From 81c1d8362d8e5c09089ec77c671e31aef7f39642 Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 13 Mar 2026 15:09:37 -0400 Subject: [PATCH] Fix pcap migration to strip yaml document end marker from so-yaml output --- salt/manager/tools/sbin/soup | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/salt/manager/tools/sbin/soup b/salt/manager/tools/sbin/soup index 16fb9e669..60d0a9bda 100755 --- a/salt/manager/tools/sbin/soup +++ b/salt/manager/tools/sbin/soup @@ -396,7 +396,7 @@ migrate_pcap_to_suricata() { for pillar_file in "$PCAPFILE" "$MINIONDIR"/*.sls; do [[ -f "$pillar_file" ]] || continue - pcap_enabled=$(so-yaml.py get "$pillar_file" pcap.enabled 2>/dev/null) || continue + pcap_enabled=$(so-yaml.py get "$pillar_file" pcap.enabled 2>/dev/null | head -1) || continue so-yaml.py add "$pillar_file" suricata.pcap.enabled "$pcap_enabled" so-yaml.py remove "$pillar_file" pcap done