Module source_build 

Build runtime toolchains from source into a self-contained, absolute cache toolchain — “our apt-get” for the macOS sandbox, which has no package manager.

Why source-build instead of a Homebrew bottle

Relocating a Homebrew bottle (rewriting its baked @@HOMEBREW_PREFIX@@ install-name placeholders) is a dead end: the rewrite is length-preserving and silently skips placeholders shorter than the cache prefix, so the toolchain’s binary keeps @@HOMEBREW_PREFIX@@/... LC_LOAD_DYLIB paths. Under a darwin Seatbelt container those paths don’t exist and macOS strips DYLD_* from the signed binary, so dyld aborts (Symbol not found … Abort trap: 6).

Building from source at an absolute toolchain prefix sidesteps both failure modes: every LC_LOAD_DYLIB is an absolute path to a macOS system library (/usr/lib/...) or an absolute sibling-toolchain path — never @@HOMEBREW@@ — and the compiled sysconfdir/prefix live inside the toolchain, so the tool reads its own config instead of /etc/* (which EPERMs under the deny-default profile).

A fully generic, data-driven build

There is no per-formula recipe table. Everything the build needs is derived from the Homebrew formula JSON we already parse plus the extracted source tree:

• Dependencies come from the formula’s data. Anything in uses_from_macos is provided by macOS itself (the Seatbelt profile already grants /usr/lib + /usr/include via the Command Line Tools) so it is skipped. Every other dependency / build_dependency is resolved recursively as a sibling toolchain via [crate::ensure_macos_toolchain] and wired onto the build with absolute toolchain paths — build tools land on PATH, libraries contribute -I<toolchain>/include / -L<toolchain>/lib / -Wl,-rpath,<toolchain>/lib / PKG_CONFIG_PATH=<toolchain>/lib/pkgconfig. So git’s gettext/pcre2 and jq’s oniguruma become resolved toolchains automatically — no NO_GETTEXT, no --with-oniguruma=builtin, no hardcoded skip lists.
• The build system is autodetected from the extracted tree (a generated configure, a CMake self-host bootstrap, a CMakeLists.txt, a bare Makefile, or an autotools project shipped as configure.ac).
• Irreducible env is derived from the install layout, not the name. A toolchain that installed <toolchain>/libexec/git-core gets GIT_EXEC_PATH pointed there — true for any git-exec-helper tool, asserted by layout, never by == "git".

Strategy order

ensure_from_source routes each formula through up to three strategies:

1. Parsed-recipe container build — when the runtime has registered a crate::executor::ContainerBuildExecutor, the formula’s real def install is fetched and parsed into a typed crate::recipe::InstallPlan; a fully-supported plan executes inside an isolated container with the network denied (source tarball, resources and patches are pre-fetched and sha-verified leaf-side). With no executor registered this strategy — including the recipe fetch itself — is skipped entirely, so executor-less processes behave exactly as before.
2. The generic autodetected build described above.
3. Brew-emulate: if the generic build fails (a custom install do / patches the generic build can’t reproduce), crate::brew_emulate runs the formula’s real Homebrew recipe at the toolchain prefix — so genuinely-custom formulae still work with zero hardcoding.

Structs

SourceSpec

Resolved source-build coordinates for a tool.

Functions

ensure_from_source

Build formula from source into a self-contained toolchain under cache_dir, writing a ToolchainManifest and returning the toolchain path.

resolve_source_spec

Fetch the formula and extract its source-build coordinates.