rust: ban ___darwin_check_fd_set_overflow on Python 3.8

By changing the SDK in the previous commit, we stopped the introduction
of this symbol on Python 3.8. Since it causes problems for end users,
lets ban its use in the validator to ensure it doesn't slip back in
without notice.

We'll consider Python 3.9 separately.

Author: indygreg

src/main.rs

@@ -351,6 +351,15 @@ const MACHO_BANNED_SYMBOLS_NON_AARCH64: &[&str] = &[
     "_preadv", "_pwritev",
 ];
 
+const MACHO_BANNED_SYMBOLS_NON_AARCH64_PYTHON_38: &[&str] = &[
+    // This symbol was improperly introduced into the 10.15 SDK and wasn't
+    // guarded by availability checks. Users in the wild have problems linking
+    // against a modern macOS SDK. So to keep compatibility with the non-buggy
+    // 10.15 SDK, we prevent the presence of this symbol.
+    // See https://github.com/indygreg/PyOxidizer/issues/373 for more.
+    "___darwin_check_fd_set_overflow",
+];
+
 static WANTED_WINDOWS_STATIC_PATHS: Lazy<BTreeSet<PathBuf>> = Lazy::new(|| {
     [
         PathBuf::from("python/build/lib/libffi.lib"),
@@ -463,6 +472,7 @@ fn validate_elf(
 }
 
 fn validate_macho(
+    python_major_minor: &str,
     target_triple: &str,
     path: &Path,
     macho: &goblin::mach::MachO,
@@ -526,7 +536,9 @@ fn validate_macho(
             let (name, _) = symbol?;
 
             if target_triple != "aarch64-apple-darwin"
-                && MACHO_BANNED_SYMBOLS_NON_AARCH64.contains(&name)
+                && (MACHO_BANNED_SYMBOLS_NON_AARCH64.contains(&name)
+                    || (python_major_minor == "3.8"
+                        && MACHO_BANNED_SYMBOLS_NON_AARCH64_PYTHON_38.contains(&name)))
             {
                 errors.push(format!(
                     "{} references unallowed symbol {}",
@@ -576,7 +588,7 @@ fn validate_possible_object_file(
             goblin::Object::Mach(mach) => match mach {
                 goblin::mach::Mach::Binary(macho) => {
                     let (local_errors, local_seen_dylibs) =
-                        validate_macho(triple, path.as_ref(), &macho, &data)?;
+                        validate_macho(python_major_minor, triple, path.as_ref(), &macho, &data)?;
 
                     errors.extend(local_errors);
                     seen_dylibs.extend(local_seen_dylibs);