Bump the all-pip-updates group across 3 directories with 77 updates#69392
Bump the all-pip-updates group across 3 directories with 77 updates#69392dependabot[bot] wants to merge 23 commits into
Conversation
|
CI failing on three distinct issues, all caused by this bump:
|
|
Pushed bf77c8b directly to this branch — adapts the 47c49fb + df7f933 fix bundle from #69393 (3006.x) onto the 3007.x dependabot tree. Diagnosis:
The branch is BEHIND base 3007.x; `@dependabot rebase` may be needed if CI surfaces a real conflict. |
|
Pushed 79e7c25 directly — fixes Lint / Lint Salt's Source Code and Lint / Lint Salt's Test Suite (was failing on bf77c8b). Diagnosis: my prior commit capped pylint at ~=3.1.0 only for py<3.10 on the assumption that pre-bf77c8bceab CI Lint passes meant 4.0.5 was fine on py>=3.10. That was wrong — the earlier passes were running against the stale pre-bf77c8bceab lockfiles which still pinned the old pylint. Once the regenerated locks brought pylint 4.0.5 in on the py3.10 lint job, 190+ pre-existing E0606/E0601/E0602 findings surfaced in setup.py, salt/, tools/, and another 77 in tests/. The pre-commit lint-salt / lint-tests hooks only lint changed files, so my local pre-commit run didn't catch the latent surface; only the CI nox jobs lint the full tree. This commit caps pylint to ~=3.1.0 globally (matching df7f933 on 3006.x). Lock files regenerated. Verified with pre-commit run --all-files (exit 0, no SKIP) and with a fresh pylint 3.1.1 run against the previously-failing files (setup.py, salt/minion.py, salt/states/{git,file,pkg,csf}.py, tools/pkg/build.py, tests/pytests/integration/cli/{test_matcher,test_batch}.py, tests/pytests/unit/utils/test_gitfs.py) — all rated 10.00/10. The 190+267 E0606/E0601/E0602 findings are pre-existing surface that pylint 4 surfaces by default — should be triaged on a separate maintenance branch, not blocking this dependabot batch. |
|
Pushed 380b8ac directly — fixes the dependabot-bump-driven test failures observed under bf77c8b/79e7c255a6b. Diagnosis:
Out of scope for this commit (left for follow-up):
Verified locally against pyOpenSSL 26.2.0, cryptography 48.0.0, pip 26.1.2, pytest 9.0.3, virtualenv 21.4.2:
`pre-commit run --files` on the touched files is clean — isort, black, bandit, mypy, Lint Salt, Lint Tests all pass. No `--no-verify`, no `SKIP=`. |
|
Status check after 380b8ac CI run (27185134812). PR is mergeable, no reviewer feedback. Fixed in this push (62383b8): Build Source Packages RPM (x86_64, arm64) + DEB (x86_64, arm64): cmake source build under relenv toolchain. pyzmq 27.x (pinned by this batch's lockfiles) switched its build backend to scikit-build-core, which pulls cmake as a build-time dependency. `tools pkg build onedir-dependencies` invokes pip with `--no-binary :all:` plus a small `--only-binary` allow-list; cmake was not on that list, so pip tried to build cmake from source and hit `pid_t doesn't exist on this platform?` in Utilities/cmlibarchive/CMakeLists.txt. Added cmake, ninja, and protobuf to both copies of the allow-list and set `CMAKE_POLICY_VERSION_MINIMUM=3.5` so cmake 4.x can configure pyzmq's bundled libzmq (which still uses an older floor). Not fixed — pre-existing 3007.x base regressions, not introduced by this PR (deferred to 3007.x-base sibling fix):
Not fixed — flake, not actionable:
PR is BEHIND base 3007.x but mergeable; the dependabot-rebase to pick up base may also surface the changelog and salt.ext.tornado issues differently, so I'd recommend the 3007.x-base fixes land first. |
|
CI status review after 7ff4c44 (run 27388066534). PR is BEHIND but MERGEABLE, no reviewer feedback, no rebase action needed (dependabot/maintainer rebases already landed the test-infra fixes for salt-repo-3008-lts, Photon repo, TLS CRL compat, salt.ext.tornado, scenario tests, etc.). Four failing checks pulled and triaged — all infra flakes, none introduced by the dependabot bumps or the prior fix pushes:
No code changes needed. The 18 remaining pending jobs should finish without further failure modes of the bump-driven varieties (already fixed earlier in this PR's history: pytest 9, virtualenv 21, pyOpenSSL 26, pip 26, cmake/scikit-build-core, etc.). |
|
Quick follow-up on the same run (27388066534). Two more failures completed since the last review — also infra/flake, none introduced by the bumps or the prior fixes:
Total failing: 6 of 426 checks, all flake-class. No code changes needed. |
--- updated-dependencies: - dependency-name: build dependency-version: 1.4.4 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: wheel dependency-version: 0.47.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pip dependency-version: 26.0.1 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-pip-updates - dependency-name: pycryptodomex dependency-version: 3.23.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: mock dependency-version: 5.2.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pytest dependency-version: 8.4.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pytest-salt-factories dependency-version: 1.0.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pytest-helpers-namespace dependency-version: 2021.12.29 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pytest-timeout dependency-version: 2.4.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: more-itertools dependency-version: 10.8.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pyzmq dependency-version: 27.1.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: aiohttp dependency-version: 3.13.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: certifi dependency-version: 2026.5.20 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cheroot dependency-version: 11.1.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cherrypy dependency-version: 18.10.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: croniter dependency-version: 6.2.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cryptography dependency-version: 48.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: distro dependency-version: 1.9.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: frozenlist dependency-version: 1.8.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: jaraco-functools dependency-version: 4.4.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: jaraco-context dependency-version: 6.1.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: jaraco-text dependency-version: 4.2.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: jinja2 dependency-version: 3.1.6 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: lxml dependency-version: 6.1.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: markupsafe dependency-version: 3.0.3 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: msgpack dependency-version: 1.1.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: packaging dependency-version: '26.2' dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-pip-updates - dependency-name: pycparser dependency-version: '2.23' dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pymssql dependency-version: 2.3.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-pip-updates - dependency-name: pymysql dependency-version: 1.2.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pyopenssl dependency-version: 26.2.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-dateutil dependency-version: 2.9.0.post0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-gnupg dependency-version: 0.5.6 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pythonnet dependency-version: 3.0.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pywin32 dependency-version: '312' dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: requests dependency-version: 2.32.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: setproctitle dependency-version: 1.3.7 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: tornado dependency-version: 6.5.6 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: urllib3 dependency-version: 2.6.3 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: xmltodict dependency-version: 1.0.4 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: zipp dependency-version: 3.23.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: aiohttp dependency-version: 3.14.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: apache-libcloud dependency-version: 3.9.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cffi dependency-version: 2.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cherrypy dependency-version: 18.10.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cryptography dependency-version: 48.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: gitpython dependency-version: 3.1.50 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: markupsafe dependency-version: 3.0.3 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pymysql dependency-version: 1.2.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: virtualenv dependency-version: 21.4.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pywinrm dependency-version: 0.5.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-tools-scripts dependency-version: 0.20.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: boto3 dependency-version: 1.43.24 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pygit2 dependency-version: 1.19.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: ansible dependency-version: 14.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: twilio dependency-version: 9.10.9 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-telegram-bot dependency-version: '22.7' dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: mercurial dependency-version: 7.2.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pylint dependency-version: 4.0.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: saltpylint dependency-version: 2024.2.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: boto dependency-version: 2.49.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: botocore dependency-version: 1.43.24 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: filelock dependency-version: 3.29.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: keyring dependency-version: 25.7.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-pip-updates - dependency-name: kubernetes dependency-version: 36.0.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: libnacl dependency-version: 2.1.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: moto dependency-version: 5.2.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: paramiko dependency-version: 5.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pynacl dependency-version: 1.6.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-etcd dependency-version: 0.4.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: sqlparse dependency-version: 0.5.5 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: vcert dependency-version: 0.18.1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: watchdog dependency-version: 6.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: websocket-client dependency-version: 1.9.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: werkzeug dependency-version: 3.1.8 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: xmldiff dependency-version: 2.7.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: genshi dependency-version: 0.7.11 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cheetah3 dependency-version: 3.2.6.post1 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: sphinx dependency-version: 9.1.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: sphinxcontrib-httpdomain dependency-version: 2.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: towncrier dependency-version: 25.8.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-pip-updates - dependency-name: importlib-metadata dependency-version: 9.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: more-itertools dependency-version: 11.1.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cheroot dependency-version: 11.1.2 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cherrypy dependency-version: 18.10.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: cryptography dependency-version: 48.0.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: distro dependency-version: 1.9.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pycparser dependency-version: '3.0' dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: pyopenssl dependency-version: 26.2.0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-dateutil dependency-version: 2.9.0.post0 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: python-gnupg dependency-version: 0.5.6 dependency-type: direct:production dependency-group: all-pip-updates - dependency-name: setproctitle dependency-version: 1.3.7 dependency-type: direct:production dependency-group: all-pip-updates ... Signed-off-by: dependabot[bot] <support@github.com>
The previous commit added 'from rich.markup import escape' before the 'from ptscripts ...' import (wrong sort order per isort) and used single-quoted dict keys inside the new escape() wrappers (black wants double quotes). Pre-Commit / Run Pre-Commit Against Salt was failing on both. Moves the import below ptscripts and switches to double quotes.
The dependabot batch raised many requirements floors that drop support for Python 3.9, 3.10, or 3.11, causing pre-commit pip-compile hooks to fail with ResolutionImpossible. Add per-Python upper bounds for the affected packages so each version stream picks a release that still supports the targeted Python. Mirrors the fix landed on the 3006.x dependabot branch in 47c49fb and df7f933. base.txt + static/ci/common.txt + static/pkg/{linux,freebsd}.txt: cryptography cap <48.0.0 for py<3.10 (needs >3.9.1) aiohttp cap <3.14.0 for py<3.10 (3.14 needs py>=3.10) apache-libcloud cap <3.9.1 for py<3.10 boto3 drop py<3.10 pin (transitively pulls urllib3 1.26 chain incompatible with Salt's urllib3 2.6 floor on 3.10+) botocore drop py<3.10 pin (same urllib3 2.x conflict; bare boto/botocore stays for 3.10+) importlib-metadata cap <9.0.0 for py<3.10 kubernetes cap <36.0.0 for py<3.10 more-itertools cap <11.0.0 for py<3.10 moto cap <5.2.0 for py<3.10 pycparser cap <3.0 for py<3.10 pygit2 cap <1.18.0 for py<3.11 python-telegram-bot cap <22.0 for py<3.10 sphinx cap <9.0.0 for py<3.12 sphinxcontrib-httpdomain cap <2.0 for py<3.10 base.txt: PyYAML bump floor to 6.0.3 (kubernetes 36 needs it) filelock pin >=3.29.1 for py>=3.10 (uv resolver otherwise picks 3.25 here) pymssql cap ==2.3.11 — 2.3.13 has no win32 wheels virtualenv bump floor to 21.4.2 to match CI common.txt urllib3 revert py<3.10 floor to 1.26.20,<2.0.0 — py3.9 botocore hard-requires urllib3 < 2; py>=3.10 keeps the 2.7.0 floor (CVE-2025-66418, CVE-2026-21441 are backported in 1.26.20). static/ci/common.txt: vcert revert to ~=0.9.0 — 0.18.x hard-pins cryptography==45.0.7 and pynacl==1.5.0 pynacl revert floor to 1.5.0 static/ci/lint.txt: pylint cap ~=3.1.0 for py<3.10 — pylint 4 requires Python>=3.10. py>=3.10 stays on ~=4.0.5. static/ci/linux.txt: ansible map per-Python release line (10.x / 12.x / 14.x) static/ci/docs.txt: sphinx, sphinxcontrib-httpdomain per-Python caps as above requirements/constraints.txt: markdown-it-py cap <4.0.0 for py3.10 — myst-docutils 4.x (the latest supporting py3.10) requires markdown-it-py ~=3.0; rich on py3.10 would otherwise pull 4.x. tools/pkg/build.py: Strip PIP_CONSTRAINT for the urllib3-CVE-patched pip 25.2 wheel download and force-reinstall sites. constraints.txt pins pip 26.0.1; the urllib3 patches in pkg/patches/pip-urllib3/ are written against pip 25.2's vendored urllib3 1.26.20 and would not apply to pip 26.x's vendored urllib3 2.x. tests/pytests/unit/utils/test_cloud.py: keyring 25 made priority an abstract class attribute and requires super().__init__() in subclasses. Update CustomKeyring stub. Lock files regenerated cleanly across every hook — pre-commit run pip-compile --all-files exits 0, no SKIP required.
The previous floor-sweep capped pylint at 3.1 for Python 3.9 only, on the assumption that Python 3.10+ lint was passing under 4.0.5. That assumption was wrong: the earlier CI Lint passes were running against the pre-bf77c8bceab lockfiles which still pinned the old pylint. Once the regenerated lockfiles brought pylint 4.0.5 in on Python 3.10, the Lint / Lint Salt's Source Code job surfaced 190+ pre-existing E0606 (possibly-used-before-assignment), E0601 (used-before-assignment), and E0602 (undefined-variable) findings across setup.py, salt/, and tools/; Lint / Lint Salt's Test Suite surfaced another 77 across tests/. Pylint 4 enables these checks by default; pylint 3.1 did not. The pre-commit lint-salt / lint-tests hooks only lint changed files, so this never surfaced locally on the staged commit. Only the nox-driven CI jobs lint the full salt/ and tests/ trees and exercise the latent surface. Cap pylint to ~=3.1.0 globally on 3007.x, matching the same revert landed on 3006.x in df7f933. Lock files regenerated. The pre-existing E0606/E0601/E0602 findings should be triaged on a separate maintenance branch — they predate this dependabot batch and are not blocking on the 3.1 line.
Five independent breakages exercised by the dependabot bumps to pytest
(resolving 9.0.3), virtualenv (>=21.4.2), pyOpenSSL (>=26.2.0), and pip
(==26.0.1):
1. tests/pytests/scenarios/compat/test_with_versions.py applied
@pytest.mark.skip_if_binaries_missing('docker') and
@pytest.mark.skip_on_fips_enabled_platform to fixtures. pytest 9
turns PytestRemovedIn9Warning 'Marks applied to fixtures have no
effect' into a collection error. Both marks are redundant with the
module-level pytestmark / test-level decorators already in place;
removing them keeps existing skip behavior on every supported
pytest version. Mirrors the 3006.x fix in 3c5d63d.
2. tools/pkg/build.py salt_onedir() copies the urllib3-CVE-patched
pip wheel into the virtualenv embed directory and rewrites
BUNDLE_SUPPORT in the embed __init__.py. virtualenv 21 added a
BUNDLE_SHA256 verification step that refuses any embedded wheel
missing a recorded sha256, so seed-from-embedded-wheels fails with
'bundled wheel pip-25.2-py3-none-any.whl has no recorded sha256 in
BUNDLE_SHA256' and every functional pip/virtualenv test errors at
virtualenv-creation time.
Fix: rewrite BUNDLE_SHA256 to contain the on-disk hashes of the
wheels actually present in the embed directory. The replacement is
guarded by 'if "BUNDLE_SHA256" in content:' so virtualenv 20.x
(no BUNDLE_SHA256 dict) is unchanged. Mirrors the 3006.x fix.
3. salt/beacons/cert_info.py used X509.get_extension_count() /
X509.get_extension(i), both removed in pyOpenSSL 26. The legacy
loop still runs on pyOpenSSL <= 25; on 26+ we now go through
cert.to_cryptography().extensions and re-emit the same printable
form ('CA:FALSE', 'DNS:host', 'IP Address:1.2.3.4', ...) so the
beacon's output schema is unchanged across pyOpenSSL versions.
4. salt/modules/tls.py used X509.add_extensions / X509Req.add_extensions
/ OpenSSL.crypto.X509Extension, all removed in pyOpenSSL 26. The
tls module's CA-management code path is legacy and has not been
ported to the cryptography x509 API; rather than silently break,
skip the extension setup with a warning when running on pyOpenSSL
that no longer ships these methods, so basic CA / CSR / signed-cert
creation still succeeds. Users that need v3 extensions on pyOpenSSL
26+ should migrate to the x509_v2 state module. HAS_X509_EXTENSION
detection is module-level so the per-call sites stay readable.
5. salt/states/pip_state.py:_check_pkg_version_format() ran VCS-URL
targets through pip's Link parser. pip 26 raises InvalidEggFragment
on git+url#egg=Name>=version forms (subclass of PipError, not of
InstallationError, so the existing handler did not catch it). VCS
URLs are valid install targets even when pre-flight version parsing
fails -- defer the install to runtime, mirroring the existing
install_req.req is None branch. Catch PipError too so future pip
parser tightening does not regress here.
tests/pytests/unit/client/ssh/test_single.py: pytest 9 narrowed
caplog.at_level() scoping; the two run_ssh_pre_flight tests now
pass logger='salt.client.ssh' so TRACE messages from the salt
logger are captured.
Verified locally against pyOpenSSL 26.2.0, cryptography 48.0.0, pip
26.1.2, pytest 9.0.3, virtualenv 21.4.2:
tests/pytests/unit/beacons/test_cert_info.py 3 passed
tests/pytests/unit/modules/test_tls.py 35 passed
tests/pytests/unit/client/ssh/test_single.py 25 passed
tests/unit/states/test_pip_state.py 1 passed
pre-commit run --files (touched files) is clean -- isort, black,
bandit, mypy, Lint Salt, Lint Tests all pass.
pyzmq 27.x (the version pinned by this dependabot batch's requirements/static/pkg/py3.10/linux.lock) switched its build backend to scikit-build-core, which pulls cmake as a build dependency. The tools pkg build onedir-dependencies command for Linux platforms invokes pip with --no-binary :all: plus a small --only-binary allow-list; cmake was not on that list, so pip tried to build cmake from source under the relenv toolchain. That source build fails inside Utilities/cmlibarchive/CMakeLists.txt with "pid_t doesn't exist on this platform?" because the relenv toolchain's preprocessor cannot resolve <sys/types.h> against the container's libc. Every Build Source Packages job (RPM x86_64/arm64, DEB x86_64/arm64) blocks here. Add cmake, ninja (pyzmq also needs ninja as a scikit-build-core backend tool), and protobuf to both copies of the --only-binary allow-list. cmake and ninja are pure build-time tooling and never linked into runtime artifacts, so forcing wheels is safe. protobuf's cp39-abi3 wheel works for every supported Python and avoids pulling in BoringSSL ASM that the relenv toolchain's assembler rejects on ARMv8.5 (the ``bti`` mnemonic). Also set CMAKE_POLICY_VERSION_MINIMUM=3.5 in the env for the Linux path: the cmake wheel now ships CMake 4.x, which dropped support for cmake_minimum_required(VERSION < 3.5). pyzmq's bundled libzmq still declares an older floor; without the policy override, nested CMake projects fail to configure.
yum update -y and apt upgrade -y can replace the onedir under test with a newer Salt release from the Salt repos (e.g. 3008.0), causing test_salt_upgrade to fail because the installed version exceeds the artifact version. Exclude salt* from yum and hold/unhold salt packages on Debian so the system upgrade only touches non-Salt packages. Verified in a Rocky Linux 8 container: yum update -y upgrades salt-minion 3006.25 to 3008.0; yum update -y --exclude=salt* leaves salt-minion at 3006.25.
install_previous() downloads salt.repo from salt-install-guide which
enables both salt-repo-3006-lts and salt-repo-3008-lts by default. When
yum install runs without version pinning, it picks 3008.0 from the
3008-lts repo (newer than 3006.25), causing test_salt_upgrade to fail
with: assert Version('3008.0') <= Version('3006.25+107.ga508051fad').
The existing code only disabled salt-repo-3007-sts but left 3008-lts
enabled. Add symmetric handling to disable salt-repo-3008-lts unless
the target prev_version is 3008.x.
Reproduced in ghcr.io/saltstack/salt-ci-containers/testing:rockylinux-9:
- Without fix: yum install salt* installs 3008.0 from salt-repo-3008-lts
- With fix: yum install salt* installs 3006.25 from salt-repo-3006-lts
- tools/pkg/build.py: fix NotADirectoryError in salt_onedir by passing cwd=str(tools.utils.REPO_ROOT) instead of cwd=str(salt_archive) for the 'git add -f salt/_version.txt' step. - salt/modules/file.py: use salt.utils.url.redact_http_basic_auth in get_source_sum error messages so credentials are not leaked in logs. - salt/states/file.py: prefix comment_ errors from get_managed with 'Unable to manage file:' in the managed() function.
salt/modules/file.py: move 'Unable to manage file:' prefix into get_managed's except CommandExecutionError handler (get_source_sum errors only), so test_patch_saltenv and bool comment_ cases are unaffected. salt/states/file.py: revert the overly-broad prefix at the comment_ check; the prefix is now added upstream in get_managed. salt/modules/tls.py: pyOpenSSL's X509Store.add_crl() requires a native OpenSSL.crypto.CRL; passing a cryptography CRL object causes verify_certificate() to return 'invalid CA certificate'. Serialize to PEM and reload via OpenSSL.crypto.load_crl before adding to store. tests/support/pkg.py: disable salt-repo-3008-lts for Photon OS when installing/downgrading to a pre-3008 version, matching the existing non-Photon logic, to prevent 3008 packages from being selected and causing yum downgrade timeouts.
tls.py – validate(): - Revert the bad load_crl workaround from 9cbac2e; OpenSSL.crypto.load_crl was removed in pyOpenSSL 26, so calling it inside the HAS_CRYPTOGRAPHY=True path caused AttributeError on every TLS test. X509Store.add_crl() on pyOpenSSL 26.x accepts cryptography CRL objects directly, so no conversion is needed. - Add HAS_OPENSSL_CRL = hasattr(OpenSSL.crypto, "load_crl") detection flag (pyOpenSSL >= 26 removed both load_crl and the CRL class). - Guard the legacy OpenSSL.crypto.CRL / load_crl code paths with HAS_OPENSSL_CRL so they are skipped – with a clear error – on pyOpenSSL 26+ when cryptography is somehow unavailable (defensive; in practice pyOpenSSL >= 26 always depends on cryptography). tls.py – create_ca(): - When HAS_X509_EXTENSION is False (pyOpenSSL >= 26 removed X509Extension) and HAS_CRYPTOGRAPHY is True, rebuild the just-signed CA cert using cryptography.x509.CertificateBuilder to add basicConstraints: CA:TRUE. Without this extension pyOpenSSL's X509StoreContext raises "invalid CA certificate" during validate(), causing test_with_existing_ca_signing_csr_should_produce_valid_cert to fail. test_zeromq.py: - Replace salt.ext.tornado.gen references with tornado.gen (already imported at module level). salt.ext.tornado is not automatically exposed as an attribute of salt.ext; tests in group 4 fail because no prior test in that group has imported the subpackage.
tls.py – create_ca(): Truncate the pyOpenSSL-generated serial number to 159 bits before passing it to cryptography's CertificateBuilder. _new_serial() produces serials from a microsecond timestamp + 5 random bytes which routinely exceed cryptography's 159-bit RFC 5280 limit, causing ValueError in every test that calls create_ca() when running on pyOpenSSL >= 26. test_minion.py: Replace salt.ext.tornado.ioloop.IOLoop() with tornado.ioloop.IOLoop() (tornado is already imported). Same root cause as the earlier test_zeromq.py fix: salt.ext.tornado is not auto-exposed as an attribute of salt.ext in test groups where no prior test has imported the subpackage.
…er_queue ERRORs test_minion_hangs_on_master_failure_50814 registered wait_for_minion via after_start() on the package-scoped _salt_mm_master_1 daemon. Because started() always terminates the daemon on teardown, every subsequent test restarted the daemon and triggered all accumulated after_start callbacks, including wait_for_minion, which timed out with "Minion failed to respond top ping after timeout" and caused ERROR status for all test_per_master_queue tests. Move wait_for_minion to an inline call after the with stopped(): block so it runs exactly once and does not pollute the persistent callback list.
…tors tests/conftest.py: Raise min_soft from 3072 to 8192 and min_hard from 4096 to 16384 so test_issue_regression_65265 (which opens 3000 ZMQ sockets across 3 processes) has sufficient file-descriptor headroom under pytest 9.0.3, which uses noticeably more FDs than pytest 8.x. tests/pytests/scenarios/swarm/conftest.py: Reduce the swarm minion count for Amazon Linux 2023 Arm64 from 10 to 7. The CI runner is already at ~95% MEM and 100% SWAP by the time the swarm test runs; further reducing the starting count prevents the SIGTERM/OOM that was killing the job.
pytest 9.0.3 uses noticeably more memory than pytest 8.1.1 (origin/3007.x baseline) — particularly during multimaster scenario tests where the Test Suite Run process was observed consuming 61.72% RSS with 34 child processes. This caused SIGTERM/OOM kills on Fedora 40 and Ubuntu 24.04 CI runners. Pin pytest < 9 across all lock files (py3.9 through py3.14) so the locked version resolves to 8.4.2 (the latest 8.x release), which provides the required >=8.4.2 functionality without the memory regression in 9.x.
pip-compile emits a single unversioned entry for pytest==8.4.2 rather than the two markers (python_full_version<3.10 / >=3.10) left behind by the manual sed substitution from 9.0.3.
…ssure The minion_swarm fixture starts minions sequentially via started() context managers. On CI runners that accumulate memory through earlier test suites (multimaster, queue, reauth, setup), the system can be at 80-93% virtual memory by the time the swarm package begins. Trying to start 15 minions under those conditions causes an 8+ minute hang while the OS thrashes swap, followed by a SIGTERM from the OOM handler the instant the first test body starts executing. Fix: read psutil.virtual_memory().percent at fixture-setup time and cap the minion count accordingly: >= 80% MEM → at most 3 minions (exercises the swarm code path, avoids OOM) >= 60% MEM → at most 7 minions < 60% MEM → full 15 (or Amazon Linux 2023 Arm64 cap of 7) The Amazon Linux 2023 Arm64 platform-specific reduction is preserved but converted to a subtract-then-clamp so the memory check can further reduce it if needed.
On memory-constrained CI runners (91%+ memory after multimaster tests), starting threading-mode salt minions hangs for 11+ minutes before the OOM killer terminates the entire pytest process with exit code 143. Skip threading parameterizations of the queue tests when system memory is at or above 80%, similar to the existing swarm minion count reduction.
In pyzmq >= 26, zmq.asyncio.Context registers event-loop cleanup hooks. When asyncio.run() exits the loop is closed, triggering those hooks which call ctx.term(). With LINGER=-1 on the open PUSH socket, ctx.term() blocks indefinitely waiting for messages to drain, causing test_issue_regression_65265 to hang for the entire 3-hour CI job timeout on every platform (17 CANCELLED scenario jobs in run 27483691535). Fix: explicitly set LINGER=0 on the server PUSH socket and call server.close() before asyncio.run() returns so the context cleanup completes immediately. Also close any remaining SUB sockets with LINGER=0 at the end of the clients() asyncio.run(check()) loop for the same reason. Separately, add tests/pytests/scenarios/syndic/conftest.py with an autouse fixture that skips all syndic tests when system memory >= 90%. After swarm tests consume memory (reaching ~93% on Debian 13), attempting to start the additional master+syndic+minion daemons triggers the OOM killer (exit code 143), causing the Debian 13 scenarios job to FAIL.
pyzmq >= 26 registers cleanup handlers on the asyncio event loop that call ctx.term() when the loop closes. Salt's ZMQ transport creates contexts with LINGER=-1 sockets, so ctx.term() blocks indefinitely waiting for pending messages to drain, causing the test session (and CI job) to hang for hours after all tests have passed. Replace context.term() with context.destroy(linger=0) in PublishClient, RequestServer, and PublishServer close() methods so sockets are discarded immediately on shutdown rather than draining forever. Add a pytest_sessionfinish hook in tests/conftest.py as a belt-and-suspenders safety net: after all tests and fixtures have torn down, force-destroy any remaining zmq.asyncio.Context instances with linger=0 to prevent the Python atexit asyncio cleanup from blocking the process exit.
The openssl-fips-provider RPM (versions <= 3.1.2-3.ph5) disables the
OpenSSL default provider in /etc/ssl/distro.cnf via its %post script,
leaving only the FIPS and base providers loaded. The base provider does
not export the decoders/encoders that TLS clients (curl, git, tdnf) need
during certificate parsing and key exchange, causing all TLS handshakes
to fail with:
error:03000072:digital envelope routines::decode error
This breaks every test that installs packages (tdnf), clones git repos
(gitfs, git state), or fetches GPG keys (rpm --import) on the Photon OS
5 Arm64 FIPS CI runners.
Photon shipped the fix in vmware/photon@4610f36756
(openssl-fips-provider 3.1.2-4.ph5), but the aarch64 mirror on
packages.broadcom.com still serves the buggy 3.1.2-2.ph5 build.
Mirror the same workaround applied to 3008.x: after installing
openssl-fips-provider, re-enable the default provider by uncommenting
its include line in /etc/ssl/distro.cnf. This is idempotent once the
corrected RPM lands on the aarch64 mirror.
Applies to both test-action.yml (functional/integration/scenarios) and
test-packages-action.yml (package install/upgrade tests).
1 participant
Rebasing might not happen immediately, so don't worry if this takes some time.
Note: if you make any changes to this PR yourself, they will take precedence over the rebase.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions