Repository navigation
Stop embedding build-time environment variables in _sysconfigdata - #8813
Conversation
crates/vm/build.rs wrote every environment variable of the build process into OUT_DIR/env_vars.rs, and _sysconfigdata included that file into build_time_vars. All build-machine environment variables ended up as string literals in the binary and were readable at runtime through sysconfig.get_config_vars(). Remove the dump and the include, and drop the now unused itertools build-dependency. build_time_vars keeps only the explicit entries. Fixes RustPython#8802 Assisted-by: Claude:claude-fable-5-1
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: RustPython/RustPython/.coderabbit.yml Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
💤 Files with no reviewable changes (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📝 WalkthroughWalkthroughThe VM build script no longer generates ChangesVM environment export removal
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Merge Risk: ⚪ Minimal · up to The change removes the build-environment export path that could expose build-machine values through sysconfig. No actionable remaining merge risk is evident from the reviewed changes. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@Eh2406 does this resolve your concern? |
|
looks good. Thank you! |
Fixes #8802
crates/vm/build.rsdumped every environment variable of the build process intoOUT_DIR/env_vars.rs, and_sysconfigdatainclude!d that file intobuild_time_vars. This is worse than the issue describes: the variables were not only cached intarget/, they were compiled into the binary as string literals and readable at runtime viasysconfig.get_config_vars(). Any secret present in the build environment (CI tokens, cloud credentials) shipped inside the resulting binary.Changes:
build.rsand theinclude!from_sysconfigdata.rs.build_time_varsnow contains only the explicit entries.itertoolsbuild-dependency.None of the keys the stdlib reads through
sysconfig.get_config_varwere sourced from build-time environment variables, so no allowlist was needed.Verified:
cargo clippy -p rustpython-vm --all-targetscleanLEAKCHECK_SECRETset:sysconfig.get_config_vars()no longer containsHOME/PATH/the secret, andstringson the binary finds no trace of ittest_sysconfig,test_site,test_venvpassNote for maintainers: previously published release binaries still contain the environment of the machine that built them. It is worth checking whether any CI secrets were exposed in past release builds.
🤖 Generated with Claude Code
Summary by CodeRabbit
_sysconfigdataoutput no longer includes values captured from the build environment. It now reports the statically defined configuration values and runtime-dependent paths, including the installation prefix and binary directory. This may change which configuration variables are available to applications that inspect system configuration.