From 63a690539c5a9a3d90fd67ddf3f0b199df2f320d Mon Sep 17 00:00:00 2001
From: Steve Dower <steve.dower@python.org>
Date: Fri, 14 Oct 2022 16:58:54 +0100
Subject: [PATCH] gh-98251: Allow venv to pass along PYTHON* variables to pip
 and ensurepip when they do not impact path resolution (GH-98259) (cherry
 picked from commit 2fe44f728afa2dd506c304641f0481d6813d1dbd)

Co-authored-by: Steve Dower <steve.dower@python.org>
---
 Lib/test/test_venv.py                         |  8 +++---
 Lib/venv/__init__.py                          | 28 +++++++++++++------
 ...2-10-14-11-46-31.gh-issue-98251.Uxc9al.rst |  2 ++
 3 files changed, 25 insertions(+), 13 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2022-10-14-11-46-31.gh-issue-98251.Uxc9al.rst

diff --git a/Lib/test/test_venv.py b/Lib/test/test_venv.py
index eca35ec4bfd1ab..fea986b9d86840 100644
--- a/Lib/test/test_venv.py
+++ b/Lib/test/test_venv.py
@@ -159,7 +159,7 @@ def test_upgrade_dependencies(self):
             if sys.platform == 'win32':
                 expect_exe = os.path.normcase(os.path.realpath(expect_exe))
 
-            def pip_cmd_checker(cmd):
+            def pip_cmd_checker(cmd, **kwargs):
                 cmd[0] = os.path.normcase(cmd[0])
                 self.assertEqual(
                     cmd,
@@ -175,7 +175,7 @@ def pip_cmd_checker(cmd):
                 )
 
             fake_context = builder.ensure_directories(fake_env_dir)
-            with patch('venv.subprocess.check_call', pip_cmd_checker):
+            with patch('venv.subprocess.check_output', pip_cmd_checker):
                 builder.upgrade_dependencies(fake_context)
 
     @requireVenvCreate
@@ -547,8 +547,8 @@ def nicer_error(self):
         try:
             yield
         except subprocess.CalledProcessError as exc:
-            out = exc.output.decode(errors="replace")
-            err = exc.stderr.decode(errors="replace")
+            out = (exc.output or b'').decode(errors="replace")
+            err = (exc.stderr or b'').decode(errors="replace")
             self.fail(
                 f"{exc}\n\n"
                 f"**Subprocess Output**\n{out}\n\n"
diff --git a/Lib/venv/__init__.py b/Lib/venv/__init__.py
index 88520085153579..69155e5cc2ffba 100644
--- a/Lib/venv/__init__.py
+++ b/Lib/venv/__init__.py
@@ -308,14 +308,25 @@ def setup_python(self, context):
                         shutil.copyfile(src, dst)
                         break
 
+    def _call_new_python(self, context, *py_args, **kwargs):
+        """Executes the newly created Python using safe-ish options"""
+        # gh-98251: We do not want to just use '-I' because that masks
+        # legitimate user preferences (such as not writing bytecode). All we
+        # really need is to ensure that the path variables do not overrule
+        # normal venv handling.
+        args = [context.env_exec_cmd, *py_args]
+        kwargs['env'] = env = os.environ.copy()
+        env['VIRTUAL_ENV'] = context.env_dir
+        env.pop('PYTHONHOME', None)
+        env.pop('PYTHONPATH', None)
+        kwargs['cwd'] = context.env_dir
+        kwargs['executable'] = context.env_exec_cmd
+        subprocess.check_output(args, **kwargs)
+
     def _setup_pip(self, context):
         """Installs or upgrades pip in a virtual environment"""
-        # We run ensurepip in isolated mode to avoid side effects from
-        # environment vars, the current directory and anything else
-        # intended for the global Python environment
-        cmd = [context.env_exec_cmd, '-Im', 'ensurepip', '--upgrade',
-                                                         '--default-pip']
-        subprocess.check_output(cmd, stderr=subprocess.STDOUT)
+        self._call_new_python(context, '-m', 'ensurepip', '--upgrade',
+                              '--default-pip', stderr=subprocess.STDOUT)
 
     def setup_scripts(self, context):
         """
@@ -414,9 +425,8 @@ def upgrade_dependencies(self, context):
         logger.debug(
             f'Upgrading {CORE_VENV_DEPS} packages in {context.bin_path}'
         )
-        cmd = [context.env_exec_cmd, '-m', 'pip', 'install', '--upgrade']
-        cmd.extend(CORE_VENV_DEPS)
-        subprocess.check_call(cmd)
+        self._call_new_python(context, '-m', 'pip', 'install', '--upgrade',
+                              *CORE_VENV_DEPS)
 
 
 def create(env_dir, system_site_packages=False, clear=False,
diff --git a/Misc/NEWS.d/next/Library/2022-10-14-11-46-31.gh-issue-98251.Uxc9al.rst b/Misc/NEWS.d/next/Library/2022-10-14-11-46-31.gh-issue-98251.Uxc9al.rst
new file mode 100644
index 00000000000000..1a2b6a2537b996
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2022-10-14-11-46-31.gh-issue-98251.Uxc9al.rst
@@ -0,0 +1,2 @@
+Allow :mod:`venv` to pass along :envvar:`PYTHON*` variables to ``ensurepip`` and ``pip`` when
+they do not impact path resolution