Merge pull request #1474 from dstufft/disable-implicit-compile

Monkeypatch the CFFI Verifier to prevent the implicit compile

1 files changed, 11 insertions, 0 deletions

diff --git a/src/cryptography/hazmat/bindings/utils.py b/src/cryptography/hazmat/bindings/utils.py
index 55b61292..ca2d91ae 100644
--- a/src/cryptography/hazmat/bindings/utils.py
+++ b/src/cryptography/hazmat/bindings/utils.py
@@ -124,9 +124,20 @@ def build_ffi(cdef_source, verify_source, libraries=[], extra_compile_args=[],
         extra_compile_args=extra_compile_args,
         extra_link_args=extra_link_args,
     )
+
+    ffi.verifier.compile_module = _compile_module
+    ffi.verifier._compile_module = _compile_module
+
     return ffi
 
 
+def _compile_module(*args, **kwargs):
+    raise RuntimeError(
+        "Attempted implicit compile of a cffi module. All cffi modules should "
+        "be pre-compiled at installation time."
+    )
+
+
 def _create_modulename(cdef_sources, source, sys_version):
     """
     cffi creates a modulename internally that incorporates the cffi version.