From 65865e8f54bf271c7c9b0bb42571f2e71fee901a Mon Sep 17 00:00:00 2001
From: Weihang Lo <me@weihanglo.tw>
Date: Wed, 16 Oct 2024 15:06:23 -0400
Subject: [PATCH 1/3] feat(sandbox): add `-Zsandbox` unstable flag

---
 src/cargo/core/features.rs                   |  2 ++
 tests/testsuite/cargo/z_help/stdout.term.svg | 22 +++++++++++---------
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/cargo/core/features.rs b/src/cargo/core/features.rs
index 2638ff95234..c4224ebaacf 100644
--- a/src/cargo/core/features.rs
+++ b/src/cargo/core/features.rs
@@ -785,6 +785,7 @@ unstable_cli_options!(
     publish_timeout: bool = ("Enable the `publish.timeout` key in .cargo/config.toml file"),
     rustdoc_map: bool = ("Allow passing external documentation mappings to rustdoc"),
     rustdoc_scrape_examples: bool = ("Allows Rustdoc to scrape code examples from reverse-dependencies"),
+    sandbox: bool = ("Enable sandbox build"),
     script: bool = ("Enable support for single-file, `.rs` packages"),
     separate_nightlies: bool,
     skip_rustdoc_fingerprint: bool,
@@ -1289,6 +1290,7 @@ impl CliUnstable {
             "publish-timeout" => self.publish_timeout = parse_empty(k, v)?,
             "rustdoc-map" => self.rustdoc_map = parse_empty(k, v)?,
             "rustdoc-scrape-examples" => self.rustdoc_scrape_examples = parse_empty(k, v)?,
+            "sandbox" => self.sandbox = parse_empty(k, v)?,
             "separate-nightlies" => self.separate_nightlies = parse_empty(k, v)?,
             "checksum-freshness" => self.checksum_freshness = parse_empty(k, v)?,
             "skip-rustdoc-fingerprint" => self.skip_rustdoc_fingerprint = parse_empty(k, v)?,
diff --git a/tests/testsuite/cargo/z_help/stdout.term.svg b/tests/testsuite/cargo/z_help/stdout.term.svg
index a429e92d58b..3f7179b887c 100644
--- a/tests/testsuite/cargo/z_help/stdout.term.svg
+++ b/tests/testsuite/cargo/z_help/stdout.term.svg
@@ -1,4 +1,4 @@
-<svg width="1230px" height="740px" xmlns="http://www.w3.org/2000/svg">
+<svg width="1230px" height="758px" xmlns="http://www.w3.org/2000/svg">
   <style>
     .fg { fill: #AAAAAA }
     .bg { background: #000000 }
@@ -78,23 +78,25 @@
 </tspan>
     <tspan x="10px" y="568px"><tspan>    -Z rustdoc-scrape-examples  Allows Rustdoc to scrape code examples from reverse-dependencies</tspan>
 </tspan>
-    <tspan x="10px" y="586px"><tspan>    -Z script                   Enable support for single-file, `.rs` packages</tspan>
+    <tspan x="10px" y="586px"><tspan>    -Z sandbox                  Enable sandbox build</tspan>
 </tspan>
-    <tspan x="10px" y="604px"><tspan>    -Z target-applies-to-host   Enable the `target-applies-to-host` key in the .cargo/config.toml file</tspan>
+    <tspan x="10px" y="604px"><tspan>    -Z script                   Enable support for single-file, `.rs` packages</tspan>
 </tspan>
-    <tspan x="10px" y="622px"><tspan>    -Z trim-paths               Enable the `trim-paths` option in profiles</tspan>
+    <tspan x="10px" y="622px"><tspan>    -Z target-applies-to-host   Enable the `target-applies-to-host` key in the .cargo/config.toml file</tspan>
 </tspan>
-    <tspan x="10px" y="640px"><tspan>    -Z unstable-options         Allow the usage of unstable options</tspan>
+    <tspan x="10px" y="640px"><tspan>    -Z trim-paths               Enable the `trim-paths` option in profiles</tspan>
 </tspan>
-    <tspan x="10px" y="658px">
+    <tspan x="10px" y="658px"><tspan>    -Z unstable-options         Allow the usage of unstable options</tspan>
 </tspan>
-    <tspan x="10px" y="676px"><tspan>Run with `cargo -Z [FLAG] [COMMAND]`</tspan>
+    <tspan x="10px" y="676px">
 </tspan>
-    <tspan x="10px" y="694px">
+    <tspan x="10px" y="694px"><tspan>Run with `cargo -Z [FLAG] [COMMAND]`</tspan>
 </tspan>
-    <tspan x="10px" y="712px"><tspan>See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html for more information about these flags.</tspan>
+    <tspan x="10px" y="712px">
 </tspan>
-    <tspan x="10px" y="730px">
+    <tspan x="10px" y="730px"><tspan>See https://doc.rust-lang.org/nightly/cargo/reference/unstable.html for more information about these flags.</tspan>
+</tspan>
+    <tspan x="10px" y="748px">
 </tspan>
   </text>
 

From 20723a9a10eee5ea65653c298a23ec8034325399 Mon Sep 17 00:00:00 2001
From: Weihang Lo <me@weihanglo.tw>
Date: Sat, 19 Oct 2024 13:52:50 -0400
Subject: [PATCH 2/3] feat(sandbox): add unstable `[sandbox]` config table

* `sandbox.runner`: Target platform sandboxed build scripts built for
* `sandbox.target`: Runner that executes artifacts of build scripts

Example config:

```toml
[sandbox]
target = "wasm32-wasip1"
runner = [
  "wasmtime",
  "--wasi",
  "inherit-env=y",
  "--dir",
  "/path/to/my/package",
]
```
---
 src/cargo/util/context/mod.rs | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/src/cargo/util/context/mod.rs b/src/cargo/util/context/mod.rs
index c38fd6fd55a..c5be78c3888 100644
--- a/src/cargo/util/context/mod.rs
+++ b/src/cargo/util/context/mod.rs
@@ -228,6 +228,7 @@ pub struct GlobalContext {
     doc_extern_map: LazyCell<RustdocExternMap>,
     progress_config: ProgressConfig,
     env_config: LazyCell<EnvConfig>,
+    sandbox_config: LazyCell<CargoSandboxConfig>,
     /// This should be false if:
     /// - this is an artifact of the rustc distribution process for "stable" or for "beta"
     /// - this is an `#[test]` that does not opt in with `enable_nightly_features`
@@ -322,6 +323,7 @@ impl GlobalContext {
             doc_extern_map: LazyCell::new(),
             progress_config: ProgressConfig::default(),
             env_config: LazyCell::new(),
+            sandbox_config: LazyCell::new(),
             nightly_features_allowed: matches!(&*features::channel(), "nightly" | "dev"),
             ws_roots: RefCell::new(HashMap::new()),
             global_cache_tracker: LazyCell::new(),
@@ -1891,6 +1893,15 @@ impl GlobalContext {
             .try_borrow_with(|| self.get::<RustdocExternMap>("doc.extern-map"))
     }
 
+    /// Returns the config table of `[sandbox]` (unstable).
+    ///
+    /// TODO: currently access `sandbox.runner` from config for convenience.
+    /// Need to find a better configuration design.
+    pub fn sandbox_config(&self) -> CargoResult<&CargoSandboxConfig> {
+        self.sandbox_config
+            .try_borrow_with(|| self.get::<CargoSandboxConfig>("sandbox"))
+    }
+
     /// Returns true if the `[target]` table should be applied to host targets.
     pub fn target_applies_to_host(&self) -> CargoResult<bool> {
         target::get_target_applies_to_host(self)
@@ -2724,6 +2735,15 @@ pub enum ProgressWhen {
     Always,
 }
 
+#[derive(Debug, Default, Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub struct CargoSandboxConfig {
+    /// Target platform sandboxed build scripts built for.
+    pub target: Option<String>,
+    /// Runner that executes artifacts of build scripts.
+    pub runner: Option<PathAndArgs>,
+}
+
 fn progress_or_string<'de, D>(deserializer: D) -> Result<Option<ProgressConfig>, D::Error>
 where
     D: serde::de::Deserializer<'de>,

From 4ca4cd026169dd6a32fc30cbee887d26ba1647de Mon Sep 17 00:00:00 2001
From: Weihang Lo <me@weihanglo.tw>
Date: Sat, 19 Oct 2024 14:52:40 -0400
Subject: [PATCH 3/3] feat(sandbox): custom build script runner and target
 platform

Add support for `[sandbox]` to specify a target platform
and a custom build script runner.

To help the external runner finds and executes the executable produced
by a build script, it is assumed that only one executable was produced.
---
 .../compiler/build_context/target_info.rs     | 10 ++++++++
 src/cargo/core/compiler/compilation.rs        | 24 +++++++++++++------
 src/cargo/core/compiler/custom_build.rs       | 17 ++++++++++---
 src/cargo/core/compiler/unit_dependencies.rs  | 12 ++++++++--
 4 files changed, 51 insertions(+), 12 deletions(-)

diff --git a/src/cargo/core/compiler/build_context/target_info.rs b/src/cargo/core/compiler/build_context/target_info.rs
index f36fc173bcc..5d34b8aacba 100644
--- a/src/cargo/core/compiler/build_context/target_info.rs
+++ b/src/cargo/core/compiler/build_context/target_info.rs
@@ -953,6 +953,16 @@ impl<'gctx> RustcTargetData<'gctx> {
             res.merge_compile_kind(kind)?;
         }
 
+        // TODO: Although `-Zsandbox need this target platform to exist,
+        // if there is no build script involved in the entire dependency tree,
+        // there is no need for doing this target pre-fetch.
+        if ws.gctx().cli_unstable().sandbox {
+            if let Some(target) = gctx.sandbox_config()?.target.as_ref() {
+                let kind = CompileKind::Target(CompileTarget::new(target)?);
+                res.merge_compile_kind(kind)?;
+            }
+        }
+
         Ok(res)
     }
 
diff --git a/src/cargo/core/compiler/compilation.rs b/src/cargo/core/compiler/compilation.rs
index 5ecf77d4c6a..8f28355aa02 100644
--- a/src/cargo/core/compiler/compilation.rs
+++ b/src/cargo/core/compiler/compilation.rs
@@ -227,13 +227,23 @@ impl<'gctx> Compilation<'gctx> {
         cmd: T,
         pkg: &Package,
     ) -> CargoResult<ProcessBuilder> {
-        self.fill_env(
-            ProcessBuilder::new(cmd),
-            pkg,
-            None,
-            CompileKind::Host,
-            ToolKind::HostProcess,
-        )
+        let builder = if self.gctx.cli_unstable().sandbox {
+            let sandbox = self.gctx.sandbox_config()?;
+            match &sandbox.runner {
+                Some(runner) => {
+                    let program = runner.path.resolve_program(self.gctx);
+                    let mut builder = ProcessBuilder::new(program);
+                    builder.args(&runner.args);
+                    builder.arg(cmd);
+                    builder
+                }
+                None => ProcessBuilder::new(cmd),
+            }
+        } else {
+            ProcessBuilder::new(cmd)
+        };
+
+        self.fill_env(builder, pkg, None, CompileKind::Host, ToolKind::HostProcess)
     }
 
     pub fn target_runner(&self, kind: CompileKind) -> Option<&(PathBuf, Vec<String>)> {
diff --git a/src/cargo/core/compiler/custom_build.rs b/src/cargo/core/compiler/custom_build.rs
index f36e741c65b..d8e9f38d91b 100644
--- a/src/cargo/core/compiler/custom_build.rs
+++ b/src/cargo/core/compiler/custom_build.rs
@@ -32,10 +32,10 @@
 //! [instructions]: https://doc.rust-lang.org/cargo/reference/build-scripts.html#outputs-of-the-build-script
 
 use super::{fingerprint, BuildRunner, Job, Unit, Work};
-use crate::core::compiler::artifact;
 use crate::core::compiler::build_runner::Metadata;
 use crate::core::compiler::fingerprint::DirtyReason;
 use crate::core::compiler::job_queue::JobState;
+use crate::core::compiler::{artifact, FileFlavor};
 use crate::core::{profiles::ProfileRoot, PackageId, Target};
 use crate::util::errors::CargoResult;
 use crate::util::internal;
@@ -265,7 +265,19 @@ fn build_work(build_runner: &mut BuildRunner<'_, '_>, unit: &Unit) -> CargoResul
     }
 
     // Building the command to execute
-    let to_exec = script_dir.join(unit.target.name());
+    let to_exec = if build_runner.bcx.gctx.cli_unstable().sandbox {
+        // XXX: is the `expect` statement here really the truth?
+        let outputs = build_runner.outputs(build_script_unit)?;
+        let mut outputs = outputs
+            .iter()
+            .filter(|output| output.flavor == FileFlavor::Normal);
+        let (Some(output), None) = (outputs.next(), outputs.next()) else {
+            panic!("a build script to produce the one and only executable");
+        };
+        output.bin_dst().as_os_str().to_os_string()
+    } else {
+        script_dir.join(unit.target.name()).into_os_string()
+    };
 
     // Start preparing the process to execute, starting out with some
     // environment variables. Note that the profile-related environment
@@ -274,7 +286,6 @@ fn build_work(build_runner: &mut BuildRunner<'_, '_>, unit: &Unit) -> CargoResul
     // NOTE: if you add any profile flags, be sure to update
     // `Profiles::get_profile_run_custom_build` so that those flags get
     // carried over.
-    let to_exec = to_exec.into_os_string();
     let mut cmd = build_runner.compilation.host_process(to_exec, &unit.pkg)?;
     let debug = unit.profile.debuginfo.is_turned_on();
     cmd.env("OUT_DIR", &script_out_dir)
diff --git a/src/cargo/core/compiler/unit_dependencies.rs b/src/cargo/core/compiler/unit_dependencies.rs
index 59e356fc682..54d0aa017ac 100644
--- a/src/cargo/core/compiler/unit_dependencies.rs
+++ b/src/cargo/core/compiler/unit_dependencies.rs
@@ -481,8 +481,16 @@ fn compute_deps_custom_build(
         &unit.pkg,
         &unit.target,
         script_unit_for,
-        // Build scripts always compiled for the host.
-        CompileKind::Host,
+        // Build scripts always compiled for the host,
+        // unless `sandbox.target` is set.
+        if state.gctx.cli_unstable().sandbox {
+            match state.gctx.sandbox_config()?.target.as_ref() {
+                Some(target) => CompileKind::Target(super::CompileTarget::new(target)?),
+                None => CompileKind::Host,
+            }
+        } else {
+            CompileKind::Host
+        },
         CompileMode::Build,
         IS_NO_ARTIFACT_DEP,
     )?;