stack/erp5: patch RestrictedPython to compile with print_function

Every restricted python code on python2 will be compiled as if it had
`from __future__ import print_function`, to ease transition away from
python2.

To update project code, 2to3 from python2.7 seems to do a good job.
Invoking like from the root of a repository rewrite all scripts:

    2to3  --write --nobackups --no-diffs --fix=print .

component/egg-patch/RestrictedPython/0001-compile-implicitly-enable-__future__.print_function-.patch

+From 4c132f622f33575aca8da1d0450caa3a33b8c0a0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=A9rome=20Perrin?= <jerome@nexedi.com>
+Date: Thu, 4 Jan 2024 00:13:08 +0900
+Subject: [PATCH] compile: implicitly enable __future__.print_function when
+ compiling functions
+
+---
+ src/RestrictedPython/compile.py           | 5 +++--
+ tests/test_compile_restricted_function.py | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/src/RestrictedPython/compile.py b/src/RestrictedPython/compile.py
+index 3fc2881..98f3026 100644
+--- a/src/RestrictedPython/compile.py
++++ b/src/RestrictedPython/compile.py
+@@ -3,6 +3,7 @@ from RestrictedPython._compat import IS_CPYTHON
+ from RestrictedPython._compat import IS_PY2
+ from RestrictedPython.transformer import RestrictingNodeTransformer
+ 
++import __future__
+ import ast
+ import warnings
+ 
+@@ -134,7 +135,7 @@ def compile_restricted_function(
+         name,
+         filename='<string>',
+         globalize=None,  # List of globals (e.g. ['here', 'context', ...])
+-        flags=0,
++        flags=__future__.print_function.compiler_flag,
+         dont_inherit=False,
+         policy=RestrictingNodeTransformer):
+     """Compile a restricted code object for a function.
+@@ -144,7 +145,7 @@ def compile_restricted_function(
+     """
+     # Parse the parameters and body, then combine them.
+     try:
+-        body_ast = ast.parse(body, '<func code>', 'exec')
++        body_ast = compile(body, '<func code>', 'exec', ast.PyCF_ONLY_AST | flags, dont_inherit)
+     except SyntaxError as v:
+         error = syntax_error_template.format(
+             lineno=v.lineno,
+diff --git a/tests/test_compile_restricted_function.py b/tests/test_compile_restricted_function.py
+index 5c81f86..a49e475 100644
+--- a/tests/test_compile_restricted_function.py
++++ b/tests/test_compile_restricted_function.py
+@@ -9,7 +9,7 @@ from types import FunctionType
+ def test_compile_restricted_function():
+     p = ''
+     body = """
+-print("Hello World!")
++print("Hello", "World!")
+ return printed
+ """
+     name = "hello_world"
+-- 
+2.42.0
+

stack/erp5/buildout.cfg

@@ -713,6 +713,8 @@ PyPDF2-patches =
 PyPDF2-patch-options = -p1
 python-magic-patches = ${:_profile_base_location_}/../../component/egg-patch/python_magic/magic.patch#de0839bffac17801e39b60873a6c2068
 python-magic-patch-options = -p1
+RestrictedPython-patches = ${:_profile_base_location_}/../../component/egg-patch/RestrictedPython/0001-compile-implicitly-enable-__future__.print_function-.patch#f746dccbf3b462e67386490b898512e4
+RestrictedPython-patch-options = -p1
 # backported security patches for waitress-1.4.4 from Debian 1.4.4-1.1+deb11u1 package.
 waitress-patches =
   ${:_profile_base_location_}/../../component/egg-patch/waitress/CVE-2022-24761-1.patch#a0508880f24662e48a20ce3bcbf440c2
@@ -765,6 +767,7 @@ PyPDF2 = 1.26.0+SlapOSPatched002
 pysvn = 1.9.15+SlapOSPatched001
 python-ldap = 2.4.32+SlapOSPatched001
 python-magic = 0.4.12+SlapOSPatched001
+RestrictedPython = 5.4+SlapOSPatched001
 waitress = 1.4.4+SlapOSPatched006
 Zope = 4.8.9+SlapOSPatched002
 ## https://lab.nexedi.com/nexedi/slapos/merge_requests/648