#1150722 dh-virtualenv: buildsystem leaves the build path in activate scripts and long-path scripts

#1150722#5
Date:
2026-10-12 18:09:08 UTC
From:
To:
The dh_virtualenv debhelper buildsystem (dh $@ --buildsystem=dh_virtualenv)
only rewrites the "#!.../bin/python" shebangs when it copies the
virtualenv to its final location. Two kinds of files keep the build
directory:

1. bin/activate, bin/activate.csh, bin/activate.fish, bin/activate.nu
   and bin/activate.xsh are never changed, so after installing the
   package sourcing them sets VIRTUAL_ENV to the build directory, e.g.
   /build/foo/build/usr/share/python/foo, and python from the
   virtualenv is not found, in bash, fish and tcsh alike.

2. When the build path is longer than the shebang limit, pip writes the
   console scripts with a /bin/sh trampoline instead of a shebang:

       #!/bin/sh
       '''exec' /very/long/build/path/usr/share/python/foo/bin/python "$0" "$@"
       ' '''

   The exec line is not rewritten, so the installed scripts (the
   package entry points, but also bin/pip) fail with:

       exec: /very/long/build/path/.../bin/python: Permission denied

Steps to reproduce: build a package with

    export DH_VIRTUALENV_INSTALL_SUFFIX = foo
    %:
    	dh $@ --buildsystem=dh_virtualenv

install it and source /usr/share/python/foo/bin/activate. For the
second issue, build it from a directory whose path is longer than about
100 characters.

#1150722#12
Date:
2026-10-17 11:05:08 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
dh-virtualenv, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150722@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nico Della Torre <nicoz91@ubuntu.com> (supplier of updated dh-virtualenv package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 13 Oct 2026 07:02:45 +0200
Source: dh-virtualenv
Architecture: source
Version: 1.3.1
Distribution: unstable
Urgency: medium
Maintainer: Debian Python Team <team+python@tracker.debian.org>
Changed-By: Nico Della Torre <nicoz91@ubuntu.com>
Closes: 845712 856144 984767 1150720 1150721 1150722 1150894 1150896
Changes:
 dh-virtualenv (1.3.1) unstable; urgency=medium
 .
   * Accept options passed by dh as -O--name=value: the lookup included
     the value, so --python and other options with a value given to dh
     were dropped and --builtin-venv failed with a TypeError.
     Closes: #984767, #845712
   * doc/dh_virtualenv.1.rst: update the quick guide for maintainers
     (debhelper-compat 13, Python 3, no ${python:Depends}).
     Closes: #856144
   * Drop the lintian override for the pre-native changelog versions, no
     longer needed now that the previous entry is native.
   * Use python3 for --builtin-venv when --python is not given, instead
     of failing with a TypeError. Closes: #1150721
   * Replace the build path in all bin/activate* scripts instead of
     matching the VIRTUAL_ENV assignments: recent venv and virtualenv
     indent them, so bin/activate kept the build directory, and the csh
     and fish patterns also overwrote VIRTUAL_ENV_PROMPT.
     Closes: #1150720
   * Buildsystem: replace the build path in all the scripts in bin/, not
     only in the shebangs, so the activate scripts and the console scripts
     that pip writes with a /bin/sh exec line for long build paths point
     to the installed virtualenv. Closes: #1150722
   * Drop the .env autoenv development script: it is a third-party copy
     with no licence notice, wrongly covered by the Spotify AB stanza in
     debian/copyright, and is not shipped in the binary packages. Document
     building the documentation with Sphinx in README.md instead.
   * Drop the Travis, tox and invoke development files, which target
     Python 2.7-3.8 with nose. README.md: run the tests with pytest and
     describe the current release steps.
   * Dockerfile: install the build dependencies with apt-get build-dep
     instead of an outdated hardcoded list that no longer installed.
   * Stop removing dh_python2, dh_pycentral and dh_pysupport from the
     sequence: no supported release has them. Fix the list of replaced
     commands and the position of dh_virtualenv in the documentation.
   * doc: drop the Python 2 era instructions and --no-site-packages from
     the Python 3 recipe.
   * Pass --setuptools=bundle to virtualenv for --setuptools: since
     virtualenv 20 the option takes a version, so the build failed with
     "the following arguments are required: dest". Closes: #1150894
   * prerm: remove every __pycache__ directory of the virtualenv, not only
     the top-level one, so the bytecode Python writes at runtime does not
     stay behind after removal and purge. Closes: #1150896
   * Publish the documentation on Salsa Pages with a pages job in
     debian/salsa-ci.yml, and link it from README.md and the man page
     instead of the Read the Docs project, still stuck at 1.2.2.
   * doc/changes.rst: add the Debian releases from debian/changelog, with
     their distribution (unstable or UNRELEASED) and date, and point to
     the history on Salsa.
   * doc: credit the Debian Python Team as maintainer and follow the
     Debian Code of Conduct.
   * Buildsystem: report projects with only a pyproject.toml as buildable
     too (they were already installed with pip). doc: the project needs a
     pyproject.toml or a setup.py, and is installed with "pip install .".
   * d/control: Build-Depend on python3-hatchling (>= 1.26), needed for the
     PEP 639 license fields in pyproject.toml (bookworm-backports has it).
   * test: expect the DeprecationWarning of --pypi-url, --no-test and
     --setuptools-test in the tests that use them.
Checksums-Sha1:
 f277a473929931ac0fd11bb909707c7dcf7244d8 2068 dh-virtualenv_1.3.1.dsc
 6279fd5a816456f335d0526c7293965980fd4889 56652 dh-virtualenv_1.3.1.tar.xz
 6a761bf499b557ea00f6abd2cefa400909743896 7944 dh-virtualenv_1.3.1_source.buildinfo
Checksums-Sha256:
 9c1c782de411fd48facb3bbeb5532031c13e41e5bbab3a294d68e093275a161e 2068 dh-virtualenv_1.3.1.dsc
 e4a8f6412b97bf36056b5b2563825ffd8c40479d1274fd62f131ac6996fbff95 56652 dh-virtualenv_1.3.1.tar.xz
 41125d5efe7eb1acbd97b6da66f74349fe697a03dd464e4baf62df1e000e784f 7944 dh-virtualenv_1.3.1_source.buildinfo
Files:
 8085f8faa4527e38344c07f8b611364c 2068 python optional dh-virtualenv_1.3.1.dsc
 ab0ade71b988d9c75dbdf855522b5a6b 56652 python optional dh-virtualenv_1.3.1.tar.xz
 250ebbb42e902e5eb3cb3798f6ee81ed 7944 python optional dh-virtualenv_1.3.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEj23hBDd/OxHnQXSHMfMURUShdBoFAmrTUNIACgkQMfMURUSh
dBr/1g/8D/EN1lk+ZaxVbgspmjUDU3Xt00vh2lzghhx3iye/mTOM6WuPzhiXe4hi
ve5xN9UupFBJI3yIQRBIxSrE5qBCtvfW+aWjmsgUZ/P6sGsCfGExhebJNFszaPXB
A+yn8Z6TbEIyuE779fjUQlIdmAoEvH4S5wmuUSewjmLJjnYKIri3iUtp1+BFKDfb
hTME7YiRWHOBkMuhnmIkk688aWMADeClso8dkHjqIKx+guzkGnH2rIQBaPY34IzR
kbZijkBvTsrX6WpTZkU1TCy/srsQesxWWn1836y3+T/aal0K1xFCPUG9ITMUiuct
gcj4L1sGAkoL/KhvkUbjq3h/5Fxp4+8d8T3l5Ts/2TQPkHSM0vXWA0ArVtN5w35x
Gabsx6BwF/lnBHoS2SieCgZOFaymjlG55TZp0v5xphWcezK0LIqk6jhzwYv+PiyF
s2sydheBKg89AuXKj8xlzeSToeYo3Twb2IeEpqRdXPq8eQO4qT3iuDQb3OppfV0G
wehDMbRT2n2fvBOl20z9/d4mjkISfwgOVYo9dUAIWgaevIp+4Sw6OE3tQ/6wwIK7
0CHFk00Odcz0nRtQRQ7fjvWmbjrLdtj3ge2Me4MB0V0vgSj1T2ZEpO7rIFWd5YLN
P7r9PxeT4L+o9zCGHtTF1uj+K6wv6TNVtwZtw/vZlJ5F4RSmLaw=
=8TSf
-----END PGP SIGNATURE-----