GeezerVison

Fixes #8802

crates/vm/build.rs dumped every environment variable of the build process into OUT_DIR/env_vars.rs, and _sysconfigdata include!d that file into build_time_vars. This is worse than the issue describes: the variables were not only cached in target/, they were compiled into the binary as string literals and readable at runtime via sysconfig.get_config_vars(). Any secret present in the build environment (CI tokens, cloud credentials) shipped inside the resulting binary.

Changes:

• Remove the environment dump from build.rs and the include! from _sysconfigdata.rs. build_time_vars now contains only the explicit entries.
• Drop the now unused itertools build-dependency.

None of the keys the stdlib reads through sysconfig.get_config_var were sourced from build-time environment variables, so no allowlist was needed.

Verified:

• cargo clippy -p rustpython-vm --all-targets clean
• Built with LEAKCHECK_SECRET set: sysconfig.get_config_vars() no longer contains HOME/PATH/the secret, and strings on the binary finds no trace of it
• test_sysconfig, test_site, test_venv pass

Note for maintainers: previously published release binaries still contain the environment of the machine that built them. It is worth checking whether any CI secrets were exposed in past release builds.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Behavior Changes
  • The _sysconfigdata output no longer includes values captured from the build environment. It now reports the statically defined configuration values and runtime-dependent paths, including the installation prefix and binary directory. This may change which configuration variables are available to applications that inspect system configuration.