In a Debian container, this works:

$ apt install curl gpg 
$ mkdir -m 755 -p /etc/apt/keyrings
$ curl -fsSL https://packages.broadcom.com/artifactory/api/security/keypair/SaltProjectKey/public | gpg --dearmor | tee /etc/apt/keyrings/salt-archive-keyring.pgp > /dev/null
$ curl -fsSL https://github.com/saltstack/salt-install-guide/releases/latest/download/salt.sources | tee /etc/apt/sources.list.d/salt.sources
$ apt update
$ apt install salt-common=3006.23 salt-master=3006.23

$ /opt/saltstack/salt/bin/python3.10
Python 3.10.19 (main, Feb 17 2026, 23:32:03) [GCC 11.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from salt.modules import cmdmod                                                                                                                                                                                                           
>>> 

Hint for local laptops

To test on a local laptop:

• install Salt as .deb or .rpm using the Salt packages repository
• create a venv, not from the system Python, but from the Salt Python: /opt/saltstack/salt/bin/python3.10 -m venv

Implications

If in the future, we're going to use the Salt-maintained Python installation everywhere, code should target the interpreter used by the Salt project, for example here, Python 3.10 and not for Python 3.13.

Hybrid Docker image for local CI and Jenkins

Based on those findings, I'm going to prepare a Docker image to run operations tests both locally and as Jenkins agent:

• based on nasqueron/jenkins-agent-barebone, updated to Trixie and Java 21, see D4021
• full Salt 3006 installation using the Broadcom package per the method above
• A symlink from /usr/bin/python to /opt/saltstack/salt/bin/python3

That image is called hybrid as it will maintained for two use cases to run the tests:

• as agent for our ci.nasqueron.org Jenkins installation, to run tests when we publish a change here
• locally, to run make test