python 3.9 package leaks CFLAGS into user packages via sysconfig

python 3.9 package leaks CFLAGS into user packages via sysconfig

[Matthias Koeppe]

$ python3.9 -m sysconfig | grep CFLAGS
CFLAGS = "-Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall
-ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
-fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
-I/usr/include/uuid/
-fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
-fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1
-ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
-fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
-I/usr/include/uuid/
-fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
-fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1"

These flags will end up in builds of user Python packages with extensions
via sysconfig/distutils.
This should be fixed by putting the necessary flags for the Python build
into CFLAGS_NODIST instead -- see similar fix for Homebrew's packaging of
python3 in https://github.com/Homebrew/homebrew-core/pull/68528

Reference: https://trac.sagemath.org/ticket/33078

-- 
Dr. Matthias Koeppe . . . . . . . . http://www.math.ucdavis.edu/~mkoeppe
Professor of Mathematics

Re: python 3.9 package leaks CFLAGS into user packages via sysconfig

[Marco Atzeri]

On 28.12.2021 02:27, Matthias Koeppe wrote:
> $ python3.9 -m sysconfig | grep CFLAGS
> CFLAGS = "-Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall
> -ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
> -fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
> -I/usr/include/uuid/
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1
> -ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
> -fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
> -I/usr/include/uuid/
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1"
> 
> These flags will end up in builds of user Python packages with extensions
> via sysconfig/distutils.
> This should be fixed by putting the necessary flags for the Python build
> into CFLAGS_NODIST instead -- see similar fix for Homebrew's packaging of
> python3 in https://github.com/Homebrew/homebrew-core/pull/68528
> 
> Reference: https://trac.sagemath.org/ticket/33078
> 

thanks Matthias
for the report and the reference.

It seems we have built all the pythons in the same way so
all versions always had it.

I will look to build a test version with the suggested change.

regards
Marco

Re: python 3.9 package leaks CFLAGS into user packages via sysconfig

[Marco Atzeri]

On 28.12.2021 03:19, Marco Atzeri wrote:
> On 28.12.2021 02:27, Matthias Koeppe wrote:
>> $ python3.9 -m sysconfig | grep CFLAGS

Hi Matthias,

can you please verify the test package

python39-3.9.9-3 (not the -2)

$ python3.9 -m sysconfig | grep CFLAGS
         BASECFLAGS = "-Wno-unused-result -Wsign-compare"
         CFLAGS = "-Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv 
-O3 -Wall"
         CFLAGSFORSHARED = ""
         CFLAGS_ALIASING = ""
         CONFIGURE_CFLAGS = ""
         CONFIGURE_CFLAGS_NODIST = "-ggdb -O2 -pipe -Wall 
-Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fstack-protector-strong 
--param=ssp-buffer-size=4 
-fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-3.x86_64/build=/usr/src/debug/python39-3.9.9-3 
-fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-3.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-3 
-DOPENSSL_NO_SSL3=1 -I/usr/include/uuid/ -std=c99 -Wextra 
-Wno-unused-result -Wno-unused-parameter -Wno-missing-field-initializers 
-Werror=implicit-function-declaration -fvisibility=hidden"
....

Regards
Marco

Re: python 3.9 package leaks CFLAGS into user packages via sysconfig

[Matthias Koeppe]

On Mon, Dec 27, 2021 at 5:27 PM Matthias Koeppe <mkoeppe@math.ucdavis.edu>
wrote:

> $ python3.9 -m sysconfig | grep CFLAGS
> CFLAGS = "-Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall
> -ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
> -fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
> -I/usr/include/uuid/
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1
> -ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
> -fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
> -I/usr/include/uuid/
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1"
>
> These flags will end up in builds of user Python packages with extensions
> via sysconfig/distutils.
> This should be fixed by putting the necessary flags for the Python build
> into CFLAGS_NODIST instead [...]
>

Thanks, Marco, for the python-3.9.9-3 test package.
It has been reported to work well for us (
https://trac.sagemath.org/ticket/33078#comment:34), solving the reported
problem.

Matthias

Re: python 3.9 package leaks CFLAGS into user packages via sysconfig

[Marco Atzeri]

On 31.12.2021 20:33, Matthias Koeppe wrote:
> On Mon, Dec 27, 2021 at 5:27 PM Matthias Koeppe <mkoeppe@math.ucdavis.edu>
> wrote:
> 
>> $ python3.9 -m sysconfig | grep CFLAGS
>> CFLAGS = "-Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall
..
>>
>> These flags will end up in builds of user Python packages with extensions
>> via sysconfig/distutils.
>> This should be fixed by putting the necessary flags for the Python build
>> into CFLAGS_NODIST instead [...]
>>
> 
> Thanks, Marco, for the python-3.9.9-3 test package.
> It has been reported to work well for us (
> https://trac.sagemath.org/ticket/33078#comment:34), solving the reported
> problem.
> 
> Matthias
> 

Thanks Matthias
for the testing.
I expect to promote it from test to current in few days.


Regards
Marco