Merge branch '2016.3' of https://github.com/saltstack/salt into win_dism

doc/man/salt.7

@@ -68771,7 +68771,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit autoscale credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -69032,7 +69032,7 @@ New in version 2015.5.0.
 .TP
 .B configuration
 This module accepts explicit AWS credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -69213,7 +69213,7 @@ New in version 2016.3.0.
 .TP
 .B configuration
 This module accepts explicit Lambda credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -69534,7 +69534,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -69897,7 +69897,7 @@ New in version 2015.5.0.
 .TP
 .B configuration
 This module accepts explicit DynamoDB credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -70972,7 +70972,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit elasticache credentials but can
-also utilize IAM roles assigned to the instance trough Instance Profiles.
+also utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -71335,7 +71335,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit elb credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -71878,7 +71878,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit iam credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -72852,7 +72852,7 @@ New in version 2016.3.0.
 .TP
 .B configuration
 This module accepts explicit Lambda credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -73381,7 +73381,7 @@ New in version 2015.8.0.
 .TP
 .B configuration
 This module accepts explicit kms credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -73825,7 +73825,7 @@ New in version 2016.3.0.
 .TP
 .B configuration
 This module accepts explicit Lambda credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -74375,7 +74375,7 @@ New in version 2015.8.0.
 .TP
 .B configuration
 This module accepts explicit rds credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -74718,7 +74718,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit route53 credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -74944,7 +74944,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit ec2 credentials but can
-also utilize IAM roles assigned to the instance trough Instance Profiles.
+also utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -75247,7 +75247,7 @@ Connection module for Amazon SNS
 .TP
 .B configuration
 This module accepts explicit sns credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles. Dynamic
+utilize IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -75437,7 +75437,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit sqs credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -75593,7 +75593,7 @@ New in version 2014.7.0.
 .TP
 .B configuration
 This module accepts explicit VPC credentials but can also
-utilize IAM roles assigned to the instance trough Instance Profiles.
+utilize IAM roles assigned to the instance through Instance Profiles.
 Dynamic credentials are then automatically obtained from AWS API and no
 further configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -152216,7 +152216,7 @@ Connection module for Amazon S3
 .TP
 .B configuration
 This module accepts explicit s3 credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 7.0
@@ -207334,7 +207334,7 @@ services, and so may incur charges.
 This module uses boto, which can be installed via package, or pip.
 .sp
 This module accepts explicit autoscale credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .INDENT 0.0
@@ -208081,7 +208081,7 @@ Amazon\(aqs services, and so may incur charges.
 This module uses boto, which can be installed via package, or pip.
 .sp
 This module accepts explicit credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 .sp

salt/modules/boto_asg.py

@@ -5,7 +5,7 @@ Connection module for Amazon Autoscale Groups
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit autoscale credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_cfn.py

@@ -5,7 +5,7 @@ Connection module for Amazon Cloud Formation
 .. versionadded:: 2015.5.0
 
 :configuration: This module accepts explicit AWS credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at:
 

salt/modules/boto_cloudtrail.py

@@ -5,7 +5,7 @@ Connection module for Amazon CloudTrail
 .. versionadded:: 2016.3.0
 
 :configuration: This module accepts explicit Lambda credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_cloudwatch.py

@@ -5,7 +5,7 @@ Connection module for Amazon CloudWatch
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at:
 

salt/modules/boto_dynamodb.py

@@ -5,7 +5,7 @@ Connection module for Amazon DynamoDB
 .. versionadded:: 2015.5.0
 
 :configuration: This module accepts explicit DynamoDB credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_elasticache.py

@@ -5,7 +5,7 @@ Connection module for Amazon Elasticache
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit elasticache credentials but can
-    also utilize IAM roles assigned to the instance trough Instance Profiles.
+    also utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_elb.py

@@ -5,7 +5,7 @@ Connection module for Amazon ELB
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit elb credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at:
 

salt/modules/boto_iam.py

@@ -5,7 +5,7 @@ Connection module for Amazon IAM
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit iam credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at:
 

salt/modules/boto_iot.py

@@ -5,7 +5,7 @@ Connection module for Amazon IoT
 .. versionadded:: 2016.3.0
 
 :configuration: This module accepts explicit Lambda credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_kms.py

@@ -5,7 +5,7 @@ Connection module for Amazon KMS
 .. versionadded:: 2015.8.0
 
 :configuration: This module accepts explicit kms credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at::
 

salt/modules/boto_lambda.py

@@ -5,7 +5,7 @@ Connection module for Amazon Lambda
 .. versionadded:: 2016.3.0
 
 :configuration: This module accepts explicit Lambda credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_rds.py

@@ -5,7 +5,7 @@ Connection module for Amazon RDS
 .. versionadded:: 2015.8.0
 
 :configuration: This module accepts explicit rds credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_route53.py

@@ -5,7 +5,7 @@ Connection module for Amazon Route53
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit route53 credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_s3_bucket.py

@@ -5,7 +5,7 @@ Connection module for Amazon S3 Buckets
 .. versionadded:: 2016.3.0
 
 :configuration: This module accepts explicit Lambda credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_secgroup.py

@@ -5,7 +5,7 @@ Connection module for Amazon Security Groups
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit ec2 credentials but can
-    also utilize IAM roles assigned to the instance trough Instance Profiles.
+    also utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/boto_sns.py

@@ -3,7 +3,7 @@
 Connection module for Amazon SNS
 
 :configuration: This module accepts explicit sns credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    utilize IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at:
 

salt/modules/boto_sqs.py

@@ -5,7 +5,7 @@ Connection module for Amazon SQS
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit sqs credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at:
 

salt/modules/boto_vpc.py

@@ -5,7 +5,7 @@ Connection module for Amazon VPC
 .. versionadded:: 2014.7.0
 
 :configuration: This module accepts explicit VPC credentials but can also
-    utilize IAM roles assigned to the instance trough Instance Profiles.
+    utilize IAM roles assigned to the instance through Instance Profiles.
     Dynamic credentials are then automatically obtained from AWS API and no
     further configuration is necessary. More Information available at:
 

salt/modules/s3.py

@@ -3,7 +3,7 @@
 Connection module for Amazon S3
 
 :configuration: This module accepts explicit s3 credentials but can also utilize
-    IAM roles assigned to the instance trough Instance Profiles. Dynamic
+    IAM roles assigned to the instance through Instance Profiles. Dynamic
     credentials are then automatically obtained from AWS API and no further
     configuration is necessary. More Information available at::
 

salt/modules/zypper.py

@@ -973,7 +973,7 @@ def install(name=None,
         fromrepoopt = ''
     cmd_install = ['install', '--name', '--auto-agree-with-licenses']
     if not refresh:
-        cmd_install.append('--no-refresh')
+        cmd_install.insert(0, '--no-refresh')
     if skip_verify:
         cmd_install.append('--no-gpg-checks')
     if downloadonly:

salt/state.py

@@ -30,6 +30,7 @@ import salt.loader
 import salt.minion
 import salt.pillar
 import salt.fileclient
+import salt.utils.dictupdate
 import salt.utils.event
 import salt.utils.url
 import salt.syspaths as syspaths
@@ -695,8 +696,21 @@ class State(object):
                 )
         ret = pillar.compile_pillar()
         if self._pillar_override:
+            merge_strategy = self.opts.get(
+                'pillar_source_merging_strategy',
+                'smart'
+            )
+            merge_lists = self.opts.get(
+                'pillar_merge_lists',
+                False
+            )
             if isinstance(self._pillar_override, dict):
-                ret.update(self._decrypt_pillar_override())
+                ret = salt.utils.dictupdate.merge(
+                    ret,
+                    self._decrypt_pillar_override(),
+                    strategy=merge_strategy,
+                    merge_lists=merge_lists
+                )
             else:
                 decrypted = yamlloader.load(
                     self._decrypt_pillar_override(),
@@ -707,7 +721,12 @@ class State(object):
                         'Decrypted pillar data did not render to a dictionary'
                     )
                 else:
-                    ret.update(decrypted)
+                    ret = salt.utils.dictupdate.merge(
+                        ret,
+                        decrypted,
+                        strategy=merge_strategy,
+                        merge_lists=merge_lists
+                    )
         return ret
 
     def _mod_init(self, low):

salt/states/boto_asg.py

@@ -11,7 +11,7 @@ services, and so may incur charges.
 This module uses boto, which can be installed via package, or pip.
 
 This module accepts explicit autoscale credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 

salt/states/boto_cloudwatch_alarm.py

@@ -10,7 +10,7 @@ Amazon's services, and so may incur charges.
 This module uses boto, which can be installed via package, or pip.
 
 This module accepts explicit credentials but can also utilize
-IAM roles assigned to the instance trough Instance Profiles. Dynamic
+IAM roles assigned to the instance through Instance Profiles. Dynamic
 credentials are then automatically obtained from AWS API and no further
 configuration is necessary. More Information available at:
 

salt/states/boto_s3_bucket.py

@@ -156,19 +156,39 @@ def __virtual__():
     return 'boto_s3_bucket' if 'boto_s3_bucket.exists' in __salt__ else False
 
 
+def _normalize_user(user_dict):
+    ret = deepcopy(user_dict)
+    # 'Type' is required as input to the AWS API, but not returned as output. So
+    # we ignore it everywhere.
+    if 'Type' in ret:
+        del ret['Type']
+    return ret
+
+
 def _get_canonical_id(region, key, keyid, profile):
-    return __salt__['boto_s3_bucket.list'](
+    ret = __salt__['boto_s3_bucket.list'](
         region=region, key=key, keyid=keyid, profile=profile
     ).get('Owner')
+    return _normalize_user(ret)
+
+
+def _prep_acl_for_compare(ACL):
+    '''
+    Prepares the ACL returned from the AWS API for comparison with a given one.
+    '''
+    ret = deepcopy(ACL)
+    ret['Owner'] = _normalize_user(ret['Owner'])
+    for item in ret.get('Grants', ()):
+        item['Grantee'] = _normalize_user(item.get('Grantee'))
+    return ret
 
 
 def _acl_to_grant(ACL, owner_canonical_id):
     if 'AccessControlPolicy' in ACL:
         ret = deepcopy(ACL['AccessControlPolicy'])
-        # Type is required as input, but is not returned as output
-        for item in ret.get('Grants'):
-            if 'Type' in item.get('Grantee', ()):
-                del item['Grantee']['Type']
+        ret['Owner'] = _normalize_user(ret['Owner'])
+        for item in ACL.get('Grants', ()):
+            item['Grantee'] = _normalize_user(item.get('Grantee'))
         # If AccessControlPolicy is set, other options are not allowed
         return ret
     ret = {
@@ -281,7 +301,7 @@ def _compare_acl(current, desired, region, key, keyid, profile):
     rather than the input itself.
     '''
     ocid = _get_canonical_id(region, key, keyid, profile)
-    return json_objs_equal(current, _acl_to_grant(desired, ocid))
+    return json_objs_equal(_prep_acl_for_compare(current), _acl_to_grant(desired, ocid))
 
 
 def _compare_policy(current, desired, region, key, keyid, profile):

tests/unit/states/boto_s3_bucket_test.py

@@ -89,6 +89,7 @@ if _has_required_boto():
             'CreationDate': None
         }],
         'Owner': {
+            'Type': 'CanonicalUser',
             'DisplayName': 'testuser',
             'ID': '111111222222'
         },