Align sshresource_state with upstream relenv improvements

The salt-ssh relenv work merged into master introduced three changes that
required corresponding updates in our SSH resource module:
1. Single.cmd_block() now calls mod_data(self.fsclient) unconditionally to
   regenerate extension modules before every remote execution.  Passing
   fsclient=None (the default) crashes immediately at fsclient.opts.
   _exec_state_pkg() now creates a fresh FSClient from the cached master
   opts and passes it via the fsclient= kwarg to Single.
2. Single.__init__ renames thin_dir from the default *_salt suffix to
   *_salt_relenv when relenv=True, then writes the updated path back into
   opts["thin_dir"].  The previous code built the state.pkg argv string
   before constructing Single, so the baked-in path diverged from where
   the state tar was actually sent.  The argv is now set after __init__
   so both the send path and the command string use the finalized
   thin_dir.
3. _relenv_path() hardcoded linux/x86_64, which would silently deploy the
   wrong tarball to arm64 hosts.  It now probes x86_64 then arm64 and
   returns the first path that exists locally, or None.  A None return
   tells Single.__init__ to call detect_os_arch() itself — one extra SSH
   round-trip as a fallback, but always correct.
Also removes the leftover debug echo from SSH_SH_SHIM_RELENV that was
writing SALT_CALL_CMD diagnostics to stderr on every remote execution.
Tests added: TestRelenvPath (4 cases), fsclient mock added to all
_exec_state_pkg test helpers, and test_single_receives_fsclient verifies
the kwarg is threaded through.

Author: dwoz

salt/client/ssh/__init__.py

@@ -277,9 +277,6 @@
 echo "{RSTR}"
 echo "{RSTR}" >&2
 
-# Debug: Show the actual command being executed
-echo "SALT_CALL_CMD: $SALT_CALL_BIN --retcode-passthrough --local --metadata --out=json -lquiet -c {THIN_DIR} -- {ARGS}" >&2
-
 exec $SUDO "$SALT_CALL_BIN" --retcode-passthrough --local --metadata --out=json -lquiet -c "{THIN_DIR}" -- {ARGS}
 EOF
 """.split(

salt/modules/sshresource_state.py

@@ -75,9 +75,21 @@ def _host_cfg():
 
 
 def _relenv_path():
-    """Return the local path of our pre-built custom relenv tarball."""
+    """
+    Return the path to a pre-built relenv tarball if one exists locally, otherwise
+    return ``None`` to let ``Single.__init__`` detect the remote arch and download
+    the correct tarball itself.
+
+    The tarball is generated by ``salt.utils.relenv.gen_relenv``, which normalises
+    the arch to ``x86_64`` or ``arm64`` before building the cache path, so the
+    lookup uses those canonical names.
+    """
     cachedir = __opts__.get("cachedir", "")  # pylint: disable=undefined-variable
-    return os.path.join(cachedir, "relenv", "linux", "x86_64", "salt-relenv.tar.xz")
+    for arch in ("x86_64", "arm64"):
+        path = os.path.join(cachedir, "relenv", "linux", arch, "salt-relenv.tar.xz")
+        if os.path.exists(path):
+            return path
+    return None
 
 
 def _target_opts():
@@ -429,23 +441,33 @@ def _exec_state_pkg(opts, trans_tar, test):
 
     Returns the state result dict directly (what the minion dispatcher
     expects) rather than the full ``{"local": {"return": ...}}`` envelope.
+
+    A fresh file client is created here so that ``Single.cmd_block()`` can call
+    ``mod_data(fsclient)`` to scan for extension modules.  (``cmd_block`` was
+    updated in the relenv improvements merge to regenerate ext-mods before every
+    remote execution.)
     """
+    fsclient = _file_client()
     try:
         trans_tar_sum = salt.utils.hashutils.get_hash(trans_tar, opts["hash_type"])
-        cmd = "state.pkg {thin_dir}/salt_state.tgz test={test} pkg_sum={pkg_sum} hash_type={hash_type}".format(
-            thin_dir=opts["thin_dir"],
-            test=test,
-            pkg_sum=trans_tar_sum,
-            hash_type=opts["hash_type"],
-        )
         single = salt.client.ssh.Single(
             opts,
-            cmd,
+            "state.pkg",  # placeholder; argv is updated after __init__ rewrites thin_dir
             _resource_id(),
             thin=_relenv_path(),
             thin_dir=opts["thin_dir"],
+            fsclient=fsclient,
             **_connection_kwargs(),
         )
+        # Single.__init__ may rename thin_dir (e.g. _salt → _salt_relenv) and
+        # writes the result back into opts["thin_dir"].  Build the real argv only now.
+        cmd = "state.pkg {thin_dir}/salt_state.tgz test={test} pkg_sum={pkg_sum} hash_type={hash_type}".format(
+            thin_dir=opts["thin_dir"],
+            test=test,
+            pkg_sum=trans_tar_sum,
+            hash_type=opts["hash_type"],
+        )
+        single.argv = [cmd]
         single.shell.send(trans_tar, "{}/salt_state.tgz".format(opts["thin_dir"]))
         stdout, stderr, retcode = single.cmd_block()
     finally:

tests/pytests/unit/modules/test_sshresource_state.py

@@ -42,6 +42,44 @@
 _BASE_RESOURCE = {"id": _RESOURCE_ID, "type": "ssh"}
 
 
+# ---------------------------------------------------------------------------
+# _relenv_path(): returns tarball or None
+# ---------------------------------------------------------------------------
+
+
+class TestRelenvPath:
+    """_relenv_path() returns the first existing tarball or None."""
+
+    def _run(self, existing_files=()):
+        import salt.modules.sshresource_state as mod
+
+        opts = _BASE_OPTS.copy()
+        with patch.object(mod, "__opts__", opts, create=True), patch.object(
+            mod, "__resource__", dict(_BASE_RESOURCE), create=True
+        ), patch.object(mod, "__context__", {}, create=True), patch.object(
+            mod, "__salt__", {}, create=True
+        ), patch(
+            "os.path.exists", side_effect=lambda p: p in existing_files
+        ):
+            return mod._relenv_path()
+
+    def test_returns_x86_64_when_present(self):
+        path = "/tmp/relenv/linux/x86_64/salt-relenv.tar.xz"
+        assert self._run(existing_files=(path,)) == path
+
+    def test_returns_arm64_when_present(self):
+        path = "/tmp/relenv/linux/arm64/salt-relenv.tar.xz"
+        assert self._run(existing_files=(path,)) == path
+
+    def test_returns_none_when_no_tarball(self):
+        assert self._run(existing_files=()) is None
+
+    def test_prefers_x86_64_over_arm64(self):
+        x86 = "/tmp/relenv/linux/x86_64/salt-relenv.tar.xz"
+        arm = "/tmp/relenv/linux/arm64/salt-relenv.tar.xz"
+        assert self._run(existing_files=(x86, arm)) == x86
+
+
 def _make_ssh_error(parsed):
     """Build a fake SSHCommandExecutionError with .parsed attribute."""
     import salt.client.ssh.wrapper
@@ -139,6 +177,8 @@ def _run(self, exc_parsed):
             mod, "_resource_id", return_value=_RESOURCE_ID
         ), patch.object(
             mod, "_relenv_path", return_value="/tmp/relenv.tar.xz"
+        ), patch.object(
+            mod, "_file_client", return_value=MagicMock()
         ), patch.object(
             mod, "_connection_kwargs", return_value={}
         ), patch(
@@ -200,6 +240,8 @@ def test_reraises_when_parsed_is_none(self):
             mod, "_resource_id", return_value=_RESOURCE_ID
         ), patch.object(
             mod, "_relenv_path", return_value="/tmp/relenv.tar.xz"
+        ), patch.object(
+            mod, "_file_client", return_value=MagicMock()
         ), patch.object(
             mod, "_connection_kwargs", return_value={}
         ), patch(
@@ -242,6 +284,8 @@ def _run(self, envelope):
             mod, "_resource_id", return_value=_RESOURCE_ID
         ), patch.object(
             mod, "_relenv_path", return_value="/tmp/relenv.tar.xz"
+        ), patch.object(
+            mod, "_file_client", return_value=MagicMock()
         ), patch.object(
             mod, "_connection_kwargs", return_value={}
         ), patch(
@@ -276,3 +320,42 @@ def test_zero_retcode_does_not_set_context_retcode(self):
         envelope = {"return": _VALID_STATE_RETURN, "retcode": 0}
         _, context = self._run(envelope)
         assert context.get("retcode", 0) == 0
+
+    def test_single_receives_fsclient(self):
+        """Single must be constructed with a fsclient so cmd_block can call mod_data."""
+        import salt.modules.sshresource_state as mod
+
+        opts = _BASE_OPTS.copy()
+        mock_fsclient = MagicMock()
+
+        with patch.object(mod, "__opts__", opts, create=True), patch.object(
+            mod, "__resource__", dict(_BASE_RESOURCE), create=True
+        ), patch.object(mod, "__context__", {}, create=True), patch.object(
+            mod, "__salt__", {}, create=True
+        ), patch.object(
+            mod, "_resource_id", return_value=_RESOURCE_ID
+        ), patch.object(
+            mod, "_relenv_path", return_value="/tmp/relenv.tar.xz"
+        ), patch.object(
+            mod, "_file_client", return_value=mock_fsclient
+        ), patch.object(
+            mod, "_connection_kwargs", return_value={}
+        ), patch(
+            "salt.utils.hashutils.get_hash", return_value="abc123"
+        ), patch(
+            "os.remove"
+        ), patch(
+            "salt.client.ssh.Single"
+        ) as mock_single_cls, patch(
+            "salt.client.ssh.wrapper.parse_ret",
+            return_value={"return": _VALID_STATE_RETURN, "retcode": 0},
+        ):
+            mock_single = MagicMock()
+            mock_single.cmd_block.return_value = ("", "", 0)
+            mock_single.shell = MagicMock()
+            mock_single_cls.return_value = mock_single
+
+            mod._exec_state_pkg(opts, "/tmp/fake.tgz", False)
+
+            _, kwargs = mock_single_cls.call_args
+            assert kwargs.get("fsclient") is mock_fsclient