Fix macOS BigSur

salt/utils/mac_utils.py

@@ -8,6 +8,7 @@
 # Import Python Libraries
 import logging
 import os
+import platform
 import plistlib
 import subprocess
 import time
@@ -513,3 +514,34 @@ def console_user(username=False):
         return pwd.getpwuid(uid)[0]
 
     return uid
+
+
+def os_version(only_major_minor=True, as_tuple=False):
+    """
+    Get the macOS version of the machine.
+
+    :param bool only_major_minor: If true returns on the major and minor
+    version of the OS (10.15). Otherwise full version 10.15.2. Defaults
+    to ``True``
+
+    :param bool as_tuple: If true will make return type a tuple otherwise
+    a string.
+
+    :return: The current os version.
+
+    :rtype: Tuple of OS version or a string of osversion.
+
+    CLI Example:
+
+    .. code-block:: bash
+
+        import salt.utils.mac_utils
+        salt.utils.mac_utils.os_version(as_tuple=True)
+    """
+    # lovingly borrowed from the munki project
+    os_version_tuple = platform.mac_ver()[0].split(".")
+    if only_major_minor:
+        os_version_tuple = os_version_tuple[0:2]
+    if as_tuple:
+        return tuple(map(int, os_version_tuple))
+    return ".".join(os_version_tuple)

salt/utils/rsax931.py

@@ -15,6 +15,7 @@
 from ctypes import c_char_p, c_int, c_void_p, cdll, create_string_buffer, pointer
 
 # Import Salt libs
+import salt.utils.mac_utils
 import salt.utils.platform
 import salt.utils.stringutils
 
@@ -30,6 +31,24 @@ def _find_libcrypto():
     """
     if sys.platform.startswith("win"):
         lib = str("libeay32")
+    elif salt.utils.platform.is_darwin():
+        # will look for several different location on the system,
+        # Search in the following order. salts pkg, homebrew, macports, finnally
+        # system.
+        # look in salts pkg install location.
+        lib = glob.glob("/opt/salt/lib/libcrypto.dylib")
+        # Find library symlinks in Homebrew locations.
+        lib = lib or glob.glob("/usr/local/opt/openssl/lib/libcrypto.dylib")
+        lib = lib or glob.glob("/usr/local/opt/openssl@*/lib/libcrypto.dylib")
+        # look in macports.
+        lib = lib or glob.glob("/opt/local/lib/libcrypto.dylib")
+        # check if 10.15, regular libcrypto.dylib is just a false pointer.
+        if salt.utils.mac_utils.os_version(as_tuple=True) == (10, 15):
+            lib = lib or glob.glob("/usr/lib/libcrypto.*.dylib")
+            lib = list(reversed(sorted(lib)))
+        # last but not least all the other macOS versions should work here.
+        # including Big Sur
+        lib = lib[0] if lib else str("/usr/lib/libcrypto.dylib")
     elif getattr(sys, "frozen", False) and salt.utils.platform.is_smartos():
         lib = glob.glob(os.path.join(os.path.dirname(sys.executable), "libcrypto.so*"))
         lib = lib[0] if lib else None
@@ -53,18 +72,6 @@ def _find_libcrypto():
                 else:
                     lib = glob.glob("/opt/freeware/lib/libcrypto.so*")
                 lib = lib[0] if lib else None
-        elif salt.utils.platform.is_darwin():
-            # Find versioned libraries in system locations, being careful
-            # to avoid the unversioned stub which is no longer permitted.
-            lib = glob.glob("/usr/lib/libcrypto.*.dylib")
-            if lib:
-                # Sort so as to prefer the newest version.
-                lib = list(reversed(sorted(lib)))
-            else:
-                # Find library symlinks in Homebrew locations.
-                lib = glob.glob("/usr/local/opt/openssl/lib/libcrypto.dylib")
-                lib = lib or glob.glob("/usr/local/opt/openssl@*/lib/libcrypto.dylib")
-            lib = lib[0] if lib else None
     if not lib:
         raise OSError("Cannot locate OpenSSL libcrypto")
     return lib

tests/unit/utils/test_mac_utils.py

@@ -7,6 +7,7 @@
 from __future__ import absolute_import, unicode_literals
 
 import os
+import platform
 import plistlib
 import xml.parsers.expat
 
@@ -168,6 +169,18 @@ def test_validate_enabled_false(self):
         """
         self.assertEqual(mac_utils.validate_enabled(False), "off")
 
+    @patch.object(platform, "mac_ver", lambda: ("10.15.5", ("", "", ""), "x86_64"))
+    def test_os_version(self):
+        """
+        test multiple outputs of os_version
+        """
+        self.assertEqual(mac_utils.os_version(), "10.15")
+        self.assertEqual(mac_utils.os_version(as_tuple=True), (10, 15))
+        self.assertEqual(mac_utils.os_version(only_major_minor=False), "10.15.5")
+        self.assertEqual(
+            mac_utils.os_version(only_major_minor=False, as_tuple=True), (10, 15, 5)
+        )
+
     def test_launchctl(self):
         """
         test launchctl function

tests/unit/utils/test_rsax931.py

@@ -174,25 +174,55 @@ def test_find_libcrypto_aix(self):
             )
 
     @skipIf(not salt.utils.platform.is_darwin(), "Host OS is not Darwin-like or macOS.")
-    def test_find_libcrypto_darwin(self):
+    @patch.object(salt.utils.mac_utils, "os_version", lambda as_tuple: (10.14))
+    @patch.object(glob, "glob", lambda _: [])
+    def test_find_libcrypto_with_system_and_not_catalina(self):
         """
-        Test _find_libcrypto on a Darwin-like or macOS host.
+        Test _find_libcrypto on a Catalina-like macOS host, simulate
+        not finding any other libcryptos and just defaulting to system.
         """
         lib_path = _find_libcrypto()
         passed = False
         for i in (
+            "/opt/salt/lib/libcrypto.dylib",
+            "/usr/local/opt/openssl/lib/libcrypto.dylib",
+            "/usr/local/opt/openssl@*/lib/libcrypto.dylib",
+            "/opt/local/lib/libcrypto.dylib",
             "/usr/lib/libcrypto.*.dylib",
+        ):
+            if fnmatch.fnmatch(lib_path, i):
+                passed = True
+                break
+        self.assertFalse(passed)
+        self.assertEqual(lib_path, "/usr/lib/libcrypto.dylib")
+
+    @skipIf(not salt.utils.platform.is_darwin(), "Host OS is not Darwin-like or macOS.")
+    @patch.object(salt.utils.mac_utils, "os_version", lambda as_tuple: (10.15))
+    def test_find_libcrypto_darwin_catalina(self):
+        """
+        Test _find_libcrypto on a Darwin-like  macOS host where there isn't a
+        lacation returned by ctypes.util.find_library()
+        """
+        lib_path = _find_libcrypto()
+        passed = False
+        for i in (
+            "/opt/salt/lib/libcrypto.dylib",
             "/usr/local/opt/openssl/lib/libcrypto.dylib",
             "/usr/local/opt/openssl@*/lib/libcrypto.dylib",
+            "/opt/local/lib/libcrypto.dylib",
+            "/usr/lib/libcrypto.*.dylib",
         ):
             if fnmatch.fnmatch(lib_path, i):
                 passed = True
                 break
         self.assertTrue(passed)
+        # we should never return the stub on catalina
+        self.assertNotEqual(lib_path, "/usr/lib/libcrypto.dylib")
 
     @patch.object(ctypes.util, "find_library", lambda a: None)
     @patch.object(glob, "glob", lambda a: [])
     @patch.object(sys, "platform", "unknown")
+    @patch.object(salt.utils.platform, "is_darwin", lambda: False)
     def test_find_libcrypto_unsupported(self):
         """
         Ensure that _find_libcrypto works correctly on an unsupported host OS.