[FIX] the Python bootstrap installed older code than it claimed

python-packaging's PKGBUILD says pkgver=26.3 and the installed module reported
25.0. The vendored builder selected by _bootstrap=1 carries its OWN copy of each
project, older than the release the PKGBUILD names. Nothing about the package
looked wrong; only `packaging.__version__` disagreed with its own name, and the
mismatch surfaced two packages later:

  python-vcs-versioning: packaging>=26.2

a floor our own package met on paper and not in fact.

_bootstrap is now a probe evaluated by makepkg, in the build environment: if
`build` and `installer` import, the real path works and the vendored copies are
not wanted. A hook could not decide this -- hooks run on the HOST even for stage
2, so a probe written there cannot answer for the chroot.

The license install then had to handle both layouts, since the source tree is a
git clone under $pkgname when bootstrapping and a release tarball otherwise.
Hardcoding either breaks the other, and this hook had hardcoded the clone -- right
only while _bootstrap was always 1.

--- FR ---

Le PKGBUILD de python-packaging annonce pkgver=26.3 et le module installé
rapportait 25.0. Le constructeur embarqué que sélectionne _bootstrap=1 porte ses
PROPRES copies de chaque projet, plus anciennes que la version nommée. Rien dans
le paquet n'avait l'air faux ; seul `packaging.__version__` contredisait son
propre nom, et l'écart est apparu deux paquets plus loin :

  python-vcs-versioning: packaging>=26.2

un plancher que notre paquet satisfaisait sur le papier et non en fait.

_bootstrap est désormais une sonde évaluée par makepkg, dans l'environnement de
construction : si `build` et `installer` s'importent, la voie normale fonctionne et
les copies embarquées ne sont pas voulues. Un hook ne pouvait pas trancher — les
hooks tournent sur l'HÔTE même pour l'étage 2, donc une sonde écrite là ne peut
pas répondre pour le chroot.

L'installation de la licence devait alors gérer les deux dispositions, l'arbre
source étant un clone git sous $pkgname en mode bootstrap et une archive sinon.
Écrire l'une en dur casse l'autre, et ce hook avait écrit le clone en dur — juste
seulement tant que _bootstrap valait toujours 1.

Assisted-by: Claude Opus 5

patches/pkgbuild/lib-python-bootstrap.sh

@@ -37,16 +37,41 @@
 # It also means these build on the HOST, where they had failed, so they need no
 # stage-2 special handling at all.
 set -euo pipefail
+# A PROBE, not a constant, and it runs in the BUILD ENVIRONMENT.
+#
+# The first version set _bootstrap=1 unconditionally. That is right on a machine
+# with no Python packaging stack and wrong the moment there is one, because the
+# vendored builder carries its OWN copy of each project -- older than the
+# PKGBUILD's pkgver. python-packaging was labelled 26.3 and installed 25.0, and
+# the mismatch surfaced two packages later:
+#
+#   python-vcs-versioning: packaging>=26.2
+#
+# a floor our own package met on paper and not in fact. Nothing about the
+# installed package looked wrong; only `import packaging; packaging.__version__`
+# disagreed with its name.
+#
+# So the PKGBUILD decides at build time, where the answer is knowable: if `build`
+# and `installer` import, the real path works and the vendored copies are not
+# wanted. Hooks run on the HOST even for stage 2, so a probe written here could
+# not answer for the chroot -- this one is evaluated by makepkg, inside it.
 python3 - <<'ZZPY'
 import io
 s = io.open("PKGBUILD", encoding="utf-8").read()
 old = "_bootstrap=0"
 assert s.count(old) == 1, "python bootstrap: expected one _bootstrap=0, got %d" % s.count(old)
-s = s.replace(old, "_bootstrap=1  # see patches/pkgbuild/lib-python-bootstrap.sh", 1)
+new = ("# Bootstrap only when the real path is unavailable -- see\n"
+       "# patches/pkgbuild/lib-python-bootstrap.sh. Evaluated by makepkg, in the\n"
+       "# build environment, because that is where the answer lives.\n"
+       "_bootstrap=1\n"
+       "python -c 'import build, installer' >/dev/null 2>&1 && _bootstrap=0")
+s = s.replace(old, new, 1)
 io.open("PKGBUILD", "w", encoding="utf-8").write(s)
 ZZPY
-grep -q "^_bootstrap=1" PKGBUILD || {
+grep -q "^_bootstrap=1$" PKGBUILD || {
-    echo "python bootstrap: _bootstrap was not switched" >&2; exit 1; }
+    echo "python bootstrap: the default was not set to 1" >&2; exit 1; }
+grep -q "import build, installer" PKGBUILD || {
+    echo "python bootstrap: the probe was not inserted" >&2; exit 1; }
 # The branch it selects must actually exist, or the switch silently builds
 # nothing -- these PKGBUILDs are not required to have both halves.
 grep -q "bootstrap.build" PKGBUILD || {

patches/pkgbuild/python-packaging.sh

@@ -23,10 +23,34 @@ import io, re
 lines = io.open("PKGBUILD", encoding="utf-8").read().split("\n")
 hit = [i for i, l in enumerate(lines) if "LICENSE*" in l and "$_name-$pkgver" in l]
 assert len(hit) == 1, "python-packaging: expected one license install, got %d" % len(hit)
-lines[hit[0]] = lines[hit[0]].replace("$srcdir/$_name-$pkgver/LICENSE*",
+# BOTH LAYOUTS, because _bootstrap is now a probe rather than a constant
-                                      "$srcdir/$pkgname/LICENSE*")
+# (see lib-python-bootstrap.sh). With the vendored builder the sources are git
+# clones under $srcdir/$pkgname; without it they are the release tarball under
+# $srcdir/$_name-$pkgver. Hardcoding either one breaks the other, and the first
+# version of this hook hardcoded the clone -- correct only while _bootstrap was
+# always 1.
+lines[hit[0]] = re.sub(
+    r"\$srcdir/\$_name-\$pkgver/LICENSE\*",
+    '"$srcdir/$pkgname"/LICENSE* "$srcdir/$_name-$pkgver"/LICENSE*',
+    lines[hit[0]])
+# install -t with two globs would fail on whichever does not exist, so the
+# whole line becomes a loop over what is actually there.
+ind = re.match(r"^[ \t]*", lines[hit[0]]).group(0)
+lines[hit[0]:hit[0] + 1] = [
+    ind + '# The sources are a git clone under $pkgname when the vendored builder',
+    ind + '# is used, and the release tarball otherwise. Take whichever exists.',
+    ind + 'for _lic in "$srcdir/$pkgname"/LICENSE* "$srcdir/$_name-$pkgver"/LICENSE*; do',
+    ind + '  [ -f "$_lic" ] && install -vDm644 "$_lic" -t "$pkgdir/usr/share/licenses/$pkgname"',
+    ind + 'done',
+]
 io.open("PKGBUILD", "w", encoding="utf-8").write("\n".join(lines))
 ZZPY
-grep -q 'srcdir/\$pkgname/LICENSE\*' PKGBUILD || {
+grep -q 'Take whichever exists' PKGBUILD || {
-    echo "python-packaging: the license path was not redirected" >&2; exit 1; }
+    echo "python-packaging: the license loop was not inserted" >&2; exit 1; }
+# Matched against what is actually written -- the inserted line quotes the
+# directory, `"$srcdir/$_name-$pkgver"/LICENSE*`, so a pattern expecting the
+# slash to follow $pkgver directly finds nothing. The first version of this guard
+# did exactly that and failed on a correct file.
+grep -q '_name-\$pkgver"/LICENSE\*' PKGBUILD || {
+    echo "python-packaging: the tarball layout was dropped" >&2; exit 1; }
 echo "python-packaging: license taken from the bootstrap clone"