Merge 3006.x into master

.github/actionlint.yaml

@@ -11,3 +11,4 @@ self-hosted-runner:
     - repo-release
     - medium
     - large
+    - macos-13-xlarge

.github/actions/build-onedir-deps/action.yml

@@ -39,7 +39,7 @@ runs:
 
     - name: Cache Deps Onedir Package Directory
       id: onedir-pkg-cache
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         path: artifacts/${{ inputs.package-name }}
         key: >

.github/actions/build-onedir-salt/action.yml

@@ -43,7 +43,7 @@ runs:
 
     - name: Download Cached Deps Onedir Package Directory
       id: onedir-bare-cache
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         path: artifacts/${{ inputs.package-name }}
         key: >

.github/actions/cached-virtualenv/action.yml

@@ -54,7 +54,7 @@ runs:
 
     - name: Cache VirtualEnv
       id: cache-virtualenv
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         key: ${{ steps.setup-cache-key.outputs.cache-key }}
         path: ${{ steps.virtualenv-path.outputs.venv-path }}

.github/actions/setup-actionlint/action.yml

@@ -15,7 +15,7 @@ runs:
   steps:
 
     - name: Cache actionlint Binary
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         path: /usr/local/bin/actionlint
         key: ${{ inputs.cache-seed }}|${{ runner.os }}|${{ runner.arch }}|actionlint|${{ inputs.version }}

.github/actions/setup-pre-commit/action.yml

@@ -36,7 +36,7 @@ runs:
         ${{ steps.pre-commit-virtualenv.outputs.python-executable }} -m pip install pre-commit==${{ inputs.version }}
 
     - name: Cache Pre-Commit Hooks
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       id: pre-commit-hooks-cache
       with:
         key: ${{ steps.pre-commit-virtualenv.outputs.cache-key }}|${{ inputs.version }}|${{ hashFiles('.pre-commit-config.yaml') }}

.github/actions/setup-python-tools-scripts/action.yml

@@ -50,7 +50,7 @@ runs:
         cache-seed: tools|${{ steps.venv-hash.outputs.venv-hash }}
 
     - name: Restore Python Tools Virtualenvs Cache
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         path: ${{ inputs.cwd }}/.tools-venvs
         key: ${{ inputs.cache-prefix }}|${{ steps.venv-hash.outputs.venv-hash }}

.github/actions/setup-relenv/action.yml

@@ -45,7 +45,7 @@ runs:
         python3 -m pip install relenv==${{ inputs.version }}
 
     - name: Cache Relenv Data Directory
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         path: ${{ github.workspace }}/.relenv
         key: ${{ inputs.cache-seed }}|relenv|${{ inputs.version }}|${{ inputs.python-version }}|${{ inputs.platform }}|${{ inputs.arch }}

.github/actions/setup-shellcheck/action.yml

@@ -15,7 +15,7 @@ runs:
   steps:
 
     - name: Cache shellcheck Binary
-      uses: actions/cache@v3
+      uses: actions/cache@v3.3.1
       with:
         path: /usr/local/bin/shellcheck
         key: ${{ inputs.cache-seed }}|${{ runner.os }}|${{ runner.arch }}|shellcheck|${{ inputs.version }}

.github/workflows/build-deps-ci-action-macos.yml

@@ -68,7 +68,7 @@ jobs:
 
       - name: Cache nox.${{ inputs.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
         id: nox-dependencies-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ inputs.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ inputs.arch }}|${{ inputs.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{

.github/workflows/build-deps-ci-action.yml

@@ -72,7 +72,7 @@ jobs:
 
       - name: Cache nox.${{ inputs.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
         id: nox-dependencies-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ inputs.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ inputs.arch }}|${{ inputs.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{
@@ -102,6 +102,8 @@ jobs:
       - name: Setup Python Tools Scripts
         if: steps.nox-dependencies-cache.outputs.cache-hit != 'true'
         uses: ./.github/actions/setup-python-tools-scripts
+        with:
+          cache-prefix: ${{ inputs.cache-prefix }}-build-deps-ci
 
       - name: Get Salt Project GitHub Actions Bot Environment
         if: steps.nox-dependencies-cache.outputs.cache-hit != 'true'

.github/workflows/build-deps-onedir-macos.yml

@@ -46,7 +46,10 @@ jobs:
       matrix:
         arch:
           - x86_64
-    runs-on: macos-12
+          - aarch64
+    runs-on:
+      - ${{ matrix.arch == 'aarch64' && 'macos-13-xlarge' || 'macos-12' }}
+
     steps:
 
       - name: "Throttle Builds"
@@ -71,7 +74,7 @@ jobs:
         uses: ./.github/actions/setup-relenv
         with:
           platform: darwin
-          arch: ${{ matrix.arch }}
+          arch: ${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}
           version: ${{ inputs.relenv-version }}
           cache-seed: ${{ inputs.cache-seed }}
           python-version: ${{ inputs.python-version }}

.github/workflows/build-docs.yml

@@ -71,7 +71,7 @@ jobs:
 
       - name: Cache Python Tools Docs Virtualenv
         id: tools-venvs-dependencies-cache
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: .tools-venvs/docs
           key: ${{ inputs.cache-seed }}|${{ github.workflow }}|${{ github.job }}|tools-venvs|${{ steps.python-tools-scripts.outputs.version }}|docs|${{ steps.get-python-version.outputs.version }}|${{ hashFiles('requirements/**/docs.txt') }}

.github/workflows/build-macos-packages.yml

@@ -48,13 +48,14 @@ jobs:
       matrix:
         arch:
           - x86_64
+          - aarch64
         source:
           - ${{ inputs.source }}
 
     runs-on:
-      - macos-12
-    steps:
+      - ${{ matrix.arch == 'aarch64' && 'macos-13-xlarge' || 'macos-12' }}
 
+    steps:
       - name: Check Package Signing Enabled
         shell: bash
         id: check-pkg-sign
@@ -81,7 +82,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
-          python-version: 3.9
+          python-version: 3.11
 
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts

.github/workflows/build-salt-onedir-linux.yml

@@ -61,6 +61,8 @@ jobs:
 
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts
+        with:
+          cache-prefix: ${{ inputs.cache-seed }}-build-salt-onedir-windows
 
       - name: Setup Salt Version
         id: setup-salt-version

.github/workflows/build-salt-onedir-macos.yml

@@ -46,9 +46,11 @@ jobs:
       matrix:
         arch:
           - x86_64
-    runs-on: macos-12
-    steps:
+          - aarch64
+    runs-on:
+      - ${{ matrix.arch == 'aarch64' && 'macos-13-xlarge' || 'macos-12' }}
 
+    steps:
       - name: "Throttle Builds"
         shell: bash
         run: |
@@ -65,13 +67,15 @@ jobs:
         uses: ./.github/actions/setup-relenv
         with:
           platform: darwin
-          arch: ${{ matrix.arch }}
+          arch: ${{ matrix.arch == 'aarch64' && 'arm64' || matrix.arch }}
           version: ${{ inputs.relenv-version }}
           cache-seed: ${{ inputs.cache-seed }}
           python-version: ${{ inputs.python-version }}
 
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts
+        with:
+          cache-prefix: ${{ inputs.cache-seed }}-build-salt-onedir-macos
 
       - name: Setup Salt Version
         id: setup-salt-version

.github/workflows/build-salt-onedir-windows.yml

@@ -74,6 +74,8 @@ jobs:
 
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts
+        with:
+          cache-prefix: ${{ inputs.cache-seed }}-build-salt-onedir-macos
 
       - name: Setup Salt Version
         id: setup-salt-version

.github/workflows/build-windows-packages.yml

@@ -92,7 +92,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-python@v4
         with:
-          python-version: 3.9
+          python-version: 3.11
 
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts

.github/workflows/ci.yml

@@ -720,6 +720,23 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
+  macos-13-xlarge-ci-deps:
+    name: macOS 13 Arm64 Deps
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-salt-onedir-macos
+    uses: ./.github/workflows/build-deps-ci-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+
   almalinux-8-ci-deps:
     name: Alma Linux 8 Deps
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -1869,6 +1886,28 @@ jobs:
       skip-junit-reports: ${{ github.event_name == 'pull_request' }}
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
+  macos-13-xlarge-pkg-tests:
+    name: macOS 13 Arm64 Package Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-macos-pkgs-onedir
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-packages-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      pkg-type: macos
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
+      skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+      testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
+
   windows-2016-nsis-pkg-tests:
     name: Windows 2016 NSIS Package Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2111,6 +2150,28 @@ jobs:
       workflow-slug: ci
       default-timeout: 180
 
+  macos-13-xlarge:
+    name: macOS 13 Arm64 Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      gh-actions-python-version: "3.10"
+      testrun: ${{ needs.prepare-workflow.outputs.testrun }}
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: ${{ fromJSON(needs.prepare-workflow.outputs.testrun)['skip_code_coverage'] }}
+      skip-junit-reports: ${{ github.event_name == 'pull_request' }}
+      workflow-slug: ci
+      default-timeout: 180
+
   almalinux-8:
     name: Alma Linux 8 Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2742,6 +2803,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -2782,6 +2844,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -2942,6 +3005,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -2982,6 +3046,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -3035,6 +3100,7 @@ jobs:
       - ubuntu-2204-arm64-pkg-tests
       - macos-12-pkg-tests
       - macos-13-pkg-tests
+      - macos-13-xlarge-pkg-tests
       - windows-2016-nsis-pkg-tests
       - windows-2016-msi-pkg-tests
       - windows-2019-nsis-pkg-tests

.github/workflows/nightly.yml

@@ -776,6 +776,23 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
+  macos-13-xlarge-ci-deps:
+    name: macOS 13 Arm64 Deps
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-salt-onedir-macos
+    uses: ./.github/workflows/build-deps-ci-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+
   almalinux-8-ci-deps:
     name: Alma Linux 8 Deps
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -1925,6 +1942,28 @@ jobs:
       skip-junit-reports: false
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
+  macos-13-xlarge-pkg-tests:
+    name: macOS 13 Arm64 Package Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-macos-pkgs-onedir
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-packages-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      pkg-type: macos
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: false
+      skip-junit-reports: false
+      testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
+
   windows-2016-nsis-pkg-tests:
     name: Windows 2016 NSIS Package Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2167,6 +2206,28 @@ jobs:
       workflow-slug: nightly
       default-timeout: 360
 
+  macos-13-xlarge:
+    name: macOS 13 Arm64 Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      gh-actions-python-version: "3.10"
+      testrun: ${{ needs.prepare-workflow.outputs.testrun }}
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: false
+      skip-junit-reports: false
+      workflow-slug: nightly
+      default-timeout: 360
+
   almalinux-8:
     name: Alma Linux 8 Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2798,6 +2859,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -2838,6 +2900,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -2991,9 +3054,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-script
+        uses: ./.github/actions/setup-python-tools-scripts
         with:
-          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}s
+          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
 
       - name: Get Salt Project GitHub Actions Bot Environment
         run: |
@@ -3562,6 +3625,12 @@ jobs:
           name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
           path: artifacts/pkgs/incoming
 
+      - name: Download macOS Arch64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-aarch64-macos
+          path: artifacts/pkgs/incoming
+
       - name: Setup GnuPG
         run: |
           sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
@@ -3753,6 +3822,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -3793,6 +3863,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -3909,6 +3980,7 @@ jobs:
       - ubuntu-2204-arm64-pkg-tests
       - macos-12-pkg-tests
       - macos-13-pkg-tests
+      - macos-13-xlarge-pkg-tests
       - windows-2016-nsis-pkg-tests
       - windows-2016-msi-pkg-tests
       - windows-2019-nsis-pkg-tests

.github/workflows/release.yml

@@ -245,6 +245,22 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
+  macos-13-xlarge-ci-deps:
+    name: macOS 13 Arm64 Deps
+    needs:
+      - prepare-workflow
+      - download-onedir-artifact
+    uses: ./.github/workflows/build-deps-ci-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+
   almalinux-8-ci-deps:
     name: Alma Linux 8 Deps
     needs:
@@ -901,6 +917,7 @@ jobs:
       - fedora-38-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - photonos-3-arm64-ci-deps
       - photonos-3-ci-deps
       - photonos-4-arm64-ci-deps
@@ -1108,6 +1125,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps

.github/workflows/scheduled.yml

@@ -754,6 +754,23 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
+  macos-13-xlarge-ci-deps:
+    name: macOS 13 Arm64 Deps
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-salt-onedir-macos
+    uses: ./.github/workflows/build-deps-ci-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+
   almalinux-8-ci-deps:
     name: Alma Linux 8 Deps
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -1903,6 +1920,28 @@ jobs:
       skip-junit-reports: false
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
+  macos-13-xlarge-pkg-tests:
+    name: macOS 13 Arm64 Package Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-macos-pkgs-onedir
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-packages-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      pkg-type: macos
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: false
+      skip-junit-reports: false
+      testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
+
   windows-2016-nsis-pkg-tests:
     name: Windows 2016 NSIS Package Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2145,6 +2184,28 @@ jobs:
       workflow-slug: scheduled
       default-timeout: 360
 
+  macos-13-xlarge:
+    name: macOS 13 Arm64 Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      gh-actions-python-version: "3.10"
+      testrun: ${{ needs.prepare-workflow.outputs.testrun }}
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: false
+      skip-junit-reports: false
+      workflow-slug: scheduled
+      default-timeout: 360
+
   almalinux-8:
     name: Alma Linux 8 Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2776,6 +2837,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -2816,6 +2878,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -2978,6 +3041,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -3018,6 +3082,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -3071,6 +3136,7 @@ jobs:
       - ubuntu-2204-arm64-pkg-tests
       - macos-12-pkg-tests
       - macos-13-pkg-tests
+      - macos-13-xlarge-pkg-tests
       - windows-2016-nsis-pkg-tests
       - windows-2016-msi-pkg-tests
       - windows-2019-nsis-pkg-tests

.github/workflows/staging.yml

@@ -771,6 +771,23 @@ jobs:
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
       cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
 
+  macos-13-xlarge-ci-deps:
+    name: macOS 13 Arm64 Deps
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-salt-onedir-macos
+    uses: ./.github/workflows/build-deps-ci-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+
   almalinux-8-ci-deps:
     name: Alma Linux 8 Deps
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['build-deps-ci'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -1920,6 +1937,28 @@ jobs:
       skip-junit-reports: true
       testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
 
+  macos-13-xlarge-pkg-tests:
+    name: macOS 13 Arm64 Package Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - build-macos-pkgs-onedir
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-packages-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      pkg-type: macos
+      nox-version: 2022.8.7
+      python-version: "3.10"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: true
+      skip-junit-reports: true
+      testing-releases: ${{ needs.prepare-workflow.outputs.testing-releases }}
+
   windows-2016-nsis-pkg-tests:
     name: Windows 2016 NSIS Package Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test-pkg'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2162,6 +2201,28 @@ jobs:
       workflow-slug: staging
       default-timeout: 180
 
+  macos-13-xlarge:
+    name: macOS 13 Arm64 Test
+    if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['github-hosted'] }}
+    needs:
+      - prepare-workflow
+      - macos-13-xlarge-ci-deps
+    uses: ./.github/workflows/test-action-macos.yml
+    with:
+      distro-slug: macos-13-xlarge
+      nox-session: ci-test-onedir
+      platform: darwin
+      arch: aarch64
+      nox-version: 2022.8.7
+      gh-actions-python-version: "3.10"
+      testrun: ${{ needs.prepare-workflow.outputs.testrun }}
+      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
+      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.13
+      skip-code-coverage: true
+      skip-junit-reports: true
+      workflow-slug: staging
+      default-timeout: 180
+
   almalinux-8:
     name: Alma Linux 8 Test
     if: ${{ fromJSON(needs.prepare-workflow.outputs.jobs)['test'] && fromJSON(needs.prepare-workflow.outputs.runners)['self-hosted'] }}
@@ -2802,9 +2863,9 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-script
+        uses: ./.github/actions/setup-python-tools-scripts
         with:
-          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}s
+          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
 
       - name: Get Salt Project GitHub Actions Bot Environment
         run: |
@@ -3375,6 +3436,12 @@ jobs:
           name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
           path: artifacts/pkgs/incoming
 
+      - name: Download macOS Arch64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-aarch64-macos
+          path: artifacts/pkgs/incoming
+
       - name: Setup GnuPG
         run: |
           sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
@@ -3696,6 +3763,7 @@ jobs:
       - fedora-38-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - photonos-3-arm64-ci-deps
       - photonos-3-ci-deps
       - photonos-4-arm64-ci-deps
@@ -3733,6 +3801,7 @@ jobs:
       - windows-2022-ci-deps
       - macos-12-ci-deps
       - macos-13-ci-deps
+      - macos-13-xlarge-ci-deps
       - almalinux-8-ci-deps
       - almalinux-8-arm64-ci-deps
       - almalinux-9-ci-deps
@@ -3773,6 +3842,7 @@ jobs:
       - windows-2022
       - macos-12
       - macos-13
+      - macos-13-xlarge
       - almalinux-8
       - almalinux-9
       - amazonlinux-2
@@ -3826,6 +3896,7 @@ jobs:
       - ubuntu-2204-arm64-pkg-tests
       - macos-12-pkg-tests
       - macos-13-pkg-tests
+      - macos-13-xlarge-pkg-tests
       - windows-2016-nsis-pkg-tests
       - windows-2016-msi-pkg-tests
       - windows-2019-nsis-pkg-tests

.github/workflows/templates/build-ci-deps.yml.jinja

@@ -48,7 +48,7 @@
       distro-slug: <{ slug }>
       nox-session: ci-test-onedir
       platform: darwin
-      arch: x86_64
+      arch: <{ arch }>
       nox-version: <{ nox_version  }>
       python-version: "<{ gh_actions_workflows_python_version }>"
       salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"

.github/workflows/templates/build-macos-repo.yml.jinja

@@ -25,6 +25,12 @@
           name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-x86_64-macos
           path: artifacts/pkgs/incoming
 
+      - name: Download macOS Arch64 Packages
+        uses: actions/download-artifact@v3
+        with:
+          name: salt-${{ needs.prepare-workflow.outputs.salt-version }}-aarch64-macos
+          path: artifacts/pkgs/incoming
+
       - name: Setup GnuPG
         run: |
           sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg

.github/workflows/templates/build-src-repo.yml.jinja

@@ -9,9 +9,9 @@
       - uses: actions/checkout@v4
 
       - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-script
+        uses: ./.github/actions/setup-python-tools-scripts
         with:
-          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}s
+          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
 
       - name: Get Salt Project GitHub Actions Bot Environment
         run: |

.github/workflows/templates/test-package-downloads-action.yml.jinja

@@ -95,7 +95,7 @@ jobs:
           tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-linux-${{ matrix.arch == 'arm64' && 'aarch64' || matrix.arch }}.tar.xz
 
       - name: Download cached nox.${{ matrix.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ matrix.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ matrix.arch == 'arm64' && 'aarch64' || matrix.arch }}|${{ matrix.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{
@@ -343,7 +343,7 @@ jobs:
           python3 -m pip install 'nox==${{ inputs.nox-version }}'
 
       - name: Download cached nox.${{ matrix.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ matrix.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ matrix.arch }}|${{ matrix.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{
@@ -546,7 +546,7 @@ jobs:
           tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-windows-${{ matrix.arch }}.tar.xz
 
       - name: Download cached nox.${{ matrix.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ matrix.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ matrix.arch }}|${{ matrix.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{

.github/workflows/templates/test-salt.yml.jinja

@@ -46,7 +46,7 @@
       distro-slug: <{ slug }>
       nox-session: ci-test-onedir
       platform: darwin
-      arch: x86_64
+      arch: <{ arch }>
       nox-version: <{ nox_version  }>
       gh-actions-python-version: "<{ gh_actions_workflows_python_version }>"
       testrun: ${{ needs.prepare-workflow.outputs.testrun }}

.github/workflows/test-action-macos.yml

@@ -146,7 +146,7 @@ jobs:
           brew install tree
 
       - name: Download cached nox.${{ inputs.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ inputs.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ inputs.arch }}|${{ inputs.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.gh-actions-python-version }}|${{

.github/workflows/test-action.yml

@@ -156,7 +156,7 @@ jobs:
           tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-${{ inputs.platform }}-${{ inputs.arch }}.tar.xz
 
       - name: Download cached nox.${{ inputs.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ inputs.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ inputs.arch }}|${{ inputs.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.gh-actions-python-version }}|${{

.github/workflows/test-package-downloads-action.yml

@@ -231,7 +231,7 @@ jobs:
           tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-linux-${{ matrix.arch == 'arm64' && 'aarch64' || matrix.arch }}.tar.xz
 
       - name: Download cached nox.${{ matrix.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ matrix.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ matrix.arch == 'arm64' && 'aarch64' || matrix.arch }}|${{ matrix.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{
@@ -441,8 +441,11 @@ jobs:
           - distro-slug: macos-13
             arch: x86_64
             pkg-type: package
-          - distro-slug: macos-13
-            arch: x86_64
+          - distro-slug: macos-13-xlarge
+            arch: aarch64
+            pkg-type: package
+          - distro-slug: macos-13-xlarge
+            arch: aarch64
             pkg-type: onedir
 
     steps:
@@ -483,7 +486,7 @@ jobs:
           python3 -m pip install 'nox==${{ inputs.nox-version }}'
 
       - name: Download cached nox.${{ matrix.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ matrix.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ matrix.arch }}|${{ matrix.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{
@@ -690,7 +693,7 @@ jobs:
           tar xvf ${{ inputs.package-name }}-${{ inputs.salt-version }}-onedir-windows-${{ matrix.arch }}.tar.xz
 
       - name: Download cached nox.${{ matrix.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ matrix.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ matrix.arch }}|${{ matrix.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{

.github/workflows/test-packages-action-macos.yml

@@ -155,7 +155,7 @@ jobs:
           python3 -m pip install 'nox==${{ inputs.nox-version }}'
 
       - name: Download cached nox.${{ inputs.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ inputs.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ inputs.arch }}|${{ inputs.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{

.github/workflows/test-packages-action.yml

@@ -153,7 +153,7 @@ jobs:
           tree pkg/artifacts
 
       - name: Download cached nox.${{ inputs.distro-slug }}.tar.* for session ${{ inputs.nox-session }}
-        uses: actions/cache@v3
+        uses: actions/cache@v3.3.1
         with:
           path: nox.${{ inputs.distro-slug }}.tar.*
           key: ${{ inputs.cache-prefix }}|testrun-deps|${{ inputs.arch }}|${{ inputs.distro-slug }}|${{ inputs.nox-session }}|${{ inputs.python-version }}|${{

changelog/64130.fixed.md

@@ -0,0 +1 @@
+Made Salt maintain options in Debian package repo definitions

changelog/64575.fixed.md

@@ -0,0 +1 @@
+Fixed salt-ssh stacktrace when retcode is not an integer

changelog/64588.fixed.md

@@ -0,0 +1 @@
+Fixed SSH shell seldomly fails to report any exit code

pkg/macos/build_python.sh

@@ -243,12 +243,7 @@ else
     # We want to suppress the output here so it looks nice
     # To see the output, remove the output redirection
     _msg "Fetching python (relenv)"
-    relenv fetch --python=$PY_VERSION
-    if [ -f "$RELENV_DIR/build/$PY_VERSION-x86_64-macos.tar.xz" ]; then
-        _success
-    else
-        _failure
-    fi
+    relenv fetch --python=$PY_VERSION && _success || _failure
 fi
 
 _msg "Extracting python environment"
@@ -262,6 +257,7 @@ fi
 #-------------------------------------------------------------------------------
 # Removing Unneeded Libraries from Python
 #-------------------------------------------------------------------------------
+PY_VERSION_MINOR=$($BLD_PY_BIN -c 'import sys; sys.stdout.write("{}.{}".format(*sys.version_info))')
 REMOVE=(
     "idlelib"
     "test"
@@ -269,16 +265,10 @@ REMOVE=(
     "turtledemo"
 )
 for i in "${REMOVE[@]}"; do
-    TEST_DIR="$BUILD_DIR/opt/salt/lib/python3.*/$i"
-    DIR=$(compgen -G "$TEST_DIR")
-    if [ -n "$DIR" ]; then
+    TEST_DIR="$BUILD_DIR/opt/salt/lib/python${PY_VERSION_MINOR}/$i"
+    if [ -d "$TEST_DIR" ]; then
         _msg "Removing $i directory"
-        rm -rf "$DIR"
-        if ! compgen -G "$TEST_DIR" > /dev/null; then
-            _success
-        else
-            _failure
-        fi
+        rm -rf "$TEST_DIR" && _success || _failure
     fi
 done
 

requirements/static/ci/py3.12/windows.txt

@@ -8,10 +8,16 @@ aiohttp==3.9.0
     # via etcd3-py
 aiosignal==1.3.1
     # via aiohttp
+
 annotated-types==0.6.0
     # via
     #   -c requirements/static/ci/../pkg/py3.11/windows.txt
     #   pydantic
+
+async-timeout==4.0.2
+    # via aiohttp
+
+
 attrs==23.1.0
     # via
     #   aiohttp
@@ -58,7 +64,14 @@ cffi==1.14.6
     #   pynacl
 charset-normalizer==3.2.0
     # via
+
     #   -c requirements/static/ci/../pkg/py3.11/windows.txt
+
+    #   -c requirements/static/ci/../pkg/py3.12/windows.txt
+    #   aiohttp
+
+    #   -c requirements/static/ci/../pkg/py3.12/windows.txt
+
     #   requests
 cheetah3==3.2.6.post1
     # via -r requirements/static/ci/common.in

requirements/static/ci/tools.in

@@ -1,7 +1,7 @@
 --constraint=../pkg/py{py_version}/{platform}.txt
 
 attrs
-python-tools-scripts >= 0.18.5
+python-tools-scripts >= 0.18.6
 boto3
 pyyaml
 jinja2

salt/client/ssh/__init__.py

@@ -556,6 +556,11 @@ class SSH(MultiprocessingStateMixin):
         )
         ret = {"id": single.id}
         stdout, stderr, retcode = single.run()
+        try:
+            retcode = int(retcode)
+        except (TypeError, ValueError):
+            log.warning(f"Got an invalid retcode for host '{host}': '{retcode}'")
+            retcode = 1
         # This job is done, yield
         try:
             data = salt.utils.json.find_json(stdout)
@@ -563,7 +568,14 @@ class SSH(MultiprocessingStateMixin):
                 ret["ret"] = data["local"]
                 try:
                     # Ensure a reported local retcode is kept
-                    retcode = data["local"]["retcode"]
+                    remote_retcode = data["local"]["retcode"]
+                    try:
+                        retcode = int(remote_retcode)
+                    except (TypeError, ValueError):
+                        log.warning(
+                            f"Host '{host}' reported an invalid retcode: '{remote_retcode}'"
+                        )
+                        retcode = max(retcode, 1)
                 except (KeyError, TypeError):
                     pass
             else:
@@ -816,6 +828,9 @@ class SSH(MultiprocessingStateMixin):
         final_exit = 0
         for ret, retcode in self.handle_ssh():
             host = next(iter(ret))
+            if not isinstance(retcode, int):
+                log.warning(f"Host '{host}' returned an invalid retcode: {retcode}")
+                retcode = 1
             final_exit = max(final_exit, retcode)
 
             self.cache_job(jid, host, ret[host], fun)

salt/client/ssh/shell.py

@@ -464,6 +464,19 @@ class Shell:
                 if stdout:
                     old_stdout = stdout
                 time.sleep(0.01)
-            return ret_stdout, ret_stderr, term.exitstatus
         finally:
             term.close(terminate=True, kill=True)
+        # Ensure term.close is called before querying the exitstatus, otherwise
+        # it might still be None.
+        ret_status = term.exitstatus
+        if ret_status is None:
+            if term.signalstatus is not None:
+                # The process died because of an unhandled signal, report
+                # a non-zero exitcode bash-style.
+                ret_status = 128 + term.signalstatus
+            else:
+                log.warning(
+                    "VT reported both exitstatus and signalstatus as None. "
+                    "This is likely a bug."
+                )
+        return ret_stdout, ret_stderr, ret_status

salt/modules/aptpkg.py

@@ -203,16 +203,27 @@ if not HAS_APT:
                 repo_line.append("#")
 
             repo_line.append(self.type)
-            opts = []
+            opts = _get_opts(self.line)
             if self.architectures:
-                opts.append("arch={}".format(",".join(self.architectures)))
+                archs = ",".join(self.architectures)
+                opts["arch"]["full"] = f"arch={archs}"
+                opts["arch"]["value"] = self.architectures
             if self.signedby:
-                opts.append(f"signed-by={self.signedby}")
+                opts["signedby"]["full"] = f"signed-by={self.signedby}"
+                opts["signedby"]["value"] = self.signedby
 
-            if opts:
-                repo_line.append("[{}]".format(" ".join(opts)))
+            ordered_opts = [
+                opt_type for opt_type, opt in opts.items() if opt["full"] != ""
+            ]
 
-            repo_line = repo_line + [self.uri, self.dist, " ".join(self.comps)]
+            for opt in opts.values():
+                if opt["full"] != "":
+                    ordered_opts[opt["index"]] = opt["full"]
+
+            if ordered_opts:
+                repo_line.append("[{}]".format(" ".join(ordered_opts)))
+
+            repo_line += [self.uri, self.dist, " ".join(self.comps)]
             if self.comment:
                 repo_line.append(f"#{self.comment}")
             return " ".join(repo_line) + "\n"
@@ -2924,6 +2935,7 @@ def mod_repo(repo, saltenv="base", aptkey=True, **kwargs):
     if "comments" in kwargs:
         kwargs["comments"] = salt.utils.pkg.deb.combine_comments(kwargs["comments"])
 
+    repo_source_entry = SourceEntry(repo)
     if not mod_source:
         mod_source = SourceEntry(repo)
         if "comments" in kwargs:
@@ -2932,12 +2944,7 @@ def mod_repo(repo, saltenv="base", aptkey=True, **kwargs):
     elif "comments" in kwargs:
         mod_source.comment = kwargs["comments"]
 
-    if HAS_APT:
-        # workaround until python3-apt supports signedby
-        if str(mod_source) != str(SourceEntry(repo)) and "signed-by" in str(mod_source):
-            rline = SourceEntry(repo)
-            mod_source.line = rline.line
-
+    mod_source.line = repo_source_entry.line
     if not mod_source.line.endswith("\n"):
         mod_source.line = mod_source.line + "\n"
 

salt/transport/zeromq.py

@@ -712,12 +712,20 @@ class AsyncReqMessageClient:
 
     @tornado.gen.coroutine
     def _send_recv(self, message, future):
-        with (yield self.lock.acquire()):
-            yield self.socket.send(message)
-            recv = yield self.socket.recv()
-        if not future.done():
-            data = salt.payload.loads(recv)
-            future.set_result(data)
+        try:
+            with (yield self.lock.acquire()):
+                yield self.socket.send(message)
+                try:
+                    recv = yield self.socket.recv()
+                except zmq.eventloop.future.CancelledError as exc:
+                    future.set_exception(exc)
+                    return
+
+            if not future.done():
+                data = salt.payload.loads(recv)
+                future.set_result(data)
+        except Exception as exc:  # pylint: disable=broad-except
+            future.set_exception(exc)
 
 
 class ZeroMQSocketMonitor:

tests/pytests/functional/states/test_pkgrepo.py

@@ -5,37 +5,33 @@ import pytest
 import salt.utils.files
 
 
+@pytest.mark.parametrize(
+    "options",
+    [
+        "",
+        "  signed-by=/foo/bar  ",
+        "  trusted=yes",
+        "signed-by=/foo/bar arch=amd64,i386",
+        "signed-by=foo/bar trusted=yes arch=amd64",
+    ],
+)
 @pytest.mark.skipif(
     not any([x for x in ["ubuntu", "debian"] if x in platform.platform()]),
     reason="Test only for debian based platforms",
 )
-def test_adding_repo_file(states, tmp_path):
+def test_adding_repo_file_options(states, tmp_path, options):
     """
     test adding a repo file using pkgrepo.managed
+    and maintaining the user-supplied options
     """
     repo_file = str(tmp_path / "stable-binary.list")
-    repo_content = "deb http://www.deb-multimedia.org stable main"
-    ret = states.pkgrepo.managed(name=repo_content, file=repo_file, clean_file=True)
-    with salt.utils.files.fopen(repo_file, "r") as fp:
-        file_content = fp.read()
-    assert file_content.strip() == repo_content
-
-
-@pytest.mark.skipif(
-    not any([x for x in ["ubuntu", "debian"] if x in platform.platform()]),
-    reason="Test only for debian based platforms",
-)
-def test_adding_repo_file_arch(states, tmp_path):
-    """
-    test adding a repo file using pkgrepo.managed
-    and setting architecture
-    """
-    repo_file = str(tmp_path / "stable-binary.list")
-    repo_content = "deb [arch=amd64  ] http://www.deb-multimedia.org stable main"
+    option = f"[{options}] " if options != "" else ""
+    expected_option = f"[{options.strip()}] " if options != "" else ""
+    repo_content = f"deb {option}http://www.deb-multimedia.org stable main"
     ret = states.pkgrepo.managed(name=repo_content, file=repo_file, clean_file=True)
     with salt.utils.files.fopen(repo_file, "r") as fp:
         file_content = fp.read()
         assert (
             file_content.strip()
-            == "deb [arch=amd64] http://www.deb-multimedia.org stable main"
+            == f"deb {expected_option}http://www.deb-multimedia.org stable main"
         )

tests/pytests/integration/minion/test_return_retries.py

@@ -5,20 +5,20 @@ from saltfactories.utils import random_string
 
 
 @pytest.fixture(scope="function")
-def salt_minion_retry(salt_master_factory, salt_minion_id):
+def salt_minion_retry(salt_master, salt_minion_id):
     # override the defaults for this test
     config_overrides = {
         "return_retry_timer_max": 0,
         "return_retry_timer": 5,
         "return_retry_tries": 30,
     }
-    factory = salt_master_factory.salt_minion_daemon(
+    factory = salt_master.salt_minion_daemon(
         random_string("retry-minion-"),
         overrides=config_overrides,
         extra_cli_arguments_after_first_start_failure=["--log-level=info"],
     )
     factory.after_terminate(
-        pytest.helpers.remove_stale_minion_key, salt_master_factory, factory.id
+        pytest.helpers.remove_stale_minion_key, salt_master, factory.id
     )
 
     with factory.started():
@@ -37,7 +37,7 @@ def test_publish_retry(salt_master, salt_minion_retry, salt_cli, salt_run_cli):
         # verify we don't yet have the result and sleep
         assert salt_run_cli.run("jobs.lookup_jid", jid, _timeout=10).data == {}
 
-        # the 70s sleep (and 60s timer value) is to reduce flakiness due to slower test runs
+        # the 5s sleep (and 60s timeout value) is to reduce flakiness due to slower test runs
         # and should be addresses when number of tries is configurable through minion opts
         time.sleep(5)
 
@@ -62,7 +62,7 @@ def test_pillar_timeout(salt_master_factory):
             {"cmd_json": cmd},
         ],
         "auto_accept": True,
-        "worker_threads": 3,
+        "worker_threads": 2,
         "peer": True,
     }
     minion_overrides = {
@@ -77,7 +77,7 @@ def test_pillar_timeout(salt_master_factory):
         - name: example
         - changes: True
         - result: True
-        - comment: "Nothing has acutally been changed"
+        - comment: "Nothing has actually been changed"
     """
     master = salt_master_factory.salt_master_daemon(
         "pillar-timeout-master",

tests/pytests/unit/client/ssh/test_shell.py

@@ -4,7 +4,7 @@ import types
 import pytest
 
 import salt.client.ssh.shell as shell
-from tests.support.mock import patch
+from tests.support.mock import MagicMock, PropertyMock, patch
 
 
 @pytest.fixture
@@ -52,3 +52,49 @@ def test_ssh_shell_exec_cmd(caplog):
         ret = _shell.exec_cmd("ls {}".format(passwd))
         assert not any([x for x in ret if passwd in str(x)])
         assert passwd not in caplog.text
+
+
+def test_ssh_shell_exec_cmd_waits_for_term_close_before_reading_exit_status():
+    """
+    Ensure that the terminal is always closed before accessing its exitstatus.
+    """
+    term = MagicMock()
+    has_unread_data = PropertyMock(side_effect=(True, True, False))
+    exitstatus = PropertyMock(
+        side_effect=lambda *args: 0 if term._closed is True else None
+    )
+    term.close.side_effect = lambda *args, **kwargs: setattr(term, "_closed", True)
+    type(term).has_unread_data = has_unread_data
+    type(term).exitstatus = exitstatus
+    term.recv.side_effect = (("hi ", ""), ("there", ""), (None, None), (None, None))
+    shl = shell.Shell({}, "localhost")
+    with patch("salt.utils.vt.Terminal", autospec=True, return_value=term):
+        stdout, stderr, retcode = shl.exec_cmd("do something")
+    assert stdout == "hi there"
+    assert stderr == ""
+    assert retcode == 0
+
+
+def test_ssh_shell_exec_cmd_returns_status_code_with_highest_bit_set_if_process_dies():
+    """
+    Ensure that if a child process dies as the result of a signal instead of exiting
+    regularly, the shell returns the signal code encoded in the lowest seven bits with
+    the highest one set, not None.
+    """
+    term = MagicMock()
+    term.exitstatus = None
+    term.signalstatus = 9
+    has_unread_data = PropertyMock(side_effect=(True, True, False))
+    type(term).has_unread_data = has_unread_data
+    term.recv.side_effect = (
+        ("", "leave me alone"),
+        ("", " please"),
+        (None, None),
+        (None, None),
+    )
+    shl = shell.Shell({}, "localhost")
+    with patch("salt.utils.vt.Terminal", autospec=True, return_value=term):
+        stdout, stderr, retcode = shl.exec_cmd("do something")
+    assert stdout == ""
+    assert stderr == "leave me alone please"
+    assert retcode == 137

tests/pytests/unit/client/ssh/test_ssh.py

@@ -3,7 +3,7 @@ import pytest
 import salt.client.ssh.client
 import salt.utils.msgpack
 from salt.client import ssh
-from tests.support.mock import MagicMock, patch
+from tests.support.mock import MagicMock, Mock, patch
 
 pytestmark = [
     pytest.mark.skip_if_binaries_missing("ssh", "ssh-keygen", check_all=True),
@@ -449,3 +449,60 @@ def test_key_deploy_no_permission_denied(tmp_path, opts):
     ret = client.key_deploy(host, ssh_ret)
     assert ret == ssh_ret
     assert mock_key_run.call_count == 0
+
+
+@pytest.mark.parametrize("retcode,expected", [("null", None), ('"foo"', "foo")])
+def test_handle_routine_remote_invalid_retcode(opts, target, retcode, expected, caplog):
+    """
+    Ensure that if a remote returns an invalid retcode as part of the return dict,
+    the final exit code is still an integer and set to 1 at least.
+    """
+    single_ret = (f'{{"local": {{"retcode": {retcode}, "return": "foo"}}}}', "", 0)
+    opts["tgt"] = "localhost"
+    single = MagicMock(spec=ssh.Single)
+    single.id = "localhost"
+    single.run.return_value = single_ret
+    que = Mock()
+
+    with patch("salt.roster.get_roster_file", MagicMock(return_value="")), patch(
+        "salt.client.ssh.Single", autospec=True, return_value=single
+    ):
+        client = ssh.SSH(opts)
+        client.handle_routine(que, opts, "localhost", target)
+    que.put.assert_called_once_with(
+        ({"id": "localhost", "ret": {"retcode": expected, "return": "foo"}}, 1)
+    )
+    assert f"Host 'localhost' reported an invalid retcode: '{expected}'" in caplog.text
+
+
+def test_handle_routine_single_run_invalid_retcode(opts, target, caplog):
+    """
+    Ensure that if Single.run() call returns an invalid retcode,
+    the final exit code is still an integer and set to 1 at least.
+    """
+    single_ret = ("", "Something went seriously wrong", None)
+    opts["tgt"] = "localhost"
+    single = MagicMock(spec=ssh.Single)
+    single.id = "localhost"
+    single.run.return_value = single_ret
+    que = Mock()
+
+    with patch("salt.roster.get_roster_file", MagicMock(return_value="")), patch(
+        "salt.client.ssh.Single", autospec=True, return_value=single
+    ):
+        client = ssh.SSH(opts)
+        client.handle_routine(que, opts, "localhost", target)
+    que.put.assert_called_once_with(
+        (
+            {
+                "id": "localhost",
+                "ret": {
+                    "stdout": "",
+                    "stderr": "Something went seriously wrong",
+                    "retcode": 1,
+                },
+            },
+            1,
+        )
+    )
+    assert "Got an invalid retcode for host 'localhost': 'None'" in caplog.text

tools/ci.py

@@ -1219,7 +1219,6 @@ def upload_coverage(ctx: Context, reports_path: pathlib.Path, commit_sha: str =
         ctx.exit(1)
 
     if TYPE_CHECKING:
-        assert codecov is not None
         assert commit_sha is not None
 
     codecov_args: list[str] = [

tools/pkg/build.py

@@ -483,6 +483,9 @@ def onedir_dependencies(
         assert package_name is not None
         assert platform is not None
 
+    if platform in ("macos", "darwin") and arch == "aarch64":
+        arch = "arm64"
+
     shared_constants = _get_shared_constants()
     if not python_version:
         python_version = shared_constants["python_version"]

tools/pkg/repo/create.py

@@ -890,6 +890,8 @@ def _create_onedir_based_repo(
             arch = "x86"
         elif "-aarch64" in dpath.name.lower():
             arch = "aarch64"
+        elif "-arm64" in dpath.name.lower():
+            arch = "arm64"
         else:
             ctx.error(
                 f"Cannot pickup the right architecture from the filename '{dpath.name}'."

tools/precommit/workflows.py

@@ -122,6 +122,7 @@ def generate_workflows(ctx: Context):
         "macos": [
             ("macos-12", "macOS 12", "x86_64"),
             ("macos-13", "macOS 13", "x86_64"),
+            ("macos-13-xlarge", "macOS 13 Arm64", "aarch64"),
         ],
         "windows": [
             ("windows-2016", "Windows 2016", "amd64"),
@@ -177,6 +178,7 @@ def generate_workflows(ctx: Context):
         "macos": [
             ("macos-12", "macOS 12", "x86_64"),
             ("macos-13", "macOS 13", "x86_64"),
+            ("macos-13-xlarge", "macOS 13 Arm64", "aarch64"),
         ],
         "windows": [
             ("windows-2016", "Windows 2016", "amd64"),
@@ -226,6 +228,7 @@ def generate_workflows(ctx: Context):
         "macos": [
             ("macos-12", "macOS 12", "x86_64"),
             ("macos-13", "macOS 13", "x86_64"),
+            ("macos-13-xlarge", "macOS 13 Arm64", "aarch64"),
         ],
         "windows": [
             ("windows-2016", "Windows 2016", "amd64"),