2.3.3

* Fix: patterns for pypy2.*/pypy3.* versions

* Shrink pypy patterns

* Fix extglob pattern

* Fix: no regex-charclasses like '[:digit:]' in 'extglob', needs also double-activation for parse/runtime stage

Co-authored-by: native-api <vano@mail.mipt.ru>
Co-authored-by: Bjoern Schneider <bjoern.schneider@scribos.com>

CHANGELOG.md

@@ -1,5 +1,16 @@
 ## Version History
 
+## Release 2.3.3
+
+* Use version sort in `pyenv versions` (#2405)
+* Add CPython 3.11.0b4 (#2411)
+* Python-build: Replace deprecated git protocol use with https in docs (#2413)
+* Fix relative path traversal due to using version string in path (#2412)
+* Allow pypy2 and pypy3 patching (#2421, #2419)
+* Add CPython 3.11.0b5 (#2420)
+* Add GraalPython 22.2.0 (#2425)
+* Add CPython 3.10.6 (#2428)
+
 ## Release 2.3.2
 
 * Add CPython 3.11.0b2 (#2380)

CONTRIBUTING.md

@@ -1,7 +1,7 @@
 General guidance
 ================
 
-* The usual principes of respecting existing conventions and making sure that your changes
+* The usual principles of respecting existing conventions and making sure that your changes
   are in line with the overall product design apply when contributing code to Pyenv.
 
 * We are limited to Bash 3.2 features

libexec/pyenv---version

@@ -12,7 +12,7 @@
 set -e
 [ -n "$PYENV_DEBUG" ] && set -x
 
-version="2.3.2"
+version="2.3.3"
 git_revision=""
 
 if cd "${BASH_SOURCE%/*}" 2>/dev/null && git remote -v 2>/dev/null | grep -q pyenv; then

libexec/pyenv-version-file-read

@@ -11,9 +11,16 @@ if [ -s "$VERSION_FILE" ]; then
   IFS="${IFS}"$'\r'
   sep=
   while read -n 1024 -r version _ || [[ $version ]]; do
-      [[ -z $version || $version == \#* ]] && continue
-      printf "%s%s" "$sep" "$version"
-      sep=:
+    if [[ -z $version || $version == \#* ]]; then
+      # Skip empty lines and comments
+      continue
+    elif [ "$version" = ".." ] || [[ $version == */* ]]; then
+      # The version string is used to construct a path and we skip dubious values.
+      # This prevents issues such as path traversal (CVE-2022-35861).
+      continue
+    fi
+    printf "%s%s" "$sep" "$version"
+    sep=:
   done <"$VERSION_FILE"
   [[ $sep ]] && { echo; exit; }
 fi

libexec/pyenv-versions

@@ -123,7 +123,19 @@ if [ -n "$include_system" ] && \
 fi
 
 shopt -s dotglob nullglob
-for path in "$versions_dir"/*; do
+versions_dir_entries=("$versions_dir"/*)
+if sort --version-sort </dev/null >/dev/null 2>&1; then
+    # system sort supports version sorting
+    OLDIFS="$IFS"
+    IFS=$'\n'
+    versions_dir_entries=($(
+        printf "%s\n" "${versions_dir_entries[@]}" |
+        sort --version-sort
+    ))
+    IFS="$OLDIFS"
+fi
+
+for path in "${versions_dir_entries[@]}"; do
   if [ -d "$path" ]; then
     if [ -n "$skip_aliases" ] && [ -L "$path" ]; then
       target="$(realpath "$path")"

plugins/python-build/README.md

@@ -24,7 +24,7 @@ Installing python-build as a standalone program will give you access to the
 `python-build` command for precise control over Python version installation. If you
 have pyenv installed, you will also be able to use the `pyenv install` command.
 
-    git clone git://github.com/pyenv/pyenv.git
+    git clone https://github.com/pyenv/pyenv.git
     cd pyenv/plugins/python-build
     ./install.sh
 

plugins/python-build/bin/python-build

@@ -1637,10 +1637,19 @@ build_package_auto_tcltk() {
   fi
 }
 
+# extglob must be set at parse time, not at runtime
+# https://stackoverflow.com/questions/49283740/bash-script-throws-syntax-errors-when-the-extglob-option-is-set-inside-a-subsh
+#
+# The function is *parsed* with "extglob" only if an outer `shopt -s exglob`
+# exists; at *runtime* you still need to activate it *within* the function.
+#
+shopt -s extglob
 apply_python_patch() {
   local patchfile
+  # needed at runtime
+  shopt -s extglob
   case "$1" in
-  Python-* | jython-* | pypy-* | stackless-* )
+  Python-* | jython-* | pypy-* | pypy[0-9].+([0-9])-* | stackless-* )
     patchfile="$(mktemp "${TMP}/python-patch.XXXXXX")"
     cat "${2:--}" >"$patchfile"
 
@@ -1649,7 +1658,9 @@ apply_python_patch() {
     patch -p$striplevel --force -i "$patchfile"
     ;;
   esac
+  shopt -u extglob
 }
+shopt -u extglob
 
 build_package_symlink_version_suffix() {
   if [[ "$CONFIGURE_OPTS $PYTHON_CONFIGURE_OPTS" == *"--enable-framework"* ]]; then

plugins/python-build/share/python-build/3.10.6

@@ -0,0 +1,9 @@
+prefer_openssl11
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+install_package "openssl-1.1.1o" "https://www.openssl.org/source/openssl-1.1.1o.tar.gz#9384a2b0570dd80358841464677115df785edb941c71211f75076d72fe6b438f" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.1" "https://ftpmirror.gnu.org/readline/readline-8.1.tar.gz#f8ceb4ee131e3232226a17f51b164afc46cd0b9e6cef344be87c65962cb82b02" mac_readline --if has_broken_mac_readline
+if has_tar_xz_support; then
+    install_package "Python-3.10.6" "https://www.python.org/ftp/python/3.10.6/Python-3.10.6.tar.xz#f795ff87d11d4b0c7c33bc8851b0c28648d8a4583aa2100a98c22b4326b6d3f3" standard verify_py310 copy_python_gdb ensurepip
+else
+    install_package "Python-3.10.6" "https://www.python.org/ftp/python/3.10.6/Python-3.10.6.tgz#848cb06a5caa85da5c45bd7a9221bb821e33fc2bdcba088c127c58fad44e6343" standard verify_py310 copy_python_gdb ensurepip
+fi

plugins/python-build/share/python-build/3.11.0b5

@@ -3,7 +3,7 @@ export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
 install_package "openssl-1.1.1n" "https://www.openssl.org/source/openssl-1.1.1n.tar.gz#40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a" mac_openssl --if has_broken_mac_openssl
 install_package "readline-8.0" "https://ftpmirror.gnu.org/readline/readline-8.0.tar.gz#e339f51971478d369f8a053a330a190781acb9864cf4c541060f12078948e461" mac_readline --if has_broken_mac_readline
 if has_tar_xz_support; then
-    install_package "Python-3.11.0b3" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0b3.tar.xz#c9b99f5315ea30f8e9fcbce6807a3739e875480d29124e6d9940f6fabcb7c902" standard verify_py311 copy_python_gdb ensurepip
+    install_package "Python-3.11.0b5" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0b5.tar.xz#3810bd22f7dc34a99c2a2eb4b85264a4df4f05ef59c4e0ccc2ea82ee9c491698" standard verify_py311 copy_python_gdb ensurepip
 else
-    install_package "Python-3.11.0b3" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0b3.tgz#f52b738043251c88e3d6bb86e30cbf0e1098470a06b9d49feb31f145af5e8149" standard verify_py311 copy_python_gdb ensurepip
+    install_package "Python-3.11.0b5" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0b5.tgz#3f7d1a4ab0e64425f4ffd92d49de192ad2ee1c62bc52e3877e9f7b254c702e60" standard verify_py311 copy_python_gdb ensurepip
 fi

plugins/python-build/share/python-build/graalpython-22.2.0

@@ -0,0 +1,48 @@
+# Copyright (c) 2022, Oracle and/or its affiliates. All rights reserved.
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy of
+# this software and associated documentation files (the "Software"), to deal in
+# the Software without restriction, including without limitation the rights to
+# use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+# of the Software, and to permit persons to whom the Software is furnished to do
+# so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+VERSION='22.2.0'
+BUILD=''
+
+case "$(pypy_architecture 2>/dev/null || true)" in
+"linux64" )
+  graalpython_arch="linux"
+  checksum="75a7e5d7afc158169fd87df9c69c3801aa0293dd727ba09facad6b01e1b6dee5"
+  ;;
+"osx64" )
+  graalpython_arch="macos"
+  checksum="575d78ae2be8d4ce4adbc9c61229b6f1271f557f0f3ec410a494de7b29986dd7"
+  ;;
+* )
+  { echo
+    colorize 1 "ERROR"
+    echo ": No binary distribution of GraalPython is available for $(pypy_architecture 2>/dev/null || true)."
+    echo
+  } >&2
+  exit 1
+  ;;
+esac
+
+if [ -n "${BUILD}" ]; then
+  urlprefix="https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/${VERSION}-${BUILD}"
+else
+  urlprefix="https://github.com/oracle/graalpython/releases/download/vm-${VERSION}"
+fi
+
+install_package "graalpython-${VERSION}${BUILD}" "${urlprefix}/graalpython-${VERSION}-${graalpython_arch}-amd64.tar.gz#${checksum}" "graalpython" ensurepip

plugins/python-build/share/python-build/patches/3.7.13/Python-3.7.13/0001-Port-ctypes-and-system-libffi-patches-for-arm64-macO.patch

@@ -1,310 +1,310 @@
-From: Christian Hammond <christian@beanbaginc.com>
-Date: Wed, 15 Dec 2021 23:12:36 -0800
-Subject: Port ctypes and system libffi patches for arm64/macOS 10.15+ to Python 3.7.12
-
-This ports the following ctypes and libffi pyenv patches for Python
-2.7.18 to Python 3.7.12:
-
-* `0004-Use-system-libffi-for-Mac-OS-10.15-and-up.patch`
-* `0005-ctypes-use-the-correct-ABI-for-variadic-functions.patch`
-* `0006-ctypes-probe-libffi-for-ffi_closure_alloc-and-ffi_pr.patch`
-
-These patches enable use of system libffi (fixing a broken `ctypes`
-module on arm64 targets) and enable calling variadic functions on arm64.
-They've been combined from patches port from Homebrew to pyenv by Takumi
-Sueda, updated to work on the Python 3.7.12 codebase.
-
-The Homebrew patches are themselves backports of changes in Python 3.9
-and 3.10. That patch can be found at:
-
-https://github.com/Homebrew/formula-patches/blob/master/python/3.8.7.patch
-
-diff --git a/Doc/library/ctypes.rst b/Doc/library/ctypes.rst
-index 715d595b24..7743144978 100644
---- a/Doc/library/ctypes.rst
-+++ b/Doc/library/ctypes.rst
-@@ -1551,6 +1551,13 @@ They are instances of a private class:
-       value usable as argument (integer, string, ctypes instance).  This allows
-       defining adapters that can adapt custom objects as function parameters.
- 
-+   .. attribute:: variadic
-+
-+      Assign a boolean to specify that the function takes a variable number of
-+      arguments.   This does not matter on most platforms, but for Apple arm64
-+      platforms variadic functions have a different calling convention than
-+      normal functions.
-+
-    .. attribute:: errcheck
- 
-       Assign a Python function or another callable to this attribute. The
-diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
-index 4ebd82d3e0..7b73c190b6 100644
---- a/Lib/test/test_unicode.py
-+++ b/Lib/test/test_unicode.py
-@@ -2458,11 +2458,14 @@ class CAPITest(unittest.TestCase):
-     def test_from_format(self):
-         support.import_module('ctypes')
-         from ctypes import (
-+            c_char_p,
-             pythonapi, py_object, sizeof,
-             c_int, c_long, c_longlong, c_ssize_t,
-             c_uint, c_ulong, c_ulonglong, c_size_t, c_void_p)
-         name = "PyUnicode_FromFormat"
-         _PyUnicode_FromFormat = getattr(pythonapi, name)
-+        _PyUnicode_FromFormat.argtypes = (c_char_p,)
-+        _PyUnicode_FromFormat.variadic = True
-         _PyUnicode_FromFormat.restype = py_object
- 
-         def PyUnicode_FromFormat(format, *args):
-diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
-index dd0c61fd8a..79137e1dc7 100644
---- a/Modules/_ctypes/_ctypes.c
-+++ b/Modules/_ctypes/_ctypes.c
-@@ -3174,6 +3174,34 @@ PyCFuncPtr_get_restype(PyCFuncPtrObject *self, void *Py_UNUSED(ignored))
-     }
- }
- 
-+static int
-+PyCFuncPtr_set_variadic(PyCFuncPtrObject *self, PyObject *ob)
-+{
-+    StgDictObject *dict = PyObject_stgdict((PyObject *)self);
-+    assert(dict);
-+    int r = PyObject_IsTrue(ob);
-+    if (r == 1) {
-+        dict->flags |= FUNCFLAG_VARIADIC;
-+        return 0;
-+    } else if (r == 0) {
-+        dict->flags &= ~FUNCFLAG_VARIADIC;
-+        return 0;
-+    } else {
-+        return -1;
-+    }
-+}
-+
-+static PyObject *
-+PyCFuncPtr_get_variadic(PyCFuncPtrObject *self)
-+{
-+    StgDictObject *dict = PyObject_stgdict((PyObject *)self);
-+    assert(dict); /* Cannot be NULL for PyCFuncPtrObject instances */
-+    if (dict->flags & FUNCFLAG_VARIADIC)
-+        Py_RETURN_TRUE;
-+    else
-+        Py_RETURN_FALSE;
-+}
-+
- static int
- PyCFuncPtr_set_argtypes(PyCFuncPtrObject *self, PyObject *ob, void *Py_UNUSED(ignored))
- {
-@@ -3219,6 +3247,8 @@ static PyGetSetDef PyCFuncPtr_getsets[] = {
-     { "argtypes", (getter)PyCFuncPtr_get_argtypes,
-       (setter)PyCFuncPtr_set_argtypes,
-       "specify the argument types", NULL },
-+    { "variadic", (getter)PyCFuncPtr_get_variadic, (setter)PyCFuncPtr_set_variadic,
-+      "specify if function takes variable number of arguments", NULL },
-     { NULL, NULL }
- };
- 
-@@ -5632,6 +5662,7 @@ PyInit__ctypes(void)
-     PyModule_AddObject(m, "FUNCFLAG_USE_ERRNO", PyLong_FromLong(FUNCFLAG_USE_ERRNO));
-     PyModule_AddObject(m, "FUNCFLAG_USE_LASTERROR", PyLong_FromLong(FUNCFLAG_USE_LASTERROR));
-     PyModule_AddObject(m, "FUNCFLAG_PYTHONAPI", PyLong_FromLong(FUNCFLAG_PYTHONAPI));
-+    PyModule_AddObject(m, "FUNCFLAG_VARIADIC", PyLong_FromLong(FUNCFLAG_VARIADIC));
-     PyModule_AddStringConstant(m, "__version__", "1.1.0");
- 
-     PyModule_AddObject(m, "_memmove_addr", PyLong_FromVoidPtr(memmove));
-diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
-index 9cbf9801ad..e7fe11176b 100644
---- a/Modules/_ctypes/callproc.c
-+++ b/Modules/_ctypes/callproc.c
-@@ -754,7 +756,8 @@ static int _call_function_pointer(int flags,
-                                   ffi_type **atypes,
-                                   ffi_type *restype,
-                                   void *resmem,
--                                  int argcount)
-+                                  int argcount,
-+                                  int argtypecount)
- {
-     PyThreadState *_save = NULL; /* For Py_BLOCK_THREADS and Py_UNBLOCK_THREADS */
-     PyObject *error_object = NULL;
-@@ -780,15 +783,39 @@ static int _call_function_pointer(int flags,
-     if ((flags & FUNCFLAG_CDECL) == 0)
-         cc = FFI_STDCALL;
- #endif
--    if (FFI_OK != ffi_prep_cif(&cif,
--                               cc,
--                               argcount,
--                               restype,
--                               atypes)) {
--        PyErr_SetString(PyExc_RuntimeError,
--                        "ffi_prep_cif failed");
--        return -1;
-+
-+#if HAVE_FFI_PREP_CIF_VAR
-+    /* Everyone SHOULD set f.variadic=True on variadic function pointers, but
-+     * lots of existing code will not.  If there's at least one arg and more
-+     * args are passed than are defined in the prototype, then it must be a
-+     * variadic function. */
-+    if ((flags & FUNCFLAG_VARIADIC) ||
-+        (argtypecount != 0 && argcount > argtypecount))
-+    {
-+        if (FFI_OK != ffi_prep_cif_var(&cif,
-+                                       cc,
-+                                       argtypecount,
-+                                       argcount,
-+                                       restype,
-+                                       atypes)) {
-+            PyErr_SetString(PyExc_RuntimeError,
-+                            "ffi_prep_cif_var failed");
-+            return -1;
-+        }
-+    } else {
-+#endif
-+        if (FFI_OK != ffi_prep_cif(&cif,
-+                                   cc,
-+                                   argcount,
-+                                   restype,
-+                                   atypes)) {
-+            PyErr_SetString(PyExc_RuntimeError,
-+                            "ffi_prep_cif failed");
-+            return -1;
-+        }
-+#if HAVE_FFI_PREP_CIF_VAR
-     }
-+#endif
- 
-     if (flags & (FUNCFLAG_USE_ERRNO | FUNCFLAG_USE_LASTERROR)) {
-         error_object = _ctypes_get_errobj(&space);
-@@ -1187,9 +1214,8 @@ PyObject *_ctypes_callproc(PPROC pProc,
- 
-     if (-1 == _call_function_pointer(flags, pProc, avalues, atypes,
-                                      rtype, resbuf,
--                                     Py_SAFE_DOWNCAST(argcount,
--                                                      Py_ssize_t,
--                                                      int)))
-+                                     Py_SAFE_DOWNCAST(argcount, Py_ssize_t, int),
-+                                     Py_SAFE_DOWNCAST(argtype_count, Py_ssize_t, int)))
-         goto cleanup;
- 
- #ifdef WORDS_BIGENDIAN
-diff --git a/Modules/_ctypes/ctypes.h b/Modules/_ctypes/ctypes.h
-index e58f85233c..e45975f6ad 100644
---- a/Modules/_ctypes/ctypes.h
-+++ b/Modules/_ctypes/ctypes.h
-@@ -285,6 +285,7 @@ PyObject *_ctypes_callproc(PPROC pProc,
- #define FUNCFLAG_PYTHONAPI 0x4
- #define FUNCFLAG_USE_ERRNO 0x8
- #define FUNCFLAG_USE_LASTERROR 0x10
-+#define FUNCFLAG_VARIADIC 0x20
- 
- #define TYPEFLAG_ISPOINTER 0x100
- #define TYPEFLAG_HASPOINTER 0x200
-diff --git a/setup.py b/setup.py
-index bf90600eaa..48ff120e9a 100644
---- a/setup.py
-+++ b/setup.py
-@@ -142,6 +142,13 @@ def macosx_sdk_root():
- 
-     return MACOS_SDK_ROOT
- 
-+def is_macosx_at_least(vers):
-+    if host_platform == 'darwin':
-+        dep_target = sysconfig.get_config_var('MACOSX_DEPLOYMENT_TARGET')
-+        if dep_target:
-+            return tuple(map(int, str(dep_target).split('.'))) >= vers
-+    return False
-+
- def is_macosx_sdk_path(path):
-     """
-     Returns True if 'path' can be located in an OSX SDK
-@@ -150,6 +157,13 @@ def is_macosx_sdk_path(path):
-                 or path.startswith('/System/')
-                 or path.startswith('/Library/') )
- 
-+def grep_headers_for(function, headers):
-+    for header in headers:
-+        with open(header, 'r') as f:
-+            if function in f.read():
-+                return True
-+    return False
-+
- def find_file(filename, std_dirs, paths):
-     """Searches for the directory where a given file is located,
-     and returns a possibly-empty list of additional directories, or None
-@@ -1972,7 +1986,11 @@ class PyBuildExt(build_ext):
-         return True
- 
-     def detect_ctypes(self, inc_dirs, lib_dirs):
--        self.use_system_libffi = False
-+        if not sysconfig.get_config_var("LIBFFI_INCLUDEDIR") and is_macosx_at_least((10,15)):
-+            self.use_system_libffi = True
-+        else:
-+            self.use_system_libffi = '--with-system-ffi' in sysconfig.get_config_var("CONFIG_ARGS")
-+
-         include_dirs = []
-         extra_compile_args = []
-         extra_link_args = []
-@@ -2018,30 +2036,47 @@ class PyBuildExt(build_ext):
-                      libraries=['m'])
-         self.extensions.extend([ext, ext_test])
- 
-+        ffi_inc = sysconfig.get_config_var("LIBFFI_INCLUDEDIR")
-+        ffi_lib = None
-+
-         if host_platform == 'darwin':
--            if '--with-system-ffi' not in sysconfig.get_config_var("CONFIG_ARGS"):
-+            if not self.use_system_libffi:
-                 return
--            # OS X 10.5 comes with libffi.dylib; the include files are
--            # in /usr/include/ffi
--            inc_dirs.append('/usr/include/ffi')
--
--        ffi_inc = [sysconfig.get_config_var("LIBFFI_INCLUDEDIR")]
--        if not ffi_inc or ffi_inc[0] == '':
--            ffi_inc = find_file('ffi.h', [], inc_dirs)
--        if ffi_inc is not None:
--            ffi_h = ffi_inc[0] + '/ffi.h'
-+            ffi_in_sdk = os.path.join(macosx_sdk_root(), "usr/include/ffi")
-+            if os.path.exists(ffi_in_sdk):
-+                ffi_inc = ffi_in_sdk
-+                ffi_lib = 'ffi'
-+            else:
-+                # OS X 10.5 comes with libffi.dylib; the include files are
-+                # in /usr/include/ffi
-+                inc_dirs.append('/usr/include/ffi')
-+
-+        if not ffi_inc:
-+            found = find_file('ffi.h', [], inc_dirs)
-+            if found:
-+                ffi_inc = found[0]
-+        if ffi_inc:
-+            ffi_h = ffi_inc + '/ffi.h'
-             if not os.path.exists(ffi_h):
-                 ffi_inc = None
-                 print('Header file {} does not exist'.format(ffi_h))
--        ffi_lib = None
--        if ffi_inc is not None:
--            for lib_name in ('ffi', 'ffi_pic'):
-+
-+        if ffi_lib is None and ffi_inc:
-+            for lib_name in ('ffi_convenience', 'ffi_pic', 'ffi'):
-                 if (self.compiler.find_library_file(lib_dirs, lib_name)):
-                     ffi_lib = lib_name
-                     break
- 
-         if ffi_inc and ffi_lib:
--            ext.include_dirs.extend(ffi_inc)
-+            ffi_headers = glob(os.path.join(ffi_inc, '*.h'))
-+            if grep_headers_for('ffi_closure_alloc', ffi_headers):
-+                try:
-+                    sources.remove('_ctypes/malloc_closure.c')
-+                except ValueError:
-+                    pass
-+            if grep_headers_for('ffi_prep_cif_var', ffi_headers):
-+                ext.extra_compile_args.append("-DHAVE_FFI_PREP_CIF_VAR=1")
-+            ext.include_dirs.append(ffi_inc)
-             ext.libraries.append(ffi_lib)
-             self.use_system_libffi = True
- 
--- 
-2.30.1 (Apple Git-130)
-
+From: Christian Hammond <christian@beanbaginc.com>
+Date: Wed, 15 Dec 2021 23:12:36 -0800
+Subject: Port ctypes and system libffi patches for arm64/macOS 10.15+ to Python 3.7.12
+
+This ports the following ctypes and libffi pyenv patches for Python
+2.7.18 to Python 3.7.12:
+
+* `0004-Use-system-libffi-for-Mac-OS-10.15-and-up.patch`
+* `0005-ctypes-use-the-correct-ABI-for-variadic-functions.patch`
+* `0006-ctypes-probe-libffi-for-ffi_closure_alloc-and-ffi_pr.patch`
+
+These patches enable use of system libffi (fixing a broken `ctypes`
+module on arm64 targets) and enable calling variadic functions on arm64.
+They've been combined from patches port from Homebrew to pyenv by Takumi
+Sueda, updated to work on the Python 3.7.12 codebase.
+
+The Homebrew patches are themselves backports of changes in Python 3.9
+and 3.10. That patch can be found at:
+
+https://github.com/Homebrew/formula-patches/blob/master/python/3.8.7.patch
+
+diff --git a/Doc/library/ctypes.rst b/Doc/library/ctypes.rst
+index 715d595b24..7743144978 100644
+--- a/Doc/library/ctypes.rst
++++ b/Doc/library/ctypes.rst
+@@ -1551,6 +1551,13 @@ They are instances of a private class:
+       value usable as argument (integer, string, ctypes instance).  This allows
+       defining adapters that can adapt custom objects as function parameters.
+ 
++   .. attribute:: variadic
++
++      Assign a boolean to specify that the function takes a variable number of
++      arguments.   This does not matter on most platforms, but for Apple arm64
++      platforms variadic functions have a different calling convention than
++      normal functions.
++
+    .. attribute:: errcheck
+ 
+       Assign a Python function or another callable to this attribute. The
+diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
+index 4ebd82d3e0..7b73c190b6 100644
+--- a/Lib/test/test_unicode.py
++++ b/Lib/test/test_unicode.py
+@@ -2458,11 +2458,14 @@ class CAPITest(unittest.TestCase):
+     def test_from_format(self):
+         support.import_module('ctypes')
+         from ctypes import (
++            c_char_p,
+             pythonapi, py_object, sizeof,
+             c_int, c_long, c_longlong, c_ssize_t,
+             c_uint, c_ulong, c_ulonglong, c_size_t, c_void_p)
+         name = "PyUnicode_FromFormat"
+         _PyUnicode_FromFormat = getattr(pythonapi, name)
++        _PyUnicode_FromFormat.argtypes = (c_char_p,)
++        _PyUnicode_FromFormat.variadic = True
+         _PyUnicode_FromFormat.restype = py_object
+ 
+         def PyUnicode_FromFormat(format, *args):
+diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
+index dd0c61fd8a..79137e1dc7 100644
+--- a/Modules/_ctypes/_ctypes.c
++++ b/Modules/_ctypes/_ctypes.c
+@@ -3174,6 +3174,34 @@ PyCFuncPtr_get_restype(PyCFuncPtrObject *self, void *Py_UNUSED(ignored))
+     }
+ }
+ 
++static int
++PyCFuncPtr_set_variadic(PyCFuncPtrObject *self, PyObject *ob)
++{
++    StgDictObject *dict = PyObject_stgdict((PyObject *)self);
++    assert(dict);
++    int r = PyObject_IsTrue(ob);
++    if (r == 1) {
++        dict->flags |= FUNCFLAG_VARIADIC;
++        return 0;
++    } else if (r == 0) {
++        dict->flags &= ~FUNCFLAG_VARIADIC;
++        return 0;
++    } else {
++        return -1;
++    }
++}
++
++static PyObject *
++PyCFuncPtr_get_variadic(PyCFuncPtrObject *self)
++{
++    StgDictObject *dict = PyObject_stgdict((PyObject *)self);
++    assert(dict); /* Cannot be NULL for PyCFuncPtrObject instances */
++    if (dict->flags & FUNCFLAG_VARIADIC)
++        Py_RETURN_TRUE;
++    else
++        Py_RETURN_FALSE;
++}
++
+ static int
+ PyCFuncPtr_set_argtypes(PyCFuncPtrObject *self, PyObject *ob, void *Py_UNUSED(ignored))
+ {
+@@ -3219,6 +3247,8 @@ static PyGetSetDef PyCFuncPtr_getsets[] = {
+     { "argtypes", (getter)PyCFuncPtr_get_argtypes,
+       (setter)PyCFuncPtr_set_argtypes,
+       "specify the argument types", NULL },
++    { "variadic", (getter)PyCFuncPtr_get_variadic, (setter)PyCFuncPtr_set_variadic,
++      "specify if function takes variable number of arguments", NULL },
+     { NULL, NULL }
+ };
+ 
+@@ -5632,6 +5662,7 @@ PyInit__ctypes(void)
+     PyModule_AddObject(m, "FUNCFLAG_USE_ERRNO", PyLong_FromLong(FUNCFLAG_USE_ERRNO));
+     PyModule_AddObject(m, "FUNCFLAG_USE_LASTERROR", PyLong_FromLong(FUNCFLAG_USE_LASTERROR));
+     PyModule_AddObject(m, "FUNCFLAG_PYTHONAPI", PyLong_FromLong(FUNCFLAG_PYTHONAPI));
++    PyModule_AddObject(m, "FUNCFLAG_VARIADIC", PyLong_FromLong(FUNCFLAG_VARIADIC));
+     PyModule_AddStringConstant(m, "__version__", "1.1.0");
+ 
+     PyModule_AddObject(m, "_memmove_addr", PyLong_FromVoidPtr(memmove));
+diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
+index 9cbf9801ad..e7fe11176b 100644
+--- a/Modules/_ctypes/callproc.c
++++ b/Modules/_ctypes/callproc.c
+@@ -754,7 +756,8 @@ static int _call_function_pointer(int flags,
+                                   ffi_type **atypes,
+                                   ffi_type *restype,
+                                   void *resmem,
+-                                  int argcount)
++                                  int argcount,
++                                  int argtypecount)
+ {
+     PyThreadState *_save = NULL; /* For Py_BLOCK_THREADS and Py_UNBLOCK_THREADS */
+     PyObject *error_object = NULL;
+@@ -780,15 +783,39 @@ static int _call_function_pointer(int flags,
+     if ((flags & FUNCFLAG_CDECL) == 0)
+         cc = FFI_STDCALL;
+ #endif
+-    if (FFI_OK != ffi_prep_cif(&cif,
+-                               cc,
+-                               argcount,
+-                               restype,
+-                               atypes)) {
+-        PyErr_SetString(PyExc_RuntimeError,
+-                        "ffi_prep_cif failed");
+-        return -1;
++
++#if HAVE_FFI_PREP_CIF_VAR
++    /* Everyone SHOULD set f.variadic=True on variadic function pointers, but
++     * lots of existing code will not.  If there's at least one arg and more
++     * args are passed than are defined in the prototype, then it must be a
++     * variadic function. */
++    if ((flags & FUNCFLAG_VARIADIC) ||
++        (argtypecount != 0 && argcount > argtypecount))
++    {
++        if (FFI_OK != ffi_prep_cif_var(&cif,
++                                       cc,
++                                       argtypecount,
++                                       argcount,
++                                       restype,
++                                       atypes)) {
++            PyErr_SetString(PyExc_RuntimeError,
++                            "ffi_prep_cif_var failed");
++            return -1;
++        }
++    } else {
++#endif
++        if (FFI_OK != ffi_prep_cif(&cif,
++                                   cc,
++                                   argcount,
++                                   restype,
++                                   atypes)) {
++            PyErr_SetString(PyExc_RuntimeError,
++                            "ffi_prep_cif failed");
++            return -1;
++        }
++#if HAVE_FFI_PREP_CIF_VAR
+     }
++#endif
+ 
+     if (flags & (FUNCFLAG_USE_ERRNO | FUNCFLAG_USE_LASTERROR)) {
+         error_object = _ctypes_get_errobj(&space);
+@@ -1187,9 +1214,8 @@ PyObject *_ctypes_callproc(PPROC pProc,
+ 
+     if (-1 == _call_function_pointer(flags, pProc, avalues, atypes,
+                                      rtype, resbuf,
+-                                     Py_SAFE_DOWNCAST(argcount,
+-                                                      Py_ssize_t,
+-                                                      int)))
++                                     Py_SAFE_DOWNCAST(argcount, Py_ssize_t, int),
++                                     Py_SAFE_DOWNCAST(argtype_count, Py_ssize_t, int)))
+         goto cleanup;
+ 
+ #ifdef WORDS_BIGENDIAN
+diff --git a/Modules/_ctypes/ctypes.h b/Modules/_ctypes/ctypes.h
+index e58f85233c..e45975f6ad 100644
+--- a/Modules/_ctypes/ctypes.h
++++ b/Modules/_ctypes/ctypes.h
+@@ -285,6 +285,7 @@ PyObject *_ctypes_callproc(PPROC pProc,
+ #define FUNCFLAG_PYTHONAPI 0x4
+ #define FUNCFLAG_USE_ERRNO 0x8
+ #define FUNCFLAG_USE_LASTERROR 0x10
++#define FUNCFLAG_VARIADIC 0x20
+ 
+ #define TYPEFLAG_ISPOINTER 0x100
+ #define TYPEFLAG_HASPOINTER 0x200
+diff --git a/setup.py b/setup.py
+index bf90600eaa..48ff120e9a 100644
+--- a/setup.py
++++ b/setup.py
+@@ -142,6 +142,13 @@ def macosx_sdk_root():
+ 
+     return MACOS_SDK_ROOT
+ 
++def is_macosx_at_least(vers):
++    if host_platform == 'darwin':
++        dep_target = sysconfig.get_config_var('MACOSX_DEPLOYMENT_TARGET')
++        if dep_target:
++            return tuple(map(int, str(dep_target).split('.'))) >= vers
++    return False
++
+ def is_macosx_sdk_path(path):
+     """
+     Returns True if 'path' can be located in an OSX SDK
+@@ -150,6 +157,13 @@ def is_macosx_sdk_path(path):
+                 or path.startswith('/System/')
+                 or path.startswith('/Library/') )
+ 
++def grep_headers_for(function, headers):
++    for header in headers:
++        with open(header, 'r') as f:
++            if function in f.read():
++                return True
++    return False
++
+ def find_file(filename, std_dirs, paths):
+     """Searches for the directory where a given file is located,
+     and returns a possibly-empty list of additional directories, or None
+@@ -1972,7 +1986,11 @@ class PyBuildExt(build_ext):
+         return True
+ 
+     def detect_ctypes(self, inc_dirs, lib_dirs):
+-        self.use_system_libffi = False
++        if not sysconfig.get_config_var("LIBFFI_INCLUDEDIR") and is_macosx_at_least((10,15)):
++            self.use_system_libffi = True
++        else:
++            self.use_system_libffi = '--with-system-ffi' in sysconfig.get_config_var("CONFIG_ARGS")
++
+         include_dirs = []
+         extra_compile_args = []
+         extra_link_args = []
+@@ -2018,30 +2036,47 @@ class PyBuildExt(build_ext):
+                      libraries=['m'])
+         self.extensions.extend([ext, ext_test])
+ 
++        ffi_inc = sysconfig.get_config_var("LIBFFI_INCLUDEDIR")
++        ffi_lib = None
++
+         if host_platform == 'darwin':
+-            if '--with-system-ffi' not in sysconfig.get_config_var("CONFIG_ARGS"):
++            if not self.use_system_libffi:
+                 return
+-            # OS X 10.5 comes with libffi.dylib; the include files are
+-            # in /usr/include/ffi
+-            inc_dirs.append('/usr/include/ffi')
+-
+-        ffi_inc = [sysconfig.get_config_var("LIBFFI_INCLUDEDIR")]
+-        if not ffi_inc or ffi_inc[0] == '':
+-            ffi_inc = find_file('ffi.h', [], inc_dirs)
+-        if ffi_inc is not None:
+-            ffi_h = ffi_inc[0] + '/ffi.h'
++            ffi_in_sdk = os.path.join(macosx_sdk_root(), "usr/include/ffi")
++            if os.path.exists(ffi_in_sdk):
++                ffi_inc = ffi_in_sdk
++                ffi_lib = 'ffi'
++            else:
++                # OS X 10.5 comes with libffi.dylib; the include files are
++                # in /usr/include/ffi
++                inc_dirs.append('/usr/include/ffi')
++
++        if not ffi_inc:
++            found = find_file('ffi.h', [], inc_dirs)
++            if found:
++                ffi_inc = found[0]
++        if ffi_inc:
++            ffi_h = ffi_inc + '/ffi.h'
+             if not os.path.exists(ffi_h):
+                 ffi_inc = None
+                 print('Header file {} does not exist'.format(ffi_h))
+-        ffi_lib = None
+-        if ffi_inc is not None:
+-            for lib_name in ('ffi', 'ffi_pic'):
++
++        if ffi_lib is None and ffi_inc:
++            for lib_name in ('ffi_convenience', 'ffi_pic', 'ffi'):
+                 if (self.compiler.find_library_file(lib_dirs, lib_name)):
+                     ffi_lib = lib_name
+                     break
+ 
+         if ffi_inc and ffi_lib:
+-            ext.include_dirs.extend(ffi_inc)
++            ffi_headers = glob(os.path.join(ffi_inc, '*.h'))
++            if grep_headers_for('ffi_closure_alloc', ffi_headers):
++                try:
++                    sources.remove('_ctypes/malloc_closure.c')
++                except ValueError:
++                    pass
++            if grep_headers_for('ffi_prep_cif_var', ffi_headers):
++                ext.extra_compile_args.append("-DHAVE_FFI_PREP_CIF_VAR=1")
++            ext.include_dirs.append(ffi_inc)
+             ext.libraries.append(ffi_lib)
+             self.use_system_libffi = True
+ 
+-- 
+2.30.1 (Apple Git-130)
+

plugins/python-build/share/python-build/patches/3.7.13/Python-3.7.13/0002-bpo-41100-fix-_decimal-for-arm64-Mac-OS-GH-21228.patch

@@ -1,36 +1,36 @@
-From 604d95e235d86465b8c17f02095edcaf18464d4c Mon Sep 17 00:00:00 2001
-From: Lawrence D'Anna <64555057+lawrence-danna-apple@users.noreply.github.com>
-Date: Tue, 30 Jun 2020 02:15:46 -0700
-Subject: [PATCH] bpo-41100: fix _decimal for arm64 Mac OS (GH-21228)
-
-Patch by Lawrence Danna.
----
- .../Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst | 1 +
- Modules/_decimal/libmpdec/mpdecimal.h                          | 3 +++
- 2 files changed, 4 insertions(+)
- create mode 100644 Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst
-
-diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst
-new file mode 100644
-index 0000000000..d6176d69f0
---- /dev/null
-+++ b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst	
-@@ -0,0 +1 @@
-+add arm64 to the allowable Mac OS arches in mpdecimal.h
-\ No newline at end of file
-diff --git a/Modules/_decimal/libmpdec/mpdecimal.h b/Modules/_decimal/libmpdec/mpdecimal.h
-index 108b76efa8..35ce429f60 100644
---- a/Modules/_decimal/libmpdec/mpdecimal.h
-+++ b/Modules/_decimal/libmpdec/mpdecimal.h
-@@ -135,6 +135,9 @@ const char *mpd_version(void);
-   #elif defined(__x86_64__)
-     #define CONFIG_64
-     #define ASM
-+  #elif defined(__arm64__)
-+    #define CONFIG_64
-+    #define ANSI
-   #else
-     #error "unknown architecture for universal build."
-   #endif
--- 
-2.30.1 (Apple Git-130)
+From 604d95e235d86465b8c17f02095edcaf18464d4c Mon Sep 17 00:00:00 2001
+From: Lawrence D'Anna <64555057+lawrence-danna-apple@users.noreply.github.com>
+Date: Tue, 30 Jun 2020 02:15:46 -0700
+Subject: [PATCH] bpo-41100: fix _decimal for arm64 Mac OS (GH-21228)
+
+Patch by Lawrence Danna.
+---
+ .../Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst | 1 +
+ Modules/_decimal/libmpdec/mpdecimal.h                          | 3 +++
+ 2 files changed, 4 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst
+
+diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst
+new file mode 100644
+index 0000000000..d6176d69f0
+--- /dev/null
++++ b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst	
+@@ -0,0 +1 @@
++add arm64 to the allowable Mac OS arches in mpdecimal.h
+\ No newline at end of file
+diff --git a/Modules/_decimal/libmpdec/mpdecimal.h b/Modules/_decimal/libmpdec/mpdecimal.h
+index 108b76efa8..35ce429f60 100644
+--- a/Modules/_decimal/libmpdec/mpdecimal.h
++++ b/Modules/_decimal/libmpdec/mpdecimal.h
+@@ -135,6 +135,9 @@ const char *mpd_version(void);
+   #elif defined(__x86_64__)
+     #define CONFIG_64
+     #define ASM
++  #elif defined(__arm64__)
++    #define CONFIG_64
++    #define ANSI
+   #else
+     #error "unknown architecture for universal build."
+   #endif
+-- 
+2.30.1 (Apple Git-130)

plugins/python-build/share/python-build/patches/3.7.13/Python-3.7.13/0003-bpo-42351-Avoid-error-when-opening-header-with-non-U.patch

@@ -1,30 +1,30 @@
-From 245427d207ee88a4ba26a66c3de350bcbcc036f2 Mon Sep 17 00:00:00 2001
-From: Ronald Oussoren <ronaldoussoren@mac.com>
-Date: Sat, 14 Nov 2020 16:07:47 +0100
-Subject: [PATCH] bpo-42351: Avoid error when opening header with non-UTF8
- encoding (GH-23279)
-
-grep_headers_for() would error out when a header contained
-text that cannot be interpreted as UTF-8.
-
-cherry-picked from 7a27c7ed4b by Pedro Fonini <fonini@ip.tv>
----
- setup.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index f211989aac..467362813d 100644
---- a/setup.py
-+++ b/setup.py
-@@ -159,7 +159,7 @@ def is_macosx_sdk_path(path):
- 
- def grep_headers_for(function, headers):
-     for header in headers:
--        with open(header, 'r') as f:
-+        with open(header, 'r', errors='surrogateescape') as f:
-             if function in f.read():
-                 return True
-     return False
--- 
-2.34.1
-
+From 245427d207ee88a4ba26a66c3de350bcbcc036f2 Mon Sep 17 00:00:00 2001
+From: Ronald Oussoren <ronaldoussoren@mac.com>
+Date: Sat, 14 Nov 2020 16:07:47 +0100
+Subject: [PATCH] bpo-42351: Avoid error when opening header with non-UTF8
+ encoding (GH-23279)
+
+grep_headers_for() would error out when a header contained
+text that cannot be interpreted as UTF-8.
+
+cherry-picked from 7a27c7ed4b by Pedro Fonini <fonini@ip.tv>
+---
+ setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index f211989aac..467362813d 100644
+--- a/setup.py
++++ b/setup.py
+@@ -159,7 +159,7 @@ def is_macosx_sdk_path(path):
+ 
+ def grep_headers_for(function, headers):
+     for header in headers:
+-        with open(header, 'r') as f:
++        with open(header, 'r', errors='surrogateescape') as f:
+             if function in f.read():
+                 return True
+     return False
+-- 
+2.34.1
+

test/version-file-read.bats

@@ -82,3 +82,15 @@ IN
   run pyenv-version-file-read my-version
   assert_success "3.9.3:3.8.9:2.7.16"
 }
+
+@test "skips relative path traversal" {
+  cat > my-version <<IN
+3.9.3
+3.8.9
+  ..
+./*
+2.7.16
+IN
+  run pyenv-version-file-read my-version
+  assert_success "3.9.3:3.8.9:2.7.16"
+}

test/versions.bats

@@ -17,6 +17,14 @@ stub_system_python() {
   touch "$stub" && chmod +x "$stub"
 }
 
+create_executable() {
+  local name="$1"
+  local bin="${PYENV_TEST_DIR}/bin"
+  mkdir -p "$bin"
+  sed -Ee '1s/^ +//' > "${bin}/$name"
+  chmod +x "${bin}/$name"
+}
+
 @test "no versions installed" {
   stub_system_python
   assert [ ! -d "${PYENV_ROOT}/versions" ]
@@ -161,3 +169,44 @@ OUT
   run pyenv-versions --bare
   assert_success ".venv"
 }
+
+@test "sort supports version sorting" {
+  create_version "1.9.0"
+  create_version "1.53.0"
+  create_version "1.218.0"
+  create_executable sort <<SH
+#!$BASH
+if [ "\$1" == "--version-sort" ]; then
+  echo "${PYENV_ROOT}/versions/1.9.0"
+  echo "${PYENV_ROOT}/versions/1.53.0"
+  echo "${PYENV_ROOT}/versions/1.218.0"
+else exit 1
+fi
+SH
+
+  run pyenv-versions --bare
+  assert_success
+  assert_output <<OUT
+1.9.0
+1.53.0
+1.218.0
+OUT
+}
+
+@test "sort doesn't support version sorting" {
+  create_version "1.9.0"
+  create_version "1.53.0"
+  create_version "1.218.0"
+  create_executable sort <<SH
+#!$BASH
+exit 1
+SH
+
+  run pyenv-versions --bare
+  assert_success
+  assert_output <<OUT
+1.218.0
+1.53.0
+1.9.0
+OUT
+}