[new check] wheel contains compiled objects/libraries with debug symbols

[jameslamb]

What should be checked?

Given a built distribution contain compiled code in the following languages:

• [x] C
• [x] C++
• [ ] Fortran
• [ ] Rust

pydistcheck should attempt to detect debug symbols in that compiled code and report on it.

See the links in the Notes section for some more information on how this could work. Significant additional research is definitely needed to accomplish this in a way that's portable, fast, and correct.

What should the name of this check be?

using-debug-symbols

Will this check introduce any additional configuration?

no

Details on additional configuration required.

No response

Distribution type

• [ ] source (e.g. .tar.gz)
• [X] built(e.g. .whl)

Notes

Some references:

• https://github.com/numpy/numpy/pull/16110
• https://github.com/psycopg/psycopg/issues/142
• https://github.com/pypa/cibuildwheel/issues/331
• https://github.com/scikit-image/scikit-image/pull/6109
• https://github.com/messense/auditwheel-symbols
• https://medium.com/@holdengrissett/linux-101-understanding-the-insides-of-your-program-2be2480ba366
• https://stackoverflow.com/questions/7219845/difference-between-nm-and-objdump
• https://github.com/vadimcn/vscode-lldb/wiki/How-can-I-tell-if-a-binary-was-compiled-with-debug-symbols%3F
• https://bloomberg.github.io/memray/native_mode.html#adding-debugging-information-to-your-native-extension
• https://dwarfstd.org/
• https://docs.rs/mach_object/latest/mach_object/
• https://www.internalpointers.com/post/journey-across-static-dynamic-libraries
• http://blog.darlinghq.org/2018/07/mach-o-linking-and-loading-tricks.html
• https://lowlevelbits.org/parsing-mach-o-files/