https://fedoraproject.org/wiki/Changes/PythonSafePath

macros.python

@@ -13,7 +13,7 @@
 %python_cache_tag %(RPM_BUILD_ROOT= %{__python} -Esc "import sys; print(sys.implementation.cache_tag)")
 
 %py_setup setup.py
-%py_shbang_opts -s
+%py_shbang_opts -s%(RPM_BUILD_ROOT= %{__python} -Esc "import sys; print('P' if hasattr(sys.flags, 'safe_path') else '')")
 %py_shbang_opts_nodash %(opts=%{py_shbang_opts}; echo ${opts#-})
 %py_shebang_flags %(opts=%{py_shbang_opts}; echo ${opts#-})
 %py_shebang_fix %{expand:\\\

macros.python3

@@ -11,7 +11,7 @@
 %python3_cache_tag %(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print(sys.implementation.cache_tag)")
 %py3dir %{_builddir}/python3-%{name}-%{version}-%{release}
 
-%py3_shbang_opts -s
+%py3_shbang_opts -s%(RPM_BUILD_ROOT= %{__python3} -Ic "import sys; print('P' if hasattr(sys.flags, 'safe_path') else '')")
 %py3_shbang_opts_nodash %(opts=%{py3_shbang_opts}; echo ${opts#-})
 %py3_shebang_flags %(opts=%{py3_shbang_opts}; echo ${opts#-})
 %py3_shebang_fix %{expand:\\\

python-rpm-macros.spec

@@ -49,7 +49,7 @@ elseif posix.stat('macros.python-srpm') then
 end
 }
 Version:        %{__default_python3_version}
-Release:        2%{?dist}
+Release:        3%{?dist}
 
 BuildArch:      noarch
 
@@ -151,6 +151,11 @@ grep -E '^#[^%%]*%%[^%%]' %{buildroot}%{rpmmacrodir}/macros.* && exit 1 || true
 
 
 %changelog
+* Tue Jul 19 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11-3
+- Add "P" to %%py3_shbang_opts, %%py3_shbang_opts_nodash, %%py3_shebang_flags
+  and to %%py_shbang_opts, %%py_shbang_opts_nodash, %%py_shebang_flags
+- https://fedoraproject.org/wiki/Changes/PythonSafePath
+
 * Mon Jun 20 2022 Miro Hrončok <mhroncok@redhat.com> - 3.11-2
 - Define %%python3_cache_tag / %%python_cache_tag, e.g. cpython-311
 

tests/test_evals.py

@@ -85,6 +85,11 @@ alt_x_y = pytest.fixture(scope="session")(get_alt_x_y)
 alt_xy = pytest.fixture(scope="session")(get_alt_xy)
 
 
+# https://fedoraproject.org/wiki/Changes/PythonSafePath
+def safe_path_flag(x_y):
+    return 'P' if tuple(int(i) for i in x_y.split('.')) >= (3, 11) else ''
+
+
 def shell_stdout(script):
     return subprocess.check_output(script,
                                    env={**os.environ, 'LANG': 'C.utf-8'},
@@ -409,7 +414,7 @@ def test_py3_shebang_fix():
 def test_py3_shebang_fix_default_shebang_flags():
     lines = rpm_eval('%py3_shebang_fix arg1 arg2')
     lines[-1] = 'echo $shebang_flags'
-    assert shell_stdout('\n'.join(lines)) == '-kas'
+    assert shell_stdout('\n'.join(lines)) == f'-kas{safe_path_flag(X_Y)}'
 
 
 def test_py3_shebang_fix_custom_shebang_flags():
@@ -773,7 +778,6 @@ def test_py3_check_import(args, expected_args, __python3, lib):
     macros = {
         'buildroot': 'BUILDROOT',
         '_rpmconfigdir': 'RPMCONFIGDIR',
-        'py3_shebang_flags': 's',
     }
     if __python3 is not None:
         if 'X.Y' in __python3:
@@ -798,7 +802,7 @@ def test_py3_check_import(args, expected_args, __python3, lib):
         PYTHONPATH="${{PYTHONPATH:-BUILDROOT/usr/{lib}/python{x_y}/site-packages:BUILDROOT/usr/lib/python{x_y}/site-packages}}"
         _PYTHONSITE="BUILDROOT/usr/{lib}/python{x_y}/site-packages:BUILDROOT/usr/lib/python{x_y}/site-packages"
         PYTHONDONTWRITEBYTECODE=1
-        {__python3 or '/usr/bin/python3'} -s RPMCONFIGDIR/redhat/import_all_modules.py {expected_args}
+        {__python3 or '/usr/bin/python3'} -s{safe_path_flag(x_y)} RPMCONFIGDIR/redhat/import_all_modules.py {expected_args}
         """)
     assert lines == expected.splitlines()
 
@@ -806,6 +810,7 @@ def test_py3_check_import(args, expected_args, __python3, lib):
 @pytest.mark.parametrize(
     'shebang_flags_value, expected_shebang_flags',
     [
+        ('sP', '-sP'),
         ('s', '-s'),
         ('%{nil}', ''),
         (None, ''),