Submitted by:            Xi Ruoyao <xry111@xry111.site>
Date:                    2025-11-16
Initial Package Version: 2.0.7
Upstream Status:         Not applicable: XORG_PREFIX is BLFS-specific.
                         The upstream dislike binding the entire /opt and
                         rejected MR 338.
Origin:                  Self
Description:             Read XORG_PREFIX at build time and add
                         $XORG_PREFIX/lib into the binded directories in
                         the bwrap command if $XORG_PREFIX != /usr.
                         Required for installing Xorg into /opt because
                         the sandboxed SVG loader needs librsvg -> cairo
                         -> xorg-libs.

Updated for glycin-2.2.0 on 2026-09-10 by Bruce Dubbs <bdubbs@linuxfromscratch.org>

From ea415d0267faa96582e0ef6de8fb558e080ec872 Mon Sep 17 00:00:00 2001
From: Xi Ruoyao <xry111@xry111.site>
Date: Fri, 14 Nov 2025 09:51:50 +0800
Subject: [PATCH] BLFS: sandbox: bind $XORG_PREFIX/lib

Note that env! is evaluated at compile time, so there won't be any
run-time overhead or security risk.

It would be easier to just bind /opt but per upstream discussion some
people put private data there.
---

diff -Naur glycin-2.2.0/.cargo/config.toml glycin-2.2.0-new/.cargo/config.toml
--- glycin-2.2.0/.cargo/config.toml	1969-12-31 18:00:00.000000000 -0600
+++ glycin-2.2.0-new/.cargo/config.toml	2026-09-10 18:33:34.805275629 -0500
@@ -0,0 +1,6 @@
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+
diff -Naur glycin-2.2.0/Cargo.toml glycin-2.2.0-new/Cargo.toml
--- glycin-2.2.0/Cargo.toml	2026-09-09 06:56:02.418801300 -0500
+++ glycin-2.2.0-new/Cargo.toml	2026-09-10 18:34:27.909813303 -0500
@@ -115,6 +115,9 @@
 zvariant = { version = "5.9.2", default-features = false }
 zerocopy = "0.8.12"
 
+[patch.crates-io]
+glycin-core = { path = "vendor/glycin-core" }
+
 [workspace.metadata.cross.target.x86_64-pc-windows-gnu]
 dockerfile = "build-aux/cross/Dockerfile.windows"
 
diff -Naur glycin-2.2.0/vendor/glycin-core/src/sandbox.rs glycin-2.2.0-new/vendor/glycin-core/src/sandbox.rs
--- glycin-2.2.0/vendor/glycin-core/src/sandbox.rs	2006-07-23 20:21:28.000000000 -0500
+++ glycin-2.2.0-new/vendor/glycin-core/src/sandbox.rs	2026-09-10 18:35:48.134116215 -0500
@@ -299,6 +299,13 @@
             "/tmp-run",
         ]);
 
+        let xorg_prefix = Path::new(env!("XORG_PREFIX"));
+        if xorg_prefix != "/usr" {
+            let libdir = xorg_prefix.join("lib");
+            command.arg("--ro-bind-try");
+            command.args([&libdir, &libdir]);
+        }
+
         // Inherit some environment variables
         for key in INHERITED_ENVIRONMENT_VARIABLES {
             if let Some(val) = std::env::var_os(key) {