Python 3.14 ensurepip Wheel Permissions

[utkonos]

Output of brew config

HOMEBREW_VERSION: 5.0.3
ORIGIN: https://github.com/Homebrew/brew
HEAD: fbfdbaba008189499958a7aeb1e2c36ab10c067d
Last commit: 10 days ago
Branch: stable
Core tap JSON: 30 Nov 05:49 UTC
Core cask tap JSON: 30 Nov 05:49 UTC
HOMEBREW_PREFIX: /opt/homebrew
HOMEBREW_CASK_OPTS: []
HOMEBREW_DOWNLOAD_CONCURRENCY: 32
HOMEBREW_FORBID_PACKAGES_FROM_PATHS: set
HOMEBREW_MAKE_JOBS: 16
Homebrew Ruby: 3.4.7 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/3.4.7/bin/ruby
CPU: 16-core 64-bit arm_brava
Clang: 17.0.0 build 1700
Git: 2.52.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 26.1-arm64
CLT: 26.1.0.0.1.1761104275
Xcode: N/A
Rosetta 2: false

Output of brew doctor

Your system is ready to brew.

Description of issue

I ran into an issue when creating a virtual environment. This is a fresh macOS machine with homebrew just installed, and Python 3.14 also just installed.

% python3.14 -m venv venv
Error: Command '['/Users/username/Desktop/temp/venv/bin/python3.14', '-m', 'ensurepip', '--upgrade', '--default-pip']' returned non-zero exit status 1.

I tracked the problem down to the permissions on this file, pip-25.3-py3-none-any.whl, being -rw-------.

/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/ensurepip/_bundled

I can see that the formula replaces ensurepip with a patched one here:

https://github.com/Homebrew/homebrew-core/blob/445f776c0ece46243f299b90a1ebdfdd233abe9b/Formula/p/python%403.14.rb#L271-L308

Is the formula installing this patched wheel with more restrictive permissions than Python's original wheel? If I change the permissions to the expected -rw-r--r-- the error is gone.

Is this a bug that I should file?

[daeho-ro]

% python3.14 -m venv venv
Error: Command '['/Users/username/Desktop/temp/venv/bin/python3.14'

This is not a global bin, your venv bin.

[utkonos]

That is incorrect.

% ls -l venv/bin/python3.14
lrwxr-xr-x  1 username  staff  44 Nov 30 03:22 venv/bin/python3.14 -> /opt/homebrew/opt/[email protected]/bin/python3.14

[utkonos]

The full error shows the problem:

% python3.14 -m ensurepip --upgrade --default-pip -v
Traceback (most recent call last):
  File "<frozen runpy>", line 198, in _run_module_as_main
  File "<frozen runpy>", line 88, in _run_code
  File "/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/ensurepip/__main__.py", line 5, in <module>
    sys.exit(ensurepip._main())
             ~~~~~~~~~~~~~~~^^
  File "/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/ensurepip/__init__.py", line 257, in _main
    return _bootstrap(
        root=args.root,
    ...<4 lines>...
        default_pip=args.default_pip,
    )
  File "/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/ensurepip/__init__.py", line 159, in _bootstrap
    copy2(bundled_wheel_path, tmp_wheel_path)
    ~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/shutil.py", line 529, in copy2
    copyfile(src, dst, follow_symlinks=follow_symlinks)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/shutil.py", line 313, in copyfile
    with open(src, 'rb') as fsrc:
         ~~~~^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/opt/homebrew/Cellar/[email protected]/3.14.0_1/Frameworks/Python.framework/Versions/3.14/lib/python3.14/ensurepip/_bundled/pip-25.3-py3-none-any.whl'

My assessment of the file permissions being the root cause is correct. Rephrasing my question: is the non-standard permission setting for the patched wheel deliberate, or is this a mistake / oversight in the formula?

[carlocab]

Should be fixed by Homebrew/homebrew-core#256454.