Merge branch 'master' of https://github.com/pyenv/pyenv

Build CPython 3.12+ with --with-dsymutil in MacOS

.github/workflows/macos_build.yml

@@ -6,11 +6,11 @@ jobs:
       fail-fast: false
       matrix:
         python-version:
-          - 3.7.10
+          - 3.7.13
-          - 3.8.10
+          - 3.8.13
-          - 3.9.5
+          - 3.9.13
-          - 3.10.0
+          - 3.10.6
-    runs-on: macos-10.15
+    runs-on: macos-11
     steps:
       - uses: actions/checkout@v2
       # Normally, we would use the superbly maintained...
@@ -27,7 +27,7 @@ jobs:
         run: |
           echo $PYENV_ROOT
           echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
-          bin/pyenv install ${{ matrix.python-version }}
+          bin/pyenv install -v ${{ matrix.python-version }}
           bin/pyenv global ${{ matrix.python-version }}
           bin/pyenv rehash
       - run: python --version

.github/workflows/modified_scripts_build.yml

@@ -12,7 +12,7 @@ jobs:
         run: >
           versions=$(git diff "origin/$GITHUB_BASE_REF" --name-only -z
           | perl -ne 'BEGIN {$\="\n";$/="\0";} chomp;
-            if (/^plugins\/python-build\/share\/python-build\/(?:([^\/]+)|patches\/([^\/]+)\/.*)$/)
+            if (/^plugins\/python-build\/share\/python-build\/(?:([^\/]+)|patches\/([^\/]+)\/.*)$/ and -e $& )
                 { print $1.$2; }' \
           | sort -u);
           echo -e "versions<<!\\n$versions\\n!" >> $GITHUB_ENV
@@ -27,7 +27,7 @@ jobs:
       fail-fast: false
       matrix:
         python-version: ${{fromJson(needs.discover_modified_scripts.outputs.versions)}}
-        os: ["macos-10.15", "macos-11"]
+        os: ["macos-11", "macos-12"]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
@@ -38,22 +38,33 @@ jobs:
           echo "PYENV_ROOT=$PYENV_ROOT" >> $GITHUB_ENV
           echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
       - run: |
-          pyenv install ${{ matrix.python-version }}
+          pyenv install -v ${{ matrix.python-version }}
           pyenv global ${{ matrix.python-version }}
-      - run: |
+      # Micropython doesn't support --version
-          python --version
+      - run: >
-          python -m pip --version
+          if [[ "${{ matrix.python-version }}" == "micropython-"* ]]; then
-      - shell: python  # Prove that actual Python == expected Python
+            python -c 'import sys; print(sys.version)'
-        env:
+          else
+            python --version;
+            python -m pip --version
+          fi
+      # Micropython doesn't support sys.executable, os.path, older versions even os
+      - env:
           EXPECTED_PYTHON: ${{ matrix.python-version }}
         run: |
-          import os, sys, os.path
+          if [[ "${{ matrix.python-version }}" == "micropython-"* ]]; then
-          correct_dir = os.path.join(
+            [[ $(pyenv which python) == "${{ env.PYENV_ROOT }}/versions/${{ matrix.python-version }}/bin/python" ]] || exit 1
-              os.environ['PYENV_ROOT'],
+            python -c 'import sys; assert sys.implementation.name == "micropython"'
-              'versions',
+          else
-              os.environ['EXPECTED_PYTHON'],
+            python -c 'if True:
-              'bin')
+            import os, sys, os.path
-          assert os.path.dirname(sys.executable) == correct_dir
+            correct_dir = os.path.join(
+              os.environ["PYENV_ROOT"],
+              "versions",
+              os.environ["EXPECTED_PYTHON"],
+              "bin")
+            assert os.path.dirname(sys.executable) == correct_dir'
+          fi
       # bundled executables in some Anaconda releases cause the post-run step to hang in MacOS
       - run: |
           pyenv global system
@@ -66,32 +77,44 @@ jobs:
       fail-fast: false
       matrix:
         python-version: ${{fromJson(needs.discover_modified_scripts.outputs.versions)}}
-        os: ["ubuntu-18.04", "ubuntu-20.04"]
+        os: ["ubuntu-20.04", "ubuntu-22.04"]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2
       - run: |
-          sudo apt-get update -q; sudo apt-get install -yq build-essential \
+          sudo apt-get update -q; sudo apt-get install -yq make build-essential \
             libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev \
-            wget curl llvm libncurses5-dev libncursesw5-dev \
+            curl llvm libncurses5-dev libncursesw5-dev \
-            xz-utils tk-dev libffi-dev liblzma-dev python-openssl git
+            xz-utils tk-dev libffi-dev liblzma-dev
       - run: |
           export PYENV_ROOT="$GITHUB_WORKSPACE"
           echo "PYENV_ROOT=$PYENV_ROOT" >> $GITHUB_ENV
           echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
       - run: |
-          pyenv install ${{ matrix.python-version }}
+          pyenv install -v ${{ matrix.python-version }}
           pyenv global ${{ matrix.python-version }}
-      - run: python --version
+      # Micropython doesn't support --version
-      - run: python -m pip --version
+      - run: >
-      - shell: python  # Prove that actual Python == expected Python
+          if [[ "${{ matrix.python-version }}" == "micropython-"* ]]; then
-        env:
+            python -c 'import sys; print(sys.version)'
+          else
+            python --version;
+            python -m pip --version
+          fi
+      # Micropython doesn't support sys.executable, os.path, older versions even os
+      - env:
           EXPECTED_PYTHON: ${{ matrix.python-version }}
         run: |
-          import os, sys, os.path
+          if [[ "${{ matrix.python-version }}" == "micropython-"* ]]; then
-          correct_dir = os.path.join(
+            [[ $(pyenv which python) == "${{ env.PYENV_ROOT }}/versions/${{ matrix.python-version }}/bin/python" ]] || exit 1
-              os.environ['PYENV_ROOT'],
+            python -c 'import sys; assert sys.implementation.name == "micropython"'
-              'versions',
+          else
-              os.environ['EXPECTED_PYTHON'],
+            python -c 'if True:
-              'bin')
+            import os, sys, os.path
-          assert os.path.dirname(sys.executable) == correct_dir
+            correct_dir = os.path.join(
+              os.environ["PYENV_ROOT"],
+              "versions",
+              os.environ["EXPECTED_PYTHON"],
+              "bin")
+            assert os.path.dirname(sys.executable) == correct_dir'
+          fi

.github/workflows/pyenv_tests.yml

@@ -6,10 +6,10 @@ jobs:
       fail-fast: false
       matrix:
         os:
+          - ubuntu-22.04
           - ubuntu-20.04
-          - ubuntu-18.04
+          - macos-12
           - macos-11
-          - macos-10.15
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v2

.github/workflows/ubuntu_build.yml

@@ -6,11 +6,11 @@ jobs:
       fail-fast: false
       matrix:
         python-version:
-          - 3.7.10
+          - 3.7.13
-          - 3.8.10
+          - 3.8.13
-          - 3.9.5
+          - 3.9.13
-          - 3.10.0
+          - 3.10.6
-    runs-on: Ubuntu-20.04
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v2
       # Normally, we would use the superbly maintained...
@@ -19,9 +19,9 @@ jobs:
       #    python-version: ${{ matrix.python-version }}
       # ... but in the repo, we want to test pyenv builds on Ubuntu
       - run: |
-          sudo apt-get install -y build-essential libssl-dev zlib1g-dev libbz2-dev \
+          sudo apt-get install -yq make build-essential libssl-dev zlib1g-dev \
-              libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev libncursesw5-dev \
+          libbz2-dev libreadline-dev libsqlite3-dev curl \
-              xz-utils tk-dev libffi-dev liblzma-dev python-openssl git
+          libncursesw5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev
       # https://github.com/pyenv/pyenv#installation
       - run: pwd
       - env:
@@ -29,7 +29,7 @@ jobs:
         run: |
           echo $PYENV_ROOT
           echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
-          bin/pyenv install ${{ matrix.python-version }}
+          bin/pyenv install -v ${{ matrix.python-version }}
           bin/pyenv global ${{ matrix.python-version }}
           bin/pyenv rehash
       - run: python --version

.travis.yml

@@ -1,83 +0,0 @@
-# Two types of tests:
-#
-# 1. shell tests run using bats
-# 2. build tests also run using bats
-#
-# Shell tests are run unconditionally on Linux (see jobs.include).
-#
-# Build tests can be skipped by starting the commit message with
-# '[skip build]'.
-#
-# Build tests are run on platforms generated from all combinations
-# of keys below.
-language: c
-
-os:
-- linux
-- osx
-
-dist:
-- focal
-
-# https://docs.travis-ci.com/user/reference/osx/#macos-version
-osx_image:
-- xcode9.4.1  # macOS 10.13.6
-- xcode10.3   # macOS 10.14.4
-- xcode11.6   # macOS 10.15.7
-- xcode12.2   # macOS 10.15.7
-
-env:
-- PYTHON_BUILD_VERSION=3.9.1
-- PYTHON_BUILD_VERSION=3.7.5
-
-before_install:
-- date +%Y-%m-%dT%H:%M:%S
-
-install: git clone --depth 1 --branch v1.2.0 https://github.com/bats-core/bats-core.git bats
-
-# Default for auto-generated jobs.
-script: make test-build
-
-jobs:
-  include:
-  # Shell-based tests should execute every time.
-  - stage: test shell
-    script: make test
-    env: PYENV_NATIVE_EXT=1
-    after_script: []
-    os: linux
-  - stage: test shell
-    script: make test
-    env: PYENV_NATIVE_EXT=
-    after_script: []
-    os: linux
-
-  exclude:
-  # For each osx_image but one there should be an entry in the exclude
-  # list, to prevent duplicate Linux builds.
-  - os: linux
-    osx_image: xcode9.4
-  - os: linux
-    osx_image: xcode10
-
-  allow_failures:
-  - env: PYTHON_BUILD_VERSION=3.9.1
-
-stages:
-- test shell
-- name: test
-  if: NOT (commit_message =~ /^\[skip build\]/)
-
-# Default 
-
-notifications:
-  email:
-    on_success: never
-
-deploy:
-  provider: releases
-  api_key:
-    secure: FLWevL09KYp7V1SjJUNEdWzuomuocXwNvPr1DSAFH7mmrjKTtjzwrjINAthSqzjlDrs5B//P47l1VLyHp5byEzy673W+bOmEg8swmqc7E9FrHLRyEByd/yca3DzkZgXEXgGdY/cl7tHhM4V2fYKEgAIWbFV+takmTFMK4WkEtNg=
-  on:
-    repo: pyenv/pyenv
-    tags: true

CHANGELOG.md

@@ -1,5 +1,28 @@
 ## Version History
 
+## Release 2.3.5
+
+* Add CPython 3.10.7 (#2454)
+* Docs: update Fish PATH update (#2449)
+* Add CPython 3.7.14, 3.8.14 and 3.9.14 (#2456)
+* Update miniconda3-3.9-4.12.0 (#2460)
+* Add CPython 3.11.0rc2 (#2459)
+* Add patches for 3.7.14 to support Apple Silicon (#2463)
+* Add ability to skip all use of Homebrew (#2464)
+* Drop Travis integration (#2468)
+* Build CPython 3.12+ with --with-dsymutil in MacOS (#2471)
+* Add Pyston 2.3.5 (#2476)
+
+## Release 2.3.4
+
+* Add CPython 3.11.0rc1 (#2434)
+* Add support for multiple versions in `pyenv uninstall` (#2432)
+* Add micropython 1.18 and 1.19.1 (#2443)
+* CI: support Micropython, deleted scripts; build with -v (#2447)
+* Re-allow paths in .python-version while still preventing CVE-2022-35861 (#2442)
+* CI: Bump OS versions (#2448)
+* Add Cinder 3.8 (#2433)
+
 ## Release 2.3.3
 
 * Use version sort in `pyenv versions` (#2405)

COMMANDS.md

@@ -238,9 +238,9 @@ To install the latest major release for Python 3 try:
 
 ## `pyenv uninstall`
 
-Uninstall a specific Python version.
+Uninstall Python versions.
 
-    Usage: pyenv uninstall [-f|--force] <version>
+    Usage: pyenv uninstall [-f|--force] <version> ...
 
        -f  Attempt to remove the specified version without prompting
            for confirmation. If the version does not exist, do not

CONTRIBUTING.md

@@ -9,6 +9,9 @@ General guidance
   That's because that's the version shipped with MacOS.
   (They didn't upgrade past it and switched to Zsh because later versions
   are covered by GPLv3 which has additional restrictions unacceptable for Apple.)
+  
+  You can still add performance optimizations etc that take advantage of newer Bash features
+  as long as there is a fallback execution route for Bash 3.
 
 * Be extra careful when submitting logic specific for the Apple Silicon platform
 

Makefile

@@ -1,11 +1,15 @@
-.PHONY: test test-build
+.PHONY: test test-build test-unit test-plugin
 
 # Do not pass in user flags to build tests.
 unexport PYTHON_CFLAGS
 unexport PYTHON_CONFIGURE_OPTS
 
-test: bats
+test: test-unit test-plugin
+
+test-unit: bats
 	PATH="./bats/bin:$$PATH" test/run
+	
+test-plugin: bats
 	cd plugins/python-build && $(PWD)/bats/bin/bats $${CI:+--tap} test
 
 PYTHON_BUILD_ROOT := $(CURDIR)/plugins/python-build

README.md

@@ -288,7 +288,7 @@ See [Advanced configuration](#advanced-configuration) for details and more confi
     configuration commands to both `.bashrc` (for interactive shells)
     and the profile file that Bash would use (for login shells).
 
-    First, add the commands to `~/.bashrc`:
+    First, add the commands to `~/.bashrc` by running the following in your terminal:
 
     ~~~ bash
     echo 'export PYENV_ROOT="$HOME/.pyenv"' >> ~/.bashrc
@@ -324,14 +324,21 @@ See [Advanced configuration](#advanced-configuration) for details and more confi
 
   - For **Fish shell**:
 
-    Execute this interactively:
+    If you have Fish 3.2.0 or newer, execute this interactively:
+
+    ~~~ fish
+    set -Ux PYENV_ROOT $HOME/.pyenv
+    fish_add_path $PYENV_ROOT/bin
+    ~~~
+
+    Otherwise, execute the snippet below:
 
     ~~~ fish
     set -Ux PYENV_ROOT $HOME/.pyenv
     set -U fish_user_paths $PYENV_ROOT/bin $fish_user_paths
     ~~~
 
-    And add this to `~/.config/fish/config.fish`:
+    Now, add this to `~/.config/fish/config.fish`:
 
     ~~~ fish
     pyenv init - | source
@@ -397,7 +404,7 @@ Though we don't actively maintain those patches, since existing releases never c
 it's safe to assume that they will continue working until there are further incompatible changes
 in a later version of those environments.
 
-* *3.7.8-3.7.13, 3.8.4-3.8.12, 3.9.0-3.9.7* : XCode 13.3
+* *3.7.8-3.7.14, 3.8.4-3.8.12, 3.9.0-3.9.7* : XCode 13.3
 * *3.6.15* : MacOS 11+ and XCode 13.3
 * *2.7.18* : MacOS 10.15+ and Apple Silicon
 
@@ -432,7 +439,7 @@ for more details on how the selection works and more information on its usage.
 As time goes on, you will accumulate Python versions in your
 `$(pyenv root)/versions` directory.
 
-To remove old Python versions, use [`pyenv uninstall <version>`](COMMANDS.md#pyenv-uninstall).
+To remove old Python versions, use [`pyenv uninstall <versions>`](COMMANDS.md#pyenv-uninstall).
 
 Alternatively, you can simply `rm -rf` the directory of the version you want
 to remove. You can find the directory of a particular Python version

libexec/pyenv---version

@@ -12,7 +12,7 @@
 set -e
 [ -n "$PYENV_DEBUG" ] && set -x
 
-version="2.3.3"
+version="2.3.5"
 git_revision=""
 
 if cd "${BASH_SOURCE%/*}" 2>/dev/null && git remote -v 2>/dev/null | grep -q pyenv; then

libexec/pyenv-version-file-read

@@ -5,18 +5,33 @@ set -e
 
 VERSION_FILE="$1"
 
+function is_version_safe() {
+  # As needed, check that the constructed path exists as a child path of PYENV_ROOT/versions
+  version="$1"
+  if [[ "$version" == ".." || "$version" == */* ]]; then
+    # Sanity check the value of version to prevent malicious path-traversal
+    (
+      cd "$PYENV_ROOT/versions/$version" &>/dev/null || exit 1
+      [[ "$PWD" == "$PYENV_ROOT/versions/"* ]]
+    )
+    return $?
+  else
+    return 0
+  fi
+}
+
 if [ -s "$VERSION_FILE" ]; then
   # Read the first non-whitespace word from the specified version file.
   # Be careful not to load it whole in case there's something crazy in it.
-  IFS="${IFS}"$'\r'
+  IFS="$IFS"$'\r'
   sep=
   while read -n 1024 -r version _ || [[ $version ]]; do
-    if [[ -z $version || $version == \#* ]]; then
+    if [[ -z "$version" || "$version" == \#* ]]; then
       # Skip empty lines and comments
       continue
-    elif [ "$version" = ".." ] || [[ $version == */* ]]; then
+    elif ! is_version_safe "$version"; then
-      # The version string is used to construct a path and we skip dubious values.
+      # CVE-2022-35861 allowed arbitrary code execution in some contexts and is mitigated by is_version_safe.
-      # This prevents issues such as path traversal (CVE-2022-35861).
+      echo "pyenv: invalid version \`$version' ignored in \`$VERSION_FILE'" >&2
       continue
     fi
     printf "%s%s" "$sep" "$version"

man/man1/pyenv.1

@@ -106,7 +106,7 @@ Set or show the shell\-specific Python version
 List existing pyenv shims
 .TP
 .B uninstall
-Uninstall a specific Python version
+Uninstall Python versions
 .TP
 .B version
 Show the current Python version(s) and its origin
@@ -452,10 +452,10 @@ $ pyenv versions
 .fi
 .IP "" 0
 .SS "pyenv uninstall"
-Uninstall a specific Python version\.
+Uninstall Python versions\.
 .IP "" 4
 .nf
-Usage: pyenv uninstall [\-f|\-\-force] <version>
+Usage: pyenv uninstall [\-f|\-\-force] <version> ...
 
    \-f  Attempt to remove the specified version without prompting
        for confirmation\. If the version does not exist, do not

plugins/python-build/README.md

@@ -113,6 +113,7 @@ You can set certain environment variables to control the build process.
   checksum of the file to the mirror URL.
 * `PYTHON_BUILD_SKIP_MIRROR`, if set, forces python-build to download packages from
   their original source URLs instead of using a mirror.
+* `PYTHON_BUILD_SKIP_HOMEBREW`, if set, will not search for libraries installed by Homebrew on macOS.
 * `PYTHON_BUILD_ROOT` overrides the default location from where build definitions
   in `share/python-build/` are looked up.
 * `PYTHON_BUILD_DEFINITIONS` can be a list of colon-separated paths that get
@@ -231,7 +232,7 @@ the full build log for build failures.
 
 ### Testing new python versions
 
-If you are contributing a new python version for python-build, 
+If you are contributing a new python version for python-build,
 you can test the build in a [docker](https://www.docker.com/) container based on Ubuntu 18.04.
 
 With docker installed:
@@ -249,7 +250,7 @@ docker run -it my_container
 ```
 
 The container will need to be rebuilt whenever you change the repo,
-but after the first build, this will be very fast, 
+but after the first build, this will be very fast,
 as the layer including the build dependencies will be cached.
 
 Changes made inside the container will not be persisted.

plugins/python-build/bin/pyenv-uninstall

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 #
-# Summary: Uninstall a specific Python version
+# Summary: Uninstall Python versions
 #
-# Usage: pyenv uninstall [-f|--force] <version>
+# Usage: pyenv uninstall [-f|--force] <version> ...
 #
 #    -f  Attempt to remove the specified version without prompting
 #        for confirmation. If the version does not exist, do not
@@ -33,14 +33,17 @@ if [ "$1" = "-f" ] || [ "$1" = "--force" ]; then
   shift
 fi
 
-[ "$#" -eq 1 ] || usage 1 >&2
+[ "$#" -gt 0 ] || usage 1 >&2
 
-DEFINITION="$1"
+versions=("$@")
-case "$DEFINITION" in
+
-"" | -* )
+for version in "${versions[@]}"; do
-  usage 1 >&2
+  case "$version" in
-  ;;
+  "" | -* )
-esac
+    usage 1 >&2
+    ;;
+  esac
+done
 
 declare -a before_hooks after_hooks
 
@@ -59,29 +62,36 @@ IFS=$'\n' scripts=(`pyenv-hooks uninstall`)
 IFS="$OLDIFS"
 for script in "${scripts[@]}"; do source "$script"; done
 
+uninstall-python() {
+  local DEFINITION="$1"
 
-VERSION_NAME="${DEFINITION##*/}"
+  local VERSION_NAME="${DEFINITION##*/}"
-PREFIX="${PYENV_ROOT}/versions/${VERSION_NAME}"
+  local PREFIX="${PYENV_ROOT}/versions/${VERSION_NAME}"
 
-if [ -z "$FORCE" ]; then
+  if [ -z "$FORCE" ]; then
-  if [ ! -d "$PREFIX" ]; then
+    if [ ! -d "$PREFIX" ]; then
-    echo "pyenv: version \`$VERSION_NAME' not installed" >&2
+      echo "pyenv: version \`$VERSION_NAME' not installed" >&2
-    exit 1
+      exit 1
+    fi
+
+    read -p "pyenv: remove $PREFIX? [y|N] "
+    case "$REPLY" in
+    y | Y | yes | YES ) ;;
+    * ) exit 1 ;;
+    esac
   fi
 
-  read -p "pyenv: remove $PREFIX? [y|N] "
+  for hook in "${before_hooks[@]}"; do eval "$hook"; done
-  case "$REPLY" in
-  y | Y | yes | YES ) ;;
-  * ) exit 1 ;;
-  esac
-fi
 
-for hook in "${before_hooks[@]}"; do eval "$hook"; done
+  if [ -d "$PREFIX" ]; then
+    rm -rf "$PREFIX"
+    pyenv-rehash
+    echo "pyenv: $VERSION_NAME uninstalled"
+  fi
 
-if [ -d "$PREFIX" ]; then
+  for hook in "${after_hooks[@]}"; do eval "$hook"; done
-  rm -rf "$PREFIX"
+}
-  pyenv-rehash
-  echo "pyenv: $VERSION_NAME uninstalled"
-fi
 
-for hook in "${after_hooks[@]}"; do eval "$hook"; done
+for version in "${versions[@]}"; do
+  uninstall-python "$version"
+done

plugins/python-build/bin/python-build

@@ -112,6 +112,11 @@ is_mac() {
   [ $# -eq 0 ] || [ "$(osx_version)" "$@" ]
 }
 
+can_use_homebrew() {
+    [ -z "$PYTHON_BUILD_SKIP_HOMEBREW" ] || return 1
+    is_mac || return 1
+}
+
 #  9.1  -> 901
 # 10.9  -> 1009
 # 10.10 -> 1010
@@ -774,6 +779,7 @@ build_package_standard_build() {
     else
       use_homebrew_zlib || true
     fi
+    use_dsymutil || true
   fi
 
   ( if [ "${CFLAGS+defined}" ] || [ "${!PACKAGE_CFLAGS+defined}" ]; then
@@ -899,7 +905,7 @@ build_package_micropython() {
     "$MAKE" $MAKE_OPTS
     cd ../ports/unix
     "$MAKE" $MAKE_OPTS axtls
-    "$MAKE" $MAKE_OPTS CFLAGS_EXTRA="-DMICROPY_PY_SYS_PATH_DEFAULT='\"${PREFIX_PATH}/lib/micropython\"' $CFLAGS_EXTRA"
+    "$MAKE" $MAKE_OPTS CFLAGS_EXTRA="-DMICROPY_PY_SYS_PATH_DEFAULT='\".frozen:${PREFIX_PATH}/lib/micropython\"' $CFLAGS_EXTRA"
     "$MAKE" install $MAKE_INSTALL_OPTS PREFIX="${PREFIX_PATH}"
     ln -fs micropython "${PREFIX_PATH}/bin/python"
     mkdir -p "${PREFIX_PATH}/lib/micropython"
@@ -1322,10 +1328,10 @@ configured_with_package_dir() {
 }
 
 use_homebrew() {
-  is_mac || return 1
+  can_use_homebrew || return 1
   # unless Homebrew is at the default /usr/local, need to add its paths to
   # compiler search to be able to use non-keg-only deps from there
-  if is_mac && command -v brew &>/dev/null; then
+  if command -v brew &>/dev/null; then
     local brew_prefix="$(brew --prefix 2>/dev/null || true)"
     # /usr/local/lib:/usr/lib is the default library search path
     if [[ -n $brew_prefix && $brew_prefix != "/usr" && $brew_prefix != "/usr/local" ]]; then
@@ -1344,7 +1350,7 @@ needs_yaml() {
 }
 
 use_homebrew_yaml() {
-  is_mac || return 1
+  can_use_homebrew || return 1
   local libdir="$(brew --prefix libyaml 2>/dev/null || true)"
   if [ -d "$libdir" ]; then
     echo "python-build: use libyaml from homebrew"
@@ -1388,7 +1394,7 @@ has_broken_mac_readline() {
 }
 
 use_homebrew_readline() {
-  is_mac || return 1
+  can_use_homebrew || return 1
   if ! configured_with_package_dir "python" "readline/rlconf.h"; then
     local libdir="$(brew --prefix readline 2>/dev/null || true)"
     if [ -d "$libdir" ]; then
@@ -1429,7 +1435,7 @@ has_broken_mac_openssl() {
 }
 
 use_homebrew_openssl() {
-  is_mac || return 1
+  can_use_homebrew || return 1
   command -v brew >/dev/null || return 1
   for openssl in ${PYTHON_BUILD_HOMEBREW_OPENSSL_FORMULA:-openssl}; do
     local ssldir="$(brew --prefix "${openssl}" || true)"
@@ -1529,7 +1535,7 @@ build_package_verify_openssl() {
 }
 
 use_homebrew_zlib() {
-  is_mac || return 1
+  can_use_homebrew || return 1
   local brew_zlib="$(brew --prefix zlib 2>/dev/null || true)"
   if [ -d "$brew_zlib" ]; then
     echo "python-build: use zlib from homebrew"
@@ -1549,7 +1555,7 @@ use_xcode_sdk_zlib() {
 }
 
 use_homebrew_tcltk() {
-  is_mac || return 1
+  can_use_homebrew || return 1
   # get the version from the folder that homebrew versions
   local tcltk_libdir="$(brew --prefix tcl-tk 2>/dev/null || true)"
   if [ -d "$tcltk_libdir" ]; then
@@ -1591,13 +1597,13 @@ use_custom_tcltk() {
 get_tcltk_flag_from() {
   IFS=$'\n'
   # parse input string into array
-  local opts_arr=( $(xargs -n1 <<<"$1") ) 
+  local opts_arr=( $(xargs -n1 <<<"$1") )
 
   # iterate through `opts_arr`, break if `--with-tcltk-libs=` was found.
   for opts in ${opts_arr[@]}; do
     # `--with-tcltk-libs=` must be the prefix.
     if [[ "$opts" == "--with-tcltk-libs="* ]]; then
-      # return 
+      # return
       echo "$opts"
       break
     fi
@@ -1607,7 +1613,7 @@ get_tcltk_flag_from() {
 }
 
 use_tcltk() {
-  if is_mac; then
+  if can_use_homebrew; then
     local tcltk_libdir="$(brew --prefix tcl-tk 2>/dev/null || true)"
   fi
   local tcl_tk_libs="$(get_tcltk_flag_from "$PYTHON_CONFIGURE_OPTS")"
@@ -1621,6 +1627,16 @@ use_tcltk() {
   fi
 }
 
+# Since 3.12, CPython can add DWARF debug information in MacOS
+# using Apple's nonstandard way, `dsymutil', that creates a "dSYM bundle"
+# that's supposed to be installed alongside executables
+# (https://github.com/python/cpython/issues/95973).
+use_dsymutil() {
+  if [[ -n "$PYTHON_BUILD_CONFIGURE_WITH_DSYMUTIL" ]] && is_mac; then
+    package_option python configure --with-dsymutil
+  fi
+}
+
 build_package_enable_shared() {
     package_option python configure --enable-shared
 }

plugins/python-build/share/python-build/3.10.7

@@ -0,0 +1,9 @@
+prefer_openssl11
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+install_package "openssl-1.1.1o" "https://www.openssl.org/source/openssl-1.1.1o.tar.gz#9384a2b0570dd80358841464677115df785edb941c71211f75076d72fe6b438f" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.1" "https://ftpmirror.gnu.org/readline/readline-8.1.tar.gz#f8ceb4ee131e3232226a17f51b164afc46cd0b9e6cef344be87c65962cb82b02" mac_readline --if has_broken_mac_readline
+if has_tar_xz_support; then
+    install_package "Python-3.10.7" "https://www.python.org/ftp/python/3.10.7/Python-3.10.7.tar.xz#6eed8415b7516fb2f260906db5d48dd4c06acc0cb24a7d6cc15296a604dcdc48" standard verify_py310 copy_python_gdb ensurepip
+else
+    install_package "Python-3.10.7" "https://www.python.org/ftp/python/3.10.7/Python-3.10.7.tgz#1b2e4e2df697c52d36731666979e648beeda5941d0f95740aafbf4163e5cc126" standard verify_py310 copy_python_gdb ensurepip
+fi

plugins/python-build/share/python-build/3.11.0rc2

@@ -3,7 +3,7 @@ export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
 install_package "openssl-1.1.1n" "https://www.openssl.org/source/openssl-1.1.1n.tar.gz#40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a" mac_openssl --if has_broken_mac_openssl
 install_package "readline-8.0" "https://ftpmirror.gnu.org/readline/readline-8.0.tar.gz#e339f51971478d369f8a053a330a190781acb9864cf4c541060f12078948e461" mac_readline --if has_broken_mac_readline
 if has_tar_xz_support; then
-    install_package "Python-3.11.0b5" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0b5.tar.xz#3810bd22f7dc34a99c2a2eb4b85264a4df4f05ef59c4e0ccc2ea82ee9c491698" standard verify_py311 copy_python_gdb ensurepip
+    install_package "Python-3.11.0rc2" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0rc2.tar.xz#25b35cc7d82c5ad34d867b179a1c1695d129be5ed14a21e46b6b7f2350a8b490" standard verify_py311 copy_python_gdb ensurepip
 else
-    install_package "Python-3.11.0b5" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0b5.tgz#3f7d1a4ab0e64425f4ffd92d49de192ad2ee1c62bc52e3877e9f7b254c702e60" standard verify_py311 copy_python_gdb ensurepip
+    install_package "Python-3.11.0rc2" "https://www.python.org/ftp/python/3.11.0/Python-3.11.0rc2.tgz#d653d52498fa8e711f8b6bf42051e24a1fd14e21f48dba500803ab7e9218d6ec" standard verify_py311 copy_python_gdb ensurepip
 fi

plugins/python-build/share/python-build/3.12-dev

@@ -1,5 +1,6 @@
 prefer_openssl11
 export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+export PYTHON_BUILD_CONFIGURE_WITH_DSYMUTIL=1
 install_package "openssl-1.1.1k" "https://www.openssl.org/source/openssl-1.1.1k.tar.gz#892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5" mac_openssl --if has_broken_mac_openssl
 install_package "readline-8.0" "https://ftpmirror.gnu.org/readline/readline-8.0.tar.gz#e339f51971478d369f8a053a330a190781acb9864cf4c541060f12078948e461" mac_readline --if has_broken_mac_readline
 install_git "Python-3.12-dev" "https://github.com/python/cpython" main standard verify_py312 copy_python_gdb ensurepip

plugins/python-build/share/python-build/3.7.14

@@ -0,0 +1,9 @@
+prefer_openssl11
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+install_package "openssl-1.1.1n" "https://www.openssl.org/source/openssl-1.1.1n.tar.gz#40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.1" "https://ftpmirror.gnu.org/readline/readline-8.1.tar.gz#f8ceb4ee131e3232226a17f51b164afc46cd0b9e6cef344be87c65962cb82b02" mac_readline --if has_broken_mac_readline
+if has_tar_xz_support; then
+  install_package "Python-3.7.14" "https://www.python.org/ftp/python/3.7.14/Python-3.7.14.tar.xz#4157ae31eb81af19e81c36882610491b0fb8f50e00fa8a17b095c88908b9c45c" standard verify_py37 copy_python_gdb ensurepip
+else
+  install_package "Python-3.7.14" "https://www.python.org/ftp/python/3.7.14/Python-3.7.14.tgz#82b2abf8978caa61a9011d166eede831b32de9cbebc0db8162900fa23437b709" standard verify_py37 copy_python_gdb ensurepip
+fi

plugins/python-build/share/python-build/3.8.14

@@ -0,0 +1,9 @@
+prefer_openssl11
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+install_package "openssl-1.1.1n" "https://www.openssl.org/source/openssl-1.1.1n.tar.gz#40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.1" "https://ftpmirror.gnu.org/readline/readline-8.1.tar.gz#f8ceb4ee131e3232226a17f51b164afc46cd0b9e6cef344be87c65962cb82b02" mac_readline --if has_broken_mac_readline
+if has_tar_xz_support; then
+  install_package "Python-3.8.14" "https://www.python.org/ftp/python/3.8.14/Python-3.8.14.tar.xz#5d77e278271ba803e9909a41a4f3baca006181c93ada682a5e5fe8dc4a24c5f3" standard verify_py38 copy_python_gdb ensurepip
+else
+  install_package "Python-3.8.14" "https://www.python.org/ftp/python/3.8.14/Python-3.8.14.tgz#41f959c480c59211feb55d5a28851a56c7e22d02ef91035606ebb21011723c31" standard verify_py38 copy_python_gdb ensurepip
+fi

plugins/python-build/share/python-build/3.9.14

@@ -0,0 +1,9 @@
+prefer_openssl11
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+install_package "openssl-1.1.1n" "https://www.openssl.org/source/openssl-1.1.1n.tar.gz#40dceb51a4f6a5275bde0e6bf20ef4b91bfc32ed57c0552e2e8e15463372b17a" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.1" "https://ftpmirror.gnu.org/readline/readline-8.1.tar.gz#f8ceb4ee131e3232226a17f51b164afc46cd0b9e6cef344be87c65962cb82b02" mac_readline --if has_broken_mac_readline
+if has_tar_xz_support; then
+  install_package "Python-3.9.14" "https://www.python.org/ftp/python/3.9.14/Python-3.9.14.tar.xz#651304d216c8203fe0adf1a80af472d8e92c3b0e0a7892222ae4d9f3ae4debcf" standard verify_py39 copy_python_gdb ensurepip
+else
+  install_package "Python-3.9.14" "https://www.python.org/ftp/python/3.9.14/Python-3.9.14.tgz#9201836e2c16361b2b7408680502393737d44f227333fe2e5729c7d5f6041675" standard verify_py39 copy_python_gdb ensurepip
+fi

plugins/python-build/share/python-build/cinder-3.8-dev

@@ -0,0 +1,31 @@
+require_distro Fedora 32 &>/dev/null || \
+{ echo
+  colorize 1 "WARNING"
+  cat >&2 <<!
+: The Cinder compiler only officially supports
+Facebook's Docker images which are Fedora 32 - based.
+It may fail to build on a system
+with a different GCC and/or Glibc version.
+!
+  echo
+}
+
+[[ $(${CC:-gcc} -dumpversion 2>/dev/null) == 10 ]] || \
+{ command -v "gcc-10" >/dev/null && \
+  export CC="gcc-10" && \
+  echo "python-build: setting the compiler to \`gcc-10'"; } || \
+{
+  echo
+  colorize 1 WARNING
+  cat >&2 <<!
+: GCC 10 is not found on PATH.
+The build may fail.
+!
+  echo
+}
+
+prefer_openssl11
+export PYTHON_BUILD_CONFIGURE_WITH_OPENSSL=1
+install_package "openssl-1.1.1k" "https://www.openssl.org/source/openssl-1.1.1k.tar.gz#892a0875b9872acd04a9fde79b1f943075d5ea162415de3047c327df33fbaee5" mac_openssl --if has_broken_mac_openssl
+install_package "readline-8.0" "https://ftpmirror.gnu.org/readline/readline-8.0.tar.gz#e339f51971478d369f8a053a330a190781acb9864cf4c541060f12078948e461" mac_readline --if has_broken_mac_readline
+install_git "Cinder-3.8-dev" "https://github.com/facebookincubator/cinder" "cinder/3.8" standard verify_py38 copy_python_gdb ensurepip

plugins/python-build/share/python-build/micropython-1.18

@@ -0,0 +1,4 @@
+has_tar_xz_support \
+  && { install=install_package; src="https://micropython.org/resources/source/micropython-1.18.tar.xz#96fc71b42ed331c64e1adc5a830ec4f29f2975c23e8751109c03f32b80fa3eb4"; } \
+  || { install=install_zip; src="https://micropython.org/resources/source/micropython-1.18.zip#90fa8049cf275310638b9e9c77121f6042f7250b814ef622f9522befde009f57"; }
+$install micropython-1.18 "$src" micropython

plugins/python-build/share/python-build/micropython-1.19.1

@@ -0,0 +1,4 @@
+has_tar_xz_support \
+  && { install=install_package; src="https://micropython.org/resources/source/micropython-1.19.1.tar.xz#940e3815e8c425c6eaed3a2aa30d320220cc012a2654b6e086e1b6f0567df350"; } \
+  || { install=install_zip; src="https://micropython.org/resources/source/micropython-1.19.1.zip#7047ce208627457c6881850527edb78189a1855a974aa34e2d929c9a3b3c5cc3"; }
+$install micropython-1.19.1 "$src" micropython

plugins/python-build/share/python-build/miniconda3-3.9-4.12.0

@@ -12,7 +12,7 @@ case "$(anaconda_architecture 2>/dev/null || true)" in
   install_script "Miniconda3-py39_4.12.0-Linux-x86_64" "https://repo.anaconda.com/miniconda/Miniconda3-py39_4.12.0-Linux-x86_64.sh#7843dd7d0a2c53b0df37ca8189672992" "miniconda" verify_py39
   ;;
 "MacOSX-arm64" )
-  install_script "Miniconda3-py39_4.12.0-MacOSX-arm64" "https://repo.anaconda.com/miniconda/Miniconda3-py39_4.12.0-MacOSX-arm64.sh#31251793539cf952ee99c18e34c30c7f" "miniconda" verify_py39
+  install_script "Miniconda3-py39_4.12.0-MacOSX-arm64" "https://repo.anaconda.com/miniconda/Miniconda3-py39_4.12.0-MacOSX-arm64.sh#f7448cfeb278f2a84ed903db02d5525c" "miniconda" verify_py39
   ;;
 "MacOSX-x86_64" )
   install_script "Miniconda3-py39_4.12.0-MacOSX-x86_64" "https://repo.anaconda.com/miniconda/Miniconda3-py39_4.12.0-MacOSX-x86_64.sh#143b9bb03b6e4865be4ebbf40b108772" "miniconda" verify_py39

plugins/python-build/share/python-build/patches/3.7.14/Python-3.7.14/0001-Port-ctypes-and-system-libffi-patches-for-arm64-macO.patch

@@ -0,0 +1,310 @@
+From: Christian Hammond <christian@beanbaginc.com>
+Date: Wed, 15 Dec 2021 23:12:36 -0800
+Subject: Port ctypes and system libffi patches for arm64/macOS 10.15+ to Python 3.7.12
+
+This ports the following ctypes and libffi pyenv patches for Python
+2.7.18 to Python 3.7.12:
+
+* `0004-Use-system-libffi-for-Mac-OS-10.15-and-up.patch`
+* `0005-ctypes-use-the-correct-ABI-for-variadic-functions.patch`
+* `0006-ctypes-probe-libffi-for-ffi_closure_alloc-and-ffi_pr.patch`
+
+These patches enable use of system libffi (fixing a broken `ctypes`
+module on arm64 targets) and enable calling variadic functions on arm64.
+They've been combined from patches port from Homebrew to pyenv by Takumi
+Sueda, updated to work on the Python 3.7.12 codebase.
+
+The Homebrew patches are themselves backports of changes in Python 3.9
+and 3.10. That patch can be found at:
+
+https://github.com/Homebrew/formula-patches/blob/master/python/3.8.7.patch
+
+diff --git a/Doc/library/ctypes.rst b/Doc/library/ctypes.rst
+index 715d595b24..7743144978 100644
+--- a/Doc/library/ctypes.rst
++++ b/Doc/library/ctypes.rst
+@@ -1551,6 +1551,13 @@ They are instances of a private class:
+       value usable as argument (integer, string, ctypes instance).  This allows
+       defining adapters that can adapt custom objects as function parameters.
+ 
++   .. attribute:: variadic
++
++      Assign a boolean to specify that the function takes a variable number of
++      arguments.   This does not matter on most platforms, but for Apple arm64
++      platforms variadic functions have a different calling convention than
++      normal functions.
++
+    .. attribute:: errcheck
+ 
+       Assign a Python function or another callable to this attribute. The
+diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
+index 4ebd82d3e0..7b73c190b6 100644
+--- a/Lib/test/test_unicode.py
++++ b/Lib/test/test_unicode.py
+@@ -2458,11 +2458,14 @@ class CAPITest(unittest.TestCase):
+     def test_from_format(self):
+         support.import_module('ctypes')
+         from ctypes import (
++            c_char_p,
+             pythonapi, py_object, sizeof,
+             c_int, c_long, c_longlong, c_ssize_t,
+             c_uint, c_ulong, c_ulonglong, c_size_t, c_void_p)
+         name = "PyUnicode_FromFormat"
+         _PyUnicode_FromFormat = getattr(pythonapi, name)
++        _PyUnicode_FromFormat.argtypes = (c_char_p,)
++        _PyUnicode_FromFormat.variadic = True
+         _PyUnicode_FromFormat.restype = py_object
+ 
+         def PyUnicode_FromFormat(format, *args):
+diff --git a/Modules/_ctypes/_ctypes.c b/Modules/_ctypes/_ctypes.c
+index dd0c61fd8a..79137e1dc7 100644
+--- a/Modules/_ctypes/_ctypes.c
++++ b/Modules/_ctypes/_ctypes.c
+@@ -3174,6 +3174,34 @@ PyCFuncPtr_get_restype(PyCFuncPtrObject *self, void *Py_UNUSED(ignored))
+     }
+ }
+ 
++static int
++PyCFuncPtr_set_variadic(PyCFuncPtrObject *self, PyObject *ob)
++{
++    StgDictObject *dict = PyObject_stgdict((PyObject *)self);
++    assert(dict);
++    int r = PyObject_IsTrue(ob);
++    if (r == 1) {
++        dict->flags |= FUNCFLAG_VARIADIC;
++        return 0;
++    } else if (r == 0) {
++        dict->flags &= ~FUNCFLAG_VARIADIC;
++        return 0;
++    } else {
++        return -1;
++    }
++}
++
++static PyObject *
++PyCFuncPtr_get_variadic(PyCFuncPtrObject *self)
++{
++    StgDictObject *dict = PyObject_stgdict((PyObject *)self);
++    assert(dict); /* Cannot be NULL for PyCFuncPtrObject instances */
++    if (dict->flags & FUNCFLAG_VARIADIC)
++        Py_RETURN_TRUE;
++    else
++        Py_RETURN_FALSE;
++}
++
+ static int
+ PyCFuncPtr_set_argtypes(PyCFuncPtrObject *self, PyObject *ob, void *Py_UNUSED(ignored))
+ {
+@@ -3219,6 +3247,8 @@ static PyGetSetDef PyCFuncPtr_getsets[] = {
+     { "argtypes", (getter)PyCFuncPtr_get_argtypes,
+       (setter)PyCFuncPtr_set_argtypes,
+       "specify the argument types", NULL },
++    { "variadic", (getter)PyCFuncPtr_get_variadic, (setter)PyCFuncPtr_set_variadic,
++      "specify if function takes variable number of arguments", NULL },
+     { NULL, NULL }
+ };
+ 
+@@ -5632,6 +5662,7 @@ PyInit__ctypes(void)
+     PyModule_AddObject(m, "FUNCFLAG_USE_ERRNO", PyLong_FromLong(FUNCFLAG_USE_ERRNO));
+     PyModule_AddObject(m, "FUNCFLAG_USE_LASTERROR", PyLong_FromLong(FUNCFLAG_USE_LASTERROR));
+     PyModule_AddObject(m, "FUNCFLAG_PYTHONAPI", PyLong_FromLong(FUNCFLAG_PYTHONAPI));
++    PyModule_AddObject(m, "FUNCFLAG_VARIADIC", PyLong_FromLong(FUNCFLAG_VARIADIC));
+     PyModule_AddStringConstant(m, "__version__", "1.1.0");
+ 
+     PyModule_AddObject(m, "_memmove_addr", PyLong_FromVoidPtr(memmove));
+diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
+index 9cbf9801ad..e7fe11176b 100644
+--- a/Modules/_ctypes/callproc.c
++++ b/Modules/_ctypes/callproc.c
+@@ -754,7 +756,8 @@ static int _call_function_pointer(int flags,
+                                   ffi_type **atypes,
+                                   ffi_type *restype,
+                                   void *resmem,
+-                                  int argcount)
++                                  int argcount,
++                                  int argtypecount)
+ {
+     PyThreadState *_save = NULL; /* For Py_BLOCK_THREADS and Py_UNBLOCK_THREADS */
+     PyObject *error_object = NULL;
+@@ -780,15 +783,39 @@ static int _call_function_pointer(int flags,
+     if ((flags & FUNCFLAG_CDECL) == 0)
+         cc = FFI_STDCALL;
+ #endif
+-    if (FFI_OK != ffi_prep_cif(&cif,
+-                               cc,
+-                               argcount,
+-                               restype,
+-                               atypes)) {
+-        PyErr_SetString(PyExc_RuntimeError,
+-                        "ffi_prep_cif failed");
+-        return -1;
++
++#if HAVE_FFI_PREP_CIF_VAR
++    /* Everyone SHOULD set f.variadic=True on variadic function pointers, but
++     * lots of existing code will not.  If there's at least one arg and more
++     * args are passed than are defined in the prototype, then it must be a
++     * variadic function. */
++    if ((flags & FUNCFLAG_VARIADIC) ||
++        (argtypecount != 0 && argcount > argtypecount))
++    {
++        if (FFI_OK != ffi_prep_cif_var(&cif,
++                                       cc,
++                                       argtypecount,
++                                       argcount,
++                                       restype,
++                                       atypes)) {
++            PyErr_SetString(PyExc_RuntimeError,
++                            "ffi_prep_cif_var failed");
++            return -1;
++        }
++    } else {
++#endif
++        if (FFI_OK != ffi_prep_cif(&cif,
++                                   cc,
++                                   argcount,
++                                   restype,
++                                   atypes)) {
++            PyErr_SetString(PyExc_RuntimeError,
++                            "ffi_prep_cif failed");
++            return -1;
++        }
++#if HAVE_FFI_PREP_CIF_VAR
+     }
++#endif
+ 
+     if (flags & (FUNCFLAG_USE_ERRNO | FUNCFLAG_USE_LASTERROR)) {
+         error_object = _ctypes_get_errobj(&space);
+@@ -1187,9 +1214,8 @@ PyObject *_ctypes_callproc(PPROC pProc,
+ 
+     if (-1 == _call_function_pointer(flags, pProc, avalues, atypes,
+                                      rtype, resbuf,
+-                                     Py_SAFE_DOWNCAST(argcount,
+-                                                      Py_ssize_t,
+-                                                      int)))
++                                     Py_SAFE_DOWNCAST(argcount, Py_ssize_t, int),
++                                     Py_SAFE_DOWNCAST(argtype_count, Py_ssize_t, int)))
+         goto cleanup;
+ 
+ #ifdef WORDS_BIGENDIAN
+diff --git a/Modules/_ctypes/ctypes.h b/Modules/_ctypes/ctypes.h
+index e58f85233c..e45975f6ad 100644
+--- a/Modules/_ctypes/ctypes.h
++++ b/Modules/_ctypes/ctypes.h
+@@ -285,6 +285,7 @@ PyObject *_ctypes_callproc(PPROC pProc,
+ #define FUNCFLAG_PYTHONAPI 0x4
+ #define FUNCFLAG_USE_ERRNO 0x8
+ #define FUNCFLAG_USE_LASTERROR 0x10
++#define FUNCFLAG_VARIADIC 0x20
+ 
+ #define TYPEFLAG_ISPOINTER 0x100
+ #define TYPEFLAG_HASPOINTER 0x200
+diff --git a/setup.py b/setup.py
+index bf90600eaa..48ff120e9a 100644
+--- a/setup.py
++++ b/setup.py
+@@ -142,6 +142,13 @@ def macosx_sdk_root():
+ 
+     return MACOS_SDK_ROOT
+ 
++def is_macosx_at_least(vers):
++    if host_platform == 'darwin':
++        dep_target = sysconfig.get_config_var('MACOSX_DEPLOYMENT_TARGET')
++        if dep_target:
++            return tuple(map(int, str(dep_target).split('.'))) >= vers
++    return False
++
+ def is_macosx_sdk_path(path):
+     """
+     Returns True if 'path' can be located in an OSX SDK
+@@ -150,6 +157,13 @@ def is_macosx_sdk_path(path):
+                 or path.startswith('/System/')
+                 or path.startswith('/Library/') )
+ 
++def grep_headers_for(function, headers):
++    for header in headers:
++        with open(header, 'r') as f:
++            if function in f.read():
++                return True
++    return False
++
+ def find_file(filename, std_dirs, paths):
+     """Searches for the directory where a given file is located,
+     and returns a possibly-empty list of additional directories, or None
+@@ -1972,7 +1986,11 @@ class PyBuildExt(build_ext):
+         return True
+ 
+     def detect_ctypes(self, inc_dirs, lib_dirs):
+-        self.use_system_libffi = False
++        if not sysconfig.get_config_var("LIBFFI_INCLUDEDIR") and is_macosx_at_least((10,15)):
++            self.use_system_libffi = True
++        else:
++            self.use_system_libffi = '--with-system-ffi' in sysconfig.get_config_var("CONFIG_ARGS")
++
+         include_dirs = []
+         extra_compile_args = []
+         extra_link_args = []
+@@ -2018,30 +2036,47 @@ class PyBuildExt(build_ext):
+                      libraries=['m'])
+         self.extensions.extend([ext, ext_test])
+ 
++        ffi_inc = sysconfig.get_config_var("LIBFFI_INCLUDEDIR")
++        ffi_lib = None
++
+         if host_platform == 'darwin':
+-            if '--with-system-ffi' not in sysconfig.get_config_var("CONFIG_ARGS"):
++            if not self.use_system_libffi:
+                 return
+-            # OS X 10.5 comes with libffi.dylib; the include files are
+-            # in /usr/include/ffi
+-            inc_dirs.append('/usr/include/ffi')
+-
+-        ffi_inc = [sysconfig.get_config_var("LIBFFI_INCLUDEDIR")]
+-        if not ffi_inc or ffi_inc[0] == '':
+-            ffi_inc = find_file('ffi.h', [], inc_dirs)
+-        if ffi_inc is not None:
+-            ffi_h = ffi_inc[0] + '/ffi.h'
++            ffi_in_sdk = os.path.join(macosx_sdk_root(), "usr/include/ffi")
++            if os.path.exists(ffi_in_sdk):
++                ffi_inc = ffi_in_sdk
++                ffi_lib = 'ffi'
++            else:
++                # OS X 10.5 comes with libffi.dylib; the include files are
++                # in /usr/include/ffi
++                inc_dirs.append('/usr/include/ffi')
++
++        if not ffi_inc:
++            found = find_file('ffi.h', [], inc_dirs)
++            if found:
++                ffi_inc = found[0]
++        if ffi_inc:
++            ffi_h = ffi_inc + '/ffi.h'
+             if not os.path.exists(ffi_h):
+                 ffi_inc = None
+                 print('Header file {} does not exist'.format(ffi_h))
+-        ffi_lib = None
+-        if ffi_inc is not None:
+-            for lib_name in ('ffi', 'ffi_pic'):
++
++        if ffi_lib is None and ffi_inc:
++            for lib_name in ('ffi_convenience', 'ffi_pic', 'ffi'):
+                 if (self.compiler.find_library_file(lib_dirs, lib_name)):
+                     ffi_lib = lib_name
+                     break
+ 
+         if ffi_inc and ffi_lib:
+-            ext.include_dirs.extend(ffi_inc)
++            ffi_headers = glob(os.path.join(ffi_inc, '*.h'))
++            if grep_headers_for('ffi_closure_alloc', ffi_headers):
++                try:
++                    sources.remove('_ctypes/malloc_closure.c')
++                except ValueError:
++                    pass
++            if grep_headers_for('ffi_prep_cif_var', ffi_headers):
++                ext.extra_compile_args.append("-DHAVE_FFI_PREP_CIF_VAR=1")
++            ext.include_dirs.append(ffi_inc)
+             ext.libraries.append(ffi_lib)
+             self.use_system_libffi = True
+ 
+-- 
+2.30.1 (Apple Git-130)
+

plugins/python-build/share/python-build/patches/3.7.14/Python-3.7.14/0002-bpo-41100-fix-_decimal-for-arm64-Mac-OS-GH-21228.patch

@@ -0,0 +1,37 @@
+From f2595c038ed7bfd182d9d05d83786106ebd02ca0 Mon Sep 17 00:00:00 2001
+From: Lawrence D'Anna <64555057+lawrence-danna-apple@users.noreply.github.com>
+Date: Tue, 30 Jun 2020 02:15:46 -0700
+Subject: [PATCH] bpo-41100: fix _decimal for arm64 Mac OS (GH-21228)
+
+Patch by Lawrence Danna.
+---
+ .../Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst | 1 +
+ Modules/_decimal/libmpdec/mpdecimal.h                          | 3 +++
+ 2 files changed, 4 insertions(+)
+ create mode 100644 Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst
+
+diff --git a/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst
+new file mode 100644
+index 0000000000..d6176d69f0
+--- /dev/null
++++ b/Misc/NEWS.d/next/Core and Builtins/2020-06-30-04-44-29.bpo-41100.PJwA6F.rst	
+@@ -0,0 +1 @@
++add arm64 to the allowable Mac OS arches in mpdecimal.h
+\ No newline at end of file
+diff --git a/Modules/_decimal/libmpdec/mpdecimal.h b/Modules/_decimal/libmpdec/mpdecimal.h
+index a67dd9bc12..3e9c8185c3 100644
+--- a/Modules/_decimal/libmpdec/mpdecimal.h
++++ b/Modules/_decimal/libmpdec/mpdecimal.h
+@@ -135,6 +135,9 @@ const char *mpd_version(void);
+   #elif defined(__x86_64__)
+     #define CONFIG_64
+     #define ASM
++  #elif defined(__arm64__)
++    #define CONFIG_64
++    #define ANSI
+   #else
+     #error "unknown architecture for universal build."
+   #endif
+-- 
+2.37.3
+

plugins/python-build/share/python-build/patches/3.7.14/Python-3.7.14/0003-bpo-42351-Avoid-error-when-opening-header-with-non-U.patch

@@ -0,0 +1,30 @@
+From 245427d207ee88a4ba26a66c3de350bcbcc036f2 Mon Sep 17 00:00:00 2001
+From: Ronald Oussoren <ronaldoussoren@mac.com>
+Date: Sat, 14 Nov 2020 16:07:47 +0100
+Subject: [PATCH] bpo-42351: Avoid error when opening header with non-UTF8
+ encoding (GH-23279)
+
+grep_headers_for() would error out when a header contained
+text that cannot be interpreted as UTF-8.
+
+cherry-picked from 7a27c7ed4b by Pedro Fonini <fonini@ip.tv>
+---
+ setup.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/setup.py b/setup.py
+index f211989aac..467362813d 100644
+--- a/setup.py
++++ b/setup.py
+@@ -159,7 +159,7 @@ def is_macosx_sdk_path(path):
+ 
+ def grep_headers_for(function, headers):
+     for header in headers:
+-        with open(header, 'r') as f:
++        with open(header, 'r', errors='surrogateescape') as f:
+             if function in f.read():
+                 return True
+     return False
+-- 
+2.34.1
+

plugins/python-build/share/python-build/pyston-2.3.5

@@ -0,0 +1,23 @@
+# sha256sum used for checksum values
+
+# version of pyston
+VER='2.3.5'
+# alias for download location
+DOWNLOAD='https://github.com/pyston/pyston/releases/download'
+
+case "$(pyston_architecture 2>/dev/null || true)" in
+"linux64" )
+  install_package "pyston_${VER}_portable_amd64" "${DOWNLOAD}/pyston_${VER}/pyston_${VER}_portable_amd64.tar.gz#c71c711d60a9c18f243a9e30fd35e0818674ae96f534c67c27b0cdfbc9132ef8" "pyston" verify_py38 get_pip
+  ;;
+"linux-aarch64" )
+  install_package "pyston_${VER}_portable_arm64" "${DOWNLOAD}/pyston_${VER}/pyston_${VER}_portable_arm64.tar.gz#c578cb806c62d9dca8728f190a87e172305bd80887e206df42c4c5658ab469c1" "pyston" verify_py38 get_pip
+  ;;
+* )
+  { echo
+    colorize 1 "ERROR"
+    echo ": A Pyston ${VER} binary is not available for $(pyston_architecture 2>/dev/null || true)."
+    echo
+  } >&2
+  exit 1
+  ;;
+esac

plugins/python-build/test/build.bats

@@ -151,7 +151,7 @@ OUT
   BREW_PREFIX="$TMP/homebrew-prefix"
   mkdir -p "$BREW_PREFIX"
 
-  for i in {1..9}; do stub uname '-s : echo Darwin'; done
+  for i in {1..8}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
   stub brew "--prefix : echo '$BREW_PREFIX'" false
   stub_make_install
@@ -179,7 +179,7 @@ OUT
   brew_libdir="$TMP/homebrew-yaml"
   mkdir -p "$brew_libdir"
 
-  for i in {1..10}; do stub uname '-s : echo Darwin'; done
+  for i in {1..9}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
   stub brew "--prefix libyaml : echo '$brew_libdir'"
   for i in {1..4}; do stub brew false; done
@@ -234,7 +234,7 @@ OUT
 
   readline_libdir="$TMP/homebrew-readline"
   mkdir -p "$readline_libdir"
-  for i in {1..8}; do stub uname '-s : echo Darwin'; done
+  for i in {1..7}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
   for i in {1..2}; do stub brew false; done
   stub brew "--prefix readline : echo '$readline_libdir'"
@@ -283,6 +283,32 @@ make install
 OUT
 }
 
+@test "no library searches performed during normal operation touch homebrew if envvar is set" {
+  cached_tarball "Python-3.6.2"
+
+  for i in {1..4}; do stub uname '-s : echo Darwin'; done
+  for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
+  stub brew true; brew
+  stub_make_install
+  export PYTHON_BUILD_SKIP_HOMEBREW=1
+
+  run_inline_definition <<DEF
+install_package "Python-3.6.2" "http://python.org/ftp/python/3.6.2/Python-3.6.2.tar.gz"
+DEF
+  assert_success
+
+  unstub uname
+  unstub brew
+  unstub make
+
+  assert_build_log <<OUT
+Python-3.6.2: CPPFLAGS="-I${TMP}/install/include " LDFLAGS="-L${TMP}/install/lib "
+Python-3.6.2: --prefix=$INSTALL_ROOT --libdir=$INSTALL_ROOT/lib
+make -j 2
+make install
+OUT
+}
+
 @test "readline is not linked from Homebrew when explicitly defined" {
   cached_tarball "Python-3.6.2"
 
@@ -291,7 +317,7 @@ OUT
   mkdir -p "$readline_libdir/include/readline"
   touch "$readline_libdir/include/readline/rlconf.h"
 
-  for i in {1..8}; do stub uname '-s : echo Darwin'; done
+  for i in {1..7}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
 
   for i in {1..3}; do stub brew false; done
@@ -323,7 +349,7 @@ OUT
   mkdir -p "$tcl_tk_libdir/lib"
   echo "TCL_VERSION='$tcl_tk_version'" >>"$tcl_tk_libdir/lib/tclConfig.sh"
 
-  for i in {1..10}; do stub uname '-s : echo Darwin'; done
+  for i in {1..9}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
 
   stub brew false
@@ -357,7 +383,7 @@ OUT
   tcl_tk_version_long="8.6.10"
   tcl_tk_version="${tcl_tk_version_long%.*}"
 
-  for i in {1..9}; do stub uname '-s : echo Darwin'; done
+  for i in {1..8}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
 
   for i in {1..4}; do stub brew false; done
@@ -385,7 +411,7 @@ OUT
 @test "number of CPU cores defaults to 2" {
   cached_tarball "Python-3.6.2"
 
-  for i in {1..10}; do stub uname '-s : echo Darwin'; done
+  for i in {1..9}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 10.10'; done
 
   stub sysctl false
@@ -412,7 +438,7 @@ OUT
 @test "number of CPU cores is detected on Mac" {
   cached_tarball "Python-3.6.2"
 
-  for i in {1..10}; do stub uname '-s : echo Darwin'; done
+  for i in {1..9}; do stub uname '-s : echo Darwin'; done
   for i in {1..2}; do stub sw_vers '-productVersion : echo 10.10'; done
 
   stub sysctl '-n hw.ncpu : echo 4'
@@ -489,14 +515,41 @@ make install DOGE="such wow"
 OUT
 }
 
-@test "setting MAKE_INSTALL_OPTS to a multi-word string" {
+@test "configuring with dSYM in MacOS" {
   cached_tarball "Python-3.6.2"
 
-  for i in {1..8}; do stub uname '-s : echo Linux'; done
+  for i in {1..9}; do stub uname '-s : echo Darwin'; done
+  for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
+  for i in {1..4}; do stub brew false; done
   stub_make_install
 
-  export MAKE_INSTALL_OPTS="DOGE=\"such wow\""
   run_inline_definition <<DEF
+export PYTHON_BUILD_CONFIGURE_WITH_DSYMUTIL=1
+install_package "Python-3.6.2" "http://python.org/ftp/python/3.6.2/Python-3.6.2.tar.gz"
+DEF
+  assert_success
+
+  unstub sw_vers
+  unstub uname
+  unstub brew
+  unstub make
+
+  assert_build_log <<OUT
+Python-3.6.2: CPPFLAGS="-I${TMP}/install/include " LDFLAGS="-L${TMP}/install/lib "
+Python-3.6.2: --prefix=$INSTALL_ROOT --libdir=${TMP}/install/lib --with-dsymutil
+make -j 2
+make install
+OUT
+}
+
+@test "configuring with dSYM has no effect in non-MacOS" {
+  cached_tarball "Python-3.6.2"
+
+  for i in {1..9}; do stub uname '-s : echo Linux'; done
+  stub_make_install
+
+  run_inline_definition <<DEF
+export PYTHON_BUILD_CONFIGURE_WITH_DSYMUTIL=1
 install_package "Python-3.6.2" "http://python.org/ftp/python/3.6.2/Python-3.6.2.tar.gz"
 DEF
   assert_success
@@ -506,9 +559,41 @@ DEF
 
   assert_build_log <<OUT
 Python-3.6.2: CPPFLAGS="-I${TMP}/install/include " LDFLAGS="-L${TMP}/install/lib "
-Python-3.6.2: --prefix=$INSTALL_ROOT --libdir=$INSTALL_ROOT/lib
+Python-3.6.2: --prefix=$INSTALL_ROOT --libdir=${TMP}/install/lib
 make -j 2
-make install DOGE="such wow"
+make install
+OUT
+}
+
+@test "tcl-tk is not linked from Homebrew when explicitly defined" {
+  cached_tarball "Python-3.6.2"
+
+  # python build
+  tcl_tk_version_long="8.6.10"
+  tcl_tk_version="${tcl_tk_version_long%.*}"
+
+  for i in {1..8}; do stub uname '-s : echo Darwin'; done
+  for i in {1..2}; do stub sw_vers '-productVersion : echo 1010'; done
+
+  for i in {1..4}; do stub brew false; done
+  stub_make_install
+
+  export PYTHON_CONFIGURE_OPTS="--with-tcltk-libs='-L${TMP}/custom-tcl-tk/lib -ltcl$tcl_tk_version -ltk$tcl_tk_version'"
+  run_inline_definition <<DEF
+install_package "Python-3.6.2" "http://python.org/ftp/python/3.6.2/Python-3.6.2.tar.gz"
+DEF
+  assert_success
+
+  unstub uname
+  unstub sw_vers
+  unstub brew
+  unstub make
+
+  assert_build_log <<OUT
+Python-3.6.2: CPPFLAGS="-I${TMP}/install/include " LDFLAGS="-L${TMP}/install/lib "
+Python-3.6.2: --prefix=$INSTALL_ROOT --libdir=$INSTALL_ROOT/lib --with-tcltk-libs=-L${TMP}/custom-tcl-tk/lib -ltcl8.6 -ltk8.6
+make -j 2
+make install
 OUT
 }
 

plugins/python-build/test/compiler.bats

@@ -63,7 +63,7 @@ DEF
   mkdir -p "$INSTALL_ROOT"
   cd "$INSTALL_ROOT"
 
-  for i in {1..10}; do stub uname '-s : echo Darwin'; done
+  for i in {1..9}; do stub uname '-s : echo Darwin'; done
   for i in {1..3}; do stub sw_vers '-productVersion : echo 10.10'; done
 
   stub cc 'false'
@@ -115,6 +115,6 @@ DEF
 
     #assert_success
     assert_output <<OUT
-CFLAGS_EXTRA=-DMICROPY_PY_SYS_PATH_DEFAULT='"${TMP}/install/lib/micropython"' -Wno-floating-conversion
+CFLAGS_EXTRA=-DMICROPY_PY_SYS_PATH_DEFAULT='".frozen:${TMP}/install/lib/micropython"' -Wno-floating-conversion
 OUT
 }

plugins/python-build/test/hooks.bats

@@ -55,3 +55,38 @@ OUT
 
   refute [ -d "${PYENV_ROOT}/versions/3.6.2" ]
 }
+
+@test "pyenv-uninstall hooks with multiple versions" {
+  cat > "${HOOK_PATH}/uninstall.bash" <<OUT
+before_uninstall 'echo before: \$PREFIX'
+after_uninstall 'echo after.'
+rm() {
+  echo "rm \$@"
+  command rm "\$@"
+}
+OUT
+  stub pyenv-hooks "uninstall : echo '$HOOK_PATH'/uninstall.bash"
+  stub pyenv-rehash "echo rehashed"
+  stub pyenv-rehash "echo rehashed"
+
+  mkdir -p "${PYENV_ROOT}/versions/3.6.2"
+  mkdir -p "${PYENV_ROOT}/versions/3.6.3"
+  run pyenv-uninstall -f 3.6.2 3.6.3
+
+  assert_success
+  assert_output <<-OUT
+before: ${PYENV_ROOT}/versions/3.6.2
+rm -rf ${PYENV_ROOT}/versions/3.6.2
+rehashed
+pyenv: 3.6.2 uninstalled
+after.
+before: ${PYENV_ROOT}/versions/3.6.3
+rm -rf ${PYENV_ROOT}/versions/3.6.3
+rehashed
+pyenv: 3.6.3 uninstalled
+after.
+OUT
+
+  refute [ -d "${PYENV_ROOT}/versions/3.6.2" ]
+  refute [ -d "${PYENV_ROOT}/versions/3.6.3" ]
+}

plugins/python-build/test/pyenv.bats

@@ -195,12 +195,28 @@ OUT
   unstub pyenv-help
 }
 
-@test "too many arguments for pyenv-uninstall" {
+@test "more than one argument for pyenv-uninstall" {
-  stub pyenv-help 'uninstall : true'
+  mkdir -p "${PYENV_ROOT}/versions/3.4.1"
+  mkdir -p "${PYENV_ROOT}/versions/3.4.2"
+  run pyenv-uninstall -f 3.4.1 3.4.2
 
-  run pyenv-uninstall 3.4.1 3.4.2
+  assert_success
+  refute [ -d "${PYENV_ROOT}/versions/3.4.1" ]
+  refute [ -d "${PYENV_ROOT}/versions/3.4.2" ]
+}
+
+@test "invalid arguments for pyenv-uninstall" {
+  mkdir -p "${PYENV_ROOT}/versions/3.10.3"
+  mkdir -p "${PYENV_ROOT}/versions/3.10.4"
+
+  run pyenv-uninstall -f 3.10.3 --invalid-option 3.10.4
   assert_failure
-  unstub pyenv-help
+
+  assert [ -d "${PYENV_ROOT}/versions/3.10.3" ]
+  assert [ -d "${PYENV_ROOT}/versions/3.10.4" ]
+
+  rmdir "${PYENV_ROOT}/versions/3.10.3"
+  rmdir "${PYENV_ROOT}/versions/3.10.4"
 }
 
 @test "show help for pyenv-uninstall" {

pyenv.d/install/latest.bash

@@ -1,7 +1,13 @@
 DEFINITION_PREFIX="${DEFINITION%%:*}"
 DEFINITION_TYPE="${DEFINITION_PREFIX%%-*}" # TODO: support non-CPython versions
 if [[ "${DEFINITION}" != "${DEFINITION_PREFIX}" ]]; then
-  DEFINITION_CANDIDATES=($(python-build --definitions | grep -F "${DEFINITION_PREFIX}" | grep "^${DEFINITION_TYPE}" | sed -e '/-dev$/d' -e '/-src$/d' | sort -t. -k1,1r -k 2,2nr -k 3,3nr || true))
+  DEFINITION_CANDIDATES=(\
+    $(python-build --definitions | \
+      grep -F "${DEFINITION_PREFIX}" | \
+      grep "^${DEFINITION_TYPE}" | \
+      sed -E -e '/-dev$/d' -e '/-src$/d' -e '/(b|rc)[0-9]+$/d' | \
+      sort -t. -k1,1r -k 2,2nr -k 3,3nr \
+    || true))
   DEFINITION="${DEFINITION_CANDIDATES}"
   VERSION_NAME="${DEFINITION##*/}"
 fi

test/version-file-read.bats

@@ -83,14 +83,36 @@ IN
   assert_success "3.9.3:3.8.9:2.7.16"
 }
 
-@test "skips relative path traversal" {
+@test "skips \`..' relative path traversal" {
+  echo '..' > my-version
+  run pyenv-version-file-read my-version
+  assert_failure "pyenv: invalid version \`..' ignored in \`my-version'"
+}
+
+@test "skips glob path traversal" {
   cat > my-version <<IN
+../*
 3.9.3
-3.8.9
-  ..
-./*
-2.7.16
 IN
   run pyenv-version-file-read my-version
-  assert_success "3.9.3:3.8.9:2.7.16"
+  assert_success <<OUT
+pyenv: invalid version \`../\*' ignored in \`my-version'
+3.9.3
+OUT
+}
+
+@test "allows relative paths that exist and stay within versions" {
+  venv=3.10.3/envs/../test
+  mkdir -p "${PYENV_ROOT}/versions/${venv}"
+  echo -n "${venv}" > my-version
+  run pyenv-version-file-read my-version
+  assert_success "${venv}"
+}
+
+@test "skips relative paths that lead outside of versions" {
+  venv=../3.10.3/envs/test
+  mkdir -p "${PYENV_ROOT}/versions/${venv}"
+  echo -n "${venv}" > my-version
+  run pyenv-version-file-read my-version
+  assert_failure
 }