[Python-Dev] Excluding the current path from module search path?

[Nick Coghlan]

Chris Withers wrote:
> Nick Coghlan wrote:
>> The details of the sys.path manipulation at program startup are
>> documented here:
>> http://docs.python.org/using/cmdline.html#command-line
>>
>> The directory prepended to sys.path is based on the code executed by the
>> command line.
> 
> It's more subtle than that though...
> 
> The OP in http://bugs.python.org/issue1734860 is being bitten by the
> same expectation that I am: sitecustomize.py should be found somewhere
> on the sys.path present at the start of the script/module/command/etc
> being executed. (The bug referenced in that report makes things worse,
> because this used to work, at least on Windows ;-) )
> 
> The problem is that site.py (and therefore sitecustomize.py) is imported
> early in main.c on line 516 as part of Py_Initialize(), but the path of
> the current script only gets added later on in RunMainFromImporter
> called on line 569.
> 
> Strictly speaking, the docs at http://docs.python.org/library/site.html
> aren't lying, but it takes an understanding of when site.py is imported
> that isn't available to anyone who doesn't read C to know why a path
> that is present on sys.path when the user's script starts isn't being
> searched for sitecustomize.py
> 
> What do people feel about this?
> 
> At the very least, I'd like to add a warning box in site.html to explain
> why sitecustomize might not be found where people expect.
> 
> I'd *like* to have the paths be the same for site.py as they are for the
> subsequent code that's executed, but would that make too much of a mess
> of main.c and runpython.c?

Ah, OK - I see the problem now. However, I think the current behaviour
is correct, it just needs to be documented better (probably noted in
both the command line doco regarding sys.path manipulation and in the
doco for site.py).

The reason I think the current behaviour is correct is that site.py and
sitecustomize.py are meant to be about customising the *site* (i.e. the
installation of Python that is being executed) rather than about
customizing a particular application. Importing them before the script
specific directories are prepended to sys.path goes a long way towards
achieving that.

Also, as was pointed out on the tracker item, having a script that can
automatically be executed when running an arbitrary Python script
without any request from or notification to the user is not a good idea
from a security standpoint.

When it comes to adding additional paths for specific applications, you
can either bundle the relevant packages into a single directory and use
2.6's directory execution feature or else look into the assorted
application environment customisation tools that are out there like
virtualenv.

Cheers,
Nick.

-- 
Nick Coghlan   |   ncoghlan at gmail.com   |   Brisbane, Australia
---------------------------------------------------------------