Pullup ticket #4926 - requested by bsiegert
sysutils/salt: security fix

Revisions pulled up:
- sysutils/salt/Makefile                                        1.34-1.36
- sysutils/salt/PLIST                                          1.15
- sysutils/salt/distinfo                                        1.17-1.19
- sysutils/salt/patches/patch-salt_modules_cron.py              1.1
- sysutils/salt/patches/patch-salt_modules_status.py            1.1

-------------------------------------------------------------------
  Module Name:    pkgsrc
  Committed By:  khorben
  Date:          Thu Feb  4 22:05:36 UTC 2016

  Modified Files:
          pkgsrc/sysutils/salt: Makefile distinfo
  Added Files:
          pkgsrc/sysutils/salt/patches: patch-salt_modules_status.py

  Log Message:
  Avoid a crash in "status.diskusage" when not on Linux or FreeBSD

  Bump PKGREVISION in the process.

  To generate a diff of this commit:
  cvs rdiff -u -r1.33 -r1.34 pkgsrc/sysutils/salt/Makefile
  cvs rdiff -u -r1.16 -r1.17 pkgsrc/sysutils/salt/distinfo
  cvs rdiff -u -r0 -r1.1 \
      pkgsrc/sysutils/salt/patches/patch-salt_modules_status.py

-------------------------------------------------------------------
  Module Name:    pkgsrc
  Committed By:  sevan
  Date:          Sun Feb  7 23:55:01 UTC 2016

  Modified Files:
          pkgsrc/sysutils/salt: Makefile PLIST distinfo

  Log Message:
  Update to 2015.8.5, from PR#50779 addresses CVE-2016-1866

  Salt 2015.8.5 is identical to the 2015.8.4 release with the addition of a f=
  ix
  for issue 30820, fixed by PR #30833.

  SECURITY FIX
  CVE-2016-1866: Improper handling of clear messages on the minion, which cou=
  ld
  result in executing commands not sent by the master.

  This issue affects only the 2015.8.x releases of Salt. In order for an atta=
  cker
  to use this attack vector, they would have to execute a successful attack o=
  n an
  existing TCP connection between minion and master on the pub port. It does =
  not
  allow an external attacker to obtain the shared secret or decrypt any encry=
  pted
  traffic between minion and master.

  We recommend everyone upgrade to 2015.8.4 as soon as possible.

  CORE CHANGES
  PR #28994: timcharper Salt S3 module has learned how to assume IAM roles

  Added option mock=3DTrue for state.sls and state.highstate. This allows the=
    salt
  state compiler to process sls data in a state run without actually calling =
  the
  state functions, thus providing feedback on the validity of the arguments u=
  sed
  for the functions beyond the preprocessing validation provided by state.sho=
  w_sls
  (issue 30118 and issue 30189).

  salt '*' state.sls core,edit.vim mock=3DTrue
  salt '*' state.highstate mock=3DTrue
  salt '*' state.apply edit.vim mock=3DTrue
  CHANGES FOR V2015.8.3..V2015.8.4

  Extended changelog courtesy of Todd Stansell
  (https://github.com/tjstansell/salt-changelogs):

  Generated at: 2016-01-25T17:48:35Z

  Total Merges: 320

  Changes:

  PR #30613: (basepi) Fix minion/syndic clearfuncs
  PR #30609: (seanjnkns) Fix documentation for pillar_merge_lists which defau=
  lt is
  False, not =E2=80=A6
  PR #30584: (julianbrost) file.line state: add missing colon in docstring
  PR #30589: (terminalmage) Merge 2015.5 into 2015.8
  PR #30599: (multani) Documentation formatting fixes
  PR #30554: (rallytime) Make the salt-cloud actions output more verbose and
  helpful
  PR #30549: (techhat) Salt Virt cleanup
  PR #30553: (techhat) AWS: Support 17-character IDs
  PR #30532: (whiteinge) Add execution module for working in sls files
  PR #30529: (terminalmage) Merge 2015.5 into 2015.8
  PR #30526: (twangboy) Added FlushKey to make sure it's changes are saved to=
    disk
  PR #30521: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #30485: (jtand) Updated pip_state to work with pip 8.0 on 2015.8
  PR #30494: (isbm) Zypper: info_installed =E2=80=94 'errors' flag change to =
  type
  'boolean'
  PR #30506: (jacksontj) Properly remove newlines after reading the file
  PR #30508: (rallytime) Fix Linode driver cloning functionality
  PR #30522: (terminalmage) Update git.list_worktree tests to reflect new ret=
  urn
  data
  PR #30483: (borgstrom) Pyobjects recursive import support (for 2015.8)
  PR #30491: (jacksontj) Add multi-IP support to network state
  PR #30496: (anlutro) Fix KeyError when adding ignored pillars
  PR #30359: (kingsquirrel152) Removes suspected copy/paste error for
  zmq_filtering functionailty
  PR #30448: (cournape) Fix osx scripts location
  PR #30457: (rallytime) Remove fsutils references from modules list
  PR #30453: (rallytime) Make sure private AND public IPs are listed for Lino=
  de
  driver
  PR #30458: (rallytime) Back-port #30062 to 2015.8
  PR #30468: (timcharper) make note of s3 role assumption in upcoming changel=
  og
  PR #30470: (whiteinge) Add example of the match_dict format to accept_dict =
  wheel
  function
  PR #30450: (gtmanfred) fix extension loading in novaclient
  PR #30212: (abednarik) Fix incorrect file permissions in file.line
  PR #29947: (jfindlay) fileclient: decode file list from master
  PR #30363: (terminalmage) Use native "list" subcommand to list git worktree=
  s
  PR #30445: (jtand) Boto uses False for is_default instead of None
  PR #30406: (frioux) Add an example of how to use file.managed/check_cmd
  PR #30424: (isbm) Check if byte strings are properly encoded in UTF-8
  PR #30405: (jtand) Updated glusterfs.py for python2.6 compatibility.
  PR #30396: (pass-by-value) Remove hardcoded val
  PR #30391: (jtand) Added else statements
  PR #30375: (rallytime) Wrap formatted log statements with six.u() in
  cloud/__init__.py
  PR #30384: (isbm) Bugfix: info_available does not work correctly on SLE 11
  series
  PR #30376: (pritambaral) Fix FLO_DIR path in 2015.8
  PR #30389: (jtand) Older versions of ipset don't support comments
  PR #30373: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #30372: (jacobhammons) Updated man pages for 2015.8.4, updated copyright=
    to
  2016
  PR #30370: (rallytime) Remove incomplete function
  PR #30366: (rallytime) Back-port #28702 to 2015.8
  PR #30361: (cro) Flip the sense of the test for proxymodule imports, add mo=
  re
  fns for esxi proxy
  PR #30267: (isbm) Fix RPM issues with the date/time and add package attribu=
  tes
  filtering
  PR #30360: (jfindlay) file.remove, file.absent: mention recursive dir remov=
  al
  PR #30221: (mbarrien) No rolcatupdate for user_exist in Postgres>=3D9.5 `#2=
  6845`_
  PR #30358: (terminalmage) Add libgit2 version to versions-report
  PR #30346: (pass-by-value) Prevent orphaned volumes
  PR #30349: (rallytime) Back-port #30347 to 2015.8
  PR #30354: (anlutro) Make sure all ignore_missing SLSes are caught
  PR #30356: (nmadhok) Adding code author
  PR #30340: (jtand) Updated seed_test.py for changes made to seed module
  PR #30339: (jfindlay) Backport #26511
  PR #30343: (rallytime) Fix 2015.8 from incomplete back-port
  PR #30342: (eliasp) Correct whitespace placement in error message
  PR #30308: (rallytime) Back-port #30257 to 2015.8
  PR #30187: (rallytime) Back-port #27606 to 2015.8
  PR #30223: (serge-p) adding support for DragonFly BSD
  PR #30238: (rallytime) Reinit crypto before calling RSA.generate when gener=
  ating
  keys.
  PR #30246: (dmacvicar) Add missing return data to scheduled jobs (`#24237`_=
  )
  PR #30292: (thegoodduke) ipset: fix test=3Dtrue & add comment for every ent=
  ry
  PR #30275: (abednarik) Add permanent argument in firewalld.
  PR #30328: (cachedout) Fix file test
  PR #30310: (pass-by-value) Empty bucket fix
  PR #30211: (techhat) Execute choot on the correct path
  PR #30309: (rallytime) Back-port #30304 to 2015.8
  PR #30278: (nmadhok) If datacenter is specified in the config, then look fo=
  r
  managed objects under it
  PR #30305: (jacobhammons) Changed examples to use the "example.com" domain
  instead of "mycompan=E2=80=A6
  PR #30249: (mpreziuso) Fixes performance and timeout issues on win_pkg.inst=
  all
  PR #30217: (pass-by-value) Make sure cloud actions can be called via salt r=
  un
  PR #30268: (terminalmage) Optimize file_tree ext_pillar and update file.man=
  aged
  to allow for binary contents
  PR #30245: (rallytime) Boto secgroup/iam_role: Add note stating us-east-1 i=
  s
  default region
  PR #30299: (rallytime) ESXi Proxy minions states are located at
  salt.states.esxi, not vsphere.
  PR #30202: (opdude) Fixed the periodic call to beacons
  PR #30303: (jacobhammons) Changed notes to indicate that functions are matc=
  hed
  using regular ex=E2=80=A6
  PR #30284: (terminalmage) salt.utils.gitfs: Fix Dulwich env detection and
  submodule handling
  PR #30280: (jfindlay) add state mocking to release notes
  PR #30273: (rallytime) Back-port #30121 to 2015.8
  PR #30301: (cachedout) Accept whatever comes into hightstate mock for state
  tests
  PR #30282: (cachedout) Fix file.append logic
  PR #30289: (cro) Fix problems with targeting proxies by grains
  PR #30293: (cro) Ensure we don't log stuff we shouldn't
  PR #30279: (cachedout) Allow modules to be packed into boto utils
  PR #30186: (rallytime) Update CLI Examples in boto_ec2 module to reflect co=
  rrect
  arg/kwarg positioning
  PR #30156: (abednarik) Add option in file.append to ignore_whitespace.
  PR #30189: (rallytime) Back-port #30185 to 2015.8
  PR #30215: (jacobhammons) Assorted doc bug fixes
  PR #30206: (cachedout) Revert "Fix incorrect file permissions in file.line"
  PR #30190: (jacobhammons) Updated doc site banners
  PR #30180: (jfindlay) modules.x509._dec2hex: add fmt index for 2.6 compat
  PR #30179: (terminalmage) Backport #26962 to 2015.8 branch
  PR #29693: (abednarik) Handle missing source file in ssh_auth.
  PR #30155: (rallytime) Update boto_secgroup and boto_iam_role docs to only =
  use
  region OR profile
  PR #30158: (rallytime) Move _option(value) calls to __salt__['config.option=
  '] in
  boto utils
  PR #30160: (dmurphy18) Fix parsing disk usage for line with no number and A=
  IX
  values in Kilos
  PR #30162: (rallytime) Update list_present and append grains state function=
    docs
  to be more clear.
  PR #30163: (rallytime) Add warning about using "=3D" in file.line function
  PR #30164: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #30168: (abednarik) Fix incorrect file permissions in file.line
  PR #30154: (Oro) Fix file serialize on windows
  PR #30144: (rallytime) Added generic ESXCLI command ability to ESXi Proxy M=
  inion
  PR #30142: (terminalmage) Fix dockerng.push, and allow for multiple images
  PR #30075: (joejulian) Convert glusterfs module to use xml
  PR #30129: (optix2000) Clean up _uptodate() in git state
  PR #30139: (rallytime) Back-port #29589 to 2015.8
  PR #30124: (abednarik) Update regex to detect ip alias in OpenBSD.
  PR #30133: (stanislavb) Fix typo in gpgkey URL
  PR #30126: (stanislavb) Log S3 API error message
  PR #30128: (oeuftete) Log retryable transport errors as warnings
  PR #30096: (cachedout) Add rm_special to crontab module
  PR #30106: (techhat) Ensure last dir
  PR #30101: (gtmanfred) fix bug where nova driver exits with no adminPass
  PR #30090: (techhat) Add argument to isdir()
  PR #30094: (rallytime) Fix doc formatting for cloud.create example in modul=
  e.py
  state
  PR #30095: (rallytime) Add the list_nodes_select function to linode driver
  PR #30082: (abednarik) Fixed saltversioninfo grain return
  PR #30084: (rallytime) Back-port #29987 to 2015.8
  PR #30071: (rallytime) Merge branch '2015.5' into '2015.8'
  PR #30067: (ryan-lane) Pass in kwargs to boto_secgroup.convert_to_group_ids
  explicitly
  PR #30069: (techhat) Ensure that pki_dir exists
  PR #30064: (rallytime) Add Syndic documentation to miscellaneous Salt Cloud
  config options
  PR #30049: (rallytime) Add some more unit tests for the vsphere execution m=
  odule
  PR #30060: (rallytime) Back-port #27104 to 2015.8
  PR #30048: (jacobhammons) Remove internal APIs from rest_cherrypy docs.
  PR #30043: (rallytime) Be explicit about importing from salt.utils.jinja to
  avoid circular imports
  PR #30038: (rallytime) Back-port #30017 to 2015.8
  PR #30036: (rallytime) Back-port #29995 to 2015.8
  PR #30035: (rallytime) Back-port #29895 to 2015.8
  PR #30034: (rallytime) Back-port #29893 to 2015.8
  PR #30033: (rallytime) Back-port #29876 to 2015.8
  PR #30029: (terminalmage) git.latest: Fix handling of nonexistent branches
  PR #30016: (anlutro) Properly normalize locales in locale.gen_locale
  PR #30015: (anlutro) locale module: don't escape the slash in \n
  PR #30022: (gqgunhed) Two minor typos fixed
  PR #30026: (anlutro) states.at: fix wrong variable being used
  PR #29966: (multani) Fix bigip state/module documentation + serializers
  documentation
  PR #29904: (twangboy) Improvements to osx packaging scripts
  PR #29950: (multani) boto_iam: fix deletion of IAM users when using
  delete_keys=3Dtrue
  PR #29937: (multani) Fix states.boto_iam group users
  PR #29934: (multani) Fix state.boto_iam virtual name
  PR #29943: (cachedout) Check args correctly in boto_rds
  PR #29924: (gqgunhed) fixed: uptime now working on non-US Windows
  PR #29883: (serge-p) fix for nfs mounts in _active_mounts_openbsd()
  PR #29894: (techhat) Support Saltfile in SPM
  PR #29856: (rallytime) Added some initial unit tests for the
  salt.modules.vsphere.py file
  PR #29855: (rallytime) Back-port #29740 to 2015.8
  PR #29890: (multani) Various documentation fixes
  PR #29850: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #29811: (anlutro) influxdb: add retention policy module functions
  PR #29814: (basepi) [2015.8][Windows] Fix multi-master on windows
  PR #29819: (rallytime) Add esxi module and state to docs build
  PR #29832: (jleimbach) Fixed typo in order to use the keyboard module for R=
  HEL
  without systemd
  PR #29803: (rallytime) Add vSphere module to doc ref module tree
  PR #29767: (abednarik) Hosts file update in mod_hostname.
  PR #29772: (terminalmage) pygit2: skip submodules when traversing tree
  PR #29765: (gtmanfred) allow nova driver to be boot from volume
  PR #29773: (l2ol33rt) Append missing wget in debian installation guide
  PR #29800: (rallytime) Back-port #29769 to 2015.8
  PR #29775: (paulnivin) Change listen requisite resolution from name to ID
  declaration
  PR #29754: (rallytime) Back-port #29719 to 2015.8
  PR #29713: (The-Loeki) Pillar-based cloud providers still forcing use of
  deprecated 'provider'
  PR #29729: (rallytime) Further clarifications on "unless" and "onlyif"
  requisites.
  PR #29737: (akissa) fix pillar sqlite3 documentation examples
  PR #29743: (akissa) fix pillar sqlite not honouring config options
  PR #29723: (rallytime) Clarify db_user and db_password kwargs for
  postgres_user.present state function
  PR #29722: (rallytime) Link "stateful" kwargs to definition of what "statef=
  ul"
  means for cmd state.
  PR #29724: (rallytime) Add examples of using multiple matching levels to Pi=
  llar
  docs
  PR #29726: (cachedout) Disable some boto tests per resolution of moto issue
  PR #29708: (lagesag) Fix test=3DTrue for file.directory with recurse
  ignore_files/ignore_dirs.
  PR #29642: (cachedout) Correctly restart deamonized minions on failure
  PR #29599: (cachedout) Clean up minion shutdown
  PR #29675: (clinta) allow returning all refs
  PR #29683: (rallytime) Catch more specific error to pass the error message
  through elegantly.
  PR #29687: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #29681: (clinta) fix bare/mirror in git.latest
  PR #29644: (rallytime) Fixed a couple more ESXi proxy minion bugs
  PR #29645: (rallytime) Back-port #29558 to 2015.8
  PR #29632: (jfindlay) reduce severity of tls module __virtual__ logging
  PR #29606: (abednarik) Fixed duplicate mtu entry in RedHat 7 network
  configuration.
  PR #29613: (rallytime) Various ESXi Proxy Minion Bug Fixes
  PR #29628: (DmitryKuzmenko) Don't create io_loop before fork
  PR #29609: (basepi) [2015.8][salt-ssh] Add ability to set salt-ssh command =
  umask
  in roster
  PR #29603: (basepi) Fix orchestration failure-checking
  PR #29597: (terminalmage) dockerng: Prevent exception when API response con=
  tains
  empty dictionary
  PR #29596: (rallytime) Back-port #29587 to 2015.8
  PR #29588: (rallytime) Added ESXi Proxy Minion Tutorial
  PR #29572: (gtmanfred) [nova] use old discover_extensions if available
  PR #29545: (terminalmage) git.latest: init submodules if not yet initialize=
  d
  PR #29548: (rallytime) Back-port #29449 to 2015.8
  PR #29547: (rallytime) Refactored ESXCLI-based functions to accept a list o=
  f
  esxi_hosts
  PR #29563: (anlutro) Fix a call to deprecated method in python-influxdb
  PR #29565: (bdrung) Fix typos and missing release note
  PR #29540: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #29499: (rallytime) Initial commit of ESXi Proxy Minion
  PR #29526: (jfindlay) 2015.8.2 notes: add note about not being released
  PR #29531: (jfindlay) grains.core: handle undefined variable
  PR #29538: (basepi) [2015.8] [salt-ssh] Remove umask around actual executio=
  n for
  salt-ssh
  PR #29505: (rallytime) Update boto_rds state docs to include funky yaml syn=
  tax
  for "tags" option.
  PR #29513: (bdrung) Drop obsolete syslog.target from systemd services
  PR #29500: (rallytime) Back-port #29467 to 2015.8
  PR #29463: (abednarik) Add **kwargs to debconf.set.
  PR #29399: (jfindlay) modules.status: add human_readable option to uptime
  PR #29433: (cro) Files for building .pkg files for MacOS X
  PR #29455: (jfindlay) modules.nova.__init__: do not return None
  PR #29454: (jfindlay) rh_service module __virtual__ return error messages
  PR #29476: (tbaker57) Doc fix - route_table_present needs subnet_names (not
  subnets) as a key
  PR #29487: (rallytime) Back-port #29450 to 2015.8
  PR #29441: (rallytime) Make sure docs line up with blade_idrac function spe=
  cs
  PR #29440: (rallytime) Back-port #28925 to 2015.8
  PR #29435: (galet) Grains return wrong OS version and other OS related valu=
  es
  for Oracle Linux
  PR #29430: (rall0r) Fix host.present state limitation
  PR #29417: (jacobhammons) Repo install updates
  PR #29402: (techhat) Add rate limiting to linode
  PR #29400: (twangboy) Fix #19332
  PR #29398: (cachedout) Lint 29288
  PR #29331: (DmitryKuzmenko) Bugfix - #29116 raet dns error
  PR #29390: (jacobhammons) updated version numbers in documentation
  PR #29381: (nmadhok) No need to deepcopy since six.iterkeys() creates a cop=
  y
  PR #29349: (cro) Fix mis-setting chassis names
  PR #29334: (rallytime) Back-port #29237 to 2015.8
  PR #29300: (ticosax) [dockerng] Add support for volume management in docker=
  ng
  PR #29218: (clan) check service enable state in test mode
  PR #29315: (jfindlay) dev tutorial doc: fix markup errors
  PR #29317: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
  PR #29240: (clan) handle acl_type [[d]efault:][user|group|mask|other]
  PR #29305: (lorengordon) Add 'file' as a source_hash proto
  PR #29272: (jfindlay) win_status module: handle 12 hour time in uptime
  PR #29289: (terminalmage) file.managed: Allow local file sources to use
  source_hash
  PR #29264: (anlutro) Prevent ssh_auth.absent from running when test=3DTrue
  PR #29277: (terminalmage) Update git_pillar runner to support new git ext_p=
  illar
  config schema
  PR #29283: (cachedout) Single-quotes and use format
  PR #29139: (thomaso-mirodin) [salt-ssh] Add a range roster and range target=
  ing
  options for the flat roster
  PR #29282: (cachedout) dev docs: add development tutorial
  PR #28994: (timcharper) add support to s3 for aws role assumption
  PR #29278: (techhat) Add verify_log to SPM
  PR #29067: (jacksontj) Fix infinite recursion in state compiler for prereq =
  of
  SLSs
  PR #29207: (jfindlay) do not shadow ret function argument
  PR #29215: (rallytime) Back-port #29192 to 2015.8
  PR #29217: (clan) show duration only if state_output_profile is False
  PR #29221: (ticosax) [dokcerng] Docu network mode
  PR #29269: (jfindlay) win_status module: fix function names in docs
  PR #29213: (rallytime) Move _wait_for_task func from vmware cloud to vmware
  utils
  PR #29271: (techhat) Pass full path for digest (SPM)
  PR #29244: (isbm) List products consistently across all SLES systems
  PR #29255: (garethgreenaway) fixes to consul module
  PR #29208: (whytewolf) Glance more profile errors
  PR #29200: (jfindlay) mount state: unmount by device is optional
  PR #29205: (trevor-h) Fixes #29187 - using winrm on EC2
  PR #29170: (cachedout) Migrate pydsl tests to integration test suite
  PR #29198: (jfindlay) rh_ip module: only set the mtu once
  PR #29135: (jfindlay) ssh_known_hosts.present state: catch not found exc
  PR #29196: (s0undt3ch) We need novaclient imported to compare versions
  PR #29059: (terminalmage) Work around upstream pygit2 bug
  PR #29112: (eliasp) Prevent backtrace (KeyError) in ssh_known_hosts.present
  state

  To generate a diff of this commit:
  cvs rdiff -u -r1.34 -r1.35 pkgsrc/sysutils/salt/Makefile
  cvs rdiff -u -r1.14 -r1.15 pkgsrc/sysutils/salt/PLIST
  cvs rdiff -u -r1.17 -r1.18 pkgsrc/sysutils/salt/distinfo

-------------------------------------------------------------------
  Module Name:    pkgsrc
  Committed By:  wiz
  Date:          Tue Feb  9 14:23:04 UTC 2016

  Modified Files:
          pkgsrc/sysutils/salt: Makefile distinfo
  Added Files:
          pkgsrc/sysutils/salt/patches: patch-salt_modules_cron.py

  Log Message:
  Add upstream patch fixing problem with cron on Solaris.

  >From Travis Paul in PR 50567.
  Bump PKGREVISION.

  To generate a diff of this commit:
  cvs rdiff -u -r1.35 -r1.36 pkgsrc/sysutils/salt/Makefile
  cvs rdiff -u -r1.18 -r1.19 pkgsrc/sysutils/salt/distinfo
  cvs rdiff -u -r0 -r1.1 \
      pkgsrc/sysutils/salt/patches/patch-salt_modules_cron.py

(spz)