certutil.add_store with salt:// URL doesn't respect saltenv

Description

In my state file, I have:

# mystate.sls
Install cert:
  certutil.add_store:
    - name: salt://mycert.cer
    - store: TrustedPublisher

My master file_roots are set up in production and staging environments --- so no base environment is present:

# top.sls
file_roots:
  production:
    - /srv/salt/production/states
  staging:
    - /srv/salt/staging/states

My minion is set up to have saltenv: production and pillarenv: production (minion config), so it should always try to fetch things from the production environment. This works fine for pretty much everything as far as I can see --- except for the above state involving certutil.add_store.

In my minion debug log, I see this:

[INFO    ] Executing state certutil.add_store for [salt://mycert.cer]
[DEBUG   ] LazyLoaded cp.cache_file
[DEBUG   ] Initializing new AsyncZeroMQReqChannel for ('c:\\salt\\conf\\pki\\minion', 'REDACTED', 'tcp://REDACTED', 'aes')
...
[DEBUG   ] Could not find file 'salt://mycert.cer' in saltenv 'base'
[ERROR   ] Unable to cache file 'salt://mycert.cer' from saltenv 'base'.
[ERROR   ] Certificate file not found.

So it seems that this specific module does not respect saltenv somehow, and I have to explicitly add a ?saltenv=... query parameter to fix this?

Interestingly, other states are fine, and fetch their files correctly.

Expected behavior

certutil.add_store should fetch files from the currently pinned environment.

Versions Report

Salt Version:
           Salt: 3000.3
 
Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.6.1
      docker-py: Not Installed
          gitdb: 2.0.3
      gitpython: 2.1.8
         Jinja2: 2.10
        libgit2: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 3.6.9 (default, Apr 18 2020, 01:56:04)
   python-gnupg: 0.4.1
         PyYAML: 3.12
          PyZMQ: 16.0.2
          smmap: 2.0.3
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.2.5
 
System Versions:
           dist: Ubuntu 18.04 bionic
         locale: UTF-8
        machine: x86_64
        release: 4.15.0-1065-aws
         system: Linux
        version: Ubuntu 18.04 bionic

Salt Version:
           Salt: 3000.3

Dependency Versions:
           cffi: 1.12.2
       cherrypy: 17.4.1
       dateutil: 2.8.0
      docker-py: Not Installed
          gitdb: 2.0.5
      gitpython: Not Installed
         Jinja2: 2.10.1
        libgit2: Not Installed
       M2Crypto: Not Installed
           Mako: 1.0.7
   msgpack-pure: Not Installed
 msgpack-python: 0.5.6
   mysql-python: Not Installed
      pycparser: 2.19
       pycrypto: Not Installed
   pycryptodome: 3.8.1
         pygit2: Not Installed
         Python: 3.5.4 (v3.5.4:3f56838, Aug  8 2017, 02:17:05) [MSC v.1900 64 bit (AMD64)]
   python-gnupg: 0.4.4
         PyYAML: 5.1.2
          PyZMQ: 18.0.1
          smmap: 2.0.5
        timelib: 0.2.4
        Tornado: 4.5.3
            ZMQ: 4.3.1

System Versions:
           dist:
         locale: cp1252
        machine: AMD64
        release: 2019
         system: Windows
        version: 2019 10.0.17763 SP0 Multiprocessor Free

Workaround

Make the state file look like this:

# mystate.sls
Install cert:
  certutil.add_store:
    - name: salt://mycert.cer?saltenv={{ saltenv }}   # <-- Add query param with current saltenv
    - store: TrustedPublisher

Start at the certutil.add_store state entry point and reproduce the supplied state with production and staging file roots, checking how the salt:// URL selects saltenv. Compare its behavior with other states that fetch files and add a regression test showing that the pinned environment is used without an explicit query parameter.