Ubuntu 26.04.1 & Salt 3008.2: [Bug]: salt-key / salt-call return different minion key fingerprints

[elwrokid]

Hello,

Since Ubuntu 26.04 is not listed as supported OS, I am starting a discussion.

tl;dr salt-key -f <minion> on the master and salt-call --local key.finger on a minion return different fingerprints which is a regression from 3007.

salt-key -f <minion> does not calculate the fingerprint of the key correctly. Based on the calculated hash in the output, It simply does an equivalent of sha256sum /etc/salt/pki/master/minions/<minion> file, which is not the fingerprint of the actual key.

I have compared /etc/salt/pki/master/minions/<minion> on the master with /etc/salt/pki/minion/minion.pub on the minion. The files are different, the former has an empty line at the end (outside the PEM key block). However, the actual keys in both files are identical. In other words, the extra line is after the END PUBLIC KEY marker and should never be considered while fingerprinting the key. This is precisely why calculating a hash of a file is incorrect.

I have done more checks:

sed -n '/BEGIN PUBLIC KEY/,/END PUBLIC KEY/{ 
  /BEGIN PUBLIC KEY/d
  /END PUBLIC KEY/d
  s/[[:space:]]//g
  p
}' /etc/salt/pki/minion/minion.pub | base64 -d | sha256sum

and

sed -n '/BEGIN PUBLIC KEY/,/END PUBLIC KEY/{ 
  /BEGIN PUBLIC KEY/d
  /END PUBLIC KEY/d
  s/[[:space:]]//g
  p
}' /etc/salt/pki/master/minions/<minion> | base64 -d | sha256sum

produce the same result. And so do:

openssl pkey -pubin -in /etc/salt/pki/minion/minion.pub -outform DER | sha256sum

and

openssl pkey -pubin -in /etc/salt/pki/master/minions/<minion> -outform DER | sha256sum

I think this problem is with salt-key specifically. When I accept the key, the communication between master and minion is as expected.

salt-key with --log-level=garbage returns:

[DEBUG   ] The functions from module 'localfs_key' are being loaded by dir() on the loaded module
[DEBUG   ] LazyLoaded localfs_key.list_all
[DEBUG   ] The functions from module 'key' are being loaded by dir() on the loaded module
[DEBUG   ] LazyLoaded key.output
[TRACE   ] data = {'minions': {'REDACTED': 'RE:DA:CT:ED'}}

which, again, leads to conclusion that the defect has been introduced in 3008:

https://docs.saltproject.io/en/3008/ref/cache/all/salt.cache.localfs_key.html

I suspect this new bit simply passes the contents of the key files to key module, while there should be some trimming or data sanitization going on, or just different parsing to extract only the relevant key data.

Version information:

master# salt --versions-report
Salt Version:
          Salt: 3008.2
 
Python Version:
        Python: 3.14.6 (main, Jun 11 2026, 02:19:05) [GCC 11.2.0]
 
Dependency Versions:
          cffi: 2.0.0
      cherrypy: 18.10.0
  cryptography: 48.0.0
      dateutil: 2.9.0.post0
     docker-py: Not Installed
         gitdb: 4.0.12
     gitpython: 3.1.50
        Jinja2: 3.1.6
       libgit2: Not Installed
  looseversion: 1.3.0
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.1.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 24.0
     pycparser: 3.00
      pycrypto: Not Installed
  pycryptodome: 3.23.0
        pygit2: Not Installed
  python-gnupg: 0.5.6
        PyYAML: 6.0.3
         PyZMQ: 27.1.0
        relenv: 0.22.14
         smmap: 5.0.2
       timelib: 0.3.0
       Tornado: 6.5.7
           ZMQ: 4.3.5
 
Salt Package Information:
  Package Type: onedir
 
System Versions:
          dist: ubuntu 26.04.1 resolute
        locale: utf-8
       machine: x86_64
       release: 7.0.0-31-generic
        system: Linux
       version: Ubuntu 26.04.1 resolute

master# salt-key --version
salt-key 3008.2 (Argon)

minion# salt-call --version
salt-call 3008.2 (Argon)

I am installing from the official DEBs.

Kind regards,

Elwrokid