unix: stop building nis extension

See inline comment in discussion in #51 for more context.

We also remove the shared library from the ELF allow list in the
validation code and teach the validation to ensure the nis extension
isn't present.

Author: indygreg

pythonbuild/cpython.py

@@ -62,7 +62,16 @@
 }
 
 # Modules we don't (yet) support building.
-UNSUPPORTED_MODULES = set([])
+UNSUPPORTED_MODULES = {
+    # nis (only installable on UNIX platforms) is globally disabled because
+    # it has a dependency on libnsl, which isn't part of the Linux Standard
+    # Base specification. This library has a wonky history where it was once
+    # part of glibc and core system installs but is slowly being phased away
+    # from base installations. There are potential workarounds to adding nis
+    # support. See discussion in
+    # https://github.com/indygreg/python-build-standalone/issues/51.
+    b"nis",
+}
 
 # Packages that define tests.
 STDLIB_TEST_PACKAGES = {

src/main.rs

@@ -50,7 +50,6 @@ const ELF_ALLOWED_LIBRARIES: &[&str] = &[
     "libcrypt.so.1",
     "libdl.so.2",
     "libm.so.6",
-    "libnsl.so.1",
     "libpthread.so.0",
     "librt.so.1",
     "libutil.so.1",
@@ -365,6 +364,11 @@ static WANTED_WINDOWS_STATIC_PATHS: Lazy<BTreeSet<PathBuf>> = Lazy::new(|| {
     .collect()
 });
 
+const GLOBALLY_BANNED_EXTENSIONS: &[&str] = &[
+    // Due to linking issues. See comment in cpython.py.
+    "nis",
+];
+
 fn allowed_dylibs_for_triple(triple: &str) -> Vec<MachOAllowedDylib> {
     match triple {
         "aarch64-apple-darwin" => DARWIN_ALLOWED_DYLIBS.clone(),
@@ -570,6 +574,12 @@ fn validate_json(json: &PythonJsonMain, triple: &str) -> Result<Vec<String>> {
         ));
     }
 
+    for extension in json.build_info.extensions.keys() {
+        if GLOBALLY_BANNED_EXTENSIONS.contains(&extension.as_str()) {
+            errors.push(format!("banned extension detected: {}", extension));
+        }
+    }
+
     Ok(errors)
 }