Incorporate the pyenv-link plugin (#3538)

for use in linking binary installations

.github/actions/build-python/action.yml

@@ -0,0 +1,44 @@
+name: Build a Python version
+description: >
+  Install python-build's system dependencies for the current runner's OS, build
+  and check the requested version.
+inputs:
+  python-version:
+    description: A version as accepted by `pyenv install`.
+    required: true
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        #envvars
+        export PYENV_ROOT="$GITHUB_WORKSPACE"
+        echo "PYENV_ROOT=$PYENV_ROOT" >> $GITHUB_ENV
+        echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
+    # The two OSes differ only in this step.
+    - if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        #prerequisites
+        brew install openssl readline sqlite3 xz tcl-tk@8 libb2 zstd
+    - if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        #prerequisites
+        pyenv install-prerequisites
+    - shell: bash
+      run: |
+        #build
+        pyenv --debug install ${{ inputs.python-version }} && rc=$? || rc=$?
+        if [[ $rc -ne 0 ]]; then echo config.log:; cat "${TMPDIR:-/tmp}"/python-build*/*/config.log; false; fi
+        pyenv global ${{ inputs.python-version }}
+        pyenv rehash
+    - shell: bash
+      run: |
+        #print version
+        python --version
+        python -m pip --version
+    - shell: python  # Prove that actual Python == expected Python
+      env:
+        EXPECTED_PYTHON: ${{ inputs.python-version }}
+      run: import os, sys ; assert sys.version.startswith(os.getenv("EXPECTED_PYTHON"))

.github/workflows/build.yml

@@ -0,0 +1,62 @@
+name: build
+on:
+  push:
+    branches: [master]
+  pull_request: {}
+
+permissions:
+  contents: read
+
+jobs:
+  discover_build_logic_change:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-slim
+    env:
+      FULL_OS_MATRIX: '[
+        "macos-14",
+        "macos-15",
+        "macos-15-intel",
+        "macos-26",
+        "macos-26-intel",
+        "ubuntu-22.04",
+        "ubuntu-22.04-arm",
+        "ubuntu-24.04",
+        "ubuntu-24.04-arm"
+      ]'
+    outputs:
+      os: ${{ steps.detect.outputs.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - run: git fetch origin "$GITHUB_BASE_REF"
+      - id: detect
+        shell: bash
+        run: |
+          if [[ -n $(git diff --name-only "origin/$GITHUB_BASE_REF" -- \
+                       plugins/python-build/bin/python-build \
+                       .github/actions/build-python/action.yml \
+                       .github/workflows/build.yml) ]]
+          then
+            printf "%s\n" "os<<!" "$FULL_OS_MATRIX" "!" >> "$GITHUB_OUTPUT"
+          fi
+
+  build:
+    needs: discover_build_logic_change
+    # Run when the detection job succeeded *or was skipped* -- but not failed
+    if: ${{ !cancelled() && !failure() }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJson(needs.discover_build_logic_change.outputs.os || '["macos-latest","ubuntu-latest"]') }}
+        python-version:
+          - "3.10"
+          - "3.11"
+          - "3.12"
+          - "3.13"
+          - "3.14"
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: ./.github/actions/build-python
+        with:
+          python-version: ${{ matrix.python-version }}
+

.github/workflows/macos_build.yml

@@ -1,43 +0,0 @@
-name: macos_build
-on:
-  push:
-    branches: [master]
-  pull_request: {}
-
-permissions:
-  contents: read  #  to fetch code (actions/checkout)
-
-jobs:
-  macos_build:
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version:
-          - "3.10"
-          - "3.11"
-          - "3.12"
-          - "3.13"
-          - "3.14"
-    runs-on: macos-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: |
-          brew install openssl readline sqlite3 xz tcl-tk@8 libb2 zstd
-      - run: |
-          #envvars
-          export PYENV_ROOT="$GITHUB_WORKSPACE"
-          echo "PYENV_ROOT=$PYENV_ROOT" >> $GITHUB_ENV
-          echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
-      - run: |
-          #build
-          pyenv --debug install ${{ matrix.python-version }} && rc=$? || rc=$?
-          if [[ $rc -ne 0 ]]; then echo config.log:; cat $TMPDIR/python-build*/*/config.log; false; fi
-          pyenv global ${{ matrix.python-version }}
-      - run: |
-          #print version
-          python --version
-          python -m pip --version
-      - shell: python  # Prove that actual Python == expected Python
-        env:
-          EXPECTED_PYTHON: ${{ matrix.python-version }}
-        run: import os, sys ; assert sys.version.startswith(os.getenv("EXPECTED_PYTHON"))

.github/workflows/modified_scripts_build.yml

@@ -220,10 +220,7 @@ jobs:
           echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
       - run: |
           #prerequisites
-          sudo apt-get update -q; sudo apt-get install -yq make build-essential \
-            libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev \
-            curl llvm libncurses5-dev libncursesw5-dev \
-            xz-utils tk-dev libffi-dev liblzma-dev
+          pyenv install-prerequisites
           if [[ "${{ matrix.python-version }}" =~ pypy.*-(src|dev) ]]; then
             export PYENV_BOOTSTRAP_VERSION=pypy2.7-7
             echo "PYENV_BOOTSTRAP_VERSION=$PYENV_BOOTSTRAP_VERSION" >> $GITHUB_ENV
@@ -283,10 +280,7 @@ jobs:
           echo "_PYTHON_BUILD_FORCE_SKIP_XZ=1" >> $GITHUB_ENV
       - run: |
           #prerequisites
-          sudo apt-get update -q; sudo apt-get install -yq make build-essential \
-            libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev \
-            curl libncursesw5-dev \
-            xz-utils tk-dev libffi-dev liblzma-dev
+          pyenv install-prerequisites
       - run: |
           #build
           pyenv --debug install ${{ matrix.python-version }} && rc=$? || rc=$?

.github/workflows/ubuntu_build.yml

@@ -1,43 +0,0 @@
-name: ubuntu_build
-on:
-  push:
-    branches: [master]
-  pull_request: {}
-
-permissions:
-  contents: read  #  to fetch code (actions/checkout)
-
-jobs:
-  ubuntu_build:
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version:
-          - "3.10"
-          - "3.11"
-          - "3.12"
-          - "3.13"
-          - "3.14"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: |
-          sudo apt-get update -q; sudo apt install -yq make build-essential libssl-dev zlib1g-dev \
-          libbz2-dev libreadline-dev libsqlite3-dev curl \
-          libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev
-      # https://github.com/pyenv/pyenv#installation
-      - run: pwd
-      - env:
-          PYENV_ROOT: /home/runner/work/pyenv/pyenv
-        run: |
-          echo $PYENV_ROOT
-          echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
-          bin/pyenv --debug install ${{ matrix.python-version }}
-          bin/pyenv global ${{ matrix.python-version }}
-          bin/pyenv rehash
-      - run: python --version
-      - run: python -m pip --version
-      - shell: python  # Prove that actual Python == expected Python
-        env:
-          EXPECTED_PYTHON: ${{ matrix.python-version }}
-        run: import os, sys ; assert sys.version.startswith(os.getenv("EXPECTED_PYTHON"))

CHANGELOG.md

@@ -1,5 +1,14 @@
 # Version History
 
+## Release v2.8.5
+* pyenv-binary: record direct system dependencies in Linux/FreeBSD by @macayu17 in https://github.com/pyenv/pyenv/pull/3520
+* tests: Fix "cd: null directory" in OpenSUSE by @native-api in https://github.com/pyenv/pyenv/pull/3524
+* Test improvements by @native-api in https://github.com/pyenv/pyenv/pull/3525
+* CI: test on all runners when the build logic changes by @sujeito-operator in https://github.com/pyenv/pyenv/pull/3522
+* Add GraalPy 25.3.4.1 by @msimacek in https://github.com/pyenv/pyenv/pull/3529
+* Add CPython 3.15.0rc2 by @pyenv-bot[bot] in https://github.com/pyenv/pyenv/pull/3530
+* pyenv-binary: support relocating macOS archives by @macayu17 in https://github.com/pyenv/pyenv/pull/3528
+
 ## Release v2.8.4
 * CI: Add macos_26_intel by @native-api in https://github.com/pyenv/pyenv/pull/3514
 * pyenv-binary: check FreeBSD system libraries by @macayu17 in https://github.com/pyenv/pyenv/pull/3511

Makefile

@@ -10,11 +10,14 @@ TEST_PYTHON_BUILD_DOCKER_TARGETS = $(foreach bash,$(TEST_BASH_VERSIONS),$(addsuf
 TEST_BINARY_DOCKER_PREFIX = test-binary-docker
 TEST_BINARY_DOCKER_TARGETS = $(foreach bash,$(TEST_BASH_VERSIONS),$(addsuffix -$(bash),$(TEST_BINARY_DOCKER_PREFIX)) $(addsuffix -gnu-$(bash),$(TEST_BINARY_DOCKER_PREFIX)))
 
+TEST_LINK_DOCKER_PREFIX = test-link-docker
+TEST_LINK_DOCKER_TARGETS = $(foreach bash,$(TEST_BASH_VERSIONS),$(addsuffix -$(bash),$(TEST_LINK_DOCKER_PREFIX)) $(addsuffix -gnu-$(bash),$(TEST_LINK_DOCKER_PREFIX)))
+
 TEST_BATS_IMAGE_PREFIX = test-pyenv-docker-image
 TEST_BATS_IMAGE_TARGETS = $(foreach bash,$(TEST_BASH_VERSIONS),$(addsuffix -$(bash),$(TEST_BATS_IMAGE_PREFIX)) $(addsuffix -gnu-$(bash),$(TEST_BATS_IMAGE_PREFIX)))
 
 .PHONY: test-docker
-test-docker: $(TEST_UNIT_DOCKER_PREFIX) $(TEST_PYTHON_BUILD_DOCKER_PREFIX) $(TEST_BINARY_DOCKER_PREFIX)
+test-docker: $(TEST_UNIT_DOCKER_PREFIX) $(TEST_PYTHON_BUILD_DOCKER_PREFIX) $(TEST_BINARY_DOCKER_PREFIX) $(TEST_LINK_DOCKER_PREFIX)
 
 .PHONY: $(TEST_UNIT_DOCKER_PREFIX)
 $(TEST_UNIT_DOCKER_PREFIX): $(TEST_UNIT_DOCKER_TARGETS)
@@ -62,7 +65,8 @@ $(TEST_PYTHON_BUILD_DOCKER_TARGETS): $(TEST_PYTHON_BUILD_DOCKER_PREFIX)-% : $(TE
 		$${CI+-e CI="$${CI}"} \
 		$(INTERACTIVE) \
 		$(DOCKER_IMAGE):$(DOCKER_TAG) \
-		bats $${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} plugins/python-build/test/$${BATS_FILE_FILTER}
+		bats $${CI:+-F "/code/test/libexec/bats-format-tap-suite"} \
+		$${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} plugins/python-build/test/$${BATS_FILE_FILTER}
 
 .PHONY: $(TEST_BINARY_DOCKER_PREFIX)
 $(TEST_BINARY_DOCKER_PREFIX): $(TEST_BINARY_DOCKER_TARGETS)
@@ -84,7 +88,31 @@ $(TEST_BINARY_DOCKER_TARGETS): $(TEST_BINARY_DOCKER_PREFIX)-% : $(TEST_BATS_IMAG
 		$${CI+-e CI="$${CI}"} \
 		$(INTERACTIVE) \
 		$(DOCKER_IMAGE):$(DOCKER_TAG) \
-		bats $${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} plugins/pyenv-binary/test/$${BATS_FILE_FILTER}
+		bats $${CI:+-F "/code/test/libexec/bats-format-tap-suite"} \
+		$${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} plugins/pyenv-binary/test/$${BATS_FILE_FILTER}
+
+.PHONY: $(TEST_LINK_DOCKER_PREFIX)
+$(TEST_LINK_DOCKER_PREFIX): $(TEST_LINK_DOCKER_TARGETS)
+
+.PHONY: $(TEST_LINK_DOCKER_TARGETS)
+$(TEST_LINK_DOCKER_TARGETS): DOCKER_IMAGE = $(TEST_BATS_IMAGE_PREFIX)
+$(TEST_LINK_DOCKER_TARGETS): GNU = $(if $(findstring -gnu-,$@),True,False)
+$(TEST_LINK_DOCKER_TARGETS): BASH = $(filter $(TEST_BASH_VERSIONS),$(subst -, ,$@))
+$(TEST_LINK_DOCKER_TARGETS): DOCKER_TAG = bash-$(BASH)-gnu-$(GNU)
+$(TEST_LINK_DOCKER_TARGETS): INTERACTIVE = $(if $(findstring true,$(CI)),,-ti)
+$(TEST_LINK_DOCKER_TARGETS): $(TEST_LINK_DOCKER_PREFIX)-% : $(TEST_BATS_IMAGE_PREFIX)-%
+	$(info Running test with docker image '$(DOCKER_IMAGE):$(DOCKER_TAG)')
+	docker run \
+		--init \
+		-v $(PWD):/code:ro \
+		-v /etc/passwd:/etc/passwd:ro \
+		-v /etc/group:/etc/group:ro \
+		-u "$$(id -u $$(whoami)):$$(id -g $$(whoami))" \
+		$${CI+-e CI="$${CI}"} \
+		$(INTERACTIVE) \
+		$(DOCKER_IMAGE):$(DOCKER_TAG) \
+		bats $${CI:+-F "/code/test/libexec/bats-format-tap-suite"} \
+		$${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} plugins/pyenv-link/test/$${BATS_FILE_FILTER}
 
 # Build all images needed for bats under docker
 .PHONY: $(TEST_BATS_IMAGE_PREFIX)
@@ -108,22 +136,28 @@ $(TEST_BATS_IMAGE_TARGETS):
 		./ ; \
 	fi
 
-.PHONY: test test-unit test-python-build test-binary
+.PHONY: test test-unit test-python-build test-binary test-link
 
 # Do not pass in user flags to build tests.
 unexport PYTHON_CFLAGS
 unexport PYTHON_CONFIGURE_OPTS
 
-test: test-unit test-python-build test-binary
+test: test-unit test-python-build test-binary test-link
 
 test-unit: bats
 	PATH="./bats/bin:$$PATH" test/run
 	
 test-python-build: bats
-	cd plugins/python-build && $(PWD)/bats/bin/bats $${CI:+--tap} $${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} test/$${BATS_FILE_FILTER}
+	cd plugins/python-build && $(PWD)/bats/bin/bats $${CI:+-F "$(PWD)/test/libexec/bats-format-tap-suite"} \
+		$${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} test/$${BATS_FILE_FILTER}
 
 test-binary: bats
-	cd plugins/pyenv-binary && $(PWD)/bats/bin/bats $${CI:+--tap} $${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} test/$${BATS_FILE_FILTER}
+	cd plugins/pyenv-binary && $(PWD)/bats/bin/bats $${CI:+-F "$(PWD)/test/libexec/bats-format-tap-suite"} \
+		$${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} test/$${BATS_FILE_FILTER}
+
+test-link: bats
+	cd plugins/pyenv-link && $(PWD)/bats/bin/bats $${CI:+-F "$(PWD)/test/libexec/bats-format-tap-suite"} \
+		$${BATS_TEST_FILTER:+--filter "$${BATS_TEST_FILTER}"} test/$${BATS_FILE_FILTER}
 
 .SECONDARY: bats-$(TEST_BATS_VERSION)
 bats-$(TEST_BATS_VERSION):

README.md

@@ -13,6 +13,8 @@ This project was forked from [rbenv](https://github.com/rbenv/rbenv) and
 
 * Lets you **change the global Python version** on a per-user basis.
 * Provides support for **per-project Python versions**.
+* Supports **multiple Python distributions**: CPython, PyPy, Stackless Python, Jython, and more.
+  See the [full list of available versions](https://github.com/pyenv/pyenv/tree/master/plugins/python-build/share/python-build).
 * Allows you to **override the Python version** with an environment
   variable.
 * Searches for commands from **multiple versions of Python at a time**.

libexec/pyenv---version

@@ -12,7 +12,7 @@
 set -e
 [ -n "$PYENV_DEBUG" ] && set -x
 
-version="2.8.4"
+version="2.8.5"
 git_revision=""
 
 if cd "${BASH_SOURCE%/*}" 2>/dev/null && git remote -v 2>/dev/null | grep -q pyenv; then

libexec/pyenv-init

@@ -473,12 +473,12 @@ function pyenv {
   }
 
   if ( ("${commands[*]}" -split ' ') -contains \$command ) {
-    \$shell_cmds = (& (get-command -commandtype application pyenv) sh-\$command \$args)
+    \$shell_cmds = (& (get-command -commandtype application pyenv -totalcount 1) sh-\$command \$args)
     if ( \$shell_cmds.Count -gt 0 ) {
       iex (\$shell_cmds -join "\`n")
     }
   } else {
-    & (get-command -commandtype application pyenv) \$command \$args
+    & (get-command -commandtype application pyenv -totalcount 1) \$command \$args
   }
 }
 EOS

libexec/pyenv-version-file

@@ -11,7 +11,7 @@ find_local_version_file() {
   # Nonexistent paths are UB as of this writing.
   # Relative ones cause a failure but absolute ones don't
   [[ $root != /* ]] && root=$(CDPATH= cd -- "$root" && pwd)
-  # Original Rbenv code supports UNC notaion for Cygwin/MinGW
+  # Original Rbenv code supports UNC notation for Cygwin/MinGW
   # (https://github.com/rbenv/rbenv/pull/529)
   # POSIX.1-2024 still allows to treat //<name> in implementation-specific manner
   # (https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/V1_chap04.html#tag_04_16)
@@ -38,7 +38,9 @@ find_local_version_file() {
 if [ -n "$target_dir" ]; then
   find_local_version_file "$target_dir"
 else
-  find_local_version_file "$PYENV_DIR" || {
+  # In tests, PYENV_DIR is not set, ultimately leading to "cd: null directory" in OpenSUSE
+  # While most `cd` implementations treat an empty argument the same as missing, that's still wrong
+  find_local_version_file "${PYENV_DIR:=$PWD}" || {
     [ "$PYENV_DIR" != "$PWD" ] && find_local_version_file "$PWD"
   } || echo "${PYENV_ROOT}/version"
 fi

plugins/.gitignore

@@ -3,4 +3,5 @@
 !/version-ext-compat
 !/python-build
 !/pyenv-binary
+!/pyenv-link
 /python-build/test/build

plugins/pyenv-binary/libexec/pyenv-binary-generate-installer

@@ -14,7 +14,7 @@
 #   into the definition; `pyenv binary save' writes the two together.
 #
 #   <metadata-file>       A .meta file written by `pyenv binary save'.
-#                         The corresponsing binary package written by `pyenv binary save'
+#                         The corresponding binary package written by `pyenv binary save'
 #                         needs to be present alongside it.
 #   --archive-url <url>   The URL for the resulting installation script to download
 #                         the package from.
@@ -55,7 +55,7 @@ if [ -z "$metadata" ] || [ -z "$archive_url" ]; then
   exit 1
 fi
 
-version="" os="" arch="" distro="" libc="" archive=""
+version="" os="" arch="" distro="" libc="" build_prefix="" archive=""
 deps=""
 while IFS='=' read -r key value; do
   case "$key" in
@@ -64,6 +64,7 @@ while IFS='=' read -r key value; do
   arch ) arch="$value" ;;
   distro ) distro="$value" ;;
   libc ) libc="$value" ;;
+  build_prefix ) build_prefix="$value" ;;
   archive ) archive="$value" ;;
   dep ) deps="${deps:+$deps }$value" ;;
   esac
@@ -78,10 +79,9 @@ for field in version os arch archive; do
   fi
 done
 
-# macOS relocation needs install_name_tool and a different rpath scheme, so it is
-# not supported yet. Other systems relocate with patchelf.
-if [ "$os" = "Darwin" ]; then
-  echo "pyenv-binary: macOS archives are not supported yet" >&2
+# Mach-O load commands contain the prefix where Python was built.
+if [ "$os" = "Darwin" ] && [ -z "$build_prefix" ]; then
+  echo "pyenv-binary: metadata is missing \`build_prefix'" >&2
   exit 1
 fi
 
@@ -122,6 +122,7 @@ emit() {
     printf 'EXPECT_OS=%q\n' "$os"
     printf 'EXPECT_ARCH=%q\n' "$arch"
     printf 'EXPECT_LIBC=%q\n' "$libc"
+    printf 'BUILD_PREFIX=%q\n' "$build_prefix"
     printf 'VERSION=%q\n' "$version"
     printf 'ARCHIVE_URL=%q\n' "$archive_url"
     printf 'SHA256=%q\n' "$sha256"
@@ -185,13 +186,29 @@ elif [ -n "$DEPS" ]; then
   echo "pyenv-binary: cannot check required system libraries (ldconfig cache unavailable)" >&2
 fi
 
-if ! command -v patchelf >/dev/null 2>&1; then
-  echo "pyenv-binary: need patchelf to relocate the binary" >&2
-  exit 1
-fi
+case "$os" in
+Darwin )
+  for tool in otool install_name_tool; do
+    if ! command -v "$tool" >/dev/null 2>&1; then
+      echo "pyenv-binary: need ${tool} to relocate the binary" >&2
+      exit 1
+    fi
+  done
+  ;;
+* )
+  if ! command -v patchelf >/dev/null 2>&1; then
+    echo "pyenv-binary: need patchelf to relocate the binary" >&2
+    exit 1
+  fi
+  ;;
+esac
 
 build_package_relocate() {
-  pyenv binary relocate "$PREFIX_PATH"
+  if [ "$os" = "Darwin" ]; then
+    pyenv binary relocate "$PREFIX_PATH" "$BUILD_PREFIX"
+  else
+    pyenv binary relocate "$PREFIX_PATH"
+  fi
 }
 
 install_package "Python-${VERSION}-binary" "${ARCHIVE_URL}#${SHA256}" copy relocate

plugins/pyenv-binary/libexec/pyenv-binary-package

@@ -75,15 +75,6 @@ latest )
   ;;
 esac
 
-os="$(uname -s)"
-
-# `generate-installer' refuses a macOS archive, so the last step here cannot
-# succeed on one. Give up before compiling rather than after it.
-if [ "$os" = "Darwin" ]; then
-  echo "pyenv-binary: macOS archives are not supported yet" >&2
-  exit 1
-fi
-
 # `pyenv install' puts a `<version>:<alias>' build under versions/<alias>.
 pyenv-install ${verbose:+--verbose} "$spec"
 pyenv-binary-save "$entry" "$PWD" --name "$entry"

plugins/pyenv-binary/libexec/pyenv-binary-relocate

@@ -1,12 +1,13 @@
 #!/usr/bin/env bash
 #
-# Summary: Rewrite an unpacked Python's rpaths so it runs from its prefix
+# Summary: Rewrite an unpacked Python's library paths so it runs from its prefix
 #
-# Usage: pyenv binary relocate <prefix>
+# Usage: pyenv binary relocate <prefix> [<build-prefix>]
 #
-#   Rewrites the rpaths of a Python tree that was unpacked into <prefix> so the
-#   interpreter and its extension modules load the bundled libraries from their
-#   new location rather than the path it was built at. Requires patchelf.
+#   Rewrites the library paths of a Python tree that was unpacked into <prefix>
+#   so the interpreter and its extension modules load the bundled libraries from
+#   their new location rather than the path it was built at. Requires patchelf on
+#   Linux and FreeBSD, or otool and install_name_tool on macOS.
 #
 #   The definition that `pyenv binary generate-installer' produces calls this
 #   after `install_package ... copy' has laid the tree down.
@@ -24,6 +25,84 @@ if [ -z "$prefix" ]; then
   exit 1
 fi
 
+if [ "$(uname -s)" = "Darwin" ]; then
+  build_prefix="${2%/}"
+  if [ -z "$build_prefix" ]; then
+    echo "pyenv-binary: need the original build prefix to relocate a macOS binary" >&2
+    exit 1
+  fi
+  for tool in otool install_name_tool; do
+    if ! command -v "$tool" >/dev/null 2>&1; then
+      echo "pyenv-binary: need ${tool} to relocate the binary" >&2
+      exit 1
+    fi
+  done
+
+  relocate_macho() {
+    local file="$1" new_rpath="$2"
+    local load_commands install_ids rpaths dependency install_id rpath replacement
+
+    load_commands="$(otool -L "$file")"
+    install_ids="$(otool -D "$file" 2>/dev/null || true)"
+    rpaths="$(otool -l "$file")"
+    install_id="$(printf '%s\n' "$install_ids" | sed -n '2s/^[[:space:]]*//p')"
+
+    while IFS= read -r dependency; do
+      case "$dependency" in
+      "$build_prefix"/lib/* )
+        if [ "$dependency" != "$install_id" ]; then
+          replacement="@rpath/${dependency#"$build_prefix"/lib/}"
+          install_name_tool -change "$dependency" "$replacement" "$file"
+        fi
+        ;;
+      esac
+    done < <(printf '%s\n' "$load_commands" | tail -n +2 | sed -E \
+      's/^[[:space:]]*//; s/[[:space:]]+\(compatibility version.*$//')
+
+    case "$install_id" in
+    "$build_prefix"/lib/* )
+      replacement="@rpath/${install_id#"$build_prefix"/lib/}"
+      install_name_tool -id "$replacement" "$file"
+      ;;
+    esac
+
+    while IFS= read -r rpath; do
+      if [ "$rpath" = "$build_prefix/lib" ]; then
+        install_name_tool -rpath "$rpath" "$new_rpath" "$file"
+      fi
+    done < <(printf '%s\n' "$rpaths" | awk '
+      /cmd LC_RPATH/ { found = 1; next }
+      found && /^[[:space:]]*path / {
+        sub(/^[[:space:]]*path /, "")
+        sub(/ \(offset [0-9]+\)$/, "")
+        print
+        found = 0
+      }
+    ')
+  }
+
+  found=0
+  for file in "$prefix"/bin/*; do
+    [[ -f $file && -x $file && ! -L $file ]] || continue
+    otool -L "$file" >/dev/null 2>&1 || continue
+    relocate_macho "$file" '@executable_path/../lib'
+    found=1
+  done
+  if [ "$found" -eq 0 ]; then
+    echo "pyenv-binary: found no interpreter to relocate under \`${prefix}/bin'" >&2
+    exit 1
+  fi
+
+  for file in "$prefix"/lib/*.dylib; do
+    [[ -f $file && ! -L $file ]] || continue
+    relocate_macho "$file" '@loader_path'
+  done
+  while IFS= read -r so; do
+    relocate_macho "$so" '@loader_path/../..'
+  done < <(find "$prefix" -type f -path '*/lib/python*/lib-dynload/*.so')
+  exit
+fi
+
 # patchelf can add an rpath and write one of any length; chrpath can only shorten
 # an existing one, which is not enough to relocate every build, so require it.
 if ! command -v patchelf >/dev/null 2>&1; then

plugins/pyenv-binary/libexec/pyenv-binary-save

@@ -92,12 +92,16 @@ fi
 if [ "$os" = "Linux" ]; then
   libc="$(getconf GNU_LIBC_VERSION 2>/dev/null || true)"
 fi
+if [ "$os" != "Darwin" ] && ! LC_ALL=C readelf --version &>/dev/null; then
+  echo "pyenv-binary: need readelf to inspect shared libraries" >&2
+  exit 1
+fi
 
 # List the external shared libraries the install links against: those that
 # resolve outside its own prefix, so they must already exist on the target.
 # The interpreter plus every bundled shared object are inspected.
 system_deps() {
-  local f
+  local f needed
   {
     for f in "${prefix}"/bin/python*; do
       [ -e "$f" ] && printf '%s\n' "$f"
@@ -111,8 +115,19 @@ system_deps() {
       otool -L "$f" 2>/dev/null | tail -n +2 | awk -v pfx="${prefix}/" \
         '$1 !~ /^@/ && substr($1, 1, length(pfx)) != pfx { print $1 }'
     else
-      ldd "$f" 2>/dev/null | awk -v pfx="${prefix}/" \
-        '$2 == "=>" && $3 ~ /^\// && substr($3, 1, length(pfx)) != pfx { print $1 }'
+      # GNU binutils 2.44 writes "(NEEDED) ... [name]"; FreeBSD 15.1 writes
+      # "NEEDED ... [name]". readelf(1) documents -d, not its text format.
+      needed="$(LC_ALL=C readelf -dW "$f" 2>/dev/null | awk \
+        '$2 == "(NEEDED)" || $2 == "NEEDED" { sub(/^.*\[/, ""); sub(/\].*$/, ""); print }' | tr '\n' ' ')"
+      # Linux and FreeBSD ldd write resolved libraries as
+      # "name => /absolute/path (address)"; entries without "=>" are ignored.
+      LC_ALL=C ldd "$f" 2>/dev/null | awk -v needed="$needed" -v pfx="${prefix}/" '
+        BEGIN {
+          split(needed, deps, " ")
+          for (i in deps) direct[deps[i]] = 1
+        }
+        $1 in direct && $2 == "=>" && $3 ~ /^\// && substr($3, 1, length(pfx)) != pfx { print $1 }
+      '
     fi
   done | sort -u
 }
@@ -132,6 +147,7 @@ tar -C "$(dirname "$prefix")" -czf "${output_dir}/${archive}" "$(basename "$pref
   echo "platform=${platform}"
   [ -n "$distro" ] && echo "distro=${distro}"
   [ -n "$libc" ] && echo "libc=${libc}"
+  echo "build_prefix=${prefix}"
   echo "archive=${archive}"
   system_deps | while IFS= read -r dep; do
     [ -n "$dep" ] && echo "dep=${dep}"

plugins/pyenv-binary/test/generate-installer.bats

@@ -6,6 +6,7 @@ create_meta() {
   local os="${1-Linux}"
   local arch="${2-x86_64}"
   local libc="${3-glibc 2.17}"
+  local build_prefix="${4-}"
   local archive="${BATS_TEST_TMPDIR}/3.12.7.tar.gz"
   local meta="${BATS_TEST_TMPDIR}/sample.meta"
 
@@ -20,6 +21,7 @@ create_meta() {
     echo "os=${os}"
     echo "arch=${arch}"
     [ -z "$libc" ] || echo "libc=${libc}"
+    [ -z "$build_prefix" ] || echo "build_prefix=${build_prefix}"
     echo "archive=${archive##*/}"
   } > "$meta"
   echo "$meta"
@@ -58,10 +60,20 @@ create_meta() {
   assert_failure
 }
 
-@test "refuses macOS metadata" {
+@test "fails when macOS metadata is missing the build prefix" {
   run pyenv-binary-generate-installer "$(create_meta Darwin arm64 '')" \
     --archive-url http://x/a.tar.gz
-  assert_failure "pyenv-binary: macOS archives are not supported yet"
+  assert_failure "pyenv-binary: metadata is missing \`build_prefix'"
+}
+
+@test "quotes the macOS build prefix in the generated definition" {
+  local out="${BATS_TEST_TMPDIR}/definition"
+  pyenv-binary-generate-installer \
+    "$(create_meta Darwin arm64 '' '/build prefix/$name')" \
+    --archive-url http://example.com/a.tar.gz -o "$out"
+
+  run grep '^BUILD_PREFIX=' "$out"
+  assert_success 'BUILD_PREFIX=/build\ prefix/\$name'
 }
 
 @test "fails when required metadata is missing" {
@@ -117,6 +129,58 @@ create_meta() {
   assert_failure "pyenv-binary: need patchelf to relocate the binary"
 }
 
+@test "checks for otool before installing a macOS archive" {
+  local out="${BATS_TEST_TMPDIR}/definition"
+  pyenv-binary-generate-installer \
+    "$(create_meta Darwin arm64 '' /build/3.12.7)" \
+    --archive-url http://example.com/a.tar.gz -o "$out"
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_path_executable install_name_tool true
+
+  PATH="$(path_without otool)" run bash "$out"
+  assert_failure "pyenv-binary: need otool to relocate the binary"
+}
+
+@test "checks for install_name_tool before installing a macOS archive" {
+  local out="${BATS_TEST_TMPDIR}/definition"
+  pyenv-binary-generate-installer \
+    "$(create_meta Darwin arm64 '' /build/3.12.7)" \
+    --archive-url http://example.com/a.tar.gz -o "$out"
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_path_executable otool true
+
+  PATH="$(path_without install_name_tool)" run bash "$out"
+  assert_failure "pyenv-binary: need install_name_tool to relocate the binary"
+}
+
+@test "the generated macOS definition preserves both relocation arguments" {
+  local archive="${BATS_TEST_TMPDIR}/3.12.7.tar.gz"
+  local cache="${BATS_TEST_TMPDIR}/cache"
+  local definition="${BATS_TEST_TMPDIR}/definition"
+  local prefix="${BATS_TEST_TMPDIR}/install"
+  pyenv-binary-generate-installer \
+    "$(create_meta Darwin arm64 '' '/build prefix/$name')" \
+    --archive-url http://example.com/3.12.7.tar.gz -o "$definition"
+  mkdir -p "$cache"
+  cp "$archive" "${cache}/Python-3.12.7-binary.tar.gz"
+  create_stub pyenv 'printf "argc=%s\narg1=%s\narg2=%s\narg3=%s\narg4=%s\n" "$#" "$1" "$2" "$3" "$4"'
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_stub sw_vers 'echo 15.5'
+  create_stub ldconfig true
+  create_path_executable otool true
+  create_path_executable install_name_tool true
+
+  PYTHON_BUILD_CACHE_PATH="$cache" run \
+    "${BATS_TEST_DIRNAME}/../../python-build/bin/python-build" "$definition" "$prefix"
+  assert_success
+  assert_line "argc=4"
+  assert_line "arg1=binary"
+  assert_line "arg2=relocate"
+  assert_line "arg3=${prefix}"
+  assert_line 'arg4=/build prefix/$name'
+  assert_line "Installed Python-3.12.7-binary to ${prefix}"
+}
+
 @test "fails when the archive is not beside the metadata" {
   local meta="$(create_meta)"
   rm "${BATS_TEST_TMPDIR}/3.12.7.tar.gz"

plugins/pyenv-binary/test/package.bats

@@ -10,6 +10,7 @@ stub_build_environment() {
   create_stub pyenv-latest 'while (($#)); do case "$1" in -f|-k);; *)break;; esac; shift; done; echo "$*"'
   create_stub uname 'case "$1" in -s) echo Linux;; -m) echo x86_64;; esac'
   create_stub getconf 'echo "glibc 2.17"'
+  create_stub readelf true
 }
 
 @test "-v|--verbose runs pyenv install verbosely" {
@@ -81,10 +82,16 @@ pyenv-install --list --bare
   assert_failure "pyenv-binary: \`latest' cannot be used as an entry name"
 }
 
-@test "refuses to package on macOS before compiling anything" {
+@test "packages on macOS" {
   create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_stub pyenv-install 'echo install'
+  create_stub pyenv-binary-save 'echo save'
+  create_stub pyenv-binary-generate-installer 'echo generate-installer'
+
   run pyenv-binary-package 3.12.7:3.12.7-test --archive-base-url http://x/b
-  assert_failure "pyenv-binary: macOS archives are not supported yet"
+  assert_success "install
+save
+generate-installer"
 }
 
 @test "writes the archive, metadata and definition under the entry name (integration)" {

plugins/pyenv-binary/test/relocate.bats

@@ -4,6 +4,7 @@ load test_helper
 
 _setup() {
   create_stub pyenv-help "echo usage"
+  create_stub uname 'case "$1" in -s) echo Linux;; -m) echo x86_64;; esac'
 }
 
 stub_patchelf() {
@@ -21,6 +22,87 @@ create_interpreter() {
   chmod +x "${BATS_TEST_TMPDIR}/prefix/bin/python2.7"
 }
 
+create_macos_tree() {
+  local prefix="${BATS_TEST_TMPDIR}/prefix"
+  local lib="${prefix}/lib/python3.12"
+  mkdir -p "${prefix}/bin" "${lib}/lib-dynload" "${lib}/site-packages/numpy"
+  printf '#!/bin/sh\n' > "${prefix}/bin/python3.12"
+  chmod +x "${prefix}/bin/python3.12"
+  touch "${prefix}/lib/libpython3.12.dylib"
+  touch "${lib}/lib-dynload/_ssl.cpython-312-darwin.so"
+  touch "${lib}/site-packages/numpy/_multiarray.so"
+}
+
+stub_macos_tools() {
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_path_executable install_name_tool \
+    'echo "$*" >> "${BATS_TEST_TMPDIR}/install-name-tool.log"'
+  create_path_executable otool <<'STUB'
+file="${!#}"
+echo "$*" >> "${BATS_TEST_TMPDIR}/otool.log"
+old="/build prefix/3.12.7"
+case "$1" in
+-L )
+  echo "${file}:"
+  case "$file" in
+  */bin/python3.12 )
+    if [ -n "$OTOOL_RELOCATED" ]; then
+      echo "    @rpath/libpython3.12.dylib (compatibility version 3.12.0, current version 3.12.0)"
+    else
+      echo "    ${old}/lib/libpython3.12.dylib (compatibility version 3.12.0, current version 3.12.0)"
+    fi
+    echo "    ${old}-other/lib/libother.dylib (compatibility version 1.0.0, current version 1.0.0)"
+    echo "    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1.0.0)"
+    echo "    /opt/homebrew/lib/libintl.8.dylib (compatibility version 1.0.0, current version 1.0.0)"
+    echo "    @loader_path/liblocal.dylib (compatibility version 1.0.0, current version 1.0.0)"
+    ;;
+  */lib/libpython3.12.dylib )
+    if [ -n "$OTOOL_RELOCATED" ]; then
+      echo "    @rpath/libpython3.12.dylib (compatibility version 3.12.0, current version 3.12.0)"
+    else
+      echo "    ${old}/lib/libpython3.12.dylib (compatibility version 3.12.0, current version 3.12.0)"
+    fi
+    ;;
+  esac
+  ;;
+-D )
+  case "$file" in
+  */lib/libpython3.12.dylib )
+    echo "${file}:"
+    if [ -n "$OTOOL_RELOCATED" ]; then
+      echo '@rpath/libpython3.12.dylib'
+    else
+      echo "${old}/lib/libpython3.12.dylib"
+    fi
+    ;;
+  * )
+    exit 1
+    ;;
+  esac
+  ;;
+-l )
+  if [ -n "$OTOOL_RELOCATED" ]; then
+    case "$file" in
+    */bin/* ) rpath='@executable_path/../lib' ;;
+    */lib/*.dylib ) rpath='@loader_path' ;;
+    * ) rpath='@loader_path/../..' ;;
+    esac
+  else
+    rpath="${old}/lib"
+  fi
+  cat <<EOF
+          cmd LC_RPATH
+         path ${rpath} (offset 12)
+          cmd LC_RPATH
+         path /opt/homebrew/lib (offset 12)
+          cmd LC_RPATH
+         path @loader_path/vendor (offset 12)
+EOF
+  ;;
+esac
+STUB
+}
+
 @test "completion produces nothing" {
   run pyenv-binary-relocate --complete
   assert_success ""
@@ -36,6 +118,31 @@ create_interpreter() {
   assert_failure "pyenv-binary: need patchelf to relocate the binary"
 }
 
+@test "fails without the original build prefix on macOS" {
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+
+  run pyenv-binary-relocate "${BATS_TEST_TMPDIR}/prefix"
+  assert_failure "pyenv-binary: need the original build prefix to relocate a macOS binary"
+}
+
+@test "fails when otool is not available on macOS" {
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_path_executable install_name_tool true
+
+  PATH="$(path_without otool)" run \
+    pyenv-binary-relocate "${BATS_TEST_TMPDIR}/prefix" /build/3.12.7
+  assert_failure "pyenv-binary: need otool to relocate the binary"
+}
+
+@test "fails when install_name_tool is not available on macOS" {
+  create_stub uname 'case "$1" in -s) echo Darwin;; -m) echo arm64;; esac'
+  create_path_executable otool true
+
+  PATH="$(path_without install_name_tool)" run \
+    pyenv-binary-relocate "${BATS_TEST_TMPDIR}/prefix" /build/3.12.7
+  assert_failure "pyenv-binary: need install_name_tool to relocate the binary"
+}
+
 @test "fails when the prefix has no interpreter" {
   create_path_executable patchelf "exit 0"
   mkdir -p "${BATS_TEST_TMPDIR}/prefix"
@@ -70,3 +177,45 @@ create_interpreter() {
   assert_line "--set-rpath ${BATS_TEST_TMPDIR}/prefix/lib ${lib}/lib-dynload/_ssl.cpython-312-x86_64-linux-gnu.so"
   refute_line "--set-rpath ${BATS_TEST_TMPDIR}/prefix/lib ${lib}/site-packages/numpy/_multiarray.so"
 }
+
+@test "relocates macOS load commands without changing unrelated entries" {
+  local prefix="${BATS_TEST_TMPDIR}/prefix"
+  local old="/build prefix/3.12.7"
+  local lib="${prefix}/lib/python3.12"
+  create_macos_tree
+  stub_macos_tools
+
+  run pyenv-binary-relocate "$prefix" "$old"
+  assert_success
+  run cat "${BATS_TEST_TMPDIR}/install-name-tool.log"
+  assert_output <<EOF
+-change ${old}/lib/libpython3.12.dylib @rpath/libpython3.12.dylib ${prefix}/bin/python3.12
+-rpath ${old}/lib @executable_path/../lib ${prefix}/bin/python3.12
+-id @rpath/libpython3.12.dylib ${prefix}/lib/libpython3.12.dylib
+-rpath ${old}/lib @loader_path ${prefix}/lib/libpython3.12.dylib
+-rpath ${old}/lib @loader_path/../.. ${lib}/lib-dynload/_ssl.cpython-312-darwin.so
+EOF
+  run grep -F "${lib}/site-packages/numpy/_multiarray.so" "${BATS_TEST_TMPDIR}/otool.log"
+  assert_failure
+}
+
+@test "skips already relocated macOS load commands" {
+  local prefix="${BATS_TEST_TMPDIR}/prefix"
+  create_macos_tree
+  stub_macos_tools
+  export OTOOL_RELOCATED=1
+
+  run pyenv-binary-relocate "$prefix" "/build prefix/3.12.7"
+  assert_success
+  assert [ ! -e "${BATS_TEST_TMPDIR}/install-name-tool.log" ]
+}
+
+@test "fails when install_name_tool cannot modify a selected file" {
+  local prefix="${BATS_TEST_TMPDIR}/prefix"
+  create_macos_tree
+  stub_macos_tools
+  create_path_executable install_name_tool 'exit 1'
+
+  run pyenv-binary-relocate "$prefix" "/build prefix/3.12.7"
+  assert_failure ""
+}

plugins/pyenv-binary/test/save.bats

@@ -79,7 +79,25 @@ platform() {
   assert_line "archive=3.12.7-$(platform).tar.gz"
 }
 
-@test "records only the libraries ldd resolves outside the prefix" {
+@test "records the original installation prefix" {
+  create_version "3.12.7"
+  local out="${BATS_TEST_TMPDIR}/dist"
+  pyenv-binary-save "3.12.7" "$out" >/dev/null
+
+  run grep '^build_prefix=' "${out}/3.12.7-$(platform).meta"
+  assert_success "build_prefix=${PYENV_ROOT}/versions/3.12.7"
+}
+
+@test "fails when readelf is not available" {
+  create_version "3.12.7"
+  create_stub uname 'case "$1" in -s) echo Linux;; -m) echo x86_64;; esac'
+
+  PATH="$(path_without readelf)" run pyenv-binary-save "3.12.7" "${BATS_TEST_TMPDIR}/dist"
+  assert_failure "pyenv-binary: need readelf to inspect shared libraries"
+  assert [ ! -e "${BATS_TEST_TMPDIR}/dist/3.12.7-$(platform).tar.gz" ]
+}
+
+@test "records only direct libraries resolved outside the prefix" {
   create_version "3.12.7"
   touch "${PYENV_ROOT}/versions/3.12.7/bin/python3.12"
   create_path_executable uname <<'STUB'
@@ -97,13 +115,18 @@ cat <<EOF
 	libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f4a3b800000)
 	/lib64/ld-linux-x86-64.so.2 (0x00007f4a3c200000)
 EOF
+STUB
+  create_path_executable readelf <<'STUB'
+cat <<EOF
+ 0x0000000000000001 (NEEDED)             Shared library: [libpython3.12.so.1.0]
+ 0x0000000000000001 (NEEDED)             Shared library: [libm.so.6]
+EOF
 STUB
 
   run pyenv-binary-save "3.12.7" "${BATS_TEST_TMPDIR}/dist"
   assert_success
   run grep '^dep=' "${BATS_TEST_TMPDIR}/dist/"*.meta
-  assert_output "dep=libc.so.6
-dep=libm.so.6"
+  assert_output "dep=libm.so.6"
 }
 
 @test "records only the libraries otool resolves outside the prefix" {

plugins/pyenv-link/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 yfprojects
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/pyenv-link/README.md

@@ -0,0 +1,33 @@
+# pyenv-link
+A [pyenv](https://github.com/pyenv/pyenv) plugin for linking Python installations and virtual environments into your pyenv root.
+
+This plugin recommends the [pyenv-virtualenv](https://github.com/pyenv/pyenv-virtualenv/) plugin.
+
+## Usage
+
+Make an arbitrary virtualenv available through pyenv. This automatically guesses a fitting name from the prompt, the directory name or the location of the venv.
+
+```console
+$ pyenv link version .venv
+Linked new version named myproject
+```
+
+You can also specify a name to use for the venv.
+
+```console
+$ pyenv link version .venv myname
+Linked new version named myname
+```
+
+The same command can give a platform-specific binary installation a shorter name:
+
+```console
+$ pyenv link version "$(pyenv root)/versions/3.13.14-linux-x86_64" 3.13.14
+Linked new version named 3.13.14
+```
+
+Now you can make pyenv activate/use the venv automatically:
+
+```console
+$ pyenv local myproject
+```

plugins/pyenv-link/bin/pyenv-link

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+#
+# Summary: Link a Python environment as a pyenv version
+#
+# Usage: pyenv link version [--dry] [--quiet] <path> [<name>]
+#
+# Link a virtual python environment to pyenvs version directory
+# so that the venv can be used like one created with *pyenv-virtualenv*.
+#
+# <path> should be a path to a Python installation or virtual environment.
+
+set -e
+[ -n "$PYENV_DEBUG" ] && set -x
+
+# Provide pyenv completions
+case "$1" in
+--complete)
+    if [ -z "$2" ]; then
+        echo version
+    else
+        shift 2
+        pyenv-link-version --complete "$@"
+    fi
+    ;;
+version)
+    shift
+    pyenv-link-version "$@"
+    exit $?
+    ;;
+*)
+    pyenv-help --usage link >&2
+    exit 1
+    ;;
+esac

plugins/pyenv-link/bin/pyenv-link-version

@@ -0,0 +1,150 @@
+#!/usr/bin/env bash
+#
+# Summary: Link a Python environment as a pyenv version
+#
+# Usage: pyenv link version [--dry] [--quiet] <path> [<name>]
+#
+# Link a virtual python environment to pyenvs version directory
+# so that the venv can be used like one created with *pyenv-virtualenv*.
+#
+# <path> should be a path to a Python installation or virtual environment.
+# <name> should be string used as a version name it may not be present
+#        in the pyenv version directory yet.
+#        If not specified a matching name is guessed from pyvenv.cfg
+#        or directory name of the venv.
+set -e
+[ -n "$PYENV_DEBUG" ] && set -x
+
+# functions
+
+if ! {
+    enable -f "${BASH_SOURCE%/*}"/../../../libexec/pyenv-realpath.dylib realpath ||
+        type realpath # realpath available?
+} >/dev/null 2>&1; then
+    # realpath requires GNU coreutils to be installed. That's why its bundled with pyenv
+    echo realpath not available >&2
+
+    # work-around when realpath is unavailable
+    realpath() {
+        (cd "$1" && pwd)
+    }
+fi
+
+guess_name() {
+    local venv_dir=$1
+    local name
+
+    # guess venv name from pyvenv.cfg
+    local pyvenv_cfg_path=$venv_dir/pyvenv.cfg
+    if [ -f "$pyvenv_cfg_path" ]; then
+        # if `prompt` key wasn't found the var remains empty
+        name=$(cut -b 1-1024 "$pyvenv_cfg_path" | sed -n '/^ *prompt *= */s///p')
+        case "$name" in
+        \"*\" | \'*\')
+            name=${name:1:${#name}-2}
+            ;;
+        esac
+    fi
+
+    # guess venv name from name of venv directory
+    local venv_dir_name=${venv_dir##*/}
+    if [ -z "$name" ]; then
+        case "$venv_dir_name" in
+        venv | env | .venv | .env | ENV | VENV) ;;
+        *) name=$venv_dir_name ;;
+        esac
+    fi
+
+    # guess venv name from name of the parent directory of the venv directory
+    local venv_dir_parent=${venv_dir%/*}
+    local venv_dir_parent_name=${venv_dir_parent##*/}
+    if [ -z "$name" ]; then
+        name=$venv_dir_parent_name
+    fi
+
+    echo "$name"
+}
+
+# process args
+POSARGS=()
+# Provide pyenv completions
+if [ "$1" = "--complete" ]; then
+    echo --dry
+    echo --quiet
+    exit
+fi
+
+for arg in "$@"; do
+    case $arg in
+    --dry)
+        dry=true # any value
+        ;;
+    --quiet)
+        quiet=true # any value
+        ;;
+    -*)
+        pyenv-help --usage link-version >&2
+        exit 1
+        ;;
+    *)
+        POSARGS+=("$arg")
+        ;;
+    esac
+done
+
+if [ ! ${#POSARGS[@]} -le 2 ] || [ ! ${#POSARGS[@]} -ge 1 ]; then
+    pyenv-help --usage link-version >&2
+    exit 1
+fi
+
+venv_dir=${POSARGS[0]%/}
+venv_name=${POSARGS[1]}
+
+# Check venv exists
+if [ ! -d "$venv_dir" ]; then
+    echo "The virtual env you specified doesn't exist"
+    exit 2
+fi
+
+# make venv dir absolute
+venv_dir=$(realpath "$venv_dir")
+
+# determine venv name
+if [ -z "$venv_name" ]; then
+    venv_name=$(guess_name "$venv_dir")
+fi
+
+case "$venv_name" in
+"" | */* | . | .. | *:* | system | *[[:cntrl:]]* )
+    echo "pyenv-link: invalid version name \`${venv_name}'" >&2
+    exit 1
+    ;;
+esac
+
+versions_dir="$PYENV_ROOT/versions"
+pyenv_prefix_path="$versions_dir/$venv_name"
+
+if [ -e "$pyenv_prefix_path" ] || [ -L "$pyenv_prefix_path" ]; then
+    echo Version "$venv_name" already exists >&2
+    exit 3
+fi
+
+case "$venv_dir" in
+"$versions_dir"/*)
+    link_target=${venv_dir#"$versions_dir"/}
+    ;;
+*)
+    link_target=$venv_dir
+    ;;
+esac
+
+# link to pyenv version directory
+if [ -z "$dry" ]; then
+    mkdir -p "$versions_dir"
+    ln -s "$link_target" "$pyenv_prefix_path"
+fi
+
+# output
+if [ -z "$quiet" ]; then
+    echo "Linked new version named $venv_name"
+fi

plugins/pyenv-link/test/link.bats

@@ -0,0 +1,61 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+@test "link completions use the dispatcher" {
+  run pyenv completions link
+  assert_success
+  assert_output <<OUT
+--help
+version
+OUT
+  run pyenv completions link version
+  assert_success
+  assert_output <<OUT
+--help
+--dry
+--quiet
+OUT
+}
+
+@test "link requires a version path" {
+  run pyenv-link version
+  assert_failure "Usage: pyenv link version [--dry] [--quiet] <path> [<name>]"
+}
+
+@test "links an installed binary under its plain version name" {
+  create_alt_executable_in_version "3.13.14-linux-x86_64" python 'echo linked-python'
+  run pyenv-link version "$PYENV_ROOT/versions/3.13.14-linux-x86_64" 3.13.14
+  assert_success "Linked new version named 3.13.14"
+  assert_equal "3.13.14-linux-x86_64" "$(readlink "$PYENV_ROOT/versions/3.13.14")"
+  PYENV_VERSION=3.13.14 run pyenv exec python
+  assert_success "linked-python"
+}
+
+@test "links external paths containing spaces into a fresh root" {
+  mkdir -p "$PYENV_TEST_DIR/external env/bin"
+  run pyenv-link version "$PYENV_TEST_DIR/external env" custom
+  assert_success "Linked new version named custom"
+  assert_equal "$PYENV_TEST_DIR/external env" "$(readlink "$PYENV_ROOT/versions/custom")"
+}
+
+@test "refuses a dangling destination link" {
+  mkdir -p "$PYENV_ROOT/versions" "$PYENV_TEST_DIR/source"
+  ln -s missing "$PYENV_ROOT/versions/dangling"
+  run pyenv-link version "$PYENV_TEST_DIR/source" dangling
+  assert_failure "Version dangling already exists"
+  assert_equal missing "$(readlink "$PYENV_ROOT/versions/dangling")"
+}
+
+@test "rejects invalid version names" {
+  mkdir -p "$PYENV_TEST_DIR/source"
+  for name in ../outside . .. 'foo/bar' 'foo:bar' system; do
+    run pyenv-link version "$PYENV_TEST_DIR/source" "$name"
+    assert_failure "pyenv-link: invalid version name \`$name'"
+    assert [ ! -e "$PYENV_ROOT/outside" ]
+  done
+  echo "prompt = '../outside'" > "$PYENV_TEST_DIR/source/pyvenv.cfg"
+  run pyenv-link version "$PYENV_TEST_DIR/source"
+  assert_failure "pyenv-link: invalid version name \`../outside'"
+  assert [ ! -e "$PYENV_ROOT/outside" ]
+}

plugins/pyenv-link/test/test_helper.bash

@@ -0,0 +1 @@
+../../../test/test_helper.bash

plugins/python-build/README.md

@@ -54,8 +54,11 @@ Or, if you would like to install the latest development release:
 
 ## Usage
 
-Before you begin, you should ensure that your build environment has the proper
-system dependencies for compiling the wanted Python Version (see our [recommendations](https://github.com/pyenv/pyenv/wiki#suggested-build-environment)).
+On Ubuntu, Debian, and Mint, install the recommended build dependencies with:
+
+    pyenv install-prerequisites
+
+For other environments, see our [build environment recommendations](https://github.com/pyenv/pyenv/wiki#suggested-build-environment).
 
 ### Using `pyenv install` with pyenv
 
@@ -361,4 +364,3 @@ git diff --name-only master \
 - Filter out any which don't live where python-build keeps its build scripts
 - Look only at the file name (i.e. the python version name)
 - Run a new docker container for each, building that version
-

plugins/python-build/bin/pyenv-install-prerequisites

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+#
+# Summary: Install Python build prerequisites on Debian-based systems
+#
+# Usage: pyenv install-prerequisites
+#
+set -e
+[ -n "$PYENV_DEBUG" ] && set -x
+
+# Provide pyenv completions
+if [ "$1" = "--complete" ]; then
+  exit
+fi
+
+usage() {
+  pyenv-help install-prerequisites 2>/dev/null
+  [ -z "$1" ] || exit "$1"
+}
+
+if [ "$1" = "-h" ] || [ "$1" = "--help" ]; then
+  usage 0
+fi
+
+[ "$#" -eq 0 ] || usage 1 >&2
+
+if ! command -v apt-get >/dev/null; then
+  echo "pyenv: installing build prerequisites is not supported on this system" >&2
+  exit 1
+fi
+
+prerequisites=(
+  make build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev
+  libsqlite3-dev curl git llvm libncurses5-dev libncursesw5-dev xz-utils
+  tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev libzstd-dev
+)
+
+if [ "$(id -u)" -eq 0 ]; then
+  apt_get=(apt-get)
+elif command -v sudo >/dev/null; then
+  apt_get=(sudo apt-get)
+else
+  echo "pyenv: sudo is required to install build prerequisites" >&2
+  exit 1
+fi
+
+"${apt_get[@]}" update -q
+"${apt_get[@]}" install -yq "${prerequisites[@]}"

plugins/python-build/bin/python-build

@@ -14,7 +14,7 @@
 #   -g/--debug       Build a debug version
 #
 
-PYTHON_BUILD_VERSION="2.8.4"
+PYTHON_BUILD_VERSION="2.8.5"
 
 OLDIFS="$IFS"
 

plugins/python-build/share/python-build/3.15.0rc1

@@ -1,11 +0,0 @@
-prefer_openssl3
-export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
-export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL_RPATH=1
-export PYTHON_BUILD_TCLTK_USE_PKGCONFIG=1
-install_package "openssl-4.0.1" "https://github.com/openssl/openssl/releases/download/openssl-4.0.1/openssl-4.0.1.tar.gz#2db3f3a0d6ea4b59e1f094ace2c8cd536dffb87cdc39084c5afa1e6f7f37dd09" mac_openssl --if has_broken_mac_openssl
-install_package "readline-8.3" "https://ftpmirror.gnu.org/readline/readline-8.3.tar.gz#fe5383204467828cd495ee8d1d3c037a7eba1389c22bc6a041f627976f9061cc" mac_readline --if has_broken_mac_readline
-if has_tar_xz_support; then
-    install_package "Python-3.15.0rc1" "https://www.python.org/ftp/python/3.15.0/Python-3.15.0rc1.tar.xz#f84dad680ab2147417d2739355c2678f0f9acffe4ae8ef77895de1454b384b07" standard verify_py315 copy_python_gdb ensurepip
-else
-    install_package "Python-3.15.0rc1" "https://www.python.org/ftp/python/3.15.0/Python-3.15.0rc1.tgz#32c2b9878bbd6ac3ceb138c5b6c880345ce9d33388b399378c0da6fc7cb3bfbc" standard verify_py315 copy_python_gdb ensurepip
-fi

plugins/python-build/share/python-build/3.15.0rc2

@@ -0,0 +1,11 @@
+prefer_openssl3
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL_RPATH=1
+export PYTHON_BUILD_TCLTK_USE_PKGCONFIG=1
+install_package "openssl-4.0.2" "https://github.com/openssl/openssl/releases/download/openssl-4.0.2/openssl-4.0.2.tar.gz#736b467530f916737b7031310ccb21d8218c6229e61e8e160cd1d3458cd543a8" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.3" "https://ftpmirror.gnu.org/readline/readline-8.3.tar.gz#fe5383204467828cd495ee8d1d3c037a7eba1389c22bc6a041f627976f9061cc" mac_readline --if has_broken_mac_readline
+if has_tar_xz_support; then
+    install_package "Python-3.15.0rc2" "https://www.python.org/ftp/python/3.15.0/Python-3.15.0rc2.tar.xz#8d93af5eaaaea5adfd41bd786a7ba3f03f2ad1ab57c6a65e0b963deab91d5ad7" standard verify_py315 copy_python_gdb ensurepip
+else
+    install_package "Python-3.15.0rc2" "https://www.python.org/ftp/python/3.15.0/Python-3.15.0rc2.tgz#164dbb80f5e1fdd8768387724bfa014da1000401b2015d872a2396c8b858b829" standard verify_py315 copy_python_gdb ensurepip
+fi

plugins/python-build/share/python-build/graalpy3.13-25.3.4.1

@@ -0,0 +1,50 @@
+# Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+# of the Software, and to permit persons to whom the Software is furnished to do
+# so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+VERSION='25.3.4.1'
+RELEASE_TAG='graal-25.3.4'
+
+colorize 1 "GraalPy 23.1 and later installed by python-build use the faster Oracle GraalVM distribution" && echo
+colorize 1 "Oracle GraalVM uses the GFTC license, which is free for development and production use, see https://medium.com/graalvm/161527df3d76" && echo
+colorize 1 "The GraalVM Community Edition variant of GraalPy is also available, under the name graalpy3.13-community-${VERSION}" && echo
+
+
+graalpy_arch="$(graalpy_architecture 2>/dev/null || true)"
+
+case "$graalpy_arch" in
+"linux-amd64" )
+  checksum="23515b4e659d645960517b0ceedb90faa84fcb01f0f4497beca5868a1b1ae3ea"
+  ;;
+"linux-aarch64" )
+  checksum="53b80e284e444540ae7cb67349af3dd8f6c1848fbf6abb5051742ac745f1f33d"
+  ;;
+"macos-aarch64" )
+  checksum="8ac33b5a5d0ee872751595211508fd826f47051ff6e6614032aed1de071eebab"
+  ;;
+* )
+  { echo
+    colorize 1 "ERROR"
+    echo ": No binary distribution of GraalPy is available for $(uname -sm)."
+    echo
+  } >&2
+  exit 1
+  ;;
+esac
+
+install_package "graalpy3.13-${VERSION}" "https://github.com/oracle/graalpython/releases/download/${RELEASE_TAG}/graalpy3.13-${VERSION}-${graalpy_arch}.tar.gz#${checksum}" "copy" ensurepip

plugins/python-build/share/python-build/graalpy3.13-community-25.3.4.1

@@ -0,0 +1,45 @@
+# Copyright (c) 2026, Oracle and/or its affiliates. All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+# of the Software, and to permit persons to whom the Software is furnished to do
+# so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+VERSION='25.3.4.1'
+RELEASE_TAG='graal-25.3.4'
+
+graalpy_arch="$(graalpy_architecture 2>/dev/null || true)"
+
+case "$graalpy_arch" in
+"linux-amd64" )
+  checksum="5e239616c8352488585f58d33991d262e8c627483741778ad43d39a4830176ad"
+  ;;
+"linux-aarch64" )
+  checksum="13007ecfe8180e91f1060de60a2ba6ce88f38faa4a36574b34143a492e8c660e"
+  ;;
+"macos-aarch64" )
+  checksum="e2cf7ae230478ad8d100ad868f75e3addb174d81e7f550322ea5e74cab066644"
+  ;;
+* )
+  { echo
+    colorize 1 "ERROR"
+    echo ": No binary distribution of GraalPy is available for $(uname -sm)."
+    echo
+  } >&2
+  exit 1
+  ;;
+esac
+
+install_package "graalpy3.13-community-${VERSION}" "https://github.com/oracle/graalpython/releases/download/${RELEASE_TAG}/graalpy3.13-community-${VERSION}-${graalpy_arch}.tar.gz#${checksum}" "copy" ensurepip

plugins/python-build/test/build.bats

@@ -1276,6 +1276,7 @@ OUT
   mkdir -p "$INSTALL_ROOT/bin"
   touch "$INSTALL_ROOT/bin/package"
   chmod -w "$INSTALL_ROOT/bin/package"
+  skip_if_nonposix_security -w "$INSTALL_ROOT/bin/package"
 
   install_fixture definitions/without-checksum
   assert_success
@@ -1288,6 +1289,7 @@ OUT
   export TMPDIR="${BATS_TEST_TMPDIR}/build"
   mkdir -p "$TMPDIR"
   chmod -w "$TMPDIR"
+  skip_if_nonposix_security -w "$TMPDIR"
 
   touch "${BATS_TEST_TMPDIR}/build-definition"
   run python-build "${BATS_TEST_TMPDIR}/build-definition" "$INSTALL_ROOT"
@@ -1298,6 +1300,7 @@ OUT
   export TMPDIR="${BATS_TEST_TMPDIR}/build"
   mkdir -p "$TMPDIR"
   chmod -x "$TMPDIR"
+  skip_if_nonposix_security -x "$TMPDIR"
 
   touch "${BATS_TEST_TMPDIR}/build-definition"
   run python-build "${BATS_TEST_TMPDIR}/build-definition" "$INSTALL_ROOT"

plugins/python-build/test/install-prerequisites.bats

@@ -0,0 +1,83 @@
+#!/usr/bin/env bats
+
+load test_helper
+
+_setup() {
+  prerequisites="make build-essential libssl-dev zlib1g-dev libbz2-dev \
+libreadline-dev libsqlite3-dev curl git llvm libncurses5-dev \
+libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev \
+liblzma-dev libzstd-dev"
+}
+
+@test "completion does not install packages" {
+  stub apt-get
+
+  PATH="${BATS_TEST_DIRNAME}/../../../libexec:$PATH" \
+    run pyenv completions install-prerequisites
+
+  assert_success "--help"
+  unstub apt-get
+}
+
+@test "supports help" {
+  stub pyenv-help 'install-prerequisites : echo "Usage: pyenv install-prerequisites"'
+
+  run pyenv-install-prerequisites --help
+
+  assert_success "Usage: pyenv install-prerequisites"
+  unstub pyenv-help
+}
+
+@test "rejects arguments" {
+  stub pyenv-help 'install-prerequisites : echo "Usage: pyenv install-prerequisites"'
+
+  run pyenv-install-prerequisites unexpected
+
+  assert_failure "Usage: pyenv install-prerequisites"
+  unstub pyenv-help
+}
+
+@test "installs build prerequisites with apt-get as root" {
+  stub id '-u : echo 0'
+  stub apt-get \
+    'update -q : true' \
+    "install -yq ${prerequisites} : true"
+
+  run pyenv-install-prerequisites
+
+  assert_success
+  unstub apt-get
+  unstub id
+}
+
+@test "uses sudo when not running as root" {
+  stub id '-u : echo 1000'
+  stub apt-get
+  stub sudo \
+    'apt-get update -q : true' \
+    "apt-get install -yq ${prerequisites} : true"
+
+  run pyenv-install-prerequisites
+
+  assert_success
+  unstub sudo
+  unstub apt-get
+  unstub id
+}
+
+@test "fails when apt-get is unavailable" {
+  PATH="$(path_without apt-get)" run pyenv-install-prerequisites
+
+  assert_failure "pyenv: installing build prerequisites is not supported on this system"
+}
+
+@test "fails when sudo is unavailable for an unprivileged user" {
+  stub id '-u : echo 1000'
+  stub apt-get
+
+  PATH="$(path_without sudo)" run pyenv-install-prerequisites
+
+  assert_failure "pyenv: sudo is required to install build prerequisites"
+  unstub apt-get
+  unstub id
+}

plugins/python-build/test/test_helper.bash

@@ -2,6 +2,7 @@ setup() {
   export PYTHON_BUILD_CURL_OPTS=
   export PYTHON_BUILD_HTTP_CLIENT="curl"
 
+  export PYENV_TEST_DIR="${BATS_TEST_TMPDIR}/pyenv"
   export FIXTURE_ROOT="${BATS_TEST_DIRNAME}/fixtures"
   export INSTALL_ROOT="${BATS_TEST_TMPDIR}/install"
   PATH="/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin"
@@ -148,7 +149,7 @@ path_without() {
       if [ "$found" != "${PYENV_ROOT}/shims" ]; then
         alt="${PYENV_TEST_DIR}/$(echo "${found#/}" | tr '/' '-')"
         mkdir -p "$alt"
-        for util in bash head cut readlink greadlink; do
+        for util in bash head cut readlink greadlink tr; do
           if [ -x "${found}/$util" ]; then
             ln -s "${found}/$util" "${alt}/$util"
           fi
@@ -162,3 +163,7 @@ path_without() {
   echo "$path"
 }
 
+skip_if_nonposix_security() {
+  true "${1:?}" "${2:?}"
+  test "$@" && skip "UNIX permission bits are being overridden" || true
+}

test/Dockerfile

@@ -12,7 +12,7 @@ FROM bash:$BASH
     apk add sed coreutils findutils \
   ;fi
   # Bats
-  RUN apk add --update parallel ncurses git \
+  RUN apk add --update parallel ncurses git binutils \
         && mkdir -p ~/.parallel \
         && touch ~/.parallel/will-cite
   COPY --from=bats /root/bats-core /root/bats-core

test/libexec/bats-format-tap-suite

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -e
+
+# Wraps Bats TAP formatter, adding file names to the output
+
+_BATS_FORMATTER_LIB_RELPATH="lib/bats-core/formatter.bash"
+source "$BATS_ROOT/$_BATS_FORMATTER_LIB_RELPATH"
+
+
+# `bats-format-tap` calls this fn at the end
+# We must stub it to be able to source and alter it
+# https://stackoverflow.com/questions/1203583/how-do-i-rename-a-bash-function
+eval orig_"$(declare -f bats_parse_internal_extended_tap)"
+bats_parse_internal_extended_tap() { true; }
+
+
+# stub sourcing lib from `bats-format-tap`
+# as that would've reset the stubbed fn
+FAKE_BATS_ROOT=
+_trap_rm_fakeroot() { rm -rf "$FAKE_BATS_ROOT"; }
+REAL_BATS_ROOT="$BATS_ROOT"
+FAKE_BATS_ROOT=$(mktemp -d)
+trap _trap_rm_fakeroot ERR EXIT
+mkdir -p "$(dirname "$FAKE_BATS_ROOT/$_BATS_FORMATTER_LIB_RELPATH")"
+touch "$FAKE_BATS_ROOT/$_BATS_FORMATTER_LIB_RELPATH"
+BATS_ROOT="$FAKE_BATS_ROOT"
+
+source "$REAL_BATS_ROOT/libexec/bats-core/bats-format-tap"
+
+_trap_rm_fakeroot
+trap - ERR EXIT
+BATS_ROOT="$REAL_BATS_ROOT"
+unset FAKE_BATS_ROOT REAL_BATS_ROOT _trap_rm_fakeroot
+
+
+# Finally, alter `bats-format-tap`'s logic and invoke it
+
+# print as "Anything" line
+bats_tap_stream_suite() { # <file name>
+  # bats only passes --base-name to specific built-in formatters
+  # so we don't have info where the test root is
+  printf '%s\n' "${1##*/}"
+}
+
+orig_bats_parse_internal_extended_tap

test/rehash.bats

@@ -13,6 +13,8 @@ load test_helper
 @test "non-writable shims directory" {
   mkdir -p "${PYENV_ROOT}/shims"
   chmod -w "${PYENV_ROOT}/shims"
+  skip_if_nonposix_security -w "${PYENV_ROOT}/shims"
+
   run pyenv-rehash
   assert_failure "pyenv: cannot rehash: ${PYENV_ROOT}/shims isn't writable"
 }

test/run

@@ -6,4 +6,4 @@ if [ -n "$PYENV_NATIVE_EXT" ]; then
   make -C src
 fi
 
-exec bats ${CI:+--tap} ${BATS_TEST_FILTER:+--filter "${BATS_TEST_FILTER}"} test/${BATS_FILE_FILTER}
+exec bats ${CI:+-F "$PWD/test/libexec/bats-format-tap-suite"} ${BATS_TEST_FILTER:+--filter "${BATS_TEST_FILTER}"} test/${BATS_FILE_FILTER}

test/shims-linked-from-elsewhere.bats

@@ -1,39 +0,0 @@
-#!/usr/bin/env bats
-
-load test_helper
-
-@test "shims linked from elsewhere are chained, other programs at the same paths are unaffected (integration)" {
-  bats_require_minimum_version 1.5.0
-  progname=shimmed_program
-  called_progname=another_program
-  create_alt_executable_in_version "custom" "$progname" <<!
-echo "called from \$0"
-pyenv-exec "$called_progname"
-!
-  pyenv-rehash
-  PATH="$(path_without "$progname" "$called_progname")"
-  for disguised_shim_path in "$BATS_TEST_TMPDIR/"{weird-location,even/weirder/location}; do
-    mkdir -p "$disguised_shim_path"
-    ln -s "${PYENV_ROOT}/shims/$progname" "$disguised_shim_path/$progname"
-    PATH="$PATH:$disguised_shim_path"
-  done
-  create_executable "$disguised_shim_path" "$called_progname" <<!
-echo "convoluted call success!"
-!
-  real_path="$BATS_TEST_TMPDIR/real-location"
-  mkdir -p "$real_path"
-  ln -s "${PYENV_ROOT}/versions/custom/bin/$progname" "$real_path/$progname"
-  PATH="$PATH:$real_path"
-  
-  run "$progname"
-  assert_success
-  assert_output <<!
-called from $real_path/$progname
-convoluted call success!
-!
-
-  rm "$real_path/$progname"
-  run -127 "$progname"
-  assert_failure
-  assert_line 0 "pyenv: shimmed_program: command not found"
-}

test/shims.bats

@@ -27,3 +27,39 @@ load test_helper
   assert_line "irb"
   assert_line "python"
 }
+
+@test "shims linked from elsewhere are chained, other programs at the same paths are unaffected (integration)" {
+  bats_require_minimum_version 1.5.0
+  progname=shimmed_program
+  called_progname=another_program
+  create_alt_executable_in_version "custom" "$progname" <<!
+echo "called from \$0"
+pyenv-exec "$called_progname"
+!
+  pyenv-rehash
+  PATH="$(path_without "$progname" "$called_progname")"
+  for disguised_shim_path in "$BATS_TEST_TMPDIR/"{weird-location,even/weirder/location}; do
+    mkdir -p "$disguised_shim_path"
+    ln -s "${PYENV_ROOT}/shims/$progname" "$disguised_shim_path/$progname"
+    PATH="$PATH:$disguised_shim_path"
+  done
+  create_executable "$disguised_shim_path" "$called_progname" <<!
+echo "convoluted call success!"
+!
+  real_path="$BATS_TEST_TMPDIR/real-location"
+  mkdir -p "$real_path"
+  ln -s "${PYENV_ROOT}/versions/custom/bin/$progname" "$real_path/$progname"
+  PATH="$PATH:$real_path"
+  
+  run "$progname"
+  assert_success
+  assert_output <<!
+called from $real_path/$progname
+convoluted call success!
+!
+
+  rm "$real_path/$progname"
+  run -127 "$progname"
+  assert_failure
+  assert_line 0 "pyenv: shimmed_program: command not found"
+}

test/test_helper.bash

@@ -2,8 +2,14 @@ unset PYENV_VERSION
 unset PYENV_DIR
 
 setup() {
-  export _PYENV_INSTALL_PREFIX="${BATS_TEST_DIRNAME%/*}"
   export PS4='+(${BASH_SOURCE}:${LINENO}): ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
+
+  export _PYENV_INSTALL_PREFIX="${BATS_TEST_DIRNAME%/*}"
+  local PLUGIN_PREFIX
+  if [[ $_PYENV_INSTALL_PREFIX =~ /plugins/[^/]+$ ]]; then
+    PLUGIN_PREFIX="$_PYENV_INSTALL_PREFIX"
+    _PYENV_INSTALL_PREFIX="${_PYENV_INSTALL_PREFIX::${#_PYENV_INSTALL_PREFIX}-${#BASH_REMATCH[0]}}"
+  fi
   if ! enable -f "${_PYENV_INSTALL_PREFIX}"/libexec/pyenv-realpath.dylib realpath 2>/dev/null; then
     if [ -n "$PYENV_NATIVE_EXT" ]; then
       echo "pyenv: failed to load \`realpath' builtin" >&2
@@ -27,6 +33,9 @@ setup() {
   PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
   PATH="${PYENV_TEST_DIR}/bin:$PATH"
   PATH="${_PYENV_INSTALL_PREFIX}/libexec:$PATH"
+  if [[ -n $PLUGIN_PREFIX ]]; then
+    PATH="${PLUGIN_PREFIX}/libexec:${PLUGIN_PREFIX}/bin:$PATH"
+  fi
   PATH="${BATS_TEST_DIRNAME}/libexec:$PATH"
   PATH="${PYENV_ROOT}/shims:$PATH"
   PATH="${BATS_TEST_TMPDIR}/stubs:$PATH"
@@ -40,6 +49,7 @@ setup() {
   # even if its output is redirected, breaking the comparison logic
   export NO_COLOR=1
 
+
   # If test specific setup exist, run it
   if [[ $(type -t _setup) == function ]];then
     _setup
@@ -165,7 +175,7 @@ path_without() {
       if [ "$found" != "${PYENV_ROOT}/shims" ]; then
         alt="${PYENV_TEST_DIR}/$(echo "${found#/}" | tr '/' '-')"
         mkdir -p "$alt"
-        for util in bash head cut readlink greadlink tr sed xargs basename sort; do
+        for util in basename bash cut dirname find greadlink gzip head mkdir readlink sed sort tar tr xargs; do
           if [ -x "${found}/$util" ]; then
             ln -s "${found}/$util" "${alt}/$util"
           fi
@@ -223,3 +233,8 @@ create_hook() {
     cat > "${PYENV_HOOK_PATH}/$1/$2"
   fi
 }
+
+skip_if_nonposix_security() {
+  true "${1:?}" "${2:?}"
+  test "$@" && skip "UNIX permission bits are being overridden" || true
+}