unix: don't export dependency symbols on macOS

This commit follows up on recent work we did for Linux/ELF around
not exporting dependency symbols and applies it to Apple/Mach-O.

We change compiler flags so symbols are hidden by default. We also
teach the linker to make symbols in library dependencies hidden
by default to prevent them from being exported / dynamic in the
resulting Mach-O binary.

Mach-O linker support for controlling symbol visibility is different
from ELF. We had to utilize an `ld64` specific argument
(`-hidden-l<lib>`) to force symbol visibility on a per library basis.

The Rust validation code for Mach-O has been updated to verify we
aren't exporting dependency symbols and are properly exporting Python
symbols, just like we did for ELF. Distributions built before this
fail the new validation.

This should finish the implementation of #114. Windows is still not
addressed. We can file a separate issue to track Windows.

Author: indygreg

cpython-unix/static-modules.3.10.macos

@@ -3,40 +3,40 @@
 # setup.py and what was observed to execute in a normal build via setup.py.
 # We should audit this every time we upgrade CPython.
 
-_bz2 _bz2module.c -lbz2
+_bz2 _bz2module.c -Xlinker -hidden-lbz2
 _crypt _cryptmodule.c
 # We link against the system ncurses on macOS for simplicity. There is no ncursesw
 # but it is Unicode aware.
-_curses _cursesmodule.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -lncurses
-_curses_panel _curses_panel.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -lpanel -lncurses
-_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -lffi -ldl
+_curses _cursesmodule.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -Xlinker -hidden-lncurses
+_curses_panel _curses_panel.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -Xlinker -hidden-lpanel -Xlinker -hidden-lncurses
+_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -Xlinker -hidden-lffi -ldl
 _ctypes_test _ctypes/_ctypes_test.c -lm
 _decimal _decimal/_decimal.c _decimal/libmpdec/basearith.c _decimal/libmpdec/constants.c _decimal/libmpdec/context.c _decimal/libmpdec/convolute.c _decimal/libmpdec/crt.c _decimal/libmpdec/difradix2.c _decimal/libmpdec/fnt.c _decimal/libmpdec/fourstep.c _decimal/libmpdec/io.c _decimal/libmpdec/mpalloc.c _decimal/libmpdec/mpdecimal.c _decimal/libmpdec/numbertheory.c _decimal/libmpdec/sixstep.c _decimal/libmpdec/transpose.c -DUNIVERSAL=1 -IModules/_decimal/libmpdec
 # macOS ships with an ndbm implementation in libSystem. CPython's setup.py will
 # use it unless an ndbl or gdbm_compat library is present.
 _dbm _dbmmodule.c -DHAVE_NDBM_H
 _elementtree _elementtree.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-_hashlib _hashopenssl.c -lcrypto
+_hashlib _hashopenssl.c -Xlinker -hidden-lcrypto
 _json _json.c
 _lsprof _lsprof.c rotatingtree.c
-_lzma _lzmamodule.c -llzma
+_lzma _lzmamodule.c -Xlinker -hidden-llzma
 # TODO check setup.py logic for semaphore.c and possibly fix missing
 # dependency.
 _multiprocessing _multiprocessing/multiprocessing.c _multiprocessing/semaphore.c
 _opcode _opcode.c
 _posixshmem _multiprocessing/posixshmem.c -IModules/_multiprocessing
 _queue _queuemodule.c
 _scproxy _scproxy.c -framework SystemConfiguration -framework CoreFoundation
-_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -lsqlite3
-_ssl _ssl.c -lssl -lcrypto
+_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -Xlinker -hidden-lsqlite3
+_ssl _ssl.c -Xlinker -hidden-lssl -Xlinker -hidden-lcrypto
 _testbuffer _testbuffer.c
 _testimportmultiple _testimportmultiple.c
 _testinternalcapi _testinternalcapi.c -DPy_BUILD_CORE_MODULE
 _testmultiphase _testmultiphase.c
 # CoreFoundation isn't a directory dependency but is a dependency of libtcl and libtk.
-_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT -framework AppKit -framework ApplicationServices -framework Carbon -framework CoreFoundation -framework CoreServices -framework CoreGraphics -framework IOKit -framework QuartzCore -ltcl8.6 -ltk8.6
-_uuid _uuidmodule.c -luuid
+_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT -framework AppKit -framework ApplicationServices -framework Carbon -framework CoreFoundation -framework CoreServices -framework CoreGraphics -framework IOKit -framework QuartzCore -Xlinker -hidden-ltcl8.6 -Xlinker -hidden-ltk8.6
+_uuid _uuidmodule.c -Xlinker -hidden-luuid
 _xxsubinterpreters _xxsubinterpretersmodule.c
 _xxtestfuzz _xxtestfuzz/_xxtestfuzz.c _xxtestfuzz/fuzzer.c
 pyexpat pyexpat.c expat/xmlparse.c expat/xmlrole.c expat/xmltok.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-readline readline.c -ledit -lncurses
+readline readline.c -Xlinker -hidden-ledit -Xlinker -hidden-lncurses

cpython-unix/static-modules.3.8.macos

@@ -3,33 +3,33 @@
 # setup.py and what was observed to execute in a normal build via setup.py.
 # We should audit this every time we upgrade CPython.
 
-_bz2 _bz2module.c -lbz2
+_bz2 _bz2module.c -Xlinker -hidden-lbz2
 _crypt _cryptmodule.c
 # We link against the system ncurses on macOS for simplicity. There is no ncursesw
 # but it is Unicode aware.
-_curses _cursesmodule.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -lncurses
-_curses_panel _curses_panel.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -lpanel -lncurses
-_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -lffi -ldl
+_curses _cursesmodule.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -Xlinker -hidden-lncurses
+_curses_panel _curses_panel.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -Xlinker -hidden-lpanel -Xlinker -hidden-lncurses
+_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -Xlinker -hidden-lffi -ldl
 _decimal _decimal/_decimal.c _decimal/libmpdec/basearith.c _decimal/libmpdec/constants.c _decimal/libmpdec/context.c _decimal/libmpdec/convolute.c _decimal/libmpdec/crt.c _decimal/libmpdec/difradix2.c _decimal/libmpdec/fnt.c _decimal/libmpdec/fourstep.c _decimal/libmpdec/io.c _decimal/libmpdec/memory.c _decimal/libmpdec/mpdecimal.c _decimal/libmpdec/numbertheory.c _decimal/libmpdec/sixstep.c _decimal/libmpdec/transpose.c -DUNIVERSAL=1 -IModules/_decimal/libmpdec
 # macOS ships with an ndbm implementation in libSystem. CPython's setup.py will
 # use it unless an ndbl or gdbm_compat library is present.
 _dbm _dbmmodule.c -DHAVE_NDBM_H
 _elementtree _elementtree.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-_hashlib _hashopenssl.c -lssl -lcrypto
+_hashlib _hashopenssl.c -Xlinker -hidden-lssl -Xlinker -hidden-lcrypto
 _json _json.c
 _lsprof _lsprof.c rotatingtree.c
-_lzma _lzmamodule.c -llzma
+_lzma _lzmamodule.c -Xlinker -hidden-llzma
 # TODO check setup.py logic for semaphore.c and possibly fix missing
 # dependency.
 _multiprocessing _multiprocessing/multiprocessing.c _multiprocessing/semaphore.c
 _opcode _opcode.c
 _posixshmem _multiprocessing/posixshmem.c -IModules/_multiprocessing
 _queue _queuemodule.c
 _scproxy _scproxy.c -framework SystemConfiguration -framework CoreFoundation
-_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -lsqlite3
-_ssl _ssl.c -lssl -lcrypto
+_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -Xlinker -hidden-lsqlite3
+_ssl _ssl.c -Xlinker -hidden-lssl -Xlinker -hidden-lcrypto
 # CoreFoundation isn't a directory dependency but is a dependency of libtcl and libtk.
-_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT -framework AppKit -framework ApplicationServices -framework Carbon -framework CoreFoundation -framework CoreServices -framework CoreGraphics -framework IOKit -framework QuartzCore -ltcl8.6 -ltk8.6
-_uuid _uuidmodule.c -luuid
+_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT -framework AppKit -framework ApplicationServices -framework Carbon -framework CoreFoundation -framework CoreServices -framework CoreGraphics -framework IOKit -framework QuartzCore -Xlinker -hidden-ltcl8.6 -Xlinker -hidden-ltk8.6
+_uuid _uuidmodule.c -Xlinker -hidden-luuid
 pyexpat pyexpat.c expat/xmlparse.c expat/xmlrole.c expat/xmltok.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-readline readline.c -ledit -lncurses
+readline readline.c -Xlinker -hidden-ledit -Xlinker -hidden-lncurses

cpython-unix/static-modules.3.9.aarch64-apple-ios

@@ -3,23 +3,23 @@
 # setup.py and what was observed to execute in a normal build via setup.py.
 # We should audit this every time we upgrade CPython.
 
-_bz2 _bz2module.c -lbz2
+_bz2 _bz2module.c -Wl,-hidden-lbz2
 _crypt _cryptmodule.c
-_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -lffi -ldl
+_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -Wl,-hidden-lffi -ldl
 _decimal _decimal/_decimal.c _decimal/libmpdec/basearith.c _decimal/libmpdec/constants.c _decimal/libmpdec/context.c _decimal/libmpdec/convolute.c _decimal/libmpdec/crt.c _decimal/libmpdec/difradix2.c _decimal/libmpdec/fnt.c _decimal/libmpdec/fourstep.c _decimal/libmpdec/io.c _decimal/libmpdec/mpalloc.c _decimal/libmpdec/mpdecimal.c _decimal/libmpdec/numbertheory.c _decimal/libmpdec/sixstep.c _decimal/libmpdec/transpose.c -DUNIVERSAL=1 -IModules/_decimal/libmpdec
 # macOS ships with an ndbm implementation in libSystem. CPython's setup.py will
 # use it unless an ndbl or gdbm_compat library is present.
 _dbm _dbmmodule.c -DHAVE_NDBM_H
 _elementtree _elementtree.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-_hashlib _hashopenssl.c -lssl -lcrypto
+_hashlib _hashopenssl.c -Wl,-hidden-lssl -Wl,-hidden-lcrypto
 _json _json.c
 _lsprof _lsprof.c rotatingtree.c
-_lzma _lzmamodule.c -llzma
+_lzma _lzmamodule.c -Wl,-hidden-llzma
 _multiprocessing _multiprocessing/multiprocessing.c _multiprocessing/semaphore.c
 _opcode _opcode.c
 _posixshmem _multiprocessing/posixshmem.c -IModules/_multiprocessing
 _queue _queuemodule.c
-_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -lsqlite3
-_ssl _ssl.c -lssl -lcrypto
+_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -Wl,-hidden-lsqlite3
+_ssl _ssl.c -Wl,-hidden-lssl -Wl,-hidden-lcrypto
 _uuid _uuidmodule.c
 pyexpat pyexpat.c expat/xmlparse.c expat/xmlrole.c expat/xmltok.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat

cpython-unix/static-modules.3.9.macos

@@ -3,40 +3,40 @@
 # setup.py and what was observed to execute in a normal build via setup.py.
 # We should audit this every time we upgrade CPython.
 
-_bz2 _bz2module.c -lbz2
+_bz2 _bz2module.c -Xlinker -hidden-lbz2
 _crypt _cryptmodule.c
 # We link against the system ncurses on macOS for simplicity. There is no ncursesw
 # but it is Unicode aware.
-_curses _cursesmodule.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -lncurses
-_curses_panel _curses_panel.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -lpanel -lncurses
-_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -lffi -ldl
+_curses _cursesmodule.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -Xlinker -hidden-lncurses
+_curses_panel _curses_panel.c -DHAVE_NCURSESW=1 -D_XOPEN_SOURCE_EXTENDED=1 -Xlinker -hidden-lpanel -Xlinker -hidden-lncurses
+_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -Xlinker -hidden-lffi -ldl
 _ctypes_test _ctypes/_ctypes_test.c -lm
 _decimal _decimal/_decimal.c _decimal/libmpdec/basearith.c _decimal/libmpdec/constants.c _decimal/libmpdec/context.c _decimal/libmpdec/convolute.c _decimal/libmpdec/crt.c _decimal/libmpdec/difradix2.c _decimal/libmpdec/fnt.c _decimal/libmpdec/fourstep.c _decimal/libmpdec/io.c _decimal/libmpdec/mpalloc.c _decimal/libmpdec/mpdecimal.c _decimal/libmpdec/numbertheory.c _decimal/libmpdec/sixstep.c _decimal/libmpdec/transpose.c -DUNIVERSAL=1 -IModules/_decimal/libmpdec
 # macOS ships with an ndbm implementation in libSystem. CPython's setup.py will
 # use it unless an ndbl or gdbm_compat library is present.
 _dbm _dbmmodule.c -DHAVE_NDBM_H
 _elementtree _elementtree.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-_hashlib _hashopenssl.c -lssl -lcrypto
+_hashlib _hashopenssl.c -Xlinker -hidden-lssl -Xlinker -hidden-lcrypto
 _json _json.c
 _lsprof _lsprof.c rotatingtree.c
-_lzma _lzmamodule.c -llzma
+_lzma _lzmamodule.c -Xlinker -hidden-llzma
 # TODO check setup.py logic for semaphore.c and possibly fix missing
 # dependency.
 _multiprocessing _multiprocessing/multiprocessing.c _multiprocessing/semaphore.c
 _opcode _opcode.c
 _posixshmem _multiprocessing/posixshmem.c -IModules/_multiprocessing
 _queue _queuemodule.c
 _scproxy _scproxy.c -framework SystemConfiguration -framework CoreFoundation
-_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -lsqlite3
-_ssl _ssl.c -lssl -lcrypto
+_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -Xlinker -hidden-lsqlite3
+_ssl _ssl.c -Xlinker -hidden-lssl -Xlinker -hidden-lcrypto
 _testbuffer _testbuffer.c
 _testimportmultiple _testimportmultiple.c
 _testinternalcapi _testinternalcapi.c -DPy_BUILD_CORE_MODULE
 _testmultiphase _testmultiphase.c
 # CoreFoundation isn't a directory dependency but is a dependency of libtcl and libtk.
-_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT -framework AppKit -framework ApplicationServices -framework Carbon -framework CoreFoundation -framework CoreServices -framework CoreGraphics -framework IOKit -framework QuartzCore -ltcl8.6 -ltk8.6
-_uuid _uuidmodule.c -luuid
+_tkinter _tkinter.c tkappinit.c -DWITH_APPINIT -framework AppKit -framework ApplicationServices -framework Carbon -framework CoreFoundation -framework CoreServices -framework CoreGraphics -framework IOKit -framework QuartzCore -Xlinker -hidden-ltcl8.6 -Xlinker -hidden-ltk8.6
+_uuid _uuidmodule.c -Xlinker -hidden-luuid
 _xxsubinterpreters _xxsubinterpretersmodule.c
 _xxtestfuzz _xxtestfuzz/_xxtestfuzz.c _xxtestfuzz/fuzzer.c
 pyexpat pyexpat.c expat/xmlparse.c expat/xmlrole.c expat/xmltok.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-readline readline.c -ledit -lncurses
+readline readline.c -Xlinker -hidden-ledit -Xlinker -hidden-lncurses

cpython-unix/static-modules.3.9.x86_64-apple-ios

@@ -3,23 +3,23 @@
 # setup.py and what was observed to execute in a normal build via setup.py.
 # We should audit this every time we upgrade CPython.
 
-_bz2 _bz2module.c -lbz2
+_bz2 _bz2module.c -Wl,-hidden-lbz2
 _crypt _cryptmodule.c
-_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -lffi -ldl
+_ctypes _ctypes/_ctypes.c _ctypes/callbacks.c _ctypes/callproc.c _ctypes/darwin/dlfcn_simple.c _ctypes/malloc_closure.c _ctypes/stgdict.c _ctypes/cfield.c -DMACOSX -DUSING_MALLOC_CLOSURE_DOT_C=1 -DHAVE_FFI_PREP_CIF_VAR=1 -DHAVE_FFI_PREP_CLOSURE_LOC=1 -DHAVE_FFI_CLOSURE_ALLOC=1 -I_ctypes/darwin -Wl,-hidden-lffi -ldl
 _decimal _decimal/_decimal.c _decimal/libmpdec/basearith.c _decimal/libmpdec/constants.c _decimal/libmpdec/context.c _decimal/libmpdec/convolute.c _decimal/libmpdec/crt.c _decimal/libmpdec/difradix2.c _decimal/libmpdec/fnt.c _decimal/libmpdec/fourstep.c _decimal/libmpdec/io.c _decimal/libmpdec/mpalloc.c _decimal/libmpdec/mpdecimal.c _decimal/libmpdec/numbertheory.c _decimal/libmpdec/sixstep.c _decimal/libmpdec/transpose.c -DUNIVERSAL=1 -IModules/_decimal/libmpdec
 # macOS ships with an ndbm implementation in libSystem. CPython's setup.py will
 # use it unless an ndbl or gdbm_compat library is present.
 _dbm _dbmmodule.c -DHAVE_NDBM_H
 _elementtree _elementtree.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat
-_hashlib _hashopenssl.c -lssl -lcrypto
+_hashlib _hashopenssl.c -Wl,-hidden-lssl -Wl,-hidden-lcrypto
 _json _json.c
 _lsprof _lsprof.c rotatingtree.c
-_lzma _lzmamodule.c -llzma
+_lzma _lzmamodule.c -Wl,-hidden-llzma
 _multiprocessing _multiprocessing/multiprocessing.c _multiprocessing/semaphore.c
 _opcode _opcode.c
 _posixshmem _multiprocessing/posixshmem.c -IModules/_multiprocessing
 _queue _queuemodule.c
-_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -lsqlite3
-_ssl _ssl.c -lssl -lcrypto
+_sqlite3 _sqlite/cache.c _sqlite/connection.c _sqlite/cursor.c _sqlite/microprotocols.c _sqlite/module.c _sqlite/prepare_protocol.c _sqlite/row.c _sqlite/statement.c _sqlite/util.c -IModules/_sqlite -DMODULE_NAME=\"sqlite3\" -DSQLITE_OMIT_LOAD_EXTENSION=1 -Wl,-hidden-lsqlite3
+_ssl _ssl.c -Wl,-hidden-lssl -Wl,-hidden-lcrypto
 _uuid _uuidmodule.c
 pyexpat pyexpat.c expat/xmlparse.c expat/xmlrole.c expat/xmltok.c -DHAVE_EXPAT_CONFIG_H=1 -DXML_POOR_ENTROPY=1 -DUSE_PYEXPAT_CAPI -IModules/expat