fix(nodeenv): append in front of the signature block of Activate.ps1

The Activate.ps1 python ships on Windows is signed, and PowerShell will
not parse a script with code after its signature block: the whole
activation failed with "Executable script code found in signature
block" instead of only losing the prompt.

writefile() now inserts an appended part in front of the block. The
signature no longer matches, but editing the script voids it whichever
end the new part goes to.

The PowerShell probe runs with $ErrorActionPreference = 'Stop' and its
stderr folded into stdout, so a script that cannot be parsed fails the
test that runs it instead of the next one.

Author: ekalinin

nodeenv.py

@@ -667,6 +667,9 @@ def make_executable(filename):
     os.chmod(filename, mode_0755)
 
 
+PS1_SIGNATURE = b'# SIG # Begin signature block'
+
+
 # noinspection PyArgumentList
 def writefile(dest, content, overwrite=True, append=False):
     """
@@ -696,10 +699,21 @@ def writefile(dest, content, overwrite=True, append=False):
 
         if append:
             logger.info(' * Appending data to %s', dest)
-            with open(dest, 'ab') as f:
-                if c and not c.endswith(b'\n'):
-                    f.write(b'\n')
-                f.write(content)
+            # PowerShell refuses to parse code that follows the signature
+            # block of a signed script, and the Activate.ps1 python ships
+            # on Windows is signed, so the new part goes in front of it.
+            # Editing the script voids that signature either way
+            # https://github.com/ekalinin/nodeenv/issues/243
+            head, signature, rest = c.partition(PS1_SIGNATURE)
+            # and the appended part starts on a line of its own: a
+            # "deactivate.bat" ending with `:END` and no newline would
+            # swallow the first appended line into the label
+            if head and not head.endswith(b'\n'):
+                head += b'\n'
+            if signature and not content.endswith(b'\n'):
+                content += b'\n'
+            with open(dest, 'wb') as f:
+                f.write(head + content + signature + rest)
             return
 
         logger.info(' * Overwriting %s with new content', dest)

tests/nodeenv_test.py

@@ -2597,3 +2597,23 @@ def test_append_starts_on_its_own_line(self, tmpdir):
 
         assert dest.read() == (
             '@echo off\n:END\n@echo off\nset NODE_VIRTUAL_ENV=\n')
+
+    def test_append_goes_before_a_powershell_signature(self, tmpdir):
+        """
+        PowerShell refuses to parse code that follows the signature
+        block, and the Activate.ps1 python ships on Windows is signed
+        """
+        dest = tmpdir.join('Activate.ps1')
+        dest.write('$env:VIRTUAL_ENV = "C:\\ws"\n'
+                   '# SIG # Begin signature block\n'
+                   '# MIIF...\n'
+                   '# SIG # End signature block\n')
+
+        nodeenv.writefile(
+            str(dest), '$env:NODE_VIRTUAL_ENV = "C:\\ws"\n', append=True)
+
+        assert dest.read() == ('$env:VIRTUAL_ENV = "C:\\ws"\n'
+                               '$env:NODE_VIRTUAL_ENV = "C:\\ws"\n'
+                               '# SIG # Begin signature block\n'
+                               '# MIIF...\n'
+                               '# SIG # End signature block\n')

tests/test_activate_win.py

@@ -104,13 +104,19 @@ def _parse(out, shell):
     out = out.replace('\r\n', '\n')
     _, sentinel, dump = out.partition(DUMP_SENTINEL + '\n')
     assert sentinel, 'no dump in the output of %s: %r' % (shell, out)
-    return dict(line.split('=', 1) for line in dump.splitlines() if line)
+    # anything the shell itself reported comes before the dump, but an
+    # error message can still follow it
+    return dict(line.split('=', 1) for line in dump.splitlines()
+                if line.split('=', 1)[0] in PROBED)
 
 
 def _run(args, script, lines, shell):
     script.write('\n'.join(lines) + '\n')
+    # stderr goes to stdout so a failing script reports why in the
+    # assertion instead of leaving an empty dump behind
     out = subprocess.check_output(
-        args + [str(script)], env=_child_env(), cwd=str(script.dirname))
+        args + [str(script)], stderr=subprocess.STDOUT,
+        env=_child_env(), cwd=str(script.dirname))
     return _parse(out.decode('utf-8'), shell)
 
 
@@ -122,7 +128,11 @@ def run_cmd(env, steps=()):
 
 def run_ps1(env, steps=()):
     """Run the steps in PowerShell and return the probed environment."""
-    lines = list(steps) + [_dump_line(env.dumper, call='&')]
+    # without this a script that cannot be parsed, which is what a
+    # signed Activate.ps1 with code appended after the signature block
+    # is, would be reported on stderr and otherwise ignored
+    lines = ["$ErrorActionPreference = 'Stop'"] + list(steps) + [
+        _dump_line(env.dumper, call='&')]
     return _run(
         ['powershell', '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File'],
         env.tmpdir.join('probe.ps1'), lines, 'powershell')