Should the shebang (#!) contain -s and/or -P?

[cfxegbert]

Should each of the rez scripts attempt to keep a cleaner environment? There are a couple of python command line flags that could be added to the shebang line that would keep it cleaner.

• -s - Don't add the user site-packages directory to sys.path. The user site-package directory is in the users home directory. The directory path is different based on the platform. This directory is a site directory, which means that .pth files in it will be processed. This could easily add other python libraries into the rez python environment and could be different for each user.
• -P - Don’t prepend a potentially unsafe path to sys.path. In the case of rez that would be the directory where the rez python scripts are installed. This was added in Python 3.11. An install time check to see if the python interpreter supports the -P flag would be if hasattr(sys.flags, 'safe_path')

[JeanChristopheMorinPerso]

Hi @cfxegbert , I think we already answered this in one of the TSC meetings, but I'll repeat it for transparency. The answer is yes. We already do it to some extent in

rez/install.py

Lines 121 to 127 in dc6b3a1

	maker.make_multiple(
	specifications=specs.values(),
	# the -E arg is crucial - it means rez cli tools still work within a
	# rez-resolved env, even if PYTHONPATH or related env-vars would have
	# otherwise changed rez's behaviour
	options=dict(interpreter_args=["-E"])
	)

. This was all we had a few years ago. -s is something we just never did I think mostly because we just forgot. As for -P, it was only added in python 3.11. I once wanted to add -I but that was at the time where we still supported python 2.7.

All in all, my philosophy has been to target the lowest denominator and only rely on features that are supported across all our supported python versions. Not doing this would cause differences in how rez behaves depending on which python version it runs, which is not a great user experience IMO. It would also likely complicate our support too.

So yes, I support hardening our scripts, with the rule given above.