python 3.9 package leaks CFLAGS into user packages via sysconfig

[Marco Atzeri]

On 28.12.2021 02:27, Matthias Koeppe wrote:
> $ python3.9 -m sysconfig | grep CFLAGS
> CFLAGS = "-Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall
> -ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
> -fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
> -I/usr/include/uuid/
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1
> -ggdb -O2 -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2
> -fstack-protector-strong --param=ssp-buffer-size=4 -DOPENSSL_NO_SSL3=1
> -I/usr/include/uuid/
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/build=/usr/src/debug/python39-3.9.9-1
> -fdebug-prefix-map=/pub/devel/python/python39/python39-3.9.9-1.x86_64/src/Python-3.9.9=/usr/src/debug/python39-3.9.9-1"
> 
> These flags will end up in builds of user Python packages with extensions
> via sysconfig/distutils.
> This should be fixed by putting the necessary flags for the Python build
> into CFLAGS_NODIST instead -- see similar fix for Homebrew's packaging of
> python3 in https://github.com/Homebrew/homebrew-core/pull/68528
> 
> Reference: https://trac.sagemath.org/ticket/33078
> 

thanks Matthias
for the report and the reference.

It seems we have built all the pythons in the same way so
all versions always had it.

I will look to build a test version with the suggested change.

regards
Marco