feat(package): use apt-pinning to pin specific package version

CODEOWNERS

@@ -0,0 +1,6 @@
+# https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+
+# FILE PATTERN                 OWNER(S)
+*                              @saltstack-formulas/wg
+salt/formulas.sls              @sticky-note @myii
+salt/pin.sls                   @hatifnatt

pillar.example

@@ -24,6 +24,10 @@ salt:
   # Optional: set salt version (if install_packages is set to true)
   version: 2017.7.2-1.el7
 
+  # Pin version provided under 'version' key by using apt-pinning
+  # available only on Debian family OS-es
+  pin_version: false
+
   # to overwrite map.jinja salt packages
   lookup:
     salt_master: 'salt-master'

salt/defaults.yaml

@@ -3,6 +3,7 @@
 ---
 salt:
   version: ''
+  pin_version: false
   py_ver: ''   ## py2 is default
   rootuser: root
   rootgroup: root

salt/master.sls

@@ -2,6 +2,11 @@
 {%- from tplroot ~ "/map.jinja" import salt_settings with context %}
 {%- from tplroot ~ "/libtofs.jinja" import files_switch with context %}
 
+{% if salt_settings.pin_version and salt_settings.version and grains.os_family|lower == 'debian' %}
+include:
+  - .pin
+{% endif %}
+
 salt-master:
 {% if salt_settings.install_packages %}
   pkg.installed:

salt/minion.sls

@@ -2,6 +2,11 @@
 {%- from tplroot ~ "/map.jinja" import salt_settings with context %}
 {%- from tplroot ~ "/libtofs.jinja" import files_switch with context %}
 
+{% if salt_settings.pin_version and salt_settings.version and grains.os_family|lower == 'debian' %}
+include:
+  - .pin
+{% endif %}
+
 {% if salt_settings.install_packages and grains.os == 'MacOS' %}
 download-salt-minion:
     {% if salt_settings.salt_minion_pkg_source %}

salt/pin.sls

@@ -0,0 +1,22 @@
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- from tplroot ~ "/map.jinja" import salt_settings with context %}
+
+{% if salt_settings.pin_version and salt_settings.version and grains.os_family|lower == 'debian' %}
+salt-pin-version:
+  file.managed:
+    - name: /etc/apt/preferences.d/salt
+    - contents: |
+        # This file managed by Salt, do not edit by hand!!
+        Package: salt*
+        Pin: version {{ salt_settings.version }}
+        Pin-Priority: 1000
+    # Order: 2 because we can't put a require_in on "pkg: salt-{master,minion}"
+    # because we don't know if they are used, and 'order: 1' already occupied by salt-pkgrepo
+    - order: 2
+
+{% elif grains.os_family|lower != 'debian' %}
+salt-pin-version:
+  test.show_notification:
+    - name: Available on Debian family OS-es only
+    - text: Apt pinning available only on Debian based distributives
+{% endif %}