Sandboxing of OPAM 2 prevents the build from downloading font files

[camlspotter]

OPAM2 now has sandboxing: the build cannot access the external resources. SATySFi build fails at the downloading of font files.

See https://github.com/ocaml/opam/issues/3460 for a discussion of the sandboxing.

In the following build attempt, curl fails due to the name resolution failure of www.gust.org.pl.

$ opam --version
2.0.0
$ opam switch show
/Users/jun/.share/4.06.1-satysfi
$ opam pin add .
[NOTE] Package satysfi is currently pinned to
       git+file:///Users/jun/.share/4.06.1-satysfi/SATySFi#master (version
       0.0.2).
[satysfi.0.0.2: git]
[satysfi.0.0.2: git]
[satysfi.0.0.2: git]
[satysfi.0.0.2: git]
[satysfi.0.0.2: git]
[satysfi.0.0.2: git]
[satysfi.0.0.2] synchronised from git+file:///Users/jun/.share/4.06.1-satysfi/a/SATySFi#master
satysfi is now pinned to git+file:///Users/jun/.share/4.06.1-satysfi/a/SATySFi#master (version 0.0.2)
The following actions will be performed:
  ∗ install satysfi 0.0.2*
Do you want to continue? [Y/n] 
y

<><> Processing actions <><><><><><><><><><><><><><><><><><><><><><><><><><>  🐫 
[ERROR] The compilation of satysfi failed at
        "/Users/jun/.opam/opam-init/hooks/sandbox.sh build make -f Makefile lib
        PREFIX=/Users/jun/.share/4.06.1-satysfi/_opam".

#=== ERROR while compiling satysfi.0.0.2 ======================================#
# context              2.0.0 | macos/x86_64 | ocaml-base-compiler.4.06.1 | pinned(git+file:///Users/jun/.share/4.06.1-satysfi/a/SATySFi#master#285ff60f)
# path                 ~/.share/4.06.1-satysfi/_opam/.opam-switch/build/satysfi.0.0.2
# command              ~/.opam/opam-init/hooks/sandbox.sh build make -f Makefile lib PREFIX=/Users/jun/.share/4.06.1-satysfi/_opam
# exit-code            2
# env-file             ~/.opam/log/satysfi-87558-335865.env
# output-file          ~/.opam/log/satysfi-87558-335865.out
### output ###
# if [ -x "$(command -v curl)" ]; then \
# [...]
#   else \
#     wget -N http://www.gust.org.pl/projects/e-foundry/latin-modern/download/lm2.004otf.zip -P temp/; \
#     wget -N http://www.gust.org.pl/projects/e-foundry/lm-math/download/latinmodern-math-1959.zip -P temp/; \
#         fi
#   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
#                                  Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0curl: (6) Could not resolve host: www.gust.org.pl
#   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
#                                  Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:--  0:00:02 --:--:--     0curl: (6) Could not resolve host: www.gust.org.pl
# make: *** [lib] Error 6

<><> Error report <><><><><><><><><><><><><><><><><><><><><><><><><><><><><>  🐫 
┌─ The following actions failed
│ λ build satysfi 0.0.2
└─ 
╶─ No changes have been performed

[omasanori]

IMHO downloading fonts during build is not critical for SATySFi and it could be replaced with an utility, say, satysfi setup-fonts to download fonts and place them in $HOME/.satysfi.

A possible side effect of this approach is that we no longer need to think about https://github.com/gfngfn/SATySFi/issues/38 ;-)

Otherwise, we can import the fonts into the repository since they are all redistributable freely.

[rjbou]

Using opam 2.0.0 format, you can use the field [extra-source] in order to let opam download the file before the sandboxed build (and check the checksum!).

[omasanori]

I made a PR based on @rjbou's comment. Thanks a lot!