validation.rs

// This Source Code Form is subject to the terms of the Mozilla Public
// License, v. 2.0. If a copy of the MPL was not distributed with this
// file, You can obtain one at https://mozilla.org/MPL/2.0/.

use {
    crate::{json::*, macho::*},
    anyhow::{anyhow, Context, Result},
    clap::ArgMatches,
    normalize_path::NormalizePath,
    object::{
        elf::{
            FileHeader32, FileHeader64, ET_DYN, ET_EXEC, STB_GLOBAL, STB_WEAK, STV_DEFAULT,
            STV_HIDDEN,
        },
        macho::{MachHeader32, MachHeader64, MH_OBJECT, MH_TWOLEVEL},
        read::{
            elf::{Dyn, FileHeader, SectionHeader, Sym},
            macho::{LoadCommandVariant, MachHeader, Nlist},
            pe::{ImageNtHeaders, PeFile, PeFile32, PeFile64},
        },
        Endianness, FileKind, Object, SectionIndex, SymbolScope,
    },
    once_cell::sync::Lazy,
    std::{
        collections::{BTreeSet, HashMap},
        convert::TryInto,
        io::Read,
        iter::FromIterator,
        path::{Path, PathBuf},
    },
};

const RECOGNIZED_TRIPLES: &[&str] = &[
    "aarch64-apple-darwin",
    "aarch64-apple-ios",
    "aarch64-unknown-linux-gnu",
    "armv7-unknown-linux-gnueabi",
    "armv7-unknown-linux-gnueabihf",
    "arm64-apple-tvos",
    "i686-pc-windows-msvc",
    "i686-unknown-linux-gnu",
    // Note there's build support for mips* targets but they are not tested
    // See https://github.com/indygreg/python-build-standalone/issues/412
    "mips-unknown-linux-gnu",
    "mipsel-unknown-linux-gnu",
    "mips64el-unknown-linux-gnuabi64",
    "ppc64le-unknown-linux-gnu",
    "s390x-unknown-linux-gnu",
    "thumbv7k-apple-watchos",
    "x86_64-apple-darwin",
    "x86_64-apple-ios",
    "x86_64-apple-tvos",
    "x86_64-apple-watchos",
    "x86_64-pc-windows-msvc",
    "x86_64-unknown-linux-gnu",
    "x86_64_v2-unknown-linux-gnu",
    "x86_64_v3-unknown-linux-gnu",
    "x86_64_v4-unknown-linux-gnu",
    "x86_64-unknown-linux-musl",
    "x86_64_v2-unknown-linux-musl",
    "x86_64_v3-unknown-linux-musl",
    "x86_64_v4-unknown-linux-musl",
];

const ELF_ALLOWED_LIBRARIES: &[&str] = &[
    // LSB set.
    "libc.so.6",
    "libdl.so.2",
    "libm.so.6",
    "libpthread.so.0",
    "librt.so.1",
    "libutil.so.1",
];

const PE_ALLOWED_LIBRARIES: &[&str] = &[
    "ADVAPI32.dll",
    "api-ms-win-core-path-l1-1-0.dll",
    "api-ms-win-crt-conio-l1-1-0.dll",
    "api-ms-win-crt-convert-l1-1-0.dll",
    "api-ms-win-crt-heap-l1-1-0.dll",
    "api-ms-win-crt-environment-l1-1-0.dll",
    "api-ms-win-crt-filesystem-l1-1-0.dll",
    "api-ms-win-crt-locale-l1-1-0.dll",
    "api-ms-win-crt-math-l1-1-0.dll",
    "api-ms-win-crt-process-l1-1-0.dll",
    "api-ms-win-crt-runtime-l1-1-0.dll",
    "api-ms-win-crt-stdio-l1-1-0.dll",
    "api-ms-win-crt-string-l1-1-0.dll",
    "api-ms-win-crt-time-l1-1-0.dll",
    "api-ms-win-crt-utility-l1-1-0.dll",
    "bcrypt.dll",
    "Cabinet.dll",
    "COMCTL32.dll",
    "COMDLG32.dll",
    "CRYPT32.dll",
    "GDI32.dll",
    "IMM32.dll",
    "IPHLPAPI.DLL",
    "KERNEL32.dll",
    "msi.dll",
    "NETAPI32.dll",
    "ole32.dll",
    "OLEAUT32.dll",
    "PROPSYS.dll",
    "RPCRT4.dll",
    "SHELL32.dll",
    "SHLWAPI.dll",
    "USER32.dll",
    "USERENV.dll",
    "VERSION.dll",
    "VCRUNTIME140.dll",
    "VCRUNTIME140_1.dll",
    "WINMM.dll",
    "WS2_32.dll",
    // Our libraries.
    "libcrypto-1_1.dll",
    "libcrypto-1_1-x64.dll",
    "libcrypto-3.dll",
    "libcrypto-3-x64.dll",
    "libffi-8.dll",
    "libssl-1_1.dll",
    "libssl-1_1-x64.dll",
    "libssl-3.dll",
    "libssl-3-x64.dll",
    "python3.dll",
    "python39.dll",
    "python310.dll",
    "python311.dll",
    "python312.dll",
    "python313.dll",
    "python313t.dll",
    "python314.dll",
    "python314t.dll",
    "sqlite3.dll",
    "tcl86t.dll",
    "tk86t.dll",
];

static GLIBC_MAX_VERSION_BY_TRIPLE: Lazy<HashMap<&'static str, version_compare::Version<'static>>> =
    Lazy::new(|| {
        let mut versions = HashMap::new();

        versions.insert(
            "aarch64-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "armv7-unknown-linux-gnueabi",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "armv7-unknown-linux-gnueabihf",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "i686-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "mips-unknown-linux-gnu",
            version_compare::Version::from("2.19").unwrap(),
        );
        versions.insert(
            "mipsel-unknown-linux-gnu",
            version_compare::Version::from("2.19").unwrap(),
        );
        versions.insert(
            "mips64el-unknown-linux-gnuabi64",
            version_compare::Version::from("2.19").unwrap(),
        );
        versions.insert(
            "ppc64le-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "s390x-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "x86_64-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "x86_64_v2-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "x86_64_v3-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );
        versions.insert(
            "x86_64_v4-unknown-linux-gnu",
            version_compare::Version::from("2.17").unwrap(),
        );

        // musl shouldn't link against glibc.
        versions.insert(
            "x86_64-unknown-linux-musl",
            version_compare::Version::from("1").unwrap(),
        );
        versions.insert(
            "x86_64_v2-unknown-linux-musl",
            version_compare::Version::from("1").unwrap(),
        );
        versions.insert(
            "x86_64_v3-unknown-linux-musl",
            version_compare::Version::from("1").unwrap(),
        );
        versions.insert(
            "x86_64_v4-unknown-linux-musl",
            version_compare::Version::from("1").unwrap(),
        );

        versions
    });

static ELF_ALLOWED_LIBRARIES_BY_TRIPLE: Lazy<HashMap<&'static str, Vec<&'static str>>> =
    Lazy::new(|| {
        [
            (
                "armv7-unknown-linux-gnueabi",
                vec!["ld-linux.so.3", "libgcc_s.so.1"],
            ),
            (
                "armv7-unknown-linux-gnueabihf",
                vec!["ld-linux-armhf.so.3", "libgcc_s.so.1"],
            ),
            ("i686-unknown-linux-gnu", vec!["ld-linux-x86-64.so.2"]),
            ("mips-unknown-linux-gnu", vec!["ld.so.1", "libatomic.so.1"]),
            (
                "mipsel-unknown-linux-gnu",
                vec!["ld.so.1", "libatomic.so.1"],
            ),
            ("mips64el-unknown-linux-gnuabi64", vec![]),
            ("ppc64le-unknown-linux-gnu", vec!["ld64.so.1", "ld64.so.2"]),
            ("s390x-unknown-linux-gnu", vec!["ld64.so.1"]),
            ("x86_64-unknown-linux-gnu", vec!["ld-linux-x86-64.so.2"]),
            ("x86_64_v2-unknown-linux-gnu", vec!["ld-linux-x86-64.so.2"]),
            ("x86_64_v3-unknown-linux-gnu", vec!["ld-linux-x86-64.so.2"]),
            ("x86_64_v4-unknown-linux-gnu", vec!["ld-linux-x86-64.so.2"]),
        ]
        .iter()
        .cloned()
        .collect()
    });

static DARWIN_ALLOWED_DYLIBS: Lazy<Vec<MachOAllowedDylib>> = Lazy::new(|| {
    [
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.9.dylib".to_string(),
                max_compatibility_version: "3.9.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.9d.dylib".to_string(),
                max_compatibility_version: "3.9.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.10.dylib".to_string(),
                max_compatibility_version: "3.10.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.10d.dylib".to_string(),
                max_compatibility_version: "3.10.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.11.dylib".to_string(),
                max_compatibility_version: "3.11.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.11d.dylib".to_string(),
                max_compatibility_version: "3.11.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.12.dylib".to_string(),
                max_compatibility_version: "3.12.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.12d.dylib".to_string(),
                max_compatibility_version: "3.12.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.13.dylib".to_string(),
                max_compatibility_version: "3.13.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.13d.dylib".to_string(),
                max_compatibility_version: "3.13.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.13t.dylib".to_string(),
                max_compatibility_version: "3.13.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.13td.dylib".to_string(),
                max_compatibility_version: "3.13.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.14.dylib".to_string(),
                max_compatibility_version: "3.14.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.14d.dylib".to_string(),
                max_compatibility_version: "3.14.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.14t.dylib".to_string(),
                max_compatibility_version: "3.14.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "@executable_path/../lib/libpython3.14td.dylib".to_string(),
                max_compatibility_version: "3.14.0".try_into().unwrap(),
                required: false,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit".to_string(),
                max_compatibility_version: "45.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/Carbon.framework/Versions/A/Carbon".to_string(),
                max_compatibility_version: "2.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name:
                    "/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation"
                        .to_string(),
                max_compatibility_version: "150.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics".to_string(),
                max_compatibility_version: "64.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation".to_string(),
                max_compatibility_version: "300.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore".to_string(),
                max_compatibility_version: "1.2.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/usr/lib/libedit.3.dylib".to_string(),
                max_compatibility_version: "2.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/usr/lib/libncurses.5.4.dylib".to_string(),
                max_compatibility_version: "5.4.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/usr/lib/libobjc.A.dylib".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/usr/lib/libpanel.5.4.dylib".to_string(),
                max_compatibility_version: "5.4.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/usr/lib/libSystem.B.dylib".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
            MachOAllowedDylib {
                name: "/usr/lib/libz.1.dylib".to_string(),
                max_compatibility_version: "1.0.0".try_into().unwrap(),
                required: true,
            },
        ]
        .to_vec()
});

static IOS_ALLOWED_DYLIBS: Lazy<Vec<MachOAllowedDylib>> = Lazy::new(|| {
    [
        MachOAllowedDylib {
            name: "@executable_path/../lib/libpython3.9.dylib".to_string(),
            max_compatibility_version: "3.9.0".try_into().unwrap(),
            required: false,
        },
        MachOAllowedDylib {
            name: "@executable_path/../lib/libpython3.9d.dylib".to_string(),
            max_compatibility_version: "3.9.0".try_into().unwrap(),
            required: false,
        },
        MachOAllowedDylib {
            name: "@executable_path/../lib/libpython3.10.dylib".to_string(),
            max_compatibility_version: "3.10.0".try_into().unwrap(),
            required: false,
        },
        MachOAllowedDylib {
            name: "@executable_path/../lib/libpython3.10d.dylib".to_string(),
            max_compatibility_version: "3.10.0".try_into().unwrap(),
            required: false,
        },
        MachOAllowedDylib {
            name: "@executable_path/../lib/libpython3.11.dylib".to_string(),
            max_compatibility_version: "3.11.0".try_into().unwrap(),
            required: false,
        },
        MachOAllowedDylib {
            name: "@executable_path/../lib/libpython3.11d.dylib".to_string(),
            max_compatibility_version: "3.11.0".try_into().unwrap(),
            required: false,
        },
        // For some reason, CoreFoundation is present in debug/noopt builds but not
        // LTO builds.
        MachOAllowedDylib {
            name: "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation".to_string(),
            max_compatibility_version: "150.0.0".try_into().unwrap(),
            required: false,
        },
        MachOAllowedDylib {
            name: "/usr/lib/libSystem.B.dylib".to_string(),
            max_compatibility_version: "1.0.0".try_into().unwrap(),
            required: true,
        },
        MachOAllowedDylib {
            name: "/usr/lib/libz.1.dylib".to_string(),
            max_compatibility_version: "1.0.0".try_into().unwrap(),
            required: true,
        },
    ]
    .to_vec()
});

static PLATFORM_TAG_BY_TRIPLE: Lazy<HashMap<&'static str, &'static str>> = Lazy::new(|| {
    [
        ("aarch64-apple-darwin", "macosx-11.0-arm64"),
        ("aarch64-apple-ios", "iOS-aarch64"),
        ("aarch64-unknown-linux-gnu", "linux-aarch64"),
        ("armv7-unknown-linux-gnueabi", "linux-arm"),
        ("armv7-unknown-linux-gnueabihf", "linux-arm"),
        ("i686-pc-windows-msvc", "win32"),
        ("i686-unknown-linux-gnu", "linux-i686"),
        ("mips-unknown-linux-gnu", "linux-mips"),
        ("mipsel-unknown-linux-gnu", "linux-mipsel"),
        ("mips64el-unknown-linux-gnuabi64", "todo"),
        ("ppc64le-unknown-linux-gnu", "linux-powerpc64le"),
        ("s390x-unknown-linux-gnu", "linux-s390x"),
        ("x86_64-apple-darwin", "macosx-10.15-x86_64"),
        ("x86_64-apple-ios", "iOS-x86_64"),
        ("x86_64-pc-windows-msvc", "win-amd64"),
        ("x86_64-unknown-linux-gnu", "linux-x86_64"),
        ("x86_64_v2-unknown-linux-gnu", "linux-x86_64"),
        ("x86_64_v3-unknown-linux-gnu", "linux-x86_64"),
        ("x86_64_v4-unknown-linux-gnu", "linux-x86_64"),
        ("x86_64-unknown-linux-musl", "linux-x86_64"),
        ("x86_64_v2-unknown-linux-musl", "linux-x86_64"),
        ("x86_64_v3-unknown-linux-musl", "linux-x86_64"),
        ("x86_64_v4-unknown-linux-musl", "linux-x86_64"),
    ]
    .iter()
    .cloned()
    .collect()
});

const ELF_BANNED_SYMBOLS: &[&str] = &[
    // Deprecated as of glibc 2.34 in favor of sched_yield.
    "pthread_yield",
];

/// Symbols defined in dependency packages.
///
/// We use this list to spot test behavior of symbols belonging to dependency packages.
/// The list is obviously not complete.
const DEPENDENCY_PACKAGE_SYMBOLS: &[&str] = &[
    // libX11
    "XClearWindow",
    "XFlush",
    // OpenSSL
    "BIO_ADDR_new",
    "BN_new",
    "DH_new",
    "SSL_extension_supported",
    "SSL_read",
    "CRYPTO_memcmp",
    "ecp_nistz256_neg",
    "OPENSSL_instrument_bus",
    "x25519_fe64_add",
    // libdb
    "__txn_begin",
    // libedit / readline
    "rl_prompt",
    "readline",
    "current_history",
    "history_expand",
    // libffi
    "ffi_call",
    "ffi_type_void",
    // ncurses
    "new_field",
    "set_field_term",
    "set_menu_init",
    "winstr",
    // gdbm
    "gdbm_close",
    "gdbm_import",
    // sqlite3
    "sqlite3_initialize",
    "sqlite3_close",
    // libxcb
    "xcb_create_window",
    "xcb_get_property",
    // libz
    "deflateEnd",
    "gzclose",
    "inflate",
    // tix
    "Tix_DItemCreate",
    "Tix_GrFormat",
    // liblzma
    "lzma_index_init",
    "lzma_stream_encoder",
    // tcl
    "Tcl_Alloc",
    "Tcl_ChannelName",
    "Tcl_CreateInterp",
    // tk
    "TkBindInit",
    "TkCreateFrame",
    "Tk_FreeGC",
];

const PYTHON_EXPORTED_SYMBOLS: &[&str] = &[
    "Py_Initialize",
    "PyList_New",
    // From limited API.
    "Py_CompileString",
];

static WANTED_WINDOWS_STATIC_PATHS: Lazy<BTreeSet<PathBuf>> = Lazy::new(|| {
    [
        PathBuf::from("python/build/lib/libffi.lib"),
        PathBuf::from("python/build/lib/libcrypto_static.lib"),
        PathBuf::from("python/build/lib/liblzma.lib"),
        PathBuf::from("python/build/lib/libssl_static.lib"),
        PathBuf::from("python/build/lib/sqlite3.lib"),
    ]
    .iter()
    .cloned()
    .collect()
});

const GLOBALLY_BANNED_EXTENSIONS: &[&str] = &[
    // Due to linking issues. See comment in cpython.py.
    "nis",
];

const GLOBAL_EXTENSIONS: &[&str] = &[
    "_abc",
    "_ast",
    "_asyncio",
    "_bisect",
    "_blake2",
    "_bz2",
    "_codecs",
    "_codecs_cn",
    "_codecs_hk",
    "_codecs_iso2022",
    "_codecs_jp",
    "_codecs_kr",
    "_codecs_tw",
    "_collections",
    "_contextvars",
    "_csv",
    "_ctypes",
    "_datetime",
    "_decimal",
    "_elementtree",
    "_functools",
    "_hashlib",
    "_heapq",
    "_imp",
    "_io",
    "_json",
    "_locale",
    "_lsprof",
    "_lzma",
    "_md5",
    "_multibytecodec",
    "_multiprocessing",
    "_opcode",
    "_operator",
    "_pickle",
    "_queue",
    "_random",
    "_sha1",
    "_sha3",
    "_signal",
    "_socket",
    "_sqlite3",
    "_sre",
    "_ssl",
    "_stat",
    "_statistics",
    "_string",
    "_struct",
    "_symtable",
    "_thread",
    "_tkinter",
    "_tracemalloc",
    "_warnings",
    "_weakref",
    "_uuid",
    "array",
    "atexit",
    "binascii",
    "builtins",
    "cmath",
    "errno",
    "faulthandler",
    "gc",
    "itertools",
    "marshal",
    "math",
    "mmap",
    "pyexpat",
    "select",
    "sys",
    "time",
    "unicodedata",
    "xxsubtype",
    "zlib",
];

// _zoneinfo added in 3.9.
// parser removed in 3.10.
// _tokenize added in 3.11.
// _typing added in 3.11.
// _testsinglephase added in 3.12.
// _sha256 and _sha512 merged into _sha2 in 3.12.
// _xxinterpchannels added in 3.12.
// audioop removed in 3.13.

// We didn't build ctypes_test until 3.9.
// We didn't build some test extensions until 3.9.

const GLOBAL_EXTENSIONS_PYTHON_3_9: &[&str] = &[
    "audioop",
    "_peg_parser",
    "_sha256",
    "_sha512",
    "_xxsubinterpreters",
    "_zoneinfo",
    "parser",
];

const GLOBAL_EXTENSIONS_PYTHON_3_10: &[&str] = &[
    "audioop",
    "_sha256",
    "_sha512",
    "_xxsubinterpreters",
    "_zoneinfo",
];

const GLOBAL_EXTENSIONS_PYTHON_3_11: &[&str] = &[
    "audioop",
    "_sha256",
    "_sha512",
    "_tokenize",
    "_typing",
    "_xxsubinterpreters",
    "_zoneinfo",
];

const GLOBAL_EXTENSIONS_PYTHON_3_12: &[&str] = &[
    "audioop",
    "_sha2",
    "_tokenize",
    "_typing",
    "_xxinterpchannels",
    "_xxsubinterpreters",
    "_zoneinfo",
];

const GLOBAL_EXTENSIONS_PYTHON_3_13: &[&str] = &[
    "_interpchannels",
    "_interpqueues",
    "_interpreters",
    "_sha2",
    "_sysconfig",
    "_tokenize",
    "_typing",
    "_zoneinfo",
];

const GLOBAL_EXTENSIONS_PYTHON_3_14: &[&str] = &[
    "_interpchannels",
    "_interpqueues",
    "_interpreters",
    "_sha2",
    "_sysconfig",
    "_tokenize",
    "_typing",
    "_zoneinfo",
];

const GLOBAL_EXTENSIONS_MACOS: &[&str] = &["_scproxy"];

const GLOBAL_EXTENSIONS_POSIX: &[&str] = &[
    "_ctypes_test",
    "_curses",
    "_curses_panel",
    "_dbm",
    "_posixshmem",
    "_posixsubprocess",
    "_testinternalcapi",
    "fcntl",
    "grp",
    "posix",
    "pwd",
    "readline",
    "resource",
    "syslog",
    "termios",
];

const GLOBAL_EXTENSIONS_POSIX_PRE_3_13: &[&str] = &["_crypt"];

const GLOBAL_EXTENSIONS_LINUX_PRE_3_13: &[&str] = &["spwd"];

const GLOBAL_EXTENSIONS_WINDOWS: &[&str] = &[
    "_overlapped",
    "_winapi",
    "msvcrt",
    "nt",
    "winreg",
    "winsound",
];

const GLOBAL_EXTENSIONS_WINDOWS_PRE_3_13: &[&str] = &["_msi"];

/// Extension modules not present in Windows static builds.
const GLOBAL_EXTENSIONS_WINDOWS_NO_STATIC: &[&str] = &["_testinternalcapi", "_tkinter"];

/// Extension modules that should be built as shared libraries.
const SHARED_LIBRARY_EXTENSIONS: &[&str] = &["_crypt"];

const PYTHON_VERIFICATIONS: &str = include_str!("verify_distribution.py");

fn allowed_dylibs_for_triple(triple: &str) -> Vec<MachOAllowedDylib> {
    match triple {
        "aarch64-apple-darwin" => DARWIN_ALLOWED_DYLIBS.clone(),
        "x86_64-apple-darwin" => DARWIN_ALLOWED_DYLIBS.clone(),
        "aarch64-apple-ios" => IOS_ALLOWED_DYLIBS.clone(),
        "x86_64-apple-ios" => IOS_ALLOWED_DYLIBS.clone(),
        _ => vec![],
    }
}

#[derive(Clone, Default)]
pub struct ValidationContext {
    /// Collected errors.
    pub errors: Vec<String>,

    /// Dynamic libraries required to be loaded.
    pub seen_dylibs: BTreeSet<String>,

    /// Symbols exported from dynamic libpython library.
    pub libpython_exported_symbols: BTreeSet<String>,

    /// Undefined Mach-O symbols that are required / non-weak.
    pub macho_undefined_symbols_strong: RequiredSymbols,

    /// Undefined Mach-O symbols that are weakly referenced.
    pub macho_undefined_symbols_weak: RequiredSymbols,
}

impl ValidationContext {
    /// Merge the contents of `other` into this instance.
    pub fn merge(&mut self, other: Self) {
        self.errors.extend(other.errors);
        self.seen_dylibs.extend(other.seen_dylibs);
        self.libpython_exported_symbols
            .extend(other.libpython_exported_symbols);
        self.macho_undefined_symbols_strong
            .merge(other.macho_undefined_symbols_strong);
        self.macho_undefined_symbols_weak
            .merge(other.macho_undefined_symbols_weak);
    }
}

fn validate_elf<Elf: FileHeader<Endian = Endianness>>(
    context: &mut ValidationContext,
    json: &PythonJsonMain,
    target_triple: &str,
    python_major_minor: &str,
    path: &Path,
    elf: &Elf,
    data: &[u8],
) -> Result<()> {
    let mut system_links = BTreeSet::new();
    for link in &json.build_info.core.links {
        if link.system.unwrap_or_default() {
            system_links.insert(link.name.as_str());
        }
    }
    for extension in json.build_info.extensions.values() {
        for variant in extension {
            for link in &variant.links {
                if link.system.unwrap_or_default() {
                    system_links.insert(link.name.as_str());
                }
            }
        }
    }

    let wanted_cpu_type = match target_triple {
        "aarch64-unknown-linux-gnu" => object::elf::EM_AARCH64,
        "armv7-unknown-linux-gnueabi" => object::elf::EM_ARM,
        "armv7-unknown-linux-gnueabihf" => object::elf::EM_ARM,
        "i686-unknown-linux-gnu" => object::elf::EM_386,
        "mips-unknown-linux-gnu" => object::elf::EM_MIPS,
        "mipsel-unknown-linux-gnu" => object::elf::EM_MIPS,
        "mips64el-unknown-linux-gnuabi64" => 0,
        "ppc64le-unknown-linux-gnu" => object::elf::EM_PPC64,
        "s390x-unknown-linux-gnu" => object::elf::EM_S390,
        "x86_64-unknown-linux-gnu" => object::elf::EM_X86_64,
        "x86_64_v2-unknown-linux-gnu" => object::elf::EM_X86_64,
        "x86_64_v3-unknown-linux-gnu" => object::elf::EM_X86_64,
        "x86_64_v4-unknown-linux-gnu" => object::elf::EM_X86_64,
        "x86_64-unknown-linux-musl" => object::elf::EM_X86_64,
        "x86_64_v2-unknown-linux-musl" => object::elf::EM_X86_64,
        "x86_64_v3-unknown-linux-musl" => object::elf::EM_X86_64,
        "x86_64_v4-unknown-linux-musl" => object::elf::EM_X86_64,
        _ => panic!("unhandled target triple: {}", target_triple),
    };

    let endian = elf.endian()?;

    if elf.e_machine(endian) != wanted_cpu_type {
        context.errors.push(format!(
            "invalid ELF machine type in {}; wanted {}, got {}",
            path.display(),
            wanted_cpu_type,
            elf.e_machine(endian),
        ));
    }

    let mut allowed_libraries = ELF_ALLOWED_LIBRARIES
        .iter()
        .map(|x| x.to_string())
        .collect::<Vec<_>>();
    if let Some(extra) = ELF_ALLOWED_LIBRARIES_BY_TRIPLE.get(target_triple) {
        allowed_libraries.extend(extra.iter().map(|x| x.to_string()));
    }

    allowed_libraries.push(format!(
        "$ORIGIN/../lib/libpython{}.so.1.0",
        python_major_minor
    ));
    allowed_libraries.push(format!(
        "$ORIGIN/../lib/libpython{}d.so.1.0",
        python_major_minor
    ));
    allowed_libraries.push(format!(
        "$ORIGIN/../lib/libpython{}t.so.1.0",
        python_major_minor
    ));
    allowed_libraries.push(format!(
        "$ORIGIN/../lib/libpython{}td.so.1.0",
        python_major_minor
    ));

    // Allow the _crypt extension module - and only it - to link against libcrypt,
    // which is no longer universally present in Linux distros.
    if let Some(filename) = path.file_name() {
        if filename.to_string_lossy().starts_with("_crypt") {
            allowed_libraries.push("libcrypt.so.1".to_string());
        }
    }

    let wanted_glibc_max_version = GLIBC_MAX_VERSION_BY_TRIPLE
        .get(target_triple)
        .expect("max glibc version not defined for target triple");

    let sections = elf.sections(endian, data)?;

    let versions = sections.versions(endian, data)?;

    for (section_index, section) in sections.iter().enumerate() {
        // Dynamic sections defined needed libraries, which we validate.
        if let Some((entries, index)) = section.dynamic(endian, data)? {
            let strings = sections.strings(endian, data, index).unwrap_or_default();

            for entry in entries {
                if entry.tag32(endian) == Some(object::elf::DT_NEEDED) {
                    let lib = entry.string(endian, strings)?;
                    let lib = String::from_utf8(lib.to_vec())?;

                    if !allowed_libraries.contains(&lib.to_string()) {
                        context.errors.push(format!(
                            "{} loads illegal library {}",
                            path.display(),
                            lib
                        ));
                    }

                    // Most linked libraries should have an annotation in the JSON metadata.
                    let requires_annotation = !lib.contains("libpython")
                        && !lib.starts_with("ld-linux")
                        && !lib.starts_with("ld64.so")
                        && !lib.starts_with("ld.so")
                        && !lib.starts_with("libc.so")
                        && !lib.starts_with("libgcc_s.so");

                    if requires_annotation {
                        if lib.starts_with("lib") {
                            if let Some(index) = lib.rfind(".so") {
                                let lib_name = &lib[3..index];

                                // There should be a system links entry for this library in the JSON
                                // metadata.
                                //
                                // Nominally we would look at where this ELF came from and make sure
                                // the annotation is present in its section (e.g. core or extension).
                                // But this is more work.
                                if !system_links.contains(lib_name) {
                                    context.errors.push(format!(
                            "{} library load of {} does not have system link build annotation",
                            path.display(),
                            lib
                        ));
                                }
                            } else {
                                context.errors.push(format!(
                                    "{} library load of {} does not have .so extension",
                                    path.display(),
                                    lib
                                ));
                            }
                        } else {
                            context.errors.push(format!(
                                "{} library load of {} does not begin with lib",
                                path.display(),
                                lib
                            ));
                        }
                    }
                }
            }
        }

        if let Some(symbols) =
            section.symbols(endian, data, &sections, SectionIndex(section_index))?
        {
            let strings = symbols.strings();