When a C extension is built by distutils, distutils.sysconfig.customize_compiler() is used to configure compiler flags. Extract of the code:

    (cc, cxx, opt, cflags, ccshared, ldshared, shlib_suffix, ar, ar_flags) = \
        get_config_vars('CC', 'CXX', 'OPT', 'CFLAGS',
                        'CCSHARED', 'LDSHARED', 'SHLIB_SUFFIX', 'AR', 'ARFLAGS')

    ...
    if 'CFLAGS' in os.environ:
        cflags = opt + ' ' + os.environ['CFLAGS']
        ldshared = ldshared + ' ' + os.environ['CFLAGS']
    if 'CPPFLAGS' in os.environ:
        cpp = cpp + ' ' + os.environ['CPPFLAGS']
        cflags = cflags + ' ' + os.environ['CPPFLAGS']
        ldshared = ldshared + ' ' + os.environ['CPPFLAGS']
    ...

If the CFLAGS environment variable is set, the 'CFLAGS' configuration variable is overriden with the 'OPT' configuration variable: cflags = opt + ...

This bug has been fixed since 2013 in Fedora and RHEL by this patch:
https://src.fedoraproject.org/rpms/python2/blob/master/f/00168-distutils-cflags.patch

RHEL bug report:
https://bugzilla.redhat.com/show_bug.cgi?id=849994

I converted that patch to a pull request.

This appears to be a duplicate of Issue969718.

New changeset 86082c22d23285995a32aabb491527c9f5629556 by Victor Stinner in branch 'master':
bpo-36235: Fix CFLAGS in distutils customize_compiler() (GH-12236)
https://github.com/python/cpython/commit/86082c22d23285995a32aabb491527c9f5629556

New changeset 37f6971777c05b5ca9c157606896b7ff458756a5 by Victor Stinner in branch '2.7':
bpo-36235: Fix CFLAGS in distutils customize_compiler() (GH-12236) (GH-12349)
https://github.com/python/cpython/commit/37f6971777c05b5ca9c157606896b7ff458756a5

New changeset 6c0e0d141a07cc3fd2441d9df8d762f56bf7edf2 by Victor Stinner in branch '3.7':
bpo-36235: Fix CFLAGS in distutils customize_compiler() (GH-12236) (GH-12348)
https://github.com/python/cpython/commit/6c0e0d141a07cc3fd2441d9df8d762f56bf7edf2

After this patch, test_distutils failed if $CPPFLAGS is not empty when building CPython. For example:

$ export CPPFLAGS=-DFOO=BAR
$ ./configure
$ make
$ ./python -m test test_distutils   
Run tests sequentially
0:00:00 load avg: 0.45 [1/1] test_distutils
test test_distutils failed -- Traceback (most recent call last):
  File "/home/yen/Projects/cpython/Lib/distutils/tests/test_sysconfig.py", line 99, in test_customize_compiler
    self.assertEqual(comp.exes['compiler'], 'my_cc --sysconfig-cflags --mycflags')
AssertionError: 'my_cc --sysconfig-cflags --mycflags -DFOO=BAR' != 'my_cc --sysconfig-cflags --mycflags'
- my_cc --sysconfig-cflags --mycflags -DFOO=BAR
?                                    ----------
+ my_cc --sysconfig-cflags --mycflags


test_distutils failed

== Tests result: FAILURE ==

1 test failed:
    test_distutils

Total duration: 2 sec 192 ms
Tests result: FAILURE

Tested with commit d2fdd1fedf6b9dc785cf5025b548a989faed089a.

This is an issue as Arch Linux uses CPPFLAGS="-D_FORTIFY_SOURCE=2" for creating packages [1].

[1] https://git.archlinux.org/svntogit/packages.git/tree/trunk/makepkg.conf?h=packages/pacman#n39

Chih-Hsuan Yen: After this patch, test_distutils failed if $CPPFLAGS is not empty when building CPython.

Aha, more sysconfig configuration variables and environment variables should be mocked. I wrote PR 12403 to mock all variables. Would you mind to test and review it?

STINNER Victor: Thank you very much for that much better fix! I've tested it on Arch Linux. With that patch, test_distutils passes as usual. The pull request looks good, too. Just a question: I think it should be backported to 3.7 and 2.7 branches like https://github.com/python/cpython/pull/12236?

New changeset 72c7b372cf145fded93a9a776acc742a60090f95 by Victor Stinner in branch 'master':
bpo-36235: Enhance distutils test_customize_compiler() (GH-12403)
https://github.com/python/cpython/commit/72c7b372cf145fded93a9a776acc742a60090f95

> Just a question: I think it should be backported to 3.7 and 2.7 (...)

Right, I wrote PRs for that. I didn't use GitHub labels because the bot is currently broken.

New changeset dd1cfefd67f254ce44f33995922e347c9d3f7b4e by Victor Stinner in branch '3.7':
bpo-36235: Enhance distutils test_customize_compiler() (GH-12403) (GH-12415)
https://github.com/python/cpython/commit/dd1cfefd67f254ce44f33995922e347c9d3f7b4e

New changeset 8c380e99e9b71387d5722373805fe3159e2d912c by Victor Stinner in branch '2.7':
bpo-36235: Enhance distutils test_customize_compiler() (GH-12403) (GH-12417)
https://github.com/python/cpython/commit/8c380e99e9b71387d5722373805fe3159e2d912c

Thanks for the review, I merged my PR and the test enhancements.

Oh, I didn't know the bot is not working for now. Thank you for making the test more robust!

Oh, the test failed on Python 2.7 on macOS:

x86-64 High Sierra 2.7
https://buildbot.python.org/all/#/builders/140/builds/211

======================================================================
FAIL: test_customize_compiler (distutils.tests.test_sysconfig.SysconfigTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/buildbot/buildarea/2.7.billenstein-sierra/build/Lib/distutils/tests/test_sysconfig.py", line 134, in test_customize_compiler
    'sc_cc -E')
AssertionError: '/usr/bin/clang -E' != 'sc_cc -E'

New changeset 22de4ce498b656063e236350e8404981c13e1cd8 by Victor Stinner in branch '2.7':
bpo-36235: Fix distutils test_customize_compiler() on macOS (GH-12751)
https://github.com/python/cpython/commit/22de4ce498b656063e236350e8404981c13e1cd8

Good, my change fixed x86-64 High Sierra 2.7 buildbot:
https://buildbot.python.org/all/#/builders/140/builds/216

I wrote PR 12764 to forward-port the fix to the master branch.

New changeset a9bd8925c7fa50dd3cfab125b824ec192133ef49 by Victor Stinner in branch 'master':
bpo-36235: Fix distutils test_customize_compiler() on macOS (GH-12764)
https://github.com/python/cpython/commit/a9bd8925c7fa50dd3cfab125b824ec192133ef49

New changeset d9b25a2627ff6f4e10d46b4de4fff941b63497c7 by Miss Islington (bot) in branch '3.7':
bpo-36235: Fix distutils test_customize_compiler() on macOS (GH-12764)
https://github.com/python/cpython/commit/d9b25a2627ff6f4e10d46b4de4fff941b63497c7