Tcl Source Code

#     THE STATUS QUO:
#
#     The Safe Base makes the slave's ::auto_path identical to its access path.
#     This arrangement pre-dates both modules and the "safe" glob command.
#     In a safe interpreter glob would raise an error (which was then caught)
#     when tclPkgUnknown used it to access subdirectories of the ::auto_path; in
#     a safe interpreter the auto_path was made identical to the access path so
#     that all packages could be accessed.
#
#     Now that "safe" glob is available, it has a kludge to prevent
#     tclPkgUnknown from looking for packages in the grandchildren of the
#     "intended" ::auto_path directories.
#
#     With the introduction of Tcl modules, the access path now also includes
#     the module path and its subdirectories (to unlimited depth): these are in
#     the safe interpreter's ::auto_path but do not belong there.
#
#     FEATURE REQUEST:
#
#     The ::auto_path should be managed separately from the access_path, and
#     should not include the module path.  At a future revision of Tcl (8.6?),
#     the tclPkgUnknown kludge should be removed from AliasGlob, and the safe
#     interpreter ::auto_path should be defined in the same way as unsafe
#     interpreters (so that its subdirectories are searched for packages).
#     Changes to the Safe Base public API will be needed, either in the commands
#     and their options, or in their effects: for example the Safe Base might
#     refrain from setting a slave's ::auto_path, and require the master
#     interpreter to do so explicitly.

The essence of these changes has been submitted as TIP-579.  There is no need to consider the change through another channel, so I will close this RFE.

File Added - 445116: patch-to--core-8-5-branch--a4511ae802abe16609824d823fb247077e75f633.patch

File Added - 445115: patch-to--trunk--4427cf5dccdac14a179717fe83f023116f09923c.patch

The attached files are patches that provide this feature as an option, and also fix four bugs that were reported as additions to bug report 2964715.

The patches (one for the trunk, one for the core-8-5-branch), provide the following:

1. Bugfix - AliasGlob does "-join" itself, and so it does not need to pass "-join" to the glob command again
2. Bugfix - spurious directories in module path (test failure safe-14.1)
3. Bugfix (plus improved test 7.3) - clean up correctly after deleting a slave that has Safe Base sub-interpreters
4. Bugfix (plus new tests 19.1, 19.2) - init.tcl inappropriately adds un-tokenized directories to a slave's auto_path
5. Extra tests 17.1, 17.2: Check that first element of slave auto_path (and access path) is Tcl Library
6. New test 7.4 of pkgIndex.tcl package loading, to complement 7.1, 7.2
7. New test 7.5 of module loading, including test of ancestor directory rule
8. Optional AutoPathSync facility ("on" by default, to replicate the existing behavior) to operate with or without the previous feature of synching auto_path with the access path, and thereby dumping the entire access path into ::auto_path.  Tests 7.1, 7.2 are modified so they work with or without this patch; new tests 18.1, 18.2, 18.3, 18.4, 18.5 are supplied for the no-dumping ("off") case.

I work a great deal with the Safe Base, and I find the AutoPathSync "off" facility to be extremely helpful when debugging package loading problems.  I hope that this feature can be included with the official Tcl release.

If a further change would not be considered to change Tcl too much from its existing behavior, the AutoPathSync default can be changed from "on" to "off" by replacing (near the end of safe.tcl):
    variable AutoPathSync 1
with
    variable AutoPathSync 0

I'm still using 8.5.8 with the patches to safe.tcl that I have submitted here.  I'll attempt an upgrade shortly.

To what extent is this related to the current version of the Safe Base code?

Sorry for the fixed-width post - here's the same text but hopefully more readable this time.

THE STATUS QUO:

The Safe Base makes the slave's ::auto_path identical to its access path.  This arrangement pre-dates both modules and the "safe" glob command.  In a safe interpreter glob would raise an error (which was then caught) when tclPkgUnknown used it to access subdirectories of the ::auto_path; in a safe interpreter the auto_path was made identical to the access path so that all packages could be accessed.

Now that "safe" glob is available, it has a kludge to prevent tclPkgUnknown from looking for packages in the grandchildren of the "intended" ::auto_path directories.

With the introduction of Tcl modules, the access path now also includes the module path and its subdirectories (to unlimited depth): these are in the safe interpreter's ::auto_path but do not belong there.

FEATURE REQUEST:

The ::auto_path should be managed separately from the access_path, and should not include the module path.  At a future revision of Tcl (8.6?), the tclPkgUnknown kludge should be removed from AliasGlob, and the safe interpreter ::auto_path should be defined in the same way as unsafe interpreters (so that its subdirectories are searched for packages).

Changes to the Safe Base public API will be needed, either in the commands and their options, or in their effects: for example the Safe Base might refrain from setting a slave's ::auto_path, and require the master interpreter to do so explicitly.