[bug#77785] gnu: cura: prevent importing outside of store
Commit Message
I've recently tried to run cura but it kept crashing because it couldn't find shared libraries.
As it turns out, python adds directories in the home directory to the search path and a pyqt5 installed by pip managed to be loaded, which obviously won't work.
This patch addresses this by adding a small snippet of code to the top of bin/cura that clears out all paths from sys.path that don't start with /gnu.
From f49e1297a0be295a7d47ebf33fe3e27ceecefefa Mon Sep 17 00:00:00 2001
Message-ID: <f49e1297a0be295a7d47ebf33fe3e27ceecefefa.1744561640.git.jakob.kirsch@web.de>
From: Jakob Kirsch <jakob.kirsch@web.de>
Date: Sun, 13 Apr 2025 18:25:20 +0200
Subject: [PATCH] gnu: cura: prevent importing outside of store
* gnu/packages/engineering.scm (cura)[arguments]<#:phases>: substitute* code into bin/cura to clear all paths from sys.path that don't start with /gnu.
Change-Id: Ie67c26ae7d43d5801a6cde7619491dacedf4e2a0
---
gnu/packages/engineering.scm | 75 ++++++++++++++++++------------------
1 file changed, 37 insertions(+), 38 deletions(-)
base-commit: 94e7afbb557d3f2709072bf2bf58618293ca7fbd
--
2.49.0
Comments
On 2025-04-13 18:29, Jakob Kirsch via Guix-patches via wrote:
> I've recently tried to run cura but it kept crashing because it couldn't find shared libraries.
> As it turns out, python adds directories in the home directory to the search path and a pyqt5 installed by pip managed to be loaded, which obviously won't work.
> This patch addresses this by adding a small snippet of code to the top of bin/cura that clears out all paths from sys.path that don't start with /gnu.
> From f49e1297a0be295a7d47ebf33fe3e27ceecefefa Mon Sep 17 00:00:00 2001
> Message-ID: <f49e1297a0be295a7d47ebf33fe3e27ceecefefa.1744561640.git.jakob.kirsch@web.de>
> From: Jakob Kirsch <jakob.kirsch@web.de>
> Date: Sun, 13 Apr 2025 18:25:20 +0200
> Subject: [PATCH] gnu: cura: prevent importing outside of store
Hey, TY Jakob for working on that.
I'm in the process of trying to get Cura to build on the next
python-team branch (for the sake of python-team, I don't use Cura).
I'll apply the patch there and test with it. Could I ping you to review
if the package works as expected once I'm done making the build pass on
python-team?
> I'm in the process of trying to get Cura to build on the next
> python-team branch (for the sake of python-team, I don't use Cura).
Thanks that's cool.
> I'll apply the patch there and test with it. Could I ping you to review
> if the package works as expected once I'm done making the build pass on
> python-team?
Yeah sure.
@@ -4897,46 +4897,45 @@ (define-public cura
(sha256
(base32 "0yg17pcrj5gm02aqcjfk40ynvpb9r9aaq9rj108dkpki1is15ks7"))))
(build-system qt-build-system)
- (native-inputs
- (list python-certifi
- python-mypy
- python-pytest
- python-requests))
- (inputs
- (list bash-minimal
- cura-engine
- libcharon
- libsavitar
- python
- python-keyring
- python-pynest2d
- python-pyserial
- python-sentry-sdk
- python-sip
- uranium))
+ (native-inputs (list python-certifi python-mypy python-pytest
+ python-requests))
+ (inputs (list bash-minimal
+ cura-engine
+ libcharon
+ libsavitar
+ python
+ python-keyring
+ python-pynest2d
+ python-pyserial
+ python-sentry-sdk
+ python-sip
+ uranium))
(arguments
- `(;; TODO: Fix tests.
- #:tests? #f
+ `( ;TODO: Fix tests.
+ #:tests? #f
#:configure-flags '("-DURANIUM_SCRIPTS_DIR=")
- #:phases
- (modify-phases %standard-phases
- (add-after 'install 'link-to-CuraEngine
- (lambda* (#:key inputs outputs #:allow-other-keys)
- (symlink (string-append (assoc-ref inputs "cura-engine")
- "/bin/CuraEngine")
- (string-append (assoc-ref outputs "out")
- "/bin/CuraEngine"))))
- (add-after 'link-to-CuraEngine 'wrap-pythonpath
- (lambda* (#:key outputs #:allow-other-keys)
- (let ((out (assoc-ref outputs "out")))
- (wrap-program (string-append out "/bin/cura")
- (list "GUIX_PYTHONPATH"
- 'prefix (list (string-append out
- "/lib/python"
- ,(version-major+minor
- (package-version python))
- "/site-packages")
- (getenv "GUIX_PYTHONPATH"))))))))))
+ #:phases (modify-phases %standard-phases
+ (add-after 'install 'link-to-CuraEngine
+ (lambda* (#:key inputs outputs #:allow-other-keys)
+ (symlink (string-append (assoc-ref inputs "cura-engine")
+ "/bin/CuraEngine")
+ (string-append (assoc-ref outputs "out")
+ "/bin/CuraEngine"))))
+ (add-after 'link-to-CuraEngine 'wrap-pythonpath
+ (lambda* (#:key outputs #:allow-other-keys)
+ (let ((out (assoc-ref outputs "out")))
+ (begin
+ (substitute* (string-append out "/bin/cura")
+ (("import sys")
+ "import sys; [sys.path.remove(x) for x in sys.path if not x.startswith('/gnu')]"))
+ (wrap-program (string-append out "/bin/cura")
+ (list "GUIX_PYTHONPATH"
+ 'prefix
+ (list (string-append out "/lib/python"
+ ,(version-major+minor (package-version
+ python))
+ "/site-packages")
+ (getenv "GUIX_PYTHONPATH")))))))))))
(home-page "https://github.com/Ultimaker/Cura")
(synopsis "Slicer for 3D printers")
(description "Cura is a slicing software from Ultimaker. A @emph{slicer}