fix: blacklist symbols from glibc 2.18 in earlier policies

src/auditwheel/policy/manylinux-policy.json

@@ -31,6 +31,9 @@
     },
     "lib_whitelist": ["libatomic.so.1", "libgcc_s.so.1", "libstdc++.so.6", "libm.so.6", "libanl.so.1", "libdl.so.2", "librt.so.1", "libc.so.6", "libnsl.so.1", "libutil.so.1", "libpthread.so.0", "libX11.so.6", "libXext.so.6", "libXrender.so.1", "libICE.so.6", "libSM.so.6", "libGL.so.1", "libgobject-2.0.so.0", "libgthread-2.0.so.0", "libglib-2.0.so.0", "libresolv.so.2", "libz.so.1"],
     "blacklist": {
+      "libc.so.6": ["__cxa_thread_atexit_impl", "__issignaling", "__issignalingf", "__issignalingl", "pthread_getattr_default_np", "pthread_setattr_default_np"],
+      "libm.so.6": ["__issignaling", "__issignalingf", "__issignalingl"],
+      "libpthread.so.0": ["pthread_getattr_default_np", "pthread_setattr_default_np"],
       "libz.so.1": ["_dist_code", "_length_code", "_tr_align", "_tr_flush_block", "_tr_init", "_tr_stored_block", "_tr_tally", "adler32_default", "bi_windup", "crc32_acle", "crc32_combine_gen", "crc32_combine_gen64", "crc32_combine_op", "crc32_le_vgfm_16", "crc32_neon", "crc32_vpmsum", "crc32_z_default", "crc_fold_512to32", "crc_fold_copy", "crc_fold_init", "deflate_copyright", "deflate_medium", "fill_window", "flush_pending", "gzflags", "inflate_copyright", "inflate_fast", "inflate_table", "longest_match", "slide_hash_sse", "static_ltree", "uncompress2", "x86_check_features", "x86_cpu_has_pclmul", "x86_cpu_has_sse2", "x86_cpu_has_sse42", "sse2_slide_hash", "z_errmsg", "z_vstring", "zcalloc", "zcfree"]
     }
   },
@@ -58,6 +61,9 @@
     },
     "lib_whitelist": ["libatomic.so.1", "libgcc_s.so.1", "libstdc++.so.6", "libm.so.6", "libanl.so.1", "libdl.so.2", "librt.so.1", "libc.so.6", "libnsl.so.1", "libutil.so.1", "libpthread.so.0", "libX11.so.6", "libXext.so.6", "libXrender.so.1", "libICE.so.6", "libSM.so.6", "libGL.so.1", "libgobject-2.0.so.0", "libgthread-2.0.so.0", "libglib-2.0.so.0", "libresolv.so.2", "libexpat.so.1", "libz.so.1"],
     "blacklist": {
+      "libc.so.6": ["__cxa_thread_atexit_impl", "__issignaling", "__issignalingf", "__issignalingl", "pthread_getattr_default_np", "pthread_setattr_default_np"],
+      "libm.so.6": ["__issignaling", "__issignalingf", "__issignalingl"],
+      "libpthread.so.0": ["pthread_getattr_default_np", "pthread_setattr_default_np"],
       "libz.so.1": ["_dist_code", "_length_code", "_tr_align", "_tr_flush_block", "_tr_init", "_tr_stored_block", "_tr_tally", "adler32_default", "bi_windup", "crc32_acle", "crc32_combine_gen", "crc32_combine_gen64", "crc32_combine_op", "crc32_le_vgfm_16", "crc32_neon", "crc32_vpmsum", "crc32_z_default", "crc_fold_512to32", "crc_fold_copy", "crc_fold_init", "deflate_copyright", "deflate_medium", "fill_window", "flush_pending", "gzflags", "inflate_copyright", "inflate_fast", "inflate_table", "longest_match", "slide_hash_sse", "static_ltree", "uncompress2", "x86_check_features", "x86_cpu_has_pclmul", "x86_cpu_has_sse2", "x86_cpu_has_sse42", "sse2_slide_hash", "z_errmsg", "z_vstring", "zcalloc", "zcfree"]
     }
   },
@@ -125,6 +131,9 @@
     },
     "lib_whitelist": ["libatomic.so.1", "libgcc_s.so.1", "libstdc++.so.6", "libm.so.6", "libanl.so.1", "libdl.so.2", "librt.so.1", "libc.so.6", "libnsl.so.1", "libutil.so.1", "libpthread.so.0", "libX11.so.6", "libXext.so.6", "libXrender.so.1", "libICE.so.6", "libSM.so.6", "libGL.so.1", "libgobject-2.0.so.0", "libgthread-2.0.so.0", "libglib-2.0.so.0", "libresolv.so.2", "libexpat.so.1", "libz.so.1"],
     "blacklist": {
+      "libc.so.6": ["__cxa_thread_atexit_impl", "__issignaling", "__issignalingf", "__issignalingl", "pthread_getattr_default_np", "pthread_setattr_default_np"],
+      "libm.so.6": ["__issignaling", "__issignalingf", "__issignalingl"],
+      "libpthread.so.0": ["pthread_getattr_default_np", "pthread_setattr_default_np"],
       "libz.so.1": ["_dist_code", "_length_code", "_tr_align", "_tr_flush_block", "_tr_init", "_tr_stored_block", "_tr_tally", "adler32_default", "bi_windup", "crc32_acle", "crc32_combine_gen", "crc32_combine_gen64", "crc32_combine_op", "crc32_le_vgfm_16", "crc32_neon", "crc32_vpmsum", "crc32_z_default", "crc_fold_512to32", "crc_fold_copy", "crc_fold_init", "deflate_copyright", "deflate_medium", "fill_window", "flush_pending", "gzflags", "inflate_copyright", "inflate_fast", "inflate_table", "longest_match", "slide_hash_sse", "static_ltree", "uncompress2", "x86_check_features", "x86_cpu_has_pclmul", "x86_cpu_has_sse2", "x86_cpu_has_sse42", "sse2_slide_hash", "z_errmsg", "z_vstring", "zcalloc", "zcfree"]
     }
   },

tests/integration/test_aarch64_glibc_blacklist/CMakeLists.txt

@@ -0,0 +1,23 @@
+cmake_minimum_required(VERSION 3.15)
+project(test_aarch64_glibc_blacklist VERSION 0.1.0 LANGUAGES C CXX)
+
+set(THREADS_PREFER_PTHREAD_FLAG TRUE)
+find_package(Threads REQUIRED)
+
+add_library(test_tls_atexit SHARED tst-tls-atexit-lib.c)
+
+add_executable(test_signaling signaling.cpp)
+target_compile_definitions(test_signaling PRIVATE SIGNALING_TYPE=double)
+target_link_libraries(test_signaling PRIVATE m)
+add_executable(test_signalingf signaling.cpp)
+target_compile_definitions(test_signalingf PRIVATE SIGNALING_TYPE=float)
+target_link_libraries(test_signalingf PRIVATE m)
+add_executable(test_signalingl signaling.cpp)
+target_compile_definitions(test_signalingl PRIVATE SIGNALING_TYPE=long\ double)
+target_link_libraries(test_signalingl PRIVATE m)
+
+add_executable(test_pthread pthread_default_attr.c)
+target_link_libraries(test_pthread PRIVATE Threads::Threads)
+
+install(TARGETS test_tls_atexit)
+install(TARGETS test_signaling test_signalingf test_signalingl test_pthread DESTINATION "${SKBUILD_SCRIPTS_DIR}")

tests/integration/test_aarch64_glibc_blacklist/pthread_default_attr.c

@@ -0,0 +1,10 @@
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+#include <pthread.h>
+
+int main() {
+  pthread_attr_t attr;
+  pthread_getattr_default_np(&attr);
+  return pthread_setattr_default_np(&attr);
+}

tests/integration/test_aarch64_glibc_blacklist/pyproject.toml

@@ -0,0 +1,13 @@
+[build-system]
+requires = ["scikit-build-core"]
+build-backend = "scikit_build_core.build"
+
+[project]
+name = "test_aarch64_glibc_blacklist"
+version = "0.0.1"
+requires-python = ">=3.10"
+
+[tool.scikit-build]
+wheel.install-dir = "test_aarch64_glibc_blacklist"
+cmake.build-type = "Release"
+wheel.py-api = "py3"

tests/integration/test_aarch64_glibc_blacklist/signaling.cpp

@@ -0,0 +1,10 @@
+#ifndef _GNU_SOURCE
+#define _GNU_SOURCE
+#endif
+
+#include <cmath>
+#include <limits>
+
+int main() {
+  return issignaling(std::numeric_limits<SIGNALING_TYPE>::quiet_NaN());
+}

tests/integration/test_aarch64_glibc_blacklist/tst-tls-atexit-lib.c

@@ -0,0 +1,39 @@
+/* Verify that DSO is unloaded only if its TLS objects are destroyed - the DSO.
+   Copyright (C) 2012 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+typedef void (*dtor_func) (void *);
+
+extern int __cxa_thread_atexit_impl (dtor_func, void *, void *);
+extern void *__dso_handle;
+
+typedef struct
+{
+  void *val;
+} A;
+
+/* We only care about the destructor.  */
+void A_dtor (void *obj)
+{
+  ((A *)obj)->val = obj;
+}
+
+void do_foo (void)
+{
+  static __thread A b;
+  __cxa_thread_atexit_impl (A_dtor, &b, __dso_handle);
+}

tests/integration/test_manylinux.py

@@ -1176,6 +1176,54 @@ def test_zlib_blacklist(self, anylinux: AnyLinuxContainer) -> None:
         output = anylinux.show(orig_wheel, verbose=True)
         assert "black-listed symbol dependencies" in output.replace("\n", " ")
 
+    @pytest.mark.skipif(PLATFORM != "aarch64", reason="glibc blacklist only for aarch64")
+    def test_glibc_blacklist(self, anylinux: AnyLinuxContainer, python: PythonContainer) -> None:
+        # https://github.com/pypa/auditwheel/issues/647
+        policy = anylinux.policy
+        if policy.startswith("manylinux_2_17_"):
+            pytest.skip(f"{policy} image can't build this test")
+
+        test_path = "/auditwheel_src/tests/integration/test_aarch64_glibc_blacklist"
+        orig_wheel = anylinux.build_wheel(test_path, check_filename=False)
+        assert orig_wheel.startswith("test_aarch64_glibc_blacklist-0.0.1-")
+
+        # Repair the wheel using the appropriate manylinux container
+        anylinux.repair(orig_wheel, only_plat=not policy.startswith("manylinux_2_28_"))
+        platform_tag = policy
+        if policy.startswith("manylinux_2_28_"):
+            platform_tag = f"manylinux_2_24_aarch64.{platform_tag}"
+        repaired_wheel = anylinux.check_wheel(
+            "test_aarch64_glibc_blacklist",
+            python_abi="py3-none",
+            platform_tag=platform_tag,
+        )
+
+        # Check auditwheel show warns about the black listed symbols
+        output = anylinux.show(orig_wheel, verbose=True)
+        output = output.replace("\n", " ")
+        assert "black-listed symbol dependencies" in output
+        # glibc moves symbol from library to library so libc.so.6 is used as a catch all
+        # as it's more likely to be needed
+        needle = (
+            "From libc.so.6: __cxa_thread_atexit_impl, __issignaling, __issignalingf, "
+            "__issignalingl, pthread_getattr_default_np, pthread_setattr_default_np"
+        )
+        assert needle in output
+        needle = "From libm.so.6: __issignaling, __issignalingf, __issignalingl"
+        assert needle in output
+        needle = "From libpthread.so.0: pthread_getattr_default_np, pthread_setattr_default_np"
+        if policy.startswith("manylinux_2_28_"):
+            assert needle in output
+        else:
+            assert needle not in output
+
+        # Test the resulting wheel outside the manylinux container
+        python.install_wheel(repaired_wheel)
+        python.exec("test_signaling")
+        python.exec("test_signalingf")
+        python.exec("test_signalingl")
+        python.exec("test_pthread")
+
 
 class TestMusllinux(Anylinux):
     @pytest.fixture(scope="session")