Skip to content

Commit b58fd24

Browse files
jdelicjdelic
committed
Merge branch '3007.x' into fix/add-nftables-icmpv6-support
2 parents 7416cf3 + f8ba8c2 commit b58fd24

File tree

290 files changed

+10546
-18678
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

290 files changed

+10546
-18678
lines changed

‎.github/ISSUE_TEMPLATE/config.yml

-3
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,3 @@ contact_links:
66
- name: Salt-Users Forum
77
url: https://groups.google.com/forum/#!forum/salt-users
88
about: Please ask and answer questions here.
9-
- name: Salt on LiberaChat
10-
url: https://web.libera.chat/#salt
11-
about: Please ask and answer questions here.

‎.github/ISSUE_TEMPLATE/tech-debt.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ assignees: ''
88
---
99

1010
### Description of the tech debt to be addressed, include links and screenshots
11-
<!-- Note: Please direct questions to the salt-users google group, IRC or Community Discord. -->
11+
<!-- Note: Please direct questions to the salt-users google group, GitHub Discussions or Community Discord. -->
1212

1313
### Versions Report
1414
(Provided by running `salt --versions-report`. Please also mention any differences in master/minion versions.)

‎.github/actionlint.yaml

+2-11
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,5 @@
11
self-hosted-runner:
22
# Labels of self-hosted runner in array of string
33
labels:
4-
- bastion
5-
- x86_64
6-
- arm64
7-
- aarch64
8-
- amd64
9-
- repo-nightly
10-
- repo-staging
11-
- repo-release
12-
- medium
13-
- large
14-
- macos-13-xlarge
4+
- linux-x86_64
5+
- linux-arm64

‎.github/actions/build-onedir-salt/action.yml

+6-14
Original file line numberDiff line numberDiff line change
@@ -29,21 +29,13 @@ runs:
2929

3030
steps:
3131

32-
- name: Download Cached Deps Onedir Package Directory
33-
id: onedir-bare-cache
34-
uses: ./.github/actions/cache
32+
- name: Install Salt Packaging Dependencies into Relenv Onedir
33+
uses: ./.github/actions/build-onedir-deps
3534
with:
36-
path: artifacts/${{ inputs.package-name }}
37-
key: >
38-
${{ inputs.cache-prefix }}|${{ inputs.python-version }}|deps|${{ inputs.platform }}|${{ inputs.arch }}|${{ inputs.package-name }}|${{
39-
hashFiles(
40-
format('{0}/.relenv/**/*.xz', github.workspace),
41-
'requirements/static/pkg/*/*.txt',
42-
'.github/actions/build-onedir-deps/action.yml',
43-
'.github/workflows/build-deps-onedir-*.yml',
44-
'cicd/shared-gh-workflows-context.yml'
45-
)
46-
}}
35+
platform: ${{ inputs.platform }}
36+
arch: ${{ inputs.arch }}
37+
python-version: "${{ inputs.python-version }}"
38+
cache-prefix: ${{ inputs.cache-seed }}|relenv|${{ inputs.salt-version }}
4739

4840
- name: Download Source Tarball
4941
uses: actions/download-artifact@v4

‎.github/actions/cache/action.yml

-7
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,6 @@ inputs:
2626
description: 'Check if a cache entry exists for the given input(s) (key, restore-keys) without downloading the cache'
2727
default: 'false'
2828
required: false
29-
save-always:
30-
description: 'Run the post step to save the cache even if another step before fails'
31-
default: 'false'
32-
required: false
3329

3430
outputs:
3531
cache-hit:
@@ -49,7 +45,6 @@ runs:
4945
echo "GHA_CACHE_ENABLE_CROSS_OS_ARCHIVE=${{ inputs.enableCrossOsArchive }}" | tee -a "${GITHUB_ENV}"
5046
echo "GHA_CACHE_FAIL_ON_CACHE_MISS=${{ inputs.fail-on-cache-miss }}" | tee -a "${GITHUB_ENV}"
5147
echo "GHA_CACHE_LOOKUP_ONLY=${{ inputs.lookup-only }}" | tee -a "${GITHUB_ENV}"
52-
echo "GHA_CACHE_SAVE_ALWAYS=${{ inputs.save-always }}" | tee -a "${GITHUB_ENV}"
5348
echo "GHA_CACHE_RESTORE_KEYS=${{ inputs.restore-keys }}" | tee -a "${GITHUB_ENV}"
5449
echo "GHA_CACHE_UPLOAD_CHUNK_SIZE=${{ inputs.upload-chunk-size }}" | tee -a "${GITHUB_ENV}"
5550
@@ -63,7 +58,6 @@ runs:
6358
enableCrossOsArchive: ${{ env.GHA_CACHE_ENABLE_CROSS_OS_ARCHIVE }}
6459
fail-on-cache-miss: ${{ env.GHA_CACHE_FAIL_ON_CACHE_MISS }}
6560
lookup-only: ${{ env.GHA_CACHE_LOOKUP_ONLY }}
66-
save-always: ${{ env.GHA_CACHE_SAVE_ALWAYS }}
6761
restore-keys: ${{ env.GHA_CACHE_RESTORE_KEYS }}
6862
upload-chunk-size: ${{ env.GHA_CACHE_UPLOAD_CHUNK_SIZE }}
6963

@@ -97,7 +91,6 @@ runs:
9791
enableCrossOsArchive: ${{ env.GHA_CACHE_ENABLE_CROSS_OS_ARCHIVE }}
9892
fail-on-cache-miss: ${{ env.GHA_CACHE_FAIL_ON_CACHE_MISS }}
9993
lookup-only: ${{ env.GHA_CACHE_LOOKUP_ONLY }}
100-
save-always: ${{ env.GHA_CACHE_SAVE_ALWAYS }}
10194
restore-keys: ${{ env.GHA_CACHE_RESTORE_KEYS }}
10295
upload-chunk-size: ${{ env.GHA_CACHE_UPLOAD_CHUNK_SIZE }}
10396

‎.github/actions/setup-python-tools-scripts/action.yml

+3
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,13 @@ runs:
5454
working-directory: ${{ inputs.cwd }}
5555
run: |
5656
PYTHON_EXE=${{ steps.tools-virtualenv.outputs.python-executable }}
57+
${PYTHON_EXE} -m ensurepip --upgrade
5758
(${PYTHON_EXE} -m pip install --help | grep break-system-packages > /dev/null 2>&1) && exitcode=0 || exitcode=1
5859
if [ $exitcode -eq 0 ]; then
60+
${PYTHON_EXE} -m pip install --break-system-packages --upgrade setuptools
5961
${PYTHON_EXE} -m pip install --break-system-packages -r requirements/static/ci/py${{ steps.get-python-version.outputs.version }}/tools.txt
6062
else
63+
${PYTHON_EXE} -m pip install --upgrade setuptools
6164
${PYTHON_EXE} -m pip install -r requirements/static/ci/py${{ steps.get-python-version.outputs.version }}/tools.txt
6265
fi
6366

‎.github/actions/ssh-tunnel/README.md

+100
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# SSH Tunnel
2+
3+
The ssh-tunnel action will create a reverse tunnel over webrtc to port 22 on the runner.
4+
5+
## Usage
6+
7+
In order to use this action you must have a sdp offer from your local host and a ssh key pair.
8+
Start with creating an sdp offer on your local machine. Provide these values to the ssh-tunnel
9+
action and wait for output from the action with the sdp reply. Provide the reply to the local
10+
rtcforward.py process by pasting it to stdin. If all goes well the local port on your maching
11+
will be forwarded to the ssh port on the runner.
12+
13+
### Getting an sdp offer
14+
15+
To get an sdp offer start rtcforward.py on you local machine with the offer command.
16+
You can also specify which port on the local machine will be used for the tunnel.
17+
18+
``` bash
19+
$ python3 .github/actions/ssh-tunnel/rtcforward.py offer --port 5222
20+
```
21+
22+
rtcforward.py will create an offer an display it to your terminal. (This example offer has been truncated)
23+
After showing the offer the `rtcforward.py` process will wait for a reply.
24+
```
25+
-- offer --
26+
eyJzZHAiOiAidj0wXHJcbm89LSAzOTQ3Mzg4NjUzIDM5NDczODg2NTMgSU4gSVA0IDAuMC4wLjBcclxu
27+
cz0tXHJcbnQ9MCAwXHJcbmE9Z3JvdXA6QlVORExFIDBcclxuYT1tc2lkLXNlbWFudGljOldNUyAqXHJc
28+
bm09YXBwbGljYXRpb24gMzUyNjkgRFRMUy9TQ1RQIDUwMDBcclxuYz1JTiBJUDQgMTkyLjE2OC4wLjIw
29+
IHVkcCAxNjk0NDk4ODE1IDE4NC4xNzkuMjEwLjE1MiAzNTI2OSB0eXAgc3JmbHggcmFkZHIgMTkyLjE2
30+
OC4wLjIwMSBycG9ydCAzNTI2OVxyXG5hPWNhbmRpZGF0ZTozZWFjMzJiZTZkY2RkMTAwZDcwMTFiNWY0
31+
NTo4Qzo2MDoxMTpFQTo3NzpDMTo5RTo1QTo3QzpDQzowRDowODpFQzo2NDowQToxM1xyXG5hPWZpbmdl
32+
cnByaW50OnNoYS01MTIgNjY6MzI6RUQ6MDA6N0I6QjY6NTQ6NzA6MzE6OTA6M0I6Mjg6Q0I6QTk6REU6
33+
MzQ6QjI6NDY6NzE6NUI6MjM6ODA6Nzg6Njg6RDA6QTA6QTg6MjU6QkY6MDQ6ODY6NUY6OTA6QUY6MUQ6
34+
QjA6QzY6ODA6QUY6OTc6QTI6MkM6NDI6QUU6MkI6Q0Q6Mjk6RUQ6MkI6ODc6NTU6ODg6NDY6QTM6ODk6
35+
OEY6ODk6OTE6QTE6QTI6NDM6NTc6M0E6MjZcclxuYT1zZXR1cDphY3RwYXNzXHJcbiIsICJ0eXBlIjog
36+
Im9mZmVyIn0=
37+
-- end offer --
38+
-- Please enter a message from remote party --
39+
```
40+
41+
### Getting an sdp answer
42+
43+
Provide the offer to the ssh-tunnel action. When the action runs, an answer to the offer will be generated.
44+
In the action output you will see that the offer was recieved and the reply in the output.
45+
46+
```
47+
-- Please enter a message from remote party --
48+
-- Message received --
49+
-- reply --
50+
eyJzZHAiOiAidj0wXHJcbm89LSAzOTQ3Mzg3NDcxIDM5NDczODc0NzEgSU4gSVA0IDAuMC4wLjBcclxu
51+
cz0tXHJcbnQ9MCAwXHJcbmE9Z3JvdXA6QlVORExFIDBcclxuYT1tc2lkLXNlbWFudGljOldNUyAqXHJc
52+
bm09YXBwbGljYXRpb24gNTcwMzkgRFRMUy9TQ1RQIDUwMDBcclxuYz1JTiBJUDQgMTkyLjE2OC42NC4x
53+
MFxyXG5hPW1pZDowXHJcbmE9c2N0cG1hcDo1MDAwIHdlYnJ0Yy1kYXRhY2hhbm5lbCA2NTUzNVxyXG5h
54+
MTc6MEI6RTA6OTA6QUM6RjU6RTk6RUI6Q0E6RUE6NTY6REI6NTA6QTk6REY6NTU6MzY6MkM6REI6OUE6
55+
MDc6Mzc6QTM6NDc6NjlcclxuYT1maW5nZXJwcmludDpzaGEtNTEyIDMyOjRDOjk0OkRDOjNFOkU5OkU3
56+
OjNCOjc5OjI4OjZDOjc5OkFEOkVDOjIzOkJDOjRBOjRBOjE5OjlCOjg5OkE3OkE2OjZBOjAwOjJFOkM5
57+
OkE0OjlEOjAwOjM0OjFFOjRDOkVGOjcwOkY5OkNBOjg0OjlEOjcxOjI5OkVCOkIxOkREOkFEOjg5OjUx
58+
OkZFOjhCOjI3OjFDOjFBOkJEOjUxOjQ2OjE4OjBBOjhFOjVBOjI1OjQzOjQzOjZGOkRBXHJcbmE9c2V0
59+
dXA6YWN0aXZlXHJcbiIsICJ0eXBlIjogImFuc3dlciJ9
60+
-- end reply --
61+
```
62+
63+
# Finalizing the tunnel
64+
65+
Paste the sdp reply from the running action into the running `rtcforward.py` process that created the offer.
66+
After receiveing the offer you will see `-- Message received --` and tunnel will be created.
67+
68+
```
69+
-- offer --
70+
eyJzZHAiOiAidj0wXHJcbm89LSAzOTQ3Mzg4NjUzIDM5NDczODg2NTMgSU4gSVA0IDAuMC4wLjBcclxu
71+
cz0tXHJcbnQ9MCAwXHJcbmE9Z3JvdXA6QlVORExFIDBcclxuYT1tc2lkLXNlbWFudGljOldNUyAqXHJc
72+
bm09YXBwbGljYXRpb24gMzUyNjkgRFRMUy9TQ1RQIDUwMDBcclxuYz1JTiBJUDQgMTkyLjE2OC4wLjIw
73+
IHVkcCAxNjk0NDk4ODE1IDE4NC4xNzkuMjEwLjE1MiAzNTI2OSB0eXAgc3JmbHggcmFkZHIgMTkyLjE2
74+
OC4wLjIwMSBycG9ydCAzNTI2OVxyXG5hPWNhbmRpZGF0ZTozZWFjMzJiZTZkY2RkMTAwZDcwMTFiNWY0
75+
NTo4Qzo2MDoxMTpFQTo3NzpDMTo5RTo1QTo3QzpDQzowRDowODpFQzo2NDowQToxM1xyXG5hPWZpbmdl
76+
cnByaW50OnNoYS01MTIgNjY6MzI6RUQ6MDA6N0I6QjY6NTQ6NzA6MzE6OTA6M0I6Mjg6Q0I6QTk6REU6
77+
MzQ6QjI6NDY6NzE6NUI6MjM6ODA6Nzg6Njg6RDA6QTA6QTg6MjU6QkY6MDQ6ODY6NUY6OTA6QUY6MUQ6
78+
QjA6QzY6ODA6QUY6OTc6QTI6MkM6NDI6QUU6MkI6Q0Q6Mjk6RUQ6MkI6ODc6NTU6ODg6NDY6QTM6ODk6
79+
OEY6ODk6OTE6QTE6QTI6NDM6NTc6M0E6MjZcclxuYT1zZXR1cDphY3RwYXNzXHJcbiIsICJ0eXBlIjog
80+
Im9mZmVyIn0=
81+
-- end offer --
82+
-- Please enter a message from remote party --
83+
eyJzZHAiOiAidj0wXHJcbm89LSAzOTQ3Mzg3NDcxIDM5NDczODc0NzEgSU4gSVA0IDAuMC4wLjBcclxu
84+
cz0tXHJcbnQ9MCAwXHJcbmE9Z3JvdXA6QlVORExFIDBcclxuYT1tc2lkLXNlbWFudGljOldNUyAqXHJc
85+
bm09YXBwbGljYXRpb24gNTcwMzkgRFRMUy9TQ1RQIDUwMDBcclxuYz1JTiBJUDQgMTkyLjE2OC42NC4x
86+
MFxyXG5hPW1pZDowXHJcbmE9c2N0cG1hcDo1MDAwIHdlYnJ0Yy1kYXRhY2hhbm5lbCA2NTUzNVxyXG5h
87+
MTc6MEI6RTA6OTA6QUM6RjU6RTk6RUI6Q0E6RUE6NTY6REI6NTA6QTk6REY6NTU6MzY6MkM6REI6OUE6
88+
MDc6Mzc6QTM6NDc6NjlcclxuYT1maW5nZXJwcmludDpzaGEtNTEyIDMyOjRDOjk0OkRDOjNFOkU5OkU3
89+
OjNCOjc5OjI4OjZDOjc5OkFEOkVDOjIzOkJDOjRBOjRBOjE5OjlCOjg5OkE3OkE2OjZBOjAwOjJFOkM5
90+
OkE0OjlEOjAwOjM0OjFFOjRDOkVGOjcwOkY5OkNBOjg0OjlEOjcxOjI5OkVCOkIxOkREOkFEOjg5OjUx
91+
OkZFOjhCOjI3OjFDOjFBOkJEOjUxOjQ2OjE4OjBBOjhFOjVBOjI1OjQzOjQzOjZGOkRBXHJcbmE9c2V0
92+
dXA6YWN0aXZlXHJcbiIsICJ0eXBlIjogImFuc3dlciJ9
93+
-- Message received --
94+
```
95+
96+
SSH to your local port.
97+
98+
```
99+
ssh -o StrictHostKeychecking=no -o TCPKeepAlive=no -o StrictHostKeyChecking=no -vv -p 5222 runner@localhost
100+
```

‎.github/actions/ssh-tunnel/action.yml

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: ssh-tunnel
2+
description: SSH Reverse Tunnel
3+
4+
inputs:
5+
public_key:
6+
required: true
7+
type: string
8+
description: Public key to accept for reverse tunnel. Warning, this should not be the public key for the 'private_key' input.
9+
offer:
10+
required: true
11+
type: string
12+
description: RTC offer
13+
debug:
14+
required: false
15+
type: bool
16+
default: false
17+
description: Run sshd with debug enabled.
18+
19+
runs:
20+
using: composite
21+
steps:
22+
- uses: actions/checkout@v4
23+
24+
- uses: actions/setup-python@v5
25+
with:
26+
python-version: '3.10'
27+
28+
- name: Install ssh
29+
if: ${{ runner.os == 'Windows' }}
30+
shell: powershell
31+
run: |
32+
python3.exe -m pip install requests
33+
python3.exe .github/actions/ssh-tunnel/installssh.py
34+
35+
- name: Start SSH
36+
shell: bash
37+
run: |
38+
if [ "$RUNNER_OS" = "Windows" ]; then
39+
powershell.exe -command "Start-Service sshd"
40+
elif [ "$RUNNER_OS" = "macOS" ]; then
41+
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
42+
else
43+
sudo systemctl start ssh
44+
fi
45+
46+
- name: Show sshd configuration
47+
shell: bash
48+
run: |
49+
if [ "$RUNNER_OS" = "Linux" ]; then
50+
cat /etc/ssh/sshd_config
51+
elif [ "$RUNNER_OS" = "macOS" ]; then
52+
cat /private/etc/ssh/sshd_config
53+
else
54+
cat "C:\ProgramData\ssh\sshd_config"
55+
fi
56+
57+
- name: Add ssh public key
58+
shell: bash
59+
run: |
60+
if [ "$RUNNER_OS" = "Linux" ]; then
61+
mkdir -p /home/runner/.ssh
62+
chmod 700 /home/runner/.ssh
63+
touch /home/runner/.ssh/authorized_keys
64+
echo "${{ inputs.public_key }}" | tee -a /home/runner/.ssh/authorized_keys
65+
elif [ "$RUNNER_OS" = "macOS" ]; then
66+
mkdir -p /Users/runner/.ssh
67+
chmod 700 /Users/runner/.ssh
68+
touch /Users/runner/.ssh/authorized_keys
69+
echo "${{ inputs.public_key }}" | tee -a /Users/runner/.ssh/authorized_keys
70+
else
71+
echo "${{ inputs.public_key }}" | tee -a "C:\ProgramData\ssh\administrators_authorized_keys"
72+
fi
73+
74+
- name: Stop SSHD
75+
if: ${{ inputs.debug }}
76+
shell: bash
77+
run: |
78+
if [ "${{ inputs.debug }}" = "true" ]; then
79+
if [ "$RUNNER_OS" = "Windows" ]; then
80+
powershell.exe -command "Stop-Service sshd"
81+
elif [ "$RUNNER_OS" = "macOS" ]; then
82+
sudo launchctl unload /System/Library/LaunchDaemons/ssh.plist
83+
else
84+
sudo systemctl stop ssh
85+
fi
86+
fi
87+
88+
- name: Create rtc tunnel
89+
shell: bash
90+
run: |
91+
if [ "${{ inputs.debug }}" = "true" ]; then
92+
if [ "$RUNNER_OS" = "Windows" ]; then
93+
./OpenSSH-Win64/sshd.exe -d &
94+
elif [ "$RUNNER_OS" = "macOS" ]; then
95+
sudo /usr/sbin/sshd -d &
96+
else
97+
sudo mkdir -p /run/sshd
98+
sudo chmod 755 /run/sshd
99+
sudo /usr/sbin/sshd -d &
100+
fi
101+
fi
102+
if [ "$RUNNER_OS" = "Windows" ]; then
103+
python3 -m pip install aiortc
104+
else
105+
python3 -m pip install aiortc uvloop
106+
fi
107+
echo '${{ inputs.offer }}' | python .github/actions/ssh-tunnel/rtcforward.py --port 22 answer

‎.github/actions/ssh-tunnel/installssh.py

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
"""
2+
"""
3+
4+
import pathlib
5+
import subprocess
6+
import zipfile
7+
8+
import requests
9+
10+
fwrule = """
11+
New-NetFirewallRule `
12+
-Name sshd `
13+
-DisplayName 'OpenSSH SSH Server' `
14+
-Enabled True `
15+
-Direction Inbound `
16+
-Protocol TCP `
17+
-Action Allow `
18+
-LocalPort 22 `
19+
-Program "{}"
20+
"""
21+
22+
23+
def start_ssh_server():
24+
"""
25+
Pretty print the GH Actions event.
26+
"""
27+
resp = requests.get(
28+
"https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.8.1.0p1-Preview/OpenSSH-Win64.zip",
29+
allow_redirects=True,
30+
)
31+
with open("openssh.zip", "wb") as fp:
32+
fp.write(resp.content)
33+
with zipfile.ZipFile("openssh.zip") as fp:
34+
fp.extractall()
35+
install_script = pathlib.Path("./OpenSSH-Win64/install-sshd.ps1").resolve()
36+
print(f"{install_script}")
37+
subprocess.call(["powershell.exe", f"{install_script}"])
38+
with open("fwrule.ps1", "w") as fp:
39+
fp.write(fwrule.format(install_script.parent / "sshd.exe"))
40+
subprocess.call(["powershell.exe", f"fwrule.ps1"])
41+
42+
43+
if __name__ == "__main__":
44+
start_ssh_server()

0 commit comments

Comments
 (0)