Sync with upstream astral-sh/python-build-standalone

[nickvines]

Summary

• Sync fork with upstream astral-sh/python-build-standalone
• Includes updates to CPython 3.15.0a3, 3.14.2, 3.13.11
• Various build improvements and patches

🤖 Generated with Claude Code

[semgrep-code-verkada]

Semgrep identified a blocking 🔴 issue in your code:
Found user controlled content when spawning a process. This is dangerous because it allows a malicious actor to execute commands.

Why this might be safe to ignore:

This is a build script that uses os.execve with the Python interpreter path and controlled arguments in a development context. The environment variables are passed through but the command itself is hardcoded ('build-main.py'), making command injection not feasible. Build scripts are not exposed to untrusted user input in production environments.

Dataflow graph

flowchart LR
    classDef invis fill:white, stroke: none
    classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none

    subgraph File0["<b>build.py</b>"]
        direction LR
        %% Source

        subgraph Source
            direction LR

            v0["<a href=https://github.com/verkada/python-build-standalone/blob/cb7ad3c6f87ca96b2ba064c902612548b43a3101/build.py#L16 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 16] os.environ</a>"]
        end
        %% Intermediate

        subgraph Traces0[Traces]
            direction TB

            v2["<a href=https://github.com/verkada/python-build-standalone/blob/cb7ad3c6f87ca96b2ba064c902612548b43a3101/build.py#L16 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 16] env</a>"]
        end
        %% Sink

        subgraph Sink
            direction LR

            v1["<a href=https://github.com/verkada/python-build-standalone/blob/cb7ad3c6f87ca96b2ba064c902612548b43a3101/build.py#L29 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 29] os.execve(python, args, env)</a>"]
        end
    end
    %% Class Assignment
    Source:::invis
    Sink:::invis

    Traces0:::invis
    File0:::invis

    %% Connections

    Source --> Traces0
    Traces0 --> Sink

Loading

To resolve this comment:

🔧 No guidance has been designated for this issue. Fix according to your organization's approved methods.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by dangerous-os-exec-tainted-env-args.

_{You can view more details about this finding in the Semgrep AppSec Platform.}