[patch] incomplete(!) patch for improving sandbox support

pypy-ebuild.patch (text/plain), 3.09 KB, created by Marien Zwart (RETIRED) on 2012-08-02 11:53:03 UTC

Index: pypy-1.9-r1.ebuild
===================================================================
RCS file: /var/cvsroot/gentoo-x86/dev-python/pypy/pypy-1.9-r1.ebuild,v
retrieving revision 1.2
diff -u -B -r1.2 pypy-1.9-r1.ebuild
--- pypy-1.9-r1.ebuild	17 Jun 2012 23:01:13 -0000	1.2
+++ pypy-1.9-r1.ebuild	2 Aug 2012 11:44:45 -0000
@@ -58,46 +58,77 @@
 
 	# The following is Gentoo-specific.
 	epatch "${FILESDIR}/${PV}-no-static-hack.patch"
+
+	# The following is experimental, probably shouldn't go in.
+	epatch "${FILESDIR}/${PV}-threads.patch"
 }
 
 src_compile() {
-	local conf
+	local -a conf
 	if use jit; then
-		conf="-Ojit"
+		conf=("-Ojit")
 	else
-		conf="-O2"
+		conf=("-O2")
 	fi
 	if use shadowstack; then
-		conf+=" --gcrootfinder=shadowstack"
-	fi
-	if use sandbox; then
-		conf+=" --sandbox"
+		conf+=("--gcrootfinder=shadowstack")
 	fi
+	conf+=("--make-jobs=$(makeopts_jobs)" "targetpypystandalone.py")
 
-	conf+=" --make-jobs=$(makeopts_jobs)"
-
-	conf+=" ./pypy/translator/goal/targetpypystandalone.py"
 	# Avoid linking against libraries disabled by use flags
 	local optional_use=("bzip2" "ncurses" "ssl")
 	local optional_mod=("bz2" "_minimal_curses" "_ssl")
 	for ((i = 0; i < ${#optional_use[*]}; i++)); do
 		if use ${optional_use[$i]};	then
-			conf+=" --withmod-${optional_mod[$i]}"
+			conf+=("--withmod-${optional_mod[$i]}")
 		else
-			conf+=" --withoutmod-${optional_mod[$i]}"
+			conf+=("--withoutmod-${optional_mod[$i]}")
 		fi
 	done
 
-	local translate_cmd="$(PYTHON -2) ./pypy/translator/goal/translate.py --batch $conf"
+	pushd pypy/translator/goal >/dev/null
+
+	local translate_cmd="$(PYTHON -2) ./translate.py --batch ${conf[@]}"
 	echo ${_BOLD}"${translate_cmd}"${_NORMAL}
 	${translate_cmd} || die "compile error"
+
+	mv pypy-c ../../.. || die
+
+	if use sandbox; then
+		# Build a separate sandbox executable. Force -O2 instead of
+		# -Ojit as upstream has "less confidence" in a binary with both
+		# (pypy.org/download.html#building-from-source). Use the pypy-c
+		# we just built to build the sandbox because that should be
+		# faster.
+		conf=("-O2" "--sandbox")
+		if use shadowstack; then
+			conf+=("--gcrootfinder=shadowstack")
+		fi
+		conf+=("--make-jobs=$(makeopts_jobs)" "targetpypystandalone.py")
+		# Disable external libraries as sandboxing those is not implemented
+		for ((i = 0; i < ${#optional_mod[*]}; i++)); do
+			conf+=("--withoutmod-${optional_mod[$i]}")
+		done
+		translate_cmd="../../../pypy-c translate.py --batch ${conf[@]}"
+		echo ${_BOLD}"${translate_cmd}"${_NORMAL}
+		${translate_cmd} || die "sandbox compile error"
+		mv pypy-c ../../../pypy-c-sandbox || die
+	fi
+
+	popd >/dev/null
 }
 
 src_install() {
 	local INSPATH="/usr/$(get_libdir)/pypy${SLOT}"
 	insinto ${INSPATH}
-	doins -r include lib_pypy lib-python pypy-c
-	fperms a+x ${INSPATH}/pypy-c
+	doins -r include lib_pypy lib-python
+	exeinto ${INSPATH}
+	doexe pypy-c
+	if use sandbox; then
+		doexe pypy-c-sandbox
+		# pypy_interact.py is unfortunately useless without most of a
+		# pypy checkout, so do not bother installing it.
+	fi
 	dosym ../$(get_libdir)/pypy${SLOT}/pypy-c /usr/bin/pypy-c${SLOT}
 
 	if ! use sqlite; then