Is there a way to avoidshell=True? We should try to avoid it, especially as code inpython/cpython is prominent. Also, prefer 'encoding' to 'text':

In this case the whole point of the code is to run a shell script and determine which environment variables it sets, soshell=True is unavoidable. However, the script is entirely under our control – it's in the repository right next to this file.

Also, prefer 'encoding' to 'text'

Thanks, fixed.

Is there a reason this has become a full export?

HOST is a somewhat standardized way of indicating cross-compilation, e.g. it's used by conda-build. So it makes sense to expose it to the build system.

I'm also using it in the cibuildwheel PR to setsys.implementation._multiarch in the cross-compilation environment.

Why are these needed for the testbed environment? Is this script being used to drive cibuildwheel?

Or - I guess - why are they needed now to support compilation when they weren't required previously?

This section of the script is only directly used when building Python itself. This PR doesn't change the flags, it only moves the flags which contain build-time paths from the...FLAGS variables (which are exposed by sysconfig for the purpose of building packages) to the...FLAGS_NODIST variables (which are only used when building Python). This approach is recommended inPython's build documentation.

This may be unnecessary for cibuildwheel, because it contains code to rewrite any paths in the sysconfigdata. But cibuildwheel isn't the only context in which packages could be built – e.g. we may also see "native" (non-cross) compilation on Termux.

OK, I've reverted this now, because the NODIST variables weren't being used by the configure script when searching for libraries such as libffi. This is what caused the previous failure to build ctypes.

I didn't see the failure locally because configure was able to find the libraries using pkg-config. But that isn't installed on the buildbot machine because it isn't part of the macOS command-line tools, it's from Homebrew. And I'd rather not add a dependency on that.

As I said in my previous comment, this doesn't matter for cibuildwheel. And it doesn't really matter for Termux either, because the filesystem layout on Android is so different, that there's no chance of the build-time paths actually existing, so they'll be ignored.