Multiple execution modules read pillar without unmask=True, breaking on 3008 (gpg, pkgbuild, x509, ssh_pki, tls, oracle)

What happened?

Since 3008, pillar.get masks scalar string values by default (salt.utils.secret), and call sites that consume pillar for use (not display) must pass unmask=True. Several execution modules read pillar without it, so on 3008 they receive the redaction placeholder (**********) instead of real values and break at runtime. This is the module-side counterpart to the file-state fixes in #69709 / PR #69710, and follows the same pattern as the x509_v2._get_signing_policy fix in #69636 and the file.managed contents_pillar fix.

Affected call sites (on the 3008.x branch), all reading pillar and then using the value operationally:

• salt/modules/gpg.py -- gpg_passphrase (used to unlock the signing key; masking breaks signing/encryption)
• salt/modules/debuild_pkgbuild.py and salt/modules/rpmbuild_pkgbuild.py -- gpg_passphrase, gpg_pkg_pub_keyname, gpg_pkg_priv_keyname (package signing)
• salt/modules/x509.py -- x509_signing_policies (same class as the fixed x509_v2)
• salt/modules/ssh_pki.py -- ssh_signing_policies
• salt/modules/tls.py -- tls.extensions:* (certificate extension config)
• salt/modules/oracle.py -- oracle:dbs and related connection data

Expected behavior

Each of these reads the real pillar value, consistent with file.managed contents_pillar and x509_v2._get_signing_policy. The fix is to pass unmask=True at each genuine consumer call site (verified per site to be a runtime consumer, not a docstring example or a render-time read that is already unmasked).

Type of salt install

Official rpm

Major version

3008.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

almalinux-9

salt --versions-report output

Identified by auditing pillar.get call sites on the 3008.x branch; the masking behavior is Python-level and platform independent.

Start by reviewing the listed pillar.get call sites in salt/modules/gpg.py, debuild_pkgbuild.py, rpmbuild_pkgbuild.py, x509.py, ssh_pki.py, tls.py, and oracle.py on the 3008.x branch. Compare them with the fixes in x509_v2._get_signing_policy and file.managed contents_pillar, then verify that each operational consumer receives the real pillar value rather than the redaction placeholder.