gh-145417: Do not preserve SELinux context when copying venv scripts

Lib/test/test_venv.py

@@ -373,6 +373,47 @@ def create_contents(self, paths, filename):
             with open(fn, 'wb') as f:
                 f.write(b'Still here?')
 
+    def test_install_scripts_mtime(self):
+        """
+        Test that install_scripts does not preserve mtime when copying scripts.
+        Using mtime serves as a proxy to verify that shutil.copy2 (and thus
+        SELinux bin_t contexts) is not being used during script installation.
+        See gh-145417.
+        """
+        import time
+
+        venv_dir = os.path.dirname(venv.__file__)
+        src_path = os.path.join(venv_dir, 'scripts', 'common', 'Activate.ps1')
+        src_mtime = os.path.getmtime(src_path)
+        if abs(time.time() - src_mtime) < 1.0:
+            time.sleep(1.1)
+
+        rmtree(self.env_dir)
+        venv.create(self.env_dir)
+
+        dst_path = os.path.join(self.env_dir, self.bindir, 'Activate.ps1')
+        self.assertTrue(os.path.exists(dst_path), "Activate.ps1 not found in venv")
+        dst_mtime = os.path.getmtime(dst_path)
+
+        # shutil.copy should update mtime, whereas shutil.copy2 would preserve it
+        self.assertNotEqual(src_mtime, dst_mtime,
+                          "mtime was preserved, meaning shutil.copy2 was used")
+
+        # Permissions and content should still match
+        src_stat = os.stat(src_path)
+        dst_stat = os.stat(dst_path)
+        self.assertEqual(src_stat.st_mode, dst_stat.st_mode, "File modes do not match")
+
+        with open(src_path, 'rb') as f:
+            src_data = f.read()
+        with open(dst_path, 'rb') as f:
+            dst_data = f.read()
+        self.assertEqual(src_data, dst_data, "File contents do not match")
+
+        self.assertNotIn(b'__VENV_PYTHON__', src_data,
+                         "Test assumes Activate.ps1 is a static file, not a template")
+
+
     def test_overwrite_existing(self):
         """
         Test creating environment in an existing directory.

Lib/venv/__init__.py

@@ -581,7 +581,7 @@ def skip_file(f):
                                    'may be binary: %s', srcfile, e)
                     continue
                 if new_data == data:
-                    shutil.copy2(srcfile, dstfile)
+                    shutil.copy(srcfile, dstfile)
                 else:
                     with open(dstfile, 'wb') as f:
                         f.write(new_data)

Misc/NEWS.d/next/Library/gh-145417.shrey.rst

@@ -0,0 +1 @@
+gh-145417: Fixed venv to prevent incorrect preservation of SELinux contexts when copying scripts by using shutil.copy instead of shutil.copy2.