Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] v3003 a salt-master using python 3.7+ using salt-ssh cannot work with a minion using python3.5 or 3.6 #59942

Closed
bryceml opened this issue Mar 31, 2021 · 30 comments
Assignees
Labels
Aluminium Release Post Mg and Pre Si Bug broken, incorrect, or confusing behavior centos affects this operating system debian affects this operating system point-release minor release Regression The issue is a bug that breaks functionality known to work in previous releases. Salt-SSH severity-high 2nd top severity, seen by most users, causes major problems ubuntu affects this operating system
Milestone

Comments

@bryceml
Copy link
Contributor

bryceml commented Mar 31, 2021

Setup
install salt-ssh on an ubuntu 20.04 box and use it to control an ubuntu 16.04 box (probably happens with centos 7, 8, debian 9, and ubuntu 18.04 as well)

Steps to Reproduce the behavior

salt-ssh \* test.ping
minion-id:
    ----------
    retcode:
        1
    stderr:
        Traceback (most recent call last):
          File "/var/tmp/.root_d24770_salt/salt-call", line 27, in <module>
            salt_call()
          File "/var/tmp/.root_d24770_salt/pyall/salt/scripts.py", line 437, in salt_call
            import salt.cli.call
          File "/var/tmp/.root_d24770_salt/pyall/salt/cli/call.py", line 6, in <module>
            import salt.cli.caller
          File "/var/tmp/.root_d24770_salt/pyall/salt/cli/caller.py", line 14, in <module>
            import salt.loader
          File "/var/tmp/.root_d24770_salt/pyall/salt/loader.py", line 7, in <module>
            import contextvars
          File "/var/tmp/.root_d24770_salt/py3/contextvars.py", line 1, in <module>
            from _contextvars import Context, ContextVar, Token, copy_context
        ImportError: No module named '_contextvars'
    stdout:

I also tried doing pip3 install contextvars immutables --prefix /usr and pip3 install contextvars immutables on the master and it didn't fix the issue.

Expected behavior

minion-id:
    True

Versions Report

Salt Version:
          Salt: 3003
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.7.3
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10.1
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 0.6.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: 2.6.1
  pycryptodome: 3.6.1
        pygit2: Not Installed
        Python: 3.8.5 (default, Jan 27 2021, 15:41:15)
  python-gnupg: 0.4.5
        PyYAML: 5.3.1
         PyZMQ: 18.1.1
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.2
 
System Versions:
          dist: ubuntu 20.04 focal
        locale: utf-8
       machine: x86_64
       release: 5.4.0-70-generic
        system: Linux
       version: Ubuntu 20.04 focal
 
@bryceml bryceml added Bug broken, incorrect, or confusing behavior needs-triage point-release minor release labels Mar 31, 2021
@sagetherage sagetherage added severity-high 2nd top severity, seen by most users, causes major problems Aluminium Release Post Mg and Pre Si and removed needs-triage labels Mar 31, 2021
@sagetherage sagetherage added this to the Aluminium milestone Mar 31, 2021
@sagetherage sagetherage changed the title [BUG] a salt-master using python 3.7+ using salt-ssh cannot work with a minion using python3.5 or 3.6 [BUG] v3003 a salt-master using python 3.7+ using salt-ssh cannot work with a minion using python3.5 or 3.6 Mar 31, 2021
@sagetherage
Copy link
Contributor

@frogunder @Ch3LL if we don't have a test for this in the packaging tests we should consider adding something see internal slack conversation starting here: https://saltstack.slack.com/archives/C04HEQ97D/p1617221478334300 in releasediscussions

@dwoz
Copy link
Contributor

dwoz commented Mar 31, 2021

@frogunder @Ch3LL if we don't have a test for this in the packaging tests we should consider adding something see internal slack conversation starting here: https://saltstack.slack.com/archives/C04HEQ97D/p1617221478334300 in releasediscussions

Ideally we'd be able to add a test for this in the regular test suite too. With the docker stuff in pytest we should probably be able to come up with something.

@bryceml
Copy link
Contributor Author

bryceml commented Mar 31, 2021

probably a different issue, but I also see

[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary
[ERROR   ] Pillar override was not passed as a dictionary

as well with salt-ssh where I didn't before when running salt-ssh \* state.single pkg.uptodate uptodate refresh=True dist_upgrade=True

debug output

[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] LazyLoaded state.single
[DEBUG   ] Gathering pillar data for state run
[ERROR   ] Pillar override was not passed as a dictionary
[DEBUG   ] Determining pillar cache
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Finished gathering pillar data for state run
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] LazyLoaded jinja.render
[DEBUG   ] LazyLoaded yaml.render
[DEBUG   ] LazyLoaded pkg.install
[DEBUG   ] LazyLoaded pkg.uptodate
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points
[DEBUG   ] Using pkg_resources to load entry points

@danmac-uk
Copy link

Can confirm with Debian 10 master, salt-ssh now fails with the contextvars error on Debian 9 target, as of the 3003 update. Debian 10 targets unaffected.

@djneades
Copy link

djneades commented Apr 1, 2021

This bug also occurs against a Ubuntu 18.04 target.

@danmac-uk
Copy link

For those on Debian 10 who want things working, I recommend editing your apt sources.list file that references the saltstack repo (mine is /etc/apt/sources.list.d/saltstack.list) replace "latest" with "3002" at the end of the URL, then run the following:

apt-get update && apt-get install salt-master=3002.6+ds-1 salt-common=3002.6+ds-1 salt-ssh=3002.6+ds-1

This should stop any future upgrades >3002. If you feel lucky again, just revert the changes to the sources list file and upgrade as normal. Should work on Ubuntu also, but I didn't test that. Super paranoid should consider "apt-mark hold".

@sagetherage sagetherage added centos affects this operating system debian affects this operating system ubuntu affects this operating system labels Apr 1, 2021
@auphofBSF
Copy link

Experiencing the same issue target minion (raspbian - stretch, python 3.5.3) salt-minion version 3003 installed
On target minion salt-call --local test.version responds correctly

on master using salt-ssh (3003) running in (alpine linux 3.13 python 3.7.10)
salt-ssh -i <DeviceID> -r 'ls -la' responds correctly
salt-ssh -i <DeviceID> test.varsion fails with ImportError: No module named '_contextvars'

dwoz added a commit to dwoz/salt that referenced this issue Apr 5, 2021
If a contextvars package exists one of the site-packages locations use
it for the generated thin tarball. This overrides python's builtin
contextvars and allows salt-ssh to work with python <=3.6 even when the
master's python is >3.6 (Fixes saltstack#59942)
@sagetherage
Copy link
Contributor

Experiencing the same issue target minion (raspbian - stretch, python 3.5.3) salt-minion version 3003 installed
On target minion salt-call --local test.version responds correctly

on master using salt-ssh (3003) running in (alpine linux 3.13 python 3.7.10)
salt-ssh -i <DeviceID> -r 'ls -la' responds correctly
salt-ssh -i <DeviceID> test.varsion fails with ImportError: No module named '_contextvars'

@auphofBSF looking to correct in the 3003.1 minor release later in April

dwoz added a commit to dwoz/salt that referenced this issue Apr 7, 2021
dwoz added a commit to dwoz/salt that referenced this issue Apr 7, 2021
dwoz added a commit to dwoz/salt that referenced this issue Apr 7, 2021
If a contextvars package exists one of the site-packages locations use
it for the generated thin tarball. This overrides python's builtin
contextvars and allows salt-ssh to work with python <=3.6 even when the
master's python is >3.6 (Fixes saltstack#59942)
@xuhcc
Copy link
Contributor

xuhcc commented Jun 24, 2021

I installed contextvars package on a target but it didn't help.
salt uses contextvars module at /var/tmp/.***_salt/py3/contextvars.py instead of site-packages version.

@bryceml
Copy link
Contributor Author

bryceml commented Jun 24, 2021

it has to be installed on the master, not the target. Also if you've already ran salt-ssh before installing contextvars, you may have to use the -w -t flags in order to re-generate the thin tarball.

@dwoz any other insight here?

also, please everyone report the os and install method of the box you are running salt-ssh from and whether the contextvars package is installed on that box.

@djneades
Copy link

@bryceml Thank you for the suggestions, but I’d already taken care of both of those. My salt-ssh is installed via python3 -m pip install (equivalent to pip3 install).

For the avoidance of doubt, to show installation, my master contextvars version, and everything else relevant …

On the master:

$ python3 -m pip install --user --upgrade salt==3003.1 mako
Requirement already satisfied: salt==3003.1 in /home/djn/.local/lib/python3.8/site-packages (3003.1)
Requirement already satisfied: mako in /home/djn/.local/lib/python3.8/site-packages (1.1.4)
Requirement already satisfied: contextvars in /home/djn/.local/lib/python3.8/site-packages (from salt==3003.1) (2.4)
Requirement already satisfied: pycryptodomex>=3.9.8 in /home/djn/.local/lib/python3.8/site-packages (from salt==3003.1) (3.9.9)
Requirement already satisfied: MarkupSafe in /usr/lib/python3/dist-packages (from salt==3003.1) (1.1.0)
Requirement already satisfied: msgpack!=0.5.5,>=0.5 in /home/djn/.local/lib/python3.8/site-packages (from salt==3003.1) (1.0.0)
Requirement already satisfied: pyzmq>=17.0.0 in /home/djn/.local/lib/python3.8/site-packages (from salt==3003.1) (20.0.0)
Requirement already satisfied: Jinja2 in /usr/lib/python3/dist-packages (from salt==3003.1) (2.10.1)
Requirement already satisfied: requests>=1.0.0 in /home/djn/.local/lib/python3.8/site-packages (from salt==3003.1) (2.25.1)
Requirement already satisfied: PyYAML in /usr/lib/python3/dist-packages (from salt==3003.1) (5.3.1)
Requirement already satisfied: distro>=1.0.1 in /home/djn/.local/lib/python3.8/site-packages (from salt==3003.1) (1.5.0)
Requirement already satisfied: idna<3,>=2.5 in /usr/lib/python3/dist-packages (from requests>=1.0.0->salt==3003.1) (2.8)
Requirement already satisfied: chardet<5,>=3.0.2 in /usr/lib/python3/dist-packages (from requests>=1.0.0->salt==3003.1) (3.0.4)
Requirement already satisfied: certifi>=2017.4.17 in /usr/lib/python3/dist-packages (from requests>=1.0.0->salt==3003.1) (2019.11.28)
Requirement already satisfied: urllib3<1.27,>=1.21.1 in /usr/lib/python3/dist-packages (from requests>=1.0.0->salt==3003.1) (1.25.8)
Requirement already satisfied: immutables>=0.9 in /home/djn/.local/lib/python3.8/site-packages (from contextvars->salt==3003.1) (0.15)

$ salt-ssh --versions
Salt Version:
          Salt: 3003.1

Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10.1
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: 1.1.4
       msgpack: 1.0.0
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.9.9
        pygit2: Not Installed
        Python: 3.8.5 (default, May 27 2021, 13:30:53)
  python-gnupg: Not Installed
        PyYAML: 5.3.1
         PyZMQ: 20.0.0
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.3

System Versions:
          dist: ubuntu 20.04 focal
        locale: utf-8
       machine: x86_64
       release: 5.10.16.3-microsoft-standard-WSL2
        system: Linux
       version: Ubuntu 20.04 focal

$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS"

$ pip3 list | grep contextvars
contextvars            2.4

$ salt-ssh -w -t redacted.host.net test.ping
redacted.host.net:
    ----------
    retcode:
        1
    stderr:
        Traceback (most recent call last):
          File "/var/tmp/.djn_165e34_salt/pyall/salt/loader_context.py", line 10, in <module>
            import _contextvars as contextvars
        ModuleNotFoundError: No module named '_contextvars'

        During handling of the above exception, another exception occurred:

        Traceback (most recent call last):
          File "/var/tmp/.djn_165e34_salt/salt-call", line 27, in <module>
            salt_call()
          File "/var/tmp/.djn_165e34_salt/pyall/salt/scripts.py", line 437, in salt_call
            import salt.cli.call
          File "/var/tmp/.djn_165e34_salt/pyall/salt/cli/call.py", line 6, in <module>
            import salt.cli.caller
          File "/var/tmp/.djn_165e34_salt/pyall/salt/cli/caller.py", line 14, in <module>
            import salt.loader
          File "/var/tmp/.djn_165e34_salt/pyall/salt/loader.py", line 26, in <module>
            import salt.config
          File "/var/tmp/.djn_165e34_salt/pyall/salt/config/__init__.py", line 103, in <module>
            _DFLT_IPC_WBUFFER = _gather_buffer_space() * 0.5
          File "/var/tmp/.djn_165e34_salt/pyall/salt/config/__init__.py", line 91, in _gather_buffer_space
            import salt.grains.core
          File "/var/tmp/.djn_165e34_salt/pyall/salt/grains/core.py", line 32, in <module>
            import salt.modules.cmdmod
          File "/var/tmp/.djn_165e34_salt/pyall/salt/modules/cmdmod.py", line 31, in <module>
            import salt.utils.templates
          File "/var/tmp/.djn_165e34_salt/pyall/salt/utils/templates.py", line 20, in <module>
            import salt.utils.jinja
          File "/var/tmp/.djn_165e34_salt/pyall/salt/utils/jinja.py", line 21, in <module>
            import salt.fileclient
          File "/var/tmp/.djn_165e34_salt/pyall/salt/fileclient.py", line 15, in <module>
            import salt.client
          File "/var/tmp/.djn_165e34_salt/pyall/salt/client/__init__.py", line 28, in <module>
            import salt.cache
          File "/var/tmp/.djn_165e34_salt/pyall/salt/cache/__init__.py", line 19, in <module>
            from salt.payload import Serial
          File "/var/tmp/.djn_165e34_salt/pyall/salt/payload.py", line 15, in <module>
            import salt.loader_context
          File "/var/tmp/.djn_165e34_salt/pyall/salt/loader_context.py", line 13, in <module>
            import contextvars
          File "/var/tmp/.djn_165e34_salt/py3/contextvars.py", line 1, in <module>
            from _contextvars import Context, ContextVar, Token, copy_context
        ModuleNotFoundError: No module named '_contextvars'
    stdout:

On the target:

# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.5 LTS"

# python3 --version
Python 3.6.9

# pip3 list | grep contextvars
DEPRECATION: The default format will switch to columns in the future. You can use --format=(legacy|columns) (or define a format=(legacy|columns) in your pip.conf under the [list] section) to disable this warning.
contextvars (2.4)

# salt --versions

Command 'salt' not found, but can be installed with:

apt install salt-master

(I had manually installed contextvars on the target just in case it helped; it didn’t.)

@xuhcc
Copy link
Contributor

xuhcc commented Jun 25, 2021

@bryceml Installing contextvars on master indeed solved the issue for me. Thanks

I'm using arch linux and installed salt-ssh from the official repo (btw here's a bug report for the arch package https://bugs.archlinux.org/task/71344).

@djneades
Copy link

djneades commented Jun 25, 2021

Rather than continue to fight this problem, I have updated my Linux targets to Ubuntu 20.04 LTS so that it will no longer occur. Thus, if I am the only person who was still seeing the issue, it can be safely ignored.

truzzon pushed a commit to truzzon/salt that referenced this issue Aug 10, 2021
* Merge 3002.6 bugfix changes (saltstack#59822)

* Pass `CI_RUN` as an environment variable to the test run.

This allows us to know if we're running the test suite under a CI
environment or not and adapt/adjust if needed

* Migrate `unit.setup` to PyTest

* Backport ae36b15 just for test_install.py

* Only skip tests on CI runs

* Always store git sha in _version.py during installation

* Fix PEP440 compliance.

The wheel metadata version 1.2 states that the package version MUST be
PEP440 compliant.

This means that instead of `3002.2-511-g033c53eccb`, the salt version
string should look like `3002.2+511.g033c53eccb`, a post release of
`3002.2` ahead by 511 commits with the git sha `033c53eccb`

* Fix and migrate `tests/unit/test_version.py` to PyTest

* Skip test if `easy_install` is not available

* We also need to be PEP440 compliant when there's no git history

* Allow extra_filerefs as sanitized kwargs for SSH client

* Fix regression on cmd.run when passing tuples as cmd

Co-authored-by: Alexander Graul <agraul@suse.com>

* Add unit tests to ensure cmd.run accepts tuples

* Add unit test to check for extra_filerefs on SSH opts

* Add changelog file

* Fix comment for test case

* Fix unit test to avoid failing on Windows

* Skip failing test on windows

* Fix test to work on Windows

* Add all ssh kwargs to sanitize_kwargs method

* Run pre-commit

* Fix pylint

* Fix cmdmod loglevel and module_names tests

* Fix pre-commit

* Skip ssh tests if binary does not exist

* Use setup_loader for cmdmod test

* Prevent argument injection in restartcheck

* Add changelog for restartcheck fix

* docs_3002.6

* Add back tests removed in merge

Co-authored-by: Pedro Algarvio <pedro@algarvio.me>
Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com>
Co-authored-by: Bryce Larson <brycel@vmware.com>
Co-authored-by: Pablo Suárez Hernández <psuarezhernandez@suse.com>
Co-authored-by: Alexander Graul <agraul@suse.com>
Co-authored-by: Frode Gundersen <fgundersen@saltstack.com>

* Remove glance state module in favor of glance_image

* update wording in changelog

* bump deprecation warning to Silicon.

* Updating warnutil version to Phosphorous.

* Update salt/modules/keystone.py

Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com>

* Check $HOMEBREW_PREFIX when linking against libcrypto

When loading `libcrypto`, Salt checks for a Homebrew installation of `openssl`
at Homebrew's default prefix of `/usr/local`. However, on Apple Silicon Macs,
Homebrew's default installation prefix is `/opt/homebrew`. On all platforms,
the prefix is configurable.  If Salt doesn't find one of those `libcrypto`s,
it will fall back on the un-versioned `/usr/lib/libcrypto.dylib`, which will
cause the following crash:

    Application Specific Information:
    /usr/lib/libcrypto.dylib
    abort() called
    Invalid dylib load. Clients should not load the unversioned libcrypto dylib as it does not have a stable ABI.

This commit checks $HOMEBREW_PREFIX instead of hard-coding `/usr/local`.

* Add test case

* Add changelog for 59808

* Add changelog entry

* Make _find_libcrypto fail on Big Sur if it can't find a library

Right now, if `_find_libcrypto` can't find any externally-managed versions of
libcrypto, it will fall back on the pre-Catalina un-versioned system libcrypto.
This does not exist on Big Sur and it would be better to raise an exception
here rather than crashing later when trying to open it.

* Update _find_libcrypto tests

This commit simplifies the unit tests for _find_libcrypto by mocking out the
host's filesystem and testing the common libcrypto installations (brew, ports,
etc.) on Big Sur. It simplifies the tests for falling back on system versions
of libcrypto on previous versions of macOS.

* Fix description of test_find_libcrypto_with_system_before_catalina

* Patch sys.platform for test_rsax931 tests

* modules/match: add missing "minion_id" in Pillar example

The documented Pillar example for `match.filter_by` lacks the `minion_id` parameter. Without it, the assignment won't work as expected.
- fix documentation
- add tests:
  - to prove the misbehavior of the documented example
  - to prove the proper behaviour when supplying `minion_id`
  - to ensure some misbehaviour observed with compound matchers doesn't occur

* Fix for issue saltstack#59773

- When instantiating the loader grab values of grains and pillars if
  they are NamedLoaderContext instances.
- The loader uses a copy of opts.
- Impliment deepcopy on NamedLoaderContext instances.

* Add changelog for saltstack#59773

* _get_initial_pillar function returns pillar

* Fix linter issues

* Clean up test

* Bump deprecation release for neutron

* Uncomment Sulfur release name

* Removing the _ext_nodes deprecation warning and alias.

* Adding changelog.

* Renaming changelog file.

* Update 59804.removed

* Initial pass at fips_mode config option

* Fix pre-commit

* Fix tests and add changelog

* update docs 3003

* update docs 3003 - newline

* Fix warts in changelog

* update releasenotes 3003

* add ubuntu-2004-amd64 m2crypto pycryptodome and tcp tests

* add distro_arch

* changing the cloud platforms file missed in 1a9b7be

* Update __utils__ calls to import utils in azure

* Add changelog for 59744

* Fix azure unit tests and move to pytest

* Use contextvars from site-packages for thin

If a contextvars package exists one of the site-packages locations use
it for the generated thin tarball. This overrides python's builtin
contextvars and allows salt-ssh to work with python <=3.6 even when the
master's python is >3.6 (Fixes saltstack#59942)

* Add regression test for saltstack#59942

* Add changelog for saltstack#59942

* Update filemap to include test_py_versions

* Fix broken thin tests

* Always install the `contextvars` backport, even on Py3.7+

Without this change, salt-ssh cannot target systems with Python <= 3.6

* Use salt-factories to handle the container. Don't override default roster

* Fix thin tests on windows

* No need to use warn log level here

* Fix getsitepackages for old virtualenv versions

* Add explicit pyobjc reqs

* Add back the passthrough stuff

* Remove a line so pre-commit will run

* Bugfix release docs

* Bugfix release docs

* Removing pip-compile log files

* Bump requirements to address a few security issues

* Address traceback on macOS

```
Traceback (most recent call last):
  File "setup.py", line 1448, in <module>
    setup(distclass=SaltDistribution)
  File "/Users/jenkins/setup-tests/.venv/lib/python3.7/site-packages/setuptools/__init__.py", line 153, in setup
    return distutils.core.setup(**attrs)
  File "/opt/salt/lib/python3.7/distutils/core.py", line 108, in setup
    _setup_distribution = dist = klass(attrs)
  File "setup.py", line 1068, in __init__
    self.update_metadata()
  File "setup.py", line 1074, in update_metadata
    attrvalue = getattr(self, attrname, None)
  File "setup.py", line 1182, in _property_install_requires
    install_requires += _parse_requirements_file(reqfile)
  File "setup.py", line 270, in _parse_requirements_file
    platform.python_version(), _parse_op(op), _parse_ver(ver)
  File "setup.py", line 247, in _check_ver
    return getattr(operator, "__{}__".format(op))(pyver, wanted)
  File "/opt/salt/lib/python3.7/distutils/version.py", line 46, in __eq__
    c = self._cmp(other)
  File "/opt/salt/lib/python3.7/distutils/version.py", line 337, in _cmp
    if self.version < other.version:
TypeError: '<' not supported between instances of 'str' and 'int'
```

* Replace `saltstack.com` with `saltproject.io` on URLs being tested

* Add back support to load old entrypoints by iterating instead of type checking

Fixes saltstack#59961

* Fix issue saltstack#59975

* Fix pillar serialization for jinja saltstack#60083

* Fix test

* Add changelog for saltstack#60083

* Update changelog and release for 3003.1

* Remove the changelog source refs

* Add connect to IPCMessageSubscriber's async_methods

Fixes saltstack#60049 by making sure an IPCMessageSubscriber that is wrapped by
SyncWrapper has a connect method that runs the coroutine rather than
returns a fugure.

* Add changelog for saltstack#60049

* Update 60049.fixed

* Fix coroutine spelling error

Co-authored-by: Wayne Werner <waynejwerner@gmail.com>

* IPC on windows cannot use socket paths

Fixes saltstack#60298

* Update Jinja2 and lxml due to security related bugfix releases

Jinja2
------

CVE-2020-28493
moderate severity
Vulnerable versions: < 2.11.3
Patched version: 2.11.3

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

lxml
----

CVE-2021-28957
moderate severity
Vulnerable versions: < 4.6.3
Patched version: 4.6.3

An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

* fix github actions jobs on branch until bullseye comes out

* Upgrade to `six==1.16.0` to avoid problems on CI runs

```
13:59:02  nox > Session invoke-pre-commit was successful.
13:59:02  nox > Running session invoke-pre-commit
13:59:02  nox > pip install --progress-bar=off -r requirements/static/ci/py3.7/invoke.txt
13:59:02  Collecting blessings==1.7
13:59:02    Using cached blessings-1.7-py3-none-any.whl (18 kB)
13:59:02  Collecting invoke==1.4.1
13:59:02    Using cached invoke-1.4.1-py3-none-any.whl (210 kB)
13:59:02  Collecting pyyaml==5.3.1
13:59:02    Using cached PyYAML-5.3.1.tar.gz (269 kB)
13:59:02  Collecting six==1.15.0
13:59:02    Using cached six-1.15.0-py2.py3-none-any.whl (10 kB)
13:59:02  Building wheels for collected packages: pyyaml
13:59:02    Building wheel for pyyaml (setup.py) ... -� �\� �|� �/� �-� �\� �|� �done
13:59:02    Created wheel for pyyaml: filename=PyYAML-5.3.1-cp37-cp37m-linux_x86_64.whl size=546391 sha256=e42e1d66cc32087f4d33ceb81268c86b59f1a97029b19459f91b8d6ad1430167
13:59:02    Stored in directory: /var/jenkins/.cache/pip/wheels/5e/03/1e/e1e954795d6f35dfc7b637fe2277bff021303bd9570ecea653
13:59:02  Successfully built pyyaml
13:59:02  Installing collected packages: six, pyyaml, invoke, blessings
13:59:02    Attempting uninstall: six
13:59:02      Found existing installation: six 1.16.0
13:59:02      Uninstalling six-1.16.0:
13:59:02  ERROR: Could not install packages due to an OSError: [Errno 2] No such file or directory: '/var/jenkins/.cache/pre-commit/repomw8oee1s/py_env-python3/lib/python3.7/site-packages/__pycache__/six.cpython-37.pyc'
13:59:02
13:59:02  nox > Command pip install --progress-bar=off -r requirements/static/ci/py3.7/invoke.txt failed with exit code 1
13:59:02  nox > Session invoke-pre-commit failed.
```

* add changelog for saltstack#59982

* Regression test for saltstack#56273

* Fix race condition in batch. saltstack#56273

* Add changelog for saltstack#56273

* Update salt/client/__init__.py

Co-authored-by: Pedro Algarvio <pedro@algarvio.me>

* Update doc for salt/client

* Update changelog/56273.fixed

Thoreau said, "Simplify, Simplify"

* Update docs

* Update docs

* Update CHANGELOG.md

* Update 3003.1.rst

* Fix changelog

Co-authored-by: Daniel Wozniak <dwozniak@saltstack.com>
Co-authored-by: Pedro Algarvio <pedro@algarvio.me>
Co-authored-by: Bryce Larson <brycel@vmware.com>
Co-authored-by: Pablo Suárez Hernández <psuarezhernandez@suse.com>
Co-authored-by: Alexander Graul <agraul@suse.com>
Co-authored-by: Frode Gundersen <fgundersen@saltstack.com>
Co-authored-by: Gareth J. Greenaway <gareth@saltstack.com>
Co-authored-by: Gareth J. Greenaway <gareth@wiked.org>
Co-authored-by: Hoa-Long Tam <hoalong@apple.com>
Co-authored-by: krionbsd <krion@freebsd.org>
Co-authored-by: Elias Probst <e.probst@ssc-services.de>
Co-authored-by: Daniel A. Wozniak <dwozniak@vmware.com>
Co-authored-by: Frode Gundersen <frogunder@gmail.com>
Co-authored-by: twangboy <slee@saltstack.com>
Co-authored-by: twangboy <leesh@vmware.com>
Co-authored-by: ScriptAutomate <derek@icanteven.io>
Co-authored-by: Wayne Werner <waynejwerner@gmail.com>
@aliasdevelopment
Copy link

Had the same issue running salt-ssh 3003.2 from Fedora 34 ( Python 3.9.6 ) to Centos 8 ( Python 3.6.8 ). Pip3 contextvars on master did not do anything.

I solved this temporarily by yum install salt-ssh-3002.6, until this is solved and released

@sp1ff
Copy link

sp1ff commented Aug 25, 2021

Can confirm I'm still seeing this (Pop! OS, Python 3.9.5). pip install salt-ssh=3002.6 solved it.

garethgreenaway added a commit that referenced this issue Sep 23, 2021
* Merge 3002.6 bugfix changes (#59822)

* Pass `CI_RUN` as an environment variable to the test run.

This allows us to know if we're running the test suite under a CI
environment or not and adapt/adjust if needed

* Migrate `unit.setup` to PyTest

* Backport ae36b15 just for test_install.py

* Only skip tests on CI runs

* Always store git sha in _version.py during installation

* Fix PEP440 compliance.

The wheel metadata version 1.2 states that the package version MUST be
PEP440 compliant.

This means that instead of `3002.2-511-g033c53eccb`, the salt version
string should look like `3002.2+511.g033c53eccb`, a post release of
`3002.2` ahead by 511 commits with the git sha `033c53eccb`

* Fix and migrate `tests/unit/test_version.py` to PyTest

* Skip test if `easy_install` is not available

* We also need to be PEP440 compliant when there's no git history

* Allow extra_filerefs as sanitized kwargs for SSH client

* Fix regression on cmd.run when passing tuples as cmd

Co-authored-by: Alexander Graul <agraul@suse.com>

* Add unit tests to ensure cmd.run accepts tuples

* Add unit test to check for extra_filerefs on SSH opts

* Add changelog file

* Fix comment for test case

* Fix unit test to avoid failing on Windows

* Skip failing test on windows

* Fix test to work on Windows

* Add all ssh kwargs to sanitize_kwargs method

* Run pre-commit

* Fix pylint

* Fix cmdmod loglevel and module_names tests

* Fix pre-commit

* Skip ssh tests if binary does not exist

* Use setup_loader for cmdmod test

* Prevent argument injection in restartcheck

* Add changelog for restartcheck fix

* docs_3002.6

* Add back tests removed in merge

Co-authored-by: Pedro Algarvio <pedro@algarvio.me>
Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com>
Co-authored-by: Bryce Larson <brycel@vmware.com>
Co-authored-by: Pablo Suárez Hernández <psuarezhernandez@suse.com>
Co-authored-by: Alexander Graul <agraul@suse.com>
Co-authored-by: Frode Gundersen <fgundersen@saltstack.com>

* Remove glance state module in favor of glance_image

* update wording in changelog

* bump deprecation warning to Silicon.

* Updating warnutil version to Phosphorous.

* Update salt/modules/keystone.py

Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com>

* Check $HOMEBREW_PREFIX when linking against libcrypto

When loading `libcrypto`, Salt checks for a Homebrew installation of `openssl`
at Homebrew's default prefix of `/usr/local`. However, on Apple Silicon Macs,
Homebrew's default installation prefix is `/opt/homebrew`. On all platforms,
the prefix is configurable.  If Salt doesn't find one of those `libcrypto`s,
it will fall back on the un-versioned `/usr/lib/libcrypto.dylib`, which will
cause the following crash:

    Application Specific Information:
    /usr/lib/libcrypto.dylib
    abort() called
    Invalid dylib load. Clients should not load the unversioned libcrypto dylib as it does not have a stable ABI.

This commit checks $HOMEBREW_PREFIX instead of hard-coding `/usr/local`.

* Add test case

* Add changelog for 59808

* Add changelog entry

* Make _find_libcrypto fail on Big Sur if it can't find a library

Right now, if `_find_libcrypto` can't find any externally-managed versions of
libcrypto, it will fall back on the pre-Catalina un-versioned system libcrypto.
This does not exist on Big Sur and it would be better to raise an exception
here rather than crashing later when trying to open it.

* Update _find_libcrypto tests

This commit simplifies the unit tests for _find_libcrypto by mocking out the
host's filesystem and testing the common libcrypto installations (brew, ports,
etc.) on Big Sur. It simplifies the tests for falling back on system versions
of libcrypto on previous versions of macOS.

* Fix description of test_find_libcrypto_with_system_before_catalina

* Patch sys.platform for test_rsax931 tests

* modules/match: add missing "minion_id" in Pillar example

The documented Pillar example for `match.filter_by` lacks the `minion_id` parameter. Without it, the assignment won't work as expected.
- fix documentation
- add tests:
  - to prove the misbehavior of the documented example
  - to prove the proper behaviour when supplying `minion_id`
  - to ensure some misbehaviour observed with compound matchers doesn't occur

* Fix for issue #59773

- When instantiating the loader grab values of grains and pillars if
  they are NamedLoaderContext instances.
- The loader uses a copy of opts.
- Impliment deepcopy on NamedLoaderContext instances.

* Add changelog for #59773

* _get_initial_pillar function returns pillar

* Fix linter issues

* Clean up test

* Bump deprecation release for neutron

* Uncomment Sulfur release name

* Removing the _ext_nodes deprecation warning and alias.

* Adding changelog.

* Renaming changelog file.

* Update 59804.removed

* Initial pass at fips_mode config option

* Fix pre-commit

* Fix tests and add changelog

* update docs 3003

* update docs 3003 - newline

* Fix warts in changelog

* update releasenotes 3003

* add ubuntu-2004-amd64 m2crypto pycryptodome and tcp tests

* add distro_arch

* changing the cloud platforms file missed in 1a9b7be

* Update __utils__ calls to import utils in azure

* Add changelog for 59744

* Fix azure unit tests and move to pytest

* Use contextvars from site-packages for thin

If a contextvars package exists one of the site-packages locations use
it for the generated thin tarball. This overrides python's builtin
contextvars and allows salt-ssh to work with python <=3.6 even when the
master's python is >3.6 (Fixes #59942)

* Add regression test for #59942

* Add changelog for #59942

* Update filemap to include test_py_versions

* Fix broken thin tests

* Always install the `contextvars` backport, even on Py3.7+

Without this change, salt-ssh cannot target systems with Python <= 3.6

* Use salt-factories to handle the container. Don't override default roster

* Fix thin tests on windows

* No need to use warn log level here

* Fix getsitepackages for old virtualenv versions

* Add explicit pyobjc reqs

* Add back the passthrough stuff

* Remove a line so pre-commit will run

* Bugfix release docs

* Bugfix release docs

* Removing pip-compile log files

* Bump requirements to address a few security issues

* Address traceback on macOS

```
Traceback (most recent call last):
  File "setup.py", line 1448, in <module>
    setup(distclass=SaltDistribution)
  File "/Users/jenkins/setup-tests/.venv/lib/python3.7/site-packages/setuptools/__init__.py", line 153, in setup
    return distutils.core.setup(**attrs)
  File "/opt/salt/lib/python3.7/distutils/core.py", line 108, in setup
    _setup_distribution = dist = klass(attrs)
  File "setup.py", line 1068, in __init__
    self.update_metadata()
  File "setup.py", line 1074, in update_metadata
    attrvalue = getattr(self, attrname, None)
  File "setup.py", line 1182, in _property_install_requires
    install_requires += _parse_requirements_file(reqfile)
  File "setup.py", line 270, in _parse_requirements_file
    platform.python_version(), _parse_op(op), _parse_ver(ver)
  File "setup.py", line 247, in _check_ver
    return getattr(operator, "__{}__".format(op))(pyver, wanted)
  File "/opt/salt/lib/python3.7/distutils/version.py", line 46, in __eq__
    c = self._cmp(other)
  File "/opt/salt/lib/python3.7/distutils/version.py", line 337, in _cmp
    if self.version < other.version:
TypeError: '<' not supported between instances of 'str' and 'int'
```

* Replace `saltstack.com` with `saltproject.io` on URLs being tested

* Add back support to load old entrypoints by iterating instead of type checking

Fixes #59961

* Fix issue #59975

* Fix pillar serialization for jinja #60083

* Fix test

* Add changelog for #60083

* Update changelog and release for 3003.1

* Remove the changelog source refs

* Add connect to IPCMessageSubscriber's async_methods

Fixes #60049 by making sure an IPCMessageSubscriber that is wrapped by
SyncWrapper has a connect method that runs the coroutine rather than
returns a fugure.

* Add changelog for #60049

* Update 60049.fixed

* Fix coroutine spelling error

Co-authored-by: Wayne Werner <waynejwerner@gmail.com>

* IPC on windows cannot use socket paths

Fixes #60298

* Update Jinja2 and lxml due to security related bugfix releases

Jinja2
------

CVE-2020-28493
moderate severity
Vulnerable versions: < 2.11.3
Patched version: 2.11.3

This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDOS vulnerability of the regex is mainly due to the sub-pattern [a-zA-Z0-9.-]+.[a-zA-Z0-9.-]+ This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.

lxml
----

CVE-2021-28957
moderate severity
Vulnerable versions: < 4.6.3
Patched version: 4.6.3

An XSS vulnerability was discovered in the python lxml clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.

* fix github actions jobs on branch until bullseye comes out

* Upgrade to `six==1.16.0` to avoid problems on CI runs

```
13:59:02  nox > Session invoke-pre-commit was successful.
13:59:02  nox > Running session invoke-pre-commit
13:59:02  nox > pip install --progress-bar=off -r requirements/static/ci/py3.7/invoke.txt
13:59:02  Collecting blessings==1.7
13:59:02    Using cached blessings-1.7-py3-none-any.whl (18 kB)
13:59:02  Collecting invoke==1.4.1
13:59:02    Using cached invoke-1.4.1-py3-none-any.whl (210 kB)
13:59:02  Collecting pyyaml==5.3.1
13:59:02    Using cached PyYAML-5.3.1.tar.gz (269 kB)
13:59:02  Collecting six==1.15.0
13:59:02    Using cached six-1.15.0-py2.py3-none-any.whl (10 kB)
13:59:02  Building wheels for collected packages: pyyaml
13:59:02    Building wheel for pyyaml (setup.py) ... -� �\� �|� �/� �-� �\� �|� �done
13:59:02    Created wheel for pyyaml: filename=PyYAML-5.3.1-cp37-cp37m-linux_x86_64.whl size=546391 sha256=e42e1d66cc32087f4d33ceb81268c86b59f1a97029b19459f91b8d6ad1430167
13:59:02    Stored in directory: /var/jenkins/.cache/pip/wheels/5e/03/1e/e1e954795d6f35dfc7b637fe2277bff021303bd9570ecea653
13:59:02  Successfully built pyyaml
13:59:02  Installing collected packages: six, pyyaml, invoke, blessings
13:59:02    Attempting uninstall: six
13:59:02      Found existing installation: six 1.16.0
13:59:02      Uninstalling six-1.16.0:
13:59:02  ERROR: Could not install packages due to an OSError: [Errno 2] No such file or directory: '/var/jenkins/.cache/pre-commit/repomw8oee1s/py_env-python3/lib/python3.7/site-packages/__pycache__/six.cpython-37.pyc'
13:59:02
13:59:02  nox > Command pip install --progress-bar=off -r requirements/static/ci/py3.7/invoke.txt failed with exit code 1
13:59:02  nox > Session invoke-pre-commit failed.
```

* add changelog for #59982

* Regression test for #56273

* Fix race condition in batch. #56273

* Add changelog for #56273

* Update salt/client/__init__.py

Co-authored-by: Pedro Algarvio <pedro@algarvio.me>

* Update doc for salt/client

* Update changelog/56273.fixed

Thoreau said, "Simplify, Simplify"

* Update docs

* Update docs

* Update CHANGELOG.md

* Update 3003.1.rst

* Ignore configuration for 'enable_fqdns_grains' for AIX, Solaris and Juniper

* Added changelog

* Let Mac OS Mojave run for 8 hours to avoid timeout

* Remove FreeBSD-12.2

* Use Popen for VT

* Still allow shell True

* Drop shlex split

* Add crypto re-init

* Fix pre-commit

* Do not call close in isalive

* Skip tests not valid on windows

* Cleanup things that are not really needed

* We do not support irix

* Fix pre-commit

* Remove commented out lines

* Add changelog for #60504

* Fix pre-commit issues

* pyupgrade does not remove six imports

* Fix OSErrors in some test cases

* Remove un-needed args processing

* Make state_running test more reliable

* Removing tmpfs from Fedora 33.

* Address leaks in fileserver caused by git backends

At this time we do not have the ability to fix the upstream memory leaks
in the gitfs backend providers. Work around their limitations by
periodically restarting the file server update proccess. This will at
least partially address #50313

* Remove un-used import

* Fix warts caused by black version

* Add changelog

* We don't need two changelogs

* Also pin the ``pip`` upgrade to be ``<21.2``

* Update the external ipaddress to the latest 3.9.5 version which has some security fixes.  Updating the compat.p to use the vendored version if the python version is below 3.9.5 and only run the test_ipaddress.py tests if below 3.9.5.

* Adding changelog

* Requested changes.

* Add shh_timeout to ssh_kwargs

* move to with blocks

* one with block

* reight crypto

* add back test file

* add changelog

* change log file number

* add m2crypt support

* only check m2crpto

* Delete 60571.fixed

* add back log

* add newline

* add newline for log file

* Work around pypa/pip#9450

See pypa/pip#10212

* Drop six and Py2

* [3003.2] Add server alive (#60573)

* add server alive

* rename log

* change default alive time

* add requested changes

* format string

* reformat string again

* run pre

* customize

* space

* remove EOF dead space

* fix pre-commit

* run pre

Co-authored-by: Megan Wilhite <megan.wilhite@gmail.com>

* Changelog for 3003.2

* Man pages update for 3003.2

* Allow CVE entries in `changelog/`

* Add security type for towncrier changelog

* Add security type for changelog entries pre-commit check

* Pin to ``pip>=20.2.4,<21.2``

Refs pypa/pip#9450

* Drop six and Py2

* Fix bug introduced in #59648

Fixes #60046

* Add changelog

* Fix doc builds

* fix release notes about dropping ubuntu 16.04

* update file client

* add changelog file

* update changelog

* Check permissions of minion config directory

* Fix some wording in the messagebox and in comments

* Add changelog

* Fix extension for changelog

* Add missing commas. It also worked, but now is better

* docs_3003.3

* fixing version numbers in man pages.

* removing newlines.

* removing newlines.

* Fixing release notes.

* Fix changelog file for 3003.2 release

* Fix test_state test using loader.context

* Re-add test_context test

* Allow Local System account, add timestamp

* swaping the git-source for vsphere-automation-sdk-python

* Remove destroy, handled in context manager

Co-authored-by: Daniel Wozniak <dwozniak@saltstack.com>
Co-authored-by: Pedro Algarvio <pedro@algarvio.me>
Co-authored-by: Bryce Larson <brycel@vmware.com>
Co-authored-by: Pablo Suárez Hernández <psuarezhernandez@suse.com>
Co-authored-by: Alexander Graul <agraul@suse.com>
Co-authored-by: Frode Gundersen <fgundersen@saltstack.com>
Co-authored-by: Gareth J. Greenaway <gareth@saltstack.com>
Co-authored-by: Gareth J. Greenaway <gareth@wiked.org>
Co-authored-by: Hoa-Long Tam <hoalong@apple.com>
Co-authored-by: krionbsd <krion@freebsd.org>
Co-authored-by: Elias Probst <e.probst@ssc-services.de>
Co-authored-by: Daniel A. Wozniak <dwozniak@vmware.com>
Co-authored-by: Frode Gundersen <frogunder@gmail.com>
Co-authored-by: twangboy <slee@saltstack.com>
Co-authored-by: twangboy <leesh@vmware.com>
Co-authored-by: ScriptAutomate <derek@icanteven.io>
Co-authored-by: Wayne Werner <waynejwerner@gmail.com>
Co-authored-by: David Murphy < dmurphy@saltstack.com>
Co-authored-by: Joe Eacott <jeacott@vmware.com>
Co-authored-by: cmcmarrow <charles.mcmarrow.4@gmail.com>
Co-authored-by: Twangboy <shane.d.lee@gmail.com>
@blackzombie87
Copy link

The problem still exist with 3004!
I've found a workaround, but maybe it's not the right way to "solve" this:

First, i needed to include typing_extensions into the thin package:

~# diff thin.py /usr/local/lib/python3.9/dist-packages/salt/utils/thin.py
30a31
> import typing_extensions
427a429
>         typing_extensions,

And second, the harder part if running on Python 3.5 (yes, ugly...) is a bug in immutables which can be solved with this:

~# diff _protocols.py /usr/local/lib/python3.9/dist-packages/immutables/_protocols.py
6c6
< from typing import NoReturn
---
> #from typing import NoReturn
15a16
>     from typing import NoReturn
18a20
>     from typing_extensions import NoReturn

It will move the import of NoReturn into the section which decides which version of Python is running, as NoReturn is not included in the typing extension of Python 3.5

Sorry for directly pasting diff's here, but i never did a merge before so maybe someone here is able to do that :)

@drigolin
Copy link

Yes is present also in 3004

@lastmikoi
Copy link
Contributor

The problem still exist with 3004! I've found a workaround, but maybe it's not the right way to "solve" this:

First, i needed to include typing_extensions into the thin package:

~# diff thin.py /usr/local/lib/python3.9/dist-packages/salt/utils/thin.py
30a31
> import typing_extensions
427a429
>         typing_extensions,

Thank you VERY much for that workaround, I was able to workaround my issue and start working on my 10-month froze deployment (rockylinux is only supported on >3004 so rolling back to 3002 was impossible), after I remembered to clean my .cache folder.

I can confirm that, without this workaround, the issue is still here, even with a python 3.6 archlinux virtualenv trying to salt-ssh to a python 3.6 rockylinux 8 target.

@OrangeDog
Copy link
Contributor

Reopening due to multiple reports of not being fixed.

@OrangeDog OrangeDog reopened this Jul 6, 2022
@OrangeDog OrangeDog added the Regression The issue is a bug that breaks functionality known to work in previous releases. label Jul 6, 2022
@lastmikoi
Copy link
Contributor

Thanks for the re-opening @OrangeDog !

I've gone ahead and troubleshooted the issue in detail, I've worked on a fix (#62234) which seems to be functional.

As an excerpt of my troubleshooting, from the PR:

[...] the contextvars backport makes uses of the immutables module.

This module went through a typing refactor [...] on August 2021.

However, that typing refactor added a new dependency, typing_extensions, but only on pre-3.8 deployments

@tao-devops
Copy link

Setup install salt-ssh on an ubuntu 20.04 box and use it to control an ubuntu 16.04 box (probably happens with centos 7, 8, debian 9, and ubuntu 18.04 as well)

Steps to Reproduce the behavior

salt-ssh \* test.ping
minion-id:
    ----------
    retcode:
        1
    stderr:
        Traceback (most recent call last):
          File "/var/tmp/.root_d24770_salt/salt-call", line 27, in <module>
            salt_call()
          File "/var/tmp/.root_d24770_salt/pyall/salt/scripts.py", line 437, in salt_call
            import salt.cli.call
          File "/var/tmp/.root_d24770_salt/pyall/salt/cli/call.py", line 6, in <module>
            import salt.cli.caller
          File "/var/tmp/.root_d24770_salt/pyall/salt/cli/caller.py", line 14, in <module>
            import salt.loader
          File "/var/tmp/.root_d24770_salt/pyall/salt/loader.py", line 7, in <module>
            import contextvars
          File "/var/tmp/.root_d24770_salt/py3/contextvars.py", line 1, in <module>
            from _contextvars import Context, ContextVar, Token, copy_context
        ImportError: No module named '_contextvars'
    stdout:

I also tried doing pip3 install contextvars immutables --prefix /usr and pip3 install contextvars immutables on the master and it didn't fix the issue.

Expected behavior

minion-id:
    True

Versions Report

Salt Version:
          Salt: 3003
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: Not Installed
      dateutil: 2.7.3
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 2.10.1
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 0.6.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: Not Installed
      pycrypto: 2.6.1
  pycryptodome: 3.6.1
        pygit2: Not Installed
        Python: 3.8.5 (default, Jan 27 2021, 15:41:15)
  python-gnupg: 0.4.5
        PyYAML: 5.3.1
         PyZMQ: 18.1.1
         smmap: Not Installed
       timelib: Not Installed
       Tornado: 4.5.3
           ZMQ: 4.3.2
 
System Versions:
          dist: ubuntu 20.04 focal
        locale: utf-8
       machine: x86_64
       release: 5.4.0-70-generic
        system: Linux
       version: Ubuntu 20.04 focal
 

as

@fs30000
Copy link

fs30000 commented Dec 16, 2022

I had the the "ModuleNotFoundError: No module named 'contextvars'" error when connecting to a centos 7 machine using salt-ssh. Of course doing pip3 install contextvars on the target fixed it.

@Reonaydo
Copy link

Reonaydo commented Mar 9, 2023

Why Salt puts contextvars.py from Python-3.7+ into archive? If on Python-3.7+ on target system it already has his own contextvars.py. But if target system has lesser version of Python than 3.7, this contextvars.py breaks it.
loader.py has support for 3.6 and 3.7+ versions in next code

try:
    # Try the stdlib C extension first
    import _contextvars as contextvars
except ImportError:
    # Py<3.7
    import contextvars

So I think that salt mustn't put contextvars.py in thin.tgz
I think there should always be contextvars backport from PyPi instead(but I'm not sure how should it be put inside)
Python-3.7+ on target system will skip it in loader but legacy version will use this backported contextvars

I made this fast patch and is works for me for rhel7-based and rhel8-based systems if python3-contextvars is installed on those systems.

--- /usr/lib64/python3.10/site-packages/salt/utils/thin.py.orig      2023-01-30 12:16:01.000000000 +0300
+++ /usr/lib64/python3.10/site-packages/salt/utils/thin.py        2023-03-09 20:18:51.527031976 +0300
@@ -427,12 +427,14 @@
         backports_abc,
     ]
     modules = find_site_modules("contextvars")
+    contextvars = None
     if modules:
         contextvars = modules[0]
-    else:
+    elif py_contextvars.__file__.split('/')[-1] != 'contextvars.py':
         contextvars = py_contextvars
-    log.debug("Using contextvars %r", contextvars)
-    mods.append(contextvars)
+    if contextvars:
+        log.debug("Using contextvars %r", contextvars)
+        mods.append(contextvars)
     if has_immutables:
         mods.append(immutables)
     for mod in mods:

@Reonaydo
Copy link

Reonaydo commented Mar 9, 2023

Oh I got it. contextvars exists in dependencies but was removed but my distro maintainers.

mwarkentin added a commit to getsentry/salt that referenced this issue Mar 15, 2023
saltstack#59942
saltstack#62234

confirmed working from my mac to both deb10 (snuba-transactions-tiger) and deb11 (access-logs) targets
@dmurphy18
Copy link
Contributor

Closing this, since it appears to be fixed, please reopen if other points to raise

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Aluminium Release Post Mg and Pre Si Bug broken, incorrect, or confusing behavior centos affects this operating system debian affects this operating system point-release minor release Regression The issue is a bug that breaks functionality known to work in previous releases. Salt-SSH severity-high 2nd top severity, seen by most users, causes major problems ubuntu affects this operating system
Projects
None yet