This patch uses numba to execute Python byte-code without access to CPython API (no open(), import, or modules like os.*, shutil.*... etc).
Checked on the numba mailing list and apparently numba is not fully secure, but they seem open to having a restricted mode in numba, which shouldn't be so hard to support. [0]
Tested on glass-half file (01_render.blend), and it works with around same performance as with full Python.
However initial jit complication is very slow, (over ~1 min!).
Pros
- Works with math API and numeric Python expressions.
- Off the shelf solution we don't have to maintain.
- No large extra dependencies.
Cons
- Slow initial expression compilation.
- Complicates build process (we would probably include pre-compiled for OSX/Windows, for Linux it needs to link with LLVM and depends on numpy).
- Not *entirely* secure (yet), apparently, though it can be supported.
Submitting this diff for reference, since it works and may help in finding a good solution.