From 6c2cd9679d52ac4f06e91026948da5fae2c2a29c Mon Sep 17 00:00:00 2001 Message-Id: <6c2cd9679d52ac4f06e91026948da5fae2c2a29c.1688740423.git.koszko@koszko.org> From: Wojtek Kosior Date: Mon, 3 Jul 2023 10:53:41 +0200 Subject: [PATCH] guix: build: python-build-system: Don't process user site dir * guix/build/python-build-system.scm (wrap): Define PYTHONNOUSERSITE for programs so they don't incorrectly pick up local, pip-installed libraries. --- guix/build/python-build-system.scm | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/guix/build/python-build-system.scm b/guix/build/python-build-system.scm index aa04664b25..bbcb861da0 100644 --- a/guix/build/python-build-system.scm +++ b/guix/build/python-build-system.scm @@ -241,12 +241,16 @@ (define* (wrap #:key inputs outputs #:allow-other-keys) (define %sh (delay (search-input-file inputs "bin/bash"))) (define (sh) (force %sh)) - (let* ((var `("GUIX_PYTHONPATH" prefix - ,(search-path-as-string->list - (or (getenv "GUIX_PYTHONPATH") ""))))) + (let* ((var-pythonpath `("GUIX_PYTHONPATH" prefix + ,(search-path-as-string->list + (or (getenv "GUIX_PYTHONPATH") "")))) + ;; Harden applications by preventing Python from automatically + ;; picking up libraries in user site directory. + (var-usersite '("PYTHONNOUSERSITE" = ("1")))) (for-each (lambda (dir) (let ((files (list-of-files dir))) - (for-each (cut wrap-program <> #:sh (sh) var) + (for-each (cut wrap-program <> #:sh (sh) + var-pythonpath var-usersite) files))) bindirs))) base-commit: 08649cfcd41bc78ba4df0609798461816dda9496 -- 2.40.1