hardcode python interpreter in python plug-ins (#952227)

gimp.spec

@@ -46,6 +46,8 @@
 %else
 %bcond_without helpbrowser
 %endif
+# hardcode python interpreter in python plug-ins
+%bcond_without hardcoded_python
 
 # skip tests known to be problematic in a specific version
 #global skip_checks_version X.Y.Z
@@ -294,6 +296,7 @@ build ASCII art plugin        %{with aalib}
 harden binaries:              %{with hardening}
 use poppler:                  %{with poppler}
 build help browser:           %{with helpbrowser}
+hardcode python interpreter   %{with hardcoded_python}
 --- >8 ---------------------------------------------------------------------
 EOF
 
@@ -442,6 +445,16 @@ ln -snf gimptool-%{lib_api_version}.1 %{buildroot}%{_mandir}/man1/gimptool.1
 ln -snf gimprc-%{binver}.5 %{buildroot}/%{_mandir}/man5/gimprc.5
 %endif
 
+%if %{with hardcoded_python}
+# Hardcode python interpreter in shipped python plug-ins. This actually has no
+# effect because gimp maps hashbangs with and without the /usr/bin/env detour
+# to the system python interpreter, but this will avoid false alarms.
+egrep -rl '^#!\s*%{_bindir}/env\s+python' --include=\*.py "%buildroot" |
+    while read file; do
+        sed -r '1s,^#!\s*%{_bindir}/env\s+python,#!%{__python},' -i "$file"
+    done
+%endif
+
 %check
 # skip tests known to be problematic in a specific version
 %if "%version" == "%{?skip_checks_version}"
@@ -607,6 +620,7 @@ gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || :
 - fix upstream commit ids
 - fix double-free crashes when selecting gradients from script-fu (#964470)
 - fix crash in unsharp-mask plug-in (#966987)
+- hardcode python interpreter in python plug-ins (#952227)
 
 * Sat Apr 20 2013 Nils Philippsen <nils@redhat.com> - 2:2.8.4-3
 - don't crash upon deleting tags in popup (#892828)