Merge forward #69894 - #69955
Open
lkubb wants to merge 12 commits into
Open
Conversation
Note: This also syncs handling of private key decryption errors with 3006.x - the changes were dropped during a merge forward because the logic migrated from the state module to utils.
Contributor
Author
|
failures unrelated, 3007.x needs #69929 |
Cherry-picked from 3006.x (649ada8 / PR saltstack#69929). Relenv 0.22.18 includes the pip 26.2 InstallRequirement.install/install_wheel wrapper fix (relenv PR saltstack#314) that the four preceding revert commits were working around.
twangboy
approved these changes
Aug 5, 2026
dwoz
added a commit
to dwoz/salt
that referenced
this pull request
Aug 16, 2026
Three merge-resolution fixes surfaced by the CI run on PR saltstack#70063: 1. salt/crypt.py: _get_pub_key_with_evict was calling PublicKey(path), but PublicKey.__init__ takes key_bytes on 3007.x+. Open the file and pass the bytes (matches 3008.x). Every minion/master factory was failing to start with: TypeError: argument 'data': Cannot convert "<class 'str'>" instance to a buffer at salt/crypt.py:1619 -> ~290 downstream test failures cascaded from this single bug. 2. salt/states/x509_v2.py: forward-port the missing new_replace handling in certificate_managed so the follow_symlinks replace=True is preserved when check_cert_changes runs (per @lkubb's saltstack#69955 adaptation for the check_cert_changes refactor). 3. tests/pytests/functional/metaproxy/test_proxy_{exec_,}pillar_refresh.py: rewrite salt.ext.tornado imports to plain tornado (salt.ext.tornado was removed on 3007.x). Fixes the Lint job and the 2-file collection error that cascaded into ~231 Test Salt failures.
dwoz
pushed a commit
to dwoz/salt
that referenced
this pull request
Aug 16, 2026
Two 3006.x fix intents were silently dropped by the 3007.x refactors, same class of shadow-refactor bug as the saltstack#69895 x509_v2 case @lkubb caught in saltstack#69955: 1. salt/utils/x509.py: saltstack#69893 (PKCS#7 unordered chain compare). compare_ca_chain() gained an `unordered=False` parameter with fingerprint-set comparison; check_cert_changes() now passes `unordered="pkcs7" in current_encoding` so PKCS#7-loaded certs don't spuriously report additional_certs changes on every run. order_certs_naively() was already carried in; only the compare half was dropped when the state's chain-compare logic was absorbed into x509util.check_cert_changes. Adapted from @lkubb's PR saltstack#69955 commit cbfa2c2. 2. salt/loader/__init__.py: saltstack#69983 (whitelist_modules two-loader). The two-loader split from 3006.x was merged, but the 3007.x `pack["__pillar__"] = pillar` assignment ended up between the inner salt_dunder and outer whitelist-filtered ret constructions, leaving salt_dunder without __pillar__. Moved the assignment before salt_dunder is built so both loaders receive pillar, preserving the 3007.x behavior for internal __salt__[...] calls.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
x509_v2#69894 to3007.x(which is very similar to 3008.x now, so merge forward from here on should just work).salt/utils/x509.py.x509_v2wrapper docstrings accordingly.Trying to ensure the latest changes are merged forward correctly.
Note: The wrapper has only been released in 3008, but the current 3007 branch contains it, so I included its updates here. Same for the lost unrelated changes.
Merge requirements satisfied?
[NOTICE] Bug fixes or features added to Salt require tests.
Commits signed with GPG?
Yes