fix: restrict exported symbols in final .so to prevent Go runtime interposition

When two gopy extensions are loaded in the same Python process via
RTLD_GLOBAL, Go runtime data globals (mcache0, allm, mheap_, etc.) from
the first-loaded library win in the dynamic-linker global namespace.
The second runtime's references to those globals are silently redirected,
so both runtimes share the same heap metadata. This corrupts sweep-
generation counters and causes:

  fatal error: bad sweepgen in refill

on macOS x86_64 / Go ≥1.24 (the earlier pthread mutex fix serialised
user code but could not stop background GC goroutines that also hit the
shared globals).

Fix: pass a symbol-visibility restriction to the final go build step so
that only PyInit__<name> is exported into the global namespace:
  - macOS: -extldflags=-Wl,-exported_symbols_list,<file>
  - Linux: -extldflags=-Wl,--version-script,<file>

All CGo bridge symbols (crosscall2, _cgo_topofstack, …) remain in the
.so and are called directly at link time; they no longer pollute the
global namespace and cannot be interposed by a second extension.

Fixes #370 / #385.

Author: b-long

cmd_build.go

@@ -185,12 +185,15 @@ func runBuild(mode bind.BuildMode, cfg *BuildCfg) error {
 		if cfg.BuildTags != "" {
 			args = append(args, "-tags", cfg.BuildTags)
 		}
+		// Collect all Go linker flags into one -ldflags argument so we can
+		// combine -s/-w with the symbol-visibility extldflags below.
+		var goLdFlags []string
 		if !cfg.Symbols {
 			// These flags will omit the various symbol tables, thereby
 			// reducing the final size of the binary. From https://golang.org/cmd/link/
 			// -s Omit the symbol table and debug information
 			// -w Omit the DWARF symbol table
-			args = append(args, "-ldflags=-s -w")
+			goLdFlags = append(goLdFlags, "-s", "-w")
 		}
 		args = append(args, "-o", buildLib, ".")
 		fmt.Printf("go %v\n", strings.Join(args, " "))
@@ -214,6 +217,42 @@ func runBuild(mode bind.BuildMode, cfg *BuildCfg) error {
 			return err
 		}
 
+		// Restrict exported symbols to only PyInit__<name> so that Go runtime
+		// globals (e.g. runtime.mheap_, mcache0) are not placed in the global
+		// dynamic-linker namespace.  Two independently-loaded Go runtimes
+		// sharing those globals via RTLD_GLOBAL interposition corrupt each
+		// other's GC sweep-generation counters (issue #370 / #385).
+		switch runtime.GOOS {
+		case "darwin":
+			// macOS exported_symbols_list: one symbol per line, with leading _.
+			ef, ferr := os.CreateTemp("", "gopy-exports-*.txt")
+			if ferr == nil {
+				fmt.Fprintf(ef, "_%sPyInit__%s\n", "", cfg.Name)
+				ef.Close()
+				defer os.Remove(ef.Name())
+				goLdFlags = append(goLdFlags,
+					"-extldflags=-Wl,-exported_symbols_list,"+ef.Name())
+			}
+		case "linux":
+			// GNU ld version script: export only PyInit__<name>.
+			ef, ferr := os.CreateTemp("", "gopy-exports-*.map")
+			if ferr == nil {
+				fmt.Fprintf(ef, "{ global: PyInit__%s; local: *; };\n", cfg.Name)
+				ef.Close()
+				defer os.Remove(ef.Name())
+				goLdFlags = append(goLdFlags,
+					"-extldflags=-Wl,--version-script="+ef.Name())
+			}
+		}
+		if len(goLdFlags) > 0 {
+			// Replace or append the single combined -ldflags argument.
+			// The args slice currently ends with "-o", modlib, "."
+			// Insert before the final ".".
+			combined := "-ldflags=" + strings.Join(goLdFlags, " ")
+			n := len(args)
+			args = append(args[:n-1], combined, args[n-1])
+		}
+
 		if bind.WindowsOS {
 			fmt.Printf("Doing windows sed hack to fix declspec for PyInit\n")
 			fname := cfg.Name + ".c"