search

pypa / pip-audit

Audits Python environments, requirements files and dependency trees for known security vulnerabilities, and can automatically fix them
https://pypi.org/project/pip-audit/
Apache License 2.0
942 stars 62 forks source link

_virtual_env: handle PermissionError #737

Closed woodruffw closed 4 months ago

woodruffw commented 4 months ago

WIP, needs tests.

Closes https://github.com/pypa/pip-audit/issues/732

woodruffw commented 4 months ago

Just thinking out loud: this is going to be really annoying to test. I guess we could mock it out, but that won't guarantee that I got the exact callsite right here.

woodruffw commented 4 months ago

I looked into this a bit more, and I mis-diagnosed this slightly originally: the error here isn't from our own code, but from venv itself: the _setup_pip function uses subprocess internally, which then explodes for the original noexec reason. So current patch is wrong.

Ref: https://github.com/python/cpython/blob/a5f49ce65ef83c41c9cc87566fe59be766d0f3ca/Lib/venv/__init__.py#L357-L360