Merge pull request #64609 from s0undt3ch/hotfix/merge-forward

[master] Merge 3006.x into master

Author: s0undt3ch

.github/actions/setup-python-tools-scripts/action.yml

@@ -33,7 +33,12 @@ runs:
       shell: bash
       working-directory: ${{ inputs.cwd }}
       run: |
-        python3 -m pip install -r requirements/static/ci/py${{ steps.get-python-version.outputs.version }}/tools.txt
+        (python3 -m pip install --help | grep break-system-packages > /dev/null 2>&1) && exitcode=0 || exitcode=1
+        if [ $exitcode -eq 0 ]; then
+          python3 -m pip install --break-system-packages -r requirements/static/ci/py${{ steps.get-python-version.outputs.version }}/tools.txt
+        else
+          python3 -m pip install -r requirements/static/ci/py${{ steps.get-python-version.outputs.version }}/tools.txt
+        fi
 
     - name: Get 'python-tools-scripts' Version
       id: get-version

.github/workflows/build-deb-packages.yml

@@ -35,7 +35,7 @@ jobs:
           - src
 
     container:
-      image: ghcr.io/saltstack/salt-ci-containers/packaging:debian-11
+      image: ghcr.io/saltstack/salt-ci-containers/packaging:debian-12
 
     steps:
       # Checkout here so we can easily use custom actions

changelog/64519.fixed.md

@@ -0,0 +1,3 @@
+`win_pkg` Fixes an issue runing `pkg.install` with `version=latest` where the
+new installer would not be cached if there was already an installer present
+with the same name.

changelog/64595.security.md

@@ -0,0 +1,3 @@
+Upgrade to `cryptography==41.0.1`(and therefor `pyopenssl==23.2.0` due to https://github.com/advisories/GHSA-5cpq-8wj7-hf2v
+
+This only really impacts pip installs of Salt and the windows onedir since the linux and macos onedir build every package dependency from source, not from pre-existing wheels.

requirements/darwin.txt

@@ -6,6 +6,7 @@ apache-libcloud>=2.4.0
 backports.ssl_match_hostname>=3.7.0.1; python_version < '3.7'
 cherrypy>=17.4.1
 gitpython>=3.1.30
+cryptography>=41.0.1
 idna>=2.8
 linode-python>=1.1.1
 pyasn1>=0.4.8

requirements/static/ci/py3.10/cloud.txt

@@ -20,7 +20,7 @@ charset-normalizer==2.1.1
     # via
     #   -c requirements/static/ci/py3.10/linux.txt
     #   requests
-cryptography==40.0.2
+cryptography==41.0.1
     # via
     #   -c requirements/static/ci/py3.10/linux.txt
     #   pyspnego

requirements/static/ci/py3.10/darwin.txt

@@ -93,10 +93,11 @@ contextvars==2.4
     #   -r requirements/base.txt
 croniter==1.3.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==40.0.2
+cryptography==41.0.1
     # via
     #   -c requirements/static/ci/../pkg/py3.10/darwin.txt
     #   -r requirements/crypto.txt
+    #   -r requirements/darwin.txt
     #   etcd3-py
     #   moto
     #   paramiko

requirements/static/ci/py3.10/linux.txt

@@ -103,10 +103,11 @@ contextvars==2.4
     #   -r requirements/base.txt
 croniter==1.3.15 ; sys_platform != "win32"
     # via -r requirements/static/ci/common.in
-cryptography==40.0.2
+cryptography==41.0.1
     # via
     #   -c requirements/static/ci/../pkg/py3.10/linux.txt
     #   -r requirements/crypto.txt
+    #   -r requirements/static/pkg/linux.in
     #   ansible-core
     #   etcd3-py
     #   moto

requirements/static/ci/py3.10/windows.txt

@@ -87,10 +87,11 @@ contextvars==2.4
     # via
     #   -c requirements/static/ci/../pkg/py3.10/windows.txt
     #   -r requirements/base.txt
-cryptography==40.0.2
+cryptography==41.0.1
     # via
     #   -c requirements/static/ci/../pkg/py3.10/windows.txt
     #   -r requirements/crypto.txt
+    #   -r requirements/windows.txt
     #   etcd3-py
     #   moto
     #   pyopenssl

requirements/static/ci/py3.11/cloud.txt

@@ -20,7 +20,7 @@ charset-normalizer==2.1.1
     # via
     #   -c requirements/static/ci/py3.11/linux.txt
     #   requests
-cryptography==40.0.2
+cryptography==41.0.1
     # via
     #   -c requirements/static/ci/py3.11/linux.txt
     #   pyspnego