fix(images): pin the pip installed in the salt-master image

Every image build fails since pip 26.2 was published (2026-07-29 21:57 UTC):

    TypeError: InstallRequirement.install() got an unexpected keyword
    argument 'script_executable'

Salt patches pip through relenv, and 26.2 changed the internals that patch
relies on, so the `salt-pip install` that follows the unpinned
`--upgrade pip` dies. The last green build of this branch (2026-07-28) still
installed 26.1.2, the release before that one.

Pin the upgrade to that version, declared in `versions.py` next to the other
pinned versions and passed as a build argument like `SALT_VERSION`. Keep the
upgrade itself: the pip bundled in the Salt onedir is too old to install the
dependencies below it, which is why it was added when the image moved to
`salt-pip` (7700955), losing the pin the previous pip install had.

`SALT_MASTER_BUILD_ID` goes to 2, since the image content changes.

`development/133.0` is not affected: it still installs the system pip with
its own pin, so there is nothing to merge up.

Author: ezekiel-alexrod

buildchain/buildchain/image.py

@@ -274,6 +274,7 @@ def _local_image(name: str, **kwargs: Any) -> targets.LocalImage:
             "BASE_IMAGE": versions.ROCKY_BASE_IMAGE,
             "BASE_IMAGE_SHA256": versions.ROCKY_BASE_IMAGE_9_SHA256,
             "SALT_VERSION": versions.SALT_VERSION,
+            "PIP_VERSION": versions.PIP_VERSION,
         },
     ),
     _local_image(

buildchain/buildchain/versions.py

@@ -75,6 +75,14 @@ def load_version_information() -> None:
     "e1d0a9f5ed99d52e7faf03afe7ee32e48b231c4dd9586808b3d1aedf894dff04"
 )
 
+# pip installed in the Salt onedir of the salt-master image. Pinned because
+# Salt patches pip through relenv: pip 26.2 changed the internals that patch
+# relies on, so `salt-pip install` fails with
+# `InstallRequirement.install() got an unexpected keyword argument
+# 'script_executable'`. Bump only after checking that `salt-pip` still works
+# with the Salt version above.
+PIP_VERSION: str = "26.1.2"
+
 ETCD_VERSION: str = "3.6.11"
 ETCD_IMAGE_VERSION: str = f"{ETCD_VERSION}-0"
 NGINX_IMAGE_VERSION: str = "1.31.2-alpine"
@@ -88,7 +96,7 @@ def load_version_information() -> None:
 # installed in the image needs to be updated.
 # This should be reset to 1 when the service exposed by the container changes
 # version.
-SALT_MASTER_BUILD_ID = 1
+SALT_MASTER_BUILD_ID = 2
 
 
 def _version_prefix(version: str, prefix: str = "v") -> str:

images/salt-master/Dockerfile

@@ -6,6 +6,7 @@ FROM ${BASE_IMAGE}@sha256:${BASE_IMAGE_SHA256}
 
 # Versions to use
 ARG SALT_VERSION
+ARG PIP_VERSION
 
 # Install Saltstack and other dependencies
 RUN curl -fsSL https://github.com/saltstack/salt-install-guide/releases/latest/download/salt.repo > /etc/yum.repos.d/salt.repo \
@@ -19,7 +20,11 @@ RUN curl -fsSL https://github.com/saltstack/salt-install-guide/releases/latest/d
       openssh-clients procps-ng \
       dnf \
       glibc-all-langpacks langpacks-en \
- && salt-pip install --no-cache-dir --upgrade pip \
+ # The bundled pip is too old to install the dependencies below, but the
+ # latest one cannot be used either: Salt patches pip through relenv, and
+ # pip 26.2 changed the internals that patch relies on, which breaks every
+ # later `salt-pip install`. Hence a pinned upgrade.
+ && salt-pip install --no-cache-dir --upgrade "pip==${PIP_VERSION}" \
  && salt-pip install --no-cache-dir "etcd3gw ~= 2.6.0" "kubernetes ~= 33.1.0" \
  && microdnf clean all