Build failure dumping all environment variables

[matyx44]

Description of the bug

Hi,

The build of pymupdf after update to 1.26.6 version was missing wheel in our alpine image, starting the build which failed and in our pipeline it logged all environment variables, including sensitive passwords, secrets and infra secrets, not all of which were masked and potentially leaking them.

Would it be possible to not log entire environment in case of failure?

setup.py: line 219 is the culprit

See the issue I created for uv:
astral-sh/uv#16804

How to reproduce the bug

1.26.6

PyMuPDF version

1.26.6

Operating system

Linux

Python version

3.13

[julian-smith-artifex-com]

Thanks for the report. I have a patch to pipcl.show_system() in my tree which hides environment values containing BEGIN OPENSSH PRIVATE KEY. Would that be sufficient for your purposes?

[We've not worried about this in the past because Github routinely hides private keys in logs.]

[matyx44]

This would not prevent that, I load external secrets from Google cloud into env variables (could be passwords or any other sensitive values), gitlab does not have a mechanism to recognize this as a variable that should be masked, not sure if in github it is different.
Is it necessary to print all env variables on build failure?

[julian-smith-artifex-com]

Ok understood.

We show the environment at the start of setup.py, so it appears regardless of whether the build succeeds or fails.

How about we don't dump the environment if environment variable PIPCL_SHOW_ENV is 0?

[matyx44]

Yeah something like that would help definitely

[julian-smith-artifex-com]

That's great.

Both changes have just been pushed, see:

232d8ff
3dd99be

[I'll close this issue after we make a release with these changes.]