test: make the verifier's fake curl robust to whitespace in sys.executable

tests/test_workflow_step_submission.py

@@ -6,6 +6,7 @@
 import builtins
 import copy
 import re
+import shlex
 import shutil
 import subprocess
 import sys
@@ -411,14 +412,35 @@ def test_fetch_keeps_malicious_text_in_one_argument_even_if_validation_is_bypass
 ):
     curl = tmp_path / "curl"
     arguments = tmp_path / "arguments.json"
-    curl.write_text(
-        f"#!{sys.executable}\n"
+    python_code = (
         "import json, sys\n"
         "from pathlib import Path\n"
         f"Path({str(arguments)!r}).write_text(json.dumps(sys.argv[1:]))\n"
         "Path(sys.argv[sys.argv.index('--output') + 1]).write_bytes(b'fixture bytes')\n"
         "print('200', end='')\n"
     )
+    # A `#!<interpreter>` shebang breaks when the interpreter path contains
+    # whitespace: the macOS kernel splits the shebang line on spaces, so a
+    # checkout living in e.g. "GitHub Contribution/" makes every lookup of
+    # `curl` fail with ENOENT. Route through /bin/sh, which quotes the
+    # interpreter path properly; with `-c`, sys.argv[1:] is exactly the
+    # argument list `curl` was invoked with.
+    #
+    # The interpreter is reached through a path that itself contains a space,
+    # so restoring the direct `#!{interpreter}` shebang makes this test fail
+    # regardless of where the checkout lives.
+    try:
+        spaced_dir = tmp_path / "py dir"
+        spaced_dir.mkdir()
+        interpreter = spaced_dir / "python3"
+        interpreter.symlink_to(sys.executable)
+    except OSError:
+        pytest.skip("symlinks to the interpreter are unavailable here")
+    curl.write_text(
+        "#!/bin/sh\n"
+        f"exec {shlex.quote(str(interpreter))} -c {shlex.quote(python_code)} \"$@\"\n",
+        encoding="utf-8",
+    )
     curl.chmod(0o755)
     monkeypatch.setenv("PATH", str(tmp_path))
     monkeypatch.chdir(tmp_path)