buildout / buildout

Buildout is a deployment automation tool written in and extended with Python
http://www.buildout.org
Other
570 stars 168 forks source link

Fix accidental changes to PYTHONPATH in os.environ #639

Open xavth opened 5 months ago

xavth commented 5 months ago

When generating an environment dict for subprocess calls to pip, os.environ was accidentally modified despite efforts to copy it and modify only the copy, as copy.copy(os.environ) is not enough.

Quick proof in a python shell:

>>> import os
>>> import copy
>>> env = copy.copy(os.environ)
>>> 'abc' in os.environ
False
>>> env['abc'] = 'xyz'
>>> 'abc' in os.environ
True
perrinjerome commented 4 months ago

That's true. pylint has a linter rule for this https://pylint.readthedocs.io/en/latest/user_guide/messages/warning/shallow-copy-environ.html

BTW, in the discussions from https://bugs.python.org/issue15373 this nice approach is discussed:

    exit_code = subprocess.call(list(args), env=dict(os.environ, PYTHONPATH=python_path))