build.rs

// pyo3 embeds a SHARED libpython and emits no rpath, so the dynamic loader
// binds whichever libpython3.x it finds first -- usually the system one, even
// when the build was configured against a different interpreter. the stdlib
// path is baked from the configured interpreter, so the two halves can come
// from different installs, and nothing says so until a node imports a module
// the mismatch hides: a python-build-standalone install (what mise provides)
// compiles `ssl` INTO libpython rather than shipping `_ssl.so` in lib-dynload,
// so pairing its stdlib with the system libpython leaves no reachable `_ssl`
// and every https url in a python node fails as "unknown url type: https".
//
// pinning the rpath to the configured interpreter's libdir keeps the library
// and the stdlib on it the same install.
//
// an interpreter living in a default loader directory needs no rpath -- the
// loader was always going to find that one -- so system pythons are left alone
// and the release workflow's containers build exactly as they did before.

use std::path::Path;
use std::process::Command;

const SYSCONFIG_QUERY: &str =
    "import sysconfig; print(sysconfig.get_config_var('LIBDIR') or ''); \
     print(sysconfig.get_config_var('Py_ENABLE_SHARED') or 0)";

/// libdirs the dynamic loader searches anyway. /usr/local/lib is the python:*
/// docker images' prefix, which the release workflow builds in.
const LOADER_DEFAULT_DIRS: [&str; 2] = ["/usr/", "/lib"];

fn main() {
    println!("cargo:rerun-if-env-changed=PYO3_PYTHON");
    if std::env::var_os("CARGO_FEATURE_PYTHON").is_none() {
        return;
    }
    let python = std::env::var("PYO3_PYTHON").unwrap_or_else(|_| "python3".to_string());
    if let Some(libdir) = shared_libdir(&python) {
        println!("cargo:rustc-link-arg=-Wl,-rpath,{}", libdir);
    }
}

/// the libdir of `python`, when it was built with a shared libpython and that
/// library is actually there to link against.
fn shared_libdir(python: &str) -> Option<String> {
    let out = Command::new(python).arg("-c").arg(SYSCONFIG_QUERY).output().ok()?;
    if !out.status.success() {
        return None;
    }
    let text = String::from_utf8(out.stdout).ok()?;
    let mut lines = text.lines();
    let libdir = lines.next()?.trim().to_string();
    let shared = lines.next()?.trim() != "0";
    if libdir.is_empty() || !shared || !Path::new(&libdir).is_dir() {
        return None;
    }
    if LOADER_DEFAULT_DIRS.iter().any(|d| libdir.starts_with(d)) {
        return None;
    }
    Some(libdir)
}