GNU bug report logs - #64573
[PATCH 0/3] guix: build: python-build-system: Have applications by default ignore non-Guix libraries in user site dir

Previous Next

Full log

View this message in rfc822 format

From: 宋文武 <iyzsong <at> envs.net>
To: Wojtek Kosior <koszko <at> koszko.org>
Cc: jgart <jgart <at> dismail.de>, 64573 <at> debbugs.gnu.org, Lars-Dominik Braun <lars <at> 6xq.net>
Subject: [bug#64573] [PATCH 0/3] guix: build: python-build-system: Have applications by default ignore non-Guix libraries in user site dir
Date: Sat, 22 Jul 2023 08:30:04 +0800

Wojtek Kosior <koszko <at> koszko.org> writes:

> Python applications used to prioritize loading their libraries from so-called
> "user site dir" (usually in ~/.local/lib/python<VERSION>/site-packages). The
> libraries would only be loaded from /gnu/store when not found in the user site
> dir. This used to cause hard-to-diagnose bugs like [1] when a user happened to
> have a similar but incompatible version of a library installed via pip.
>
> These patches modify the python-build-system's procedure responsible for
> wrapping executables. The modified proc defines a PYTHONNOUSERSITE variable
> which makes Python applications disregard the user site dir when loading
> libraries.
>
> While this solution does harden most Python applications, it can also break a
> few ones like pip that operate on the user site dir itself. To work around
> that, the second patch introduces a change to pip to allow installing to the
> user site directory even when PYTHONNOUSERSITE is set by the Guix-created
> wrapper script.

Hello, I think we can let pip just break as other distros (eg: ArchLinux
and Debian) with PEP-668.

https://gitlab.archlinux.org/archlinux/packaging/packages/python/-/blob/main/EXTERNALLY-MANAGED
https://pythonspeed.com/articles/externally-managed-environment-pep-668/
https://peps.python.org/pep-0668/#recommendations-for-distros

With usage guide towards virtual environments, guix shell, or pipx
(not packaged yet).

Consider other distros does the same thing, this should be safer.

What do you think?  🤔

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.