I'm attaching a small patch (against the current hg master branch) that I believe solves the problem, however, I think it was quite hacky.

Here is a walk-through of the logic.

1) If '--system-site-packages' is requested, then it is overrided initially in the process when creating the config file. I.e. it is hard-coded to 'false' in the pyvenv.cfg file.
2) Next ensurepip is run. This is being run in the same state as it would be if no '--system-site-packages' flag were passed, so this time it installs some packages to the venv's site-packages.
3) If necessary, the config file is regenerated without over-riding the system-site-packages flag.
4) If necessary, all packages installed in site-packages are removed and a new empty site-packages folder is regenerated.

The logic here is pretty horrid, but it seems to be functioning correctly. There are a couple possible issues here:

1) I assume that on all platforms the site-packages folder will always end up empty when the no '--system-site-packages' flag is passed.
2) I also assume that on all platforms there are no differences in the venv that is produced with or without this option except for the packages installed in the system-site-packages folder.

I don't really have any way to verify either of those assumption experimentally and I'm not familiar enough with ensurepip/pip to know that way either. I've only tested this on my debian system so it could very well not be portable.

Regardless of my misgivings of the quality of this patch, I think a solution to this problem is totally essential. The '--system-site-packages' flag is a great way to let your distro's package manager install most packages you need while allowing you then to install whatever others your distro does not provide. I use this all the time to simplify/decrease maintenance complexity. Without this fix, the --system-site-packages flag is essentially equivalent to a read-only environment and in that case, there's no point in using it at all.