-block:: yaml

        engines:
-          docker_events:
-            docker_url: unix://var/run/docker.sock
+          - docker_events:
+              docker_url: unix://var/run/docker.sock

    The config above sets up engines to listen
    for events from the Docker daemon and publish
--- a/salt/engines/hipchat.py
+++ b/salt/engines/hipchat.py
@ -14,25 +14,25 @@ keys make the engine interactive.
    .. code-block:: yaml

        engines:
-          - hipchat:
-              api_url: http://api.hipchat.myteam.com
-              token: 'XXXXXX'
-              room: 'salt'
-              control: True
-              valid_users:
-                 - SomeUser
-              valid_commands:
-                 - test.ping
-                 - cmd.run
-                 - list_jobs
-                 - list_commands
-              aliases:
-                 list_jobs:
-                     cmd: jobs.list_jobs
-                 list_commands:
-                     cmd: pillar.get salt:engines:hipchat:valid_commands target=saltmaster tgt_type=list
-              max_rooms: 0
-              wait_time: 1
+            - hipchat:
+                api_url: http://api.hipchat.myteam.com
+                token: 'XXXXXX'
+                room: 'salt'
+                control: True
+                valid_users:
+                    - SomeUser
+                valid_commands:
+                    - test.ping
+                    - cmd.run
+                    - list_jobs
+                    - list_commands
+                aliases:
+                    list_jobs:
+                        cmd: jobs.list_jobs
+                    list_commands:
+                        cmd: pillar.get salt:engines:hipchat:valid_commands target=saltmaster
+                max_rooms: 0
+                wait_time: 1
 '''

 from __future__ import absolute_import
--- a/salt/engines/http_logstash.py
+++ b/salt/engines/http_logstash.py
@ -12,13 +12,13 @@ them onto a logstash endpoint via HTTP requests.

        engines:
          - http_logstash:
-                url: http://blabla.com/salt-stuff
-                tags:
-                    - salt/job/*/new
-                    - salt/job/*/ret/*
-                funs:
-                    - probes.results
-                    - bgp.config
+              url: http://blabla.com/salt-stuff
+              tags:
+                  - salt/job/*/new
+                  - salt/job/*/ret/*
+              funs:
+                  - probes.results
+                  - bgp.config
 '''

 from __future__ import absolute_import
--- a/salt/engines/logentries.py
+++ b/salt/engines/logentries.py
@ -24,6 +24,9 @@ master config.
 :configuration:

    Example configuration
+
+    .. code-block:: yaml
+
        engines:
          - logentries:
            endpoint: data.logentries.com
--- a/salt/engines/logstash.py
+++ b/salt/engines/logstash.py
@ -8,6 +8,9 @@ them onto a logstash endpoint.
 :configuration:

    Example configuration
+
+    .. code-block:: yaml
+
        engines:
          - logstash:
            host: log.my_network.com
--- a/salt/engines/reactor.py
+++ b/salt/engines/reactor.py
@ -7,10 +7,10 @@ Example Config in Master or Minion config
 .. code-block:: yaml

    engines:
-      reactor:
-        refresh_interval: 60
-        worker_threads: 10
-        worker_hwm: 10000
+      - reactor:
+          refresh_interval: 60
+          worker_threads: 10
+          worker_hwm: 10000

    reactor:
      - 'salt/cloud/*/destroyed':
--- a/salt/engines/redis_sentinel.py
+++ b/salt/engines/redis_sentinel.py
@ -8,6 +8,9 @@ events based on the channels they are subscribed to.
 :configuration:

    Example configuration
+
+    .. code-block:: yaml
+
        engines:
          - redis_sentinel:
              hosts:
--- a/salt/engines/slack.py
+++ b/salt/engines/slack.py
@ -12,44 +12,43 @@ prefaced with a ``!``.
    .. code-block:: yaml

        engines:
-            slack:
-               token: 'xoxb-xxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx'
-               control: True
-               valid_users:
-                   - garethgreenaway
-               valid_commands:
-                   - test.ping
-                   - cmd.run
-                   - list_jobs
-                   - list_commands
-               aliases:
-                   list_jobs:
-                       cmd: jobs.list_jobs
-                   list_commands:
-                       cmd: pillar.get salt:engines:slack:valid_commands target=saltmaster tgt_type=list
+            - slack:
+                token: 'xoxb-xxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx'
+                control: True
+                valid_users:
+                    - garethgreenaway
+                valid_commands:
+                    - test.ping
+                    - cmd.run
+                    - list_jobs
+                    - list_commands
+                aliases:
+                    list_jobs:
+                        cmd: jobs.list_jobs
+                    list_commands:
+                        cmd: pillar.get salt:engines:slack:valid_commands target=saltmaster tgt_type=list

    :configuration: Example configuration using groups
    .. versionadded: 2017.7.0

        engines:
-            slack:
-               token: 'xoxb-xxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx'
-               control: True
-               groups:
-                 gods:
-                   users:
-                     - garethgreenaway
-                   commands:
-                     - test.ping
-                     - cmd.run
-                     - list_jobs
-                     - list_commands
-               aliases:
+            - slack:
+                token: 'xoxb-xxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxx'
+                control: True
+                groups:
+                    gods:
+                        users:
+                            - garethgreenaway
+                        commands:
+                            - test.ping
+                            - cmd.run
+                            - list_jobs
+                            - list_commands
+                aliases:
                   list_jobs:
-                       cmd: jobs.list_jobs
+                        cmd: jobs.list_jobs
                   list_commands:
-                       cmd: pillar.get salt:engines:slack:valid_commands target=saltmaster tgt_type=list
-
+                        cmd: pillar.get salt:engines:slack:valid_commands target=saltmaster tgt_type=list

 :depends: slackclient
 '''
@ -62,6 +61,7 @@ import logging
 import time
 import re
 import yaml
+import ast

 try:
    import slackclient
@ -182,11 +182,20 @@ def start(token,
                                            if 'aliases' in groups[group]:
                                                aliases.update(groups[group]['aliases'])

+                                if 'user' not in _m:
+                                    if 'message' in _m and 'user' in _m['message']:
+                                        log.debug('Message was edited, '
+                                                  'so we look for user in '
+                                                  'the original message.')
+                                        _user = _m['message']['user']
+                                else:
+                                    _user = _m['user']
+
                                # Ensure the user is allowed to run commands
                                if valid_users:
-                                    log.debug('{0} {1}'.format(all_users, _m['user']))
-                                    if _m['user'] not in valid_users and all_users.get(_m['user'], None) not in valid_users:
-                                        channel.send_message('{0} not authorized to run Salt commands'.format(all_users[_m['user']]))
+                                    log.debug('{0} {1}'.format(all_users, _user))
+                                    if _user not in valid_users and all_users.get(_user, None) not in valid_users:
+                                        channel.send_message('{0} not authorized to run Salt commands'.format(all_users[_user]))
                                        return

                                # Trim the ! from the front
@ -220,7 +229,7 @@ def start(token,
                                # Ensure the command is allowed
                                if valid_commands:
                                    if cmd not in valid_commands:
-                                        channel.send_message('{0} is not allowed to use command {1}.'.format(all_users[_m['user']], cmd))
+                                        channel.send_message('{0} is not allowed to use command {1}.'.format(all_users[_user], cmd))
                                        return

                                # Parse args and kwargs
@ -246,6 +255,10 @@ def start(token,
                                    tgt_type = kwargs['tgt_type']
                                    del kwargs['tgt_type']

+                                # Check for pillar string representation of dict and convert it to dict
+                                if 'pillar' in kwargs:
+                                    kwargs.update(pillar=ast.literal_eval(kwargs['pillar']))
+
                                ret = {}

                                if cmd in runner_functions:
@ -255,7 +268,7 @@ def start(token,
                                # Default to trying to run as a client module.
                                else:
                                    local = salt.client.LocalClient()
-                                    ret = local.cmd('{0}'.format(target), cmd, args, kwargs, tgt_type='{0}'.format(tgt_type))
+                                    ret = local.cmd('{0}'.format(target), cmd, arg=args, kwarg=kwargs, tgt_type='{0}'.format(tgt_type))

                                if ret:
                                    return_text = json.dumps(ret, sort_keys=True, indent=1)
--- a/salt/executors/sudo.py
+++ b/salt/executors/sudo.py
@ -73,7 +73,7 @@ class SudoExecutor(ModuleExecutorBase):
                    '-c', salt.syspaths.CONFIG_DIR,
                    '--',
                    data.get('fun')]
-        if data['fun'] == 'state.sls':
+        if data['fun'] in ('state.sls', 'state.highstate', 'state.apply'):
            kwargs['concurrent'] = True
        for arg in args:
            self.cmd.append(_cmd_quote(str(arg)))
--- a/salt/ext/ipaddress.py
+++ b/salt/ext/ipaddress.py
@ -28,9 +28,6 @@ bytes = bytearray
 # Python 2 does not support exception chaining.
 # s/ from None$//

-# Python 2 ranges need to fit in a C long
-# 'fix' hosts() for IPv6Network
-
 # When checking for instances of int, also allow Python 2's long.
 _builtin_isinstance = isinstance

@ -2259,7 +2256,7 @@ class IPv6Network(_BaseV6, _BaseNetwork):
        """
        network = int(self.network_address)
        broadcast = int(self.broadcast_address)
-        for x in range(1, broadcast - network + 1):
+        for x in long_range(1, broadcast - network + 1):
            yield self._address_class(network + x)

    @property
--- a/Show more
+++ b/Show more
				`@ -1 +0,0 @@`
				`6ddbbce47cc49597433d98ca05c2f62f07ed1070807b645602a8e9e9b996adc6fa66fa20a33cd7d23d4e7e925e25071d7301d288149fbe4e8c5f06d5438dda1f ./Python-2.7.12.tar.xz`
				`@ -0,0 +1 @@`
				`f37c9a28ce129d01e63c84d7db627a06402854578f62d17927334ea21ede318e04bbf66e890e3f47c85333e6b19f6e5581fb3f3e27efd24be27017d1b6529c4b ./Python-2.7.13.tar.xz`
				`@ -0,0 +1 @@`
				`bbcc20e315c63dbc8901d7e7bfa29d4dbdad9335720757d8d679730319fd1d9fcfdb55cf62d620c9b052134170f162c28d653a8af60923185b8932524d827864 ./Python-3.5.3.tar.xz`
				`@ -1 +0,0 @@`
				`1e63960da42bcc90945463ae1f5b1355849881dce5bba6d293391f8d6f0932063a5bfd433a071cb184af90ebeab469acc34710587116922144d61f3d7661901b ./libsodium-1.0.12.tar.gz`
				`@ -0,0 +1 @@`
				`c619b12fdf0b2e59174b6e383a62d5499ebcd720fdbb2c1a41a98a46c285df075202423454b294fefee185432441e943805397d7656f7cd7837de425da623929 ./libsodium-1.0.13.tar.gz`
				`@ -1 +0,0 @@`
				`50abf6dc94cafd06e7fd20770808bdc675c88daa369e4f752bd584ab17f72a57357c1ca1eca3c83e6745b5a3c9c73c99dce70adaa904d73f6df4c75bc7138351 ./openssl-1.0.2f.tar.gz`
				`@ -0,0 +1 @@`
				`047d964508ad6025c79caabd8965efd2416dc026a56183d0ef4de7a0a6769ce8e0b4608a3f8393d326f6d03b26a2b067e6e0c750f35b20be190e595e8290c0e3 ./openssl-1.0.2l.tar.gz`
				`@ -0,0 +1 @@`
				`4861ec6428fead416f5cbbbb0bbad10b9152967e481d4b0ff2eb396a9f297f552984c9bb72f6864a37dcd8fca1d9ccceda3ef18d8f121938dbe4fdf2b870fe75 ./pkg-config-0.29.2.tar.gz`
				`@ -1 +0,0 @@`
				`c2857cd67801c0db5d204912453ff6bdc7da3ea61f8b1c6b38983d48dffb958725e7723f909abbc057c7b34a85c27290eec6943808312a75909306076064aa63 ./pkg-config-0.29.tar.gz`
				`@ -1 +0,0 @@`
				`2c993d18ea44e1cba890e024176af65b85b842ca4f8a22d319be4ace8388ab8828dd706b065f02754025bf271b1d7aa878c3f6655878248f7826452cb2a6134c ./zeromq-4.1.3.tar.gz`