# Buggy code
def dec_file(name, out=None, **kwargs):
    """
    This is a helper function to decrypt a file and return its contents.

    You can provide an optional output file using `out`

    `name` can be a local file or when not using `salt-run` can be a url like `salt://`, `https://` etc.

    CLI Examples:

    .. code-block:: bash

        salt-run nacl.dec_file name=/tmp/id_rsa.nacl
        salt-call nacl.dec_file name=salt://crt/mycert.nacl out=/tmp/id_rsa
        salt-run nacl.dec_file name=/tmp/id_rsa.nacl box_type=secretbox \
            sk_file=/etc/salt/pki/master/nacl.pub
    """
    try:
        data = __salt__["cp.get_file_str"](name)
    except Exception as e:
        # likly using salt-run so fallback to local filesystem
        with salt.utils.files.fopen(name, "rb") as f:
            data = f.read()
    d = dec(data, **kwargs)
    if out:
        if os.path.isfile(out):
            raise Exception("file:{0} already exist.".format(out))
        with salt.utils.files.fopen(out, "wb") as f:
            f.write(d)
        return "Wrote: {0}".format(out)
    return d


# Traceback (IOError)
2018-03-05 18:47:44,563 [salt.pillar                                                 :732 ][CRITICAL][339999] Rendering SLS 'common.account' failed, render error:
Traceback (most recent call last):
File "/opt/local/lib/python2.7/site-packages/salt/utils/templates.py", line 553, in py
data = mod.run()
File "/salt/pillar/common/account/init.sls", line 121, in run
'password': __salt__['shadow.gen_password'](__salt__['nacl.dec'](data=user['password'], key=nacl['db']), 'BLBnVC', 'sha256') if user['password'] else None,
File "/opt/local/lib/python2.7/site-packages/salt/modules/nacl.py", line 365, in dec
return sealedbox_decrypt(data, **kwargs)
File "/opt/local/lib/python2.7/site-packages/salt/modules/nacl.py", line 436, in sealedbox_decrypt
sk = _get_sk(**kwargs)
File "/opt/local/lib/python2.7/site-packages/salt/modules/nacl.py", line 213, in _get_sk
with salt.utils.files.fopen(sk_file, 'rb') as keyf:
File "/opt/local/lib/python2.7/site-packages/salt/utils/files.py", line 366, in fopen
f_handle = open(*args, **kwargs)  # pylint: disable=resource-leakage
IOError: [Errno 2] No such file or directory: u'/etc/salt/pki/master/nacl'

# Fixed code
def dec_file(name, out=None, **kwargs):
    """
    This is a helper function to decrypt a file and return its contents.

    You can provide an optional output file using `out`

    `name` can be a local file or when not using `salt-run` can be a url like `salt://`, `https://` etc.

    CLI Examples:

    .. code-block:: bash

        salt-run nacl.dec_file name=/tmp/id_rsa.nacl
        salt-run nacl.dec_file name=/tmp/id_rsa.nacl box_type=secretbox \
            sk_file=/etc/salt/pki/master/nacl.pub
    """
    try:
        data = __salt__["cp.get_file_str"](name)
    except Exception as e:
        # likly using salt-run so fallback to local filesystem
        with salt.utils.files.fopen(name, "rb") as f:
            data = f.read()
    d = dec(data, **kwargs)
    if out:
        if os.path.isfile(out):
            raise Exception("file:{0} already exist.".format(out))
        with salt.utils.files.fopen(out, "wb") as f:
            f.write(d)
        return "Wrote: {0}".format(out)
    return d