Support verify_options for pkg.verify

This patch adds support to `pkg.verify` for a list of `verify_options`
that modify how `rpm -V` is executed.

Fixes #33145

salt/modules/rpm.py

@@ -168,14 +168,34 @@ def verify(*packages, **kwargs):
               'g': 'ghost',
               'l': 'license',
               'r': 'readme'}
+    options_map = {
+        'nocaps': '--nocaps',
+        'nodeps': '--nodeps',
+        'nodigest': '--nodigest',
+        'nofiledigest': '--nofiledigest',
+        'nofiles': '--nofiles',
+        'nogroup': '--nogroup',
+        'nolinkto': '--nolinkto',
+        'nomode': '--nomode',
+        'nomtime': '--nomtime',
+        'nordev': '--nordev',
+        'noscripts': '--noscripts',
+        'nosignature': '--nosignature',
+        'nosize': '--nosize',
+        'nouser': '--nouser'
+    }
     ret = {}
     ignore_types = kwargs.get('ignore_types', [])
+    verify_options = kwargs.get('verify_options', [])
+    cmd = ['rpm']
+    for option in verify_options:
+        cmd.append(options_map.get(option, ''))
     if packages:
-        cmd = ['rpm', '-V']
+        cmd.append('-V')
         # Can't concatenate a tuple, must do a list.extend()
         cmd.extend(packages)
     else:
-        cmd = ['rpm', '-Va']
+        cmd.append('-Va')
     out = __salt__['cmd.run'](cmd,
                               output_loglevel='trace',
                               ignore_retcode=True,

salt/modules/yumpkg.py

@@ -1691,6 +1691,9 @@ def verify(*names, **kwargs):
 
     Runs an rpm -Va on a system, and returns the results in a dict
 
+    Pass options to modify rpm verify behavior using the ``verify_options``
+    keyword argument
+
     Files with an attribute of config, doc, ghost, license or readme in the
     package header can be ignored using the ``ignore_types`` keyword argument
 
@@ -1702,6 +1705,7 @@ def verify(*names, **kwargs):
         salt '*' pkg.verify httpd
         salt '*' pkg.verify 'httpd postfix'
         salt '*' pkg.verify 'httpd postfix' ignore_types=['config','doc']
+        salt '*' pkg.verify 'httpd postfix' verify_options=['nodeps','nosize']
     '''
     return __salt__['lowpkg.verify'](*names, **kwargs)
 

salt/states/pkg.py

@@ -294,6 +294,18 @@ def _find_install_targets(name=None,
     else:
         ignore_types = []
 
+    # Get the verify_options list if any from the pkg_verify argument
+    if isinstance(pkg_verify, list) \
+            and any(x.get('verify_options') is not None
+                    for x in pkg_verify
+                    if isinstance(x, _OrderedDict)
+                    and 'verify_options' in x):
+        verify_options = next(x.get('verify_options')
+                            for x in pkg_verify
+                            if 'verify_options' in x)
+    else:
+        verify_options = []
+
     if __grains__['os'] == 'FreeBSD':
         kwargs['with_origin'] = True
 
@@ -460,6 +472,7 @@ def _find_install_targets(name=None,
                     verify_result = __salt__['pkg.verify'](
                         key,
                         ignore_types=ignore_types,
+                        verify_options=verify_options
                     )
                     if verify_result:
                         to_reinstall[key] = val
@@ -483,7 +496,8 @@ def _find_install_targets(name=None,
             elif pkg_verify and oper == '==':
                 verify_result = __salt__['pkg.verify'](
                     key,
-                    ignore_types=ignore_types)
+                    ignore_types=ignore_types,
+                    verify_options=verify_options)
                 if verify_result:
                     to_reinstall[key] = val
                     altered_files[key] = verify_result
@@ -794,9 +808,10 @@ def installed(
         targeted for upgrade or downgrade, use pkg.verify to determine if any
         of the files installed by the package have been altered. If files have
         been altered, the reinstall option of pkg.install is used to force a
-        reinstall. Types to ignore can be passed to pkg.verify (see example
-        below). Currently, this option is supported for the following pkg
-        providers: :mod:`yumpkg <salt.modules.yumpkg>`.
+        reinstall. Types to ignore can be passed to pkg.verify. Additionally,
+        ``verify_options`` can be used to modify further the behavior of
+        pkg.verify. See examples below.  Currently, this option is supported
+        for the following pkg providers: :mod:`yumpkg <salt.modules.yumpkg>`.
 
         Examples:
 
@@ -818,6 +833,18 @@ def installed(
                 - pkg_verify:
                   - ignore_types: [config,doc]
 
+        .. code-block:: yaml
+
+            mypkgs:
+              pkg.installed:
+                - pkgs:
+                  - foo
+                  - bar: 1.2.3-4
+                  - baz
+                - pkg_verify:
+                  - ignore_types: ['config','doc']
+                  - verify_options: ['nodeps','nofiledigest']
+
     :param bool normalize:
         Normalize the package name by removing the architecture, if the
         architecture of the package is different from the architecture of the
@@ -1367,6 +1394,18 @@ def installed(
     else:
         ignore_types = []
 
+    # Get the verify_options list if any from the pkg_verify argument
+    if isinstance(pkg_verify, list) \
+            and any(x.get('verify_options') is not None
+                    for x in pkg_verify
+                    if isinstance(x, _OrderedDict)
+                    and 'verify_options' in x):
+        verify_options = next(x.get('verify_options')
+                            for x in pkg_verify
+                            if 'verify_options' in x)
+    else:
+        verify_options = []
+
     # Rerun pkg.verify for packages in to_reinstall to determine failed
     modified = []
     failed = []
@@ -1378,7 +1417,8 @@ def installed(
                 failed.append(reinstall_pkg)
         elif pkg_verify:
             verify_result = __salt__['pkg.verify'](reinstall_pkg,
-                                                   ignore_types=ignore_types)
+                                                   ignore_types=ignore_types,
+                                                   verify_options=verify_options)
             if verify_result:
                 failed.append(reinstall_pkg)
                 altered_files[reinstall_pkg] = verify_result