ocran 1.4.6 → 1.5.1

data/lib/ocran/runtime_sdk.rb

@@ -0,0 +1,259 @@
+# frozen_string_literal: true
+require "pathname"
+require "fileutils"
+require "open3"
+require "rbconfig"
+require "tmpdir"
+require "json"
+require_relative "pe_imports"
+
+module Ocran
+  # The SDK part of a static runtime (<runtime>/sdk, written by
+  # runtime/make-sdk.rb): what is needed to link the runtime again with more
+  # C extensions statically linked in - its link inputs and link command
+  # (link.args), Ruby's headers, the runtime's rbconfig.rb with the
+  # <arch>-fake.rb Ruby's cross builds use to describe the target, and the
+  # gem extensions already linked in (exts/*.line).
+  #
+  # Linking needs a compiler for the runtime's target on the build host. For
+  # a MinGW runtime (toolchain "gcc" in sdk.json): the one link.args names
+  # (e.g. x86_64-w64-mingw32ucrt-gcc on Linux), or OCRAN_RUNTIME_CC (e.g. gcc
+  # from RubyInstaller's MSYS2 on Windows). For an mswin runtime ("msvc"):
+  # cl and nmake of Visual Studio (Build Tools), from a developer prompt.
+  class RuntimeSdk
+    BUILD_STATIC_EXT = File.expand_path("static_runtime/build_static_ext.rb", __dir__)
+
+    # One statically built extension: the feature it provides ("bcrypt_ext"),
+    # its Init function, the static library and the libraries it links with.
+    Extension = Struct.new(:feature, :init, :archive, :libs) do
+      def self.parse(line, base)
+        feature, init, archive, libs = line.strip.split(" ", 4)
+        raise "bad extension line #{line.inspect}" unless feature&.match?(%r{\A[\w/.-]+\z}) && init&.match?(/\A\w+\z/)
+
+        new(feature, init, File.expand_path(archive.sub("@SDK@", base.to_s)), libs.to_s.split(","))
+      end
+    end
+
+    attr_reader :dir, :arch, :toolchain
+
+    def initialize(dir, arch:)
+      @dir = Pathname(dir)
+      @arch = arch
+      raise "#{@dir} is not a static runtime SDK (no link.args)" unless (@dir / "link.args").file?
+
+      @info = (@dir / "sdk.json").file? ? JSON.parse((@dir / "sdk.json").read) : {}
+      @toolchain = @info.fetch("toolchain", "gcc")
+    end
+
+    # Libraries available as DLLs instead of linked in (--runtime-dll):
+    # name ("sybdb") => { "dll" => ..., "import" => ... }, relative to the SDK.
+    def dlls = @info.fetch("dlls", {})
+
+    # extconf.rb options for gems whose C library the SDK provides, so that
+    # extconf.rb uses it instead of downloading and building its own.
+    GEM_EXTCONF_ARGS = {
+      "nokogiri" => ["--use-system-libraries"],
+      "tiny_tds" => ["--with-freetds-dir=@SDK_DEPS@"],
+    }.freeze
+
+    def extconf_args(gem_name)
+      (GEM_EXTCONF_ARGS[gem_name] || []).map { |a| a.gsub("@SDK_DEPS@", (@dir / "deps").to_s) }
+    end
+
+    def msvc? = @toolchain == "msvc"
+
+    # True when the application archive cannot be appended to the
+    # executable but is linked in as the section __OCRAN,__zip (macOS, where
+    # appended data would break the code signature).
+    def section_payload? = @info["payload"] == "section"
+
+    def link_args = (@dir / "link.args").read.lines(chomp: true).map { |a| a.gsub("@SDK@", @dir.to_s) }
+
+    # The SDK's header directories, ahead of whatever an extconf.rb adds:
+    # the SDK's libraries are the ones linked, so their headers must win
+    # over a system copy (nokogiri adds the libxml2 headers of Apple's SDK,
+    # an older libxml2, on macOS).
+    def sdk_include_flags
+      deps = @dir / "deps" / "include"
+      [deps, deps / "libxml2"].select(&:directory?).map { |dir| "-I#{dir}" }
+    end
+
+    # The C compiler driver of the target.
+    def cc
+      return "cl" if msvc?
+
+      env = ENV["OCRAN_RUNTIME_CC"]
+      env && !env.empty? ? env : link_args.first
+    end
+
+    # The gem extensions already linked into the runtime.
+    def base_extensions
+      Dir[(@dir / "exts/*.line").to_s].sort.map { |f| Extension.parse(File.read(f), @dir) }
+    end
+
+    # Fails early, with a hint, when the build host has no compiler for the
+    # runtime's target.
+    def check_toolchain!
+      return check_msvc! if msvc?
+
+      out, status = Open3.capture2e(cc, "-dumpmachine")
+      expected = @info["dumpmachine"]
+      return if status.success? && (expected.nil? || out.include?(expected))
+
+      raise "#{cc} #{status.success? ? "does not target #{expected} (#{out.strip})" : "did not run"}; " \
+            "set OCRAN_RUNTIME_CC to #{toolchain_hint}"
+    rescue SystemCallError
+      raise "#{cc} not found; set OCRAN_RUNTIME_CC to #{toolchain_hint}"
+    end
+
+    def toolchain_hint
+      target_os = @info.fetch("target_os", "mingw32")
+      if target_os.start_with?("darwin")
+        return "clang from Xcode or the Command Line Tools (xcode-select --install)"
+      end
+      if target_os.start_with?("mingw")
+        "a MinGW-w64 UCRT C compiler (on Linux: gcc-mingw-w64-ucrt64, on Windows: RubyInstaller's " \
+          "MSYS2, e.g. ucrt64/bin/gcc.exe)"
+      else
+        "a musl C compiler (musl-gcc from musl-tools)"
+      end
+    end
+
+    def check_msvc!
+      %w[cl nmake].each do |tool|
+        Open3.capture2e(tool, "-?")
+      rescue SystemCallError
+        raise "#{tool} not found: building C extensions for an mswin runtime needs Visual Studio " \
+              "(Build Tools); run ocran from a \"x64 Native Tools\" developer prompt"
+      end
+    end
+
+    # Compiles the C extension in +ext_dir+ (a gem's ext/<name>/, with its
+    # extconf.rb) to a static library under +work_dir+. +gem_path+: more
+    # gem directories for the gems extconf.rb itself uses.
+    def build_extension(ext_dir, work_dir, *extconf_args, gem_path: [])
+      pkgconfig = File.join(work_dir.to_s + ".pkgconfig")
+      FileUtils.mkdir_p(pkgconfig)
+      Dir[(@dir / "deps/lib/pkgconfig/*.pc").to_s].each do |pc|
+        File.write(File.join(pkgconfig, File.basename(pc)), File.read(pc).gsub("@SDK_DEPS@", (@dir / "deps").to_s))
+      end
+      # The SDK's rbconfig.rb is found first on the load path; a MinGW SDK
+      # also has Ruby's <arch>-fake.rb, which makes any Ruby pose as the
+      # runtime's (an mswin build host runs the runtime's own revision).
+      fake = Dir[(@dir / "*-fake.rb").to_s].first
+      env = { "RUBYOPT" => nil, "BUNDLE_GEMFILE" => nil, "BUNDLER_SETUP" => nil,
+              "OCRAN_RUNTIME_CC" => msvc? ? nil : ENV["OCRAN_RUNTIME_CC"] || (cc == link_args.first ? nil : cc),
+              "OCRAN_RUNTIME_LIBS" => @info.fetch("libs", []).join(" "),
+              "OCRAN_RUNTIME_CPPFLAGS" => (sdk_include_flags + @info.fetch("cppflags", [])).join(" "),
+              "PKG_CONFIG_LIBDIR" => pkgconfig, "PKG_CONFIG_PATH" => "",
+              # Build-time gems extconf.rb uses (nokogiri: mini_portile2):
+              # the build host's, which the target's RbConfig would hide.
+              "GEM_HOME" => Gem.dir, "GEM_PATH" => (gem_path + Gem.path).join(File::PATH_SEPARATOR) }
+      cmd = [RbConfig.ruby, "--disable=gems", "-I", @dir.to_s, *(fake ? ["-r", fake] : []), BUILD_STATIC_EXT,
+             (@dir / "include").to_s, (@dir / "include" / @arch).to_s, ext_dir.to_s, work_dir.to_s, *extconf_args]
+      out, status = Open3.capture2e(env, *cmd)
+      unless status.success?
+        raise "Building the C extension in #{ext_dir} for the static runtime failed:\n#{out.lines.last(25).join}"
+      end
+
+      Extension.parse(out.lines.last, @dir)
+    end
+
+    # Links the runtime with the given extensions registered in addition to
+    # those it already has, into +output+. Libraries named in +dlls+ are
+    # linked against their DLL instead of statically (see #dll_files).
+    # macOS: the application archive is linked in as a section (see
+    # #section_payload?); +archive+ is that file.
+    def link(extensions, output, dlls: [], archive: nil)
+      unknown = dlls - self.dlls.keys
+      unless unknown.empty?
+        raise "No DLL build of #{unknown.join(", ")} in #{@dir} (available: #{self.dlls.keys.join(", ")})"
+      end
+      as_dll = dlls.to_h { |name| ["-l#{name}", (@dir / self.dlls[name]["import"]).to_s] }
+      all = base_extensions + extensions
+      Dir.mktmpdir do |tmp|
+        src = File.join(tmp, "ocran_exts.c")
+        File.write(src, exts_source(all))
+        obj = File.join(tmp, msvc? ? "ocran_exts.obj" : "ocran_exts.o")
+        if msvc?
+          run("cl", "-nologo", "-MT", "-O2", "-c", src, "-Fo#{obj}")
+        else
+          run(cc, "-O2", "-c", src, "-o", obj)
+        end
+
+        extra = [obj] + all.flat_map { |ext| [ext.archive, *ext.libs] } + @info.fetch("libs", [])
+        args = link_args
+        args[0] = cc
+        cmd = args.flat_map { |a| a == "@EXTRA@" ? extra : [a.gsub("@OUTPUT@", output.to_s)] }
+        cmd = cmd.map { |a| as_dll.fetch(a, a) }
+        cmd += ["-o", output.to_s] unless args.any? { |a| a.include?("@OUTPUT@") }
+        cmd += ["-Wl,-sectcreate,__OCRAN,__zip,#{archive}"] if archive
+        # macOS: no debug map (the objects' paths, here in a temporary
+        # directory, would differ every time), and nothing for strip to do,
+        # which would break the signature the linker writes.
+        cmd += ["-Wl,-S"] if @info["target_os"].to_s.start_with?("darwin")
+        run(*cmd)
+      end
+      strip = strip_tool
+      run(strip, output.to_s) if strip
+      output
+    end
+
+    # The strip of the compiler in use: sdk.json names the SDK build host's
+    # (nil on macOS, where stripping would break the signature), which
+    # another compiler named with OCRAN_RUNTIME_CC may not come with (MSYS2
+    # has gcc and strip, not x86_64-w64-mingw32ucrt-strip).
+    def strip_tool
+      return nil if msvc? || (@info.key?("strip") && @info["strip"].nil?)
+
+      derived = cc.sub(/gcc(\.exe)?\z/) { "strip#{$1}" } if cc.match?(/gcc(\.exe)?\z/)
+      return derived if derived && cc != link_args.first
+
+      @info["strip"] || derived
+    end
+
+    # The DLL files to ship next to the executable for +dlls+: each named
+    # library's DLL and the SDK DLLs it imports in turn (libsybdb-5.dll
+    # needs libiconv-2.dll).
+    def dll_files(dlls)
+      by_file = self.dlls.values.to_h { |d| [File.basename(d["dll"]).downcase, @dir / d["dll"]] }
+      queue = dlls.map { |name| @dir / self.dlls.fetch(name)["dll"] }
+      found = {}
+      until queue.empty?
+        dll = queue.shift
+        next if found[dll.basename.to_s.downcase]
+
+        found[dll.basename.to_s.downcase] = dll
+        PEImports.dll_names(dll.to_s).each { |name| queue << by_file[name.downcase] if by_file[name.downcase] }
+      end
+      found.values
+    end
+
+    private
+
+    def exts_source(extensions)
+      <<~C
+        /* generated by ocran (Ocran::RuntimeSdk) */
+        void ruby_init_ext(const char *name, void (*init)(void));
+        #{extensions.map { |e| "extern void #{e.init}(void);" }.join("\n")}
+        void ocran_init_extra_exts(void)
+        {
+        #{extensions.map { |e| "    ruby_init_ext(\"#{e.feature}.so\", #{e.init});" }.join("\n")}
+        }
+      C
+    end
+
+    # Compilers, linkers and strip run with SOURCE_DATE_EPOCH set: binutils
+    # then writes that, not the current time, into a PE header it rewrites
+    # (strip does), so that the same application links to the same bytes.
+    # ZERO_AR_DATE does the same for Apple's ld, which otherwise writes the
+    # objects' modification times into the executable's debug map.
+    def run(*cmd)
+      env = { "SOURCE_DATE_EPOCH" => ENV["SOURCE_DATE_EPOCH"] || "1767225600", "ZERO_AR_DATE" => "1" }
+      out, status = Open3.capture2e(env, *cmd)
+      raise "#{cmd.first} failed:\n#{out.lines.last(25).join}" unless status.success?
+
+      out
+    end
+  end
+end

data/lib/ocran/spinel_builder.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+require "open3"
+require "pathname"
+require_relative "command_output" unless defined?(Ocran::CommandOutput)
+require_relative "aot_toolchain"
+require_relative "spinel_compatibility"
+
+module Ocran
+  # Builds --spinel output: the script compiled ahead of time by Spinel
+  # (https://github.com/matz/spinel) into a native executable, instead of
+  # being packaged together with a Ruby interpreter.
+  #
+  # Spinel compiles a subset of Ruby, so whether this works depends on the
+  # program. When it does, the result is one small binary that needs
+  # nothing but libc. When it does not - or when Spinel is not installed -
+  # the user gets a report of what in their code and in which gems stands
+  # in the way, from SpinelCompatibility.
+  class SpinelBuilder
+    include CommandOutput
+
+    # How much of the compiler's output is shown when it fails. The tail is
+    # what names the error; a C compiler failure can run to thousands of
+    # lines before it.
+    MAX_OUTPUT_LINES = 60
+
+    def initialize(option)
+      @option = option
+      @script = option.script
+      @output = option.output_executable
+    end
+
+    def build
+      spinel = AotToolchain.find(:spinel)
+      analysis = SpinelCompatibility.new(@script, packages_dir: packages_dir(spinel),
+                                                  project_dirs: project_dirs).analyze
+
+      unless spinel
+        error "--spinel needs the Spinel compiler, which was not found."
+        STDERR.puts
+        STDERR.puts AotToolchain.install_instructions([:spinel])
+        STDERR.puts
+        print_report(analysis, "Meanwhile, a static check of whether #{display(@script)} is likely to compile with Spinel:")
+        raise "Spinel is not installed"
+      end
+
+      verbose "Using Spinel at #{spinel} (#{AotToolchain.version(spinel) || "version unknown"})"
+      warn_about_uncompiled_files(analysis)
+
+      flags = analysis.include_dirs.flat_map { |dir| ["-I", dir] }
+      flags << "-g" if @option.enable_debug_mode?
+      flags.concat(@option.spinel_options)
+      command = [spinel, *flags, @script.to_s, "-o", @output.to_s]
+
+      say "Compiling #{display(@script)} with Spinel"
+      verbose command.join(" ")
+      output, status = Open3.capture2e(*command)
+
+      if status.success?
+        STDERR.print output if !output.strip.empty? && @option.warning?
+        report_success(analysis)
+      else
+        report_failure(spinel, flags, output, status, analysis)
+      end
+    end
+
+    private
+
+    def report_success(analysis)
+      unless analysis.findings.empty?
+        warning "Spinel compiled the program, but the static check flagged #{analysis.findings.size} " \
+                "construct(s) that may behave differently than under CRuby#{@option.verbose? ? ":" : " (--verbose lists them)"}"
+        verbose analysis.report
+      end
+      say "Finished building #{@output} (#{File.size(@output)} bytes)"
+      say "This is a native executable for this platform; it does not need Ruby to run."
+    end
+
+    def report_failure(spinel, flags, output, status, analysis)
+      lines = output.lines
+      STDERR.puts "Spinel could not compile #{display(@script)} (exit status #{status.exitstatus.inspect}):"
+      STDERR.puts "  ... (#{lines.size - MAX_OUTPUT_LINES} earlier lines omitted)" if lines.size > MAX_OUTPUT_LINES
+      STDERR.puts lines.last(MAX_OUTPUT_LINES).map { |l| "  #{l}" }.join
+      STDERR.puts
+
+      if analysis.clean?
+        STDERR.puts "The static check found nothing Spinel is known to reject in #{analysis.files.size} file(s),"
+        STDERR.puts "so the cause is likely a limit of Spinel's type inference rather than a missing feature."
+      else
+        print_report(analysis, "What may stand in the way:")
+      end
+      print_doctor(spinel, flags)
+
+      STDERR.puts
+      STDERR.puts "Things to try:"
+      STDERR.puts "  - Spinel's supported subset: #{AotToolchain::SPINEL_URL}/blob/master/docs/limitations.md"
+      STDERR.puts "  - --spinel-opt --defer-refusals builds anyway; refused methods then raise NotImplementedError when called"
+      STDERR.puts "  - --spinel-opt --warn-widen shows where inference gave up on a type"
+      unless analysis.problem_gems.empty?
+        names = analysis.problem_gems.map(&:name).join(", ")
+        STDERR.puts "  - replace or drop the gems Spinel cannot compile (#{names}), or leave out --spinel to package them with Ruby"
+      end
+      raise "Spinel could not compile #{display(@script)}"
+    end
+
+    # spinel-doctor, installed beside the compiler, adds what the compile
+    # error alone does not say: calls that degrade to nil, methods whose
+    # types inference gave up on, requires it treats as no-ops. Its build
+    # leg repeats the compiler output shown already, and its behavior leg
+    # runs the program under CRuby, so both are left out.
+    def print_doctor(spinel, flags)
+      doctor = doctor_path(spinel) or return
+
+      verbose "Running #{doctor}"
+      env = { "SPINEL" => spinel }
+      command = [doctor, "--skip", "build,behavior", @script.to_s]
+      command.concat(["--", *flags]) unless flags.empty?
+      output, = Open3.capture2e(env, *command)
+      return if output.strip.empty?
+
+      STDERR.puts
+      STDERR.puts "spinel-doctor's report:"
+      STDERR.puts output.lines.last(MAX_OUTPUT_LINES).map { |l| "  #{l}" }.join
+    rescue SystemCallError => e
+      verbose "spinel-doctor could not be run: #{e.message}"
+    end
+
+    def doctor_path(spinel)
+      candidates = [File.dirname(spinel)]
+      real = File.realpath(spinel)
+      candidates += [File.dirname(real), File.join(File.dirname(File.dirname(real)), "bin")]
+      candidates.uniq.map { |dir| File.join(dir, "spinel-doctor") }.find { |path| AotToolchain.executable?(path) }
+    rescue SystemCallError
+      nil
+    end
+
+    def print_report(analysis, heading)
+      STDERR.puts heading
+      STDERR.puts
+      STDERR.puts analysis.report.gsub(/^(?=.)/, "  ")
+    end
+
+    # Files given on the command line besides the script, which Spinel
+    # compiles in only when the program requires them. Anything else -
+    # data files, assets - is not part of the binary.
+    def warn_about_uncompiled_files(analysis)
+      compiled = analysis.files.map(&:to_s)
+      extra = @option.source_files.drop(1).reject { |f| compiled.include?(f.to_s) }
+      return if extra.empty?
+
+      shown = extra.first(5).map { |f| display(f) }.join(", ")
+      shown += ", ..." if extra.size > 5
+      warning "Spinel compiles code only; #{extra.size} file(s) given on the command line are not " \
+              "part of the executable and have to be shipped beside it: #{shown}"
+    end
+
+    # Directories whose files are the program's own rather than a gem's.
+    def project_dirs
+      [@script.dirname, *@option.source_files.map(&:dirname)].uniq
+    end
+
+    # Spinel's packages/ directory, which lists the standard library it
+    # provides: beside the compiler when installed, at the root of a source
+    # checkout otherwise (where `spinel` links to build/spinel).
+    def packages_dir(spinel)
+      return nil unless spinel
+
+      real = File.realpath(spinel)
+      [File.dirname(real), File.dirname(File.dirname(real))]
+        .map { |dir| File.join(dir, "packages") }
+        .find { |dir| File.directory?(dir) }
+    rescue SystemCallError
+      nil
+    end
+
+    # Relative to the working directory when inside it, else absolute.
+    def display(path)
+      rel = Pathname(path).relative_path_from(Pathname.pwd).to_s
+      rel.start_with?("..") ? path.to_s : rel
+    rescue ArgumentError
+      path.to_s
+    end
+  end
+end

data/lib/ocran/spinel_compatibility.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+require_relative "compatibility_scan"
+
+module Ocran
+  # Whether a script is likely to compile with Spinel, the ahead-of-time
+  # compiler behind --spinel.
+  #
+  # Spinel compiles a subset of Ruby: no eval of strings, no method_missing,
+  # no runtime class graph changes, and only the standard library it ships
+  # itself (https://github.com/matz/spinel/blob/master/docs/limitations.md).
+  #
+  # The walk also yields the -I roots that let Spinel find the pure-Ruby
+  # gems and the project's own lib/ directory, since Spinel resolves
+  # `require` at compile time against the roots it is given rather than
+  # against the gems installed for CRuby.
+  class SpinelCompatibility < CompatibilityScan
+    # Features Spinel provides when its own packages/ directory cannot be
+    # found to read the list from (it is installed beside the compiler).
+    # Mirrors packages/ plus the requires the compiler answers natively
+    # (src/spinel_parse.c: sp_lib_is_native, sp_require_tolerated,
+    # sp_require_preloaded) as of Spinel 2026.09.
+    FALLBACK_FEATURES = %w[
+      base64 benchmark bigdecimal cgi cgi/escape cgi/util csv digest digest/md5
+      digest/sha1 digest/sha2 erb ffi fiddle fiddle/import fileutils forwardable
+      io/buffer json logger net/http open3 openssl optparse pathname
+      securerandom set stringio strscan tempfile tmpdir uri zlib
+    ].freeze
+
+    NATIVE_FEATURES = %w[
+      io/console monitor time socket ostruct
+      thread enumerator fiber rational complex
+    ].freeze
+
+    # packages_dir: Spinel's packages/ directory, if known, to read the
+    #               features it provides from
+    def initialize(script, packages_dir: nil, project_dirs: nil)
+      super(script, project_dirs: project_dirs)
+      @features = spinel_features(packages_dir)
+      @allowed = {}
+    end
+
+    def target = "Spinel"
+
+    private
+
+    def provided_feature?(feature) = @features.include?(feature)
+
+    def gem_problem(gem)
+      if gem.native
+        [:error, "has a C extension, which Spinel cannot compile"]
+      elsif gem.stdlib
+        # Spinel has its own versions of the parts of the standard library
+        # it supports (matched by name before a gem is ever looked up), so
+        # any other default gem is standard library it does not have.
+        [:error, "Ruby standard library that Spinel does not provide"]
+      end
+    end
+
+    def gem_status(gem)
+      return super if gem_problem(gem) || @findings.any? { |f| f.severity == :error && f.origin == gem.name }
+
+      "pure Ruby, nothing unsupported found (compiled from #{gem.spec.full_gem_path})"
+    end
+
+    def dynamic_require_message(name)
+      "#{name} with a computed name: Spinel resolves requires at compile time, so the name must be a string literal"
+    end
+
+    def spinel_features(packages_dir)
+      features = NATIVE_FEATURES.dup
+      if packages_dir && File.directory?(packages_dir)
+        Dir.glob(File.join(packages_dir, "*")).each do |pkg|
+          Dir.glob("**/*.rb", base: pkg).each do |rel|
+            next if rel.start_with?("test/", "build/") || rel.include?("/test/")
+
+            features << rel.delete_suffix(".rb")
+          end
+        end
+      else
+        features.concat(FALLBACK_FEATURES)
+      end
+      features.uniq
+    end
+
+    def check_def(node)
+      if node.name == :method_missing
+        flag(:warning, node, "method_missing is never dispatched by Spinel; calls to undefined methods fail to compile")
+      end
+    end
+
+    def check_global(node)
+      if %i[$LOAD_PATH $:].include?(node.name)
+        flag(:warning, node, "#{node.name} has no effect: Spinel resolves every require at compile time")
+      end
+    end
+
+    def check_constant(node)
+      flag(:error, node, "TracePoint is not supported (it needs an interpreter loop)") if node.name == :TracePoint
+    end
+
+    def check_call(node, name, args, receiver, kernel)
+      return if @allowed[node.object_id]
+
+      case name
+      when :load
+        flag(:error, node, "load: a compiled program cannot load Ruby files at run time") if kernel && !args.empty?
+      when :eval
+        flag(:error, node, "eval of a string is not supported (no parser at run time)") if kernel
+      when :instance_eval, :class_eval, :module_eval, :class_exec
+        if node.block.nil? && args.any? && !args.first.is_a?(Prism::BlockArgumentNode)
+          flag(:error, node, "#{name} with a string is not supported (the block form works)")
+        end
+      when :define_method
+        unless literal?(args.first)
+          flag(:warning, node, "define_method with a computed name works only where Spinel can enumerate the names at compile time")
+        end
+      when :instance_variable_get, :instance_variable_set
+        unless literal?(args.first)
+          flag(:error, node, "#{name} with a computed name is not supported (only literal names like :@x)")
+        end
+      when :send, :public_send, :__send__
+        if args.first && !literal?(args.first)
+          flag(:warning, node, "#{name} with a computed method name only dispatches to methods named literally somewhere in the program")
+        end
+      when :binding
+        if kernel && args.empty?
+          flag(:error, node, "binding as an object is not supported (only binding.local_variable_get(:literal))")
+        end
+      when :local_variable_get
+        # binding.local_variable_get(:x) with a literal name is supported.
+        if receiver.is_a?(Prism::CallNode) && receiver.name == :binding && literal?(args.first)
+          @allowed[receiver.object_id] = true
+        end
+      when :each_object, :count_objects
+        flag(:error, node, "ObjectSpace.#{name} is not supported") if constant?(receiver, :ObjectSpace)
+      when :set_trace_func
+        flag(:error, node, "set_trace_func is not supported") if kernel
+      when :callcc
+        flag(:error, node, "callcc / Continuation is not supported") if kernel
+      when :refine, :using
+        if receiver.nil? && args.size == 1 && (node.block || name == :using)
+          flag(:error, node, "refinements (refine / using) are not supported")
+        end
+      when :new
+        flag(:error, node, "Class.new builds a class at run time, which is not supported") if constant?(receiver, :Class)
+      end
+    end
+  end
+end