refactor(c/sedona-proj): replace C dynamic loading with pure Rust using libloading (#672)

## Summary

Replace the C-based `dlopen`/`dlsym` dynamic PROJ loading (`proj_dyn.c`/`proj_dyn.h`) with a pure Rust implementation using the `libloading` crate. This eliminates ~250 lines of C code while maintaining the same `ProjApi` struct-of-function-pointers architecture used by all existing call sites.

## Approach

The `libloading` crate provides safe, cross-platform dynamic library loading (`dlopen`/`LoadLibrary`). Each PROJ symbol is loaded via a `load_fn!` macro that:
1. Loads the symbol as a raw `*const ()` pointer
2. Transmutes it to the expected function pointer type
3. Stores it in the existing `ProjApi` `#[repr(C)]` struct

The `Library` handle is stored as `_lib: Option<Library>` in the Rust `ProjApi` wrapper — `Some` when loaded from a shared library, `None` when using `proj-sys`. This ensures the library stays loaded for the lifetime of the function pointers.

## Tests

Temporarily enabled python-wheels test and passed on all major platforms: https://github.com/apache/sedona-db/actions/runs/22518558723

## Upcoming Changes

We'll implement c/sedona-gdal using similar approach.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: Kontinuation

Cargo.lock

@@ -105,6 +105,7 @@ geos = { version = "11.0.1", features = ["geo", "v3_12_0"] }
 glam = "0.32.0"
 libmimalloc-sys = { version = "0.1", default-features = false }
 log = "^0.4"
+libloading = "0.9"
 lru = "0.16"
 mimalloc = { version = "0.1", default-features = false }
 num-traits = { version = "0.2", default-features = false, features = ["libm"] }

Cargo.toml

@@ -28,9 +28,6 @@ readme.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 
-[build-dependencies]
-cc = { version = "1" }
-
 [dev-dependencies]
 approx = { workspace = true }
 geo-types = { workspace = true }
@@ -44,6 +41,7 @@ default = [ "proj-sys" ]
 proj-sys = [ "dep:proj-sys" ]
 
 [dependencies]
+libloading = { workspace = true }
 serde_json = { workspace = true }
 arrow-schema = { workspace = true }
 arrow-array = { workspace = true }

c/sedona-proj/Cargo.toml

@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+use std::path::Path;
+
+use libloading::Library;
+
+use crate::error::SedonaProjError;
+use crate::proj_dyn_bindgen::ProjApi;
+
+/// Load a single symbol from the library and write it into the given field.
+///
+/// We load as a raw `*const ()` pointer and transmute to the target function pointer
+/// type. This is the standard pattern for dynamic symbol loading where the loaded
+/// symbol's signature is known but cannot be expressed as a generic parameter to
+/// `Library::get` (because each field has a different signature).
+///
+/// On failure returns a `SedonaProjError` with the symbol name and the
+/// underlying OS error message.
+macro_rules! load_fn {
+    ($lib:expr, $api:expr, $name:ident) => {
+        // The target types here are too verbose to annotate for each call site
+        #[allow(clippy::missing_transmute_annotations)]
+        {
+            $api.$name = Some(unsafe {
+                let sym = $lib
+                    .get::<*const ()>(concat!(stringify!($name), "\0").as_bytes())
+                    .map_err(|e| {
+                        SedonaProjError::LibraryError(format!(
+                            "Failed to load symbol {}: {}",
+                            stringify!($name),
+                            e
+                        ))
+                    })?;
+                std::mem::transmute(sym.into_raw().into_raw())
+            });
+        }
+    };
+}
+
+/// Populate all 21 function-pointer fields of [`ProjApi`] from the given
+/// [`Library`] handle.
+fn load_all_symbols(lib: &Library, api: &mut ProjApi) -> Result<(), SedonaProjError> {
+    load_fn!(lib, api, proj_area_create);
+    load_fn!(lib, api, proj_area_destroy);
+    load_fn!(lib, api, proj_area_set_bbox);
+    load_fn!(lib, api, proj_context_create);
+    load_fn!(lib, api, proj_context_destroy);
+    load_fn!(lib, api, proj_context_errno_string);
+    load_fn!(lib, api, proj_context_errno);
+    load_fn!(lib, api, proj_context_set_database_path);
+    load_fn!(lib, api, proj_context_set_search_paths);
+    load_fn!(lib, api, proj_create_crs_to_crs_from_pj);
+    load_fn!(lib, api, proj_create);
+    load_fn!(lib, api, proj_cs_get_axis_count);
+    load_fn!(lib, api, proj_destroy);
+    load_fn!(lib, api, proj_errno_reset);
+    load_fn!(lib, api, proj_errno);
+    load_fn!(lib, api, proj_info);
+    load_fn!(lib, api, proj_log_level);
+    load_fn!(lib, api, proj_normalize_for_visualization);
+    load_fn!(lib, api, proj_trans);
+    load_fn!(lib, api, proj_trans_array);
+    load_fn!(lib, api, proj_as_projjson);
+
+    Ok(())
+}
+
+/// Load a PROJ shared library from `path` and populate a [`ProjApi`] struct.
+///
+/// Returns the `(Library, ProjApi)` pair. The caller is responsible for
+/// keeping the `Library` alive for the lifetime of the function pointers.
+pub(crate) fn load_proj_from_path(path: &Path) -> Result<(Library, ProjApi), SedonaProjError> {
+    let lib = unsafe { Library::new(path.as_os_str()) }.map_err(|e| {
+        SedonaProjError::LibraryError(format!(
+            "Failed to load PROJ library from {}: {}",
+            path.display(),
+            e
+        ))
+    })?;
+
+    let mut api = ProjApi::default();
+    load_all_symbols(&lib, &mut api)?;
+    Ok((lib, api))
+}

c/sedona-proj/build.rs

@@ -14,6 +14,7 @@
 // KIND, either express or implied.  See the License for the
 // specific language governing permissions and limitations
 // under the License.
+mod dyn_load;
 pub mod error;
 mod proj;
 mod proj_dyn_bindgen;

c/sedona-proj/src/dyn_load.rs

@@ -42,7 +42,9 @@ use std::{
     sync::Arc,
 };
 
-use crate::{error::SedonaProjError, proj_dyn_bindgen};
+use libloading::Library;
+
+use crate::{dyn_load, error::SedonaProjError, proj_dyn_bindgen};
 
 /// A macro to safely call a function pointer from a ProjApi
 ///
@@ -449,24 +451,16 @@ impl Proj {
 /// loaded using C code; however, this could be migrated to Rust which also
 /// provides dynamic library loading capabilities.
 ///
-/// This API is thread safe and is marked as such; however, clients must not
-/// call the inner release callback. Doing so will set function pointers to
-/// null, which will cause subsequent calls to panic.
-#[derive(Default)]
+/// This API is thread safe and is marked as such. When loading PROJ from a
+/// shared library, the `_lib` field holds the `Library` handle, ensuring that
+/// the underlying library and its function pointers remain valid for the
+/// lifetime of this `ProjApi` instance.
 struct ProjApi {
     inner: proj_dyn_bindgen::ProjApi,
     name: String,
-}
-
-unsafe impl Send for ProjApi {}
-unsafe impl Sync for ProjApi {}
-
-impl Drop for ProjApi {
-    fn drop(&mut self) {
-        if let Some(releaser) = self.inner.release {
-            unsafe { releaser(&mut self.inner) }
-        }
-    }
+    /// Keep the dynamically loaded library alive for the lifetime of the function pointers.
+    /// `None` when using `proj-sys` (statically linked), `Some` when loaded from a shared library.
+    _lib: Option<Library>,
 }
 
 impl Debug for ProjApi {
@@ -477,31 +471,12 @@ impl Debug for ProjApi {
 
 impl ProjApi {
     fn try_from_shared_library(shared_library: PathBuf) -> Result<Arc<Self>, SedonaProjError> {
-        let mut inner = proj_dyn_bindgen::ProjApi::default();
-        let mut err_message = (0..1024).map(|_| 0).collect::<Vec<u8>>();
-        let shared_library_c = CString::new(shared_library.to_string_lossy().to_string())
-            .map_err(|_| SedonaProjError::Invalid("embedded nul in Rust string".to_string()))?;
-
-        let err = unsafe {
-            proj_dyn_bindgen::proj_dyn_api_init(
-                &mut inner as _,
-                shared_library_c.as_ptr(),
-                err_message.as_mut_ptr() as _,
-                err_message.len().try_into().unwrap(),
-            )
-        };
-
-        let c_err_message = CStr::from_bytes_until_nul(&err_message)
-            .map_err(|_| SedonaProjError::Invalid("embedded nul in C string".to_string()))?;
-        if err != 0 {
-            return Err(SedonaProjError::LibraryError(
-                c_err_message.to_string_lossy().to_string(),
-            ));
-        }
+        let (lib, inner) = dyn_load::load_proj_from_path(&shared_library)?;
 
         Ok(Arc::new(Self {
             inner,
             name: shared_library.to_string_lossy().to_string(),
+            _lib: Some(lib),
         }))
     }
 
@@ -624,6 +599,7 @@ impl ProjApi {
         Self {
             inner,
             name: "proj_sys".to_string(),
+            _lib: None,
         }
     }
 }