toolchain/58797: build lacks automatic check for /bin programs linked against /usr/lib libraries

[campbell+netbsd%mumble.net@localhost]

>Number:         58797
>Category:       toolchain
>Synopsis:       build lacks automatic check for /bin programs linked against /usr/lib libraries
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    toolchain-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 31 19:50:01 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current, 10, 9, ...
>Organization:
The /binBSD Foundation
>Environment:
>Description:
Since netbsd-9, we have inadvertently shipped a /bin/tar that is linked against libarchive.so.N, which lives in /usr/lib, unless you use a custom build with MKBSDTAR=no.  Hence /bin/tar is nonfunctional on systems without /usr mounted (PR bin/58187: /bin/tar does not work without mounted /usr, https://gnats.netbsd.org/58187).

Nothing in the build automatically detects or avoids this scenario.
>How-To-Repeat:
run tar without /usr mounted
>Fix:
Obvious approaches:

1. teach ld to exclude /usr/lib from the list of libraries when linking /bin (and /sbin and /libexec and ...)
2. add a post-link pass to verify anything installed outside /usr only depends on things outside /usr