"RPath not in prefix or allow listed" leaves `libclang_rt.asan_osx_dynamic.dylib` unavailable

[lucascolley]

full build log: https://gist.githubusercontent.com/lucascolley/6b97ffa8f942011f6f47eafeecb7fb60/raw/d52aa086bced6f0dfbda61b4b4862ac45994c4c7/log.txt
package definition: https://github.com/lucascolley/asan-stack/tree/main/cpython

error when trying to use the built Python:

 │ │ error: Failed to inspect Python interpreter from provided path at `$PREFIX/bin/python`
 │ │   Caused by: Querying Python at `$PREFIX/bin/python` failed with exit status signal: 6 (SIGABRT)
 │ │ [stderr]
 │ │ dyld[69580]: Library not loaded: @rpath/libclang_rt.asan_osx_dynamic.dylib
 │ │   Referenced from: <758C8CE0-72F0-36D8-9ADD-4948C93834BF> $PREFIX/bin/python3.14
 │ │   Reason: tried: '$PREFIX/bin/../lib/libclang_rt.asan_osx_dynamic.dylib' (no such file), '$PREFIX/bin/../lib/libclang_rt.asan_osx_dynamic.dylib' (no such f
 │ │ ile)

suspicious section of log example:

 │ │ Rpath not in prefix or allow-listed: @executable_path - removing it
 │ │ Rpath not in prefix or allow-listed: /Users/lucascolley/ghq/github.com/lucascolley/asan-stack/cpython/.pixi/build/work/python-007Gmp9gnHQ/bld/lib/clang/21/
 │ │ lib/darwin - removing it
 │ │ install_name_tool for "/var/folders/_j/kscn3hgd6x995v65h1b3gnrm0000gn/T/pythonv6fep3/lib/python3.14/lib-dynload/_tkinter.cpython-314-darwin.so":
 │ │  - changing absolute rpath from "/Users/lucascolley/ghq/github.com/lucascolley/asan-stack/cpython/.pixi/build/work/python-007Gmp9gnHQ/host_placehold_placeh
 │ │ old_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold/lib" to "@loader_path
 │ │ /../.."
 │ │  - delete rpath "@executable_path"
 │ │  - delete rpath "/Users/lucascolley/ghq/github.com/lucascolley/asan-stack/cpython/.pixi/build/work/python-007Gmp9gnHQ/bld/lib/clang/21/lib/darwin"

actual location of the dylib:

❯ ls -a **/* | where name =~ "asan_osx_dynamic" | select name
╭───┬──────────────────────────────────────────────────────────────────────────────────────────────────╮
│ # │                                               name                                               │
├───┼──────────────────────────────────────────────────────────────────────────────────────────────────┤
│ 0 │ .pixi/build/work/numpy-K8YFxN4GfUg-wpTTOAWABi0/bld/lib/clang/21/lib/darwin/libclang_rt.asan_osx_ │
│   │ dynamic.dylib                                                                                    │
│ 1 │ .pixi/build/work/python-7mcdhoySzcw-VBmluO3aaIM/bld/lib/clang/21/lib/darwin/libclang_rt.asan_osx │
│   │ _dynamic.dylib                                                                                   │
╰───┴──────────────────────────────────────────────────────────────────────────────────────────────────╯

rpath debugging:

❯ otool -L .pixi/build/work/numpy-K8YFxN4GfUg-wpTTOAWABi0/host_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_/bin/python3.14
.pixi/build/work/numpy-K8YFxN4GfUg-wpTTOAWABi0/host_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_/bin/python3.14:
    @rpath/libpython3.14.dylib (compatibility version 3.14.0, current version 3.14.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1356.0.0)
    @rpath/libclang_rt.asan_osx_dynamic.dylib (compatibility version 0.0.0, current version 0.0.0)

❯ otool -l .pixi/build/work/numpy-K8YFxN4GfUg-wpTTOAWABi0/host_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_placehold_/bin/python3.14 | rg -A2 LC_RPATH
          cmd LC_RPATH
      cmdsize 32
         path @loader_path/../lib (offset 12)

[crusaderky]

I've hit this too.

If I create a pixi environment with clang=21 and then manually invoke the command clang -fsanitize=address, everything works fine both on Linux and on MacOSX.

If I instead create a rattler-build recipe with `CFLAGS = "-fsanitize=address" that in turn invokes clang in the build script, it creates a dynamic dependency:

on Linux

rattler-build on linux creates a dynamic dependency to libasan.so.

Note that compiler-rt does not ship this file; instead it ships $CONDA_PREFIX/lib/clang/21/lib/linux/libclang_rt.asan-x86_64.so, which besides having the wrong name it is out of LD_LIBRARY_PATH. I did not try forcing to link against it.

on MacOS

rattler-build on mac creates a dynamic dependency to @rpath/libclang_rt.asan_osx_dynamic.dylib.
compiler-rt ships $CONDA_PREFIX/lib/clang/21/lib/darwin/libclang_rt.asan_osx_dynamic.dylib, which can't be found at runtime.

Work-around

To recipe.yaml, add

requirements:
  build:
    - clang=21
  run:
    - if: linux
      then:
        - libsanitizer
    - if: osx
      then:
        - compiler-rt=21  # Must match clang version

to the consumer's pixi.toml, add

[target.osx.activation.env]
# clang version must match recipe.yaml
DYLD_LIBRARY_PATH = "$CONDA_PREFIX/lib/clang/21/lib/darwin"

note that libsanitizer is part of the gcc stack, but seems to work correctly vs. clang binaries.
Also, Ubuntu 24.04 ships libasan.so and libtsan.so system-wide, so on it libsanitizer is not strictly necessary.

[crusaderky]

A simple project with this problem is https://github.com/crusaderky/hdf5-pixi/

[ngoldbaum]

FWIW here it is on a CI run: https://github.com/numpy/numpy/actions/runs/20490795114/job/58882493959?pr=30510