From d608f39869b4fc8191ce34ecaab78bf6a0f4dbc0 Mon Sep 17 00:00:00 2001
From: Julian Smith <julian.smith@artifex.com>
Date: Mon, 24 Nov 2025 11:32:19 +0000
Subject: [PATCH 1/5] scripts/sysinstall.py: exclude new test_4767 because uses
 `pymupdf` command.

---
 scripts/sysinstall.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/sysinstall.py b/scripts/sysinstall.py
index d4f2fc14f..ea6597d6d 100755
--- a/scripts/sysinstall.py
+++ b/scripts/sysinstall.py
@@ -401,6 +401,7 @@ def run(command, env_extra=None):
                 'test_textbox3',
                 'test_3493',
                 'test_4180',
+                'test_4767',
                 )
         excluded_tests = ' and not '.join(excluded_tests)
         if not pytest_args:

From b3e4acaf6d1a0b6f14335b193cb503534cf4bb0d Mon Sep 17 00:00:00 2001
From: Julian Smith <julian.smith@artifex.com>
Date: Mon, 24 Nov 2025 12:21:04 +0000
Subject: [PATCH 2/5] pipcl.py: show_system(): hide private keys.

---
 pipcl.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pipcl.py b/pipcl.py
index d9b831f70..55eb6b618 100644
--- a/pipcl.py
+++ b/pipcl.py
@@ -2450,7 +2450,11 @@ def log(text):
     log(f'os.environ ({len(os.environ)}):')
     for k in sorted( os.environ.keys()):
         v = os.environ[ k]
-        log( f'    {k}: {v!r}')
+        if 'BEGIN OPENSSH PRIVATE KEY' in v:
+            # Don't show private keys.
+            log(f'    {k} ****')
+        else:
+            log( f'    {k}: {v!r}')
 
 
 class PythonFlags:

From b7dda7006062d4c023e08c13f5208ab9da0d8e05 Mon Sep 17 00:00:00 2001
From: Julian Smith <julian.smith@artifex.com>
Date: Tue, 25 Nov 2025 13:16:34 +0000
Subject: [PATCH 3/5] tests/test_4767.py: don't attempt to run on pyodide.

---
 tests/test_4767.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/test_4767.py b/tests/test_4767.py
index d3fc318dc..397435edb 100644
--- a/tests/test_4767.py
+++ b/tests/test_4767.py
@@ -9,6 +9,10 @@ def test_4767():
     '''
     Check handling of unsafe paths in `pymupdf embed-extract`.
     '''
+    if os.environ.get('PYODIDE_ROOT'):
+        print('test_4767(): not running on Pyodide - cannot run child processes.')
+        return
+        
     with pymupdf.open() as document:
         document.new_page() 
         document.embfile_add(

From 781b56d2afe6ce2f8f6b3bcc4a58b458bca9d989 Mon Sep 17 00:00:00 2001
From: Julian Smith <julian.smith@artifex.com>
Date: Tue, 25 Nov 2025 13:17:16 +0000
Subject: [PATCH 4/5] pipcl.py: show_system(): don't print environ if
 PIPCL_SHOW_ENV=0.

---
 pipcl.py | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/pipcl.py b/pipcl.py
index 55eb6b618..c25c5118a 100644
--- a/pipcl.py
+++ b/pipcl.py
@@ -2416,6 +2416,8 @@ def openbsd():
 def show_system():
     '''
     Show useful information about the system plus argv and environ.
+    
+    Omits os.environ if $PIPCL_SHOW_ENV is '0'.
     '''
     def log(text):
         log0(text, caller=3)
@@ -2447,14 +2449,18 @@ def log(text):
     for i, arg in enumerate(sys.argv):
         log(f'    {i}: {arg!r}')
     
-    log(f'os.environ ({len(os.environ)}):')
-    for k in sorted( os.environ.keys()):
-        v = os.environ[ k]
-        if 'BEGIN OPENSSH PRIVATE KEY' in v:
-            # Don't show private keys.
-            log(f'    {k} ****')
-        else:
-            log( f'    {k}: {v!r}')
+    PIPCL_SHOW_ENV = os.environ.get('PIPCL_SHOW_ENV')
+    if PIPCL_SHOW_ENV == '0':
+        log(f'[Not showing os.environ because {PIPCL_SHOW_ENV=}.]')
+    else:
+        log(f'os.environ ({len(os.environ)}):')
+        for k in sorted( os.environ.keys()):
+            v = os.environ[ k]
+            if 'BEGIN OPENSSH PRIVATE KEY' in v:
+                # Don't show private keys.
+                log(f'    {k} ****')
+            else:
+                log( f'    {k}: {v!r}')
 
 
 class PythonFlags:

From 80efd38acbd022248247919b6cea63f2a54a49cd Mon Sep 17 00:00:00 2001
From: Julian Smith <julian.smith@artifex.com>
Date: Tue, 25 Nov 2025 14:08:30 +0000
Subject: [PATCH 5/5] setup.py: document PIPCL_SHOW_ENV.

---
 setup.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/setup.py b/setup.py
index f5d6abad0..709e69489 100755
--- a/setup.py
+++ b/setup.py
@@ -39,6 +39,9 @@
             Directory containing MuPDF libraries, (libmupdf.so,
             libmupdfcpp.so).
     
+    PIPCL_SHOW_ENV
+        If '0', we do not show environment variables on startup.
+    
     PYMUPDF_SETUP_DEVENV
         Location of devenv.com on Windows. If unset we search for it - see
         wdev.py. if that fails we use just 'devenv.com'.