[Bug]: virtualenv creation failed since ensurepip is removed from salt-common

[shadow38]

What happened?

I was able to use the following command before upgrading to salt 3006.16

salt-call virtualenv.create /opt/testvenv

This command creates a virtualenv based on the python environment used by salt. Removing 'ensurepip' from salt-common packaging breaks the virtualenv creation. (cf #68330)

Now, we get this error :

salt-call virtualenv.create /opt/testvenv

[ERROR   ] Command '/opt/saltstack/salt/bin/python3.10' failed with return code: 1
[ERROR   ] stderr: Error: Command '['/opt/testvenv/bin/python3.10', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.
[ERROR   ] retcode: 1
local:
    ----------
    pid:
        15688
    retcode:
        1
    stderr:
        Error: Command '['/opt/testvenv/bin/python3.10', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

It creates a new virtualenv but pip is not installed in this context.

Workaround :

You can install python3-virtualenv package. Salt will detect virtualenv executable and use it to create the new virtualenv. The new virtualenv will use the python system environment (python 3.11 in my case) instead of the salt python environment (python 3.10)

Type of salt install

Official deb

Major version

3006.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

debian-12

salt --versions-report output

Salt Version:
          Salt: 3006.16

Python Version:
        Python: 3.10.18 (main, Sep  5 2025, 22:48:51) [GCC 11.2.0]

Dependency Versions:
          cffi: 1.14.6
      cherrypy: 18.10.0
  cryptography: 42.0.5
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: Not Installed
     gitpython: Not Installed
        Jinja2: 3.1.6
       libgit2: Not Installed
  looseversion: 1.0.2
      M2Crypto: Not Installed
          Mako: Not Installed
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     packaging: 24.0
     pycparser: 2.21
      pycrypto: Not Installed
  pycryptodome: 3.19.1
        pygit2: Not Installed
  python-gnupg: 0.4.8
        PyYAML: 6.0.1
         PyZMQ: 23.2.0
        relenv: 0.20.6
         smmap: Not Installed
       timelib: 0.3.0
       Tornado: 4.5.3
           ZMQ: 4.3.4

System Versions:
          dist: debian 12 bookworm
        locale: utf-8
       machine: x86_64
       release: 6.1.0-28-amd64
        system: Linux
       version: Debian GNU/Linux 12 bookworm

[dwoz]

We removed ensure pip due to a vulnerability reported in the version it was installing.

@twangboy maybe we can patch it instead?

[pepoluan]

My flow is also impacted by this removal of ensurepip

[pepoluan]

For my workaround, I added the following tasks:

{% if grains["saltversion"] == "3006.16" %}
{% set _pylib = "/".join(grains["saltpath"].split("/")[:-2]) %}
Python-ensurepip:
  archive.extracted:
    - name: {{ _pylib }}
    - source: salt://tar/ensurepip-cpy_3_10.tar.xz
    - user: root
    - group: root
    - if_missing: {{ _pylib }}/ensurepip/__main__.py
Python-ensurepip perms:
  file.directory:
    - name: {{ _pylib }}/ensurepip
    - user: root
    - group: root
    - dir_mode: "755"
    - file_mode: "755"
    - recurse:
      - user
      - group
      - mode
    - require:
      - archive: Python-ensurepip
{% endif %}

And then I uploaded the ensurepip-cpy_3_10.tar.xz in salt-files/tar to be pulled by 3006.16 minions.

I got the tarball by downloading upstream's Python 3.10 ensurepip module (using this tool), then creating the tarball locally.

[twangboy]

Ensurepip has been patched in relenv: saltstack/relenv#251
This PR keeps it from being removed in packaging: #68443

[dwoz]

We should ensure the virtualenv module uses the system python.

[OrangeDog]

This issue has just been included in the 3006.20 release notes, but the module doesn't use the system python.
That would be #68282

Reopening something that was already fixed and released is also pretty bad. Make a new issue (although in this case don't, because there already is one).