[bug#64573] [PATCH 1/3] guix: build: python-build-system: Don't process user site dir

[Wojtek Kosior]

* guix/build/python-build-system.scm (wrap): Define PYTHONNOUSERSITE for
programs so they don't incorrectly pick up local, pip-installed libraries.
---
 guix/build/python-build-system.scm | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/guix/build/python-build-system.scm 
b/guix/build/python-build-system.scm
index aa04664b25..93aafc4aa9 100644
--- a/guix/build/python-build-system.scm
+++ b/guix/build/python-build-system.scm
@@ -241,12 +241,16 @@ (define* (wrap #:key inputs outputs #:allow-other-keys)
   (define %sh (delay (search-input-file inputs "bin/bash")))
   (define (sh) (force %sh))
 
-  (let* ((var `("GUIX_PYTHONPATH" prefix
-                ,(search-path-as-string->list
-                  (or (getenv "GUIX_PYTHONPATH") "")))))
+  (let* ((var-pythonpath `("GUIX_PYTHONPATH" prefix
+                           ,(search-path-as-string->list
+                             (or (getenv "GUIX_PYTHONPATH") ""))))
+         ;; Harden applications by preventing Python from automatically
+         ;; picking up libraries in user site directory.
+         (var-usersite '("PYTHONNOUSERSITE" = ("GUIX_WRAPPER"))))
     (for-each (lambda (dir)
                 (let ((files (list-of-files dir)))
-                  (for-each (cut wrap-program <> #:sh (sh) var)
+                  (for-each (cut wrap-program <> #:sh (sh)
+                                 var-pythonpath var-usersite)
                             files)))
               bindirs)))
 
-- 
2.40.1