Make pass renderer configurable & other fixes

What does this PR do?

The pass renderer becomes configurable. Also several issues in the code have been fixed.

Previous Behavior

No changes to the existing behavior, new features must be explicitly enabled.

New Behavior

Config option pass_variable_prefix allows to distinguish variables that contain paths to pass secrets. Config option pass_strict_fetch allows to error out when a secret cannot be fetched from pass. Config option pass_dir allows setting the PASSWORD_STORE_DIR env for pass. Config option pass_gnupghome allows setting the $GNUPGHOME env for pass. Pass executable path from _get_path_exec() is used when calling the program. The $HOME env is no longer modified globally. Only trailing newlines are stripped from the fetched secret. Pass process arguments are handled in a secure way.

Merge requirements satisfied?

[NOTICE] Bug fixes or features added to Salt require tests.

• [X] Docs
• [X] Changelog - https://docs.saltproject.io/en/master/topics/development/changelog.html
• [X] Tests written/updated

Commits signed with GPG?

No

Please review Salt's Contributing Guide for best practices.

See GitHub's page on GPG signing for more information about signing commits with GPG.

(BTW: the failing test does look related to the changes in this PR)

You mean this one? https://jenkins.saltproject.io/job/pr-macosx-catalina-x86_64-py3-pytest/job/PR-62120/6/ That failed in the tests.unit.utils.test_verify.TestVerify.test_max_open_files test - which is most likely unrelated.

@dmach sorry I meant it does not look related :sweat_smile: . Thanks!

@meaksh @krionbsd Is there something I can do to move this forward?

@Ch3LL any chance to have a review of this one? Thanks in advance!

lint and pre-commit are failing. Once you get that fixed up we can get this one merged in.

lint and pre-commit are failing. Once you get that fixed up we can get this one merged in.

Fixed (I hope). Other 2 tests are failing now, but I don't think they're related.

For some reason I cannot update the branch. Can you rebase and push? We shouldn't be seeing those test issues so lets re-base and start them again. thanks

For some reason I cannot update the branch. Can you rebase and push? We shouldn't be seeing those test issues so lets re-base and start them again. thanks

Done via GitHub webui. I was also quite surprised seeing the test issues. Looks like a caching problem to me - jenkins did not know about the commit I just pushed.

Congratulations on your first PR being merged! :tada: