[FR] Add a way to enforce static evaluation of attr:
Open
Nobody has claimed this yet.
enhancement
help wanted
- Dominant language
- Python
- Stars
- 2.9k
- Forks
- 1.4k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 1
Description
What's the problem this feature will solve?
It is possible to cause code execution in pure setup.cfg + pyproject.toml workflows at wheel build stage.
Describe the solution you'd like
- Add an attr
options.no_exec = trueintosetup.cfgwhich semantics is to disable as many mechanisms of execution of code supplied by package author at the build stage as possible. - Disable importing of modules mentioned in
attrfor now when it is enabled. Other hardenings can be done in other PRs.
Alternative Solutions
Do it by default for setup.cfg + pyproject.toml packages, it's the main feature of such a way to build packages anyway.
Code of Conduct
- I agree to follow the PSF Code of Conduct
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies setup.cfg, pyproject.toml, and the attr option, but no repository files or tests. Start by locating how setuptools reads attr values and imports referenced modules, then determine the enforceable no_exec boundary and add coverage for the requested disabled-import behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100