From 1f718c4ae46cb787171b81a3044e22a5491b7919 Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <dan.woz@gmail.com>
Date: Wed, 17 Jun 2026 04:08:36 -0700
Subject: [PATCH 1/2] Fix NotADirectoryError in tools/pkg/build.py salt_onedir

Commit 9c268db94d2 added a `git add -f salt/_version.txt` invocation
inside `salt_onedir` with `cwd=str(salt_archive)`, but `salt_archive`
is a path to a `.tar.gz` file, not a directory.  Python's subprocess
implementation calls `chdir()` on `cwd` and raises:

    NotADirectoryError: [Errno 20] Not a directory:
    '/.../salt-3008.0+NNN.gSHA.tar.gz'

This blocks the Build Salt Onedir job on Linux and macOS for every
master PR.  The Windows path takes a different branch
(`pkg\\windows\\install_salt.cmd`) and is unaffected.

The `salt_onedir` step runs in the salt source checkout (the CI
working tree), which is a real git repository containing
`salt/_version.txt`, so dropping the `cwd=` argument lets the
subprocess inherit that directory and the `git add` works as the
original commit intended.

Reproducer:

    import subprocess
    subprocess.run(['echo', 'x'], cwd='/tmp/anything.tar.gz')
    # NotADirectoryError: [Errno 20] Not a directory: '/tmp/anything.tar.gz'

Fixes #69461
Refs 9c268db94d2
---
 changelog/69461.fixed.md | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 changelog/69461.fixed.md

diff --git a/changelog/69461.fixed.md b/changelog/69461.fixed.md
new file mode 100644
index 000000000000..c9bc78327b64
--- /dev/null
+++ b/changelog/69461.fixed.md
@@ -0,0 +1,4 @@
+Fix ``NotADirectoryError`` in ``tools/pkg/build.py`` ``salt_onedir`` by no
+longer passing the source tarball path as the ``cwd=`` of the
+``git add -f salt/_version.txt`` subprocess; the command now runs in the
+salt source checkout (a real git working tree) as intended.

From c7aede9bb1d6a8f2ae4dd12485aebe8fd8b707ec Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <daniel.wozniak@broadcom.com>
Date: Sat, 20 Jun 2026 17:46:09 -0700
Subject: [PATCH 2/2] Fix file.managed error prefix and redact basic-auth in
 source_hash errors

Forward-port from 3008.x commit 3fafbbec30d to master:

- salt/states/file.py: prefix the early `_error()` return in
  `file.managed` with "Unable to manage file:" so callers and tests can
  reliably distinguish the manage-file failure path from other state
  errors. Restores the assertion checked by
  tests/pytests/functional/states/file/test_managed.py::test_issue_60203,
  which is failing across every functional-zeromq-3 chunk on master.

- salt/modules/file.py: route the `source_hash` value through
  `salt.utils.url.redact_http_basic_auth()` in both the "format is
  invalid" and "Source hash file not found" error paths of
  `get_source_sum()` so HTTP basic-auth credentials are not leaked into
  state comments or logs when the source hash URI is malformed or
  unreachable.
---
 changelog/69402.fixed.md | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 changelog/69402.fixed.md

diff --git a/changelog/69402.fixed.md b/changelog/69402.fixed.md
new file mode 100644
index 000000000000..c703f49ee586
--- /dev/null
+++ b/changelog/69402.fixed.md
@@ -0,0 +1,4 @@
+Prefix ``file.managed`` error comments with ``Unable to manage file:`` and
+redact HTTP basic-auth credentials from ``Source hash`` error messages in
+``salt.modules.file.get_source_sum`` so they are not leaked in state output
+or logs.