[bug#64573] [PATCH 0/3] guix: build: python-build-system: Have applications by default ignore non-Guix libraries in user site dir

[Wojtek Kosior]

Python applications used to prioritize loading their libraries from so-called
"user site dir" (usually in ~/.local/lib/python<VERSION>/site-packages). The
libraries would only be loaded from /gnu/store when not found in the user site
dir. This used to cause hard-to-diagnose bugs like [1] when a user happened to
have a similar but incompatible version of a library installed via pip.

These patches modify the python-build-system's procedure responsible for
wrapping executables. The modified proc defines a PYTHONNOUSERSITE variable
which makes Python applications disregard the user site dir when loading
libraries.

While this solution does harden most Python applications, it can also break a
few ones like pip that operate on the user site dir itself. To work around
that, the second patch introduces a change to pip to allow installing to the
user site directory even when PYTHONNOUSERSITE is set by the Guix-created
wrapper script.

The third patch adds a boolean argument called disable-user-site? to
python-build-system. Packagers can set this argument to #f on per-package
basis to disable the hardening behavior in case it breaks some
application. Note that in the long run, it might be beneficial (although more
time-consuming) to leave disable-user-site? as #t everywhere and instead
modify the problematic applications — as done here with python-pip. It might
even be practical to only merge the first 2 patches from this series.

Please note that virtualenvs and packages that operate on them are likely
unaffected by this change. The initial bug doesn't even occur with
virtualenvs.


I tested the changes with

    ./pre-inst-env guix shell -C --network --no-cwd python-xmldiff coreutils 
python-pip
    pip install xmldiff==2.4
    echo > ~/.local/lib/python3.10/site-packages/xmldiff/main.py
    xmldiff --help

Without any patches, the 4th line fails. With the patches applied, the 4th
line succeeds and prints xmldiff's usage info


[1] https://issues.guix.gnu.org/63912


Wojtek Kosior (3):
  guix: build: python-build-system: Don't process user site dir
  gnu: python-pip: Enable user site even with PYTHONNOUSERSITE
  guix: build: python-build-system: Honor disable-user-site? argument

 gnu/packages/python-build.scm      | 10 +++++++++-
 guix/build-system/python.scm       |  2 ++
 guix/build/python-build-system.scm | 27 ++++++++++++++++++---------
 3 files changed, 29 insertions(+), 10 deletions(-)


base-commit: 67e22584faaa558c2a5834a5013d77660ec45e85
-- 
2.40.1