Log Message:
Update to 2015.8.5, from PR#50779 addresses CVE-2016-1866

Salt 2015.8.5 is identical to the 2015.8.4 release with the addition of a fix
for issue 30820, fixed by PR #30833.

SECURITY FIX
CVE-2016-1866: Improper handling of clear messages on the minion, which could
result in executing commands not sent by the master.

This issue affects only the 2015.8.x releases of Salt. In order for an attacker
to use this attack vector, they would have to execute a successful attack on an
existing TCP connection between minion and master on the pub port. It does not
allow an external attacker to obtain the shared secret or decrypt any encrypted
traffic between minion and master.

We recommend everyone upgrade to 2015.8.4 as soon as possible.

CORE CHANGES
PR #28994: timcharper Salt S3 module has learned how to assume IAM roles

Added option mock=True for state.sls and state.highstate. This allows the salt
state compiler to process sls data in a state run without actually calling the
state functions, thus providing feedback on the validity of the arguments used
for the functions beyond the preprocessing validation provided by state.show_sls
(issue 30118 and issue 30189).

salt '*' state.sls core,edit.vim mock=True
salt '*' state.highstate mock=True
salt '*' state.apply edit.vim mock=True
CHANGES FOR V2015.8.3..V2015.8.4

Extended changelog courtesy of Todd Stansell
(https://github.com/tjstansell/salt-changelogs):

Generated at: 2016-01-25T17:48:35Z

Total Merges: 320

Changes:

PR #30613: (basepi) Fix minion/syndic clearfuncs
PR #30609: (seanjnkns) Fix documentation for pillar_merge_lists which default is
False, not …
PR #30584: (julianbrost) file.line state: add missing colon in docstring
PR #30589: (terminalmage) Merge 2015.5 into 2015.8
PR #30599: (multani) Documentation formatting fixes
PR #30554: (rallytime) Make the salt-cloud actions output more verbose and
helpful
PR #30549: (techhat) Salt Virt cleanup
PR #30553: (techhat) AWS: Support 17-character IDs
PR #30532: (whiteinge) Add execution module for working in sls files
PR #30529: (terminalmage) Merge 2015.5 into 2015.8
PR #30526: (twangboy) Added FlushKey to make sure it's changes are saved to disk
PR #30521: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #30485: (jtand) Updated pip_state to work with pip 8.0 on 2015.8
PR #30494: (isbm) Zypper: info_installed — 'errors' flag change to type
'boolean'
PR #30506: (jacksontj) Properly remove newlines after reading the file
PR #30508: (rallytime) Fix Linode driver cloning functionality
PR #30522: (terminalmage) Update git.list_worktree tests to reflect new return
data
PR #30483: (borgstrom) Pyobjects recursive import support (for 2015.8)
PR #30491: (jacksontj) Add multi-IP support to network state
PR #30496: (anlutro) Fix KeyError when adding ignored pillars
PR #30359: (kingsquirrel152) Removes suspected copy/paste error for
zmq_filtering functionailty
PR #30448: (cournape) Fix osx scripts location
PR #30457: (rallytime) Remove fsutils references from modules list
PR #30453: (rallytime) Make sure private AND public IPs are listed for Linode
driver
PR #30458: (rallytime) Back-port #30062 to 2015.8
PR #30468: (timcharper) make note of s3 role assumption in upcoming changelog
PR #30470: (whiteinge) Add example of the match_dict format to accept_dict wheel
function
PR #30450: (gtmanfred) fix extension loading in novaclient
PR #30212: (abednarik) Fix incorrect file permissions in file.line
PR #29947: (jfindlay) fileclient: decode file list from master
PR #30363: (terminalmage) Use native "list" subcommand to list git \ 
worktrees
PR #30445: (jtand) Boto uses False for is_default instead of None
PR #30406: (frioux) Add an example of how to use file.managed/check_cmd
PR #30424: (isbm) Check if byte strings are properly encoded in UTF-8
PR #30405: (jtand) Updated glusterfs.py for python2.6 compatibility.
PR #30396: (pass-by-value) Remove hardcoded val
PR #30391: (jtand) Added else statements
PR #30375: (rallytime) Wrap formatted log statements with six.u() in
cloud/__init__.py
PR #30384: (isbm) Bugfix: info_available does not work correctly on SLE 11
series
PR #30376: (pritambaral) Fix FLO_DIR path in 2015.8
PR #30389: (jtand) Older versions of ipset don't support comments
PR #30373: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #30372: (jacobhammons) Updated man pages for 2015.8.4, updated copyright to
2016
PR #30370: (rallytime) Remove incomplete function
PR #30366: (rallytime) Back-port #28702 to 2015.8
PR #30361: (cro) Flip the sense of the test for proxymodule imports, add more
fns for esxi proxy
PR #30267: (isbm) Fix RPM issues with the date/time and add package attributes
filtering
PR #30360: (jfindlay) file.remove, file.absent: mention recursive dir removal
PR #30221: (mbarrien) No rolcatupdate for user_exist in Postgres>=9.5 `#26845`_
PR #30358: (terminalmage) Add libgit2 version to versions-report
PR #30346: (pass-by-value) Prevent orphaned volumes
PR #30349: (rallytime) Back-port #30347 to 2015.8
PR #30354: (anlutro) Make sure all ignore_missing SLSes are caught
PR #30356: (nmadhok) Adding code author
PR #30340: (jtand) Updated seed_test.py for changes made to seed module
PR #30339: (jfindlay) Backport #26511
PR #30343: (rallytime) Fix 2015.8 from incomplete back-port
PR #30342: (eliasp) Correct whitespace placement in error message
PR #30308: (rallytime) Back-port #30257 to 2015.8
PR #30187: (rallytime) Back-port #27606 to 2015.8
PR #30223: (serge-p) adding support for DragonFly BSD
PR #30238: (rallytime) Reinit crypto before calling RSA.generate when generating
keys.
PR #30246: (dmacvicar) Add missing return data to scheduled jobs (`#24237`_)
PR #30292: (thegoodduke) ipset: fix test=true & add comment for every entry
PR #30275: (abednarik) Add permanent argument in firewalld.
PR #30328: (cachedout) Fix file test
PR #30310: (pass-by-value) Empty bucket fix
PR #30211: (techhat) Execute choot on the correct path
PR #30309: (rallytime) Back-port #30304 to 2015.8
PR #30278: (nmadhok) If datacenter is specified in the config, then look for
managed objects under it
PR #30305: (jacobhammons) Changed examples to use the "example.com" domain
instead of "mycompan…
PR #30249: (mpreziuso) Fixes performance and timeout issues on win_pkg.install
PR #30217: (pass-by-value) Make sure cloud actions can be called via salt run
PR #30268: (terminalmage) Optimize file_tree ext_pillar and update file.managed
to allow for binary contents
PR #30245: (rallytime) Boto secgroup/iam_role: Add note stating us-east-1 is
default region
PR #30299: (rallytime) ESXi Proxy minions states are located at
salt.states.esxi, not vsphere.
PR #30202: (opdude) Fixed the periodic call to beacons
PR #30303: (jacobhammons) Changed notes to indicate that functions are matched
using regular ex…
PR #30284: (terminalmage) salt.utils.gitfs: Fix Dulwich env detection and
submodule handling
PR #30280: (jfindlay) add state mocking to release notes
PR #30273: (rallytime) Back-port #30121 to 2015.8
PR #30301: (cachedout) Accept whatever comes into hightstate mock for state
tests
PR #30282: (cachedout) Fix file.append logic
PR #30289: (cro) Fix problems with targeting proxies by grains
PR #30293: (cro) Ensure we don't log stuff we shouldn't
PR #30279: (cachedout) Allow modules to be packed into boto utils
PR #30186: (rallytime) Update CLI Examples in boto_ec2 module to reflect correct
arg/kwarg positioning
PR #30156: (abednarik) Add option in file.append to ignore_whitespace.
PR #30189: (rallytime) Back-port #30185 to 2015.8
PR #30215: (jacobhammons) Assorted doc bug fixes
PR #30206: (cachedout) Revert "Fix incorrect file permissions in file.line"
PR #30190: (jacobhammons) Updated doc site banners
PR #30180: (jfindlay) modules.x509._dec2hex: add fmt index for 2.6 compat
PR #30179: (terminalmage) Backport #26962 to 2015.8 branch
PR #29693: (abednarik) Handle missing source file in ssh_auth.
PR #30155: (rallytime) Update boto_secgroup and boto_iam_role docs to only use
region OR profile
PR #30158: (rallytime) Move _option(value) calls to __salt__['config.option'] in
boto utils
PR #30160: (dmurphy18) Fix parsing disk usage for line with no number and AIX
values in Kilos
PR #30162: (rallytime) Update list_present and append grains state function docs
to be more clear.
PR #30163: (rallytime) Add warning about using "=" in file.line function
PR #30164: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #30168: (abednarik) Fix incorrect file permissions in file.line
PR #30154: (Oro) Fix file serialize on windows
PR #30144: (rallytime) Added generic ESXCLI command ability to ESXi Proxy Minion
PR #30142: (terminalmage) Fix dockerng.push, and allow for multiple images
PR #30075: (joejulian) Convert glusterfs module to use xml
PR #30129: (optix2000) Clean up _uptodate() in git state
PR #30139: (rallytime) Back-port #29589 to 2015.8
PR #30124: (abednarik) Update regex to detect ip alias in OpenBSD.
PR #30133: (stanislavb) Fix typo in gpgkey URL
PR #30126: (stanislavb) Log S3 API error message
PR #30128: (oeuftete) Log retryable transport errors as warnings
PR #30096: (cachedout) Add rm_special to crontab module
PR #30106: (techhat) Ensure last dir
PR #30101: (gtmanfred) fix bug where nova driver exits with no adminPass
PR #30090: (techhat) Add argument to isdir()
PR #30094: (rallytime) Fix doc formatting for cloud.create example in module.py
state
PR #30095: (rallytime) Add the list_nodes_select function to linode driver
PR #30082: (abednarik) Fixed saltversioninfo grain return
PR #30084: (rallytime) Back-port #29987 to 2015.8
PR #30071: (rallytime) Merge branch '2015.5' into '2015.8'
PR #30067: (ryan-lane) Pass in kwargs to boto_secgroup.convert_to_group_ids
explicitly
PR #30069: (techhat) Ensure that pki_dir exists
PR #30064: (rallytime) Add Syndic documentation to miscellaneous Salt Cloud
config options
PR #30049: (rallytime) Add some more unit tests for the vsphere execution module
PR #30060: (rallytime) Back-port #27104 to 2015.8
PR #30048: (jacobhammons) Remove internal APIs from rest_cherrypy docs.
PR #30043: (rallytime) Be explicit about importing from salt.utils.jinja to
avoid circular imports
PR #30038: (rallytime) Back-port #30017 to 2015.8
PR #30036: (rallytime) Back-port #29995 to 2015.8
PR #30035: (rallytime) Back-port #29895 to 2015.8
PR #30034: (rallytime) Back-port #29893 to 2015.8
PR #30033: (rallytime) Back-port #29876 to 2015.8
PR #30029: (terminalmage) git.latest: Fix handling of nonexistent branches
PR #30016: (anlutro) Properly normalize locales in locale.gen_locale
PR #30015: (anlutro) locale module: don't escape the slash in \n
PR #30022: (gqgunhed) Two minor typos fixed
PR #30026: (anlutro) states.at: fix wrong variable being used
PR #29966: (multani) Fix bigip state/module documentation + serializers
documentation
PR #29904: (twangboy) Improvements to osx packaging scripts
PR #29950: (multani) boto_iam: fix deletion of IAM users when using
delete_keys=true
PR #29937: (multani) Fix states.boto_iam group users
PR #29934: (multani) Fix state.boto_iam virtual name
PR #29943: (cachedout) Check args correctly in boto_rds
PR #29924: (gqgunhed) fixed: uptime now working on non-US Windows
PR #29883: (serge-p) fix for nfs mounts in _active_mounts_openbsd()
PR #29894: (techhat) Support Saltfile in SPM
PR #29856: (rallytime) Added some initial unit tests for the
salt.modules.vsphere.py file
PR #29855: (rallytime) Back-port #29740 to 2015.8
PR #29890: (multani) Various documentation fixes
PR #29850: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #29811: (anlutro) influxdb: add retention policy module functions
PR #29814: (basepi) [2015.8][Windows] Fix multi-master on windows
PR #29819: (rallytime) Add esxi module and state to docs build
PR #29832: (jleimbach) Fixed typo in order to use the keyboard module for RHEL
without systemd
PR #29803: (rallytime) Add vSphere module to doc ref module tree
PR #29767: (abednarik) Hosts file update in mod_hostname.
PR #29772: (terminalmage) pygit2: skip submodules when traversing tree
PR #29765: (gtmanfred) allow nova driver to be boot from volume
PR #29773: (l2ol33rt) Append missing wget in debian installation guide
PR #29800: (rallytime) Back-port #29769 to 2015.8
PR #29775: (paulnivin) Change listen requisite resolution from name to ID
declaration
PR #29754: (rallytime) Back-port #29719 to 2015.8
PR #29713: (The-Loeki) Pillar-based cloud providers still forcing use of
deprecated 'provider'
PR #29729: (rallytime) Further clarifications on "unless" and \ 
"onlyif"
requisites.
PR #29737: (akissa) fix pillar sqlite3 documentation examples
PR #29743: (akissa) fix pillar sqlite not honouring config options
PR #29723: (rallytime) Clarify db_user and db_password kwargs for
postgres_user.present state function
PR #29722: (rallytime) Link "stateful" kwargs to definition of what \ 
"stateful"
means for cmd state.
PR #29724: (rallytime) Add examples of using multiple matching levels to Pillar
docs
PR #29726: (cachedout) Disable some boto tests per resolution of moto issue
PR #29708: (lagesag) Fix test=True for file.directory with recurse
ignore_files/ignore_dirs.
PR #29642: (cachedout) Correctly restart deamonized minions on failure
PR #29599: (cachedout) Clean up minion shutdown
PR #29675: (clinta) allow returning all refs
PR #29683: (rallytime) Catch more specific error to pass the error message
through elegantly.
PR #29687: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #29681: (clinta) fix bare/mirror in git.latest
PR #29644: (rallytime) Fixed a couple more ESXi proxy minion bugs
PR #29645: (rallytime) Back-port #29558 to 2015.8
PR #29632: (jfindlay) reduce severity of tls module __virtual__ logging
PR #29606: (abednarik) Fixed duplicate mtu entry in RedHat 7 network
configuration.
PR #29613: (rallytime) Various ESXi Proxy Minion Bug Fixes
PR #29628: (DmitryKuzmenko) Don't create io_loop before fork
PR #29609: (basepi) [2015.8][salt-ssh] Add ability to set salt-ssh command umask
in roster
PR #29603: (basepi) Fix orchestration failure-checking
PR #29597: (terminalmage) dockerng: Prevent exception when API response contains
empty dictionary
PR #29596: (rallytime) Back-port #29587 to 2015.8
PR #29588: (rallytime) Added ESXi Proxy Minion Tutorial
PR #29572: (gtmanfred) [nova] use old discover_extensions if available
PR #29545: (terminalmage) git.latest: init submodules if not yet initialized
PR #29548: (rallytime) Back-port #29449 to 2015.8
PR #29547: (rallytime) Refactored ESXCLI-based functions to accept a list of
esxi_hosts
PR #29563: (anlutro) Fix a call to deprecated method in python-influxdb
PR #29565: (bdrung) Fix typos and missing release note
PR #29540: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #29499: (rallytime) Initial commit of ESXi Proxy Minion
PR #29526: (jfindlay) 2015.8.2 notes: add note about not being released
PR #29531: (jfindlay) grains.core: handle undefined variable
PR #29538: (basepi) [2015.8] [salt-ssh] Remove umask around actual execution for
salt-ssh
PR #29505: (rallytime) Update boto_rds state docs to include funky yaml syntax
for "tags" option.
PR #29513: (bdrung) Drop obsolete syslog.target from systemd services
PR #29500: (rallytime) Back-port #29467 to 2015.8
PR #29463: (abednarik) Add **kwargs to debconf.set.
PR #29399: (jfindlay) modules.status: add human_readable option to uptime
PR #29433: (cro) Files for building .pkg files for MacOS X
PR #29455: (jfindlay) modules.nova.__init__: do not return None
PR #29454: (jfindlay) rh_service module __virtual__ return error messages
PR #29476: (tbaker57) Doc fix - route_table_present needs subnet_names (not
subnets) as a key
PR #29487: (rallytime) Back-port #29450 to 2015.8
PR #29441: (rallytime) Make sure docs line up with blade_idrac function specs
PR #29440: (rallytime) Back-port #28925 to 2015.8
PR #29435: (galet) Grains return wrong OS version and other OS related values
for Oracle Linux
PR #29430: (rall0r) Fix host.present state limitation
PR #29417: (jacobhammons) Repo install updates
PR #29402: (techhat) Add rate limiting to linode
PR #29400: (twangboy) Fix #19332
PR #29398: (cachedout) Lint 29288
PR #29331: (DmitryKuzmenko) Bugfix - #29116 raet dns error
PR #29390: (jacobhammons) updated version numbers in documentation
PR #29381: (nmadhok) No need to deepcopy since six.iterkeys() creates a copy
PR #29349: (cro) Fix mis-setting chassis names
PR #29334: (rallytime) Back-port #29237 to 2015.8
PR #29300: (ticosax) [dockerng] Add support for volume management in dockerng
PR #29218: (clan) check service enable state in test mode
PR #29315: (jfindlay) dev tutorial doc: fix markup errors
PR #29317: (basepi) [2015.8] Merge forward from 2015.5 to 2015.8
PR #29240: (clan) handle acl_type [[d]efault:][user|group|mask|other]
PR #29305: (lorengordon) Add 'file' as a source_hash proto
PR #29272: (jfindlay) win_status module: handle 12 hour time in uptime
PR #29289: (terminalmage) file.managed: Allow local file sources to use
source_hash
PR #29264: (anlutro) Prevent ssh_auth.absent from running when test=True
PR #29277: (terminalmage) Update git_pillar runner to support new git ext_pillar
config schema
PR #29283: (cachedout) Single-quotes and use format
PR #29139: (thomaso-mirodin) [salt-ssh] Add a range roster and range targeting
options for the flat roster
PR #29282: (cachedout) dev docs: add development tutorial
PR #28994: (timcharper) add support to s3 for aws role assumption
PR #29278: (techhat) Add verify_log to SPM
PR #29067: (jacksontj) Fix infinite recursion in state compiler for prereq of
SLSs
PR #29207: (jfindlay) do not shadow ret function argument
PR #29215: (rallytime) Back-port #29192 to 2015.8
PR #29217: (clan) show duration only if state_output_profile is False
PR #29221: (ticosax) [dokcerng] Docu network mode
PR #29269: (jfindlay) win_status module: fix function names in docs
PR #29213: (rallytime) Move _wait_for_task func from vmware cloud to vmware
utils
PR #29271: (techhat) Pass full path for digest (SPM)
PR #29244: (isbm) List products consistently across all SLES systems
PR #29255: (garethgreenaway) fixes to consul module
PR #29208: (whytewolf) Glance more profile errors
PR #29200: (jfindlay) mount state: unmount by device is optional
PR #29205: (trevor-h) Fixes #29187 - using winrm on EC2
PR #29170: (cachedout) Migrate pydsl tests to integration test suite
PR #29198: (jfindlay) rh_ip module: only set the mtu once
PR #29135: (jfindlay) ssh_known_hosts.present state: catch not found exc
PR #29196: (s0undt3ch) We need novaclient imported to compare versions
PR #29059: (terminalmage) Work around upstream pygit2 bug
PR #29112: (eliasp) Prevent backtrace (KeyError) in ssh_known_hosts.present
state