gh-96867: Set zipapp execute bits from readable bits

Lib/test/test_zipapp.py

@@ -1,6 +1,7 @@
 """Test harness for the zipapp module."""
 
 import io
+import os
 import pathlib
 import stat
 import sys
@@ -366,6 +367,38 @@ def test_shebang_is_executable(self):
         zipapp.create_archive(str(source), str(target), interpreter='python')
         self.assertTrue(target.stat().st_mode & stat.S_IEXEC)
 
+    @unittest.skipIf(sys.platform == 'win32',
+                     'Windows does not support an executable bit')
+    @unittest.skipUnless(hasattr(os, 'umask'), 'test needs os.umask()')
+    @os_helper.skip_unless_working_chmod
+    def test_shebang_executable_bits_match_readable_bits(self):
+        source = self.tmpdir / 'source'
+        source.mkdir()
+        (source / '__main__.py').touch()
+        for umask, expected_mode in ((0o022, 0o755), (0o077, 0o700)):
+            with self.subTest(umask=umask):
+                target = self.tmpdir / f'source-{umask:o}.pyz'
+                with os_helper.temp_umask(umask):
+                    zipapp.create_archive(source, target, interpreter='python')
+                self.assertEqual(stat.S_IMODE(target.stat().st_mode), expected_mode)
+
+    @unittest.skipIf(sys.platform == 'win32',
+                     'Windows does not support an executable bit')
+    @unittest.skipUnless(hasattr(os, 'umask'), 'test needs os.umask()')
+    @os_helper.skip_unless_working_chmod
+    def test_copied_shebang_executable_bits_match_readable_bits(self):
+        source = self.tmpdir / 'source'
+        source.mkdir()
+        (source / '__main__.py').touch()
+        archive = self.tmpdir / 'source.pyz'
+        zipapp.create_archive(source, archive)
+        for umask, expected_mode in ((0o022, 0o755), (0o077, 0o700)):
+            with self.subTest(umask=umask):
+                target = self.tmpdir / f'target-{umask:o}.pyz'
+                with os_helper.temp_umask(umask):
+                    zipapp.create_archive(archive, target, interpreter='python')
+                self.assertEqual(stat.S_IMODE(target.stat().st_mode), expected_mode)
+
     @unittest.skipIf(sys.platform == 'win32',
                      'Windows does not support an executable bit')
     def test_no_shebang_is_not_executable(self):

Lib/zipapp.py

@@ -50,6 +50,16 @@ def _write_file_prefix(f, interpreter):
         f.write(shebang)
 
 
+def _make_executable(path):
+    mode = os.stat(path).st_mode
+    executable = (
+        (mode & stat.S_IRUSR) >> 2
+        | (mode & stat.S_IRGRP) >> 2
+        | (mode & stat.S_IROTH) >> 2
+    )
+    os.chmod(path, mode | executable)
+
+
 def _copy_archive(archive, new_archive, interpreter=None):
     """Copy an application archive, modifying the shebang line."""
     with _maybe_open(archive, 'rb') as src:
@@ -69,8 +79,8 @@ def _copy_archive(archive, new_archive, interpreter=None):
             dst.write(first_2)
             shutil.copyfileobj(src, dst)
 
-    if interpreter and isinstance(new_archive, str):
-        os.chmod(new_archive, os.stat(new_archive).st_mode | stat.S_IEXEC)
+    if interpreter and isinstance(new_archive, (str, os.PathLike)):
+        _make_executable(new_archive)
 
 
 def create_archive(source, target=None, interpreter=None, main=None,
@@ -169,7 +179,7 @@ def create_archive(source, target=None, interpreter=None, main=None,
                 z.writestr('__main__.py', main_py.encode('utf-8'))
 
     if interpreter and not hasattr(target, 'write'):
-        target.chmod(target.stat().st_mode | stat.S_IEXEC)
+        _make_executable(target)
 
 
 def get_interpreter(archive):

Misc/NEWS.d/next/Library/2026-06-23-10-14-15.gh-issue-96867._sZyQg.rst

@@ -0,0 +1,2 @@
+Fix :mod:`zipapp` to set executable bits on archives with shebangs based on
+their readable permission bits. Contributed by Xiao Yuan.