contrib/freeze_packages: use stdlib "venv" vs 3rd party virtualenv
What the developer wrote
Authored by SomberNight
contrib/freeze_packages: use stdlib "venv" vs 3rd party virtualenv
What changed, and why it matters
This commit changes a build helper script to create Python virtual environments using the standard library's built-in 'venv' module instead of the separately installable 'virtualenv' tool. It removes a dependency on a third-party package and a check that required it to be installed. There is no direct security fix here, but relying on the standard library reduces supply-chain exposure and avoids potential issues from an external tool.
Treat as a routine build-maintenance improvement. Reviewers may verify that the system Python used by the script provides a working 'venv' module and that frozen requirements outputs remain unchanged. No urgent security action is required.
Security signals we found
Reduced third-party build dependency (virtualenv package no longer required)
Uses stdlib venv, lowering supply-chain attack surface for build tooling
No direct vulnerability fix or cryptographic change in the diff
Evidence from the diff
The patch modifies contrib/freeze_packages.sh to replace ‘virtualenv -p ${SYSTEM_PYTHON} $venv_dir’ with ‘${SYSTEM_PYTHON} -m venv $venv_dir’ and removes the ‘which virtualenv’ prerequisite check. This is a build-hygiene change: it uses the stdlib venv module bundled with the system Python interpreter rather than the PyPI ‘virtualenv’ package. The script still installs ‘hashin’ into the environment and freezes requirements files. No runtime wallet code is changed, and no vulnerability is patched in the diff itself.
Changed components
contrib/freeze_packages.shInspect captured patch +1 / −3
diff --git a/contrib/freeze_packages.sh b/contrib/freeze_packages.sh
index 1a5dcc6..17542a0 100755
--- a/contrib/freeze_packages.sh
+++ b/contrib/freeze_packages.sh
@@ -16,15 +16,13 @@ if [[ ! "$SYSTEM_PYTHON" ]] ; then
echo "Please specify which python to use in \$SYSTEM_PYTHON" && exit 1
fi
-which virtualenv > /dev/null 2>&1 || { echo "Please install virtualenv" && exit 1; }
-
"${SYSTEM_PYTHON}" -m hashin -h > /dev/null 2>&1 || { "${SYSTEM_PYTHON}" -m pip install hashin; }
for suffix in '' '-hw' '-binaries' '-binaries-mac' '-build-wine' '-build-mac' '-build-base' '-build-appimage' '-build-android'; do
reqfile="requirements${suffix}.txt"
rm -rf "$venv_dir"
- virtualenv -p "${SYSTEM_PYTHON}" "$venv_dir"
+ "${SYSTEM_PYTHON}" -m venv "$venv_dir"
source "$venv_dir/bin/activate"
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.