diff --git a/4c6d7471de.patch b/4c6d7471de.patch new file mode 100644 index 0000000..d107561 --- /dev/null +++ b/4c6d7471de.patch @@ -0,0 +1,29 @@ +From 4c6d7471dec62fb004a47a7c2164b6b5b089ac06 Mon Sep 17 00:00:00 2001 +From: Richard Si +Date: Fri, 5 Jun 2026 15:44:14 -0400 +Subject: [PATCH] Also fix user site patching in test suite + +--- + tests/lib/venv.py | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tests/lib/venv.py b/tests/lib/venv.py +index 67b01d9f31..4e86b92b3b 100644 +--- a/tests/lib/venv.py ++++ b/tests/lib/venv.py +@@ -174,11 +174,13 @@ def _customize_site(self) -> None: + site.ENABLE_USER_SITE = {self._user_site_packages} + # First, drop system-sites related paths. + original_sys_path = sys.path[:] ++ # To discover system-sites related paths, clear sys.path ++ # and build a new one with only system paths. ++ sys.path = [] + known_paths = set() + for path in site.getsitepackages(): + site.addsitedir(path, known_paths=known_paths) +- system_paths = sys.path[len(original_sys_path):] +- for path in system_paths: ++ for path in sys.path: + if path in original_sys_path: + original_sys_path.remove(path) + sys.path = original_sys_path diff --git a/6099a54ddd.patch b/6099a54ddd.patch new file mode 100644 index 0000000..0bc8ea7 --- /dev/null +++ b/6099a54ddd.patch @@ -0,0 +1,62 @@ +From 6099a54dddbfbc7fb912d53b6adad5ff6b8d1745 Mon Sep 17 00:00:00 2001 +From: Richard Si +Date: Fri, 5 Jun 2026 15:03:38 -0400 +Subject: [PATCH] Fix sitecustomize.py used for build isolation on Python 3.15+ + +The sitecustomize.py file pip uses to isolate build subprocesses from +the parent environment discovers system related paths by calling +site.addsitedir() for every system site-packages path and observing +what new entries are appended to sys.path. + +This breaks since Python 3.15b2 due to two changes: + +- site.addsitedir() won't add a path if it already exists in sys.path + +- site.addsitedir() won't re-execute .pth files if called for a known + directory (which includes the system sites because known_path is + mutated by addsitedir before it checks for .pth files) + +To cope with this, temporarily clear sys.path before using +site.addsitedir() to discover all system paths for exclusion. +--- + news/14033.bugfix.rst | 1 + + src/pip/_internal/build_env.py | 14 +++++++++----- + 2 files changed, 10 insertions(+), 5 deletions(-) + create mode 100644 news/14033.bugfix.rst + +diff --git a/news/14033.bugfix.rst b/news/14033.bugfix.rst +new file mode 100644 +index 0000000000..404196a2f0 +--- /dev/null ++++ b/news/14033.bugfix.rst +@@ -0,0 +1 @@ ++Prevent system packages from leaking into isolated build environments on Python 3.15 +diff --git a/src/pip/_internal/build_env.py b/src/pip/_internal/build_env.py +index 1a42a9d411..7639dabcad 100644 +--- a/src/pip/_internal/build_env.py ++++ b/src/pip/_internal/build_env.py +@@ -468,15 +468,19 @@ def __init__(self, installer: BuildEnvironmentInstaller) -> None: + """ + import os, site, sys + +- # First, drop system-sites related paths. ++ # First, discover all system-sites related paths. + original_sys_path = sys.path[:] ++ # Clear sys.path so addsitedir() will add system site paths and paths ++ # added by contained .pth files to sys.path reliably. This is necessary ++ # since Python 3.15, which notably no longer re-executes .pth files for ++ # known paths. ++ sys.path = [] + known_paths = set() + for path in {system_sites!r}: + site.addsitedir(path, known_paths=known_paths) +- system_paths = set( +- os.path.normcase(path) +- for path in sys.path[len(original_sys_path):] +- ) ++ system_paths = set(os.path.normcase(path) for path in sys.path) ++ ++ # Drop discovered system-sites related paths. + original_sys_path = [ + path for path in original_sys_path + if os.path.normcase(path) not in system_paths diff --git a/python-pip.spec b/python-pip.spec index c2b620d..cf3940e 100644 --- a/python-pip.spec +++ b/python-pip.spec @@ -6,7 +6,7 @@ %bcond man 1 %global srcname pip -%global base_version 26.1.1 +%global base_version 26.1.2 %global upstream_version %{base_version}%{?prerel} %global python_wheel_name %{srcname}-%{upstream_version}-py3-none-any.whl @@ -95,6 +95,18 @@ Patch: dummy-certifi.patch # We don't need a layer to check that, as we're by default in an offline environment Patch: downstream-remove-pytest-subket.patch +# Fix sitecustomize.py used for build isolation on Python 3.15+ +Patch: https://github.com/pypa/pip/commit/6099a54ddd.patch + +# Fix user-site path ordering in the test suite on Python 3.15+ +# The same CPython gh-149819 change that broke build env isolation also broke +# _customize_site() in tests/lib/venv.py: site.addsitedir() no longer +# re-appends paths already in sys.path, so the detection of system-site paths +# produces an empty list and user site ends up after venv site-packages instead +# of before it, causing user-site install/uninstall tests to operate on the +# wrong installation. +Patch: https://github.com/pypa/pip/commit/4c6d7471de.patch + # Remove -s from Python shebang - ensure that packages installed with pip # to user locations are seen by pip itself %undefine _py3_shebang_s @@ -309,9 +321,8 @@ grep "pem$" %{pyproject_files} && exit 1 || true pytest_k='not completion' # this clashes with our PYTHONPATH pytest_k="$pytest_k and not environments_with_no_pip" -# this seems to require internet (despite no network marker) -# added in https://github.com/pypa/pip/pull/13378 TODO drop this in the next release -pytest_k="$pytest_k and not test_prompt_for_keyring_if_needed and not test_double_install_fail and not test_install_sdist_links and not test_lock_vcs and not test_lock_archive and not test_backend_sees_config_via_sdist" +# this requires internet without the keyring local wheel +pytest_k="$pytest_k and not test_prompt_for_keyring_if_needed" # this cannot import breezy, TODO investigate pytest_k="$pytest_k and not (functional and bazaar)" # failures to investigate diff --git a/sources b/sources index a50ad4c..786a390 100644 --- a/sources +++ b/sources @@ -1,4 +1,4 @@ SHA512 (setuptools-79.0.1-py3-none-any.whl) = fef6cfc6f95a5bb7320f1680e1c665cb8d9a4e4227cde4d8aab8a50bed4bcf04320085b9d7d5343359f887008db5c5a861e57f3d08b7b0b2311a28adaeee6b4a SHA512 (flit_core-3.12.0-py3-none-any.whl) = 790c12b1f43201e365fb3f8f2f0a54e1a578876799dfdf8bfeea679a25ea096bf62946d006618c1458ae6e37ce6d00998f37e9aba426d5ab80d32ef2d75da4e0 -SHA512 (pip-26.1.1.tar.gz) = 777fab14b5e7e7edeffbc7ae86f4e6061e9f7cf43adcaebcb4d099c184c4f2ad6a63019a70d95b98b631821c3472713c9545fb8d65b684da67cfc31ee9293054 +SHA512 (pip-26.1.2.tar.gz) = e29c98a7da5e329183b7eef86a66f9d6c3473051f64aa6e762714306148547eb0de4220824484071822a9a62bd01a62a09ab16bba4c26e4b847bfc2609728608 SHA512 (coverage-0-py3-none-any.whl) = e734192565347010efe68f8ba600254259c9b647f3c553fd4e5d87b1d7f955cb15d6f7d807716f4a6415d239beed945fbec7210feaf502e9cc849c332845926e