Subject: [PATCH] gnu: cura: prevent importing outside of store

From: Jakob Kirsch <[email-masked]>
Date: Sun, 13 Apr 2025 18:29:31 +0200

I've recently tried to run cura but it kept crashing because it couldn't find shared libraries.
As it turns out, python adds directories in the home directory to the search path and a pyqt5 installed by pip managed to be loaded, which obviously won't work.
This patch addresses this by adding a small snippet of code to the top of bin/cura that clears out all paths from sys.path that don't start with /gnu.
From f49e1297a0be295a7d47ebf33fe3e27ceecefefa Mon Sep 17 00:00:00 2001
Message-ID: <f49e[email-masked]>
From: Jakob Kirsch <[email-masked]>
Date: Sun, 13 Apr 2025 18:25:20 +0200
Subject: [PATCH] gnu: cura: prevent importing outside of store

* gnu/packages/engineering.scm (cura)[arguments]<#:phases>: substitute* code into bin/cura to clear all paths from sys.path that don't start with /gnu.

Change-Id: Ie67c26ae7d43d5801a6cde7619491dacedf4e2a0
---
 gnu/packages/engineering.scm | 75 ++++++++++++++++++------------------
 1 file changed, 37 insertions(+), 38 deletions(-)

diff --git a/gnu/packages/engineering.scm b/gnu/packages/engineering.scm
index f37b0e3844..079e849ae9 100644
--- a/gnu/packages/engineering.scm
+++ b/gnu/packages/engineering.scm
@@ -4897,46 +4897,45 @@ (define-public cura
        (sha256
         (base32 "0yg17pcrj5gm02aqcjfk40ynvpb9r9aaq9rj108dkpki1is15ks7"))))
     (build-system qt-build-system)
-    (native-inputs
-     (list python-certifi
-           python-mypy
-           python-pytest
-           python-requests))
-    (inputs
-     (list bash-minimal
-           cura-engine
-           libcharon
-           libsavitar
-           python
-           python-keyring
-           python-pynest2d
-           python-pyserial
-           python-sentry-sdk
-           python-sip
-           uranium))
+    (native-inputs (list python-certifi python-mypy python-pytest
+                         python-requests))
+    (inputs (list bash-minimal
+                  cura-engine
+                  libcharon
+                  libsavitar
+                  python
+                  python-keyring
+                  python-pynest2d
+                  python-pyserial
+                  python-sentry-sdk
+                  python-sip
+                  uranium))
     (arguments
-     `(;; TODO: Fix tests.
-       #:tests? #f
+     `( ;TODO: Fix tests.
+        #:tests? #f
        #:configure-flags '("-DURANIUM_SCRIPTS_DIR=")
-       #:phases
-       (modify-phases %standard-phases
-         (add-after 'install 'link-to-CuraEngine
-           (lambda* (#:key inputs outputs #:allow-other-keys)
-             (symlink (string-append (assoc-ref inputs "cura-engine")
-                                     "/bin/CuraEngine")
-                      (string-append (assoc-ref outputs "out")
-                                     "/bin/CuraEngine"))))
-         (add-after 'link-to-CuraEngine 'wrap-pythonpath
-           (lambda* (#:key outputs #:allow-other-keys)
-             (let ((out (assoc-ref outputs "out")))
-               (wrap-program (string-append out "/bin/cura")
-                 (list "GUIX_PYTHONPATH"
-                       'prefix (list (string-append out
-                                                    "/lib/python"
-                                                    ,(version-major+minor
-                                                      (package-version python))
-                                                    "/site-packages")
-                                     (getenv "GUIX_PYTHONPATH"))))))))))
+       #:phases (modify-phases %standard-phases
+                  (add-after 'install 'link-to-CuraEngine
+                    (lambda* (#:key inputs outputs #:allow-other-keys)
+                      (symlink (string-append (assoc-ref inputs "cura-engine")
+                                              "/bin/CuraEngine")
+                               (string-append (assoc-ref outputs "out")
+                                              "/bin/CuraEngine"))))
+                  (add-after 'link-to-CuraEngine 'wrap-pythonpath
+                    (lambda* (#:key outputs #:allow-other-keys)
+                      (let ((out (assoc-ref outputs "out")))
+                        (begin
+                          (substitute* (string-append out "/bin/cura")
+                            (("import sys")
+                             "import sys; [sys.path.remove(x) for x in sys.path if not x.startswith('/gnu')]"))
+                          (wrap-program (string-append out "/bin/cura")
+                            (list "GUIX_PYTHONPATH"
+                                  'prefix
+                                  (list (string-append out "/lib/python"
+                                                       ,(version-major+minor (package-version
+                                                                              python))
+                                                       "/site-packages")
+                                        (getenv "GUIX_PYTHONPATH")))))))))))
     (home-page "https://github.com/Ultimaker/Cura")
     (synopsis "Slicer for 3D printers")
     (description "Cura is a slicing software from Ultimaker.  A @emph{slicer}

base-commit: 94e7afbb557d3f2709072bf2bf58618293ca7fbd
--
2.49.0