Release v3006.10

- Work around WMIC disks grain failure by overriding the minion's grain.
- Use static master config directory on windows so it can be re-used by
  the pkg integration tests.

.github/actions/setup-actionlint/action.yml

@@ -5,7 +5,7 @@ description: Setup actionlint
 inputs:
   version:
     description: The version of actionlint
-    default: 1.6.26
+    default: 1.7.7
   cache-seed:
     required: true
     description: Seed used to invalidate caches

.github/workflows/draft-release.yml

@@ -49,13 +49,21 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          release_name: "Release v${{ inputs.salt-version }}"
+          release_name: "v${{ inputs.salt-version }}"
           tag_name: v${{ inputs.salt-version }}
           draft: true
           prerelease: false
       - name: Release Output
         run: echo "upload_url=${{ steps.create_release.outputs.upload_url }}" >> "$GITHUB_OUTPUT"
 
+  upload-release-patch:
+    needs:
+      - create-github-release
+    uses: ./.github/workflows/release-artifact.yml
+    with:
+      name: salt-${{ inputs.salt-version }}.patch
+      upload_url: ${{ needs.create-github-release.outputs.upload_url }}
+
   upload-source-tarball:
     needs:
       - create-github-release

.github/workflows/release-tag.yml

@@ -1,84 +0,0 @@
----
-name: Generate Tag and Github Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      saltVersion:
-        description: 'Salt Version'
-        required: true
-      saltRepo:
-        description: 'Salt Repo'
-        default: saltstack/salt
-      saltBranch:
-        description: 'Salt Branch'
-        default: freeze
-      reTag:
-        description: 'Re Tag (Deletes tag and release)'
-        default: false
-
-
-env:
-  PIP_INDEX_URL: ${{ vars.PIP_INDEX_URL }}
-  PIP_TRUSTED_HOST: ${{ vars.PIP_TRUSTED_HOST }}
-  PIP_EXTRA_INDEX_URL: ${{ vars.PIP_EXTRA_INDEX_URL }}
-
-
-permissions:
-  contents: read
-
-jobs:
-  GenerateTagRelease:
-    permissions:
-      contents: write  # for dev-drprasad/delete-tag-and-release to delete tags or releases
-    name: Generate Tag and Github Release
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: dev-drprasad/delete-tag-and-release@v0.2.0
-      if: github.event.inputs.reTag == 'true'
-      with:
-        delete_release: true # default: false
-        tag_name: v${{ github.event.inputs.saltVersion }}
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-    - uses: actions/checkout@v4
-      with:
-        repository: ${{ github.event.inputs.saltRepo }}
-        ref: ${{ github.event.inputs.saltBranch }}
-    - name: Bump version and push tag
-      id: tag_version
-      uses: mathieudutour/github-tag-action@v5.6
-      with:
-        create_annotated_tag: True
-        github_token: ${{ secrets.GITHUB_TOKEN }}
-        custom_tag: ${{ github.event.inputs.saltVersion }}
-
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v5
-      with:
-        python-version: 3.8
-
-    - uses: actions/checkout@v4
-    - name: Install pypa/build
-      run: |
-        python -m pip install build --user
-    - name: Build a binary wheel and a source tarball
-      run: |
-        git fetch --tags origin
-        git checkout v${{ github.event.inputs.saltVersion }}
-        chmod 700 conf/cloud.*.d
-        chmod 600 conf/cloud
-        chmod 600 conf/cloud.profiles
-        chmod 600 conf/cloud.providers
-        python3 setup.py --ssh-packaging sdist
-        python -m build --sdist --outdir dist/ .
-    - name: Create a GitHub release
-      uses: ncipollo/release-action@v1
-      with:
-        tag: ${{ steps.tag_version.outputs.new_tag }}
-        name: Release ${{ steps.tag_version.outputs.new_tag }}
-        body: |
-          WARNING: The tarball generated by GitHub will not have the correct version information when using a version not ending in .0 . Please use the tarball generated by SaltStack instead. See issue #41847 for more information.
-          Official Salt packages can be found at https://repo.saltproject.io/
-        artifacts: dist/salt*.tar.gz

.github/workflows/release-update-winrepo.yml

@@ -59,7 +59,7 @@ jobs:
 
     - name: Create Pull Request
       id: cpr
-      uses: peter-evans/create-pull-request@v4
+      uses: peter-evans/create-pull-request@v7
       with:
         path: winrepo
         push-to-fork: saltbot-open/salt-winrepo-ng

.github/workflows/release.yml

@@ -1,7 +1,3 @@
-# Do not edit these workflows directly as the changes made will be overwritten.
-# Instead, edit the template '.github/workflows/templates/release.yml.jinja'
----
-
 name: Release
 run-name: "Release (branch: ${{ github.ref_name }}; version: ${{ inputs.salt-version }})"
 
@@ -28,6 +24,7 @@ env:
 
 permissions:
   contents: write  # To be able to publish the release
+  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.repository }}
@@ -49,7 +46,7 @@ jobs:
   prepare-workflow:
     name: Prepare Workflow Run
     runs-on:
-      - linux-x86_64
+      - ubuntu-24.04
     env:
       USE_S3_CACHE: 'false'
     environment: release
@@ -61,7 +58,6 @@ jobs:
       latest-release: ${{ steps.get-salt-releases.outputs.latest-release }}
       releases: ${{ steps.get-salt-releases.outputs.releases }}
       nox-archive-hash: ${{ steps.nox-archive-hash.outputs.nox-archive-hash }}
-      config: ${{ steps.workflow-config.outputs.config }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -97,12 +93,6 @@ jobs:
             tools pkg repo confirm-unreleased --repository saltstack/salt ${{ steps.setup-salt-version.outputs.salt-version }}
           fi
 
-      - name: Check Release Staged
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          tools pkg repo confirm-staged --repository ${{ github.repository }} ${{ steps.setup-salt-version.outputs.salt-version }}
-
       - name: Get Salt Releases
         id: get-salt-releases
         env:
@@ -120,152 +110,14 @@ jobs:
         run: |
           echo "nox-archive-hash=${{ hashFiles('requirements/**/*.txt', 'cicd/golden-images.json', 'noxfile.py', 'pkg/common/env-cleanup-rules.yml', '.github/workflows/build-deps-ci-action.yml') }}" | tee -a "$GITHUB_OUTPUT"
 
-      - name: Define workflow config
-        id: workflow-config
-        run: |
-          tools ci workflow-config${{ inputs.skip-salt-pkg-download-test-suite && ' --skip-pkg-download-tests' || '' }} ${{ steps.setup-salt-version.outputs.salt-version }} ${{ github.event_name }} changed-files.json
-
-  download-onedir-artifact:
-    name: Download Staging Onedir Artifact
-    runs-on:
-      - linux-x86_64
-    env:
-      USE_S3_CACHE: 'true'
-    environment: release
-    needs:
-      - prepare-workflow
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - platform: linux
-            arch: x86_64
-          - platform: linux
-            arch: arm64
-          - platform: windows
-            arch: amd64
-          - platform: windows
-            arch: x86
-          - platform: macos
-            arch: x86_64
-          - platform: macos
-            arch: arm64
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-        with:
-          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Download Onedir Tarball Artifact
-        run: |
-          tools release download-onedir-artifact --platform=${{ matrix.platform }} --arch=${{ matrix.arch }} ${{ inputs.salt-version }}
-
-      - name: Upload Onedir Tarball as an Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: salt-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz
-          path: artifacts/salt-${{ inputs.salt-version }}-onedir-${{ matrix.platform }}-${{ matrix.arch }}.tar.xz*
-          retention-days: 7
-          if-no-files-found: error
-  build-ci-deps:
-    name: CI Deps
-    needs:
-      - prepare-workflow
-      - download-onedir-artifact
-    uses: ./.github/workflows/build-deps-ci-action.yml
-    with:
-      nox-session: ci-test-onedir
-      nox-version: 2022.8.7
-      python-version: "3.10"
-      salt-version: "${{ needs.prepare-workflow.outputs.salt-version }}"
-      cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}|3.10.16
-      nox-archive-hash: "${{ needs.prepare-workflow.outputs.nox-archive-hash }}"
-      matrix: ${{ toJSON(fromJSON(needs.prepare-workflow.outputs.config)['build-matrix']) }}
-      linux_arm_runner: ${{ fromJSON(needs.prepare-workflow.outputs.config)['linux_arm_runner'] }}
-
-  backup:
-    name: Backup
-    runs-on:
-      - linux-x86_64
-    needs:
-      - prepare-workflow
-    env:
-      USE_S3_CACHE: 'true'
-    environment: release
-    outputs:
-      backup-complete: ${{ steps.backup.outputs.backup-complete }}
-
-    steps:
-      - name: Clone The Salt Repository
-        uses: actions/checkout@v4
-
-      - name: Setup Rclone
-        uses: AnimMouse/setup-rclone@v1
-        with:
-          version: v1.61.1
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-        with:
-          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-
-      - name: Backup Previous Releases
-        id: backup
-        run: |
-          tools pkg repo backup-previous-releases
-
-  publish-repositories:
-    name: Publish Repositories
-    runs-on:
-      - linux-x86_64
-    env:
-      USE_S3_CACHE: 'true'
-    needs:
-      - prepare-workflow
-      - backup
-      - download-onedir-artifact
-    environment: release
-    steps:
-      - name: Clone The Salt Repository
-        uses: actions/checkout@v4
-
-      - name: Get Salt Project GitHub Actions Bot Environment
-        run: |
-          TOKEN=$(curl -sS -f -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 30")
-          SPB_ENVIRONMENT=$(curl -sS -f -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/tags/instance/spb:environment)
-          echo "SPB_ENVIRONMENT=$SPB_ENVIRONMENT" >> "$GITHUB_ENV"
-
-      - name: Setup Python Tools Scripts
-        uses: ./.github/actions/setup-python-tools-scripts
-        with:
-          cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
-
-      - name: Publish Release Repository
-        env:
-          SALT_REPO_DOMAIN_RELEASE: ${{ vars.SALT_REPO_DOMAIN_RELEASE || 'repo.saltproject.io' }}
-          SALT_REPO_DOMAIN_STAGING: ${{ vars.SALT_REPO_DOMAIN_STAGING || 'staging.repo.saltproject.io' }}
-        run: |
-          tools pkg repo publish release ${{ needs.prepare-workflow.outputs.salt-version }}
-
   release:
     name: Release v${{ needs.prepare-workflow.outputs.salt-version }}
     if: ${{ always() && ! failure() && ! cancelled() }}
-    runs-on:
+    runs-on: ubuntu-24.04
-      - linux-x86_64
     env:
-      USE_S3_CACHE: 'true'
+      USE_S3_CACHE: 'false'
     needs:
       - prepare-workflow
-      - backup
-      - publish-repositories
     environment: release
     steps:
       - name: Clone The Salt Repository
@@ -273,46 +125,16 @@ jobs:
         with:
           ssh-key: ${{ secrets.GHA_SSH_KEY }}
 
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts
         with:
           cache-prefix: ${{ needs.prepare-workflow.outputs.cache-seed }}
 
-      - name: Setup GnuPG
-        run: |
-          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
-          GNUPGHOME="$(mktemp -d -p /run/gpg)"
-          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
-          cat <<EOF > "${GNUPGHOME}/gpg.conf"
-          batch
-          no-tty
-          pinentry-mode loopback
-          EOF
-
-      - name: Get Secrets
-        id: get-secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text | jq .default_key -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -d - \
-            | gpg --import -
-          sync
-          aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/signing/repo-signing-keys-sha256-2023 \
-            --query SecretString --output text| jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "${SECRETS_KEY_FILE}" -o "${GNUPGHOME}/passphrase" -d -
-          sync
-          rm "$SECRETS_KEY_FILE"
-          echo "passphrase-file ${GNUPGHOME}/passphrase" >> "${GNUPGHOME}/gpg.conf"
-
-      - name: Prepare Release
-        id: prepare-release
-        run: |
-          tools pkg repo publish github --repository ${{ github.repository }} --key-id=64CBBC8173D76B3F ${{ needs.prepare-workflow.outputs.salt-version }}
-
       - name: Configure Git
         shell: bash
         run: |
@@ -322,47 +144,48 @@ jobs:
           git config --global user.signingkey 64CBBC8173D76B3F
           git config --global commit.gpgsign true
 
+      - name: Setup GnuPG
+        env:
+          SIGNING_GPG_KEY: ${{ secrets.SIGNING_GPG_KEY }}
+          SIGNING_PASSPHRASE: ${{ secrets.SIGNING_PASSPHRASE }}
+        run: |
+          sudo install -d -m 0700 -o "$(id -u)" -g "$(id -g)" /run/gpg
+          GNUPGHOME="$(mktemp -d -p /run/gpg)"
+          export GNUPGHOME
+          echo "GNUPGHOME=${GNUPGHOME}" >> "$GITHUB_ENV"
+          cat <<EOF > "${GNUPGHOME}/gpg.conf"
+          batch
+          no-tty
+          pinentry-mode loopback
+          passphrase-file ${GNUPGHOME}/passphrase
+          EOF
+          echo "${SIGNING_PASSPHRASE}" > "${GNUPGHOME}/passphrase"
+          echo "${SIGNING_GPG_KEY}" | gpg --import -
+
+      - name: Download Release Patch
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir -p artifacts/release
+          gh release download \
+            -D artifacts/release \
+            -p 'salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch' \
+            v${{ needs.prepare-workflow.outputs.salt-version }}
+
       - name: Apply The Release Patch
         run: |
-          git am --committer-date-is-author-date release-artifacts/salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch
+          git am --committer-date-is-author-date artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch
-          rm release-artifacts/salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch
+          rm artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.patch
 
       - name: Tag The v${{ needs.prepare-workflow.outputs.salt-version }} Release
         run: |
           git tag -m "Release v${{ needs.prepare-workflow.outputs.salt-version }}" -as v${{ needs.prepare-workflow.outputs.salt-version }}
 
-      - name: Push Changes
+      - name: Push tag
-        uses: ad-m/github-push-action@b87afee92c6e70ea888be6203a3e9426fda49839
+        run: |
-        with:
+          git config user.name "GitHub Actions"
-          ssh: true
+          git config user.email "github-actions@users.noreply.github.com"
-          tags: true
+          git push origin v${{ inputs.salt-version }}
-          atomic: true
-          branch: ${{ github.ref }}
-
-      - name: Create Github Release
-        uses: ncipollo/release-action@v1
-        with:
-          artifactErrorsFailBuild: true
-          artifacts: ${{ steps.prepare-release.outputs.release-artifacts }}
-          bodyFile: ${{ steps.prepare-release.outputs.release-messsage-file }}
-          draft: false
-          generateReleaseNotes: false
-          makeLatest: fromJSON(${{ steps.prepare-release.outputs.make-latest }})
-          name: v${{ needs.prepare-workflow.outputs.salt-version }}
-          prerelease: ${{ contains(needs.prepare-workflow.outputs.salt-version, 'rc') }}
-          removeArtifacts: true
-          replacesArtifacts: true
-          tag: v${{ needs.prepare-workflow.outputs.salt-version }}
-
-      - name: Upload PyPi Artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: pypi-artifacts
-          path: |
-            release-artifacts/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
-            release-artifacts/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz.asc
-          retention-days: 7
-          if-no-files-found: error
 
   publish-pypi:
     name: Publish to PyPi
@@ -371,13 +194,17 @@ jobs:
       - prepare-workflow
       - release
     environment: release
-    runs-on:
+    runs-on: ubuntu-24.04
-      - linux-x86_64
     env:
-      USE_S3_CACHE: 'true'
+      USE_S3_CACHE: 'false'
     steps:
       - uses: actions/checkout@v4
 
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
       - name: Setup Python Tools Scripts
         uses: ./.github/actions/setup-python-tools-scripts
         with:
@@ -394,30 +221,39 @@ jobs:
           pinentry-mode loopback
           EOF
 
-      - name: Get Secrets
-        id: get-secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          TWINE_PASSWORD=$(aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/publishing/publish-pypi \
-            --query SecretString --output text | jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "$SECRETS_KEY_FILE" -d -)
-          echo "::add-mask::$TWINE_PASSWORD"
-          echo "twine-password=$TWINE_PASSWORD" >> "${GITHUB_OUTPUT}"
-
       - name: Download PyPi Artifacts
-        uses: actions/download-artifact@v4
+        env:
-        with:
+          GH_TOKEN: ${{ github.token }}
-          name: pypi-artifacts
+        run: |
-          path: artifacts/release
+          mkdir -p artifacts/release
+          gh release download \
+            -D artifacts/release \
+            -p 'salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz' \
+            v${{ needs.prepare-workflow.outputs.salt-version }}
 
       - name: Publish to PyPi
         env:
-          TWINE_PASSWORD: "${{ steps.get-secrets.outputs.twine-password }}"
+          TWINE_PASSWORD: "${{ secrets.TWINE_PASSWORD }}"
         run: |
           tools pkg pypi-upload artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
+
+  publish-draft:
+    name: Publish Relase v${{ needs.prepare-workflow.outputs.salt-version }}
+    if: ${{ !cancelled() && always() }}
+    runs-on: ubuntu-22.04
+    needs:
+      - check-requirements
+      - prepare-workflow
+      - release
+      - publish-pypi
+    steps:
+      - uses: actions/checkout@v4
+      - name: Publish Release v${{ needs.prepare-workflow.outputs.salt-version }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release edit v${{ inputs.salt-version }} --draft=false
+
   set-pipeline-exit-status:
     # This step is just so we can make github require this step, to pass checks
     # on a pull request instead of requiring all
@@ -427,10 +263,9 @@ jobs:
     needs:
       - check-requirements
       - prepare-workflow
-      - publish-repositories
       - release
       - publish-pypi
-      - build-ci-deps
+      - publish-draft
     steps:
       - name: Get workflow information
         id: get-workflow-info

.github/workflows/staging.yml

@@ -607,19 +607,6 @@ jobs:
           pinentry-mode loopback
           EOF
 
-      - name: Get Secrets
-        id: get-secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          TWINE_PASSWORD=$(aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/publishing/publish-test-pypi \
-            --query SecretString --output text | jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "$SECRETS_KEY_FILE" -d -)
-          echo "::add-mask::$TWINE_PASSWORD"
-          echo "twine-password=$TWINE_PASSWORD" >> "${GITHUB_OUTPUT}"
-
       - name: Download PyPi Artifacts
         uses: actions/download-artifact@v4
         with:
@@ -628,7 +615,7 @@ jobs:
 
       - name: Publish to Test PyPi
         env:
-          TWINE_PASSWORD: "${{ steps.get-secrets.outputs.twine-password }}"
+          TWINE_PASSWORD: "${{ secrets.PYPI_TEST_PASSWORD }}"
         run: |
           tools pkg pypi-upload --test artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
 

.github/workflows/templates/staging.yml.jinja

@@ -151,19 +151,6 @@ on:
           pinentry-mode loopback
           EOF
 
-      - name: Get Secrets
-        id: get-secrets
-        env:
-          SECRETS_KEY: ${{ secrets.SECRETS_KEY }}
-        run: |
-          SECRETS_KEY_FILE=$(mktemp /tmp/output.XXXXXXXXXX)
-          echo "$SECRETS_KEY" > "$SECRETS_KEY_FILE"
-          TWINE_PASSWORD=$(aws --region us-west-2 secretsmanager get-secret-value --secret-id /cmbu-saltstack/publishing/publish-test-pypi \
-            --query SecretString --output text | jq .default_passphrase -r | base64 -d \
-            | gpg --passphrase-file "$SECRETS_KEY_FILE" -d -)
-          echo "::add-mask::$TWINE_PASSWORD"
-          echo "twine-password=$TWINE_PASSWORD" >> "${GITHUB_OUTPUT}"
-
       - name: Download PyPi Artifacts
         uses: actions/download-artifact@v4
         with:
@@ -172,7 +159,7 @@ on:
 
       - name: Publish to Test PyPi
         env:
-          TWINE_PASSWORD: "${{ steps.get-secrets.outputs.twine-password }}"
+          TWINE_PASSWORD: "${{ secrets.PYPI_TEST_PASSWORD }}"
         run: |
           tools pkg pypi-upload --test artifacts/release/salt-${{ needs.prepare-workflow.outputs.salt-version }}.tar.gz
 

.github/workflows/test-packages-action.yml

@@ -294,6 +294,15 @@ jobs:
           rm -rf artifacts/salt*
           tree -a artifacts
 
+      - name: Upload Test Run Log Artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: pkg-testrun-log-artifacts-${{ matrix.slug }}-${{ matrix.pkg_type }}-${{ matrix.arch }}-${{ matrix.tests-chunk }}-${{ matrix.version || 'no-version'}}-${{ env.TIMESTAMP }}
+          path: |
+            artifacts/logs
+          include-hidden-files: true
+
       - name: Upload Test Run Artifacts
         if: always()
         uses: actions/upload-artifact@v4
@@ -328,7 +337,6 @@ jobs:
         run: |
           t=$(python3 -c 'import random, sys; sys.stdout.write(str(random.randint(1, 15)))'); echo "Sleeping $t seconds"; sleep "$t"
 
-
       - name: "Set `TIMESTAMP` environment variable"
         shell: bash
         run: |
@@ -433,7 +441,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: pkg-testrun-log-artifacts-${{ matrix.slug }}-${{ inputs.nox-session }}-${{ matrix.transport }}-${{ matrix.tests-chunk }}-${{ env.TIMESTAMP }}
+          name: pkg-testrun-log-artifacts-${{ matrix.slug }}-${{ matrix.pkg_type }}-${{ matrix.arch }}-${{ matrix.tests-chunk }}-${{ inputs.salt-version }}-${{ matrix.version || 'no-version'}}-${{ env.TIMESTAMP }}
           path: |
             artifacts/logs
           include-hidden-files: true
@@ -442,7 +450,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: pkg-testrun-artifacts-${{ matrix.slug }}-${{ matrix.pkg_type }}-${{ matrix.arch }}-${{ matrix.tests-chunk }}-${{ matrix.version || 'no-version'}}-${{ env.TIMESTAMP }}
+          name: pkg-testrun-artifacts-${{ matrix.slug }}-${{ matrix.pkg_type }}-${{ matrix.arch }}-${{ matrix.tests-chunk }}-${{ inputs.salt-version }}-${{ matrix.version || 'no-version'}}-${{ env.TIMESTAMP }}
           path: |
             artifacts/
             !artifacts/pkg/*

.github/workflows/triage.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Download last assignment cache
         continue-on-error: true
-        uses: dawidd6/action-download-artifact@v2
+        uses: dawidd6/action-download-artifact@v3
         with:
           workflow: triage.yml
           name: last-assignment

CHANGELOG.md

@@ -7,6 +7,121 @@ Versions are `MAJOR.PATCH`.
 
 # Changelog
 
+## 3006.10 (2025-03-19)
+
+
+### Removed
+
+- Remove psutil_compat.py file, which should have been removed when RHEL 6 EOL [#66467](https://github.com/saltstack/salt/issues/66467)
+- Removed dependency on bsdmainutils package for Debian and Ubuntu [#67184](https://github.com/saltstack/salt/issues/67184)
+
+
+### Deprecated
+
+- Drop Arch Linux support [#66886](https://github.com/saltstack/salt/issues/66886)
+- Removed support for end of life Python 3.7 and 3.8 from pre-commit and requirements [#67729](https://github.com/saltstack/salt/issues/67729)
+
+
+### Fixed
+
+- Commands on Windows are now prefixed with ``cmd /c`` so that compound
+  commands (commands separated by ``&&``) run properly when using ``runas`` [#44736](https://github.com/saltstack/salt/issues/44736)
+- Issue 58969: Fixes an issue with `saltclass.expand_classes_in_order`
+  function where it was losing nested classes states during class
+  expansion. The logic now use `salt.utils.odict.OrderedDict` to keep
+  the inclusion ordering. [#58969](https://github.com/saltstack/salt/issues/58969)
+- Fix issue with RunAs on Windows so that usernames of all numeric characters
+  are handled as strings [#59344](https://github.com/saltstack/salt/issues/59344)
+- Fixed an issue on Windows where checking success_retcodes when using the
+  runas parameter would fail. Now success_retcodes are checked correctly [#59977](https://github.com/saltstack/salt/issues/59977)
+- Fix an issue with cmd.script in Windows so that the exit code from a script will
+  be passed through to the retcode of the state [#60884](https://github.com/saltstack/salt/issues/60884)
+- Fixed an issue uninstalling packages on Windows using pkg.removed where there
+  are multiple versions of the same software installed [#61001](https://github.com/saltstack/salt/issues/61001)
+- Ensure file clients for runner, wheel, local and caller are available from the client_cache if called upon. [#61416](https://github.com/saltstack/salt/issues/61416)
+- Convert stdin string to bytes regardless of stdin_raw_newlines [#62501](https://github.com/saltstack/salt/issues/62501)
+- Issue 63933: Fixes an issue with `saltclass.expanded_dict_from_minion`
+  function where it was passing a reference to minion `dict` which was
+  overridden by nested classes during class expansion. Copy the node
+  definition with `copy.deepcopy` instead of passing a reference. [#63933](https://github.com/saltstack/salt/issues/63933)
+- Fixed an intermittent issue with file.recurse where the state would
+  report failure even on success. Makes sure symlinks are created
+  after the target file is created [#64630](https://github.com/saltstack/salt/issues/64630)
+- The 'profile' outputter does not crash with incorrectly formatted data [#65104](https://github.com/saltstack/salt/issues/65104)
+- Updating version comparison for rpm and removed obsolete comparison methods for rpms [#65443](https://github.com/saltstack/salt/issues/65443)
+- Fix batch mode hang indefinitely in some scenarios [#66249](https://github.com/saltstack/salt/issues/66249)
+- Applying `selinux.fcontext_policy_present` to a shorter path than an existing entry now works [#66252](https://github.com/saltstack/salt/issues/66252)
+- Correct bash-completion for Debian / Ubuntu [#66560](https://github.com/saltstack/salt/issues/66560)
+- Fix minion config option startup_states [#66592](https://github.com/saltstack/salt/issues/66592)
+- Fixed an issue with cmd.run with requirements when the shell is not the
+  default [#66596](https://github.com/saltstack/salt/issues/66596)
+- Fixes an issue when getting account names using the get_name function in the
+  win_dacl.py salt util. Capability SIDs return ``None``. SIDs for deleted
+  accounts return the SID. SIDs for domain accounts where the system is not
+  connected to the domain return the SID. [#66637](https://github.com/saltstack/salt/issues/66637)
+- Fixed an issue where ``status.master`` wasn't detecting a connection to the
+  specified master properly [#66716](https://github.com/saltstack/salt/issues/66716)
+- Fixed ``win_wua.available`` when some of the update objects are empty CDispatch
+  objects. The ``available`` function no longer crashes [#66718](https://github.com/saltstack/salt/issues/66718)
+- Clean up multiprocessing file handles on minion [#66726](https://github.com/saltstack/salt/issues/66726)
+- Fixed nacl.keygen for not yet existing sk_file or pk_file [#66772](https://github.com/saltstack/salt/issues/66772)
+- fix yaml output [#66783](https://github.com/saltstack/salt/issues/66783)
+- Fixed an issue where enabling `grain_opts` in the minion config would cause
+  some core grains to be overwritten. [#66784](https://github.com/saltstack/salt/issues/66784)
+- Fix an issue where files created using `salt.utils.atomicile.atomic_open()`
+  were created with restrictive permissions instead of respecting the umask. [#66786](https://github.com/saltstack/salt/issues/66786)
+- Fix bad async_method name on AsyncPubClient class [#66789](https://github.com/saltstack/salt/issues/66789)
+- Ensure Manjaro ARM reports the correct os_family of Arch. [#66796](https://github.com/saltstack/salt/issues/66796)
+- Removed ``salt.utils.data.decode`` usage from the fileserver. This function was
+  necessary to support Python 2. This speeds up loading the list cache by 80-90x. [#66835](https://github.com/saltstack/salt/issues/66835)
+- Issue 66837: Fixes an issue with the `network.local_port_tcp` function
+  where it was not parsing the IPv4 mapped IPv6 address correctly. The
+  ``::ffff:`` is now removed and only the IP address is returned. [#66837](https://github.com/saltstack/salt/issues/66837)
+- Better handling output of `systemctl --version` with salt.grains.core._systemd [#66856](https://github.com/saltstack/salt/issues/66856)
+- Upgrade relenv to 0.17.3. This release includes python 3.10.15, openssl 3.2.3,
+  and fixes for pip 24.2. [#66858](https://github.com/saltstack/salt/issues/66858)
+- Remove caching of 'systemctl status' in systemd_service to fix automatic daemon-reload for repeated invocations. [#66864](https://github.com/saltstack/salt/issues/66864)
+- Added cryptogrpahy back to base.txt requirements as a dependency [#66883](https://github.com/saltstack/salt/issues/66883)
+- Remove "perms" from `linux_acl.list_absent()` documentation [#66891](https://github.com/saltstack/salt/issues/66891)
+- Ensure minion start event coroutines are run [#66932](https://github.com/saltstack/salt/issues/66932)
+- Allow for secure-boot efivars directory having SecureBoot-xxx files, not directories with a data file [#66955](https://github.com/saltstack/salt/issues/66955)
+- Removed the usage of wmic to get the disk and iscsi grains for Windows. The wmic
+  binary is being deprecated. [#66959](https://github.com/saltstack/salt/issues/66959)
+- Fixes an issue with the LGPO module when trying to parse ADMX/ADML files
+  that have a space in the XMLNS url in the policyDefinitionsResources header. [#66992](https://github.com/saltstack/salt/issues/66992)
+- Ensured global dunders like __env__ are defined in state module that are run in parallel on spawning platforms [#66996](https://github.com/saltstack/salt/issues/66996)
+- Filtered unpicklable objects from the context dict when invoking states in parallel on spawning platforms to avoid a crash [#66999](https://github.com/saltstack/salt/issues/66999)
+- Update for deprecation of hex in pygit2 1.15.0 and above [#67017](https://github.com/saltstack/salt/issues/67017)
+- Fixed blob path for salt.ufw in the firewall tutorial documentation [#67019](https://github.com/saltstack/salt/issues/67019)
+- Update locations for bootstrap scripts, to new infrastructure, GitHub releases for bootstrap [#67020](https://github.com/saltstack/salt/issues/67020)
+- Constrained the localfs module to operations inside the specified cachedir [#67031](https://github.com/saltstack/salt/issues/67031)
+- Added support for dnf5 (backport from 3007) and update to its new command syntax changes since 2023 [#67057](https://github.com/saltstack/salt/issues/67057)
+- Recognise newer AMD GPU devices [#67058](https://github.com/saltstack/salt/issues/67058)
+- Fix yumpkg module for Python<3.8 [#67091](https://github.com/saltstack/salt/issues/67091)
+- Fixed an issue with making changes to the Windows Firewall when the
+  AllowInboundRules setting is set to True [#67122](https://github.com/saltstack/salt/issues/67122)
+- Added support and tests for dnf5 to services_need_restart for yum packages [#67177](https://github.com/saltstack/salt/issues/67177)
+- Use os.walk to traverse git branches, and no longer replace slash '/' in git branch names [#67722](https://github.com/saltstack/salt/issues/67722)
+- Set correct virtual grain in systemd based Podman containers [#67733](https://github.com/saltstack/salt/issues/67733)
+- Corrected option --upgrades for dnf[5] for function list_upgrades [#67743](https://github.com/saltstack/salt/issues/67743)
+- Fix salt-ssh for hosts that use password as the SSH password [#67754](https://github.com/saltstack/salt/issues/67754)
+- Corrected dnf5 option --downloadonly for dnf5 install [#67769](https://github.com/saltstack/salt/issues/67769)
+- Upgrade relenv to 0.18.1. Which includes python 3.10.16 and openssl 3.2.4.
+  Openssl 3.2.4 fixes CVE-2024-12797 and CVE-2024-13176 [#67792](https://github.com/saltstack/salt/issues/67792)
+- Update jinja2 to 3.1.5, advisories GHSA-q2x7-8rv6-6q7h and GHSA-gmj6-6f8f-6699
+  Update urllib3 to 1.26.18 advisories GHSA-34jh-p97f-mpxf [#67794](https://github.com/saltstack/salt/issues/67794)
+- Ensure salt-cloud has salt-master dependency on Debian and Ubuntu [#67810](https://github.com/saltstack/salt/issues/67810)
+- Fix traceback from _send_req_sync method on minion by raising proper timeout error. [#67891](https://github.com/saltstack/salt/issues/67891)
+
+
+### Added
+
+- Issue #33669: Fixes an issue with the ``ini_managed`` execution module
+  where it would always wrap the separator with spaces. Adds a new parameter
+  named ``no_spaces`` that will not warp the separator with spaces. [#33669](https://github.com/saltstack/salt/issues/33669)
+- Enhance json.find_json to return json even when it contains text on the same line of the last closing parenthesis [#67023](https://github.com/saltstack/salt/issues/67023)
+
+
 ## 3006.9 (2024-07-29)
 
 

changelog/33669.added.md

@@ -1,3 +0,0 @@
-Issue #33669: Fixes an issue with the ``ini_managed`` execution module
-where it would always wrap the separator with spaces. Adds a new parameter
-named ``no_spaces`` that will not warp the separator with spaces.

changelog/44736.fixed.md

@@ -1,2 +0,0 @@
-Commands on Windows are now prefixed with ``cmd /c`` so that compound
-commands (commands separated by ``&&``) run properly when using ``runas``

changelog/58969.fixed.md

@@ -1,4 +0,0 @@
-Issue 58969: Fixes an issue with `saltclass.expand_classes_in_order`
-function where it was losing nested classes states during class
-expansion. The logic now use `salt.utils.odict.OrderedDict` to keep
-the inclusion ordering.

changelog/59977.fixed.md

@@ -1,2 +0,0 @@
-Fixed an issue on Windows where checking success_retcodes when using the
-runas parameter would fail. Now success_retcodes are checked correctly

changelog/60884.fixed.md

@@ -1,2 +0,0 @@
-Fix an issue with cmd.script in Windows so that the exit code from a script will
-be passed through to the retcode of the state

changelog/61001.fixed.md

@@ -1,2 +0,0 @@
-Fixed an issue uninstalling packages on Windows using pkg.removed where there
-are multiple versions of the same software installed

changelog/61416.fixed.md

@@ -1 +0,0 @@
-Ensure file clients for runner, wheel, local and caller are available from the client_cache if called upon.

changelog/62501.fixed.md

@@ -1 +0,0 @@
-Convert stdin string to bytes regardless of stdin_raw_newlines

changelog/63933.fixed.md

@@ -1,4 +0,0 @@
-Issue 63933: Fixes an issue with `saltclass.expanded_dict_from_minion`
-function where it was passing a reference to minion `dict` which was
-overridden by nested classes during class expansion. Copy the node
-definition with `copy.deepcopy` instead of passing a reference.

changelog/64630.fixed.md

@@ -1,3 +0,0 @@
-Fixed an intermittent issue with file.recurse where the state would
-report failure even on success. Makes sure symlinks are created
-after the target file is created

changelog/65104.fixed.md

@@ -1 +0,0 @@
-The 'profile' outputter does not crash with incorrectly formatted data

changelog/66249.fixed.md

@@ -1 +0,0 @@
-Fix batch mode hang indefinitely in some scenarios

changelog/66252.fixed.md

@@ -1 +0,0 @@
-Applying `selinux.fcontext_policy_present` to a shorter path than an existing entry now works

changelog/66467.removed.md

@@ -1 +0,0 @@
-Remove psutil_compat.py file, which should have been removed when RHEL 6 EOL

changelog/66560.fixed.md

@@ -1 +0,0 @@
-Correct bash-completion for Debian / Ubuntu

changelog/66592.fixed.md

@@ -1 +0,0 @@
-Fix minion config option startup_states

changelog/66596.fixed.md

@@ -1,2 +0,0 @@
-Fixed an issue with cmd.run with requirements when the shell is not the
-default

changelog/66637.fixed.md

@@ -1,4 +0,0 @@
-Fixes an issue when getting account names using the get_name function in the
-win_dacl.py salt util. Capability SIDs return ``None``. SIDs for deleted
-accounts return the SID. SIDs for domain accounts where the system is not
-connected to the domain return the SID.

changelog/66716.fixed.md

@@ -1,2 +0,0 @@
-Fixed an issue where ``status.master`` wasn't detecting a connection to the
-specified master properly

changelog/66718.fixed.md

@@ -1,2 +0,0 @@
-Fixed ``win_wua.available`` when some of the update objects are empty CDispatch
-objects. The ``available`` function no longer crashes

changelog/66726.fixed.md

@@ -1 +0,0 @@
-Clean up multiprocessing file handles on minion

changelog/66772.fixed.md

@@ -1 +0,0 @@
-Fixed nacl.keygen for not yet existing sk_file or pk_file

changelog/66783.fixed.md

@@ -1 +0,0 @@
-fix yaml output

changelog/66784.fixed.md

@@ -1,2 +0,0 @@
-Fixed an issue where enabling `grain_opts` in the minion config would cause
-some core grains to be overwritten.

changelog/66786.fixed.md

@@ -1,2 +0,0 @@
-Fix an issue where files created using `salt.utils.atomicile.atomic_open()`
-were created with restrictive permissions instead of respecting the umask.

changelog/66789.fixed.md

@@ -1 +0,0 @@
-Fix bad async_method name on AsyncPubClient class

changelog/66796.fixed.md

@@ -1 +0,0 @@
-Ensure Manjaro ARM reports the correct os_family of Arch.

changelog/66835.fixed.md

@@ -1,2 +0,0 @@
-Removed ``salt.utils.data.decode`` usage from the fileserver. This function was
-necessary to support Python 2. This speeds up loading the list cache by 80-90x.

changelog/66837.fixed.md

@@ -1,3 +0,0 @@
-Issue 66837: Fixes an issue with the `network.local_port_tcp` function
-where it was not parsing the IPv4 mapped IPv6 address correctly. The
-``::ffff:`` is now removed and only the IP address is returned.

changelog/66856.fixed.md

@@ -1 +0,0 @@
-Better handling output of `systemctl --version` with salt.grains.core._systemd

changelog/66858.fixed.md

@@ -1,2 +0,0 @@
-Upgrade relenv to 0.17.3. This release includes python 3.10.15, openssl 3.2.3,
-and fixes for pip 24.2.

changelog/66883.fixed.md

@@ -1 +0,0 @@
-Added cryptogrpahy back to base.txt requirements as a dependency

changelog/66886.deprecated.md

@@ -1 +0,0 @@
-Drop Arch Linux support

changelog/66891.fixed.md

@@ -1 +0,0 @@
-Remove "perms" from `linux_acl.list_absent()` documentation

changelog/66932.fixed.md

@@ -1 +0,0 @@
-Ensure minion start event coroutines are run

changelog/66955.fixed.md

@@ -1 +0,0 @@
-Allow for secure-boot efivars directory having SecureBoot-xxx files, not directories with a data file

changelog/66959.fixed.md

@@ -1,2 +0,0 @@
-Removed the usage of wmic to get the disk and iscsi grains for Windows. The wmic
-binary is being deprecated.

changelog/66992.fixed.md

@@ -1,2 +0,0 @@
-Fixes an issue with the LGPO module when trying to parse ADMX/ADML files
-that have a space in the XMLNS url in the policyDefinitionsResources header.

changelog/66996.fixed.md

@@ -1 +0,0 @@
-Ensured global dunders like __env__ are defined in state module that are run in parallel on spawning platforms

changelog/66999.fixed.md

@@ -1 +0,0 @@
-Filtered unpicklable objects from the context dict when invoking states in parallel on spawning platforms to avoid a crash

changelog/67017.fixed.md

@@ -1 +0,0 @@
-Update for deprecation of hex in pygit2 1.15.0 and above

changelog/67019.fixed.md

@@ -1 +0,0 @@
-Fixed blob path for salt.ufw in the firewall tutorial documentation

changelog/67020.fixed.md

@@ -1 +0,0 @@
-Update locations for bootstrap scripts, to new infrastructure, GitHub releases for bootstrap

changelog/67057.fixed.md

@@ -1 +0,0 @@
-Added support for dnf5 (backport from 3007) and update to its new command syntax changes since 2023

changelog/67058.fixed.md

@@ -1 +0,0 @@
-Recognise newer AMD GPU devices

changelog/67091.fixed.md

@@ -1 +0,0 @@
-Fix yumpkg module for Python<3.8

changelog/67122.fixed.md

@@ -1,2 +0,0 @@
-Fixed an issue with making changes to the Windows Firewall when the
-AllowInboundRules setting is set to True

changelog/67177.fixed.md

@@ -1 +0,0 @@
-Added support and tests for dnf5 to services_need_restart for yum packages

changelog/67184.removed.md

@@ -1 +0,0 @@
-Removed dependency on bsdmainutils package for Debian and Ubuntu

changelog/67722.fixed.md

@@ -1 +0,0 @@
-Use os.walk to traverse git branches, and no longer replace slash '/' in git branch names

changelog/67729.deprecated.md

@@ -1 +0,0 @@
-Removed support for end of life Python 3.7 and 3.8 from pre-commit and requirements

changelog/67733.fixed.md

@@ -1 +0,0 @@
-Set correct virtual grain in systemd based Podman containers

changelog/67743.fixed.md

@@ -1 +0,0 @@
-Corrected option --upgrades for dnf[5] for function list_upgrades

changelog/67769.fixed.md

@@ -1 +0,0 @@
-Corrected dnf5 option --downloadonly for dnf5 install

changelog/67792.fixed.md

@@ -1,2 +0,0 @@
-Upgrade relenv to 0.18.1. Which includes python 3.10.16 and openssl 3.2.4.
-Openssl 3.2.4 fixes CVE-2024-12797 and CVE-2024-13176

changelog/67794.fixed.md

@@ -1,2 +0,0 @@
-Update jinja2 to 3.1.5, advisories GHSA-q2x7-8rv6-6q7h and GHSA-gmj6-6f8f-6699
-Update urllib3 to 1.26.18 advisories GHSA-34jh-p97f-mpxf

doc/man/salt-api.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-API" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-API" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-api \- salt-api Command
 .sp
@@ -109,6 +109,6 @@ Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-call.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-CALL" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-CALL" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-call \- salt-call Documentation
 .SH SYNOPSIS
@@ -262,6 +262,6 @@ output. Set to True or False. Default: none.
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-cloud.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-CLOUD" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-CLOUD" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-cloud \- Salt Cloud Command
 .sp
@@ -380,6 +380,6 @@ salt\-cloud \-m /path/to/cloud.map \-Q
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-cp.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-CP" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-CP" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-cp \- salt-cp Documentation
 .sp
@@ -207,6 +207,6 @@ New in version 2016.3.7,2016.11.6,2017.7.0.
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-key.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-KEY" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-KEY" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-key \- salt-key Documentation
 .SH SYNOPSIS
@@ -332,6 +332,6 @@ Auto\-create a signing key\-pair if it does not yet exist
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-master.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-MASTER" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-MASTER" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-master \- salt-master Documentation
 .sp
@@ -114,6 +114,6 @@ Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-minion.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-MINION" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-MINION" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-minion \- salt-minion Documentation
 .sp
@@ -115,6 +115,6 @@ Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-proxy.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-PROXY" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-PROXY" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-proxy \- salt-proxy Documentation
 .sp
@@ -123,6 +123,6 @@ Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-run.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-RUN" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-RUN" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-run \- salt-run Documentation
 .sp
@@ -120,6 +120,6 @@ Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-ssh.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-SSH" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-SSH" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-ssh \- salt-ssh Documentation
 .SH SYNOPSIS
@@ -365,6 +365,6 @@ to a JSON parser, use \fB\-\-static\fP as well.
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt-syndic.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT-SYNDIC" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT-SYNDIC" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt-syndic \- salt-syndic Documentation
 .sp
@@ -116,6 +116,6 @@ Logfile logging log level. One of \fBall\fP, \fBgarbage\fP, \fBtrace\fP,
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/salt.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SALT" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SALT" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 salt \- salt
 .SH SYNOPSIS
@@ -354,6 +354,6 @@ to a JSON parser, use \fB\-\-static\fP as well.
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/man/spm.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "SPM" "1" "Generated on July 29, 2024 at 07:43:51 AM UTC." "3006.9" "Salt"
+.TH "SPM" "1" "Generated on March 19, 2025 at 04:34:24 UTC." "3006.10" "Salt"
 .SH NAME
 spm \- Salt Package Manager Command
 .sp
@@ -138,6 +138,6 @@ in that directory which describes them.
 .SH AUTHOR
 Thomas S. Hatch <thatch45@gmail.com> and many others, please see the Authors file
 .SH COPYRIGHT
-2024
+2025
 .\" Generated by docutils manpage writer.
 .

doc/topics/releases/3006.10.md

@@ -0,0 +1,130 @@
+(release-3006.10)=
+# Salt 3006.10 release notes
+
+<!---
+Do not edit this file. This is auto generated.
+Edit the templates in doc/topics/releases/templates/
+for a given release.
+-->
+
+
+<!--
+Add release specific details below
+-->
+
+<!--
+Do not edit the changelog below.
+This is auto generated.
+-->
+## Changelog
+
+### Removed
+
+- Remove psutil_compat.py file, which should have been removed when RHEL 6 EOL [#66467](https://github.com/saltstack/salt/issues/66467)
+- Removed dependency on bsdmainutils package for Debian and Ubuntu [#67184](https://github.com/saltstack/salt/issues/67184)
+
+
+### Deprecated
+
+- Drop Arch Linux support [#66886](https://github.com/saltstack/salt/issues/66886)
+- Removed support for end of life Python 3.7 and 3.8 from pre-commit and requirements [#67729](https://github.com/saltstack/salt/issues/67729)
+
+
+### Fixed
+
+- Commands on Windows are now prefixed with ``cmd /c`` so that compound
+  commands (commands separated by ``&&``) run properly when using ``runas`` [#44736](https://github.com/saltstack/salt/issues/44736)
+- Issue 58969: Fixes an issue with `saltclass.expand_classes_in_order`
+  function where it was losing nested classes states during class
+  expansion. The logic now use `salt.utils.odict.OrderedDict` to keep
+  the inclusion ordering. [#58969](https://github.com/saltstack/salt/issues/58969)
+- Fix issue with RunAs on Windows so that usernames of all numeric characters
+  are handled as strings [#59344](https://github.com/saltstack/salt/issues/59344)
+- Fixed an issue on Windows where checking success_retcodes when using the
+  runas parameter would fail. Now success_retcodes are checked correctly [#59977](https://github.com/saltstack/salt/issues/59977)
+- Fix an issue with cmd.script in Windows so that the exit code from a script will
+  be passed through to the retcode of the state [#60884](https://github.com/saltstack/salt/issues/60884)
+- Fixed an issue uninstalling packages on Windows using pkg.removed where there
+  are multiple versions of the same software installed [#61001](https://github.com/saltstack/salt/issues/61001)
+- Ensure file clients for runner, wheel, local and caller are available from the client_cache if called upon. [#61416](https://github.com/saltstack/salt/issues/61416)
+- Convert stdin string to bytes regardless of stdin_raw_newlines [#62501](https://github.com/saltstack/salt/issues/62501)
+- Issue 63933: Fixes an issue with `saltclass.expanded_dict_from_minion`
+  function where it was passing a reference to minion `dict` which was
+  overridden by nested classes during class expansion. Copy the node
+  definition with `copy.deepcopy` instead of passing a reference. [#63933](https://github.com/saltstack/salt/issues/63933)
+- Fixed an intermittent issue with file.recurse where the state would
+  report failure even on success. Makes sure symlinks are created
+  after the target file is created [#64630](https://github.com/saltstack/salt/issues/64630)
+- The 'profile' outputter does not crash with incorrectly formatted data [#65104](https://github.com/saltstack/salt/issues/65104)
+- Updating version comparison for rpm and removed obsolete comparison methods for rpms [#65443](https://github.com/saltstack/salt/issues/65443)
+- Fix batch mode hang indefinitely in some scenarios [#66249](https://github.com/saltstack/salt/issues/66249)
+- Applying `selinux.fcontext_policy_present` to a shorter path than an existing entry now works [#66252](https://github.com/saltstack/salt/issues/66252)
+- Correct bash-completion for Debian / Ubuntu [#66560](https://github.com/saltstack/salt/issues/66560)
+- Fix minion config option startup_states [#66592](https://github.com/saltstack/salt/issues/66592)
+- Fixed an issue with cmd.run with requirements when the shell is not the
+  default [#66596](https://github.com/saltstack/salt/issues/66596)
+- Fixes an issue when getting account names using the get_name function in the
+  win_dacl.py salt util. Capability SIDs return ``None``. SIDs for deleted
+  accounts return the SID. SIDs for domain accounts where the system is not
+  connected to the domain return the SID. [#66637](https://github.com/saltstack/salt/issues/66637)
+- Fixed an issue where ``status.master`` wasn't detecting a connection to the
+  specified master properly [#66716](https://github.com/saltstack/salt/issues/66716)
+- Fixed ``win_wua.available`` when some of the update objects are empty CDispatch
+  objects. The ``available`` function no longer crashes [#66718](https://github.com/saltstack/salt/issues/66718)
+- Clean up multiprocessing file handles on minion [#66726](https://github.com/saltstack/salt/issues/66726)
+- Fixed nacl.keygen for not yet existing sk_file or pk_file [#66772](https://github.com/saltstack/salt/issues/66772)
+- fix yaml output [#66783](https://github.com/saltstack/salt/issues/66783)
+- Fixed an issue where enabling `grain_opts` in the minion config would cause
+  some core grains to be overwritten. [#66784](https://github.com/saltstack/salt/issues/66784)
+- Fix an issue where files created using `salt.utils.atomicile.atomic_open()`
+  were created with restrictive permissions instead of respecting the umask. [#66786](https://github.com/saltstack/salt/issues/66786)
+- Fix bad async_method name on AsyncPubClient class [#66789](https://github.com/saltstack/salt/issues/66789)
+- Ensure Manjaro ARM reports the correct os_family of Arch. [#66796](https://github.com/saltstack/salt/issues/66796)
+- Removed ``salt.utils.data.decode`` usage from the fileserver. This function was
+  necessary to support Python 2. This speeds up loading the list cache by 80-90x. [#66835](https://github.com/saltstack/salt/issues/66835)
+- Issue 66837: Fixes an issue with the `network.local_port_tcp` function
+  where it was not parsing the IPv4 mapped IPv6 address correctly. The
+  ``::ffff:`` is now removed and only the IP address is returned. [#66837](https://github.com/saltstack/salt/issues/66837)
+- Better handling output of `systemctl --version` with salt.grains.core._systemd [#66856](https://github.com/saltstack/salt/issues/66856)
+- Upgrade relenv to 0.17.3. This release includes python 3.10.15, openssl 3.2.3,
+  and fixes for pip 24.2. [#66858](https://github.com/saltstack/salt/issues/66858)
+- Remove caching of 'systemctl status' in systemd_service to fix automatic daemon-reload for repeated invocations. [#66864](https://github.com/saltstack/salt/issues/66864)
+- Added cryptogrpahy back to base.txt requirements as a dependency [#66883](https://github.com/saltstack/salt/issues/66883)
+- Remove "perms" from `linux_acl.list_absent()` documentation [#66891](https://github.com/saltstack/salt/issues/66891)
+- Ensure minion start event coroutines are run [#66932](https://github.com/saltstack/salt/issues/66932)
+- Allow for secure-boot efivars directory having SecureBoot-xxx files, not directories with a data file [#66955](https://github.com/saltstack/salt/issues/66955)
+- Removed the usage of wmic to get the disk and iscsi grains for Windows. The wmic
+  binary is being deprecated. [#66959](https://github.com/saltstack/salt/issues/66959)
+- Fixes an issue with the LGPO module when trying to parse ADMX/ADML files
+  that have a space in the XMLNS url in the policyDefinitionsResources header. [#66992](https://github.com/saltstack/salt/issues/66992)
+- Ensured global dunders like __env__ are defined in state module that are run in parallel on spawning platforms [#66996](https://github.com/saltstack/salt/issues/66996)
+- Filtered unpicklable objects from the context dict when invoking states in parallel on spawning platforms to avoid a crash [#66999](https://github.com/saltstack/salt/issues/66999)
+- Update for deprecation of hex in pygit2 1.15.0 and above [#67017](https://github.com/saltstack/salt/issues/67017)
+- Fixed blob path for salt.ufw in the firewall tutorial documentation [#67019](https://github.com/saltstack/salt/issues/67019)
+- Update locations for bootstrap scripts, to new infrastructure, GitHub releases for bootstrap [#67020](https://github.com/saltstack/salt/issues/67020)
+- Constrained the localfs module to operations inside the specified cachedir [#67031](https://github.com/saltstack/salt/issues/67031)
+- Added support for dnf5 (backport from 3007) and update to its new command syntax changes since 2023 [#67057](https://github.com/saltstack/salt/issues/67057)
+- Recognise newer AMD GPU devices [#67058](https://github.com/saltstack/salt/issues/67058)
+- Fix yumpkg module for Python<3.8 [#67091](https://github.com/saltstack/salt/issues/67091)
+- Fixed an issue with making changes to the Windows Firewall when the
+  AllowInboundRules setting is set to True [#67122](https://github.com/saltstack/salt/issues/67122)
+- Added support and tests for dnf5 to services_need_restart for yum packages [#67177](https://github.com/saltstack/salt/issues/67177)
+- Use os.walk to traverse git branches, and no longer replace slash '/' in git branch names [#67722](https://github.com/saltstack/salt/issues/67722)
+- Set correct virtual grain in systemd based Podman containers [#67733](https://github.com/saltstack/salt/issues/67733)
+- Corrected option --upgrades for dnf[5] for function list_upgrades [#67743](https://github.com/saltstack/salt/issues/67743)
+- Fix salt-ssh for hosts that use password as the SSH password [#67754](https://github.com/saltstack/salt/issues/67754)
+- Corrected dnf5 option --downloadonly for dnf5 install [#67769](https://github.com/saltstack/salt/issues/67769)
+- Upgrade relenv to 0.18.1. Which includes python 3.10.16 and openssl 3.2.4.
+  Openssl 3.2.4 fixes CVE-2024-12797 and CVE-2024-13176 [#67792](https://github.com/saltstack/salt/issues/67792)
+- Update jinja2 to 3.1.5, advisories GHSA-q2x7-8rv6-6q7h and GHSA-gmj6-6f8f-6699
+  Update urllib3 to 1.26.18 advisories GHSA-34jh-p97f-mpxf [#67794](https://github.com/saltstack/salt/issues/67794)
+- Ensure salt-cloud has salt-master dependency on Debian and Ubuntu [#67810](https://github.com/saltstack/salt/issues/67810)
+- Fix traceback from _send_req_sync method on minion by raising proper timeout error. [#67891](https://github.com/saltstack/salt/issues/67891)
+
+
+### Added
+
+- Issue #33669: Fixes an issue with the ``ini_managed`` execution module
+  where it would always wrap the separator with spaces. Adds a new parameter
+  named ``no_spaces`` that will not warp the separator with spaces. [#33669](https://github.com/saltstack/salt/issues/33669)
+- Enhance json.find_json to return json even when it contains text on the same line of the last closing parenthesis [#67023](https://github.com/saltstack/salt/issues/67023)

doc/topics/releases/templates/3006.10.md.template

@@ -0,0 +1,14 @@
+(release-3006.10)=
+# Salt 3006.10 release notes{{ unreleased }}
+{{ warning }}
+
+<!--
+Add release specific details below
+-->
+
+<!--
+Do not edit the changelog below.
+This is auto generated.
+-->
+## Changelog
+{{ changelog }}

noxfile.py

@@ -1841,6 +1841,11 @@ def ci_test_onedir_pkgs(session):
         "--pkg-system-service",
     ]
 
+    # Upgrade and downgrade tests run with no-uninstall. The intergration tests
+    # will use the results of the upgrade downgrade tests. So, for upgrade
+    # tests the intergration tests will be testing the current version after
+    # and upgrade was performed. For downgrade tests, the integration tests are
+    # testing the previous version after a downgrade was performed.
     chunks = {
         "install": [],
         "upgrade": [
@@ -1934,6 +1939,8 @@ def ci_test_onedir_pkgs(session):
             on_rerun=True,
         )
 
+    # The upgrade/downgrad tests passed, now run the integration tests against
+    # the results.
     if chunk not in ("install", "download-pkgs"):
         cmd_args = chunks["install"]
         pytest_args = (

pkg/debian/changelog

@@ -1,3 +1,117 @@
+salt (3006.10) stable; urgency=medium
+
+
+  # Removed
+
+  * Remove psutil_compat.py file, which should have been removed when RHEL 6 EOL [#66467](https://github.com/saltstack/salt/issues/66467)
+  * Removed dependency on bsdmainutils package for Debian and Ubuntu [#67184](https://github.com/saltstack/salt/issues/67184)
+
+  # Deprecated
+
+  * Drop Arch Linux support [#66886](https://github.com/saltstack/salt/issues/66886)
+  * Removed support for end of life Python 3.7 and 3.8 from pre-commit and requirements [#67729](https://github.com/saltstack/salt/issues/67729)
+
+  # Fixed
+
+  * Commands on Windows are now prefixed with ``cmd /c`` so that compound
+    commands (commands separated by ``&&``) run properly when using ``runas`` [#44736](https://github.com/saltstack/salt/issues/44736)
+  * Issue 58969: Fixes an issue with `saltclass.expand_classes_in_order`
+    function where it was losing nested classes states during class
+    expansion. The logic now use `salt.utils.odict.OrderedDict` to keep
+    the inclusion ordering. [#58969](https://github.com/saltstack/salt/issues/58969)
+  * Fix issue with RunAs on Windows so that usernames of all numeric characters
+    are handled as strings [#59344](https://github.com/saltstack/salt/issues/59344)
+  * Fixed an issue on Windows where checking success_retcodes when using the
+    runas parameter would fail. Now success_retcodes are checked correctly [#59977](https://github.com/saltstack/salt/issues/59977)
+  * Fix an issue with cmd.script in Windows so that the exit code from a script will
+    be passed through to the retcode of the state [#60884](https://github.com/saltstack/salt/issues/60884)
+  * Fixed an issue uninstalling packages on Windows using pkg.removed where there
+    are multiple versions of the same software installed [#61001](https://github.com/saltstack/salt/issues/61001)
+  * Ensure file clients for runner, wheel, local and caller are available from the client_cache if called upon. [#61416](https://github.com/saltstack/salt/issues/61416)
+  * Convert stdin string to bytes regardless of stdin_raw_newlines [#62501](https://github.com/saltstack/salt/issues/62501)
+  * Issue 63933: Fixes an issue with `saltclass.expanded_dict_from_minion`
+    function where it was passing a reference to minion `dict` which was
+    overridden by nested classes during class expansion. Copy the node
+    definition with `copy.deepcopy` instead of passing a reference. [#63933](https://github.com/saltstack/salt/issues/63933)
+  * Fixed an intermittent issue with file.recurse where the state would
+    report failure even on success. Makes sure symlinks are created
+    after the target file is created [#64630](https://github.com/saltstack/salt/issues/64630)
+  * The 'profile' outputter does not crash with incorrectly formatted data [#65104](https://github.com/saltstack/salt/issues/65104)
+  * Updating version comparison for rpm and removed obsolete comparison methods for rpms [#65443](https://github.com/saltstack/salt/issues/65443)
+  * Fix batch mode hang indefinitely in some scenarios [#66249](https://github.com/saltstack/salt/issues/66249)
+  * Applying `selinux.fcontext_policy_present` to a shorter path than an existing entry now works [#66252](https://github.com/saltstack/salt/issues/66252)
+  * Correct bash-completion for Debian / Ubuntu [#66560](https://github.com/saltstack/salt/issues/66560)
+  * Fix minion config option startup_states [#66592](https://github.com/saltstack/salt/issues/66592)
+  * Fixed an issue with cmd.run with requirements when the shell is not the
+    default [#66596](https://github.com/saltstack/salt/issues/66596)
+  * Fixes an issue when getting account names using the get_name function in the
+    win_dacl.py salt util. Capability SIDs return ``None``. SIDs for deleted
+    accounts return the SID. SIDs for domain accounts where the system is not
+    connected to the domain return the SID. [#66637](https://github.com/saltstack/salt/issues/66637)
+  * Fixed an issue where ``status.master`` wasn't detecting a connection to the
+    specified master properly [#66716](https://github.com/saltstack/salt/issues/66716)
+  * Fixed ``win_wua.available`` when some of the update objects are empty CDispatch
+    objects. The ``available`` function no longer crashes [#66718](https://github.com/saltstack/salt/issues/66718)
+  * Clean up multiprocessing file handles on minion [#66726](https://github.com/saltstack/salt/issues/66726)
+  * Fixed nacl.keygen for not yet existing sk_file or pk_file [#66772](https://github.com/saltstack/salt/issues/66772)
+  * fix yaml output [#66783](https://github.com/saltstack/salt/issues/66783)
+  * Fixed an issue where enabling `grain_opts` in the minion config would cause
+    some core grains to be overwritten. [#66784](https://github.com/saltstack/salt/issues/66784)
+  * Fix an issue where files created using `salt.utils.atomicile.atomic_open()`
+    were created with restrictive permissions instead of respecting the umask. [#66786](https://github.com/saltstack/salt/issues/66786)
+  * Fix bad async_method name on AsyncPubClient class [#66789](https://github.com/saltstack/salt/issues/66789)
+  * Ensure Manjaro ARM reports the correct os_family of Arch. [#66796](https://github.com/saltstack/salt/issues/66796)
+  * Removed ``salt.utils.data.decode`` usage from the fileserver. This function was
+    necessary to support Python 2. This speeds up loading the list cache by 80*90x. [#66835](https://github.com/saltstack/salt/issues/66835)
+  * Issue 66837: Fixes an issue with the `network.local_port_tcp` function
+    where it was not parsing the IPv4 mapped IPv6 address correctly. The
+    ``::ffff:`` is now removed and only the IP address is returned. [#66837](https://github.com/saltstack/salt/issues/66837)
+  * Better handling output of `systemctl --version` with salt.grains.core._systemd [#66856](https://github.com/saltstack/salt/issues/66856)
+  * Upgrade relenv to 0.17.3. This release includes python 3.10.15, openssl 3.2.3,
+    and fixes for pip 24.2. [#66858](https://github.com/saltstack/salt/issues/66858)
+  * Remove caching of 'systemctl status' in systemd_service to fix automatic daemon-reload for repeated invocations. [#66864](https://github.com/saltstack/salt/issues/66864)
+  * Added cryptogrpahy back to base.txt requirements as a dependency [#66883](https://github.com/saltstack/salt/issues/66883)
+  * Remove "perms" from `linux_acl.list_absent()` documentation [#66891](https://github.com/saltstack/salt/issues/66891)
+  * Ensure minion start event coroutines are run [#66932](https://github.com/saltstack/salt/issues/66932)
+  * Allow for secure-boot efivars directory having SecureBoot-xxx files, not directories with a data file [#66955](https://github.com/saltstack/salt/issues/66955)
+  * Removed the usage of wmic to get the disk and iscsi grains for Windows. The wmic
+    binary is being deprecated. [#66959](https://github.com/saltstack/salt/issues/66959)
+  * Fixes an issue with the LGPO module when trying to parse ADMX/ADML files
+    that have a space in the XMLNS url in the policyDefinitionsResources header. [#66992](https://github.com/saltstack/salt/issues/66992)
+  * Ensured global dunders like __env__ are defined in state module that are run in parallel on spawning platforms [#66996](https://github.com/saltstack/salt/issues/66996)
+  * Filtered unpicklable objects from the context dict when invoking states in parallel on spawning platforms to avoid a crash [#66999](https://github.com/saltstack/salt/issues/66999)
+  * Update for deprecation of hex in pygit2 1.15.0 and above [#67017](https://github.com/saltstack/salt/issues/67017)
+  * Fixed blob path for salt.ufw in the firewall tutorial documentation [#67019](https://github.com/saltstack/salt/issues/67019)
+  * Update locations for bootstrap scripts, to new infrastructure, GitHub releases for bootstrap [#67020](https://github.com/saltstack/salt/issues/67020)
+  * Constrained the localfs module to operations inside the specified cachedir [#67031](https://github.com/saltstack/salt/issues/67031)
+  * Added support for dnf5 (backport from 3007) and update to its new command syntax changes since 2023 [#67057](https://github.com/saltstack/salt/issues/67057)
+  * Recognise newer AMD GPU devices [#67058](https://github.com/saltstack/salt/issues/67058)
+  * Fix yumpkg module for Python<3.8 [#67091](https://github.com/saltstack/salt/issues/67091)
+  * Fixed an issue with making changes to the Windows Firewall when the
+    AllowInboundRules setting is set to True [#67122](https://github.com/saltstack/salt/issues/67122)
+  * Added support and tests for dnf5 to services_need_restart for yum packages [#67177](https://github.com/saltstack/salt/issues/67177)
+  * Use os.walk to traverse git branches, and no longer replace slash '/' in git branch names [#67722](https://github.com/saltstack/salt/issues/67722)
+  * Set correct virtual grain in systemd based Podman containers [#67733](https://github.com/saltstack/salt/issues/67733)
+  * Corrected option --upgrades for dnf[5] for function list_upgrades [#67743](https://github.com/saltstack/salt/issues/67743)
+  * Fix salt-ssh for hosts that use password as the SSH password [#67754](https://github.com/saltstack/salt/issues/67754)
+  * Corrected dnf5 option --downloadonly for dnf5 install [#67769](https://github.com/saltstack/salt/issues/67769)
+  * Upgrade relenv to 0.18.1. Which includes python 3.10.16 and openssl 3.2.4.
+    Openssl 3.2.4 fixes CVE*2024-12797 and CVE-2024-13176 [#67792](https://github.com/saltstack/salt/issues/67792)
+  * Update jinja2 to 3.1.5, advisories GHSA-q2x7-8rv6-6q7h and GHSA-gmj6-6f8f-6699
+    Update urllib3 to 1.26.18 advisories GHSA*34jh-p97f-mpxf [#67794](https://github.com/saltstack/salt/issues/67794)
+  * Ensure salt-cloud has salt-master dependency on Debian and Ubuntu [#67810](https://github.com/saltstack/salt/issues/67810)
+  * Fix traceback from _send_req_sync method on minion by raising proper timeout error. [#67891](https://github.com/saltstack/salt/issues/67891)
+
+  # Added
+
+  * Issue #33669: Fixes an issue with the ``ini_managed`` execution module
+    where it would always wrap the separator with spaces. Adds a new parameter
+    named ``no_spaces`` that will not warp the separator with spaces. [#33669](https://github.com/saltstack/salt/issues/33669)
+  * Enhance json.find_json to return json even when it contains text on the same line of the last closing parenthesis [#67023](https://github.com/saltstack/salt/issues/67023)
+
+
+ -- Salt Project Packaging <saltproject-packaging@vmware.com>  Wed, 19 Mar 2025 04:33:26 +0000
+
 salt (3006.9) stable; urgency=medium
 
 

pkg/debian/control

@@ -160,7 +160,7 @@ Description: remote manager to administer servers via Salt SSH
 Package: salt-cloud
 Architecture: amd64 arm64
 Breaks: salt-common (<= 3006.4)
-Depends: salt-common (= ${source:Version}),
+Depends: salt-master (= ${source:Version}),
          ${misc:Depends}
 Description: public cloud VM management system
  provision virtual machines on various public clouds via a cleanly
@@ -169,7 +169,7 @@ Description: public cloud VM management system
 
 Package: salt-api
 Architecture: amd64 arm64
-Depends: salt-master,
+Depends: salt-master (= ${source:Version}),
          ${misc:Depends}
 Description: Generic, modular network access system
  a modular interface on top of Salt that can provide a variety of entry points

pkg/rpm/salt.spec

@@ -40,7 +40,7 @@
 %define fish_dir %{_datadir}/fish/vendor_functions.d
 
 Name:    salt
-Version: 3006.9
+Version: 3006.10
 Release: 0
 Summary: A parallel remote execution system
 Group:   System Environment/Daemons
@@ -724,6 +724,117 @@ if [ $1 -ge 1 ] ; then
 fi
 
 %changelog
+* Wed Mar 19 2025 Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.10
+
+# Removed
+
+- Remove psutil_compat.py file, which should have been removed when RHEL 6 EOL [#66467](https://github.com/saltstack/salt/issues/66467)
+- Removed dependency on bsdmainutils package for Debian and Ubuntu [#67184](https://github.com/saltstack/salt/issues/67184)
+
+# Deprecated
+
+- Drop Arch Linux support [#66886](https://github.com/saltstack/salt/issues/66886)
+- Removed support for end of life Python 3.7 and 3.8 from pre-commit and requirements [#67729](https://github.com/saltstack/salt/issues/67729)
+
+# Fixed
+
+- Commands on Windows are now prefixed with ``cmd /c`` so that compound
+  commands (commands separated by ``&&``) run properly when using ``runas`` [#44736](https://github.com/saltstack/salt/issues/44736)
+- Issue 58969: Fixes an issue with `saltclass.expand_classes_in_order`
+  function where it was losing nested classes states during class
+  expansion. The logic now use `salt.utils.odict.OrderedDict` to keep
+  the inclusion ordering. [#58969](https://github.com/saltstack/salt/issues/58969)
+- Fix issue with RunAs on Windows so that usernames of all numeric characters
+  are handled as strings [#59344](https://github.com/saltstack/salt/issues/59344)
+- Fixed an issue on Windows where checking success_retcodes when using the
+  runas parameter would fail. Now success_retcodes are checked correctly [#59977](https://github.com/saltstack/salt/issues/59977)
+- Fix an issue with cmd.script in Windows so that the exit code from a script will
+  be passed through to the retcode of the state [#60884](https://github.com/saltstack/salt/issues/60884)
+- Fixed an issue uninstalling packages on Windows using pkg.removed where there
+  are multiple versions of the same software installed [#61001](https://github.com/saltstack/salt/issues/61001)
+- Ensure file clients for runner, wheel, local and caller are available from the client_cache if called upon. [#61416](https://github.com/saltstack/salt/issues/61416)
+- Convert stdin string to bytes regardless of stdin_raw_newlines [#62501](https://github.com/saltstack/salt/issues/62501)
+- Issue 63933: Fixes an issue with `saltclass.expanded_dict_from_minion`
+  function where it was passing a reference to minion `dict` which was
+  overridden by nested classes during class expansion. Copy the node
+  definition with `copy.deepcopy` instead of passing a reference. [#63933](https://github.com/saltstack/salt/issues/63933)
+- Fixed an intermittent issue with file.recurse where the state would
+  report failure even on success. Makes sure symlinks are created
+  after the target file is created [#64630](https://github.com/saltstack/salt/issues/64630)
+- The 'profile' outputter does not crash with incorrectly formatted data [#65104](https://github.com/saltstack/salt/issues/65104)
+- Updating version comparison for rpm and removed obsolete comparison methods for rpms [#65443](https://github.com/saltstack/salt/issues/65443)
+- Fix batch mode hang indefinitely in some scenarios [#66249](https://github.com/saltstack/salt/issues/66249)
+- Applying `selinux.fcontext_policy_present` to a shorter path than an existing entry now works [#66252](https://github.com/saltstack/salt/issues/66252)
+- Correct bash-completion for Debian / Ubuntu [#66560](https://github.com/saltstack/salt/issues/66560)
+- Fix minion config option startup_states [#66592](https://github.com/saltstack/salt/issues/66592)
+- Fixed an issue with cmd.run with requirements when the shell is not the
+  default [#66596](https://github.com/saltstack/salt/issues/66596)
+- Fixes an issue when getting account names using the get_name function in the
+  win_dacl.py salt util. Capability SIDs return ``None``. SIDs for deleted
+  accounts return the SID. SIDs for domain accounts where the system is not
+  connected to the domain return the SID. [#66637](https://github.com/saltstack/salt/issues/66637)
+- Fixed an issue where ``status.master`` wasn't detecting a connection to the
+  specified master properly [#66716](https://github.com/saltstack/salt/issues/66716)
+- Fixed ``win_wua.available`` when some of the update objects are empty CDispatch
+  objects. The ``available`` function no longer crashes [#66718](https://github.com/saltstack/salt/issues/66718)
+- Clean up multiprocessing file handles on minion [#66726](https://github.com/saltstack/salt/issues/66726)
+- Fixed nacl.keygen for not yet existing sk_file or pk_file [#66772](https://github.com/saltstack/salt/issues/66772)
+- fix yaml output [#66783](https://github.com/saltstack/salt/issues/66783)
+- Fixed an issue where enabling `grain_opts` in the minion config would cause
+  some core grains to be overwritten. [#66784](https://github.com/saltstack/salt/issues/66784)
+- Fix an issue where files created using `salt.utils.atomicile.atomic_open()`
+  were created with restrictive permissions instead of respecting the umask. [#66786](https://github.com/saltstack/salt/issues/66786)
+- Fix bad async_method name on AsyncPubClient class [#66789](https://github.com/saltstack/salt/issues/66789)
+- Ensure Manjaro ARM reports the correct os_family of Arch. [#66796](https://github.com/saltstack/salt/issues/66796)
+- Removed ``salt.utils.data.decode`` usage from the fileserver. This function was
+  necessary to support Python 2. This speeds up loading the list cache by 80-90x. [#66835](https://github.com/saltstack/salt/issues/66835)
+- Issue 66837: Fixes an issue with the `network.local_port_tcp` function
+  where it was not parsing the IPv4 mapped IPv6 address correctly. The
+  ``::ffff:`` is now removed and only the IP address is returned. [#66837](https://github.com/saltstack/salt/issues/66837)
+- Better handling output of `systemctl --version` with salt.grains.core._systemd [#66856](https://github.com/saltstack/salt/issues/66856)
+- Upgrade relenv to 0.17.3. This release includes python 3.10.15, openssl 3.2.3,
+  and fixes for pip 24.2. [#66858](https://github.com/saltstack/salt/issues/66858)
+- Remove caching of 'systemctl status' in systemd_service to fix automatic daemon-reload for repeated invocations. [#66864](https://github.com/saltstack/salt/issues/66864)
+- Added cryptogrpahy back to base.txt requirements as a dependency [#66883](https://github.com/saltstack/salt/issues/66883)
+- Remove "perms" from `linux_acl.list_absent()` documentation [#66891](https://github.com/saltstack/salt/issues/66891)
+- Ensure minion start event coroutines are run [#66932](https://github.com/saltstack/salt/issues/66932)
+- Allow for secure-boot efivars directory having SecureBoot-xxx files, not directories with a data file [#66955](https://github.com/saltstack/salt/issues/66955)
+- Removed the usage of wmic to get the disk and iscsi grains for Windows. The wmic
+  binary is being deprecated. [#66959](https://github.com/saltstack/salt/issues/66959)
+- Fixes an issue with the LGPO module when trying to parse ADMX/ADML files
+  that have a space in the XMLNS url in the policyDefinitionsResources header. [#66992](https://github.com/saltstack/salt/issues/66992)
+- Ensured global dunders like __env__ are defined in state module that are run in parallel on spawning platforms [#66996](https://github.com/saltstack/salt/issues/66996)
+- Filtered unpicklable objects from the context dict when invoking states in parallel on spawning platforms to avoid a crash [#66999](https://github.com/saltstack/salt/issues/66999)
+- Update for deprecation of hex in pygit2 1.15.0 and above [#67017](https://github.com/saltstack/salt/issues/67017)
+- Fixed blob path for salt.ufw in the firewall tutorial documentation [#67019](https://github.com/saltstack/salt/issues/67019)
+- Update locations for bootstrap scripts, to new infrastructure, GitHub releases for bootstrap [#67020](https://github.com/saltstack/salt/issues/67020)
+- Constrained the localfs module to operations inside the specified cachedir [#67031](https://github.com/saltstack/salt/issues/67031)
+- Added support for dnf5 (backport from 3007) and update to its new command syntax changes since 2023 [#67057](https://github.com/saltstack/salt/issues/67057)
+- Recognise newer AMD GPU devices [#67058](https://github.com/saltstack/salt/issues/67058)
+- Fix yumpkg module for Python<3.8 [#67091](https://github.com/saltstack/salt/issues/67091)
+- Fixed an issue with making changes to the Windows Firewall when the
+  AllowInboundRules setting is set to True [#67122](https://github.com/saltstack/salt/issues/67122)
+- Added support and tests for dnf5 to services_need_restart for yum packages [#67177](https://github.com/saltstack/salt/issues/67177)
+- Use os.walk to traverse git branches, and no longer replace slash '/' in git branch names [#67722](https://github.com/saltstack/salt/issues/67722)
+- Set correct virtual grain in systemd based Podman containers [#67733](https://github.com/saltstack/salt/issues/67733)
+- Corrected option --upgrades for dnf[5] for function list_upgrades [#67743](https://github.com/saltstack/salt/issues/67743)
+- Fix salt-ssh for hosts that use password as the SSH password [#67754](https://github.com/saltstack/salt/issues/67754)
+- Corrected dnf5 option --downloadonly for dnf5 install [#67769](https://github.com/saltstack/salt/issues/67769)
+- Upgrade relenv to 0.18.1. Which includes python 3.10.16 and openssl 3.2.4.
+  Openssl 3.2.4 fixes CVE-2024-12797 and CVE-2024-13176 [#67792](https://github.com/saltstack/salt/issues/67792)
+- Update jinja2 to 3.1.5, advisories GHSA-q2x7-8rv6-6q7h and GHSA-gmj6-6f8f-6699
+  Update urllib3 to 1.26.18 advisories GHSA-34jh-p97f-mpxf [#67794](https://github.com/saltstack/salt/issues/67794)
+- Ensure salt-cloud has salt-master dependency on Debian and Ubuntu [#67810](https://github.com/saltstack/salt/issues/67810)
+- Fix traceback from _send_req_sync method on minion by raising proper timeout error. [#67891](https://github.com/saltstack/salt/issues/67891)
+
+# Added
+
+- Issue #33669: Fixes an issue with the ``ini_managed`` execution module
+  where it would always wrap the separator with spaces. Adds a new parameter
+  named ``no_spaces`` that will not warp the separator with spaces. [#33669](https://github.com/saltstack/salt/issues/33669)
+- Enhance json.find_json to return json even when it contains text on the same line of the last closing parenthesis [#67023](https://github.com/saltstack/salt/issues/67023)
+
+
 * Mon Jul 29 2024 Salt Project Packaging <saltproject-packaging@vmware.com> - 3006.9
 
 # Deprecated

salt/cache/localfs.py

@@ -20,6 +20,7 @@ import tempfile
 import salt.payload
 import salt.utils.atomicfile
 import salt.utils.files
+import salt.utils.path
 from salt.exceptions import SaltCacheError
 
 log = logging.getLogger(__name__)
@@ -45,7 +46,7 @@ def store(bank, key, data, cachedir):
     """
     Store information in a file.
     """
-    base = os.path.join(cachedir, os.path.normpath(bank))
+    base = salt.utils.path.join(cachedir, os.path.normpath(bank))
     try:
         os.makedirs(base)
     except OSError as exc:
@@ -54,7 +55,7 @@ def store(bank, key, data, cachedir):
                 f"The cache directory, {base}, could not be created: {exc}"
             )
 
-    outfile = os.path.join(base, f"{key}.p")
+    outfile = salt.utils.path.join(base, f"{key}.p")
     tmpfh, tmpfname = tempfile.mkstemp(dir=base)
     os.close(tmpfh)
     try:
@@ -73,10 +74,10 @@ def fetch(bank, key, cachedir):
     Fetch information from a file.
     """
     inkey = False
-    key_file = os.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
+    key_file = salt.utils.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
     if not os.path.isfile(key_file):
         # The bank includes the full filename, and the key is inside the file
-        key_file = os.path.join(cachedir, os.path.normpath(bank) + ".p")
+        key_file = salt.utils.path.join(cachedir, os.path.normpath(bank) + ".p")
         inkey = True
 
     if not os.path.isfile(key_file):
@@ -98,7 +99,7 @@ def updated(bank, key, cachedir):
     """
     Return the epoch of the mtime for this cache file
     """
-    key_file = os.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
+    key_file = salt.utils.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
     if not os.path.isfile(key_file):
         log.warning('Cache file "%s" does not exist', key_file)
         return None
@@ -119,12 +120,12 @@ def flush(bank, key=None, cachedir=None):
 
     try:
         if key is None:
-            target = os.path.join(cachedir, os.path.normpath(bank))
+            target = salt.utils.path.join(cachedir, os.path.normpath(bank))
             if not os.path.isdir(target):
                 return False
             shutil.rmtree(target)
         else:
-            target = os.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
+            target = salt.utils.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
             if not os.path.isfile(target):
                 return False
             os.remove(target)
@@ -137,7 +138,7 @@ def list_(bank, cachedir):
     """
     Return an iterable object containing all entries stored in the specified bank.
     """
-    base = os.path.join(cachedir, os.path.normpath(bank))
+    base = salt.utils.path.join(cachedir, os.path.normpath(bank))
     if not os.path.isdir(base):
         return []
     try:
@@ -158,8 +159,8 @@ def contains(bank, key, cachedir):
     Checks if the specified bank contains the specified key.
     """
     if key is None:
-        base = os.path.join(cachedir, os.path.normpath(bank))
+        base = salt.utils.path.join(cachedir, os.path.normpath(bank))
         return os.path.isdir(base)
     else:
-        keyfile = os.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
+        keyfile = salt.utils.path.join(cachedir, os.path.normpath(bank), f"{key}.p")
         return os.path.isfile(keyfile)

salt/client/ssh/shell.py

@@ -376,6 +376,13 @@ class Shell:
             cmd_lst.append(f"/bin/sh {cmd_part}")
         return cmd_lst
 
+    def _sanitize_str(self, text, sanitize_text):
+        """Remove all occurrences of sanitize_text from text"""
+        if not sanitize_text:
+            return text
+        replace_str = "*" * 6
+        return re.sub(r"\b" + re.escape(sanitize_text) + r"\b", replace_str, text)
+
     def _run_cmd(self, cmd, key_accept=False, passwd_retries=3):
         """
         Execute a shell command via VT. This is blocking and assumes that ssh
@@ -407,15 +414,11 @@ class Shell:
             while term.has_unread_data:
                 stdout, stderr = term.recv()
                 if stdout:
-                    if self.passwd:
-                        stdout = stdout.replace(self.passwd, ("*" * 6))
                     ret_stdout += stdout
                     buff = old_stdout + stdout
                 else:
                     buff = stdout
                 if stderr:
-                    if self.passwd:
-                        stderr = stderr.replace(self.passwd, ("*" * 6))
                     ret_stderr += stderr
                 if buff and RSTR_RE.search(buff):
                     # We're getting results back, don't try to send passwords
@@ -448,7 +451,7 @@ class Shell:
                         ret_stdout = (
                             "The host key needs to be accepted, to "
                             "auto accept run salt-ssh with the -i "
-                            "flag:\n{}".format(stdout)
+                            f"flag:\n{self._sanitize_str(stdout, self.passwd)}"
                         )
                         return ret_stdout, "", 254
                 elif buff and SUDO_PROMPT_RE.search(buff):
@@ -481,4 +484,6 @@ class Shell:
                     "VT reported both exitstatus and signalstatus as None. "
                     "This is likely a bug."
                 )
+        ret_stdout = self._sanitize_str(ret_stdout, self.passwd)
+        ret_stderr = self._sanitize_str(ret_stderr, self.passwd)
         return ret_stdout, ret_stderr, ret_status

salt/minion.py

@@ -1644,8 +1644,10 @@ class Minion(MinionBase):
                 tag=f"__master_req_channel_return/{request_id}",
                 wait=timeout,
             )
-            log.trace("Reply from main %s", request_id)
+            if ret:
-            return ret["ret"]
+                log.trace("Reply from main %s", request_id)
+                return ret["ret"]
+            raise TimeoutError("Request timed out")
 
     @salt.ext.tornado.gen.coroutine
     def _send_req_async(self, load, timeout):

salt/modules/rpm_lowpkg.py

@@ -22,20 +22,6 @@ try:
 except ImportError:
     HAS_RPM = False
 
-try:
-    import rpmUtils.miscutils
-
-    HAS_RPMUTILS = True
-except ImportError:
-    HAS_RPMUTILS = False
-
-try:
-    import rpm_vercmp
-
-    HAS_PY_RPM = True
-except ImportError:
-    HAS_PY_RPM = False
-
 
 log = logging.getLogger(__name__)
 
@@ -730,18 +716,11 @@ def version_cmp(ver1, ver2, ignore_epoch=False):
                     "labelCompare function. Not using rpm.labelCompare for "
                     "version comparison."
                 )
-        elif HAS_PY_RPM:
-            cmp_func = rpm_vercmp.vercmp
         else:
             log.warning(
                 "Please install a package that provides rpm.labelCompare for "
                 "more accurate version comparisons."
             )
-        if cmp_func is None and HAS_RPMUTILS:
-            try:
-                cmp_func = rpmUtils.miscutils.compareEVR
-            except AttributeError:
-                log.debug("rpmUtils.miscutils.compareEVR is not available")
 
         # If one EVR is missing a release but not the other and they
         # otherwise would be equal, ignore the release. This can happen if
@@ -756,6 +735,7 @@ def version_cmp(ver1, ver2, ignore_epoch=False):
         if cmp_func is None:
             ver1 = f"{ver1_e}:{ver1_v}-{ver1_r}"
             ver2 = f"{ver2_e}:{ver2_v}-{ver2_r}"
+
             if salt.utils.path.which("rpmdev-vercmp"):
                 log.warning(
                     "Installing the rpmdevtools package may surface dev tools in"
@@ -805,20 +785,7 @@ def version_cmp(ver1, ver2, ignore_epoch=False):
                     " comparisons"
                 )
         else:
-            if HAS_PY_RPM:
+            cmp_result = cmp_func((ver1_e, ver1_v, ver1_r), (ver2_e, ver2_v, ver2_r))
-                ver1 = f"{ver1_v}-{ver1_r}"
-                ver2 = f"{ver2_v}-{ver2_r}"
-
-                # handle epoch version comparison first
-                # rpm_vercmp.vercmp does not handle epoch version comparison
-                ret = salt.utils.versions.version_cmp(ver1_e, ver2_e)
-                if ret in (1, -1):
-                    return ret
-                cmp_result = cmp_func(ver1, ver2)
-            else:
-                cmp_result = cmp_func(
-                    (ver1_e, ver1_v, ver1_r), (ver2_e, ver2_v, ver2_r)
-                )
             if cmp_result not in (-1, 0, 1):
                 raise CommandExecutionError(
                     f"Comparison result '{cmp_result}' is invalid"

salt/modules/systemd_service.py

@@ -135,12 +135,8 @@ def _check_for_unit_changes(name):
     Check for modified/updated unit files, and run a daemon-reload if any are
     found.
     """
-    contextkey = f"systemd._check_for_unit_changes.{name}"
+    if _untracked_custom_unit_found(name) or _unit_file_changed(name):
-    if contextkey not in __context__:
+        systemctl_reload()
-        if _untracked_custom_unit_found(name) or _unit_file_changed(name):
-            systemctl_reload()
-        # Set context key to avoid repeating this check
-        __context__[contextkey] = True
 
 
 def _check_unmask(name, unmask, unmask_runtime, root=None):
@@ -154,20 +150,6 @@ def _check_unmask(name, unmask, unmask_runtime, root=None):
         unmask_(name, runtime=True, root=root)
 
 
-def _clear_context():
-    """
-    Remove context
-    """
-    # Using list() here because modifying a dictionary during iteration will
-    # raise a RuntimeError.
-    for key in list(__context__):
-        try:
-            if key.startswith("systemd._systemctl_status."):
-                __context__.pop(key)
-        except AttributeError:
-            continue
-
-
 def _default_runlevel():
     """
     Try to figure out the default runlevel.  It is kept in
@@ -355,19 +337,14 @@ def _systemctl_cmd(action, name=None, systemd_scope=False, no_block=False, root=
 
 def _systemctl_status(name):
     """
-    Helper function which leverages __context__ to keep from running 'systemctl
+    Helper function to run 'systemctl status'.
-    status' more than once.
     """
-    contextkey = "systemd._systemctl_status.%s" % name
+    return __salt__["cmd.run_all"](
-    if contextkey in __context__:
-        return __context__[contextkey]
-    __context__[contextkey] = __salt__["cmd.run_all"](
         _systemctl_cmd("status", name),
         python_shell=False,
         redirect_stderr=True,
         ignore_retcode=True,
     )
-    return __context__[contextkey]
 
 
 def _sysv_enabled(name, root):
@@ -424,7 +401,6 @@ def systemctl_reload():
         raise CommandExecutionError(
             "Problem performing systemctl daemon-reload: %s" % out["stdout"]
         )
-    _clear_context()
     return True
 
 

salt/modules/transactional_update.py

@@ -971,7 +971,7 @@ def call(function, *args, **kwargs):
                 return local.get("return", local)
             else:
                 return local
-        except ValueError:
+        except (ValueError, AttributeError):
             return {"result": False, "retcode": 1, "comment": ret_stdout}
     finally:
         # Check if reboot is needed

salt/modules/win_groupadd.py

@@ -65,7 +65,7 @@ def _get_group_object(name):
     """
     with salt.utils.winapi.Com():
         nt = win32com.client.Dispatch("AdsNameSpaces")
-        return nt.GetObject("", "WinNT://./" + name + ",group")
+        return nt.GetObject("", f"WinNT://./{name},group")
 
 
 def _get_all_groups():

salt/utils/json.py

@@ -27,10 +27,48 @@ def __split(raw):
 def find_json(raw):
     """
     Pass in a raw string and load the json when it starts. This allows for a
-    string to start with garbage and end with json but be cleanly loaded
+    string to start or end with garbage but the JSON be cleanly loaded
     """
     ret = {}
     lines = __split(raw)
+    lengths = list(map(len, lines))
+    starts = []
+    ends = []
+
+    # Search for possible starts and ends of the json fragments
+    for ind, line in enumerate(lines):
+        line = line.lstrip()
+        line = line[0] if line else line
+        if line == "{" or line == "[":
+            starts.append((ind, line))
+        if line == "}" or line == "]":
+            ends.append((ind, line))
+
+    # List all the possible pairs of starts and ends,
+    # and fill the length of each block to sort by size after
+    starts_ends = []
+    for start, start_char in starts:
+        for end, end_br in reversed(ends):
+            if end > start and (
+                (start_char == "{" and end_br == "}")
+                or (start_char == "[" and end_br == "]")
+            ):
+                starts_ends.append((start, end, sum(lengths[start : end + 1])))
+
+    # Iterate through all the possible pairs starting from the largest
+    starts_ends.sort(key=lambda x: (x[2], x[1] - x[0], x[0]), reverse=True)
+    for start, end, _ in starts_ends:
+        # Try filtering non-JSON text right after the last closing character
+        end_str = lines[end].lstrip()[0]
+        working = "\n".join(lines[start:end]) + end_str
+        try:
+            ret = json.loads(working)
+            return ret
+        except ValueError:
+            continue
+
+    # Fall back to old implementation for backward compatibility
+    # expecting json after the text
     for ind, _ in enumerate(lines):
         try:
             working = "\n".join(lines[ind:])

salt/utils/win_runas.py

@@ -96,6 +96,10 @@ def runas(cmdLine, username, password=None, cwd=None):
     Commands are run in with the highest level privileges possible for the
     account provided.
     """
+    # Sometimes this comes in as an int. LookupAccountName can't handle an int
+    # Let's make it a string if it's anything other than a string
+    if not isinstance(username, str):
+        username = str(username)
     # Validate the domain and sid exist for the username
     try:
         _, domain, _ = win32security.LookupAccountName(None, username)
@@ -265,6 +269,10 @@ def runas_unpriv(cmd, username, password, cwd=None):
     """
     Runas that works for non-privileged users
     """
+    # Sometimes this comes in as an int. LookupAccountName can't handle an int
+    # Let's make it a string if it's anything other than a string
+    if not isinstance(username, str):
+        username = str(username)
     # Validate the domain and sid exist for the username
     try:
         _, domain, _ = win32security.LookupAccountName(None, username)

tests/pytests/functional/cache/test_localfs.py

@@ -1,5 +1,6 @@
 import logging
 import shutil
+from pathlib import Path
 
 import pytest
 
@@ -23,3 +24,61 @@ def cache(minion_opts):
 
 def test_caching(subtests, cache):
     run_common_cache_tests(subtests, cache)
+
+
+def test_store_is_constrained_to_cachedir(cache, tmp_path):
+    cache.store(str(tmp_path), "yikes", "wat")
+    assert not (tmp_path / "yikes.p").exists()
+    assert (Path(cache.cachedir) / str(tmp_path)[1:]).exists()
+
+
+@pytest.mark.parametrize(
+    "full_path,in_key", ((False, False), (False, True), (True, False))
+)
+def test_fetch_is_constrained_to_cachedir(cache, tmp_path, full_path, in_key):
+    fake_data = b"\xa1a"
+    if full_path:
+        cbank = f"{tmp_path}/yikes"
+        ckey = "foo"
+        data = {"foo": "wat"}
+        fake_data = b"\x81\xa3foo\xa1a"
+    elif in_key:
+        cbank = "/"
+        ckey = f"{tmp_path}/yikes"
+        data = "wat"
+    else:
+        cbank = str(tmp_path)
+        ckey = "yikes"
+        data = "wat"
+    (tmp_path / "yikes.p").write_bytes(fake_data)
+    cache.store(str(tmp_path)[1:], "yikes", data)
+    res = cache.fetch(cbank, ckey)
+    assert res == "wat"
+
+
+def test_updated_is_constrained_to_cachedir(cache, tmp_path):
+    (tmp_path / "yikes.p").touch()
+    assert not cache.updated(str(tmp_path), "yikes")
+
+
+@pytest.mark.parametrize("key", (None, "yikes"))
+def test_flush_is_constrained_to_cachedir(cache, tmp_path, key):
+    tgt = tmp_path
+    if key is not None:
+        tgt = tmp_path / f"{key}.p"
+        tgt.touch()
+    cache.flush(str(tmp_path), key)
+    assert tgt.exists()
+
+
+def test_list_is_constrained_to_cachedir(cache, tmp_path):
+    (tmp_path / "yikes").touch()
+    res = cache.list(str(tmp_path))
+    assert "yikes" not in res
+
+
+@pytest.mark.parametrize("key", (None, "yikes"))
+def test_contains_is_constrained_to_cachedir(cache, tmp_path, key):
+    if key is not None:
+        (tmp_path / f"{key}.p").touch()
+    assert not cache.contains(str(tmp_path), key)

tests/pytests/functional/minion/test_minion.py

@@ -0,0 +1,14 @@
+import pytest
+
+import salt.minion
+
+
+def test_minion_send_req_async(minion_opts):
+    """
+    Ensure Minion._send_req_sync raises a TimeoutError when no reply is
+    received.
+    """
+
+    minion = salt.minion.Minion(minion_opts)
+    with pytest.raises(TimeoutError):
+        minion._send_req_sync({"load": "meh"}, 10)

tests/pytests/functional/utils/test_win_runas.py

@@ -2,8 +2,11 @@
 Test the win_runas util
 """
 
+from random import randint
+
 import pytest
 
+import salt.modules.win_useradd as win_useradd
 import salt.utils.win_runas as win_runas
 
 pytestmark = [
@@ -18,6 +21,15 @@ def user():
         yield account
 
 
+@pytest.fixture
+def int_user():
+    with pytest.helpers.create_account() as account:
+        int_name = randint(10000, 99999)
+        win_useradd.rename(account.username, int_name)
+        account.username = int_name
+        yield account
+
+
 @pytest.mark.parametrize(
     "cmd, expected",
     [
@@ -54,3 +66,31 @@ def test_compound_runas_unpriv(user, cmd, expected):
         password=user.password,
     )
     assert expected in result["stdout"]
+
+
+def test_runas_str_user(user):
+    result = win_runas.runas(
+        cmdLine="whoami", username=user.username, password=user.password
+    )
+    assert user.username in result["stdout"]
+
+
+def test_runas_int_user(int_user):
+    result = win_runas.runas(
+        cmdLine="whoami", username=int(int_user.username), password=int_user.password
+    )
+    assert str(int_user.username) in result["stdout"]
+
+
+def test_runas_unpriv_str_user(user):
+    result = win_runas.runas_unpriv(
+        cmd="whoami", username=user.username, password=user.password
+    )
+    assert user.username in result["stdout"]
+
+
+def test_runas_unpriv_int_user(int_user):
+    result = win_runas.runas_unpriv(
+        cmd="whoami", username=int(int_user.username), password=int_user.password
+    )
+    assert str(int_user.username) in result["stdout"]

tests/pytests/pkg/conftest.py

@@ -228,8 +228,12 @@ def salt_factories_config(salt_factories_root_dir):
 
 @pytest.fixture(scope="session")
 def install_salt(request, salt_factories_root_dir):
+    if platform.is_windows():
+        conf_dir = "c:/salt/etc/salt"
+    else:
+        conf_dir = salt_factories_root_dir / "etc" / "salt"
     with SaltPkgInstall(
-        conf_dir=salt_factories_root_dir / "etc" / "salt",
+        conf_dir=conf_dir,
         pkg_system_service=request.config.getoption("--pkg-system-service"),
         upgrade=request.config.getoption("--upgrade"),
         downgrade=request.config.getoption("--downgrade"),
@@ -371,7 +375,7 @@ def salt_master(salt_factories, install_salt, pkg_tests_account):
         python_executable = install_salt.install_dir / "Scripts" / "python.exe"
         salt_factories.python_executable = python_executable
         factory = salt_factories.salt_master_daemon(
-            random_string("master-"),
+            "pkg-test-master",
             defaults=config_defaults,
             overrides=config_overrides,
             factory_class=SaltMasterWindows,
@@ -380,7 +384,7 @@ def salt_master(salt_factories, install_salt, pkg_tests_account):
         salt_factories.system_service = True
     else:
         factory = salt_factories.salt_master_daemon(
-            random_string("master-"),
+            "pkg-test-master",
             defaults=config_defaults,
             overrides=config_overrides,
             factory_class=SaltMaster,
@@ -438,7 +442,6 @@ def salt_minion(salt_factories, salt_master, install_salt):
         "fips_mode": FIPS_TESTRUN,
         "encryption_algorithm": "OAEP-SHA224" if FIPS_TESTRUN else "OAEP-SHA1",
         "signing_algorithm": "PKCS1v15-SHA224" if FIPS_TESTRUN else "PKCS1v15-SHA1",
-        "open_mode": True,
     }
     if platform.is_windows():
         config_overrides["winrepo_dir"] = (
@@ -475,6 +478,16 @@ def salt_minion(salt_factories, salt_master, install_salt):
                     continue
                 subprocess.run(["chown", "-R", "salt:salt", str(path)], check=False)
 
+    if platform.is_windows():
+        minion_pki = pathlib.Path("c:/salt/etc/salt/pki")
+        if minion_pki.exists():
+            salt.utils.files.rm_rf(minion_pki)
+
+        # Work around missing WMIC until 3008.10 has been released.
+        grainsdir = pathlib.Path("c:/salt/etc/grains")
+        grainsdir.mkdir(exist_ok=True)
+        shutil.copy(r"salt\grains\disks.py", grainsdir)
+
     factory.after_terminate(
         pytest.helpers.remove_stale_minion_key, salt_master, factory.id
     )