Avoid linking against private Apple libraries with ACLiC

.github/workflows/root-ci.yml

@@ -113,6 +113,7 @@
     env:
       VIRTUAL_ENV_DIR: ${{ github.workspace }}/ROOT_CI_VENV
       MACOSX_DEPLOYMENT_TARGET: ${{ matrix.platform == 'mac-beta' && '27' || '' }} # Problems with gfortran falling back 18 (unsupported)
+      HOME: /Users/sftnight
 
     strategy:
       fail-fast: false
@@ -154,11 +155,10 @@
       - name: Pull Request Build
         if: github.event_name == 'pull_request'
         env:
-          HOME: /Users/sftnight
           INCREMENTAL: ${{ !contains(github.event.pull_request.labels.*.name, 'clean build') && !matrix.platform == 'mac15' && !matrix.platform == 'mac26'}}
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
           OVERRIDES: ${{ join( matrix.overrides, ' ') }}
         run: |
           [ -d "${VIRTUAL_ENV_DIR}" ] && source ${VIRTUAL_ENV_DIR}/bin/activate
           echo "Python is now $(which python3) $(python3 --version)"
           src/.github/workflows/root-ci-config/build_root.py  \
@@ -231,6 +231,30 @@
           path: /Users/sftnight/ROOT-CI/packages/root_v*
           if-no-files-found: error
 
+      - name: Install
+        env:
+          BUILD_DIR: ${{ env.HOME }}/ROOT-CI/build
+          INSTALL_DIR: ${{ env.HOME }}/ROOT-CI/install
+        if: ${{ !cancelled() && !matrix.is_special }}
+        run: "cmake --install ${{ env.BUILD_DIR }} --prefix ${{ env.INSTALL_DIR }}"
+
+      - name: Build post-install test project
+        if: ${{ !cancelled() && !matrix.is_special }}
+        env:
+          SOURCE_DIR: ${{ env.HOME }}/ROOT-CI/src/test/PostInstall/
+          INSTALL_DIR: ${{ env.HOME }}/ROOT-CI/install
+          POST_INSTALL_DIR: ${{ env.HOME }}/ROOT-CI/PostInstall
+        run: |
+          cmake -S ${{ env.SOURCE_DIR }} -B ${{ env.POST_INSTALL_DIR }} -DCMAKE_PREFIX_PATH=${{ env.INSTALL_DIR }};
+          cmake --build ${{ env.POST_INSTALL_DIR }};
+
+      - name: CTest in post-install test project
+        if: ${{ !cancelled() && !matrix.is_special }}
+        env:
+          POST_INSTALL_DIR: ${{ env.HOME }}/ROOT-CI/PostInstall
+        working-directory: ${{ env.POST_INSTALL_DIR }}
+        run: ctest --output-on-failure -j $(sysctl -n hw.logicalcpu)
+
 
   build-windows:
     # For any event that is not a PR, the CI will always run. In PRs, the CI
@@ -288,7 +312,7 @@
           INCREMENTAL: ${{ !contains(github.event.pull_request.labels.*.name, 'clean build') }}
           GITHUB_PR_ORIGIN: ${{ github.event.pull_request.head.repo.clone_url }}
         shell: cmd
         run: "C:\\setenv.bat ${{ matrix.target_arch }} &&
               python .github/workflows/root-ci-config/build_root.py
                     --buildtype       ${{ matrix.config }}
                     --platform        windows10
@@ -455,7 +479,7 @@
       - self-hosted
       - linux
       - ${{ matrix.architecture == null && 'x64' || matrix.architecture }}
       - ${{ matrix.extra-runs-on == null && 'cpu' || matrix.extra-runs-on }}
 
     name: |
       ${{ matrix.image }} ${{ matrix.property }}

core/base/src/TSystem.cxx

@@ -2276,6 +2276,11 @@ const char *TSystem::GetLibraries(const char *regexp, const char *options,
 
    static TRegexp separator("[^ \\t\\s]+");
    static TRegexp dynload("/lib-dynload/");
+   // Skip libffi, it is a private library used by the system. This is visible in the stub .tbd file:
+   // allowable-clients:
+   //     clients:         [ '!' ]
+   // See https://github.com/Homebrew/homebrew-core/issues/272324#issuecomment-5119880493 for more info
+   static TRegexp libffiMatch("/usr/lib/libffi");
 
    Ssiz_t start, index, end;
    start = index = end = 0;
@@ -2284,7 +2289,7 @@ const char *TSystem::GetLibraries(const char *regexp, const char *options,
       index = libs2.Index(separator, &end, start);
       if (index >= 0) {
          TString s = libs2(index, end);
-         if (s.Index(dynload) == kNPOS) {
+         if (s.Index(dynload) == kNPOS && s.Index(libffiMatch) == kNPOS) {
             if (!maclibs.IsNull()) maclibs.Append(" ");
             maclibs.Append(s);
          }

test/PostInstall/CMakeLists.txt

@@ -42,5 +42,24 @@ if(BUILD_TESTING)
     set_tests_properties(python-package-metadata
       PROPERTIES ENVIRONMENT PYTHONPATH=${ROOT_LIBRARY_DIR}
     )
+
+    # Test ACLiC can be run from Python after installation
+    configure_file(post_install_test_ACLiC.C ${CMAKE_CURRENT_BINARY_DIR} COPYONLY)
+    configure_file(post_install_test_ACLiC.py ${CMAKE_CURRENT_BINARY_DIR} COPYONLY)
+    add_test(NAME python-post-install-ACLiC
+      COMMAND ${Python3_EXECUTABLE} post_install_test_ACLiC.py
+    )
+    set_tests_properties(python-post-install-ACLiC
+      PROPERTIES
+      ENVIRONMENT PYTHONPATH=${ROOT_LIBRARY_DIR}
+      FIXTURES_REQUIRED python-post-install-ACLiC-fixture
+    )
+    add_test(NAME python-post-install-ACLiC-cleanupfiles
+      COMMAND ${CMAKE_COMMAND} -P ${CMAKE_SOURCE_DIR}/post_install_test_ACLiC_cleanup.cmake
+    )
+    set_tests_properties(python-post-install-ACLiC-cleanupfiles
+      PROPERTIES FIXTURES_CLEANUP python-post-install-ACLiC-fixture
+    )
+
   endif()
 endif()

test/PostInstall/post_install_test_ACLiC.C

@@ -0,0 +1,4 @@
+int post_install_test_ACLiC()
+{
+   return 42;
+}

test/PostInstall/post_install_test_ACLiC.py

@@ -0,0 +1,21 @@
+import ctypes
+
+import cppyy.ll
+import ROOT
+
+
+def main():
+    err = ctypes.c_int(-1)  # A value purposely different than any of the EErrorCode values
+    err_ptr = cppyy.ll.reinterpret_cast["TInterpreter::EErrorCode*"](ctypes.addressof(err))
+    ROOT.gInterpreter.ProcessLine(".L post_install_test_ACLiC.C+", err_ptr)
+    if err.value != ROOT.TInterpreter.kNoError:
+        raise RuntimeError(f"Failed to compile post_install_test_ACLiC.C, error code: {err.value}")
+
+    val = ROOT.gInterpreter.MakeInterpreterValue()
+    ROOT.gInterpreter.Evaluate("post_install_test_ACLiC()", val)
+
+    return 0 if val.GetAsUnsignedLong() == 42 else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

test/PostInstall/post_install_test_ACLiC_cleanup.cmake

@@ -0,0 +1,2 @@
+file(GLOB post_install_test_ACLiC_artifacts "post_install_test_ACLiC_*")
+file(REMOVE ${post_install_test_ACLiC_artifacts})