[feat] Prevent pip installing setup_requires

Use a special .pydistutils.cfg in a temporary HOME directory for
the duration of the pip wheel run to prevent build dependencies
specified in a setup_requires from being installed on the fly
without respecting pinned versions.

src/zc/buildout/easy_install.py

@@ -18,6 +18,7 @@ It doesn't install scripts.  It uses setuptools and requires it to be
 installed.
 """
 
+import atexit
 import copy
 import distutils.errors
 import distutils.sysconfig
@@ -1731,6 +1732,13 @@ class IncompatibleConstraintError(zc.buildout.UserError):
 IncompatibleVersionError = IncompatibleConstraintError # Backward compatibility
 
 
+# Temporary HOME with .pydistutils.cfg to disable setup_requires
+pip_pydistutils_home = tempfile.mkdtemp('pip-pydistutils-home')
+with open(os.path.join(pip_pydistutils_home, '.pydistutils.cfg'), 'w') as f:
+    f.write("[easy_install]\n"
+            "index-url = file:///dev/null")
+atexit.register(zc.buildout.rmtree.rmtree, pip_pydistutils_home)
+
 def call_pip_wheel(spec, dest, options):
     """
     Call `pip wheel` from a subprocess to install a
@@ -1744,8 +1752,10 @@ def call_pip_wheel(spec, dest, options):
     else:
         args.append('-v')
 
-    # Try to prevent pip from installing build dependencies implicitly
-    # and without respecting pinned versions, on the fly
+    # Prevent pip from installing build dependencies on the fly
+    # without respecting pinned versions. This only works for
+    # PEP 517 specifications using pyproject.toml and not for
+    # dependencies in setup_requires option in legacy setup.py
     if not options._allow_picked_versions:
         args.append('--no-index')
         args.append('--no-build-isolation')
@@ -1779,7 +1789,14 @@ def call_pip_wheel(spec, dest, options):
 
     sys.stdout.flush() # We want any pending output first
 
-    subprocess.check_call(list(args), env=env)
+    # Prevent setuptools from downloading and thus installing
+    # build dependencies specified in setup_requires option of
+    # legacy setup.py by providing a crafted .pydistutils.cfg.
+    # This is used in complement to --no-build-isolation.
+    if not options._allow_picked_versions:
+        env['HOME'] = pip_pydistutils_home
+
+    subprocess.check_call(args, env=env)
 
     entries = os.listdir(dest)
     try: