Give _tkinter $ORIGIN-relative dependencies on glibc and an rpath on musl

Partially addresses #742 and makes it consistent with what we're doing
on macOS.

There's an argument in the comments above that we should not set an
rpath on libpython (except on musl where it's needed), and I need to see
if I still believe that. In the meantime I'm following that pattern and
setting $ORIGIN-relative NEEDED on glibc and rpath on musl only.

This also adds a specific ldd regression test but not the additional
tests listed in #742.

Author: geofft

cpython-unix/build-cpython.sh

@@ -821,6 +821,25 @@ if [ "${PYBUILD_SHARED}" = "1" ]; then
                     ${ROOT}/out/python/install/lib/libpython3.so
             fi
         fi
+
+        # PyInstaller would like to see `ldd` work on modules.
+        # https://github.com/pyinstaller/pyinstaller/issues/9204#issuecomment-3171583553
+        # Also this probably helps programs linking libpython avoid having to set an rpath.
+        patchelf_args=()
+        if [ "${CC}" == "musl-clang" ]; then
+            patchelf_args+=(--set-rpath '${ORIGIN}/../..')
+        else
+            for lib in ${ROOT}/out/python/install/lib/*; do
+                basename=${lib##*/}
+                patchelf_args+=(--replace-needed "$basename" '${ORIGIN}/../../'"$basename")
+            done
+        fi
+        # At the moment, python3 and libpython don't have shared-library
+        # dependencies, but at some point we will want to run this for
+        # them too.
+        for module in ${ROOT}/out/python/install/lib/python*/lib-dynload/*.so; do
+            patchelf "${patchelf_args[@]}" "$module"
+        done
     fi
 fi
 

src/validation.rs

@@ -2186,6 +2186,37 @@ fn verify_distribution_behavior(dist_path: &Path) -> Result<Vec<String>> {
         errors.push("errors running interpreter tests".to_string());
     }
 
+    // Explicitly test ldd directly on the extension modules, which PyInstaller
+    // relies on. This is not strictly needed for a working distribution (e.g.
+    // you can set an rpath on just python+libpython), so we test here for
+    // compatibility with tools that run ldd.
+    // that fails this check (e.g. by setting an rpath on just python+libpython).
+    // https://github.com/pyinstaller/pyinstaller/issues/9204#issuecomment-3171050891
+    if cfg!(target_os = "linux") {
+        for (name, variants) in python_json.build_info.extensions.iter() {
+            if name == "_crypt" {
+                // Our test environment may lack libcrypt (and _crypt is
+                // split out specifically because of this problem).
+                continue;
+            }
+            for ext in variants {
+                let Some(shared_lib) = &ext.shared_lib else {
+                    continue;
+                };
+                let shared_lib_path = temp_dir.path().join("python").join(shared_lib);
+                let output = duct::cmd("ldd", [shared_lib_path])
+                    .unchecked()
+                    .stdout_capture()
+                    .run()
+                    .context(format!("Failed to run `ldd {}`", shared_lib))?;
+                let stdout = String::from_utf8_lossy(&output.stdout);
+                if !output.status.success() || stdout.contains("not found") {
+                    errors.push(format!("Error from `ldd {}`:\n{}", shared_lib, stdout));
+                }
+            }
+        }
+    }
+
     Ok(errors)
 }