From c8c780e284b7bd638e5763cef993669ca4d2327c Mon Sep 17 00:00:00 2001
From: Johannes Schlatow <johannes.schlatow@genode-labs.com>
Date: Wed, 4 Sep 2024 13:24:52 +0200
Subject: [PATCH] load goarc files with safe slave interpreter

TCL's safe interpreter hides file operations, source, and exec commands.
Loading goarc files with a safe slave interpreter is a basic security
measure. This change also moves all config variables into a separate
namespace. Our interpreter additionally hides the set command in order to
make sure that goarc files are only able to set predefined variables in
the config namespace.

genodelabs/goa#99
---
 bin/goa                            |  28 +--
 share/goa/lib/actions/build.tcl    |  30 ++--
 share/goa/lib/actions/depot.tcl    |  56 +++---
 share/goa/lib/actions/generic.tcl  |   6 +-
 share/goa/lib/actions/import.tcl   |  10 +-
 share/goa/lib/actions/run.tcl      |   9 +-
 share/goa/lib/actions/versions.tcl |   7 +-
 share/goa/lib/build/autoconf.tcl   |   6 +-
 share/goa/lib/build/cargo.tcl      |   9 +-
 share/goa/lib/build/cmake.tcl      |  13 +-
 share/goa/lib/build/make.tcl       |   7 +-
 share/goa/lib/build/meson.tcl      |  16 +-
 share/goa/lib/build/qmake.tcl      |   8 +-
 share/goa/lib/build/vivado.tcl     |   7 +-
 share/goa/lib/command_line.tcl     | 274 ++++++-----------------------
 share/goa/lib/config.tcl           | 239 +++++++++++++++++++++++++
 share/goa/lib/run/common.tcl       |   6 +-
 share/goa/lib/run/linux.tcl        |  24 +--
 share/goa/lib/run/sculpt.tcl       |  12 +-
 share/goa/lib/util.tcl             |  33 ++--
 20 files changed, 456 insertions(+), 344 deletions(-)
 create mode 100644 share/goa/lib/config.tcl

diff --git a/bin/goa b/bin/goa
index a8cd0ab..3ecc84b 100755
--- a/bin/goa
+++ b/bin/goa
@@ -105,8 +105,8 @@ if {$perform(add-depot-user)} {
 # The following commands only work when the current working directory is a goa
 # project.
 #
-if {![looks_like_goa_project_dir $project_dir] && ![has_src_but_no_artifacts $project_dir]} {
-	exit_with_error "$project_dir does not look like a goa project" }
+if {![looks_like_goa_project_dir $config::project_dir] && ![has_src_but_no_artifacts $config::project_dir]} {
+	exit_with_error "$config::project_dir does not look like a goa project" }
 
 
 source [file join $tool_dir lib actions versions.tcl]
@@ -159,8 +159,8 @@ source [file join $tool_dir lib actions build.tcl]
 source [file join $tool_dir lib actions depot.tcl]
 
 if {$perform(build-dir)} {
-	if {[has_src_but_no_artifacts $project_dir]} {
-		exit_with_error "$project_dir has a 'src' directory but lacks an" \
+	if {[has_src_but_no_artifacts $config::project_dir]} {
+		exit_with_error "$config::project_dir has a 'src' directory but lacks an" \
 		                "'artifacts' file. You may start with an empty file."
 	}
 }
@@ -217,9 +217,9 @@ if {$perform(run-dir)} {
 
 	source [file join $tool_dir lib run common.tcl]
 
-	set target_file [file join $tool_dir lib run $target.tcl]
-	if {$target == "common" || ![file exists $target_file]} {
-		exit_with_error "Target '$target' not available (see 'goa help targets')" }
+	set target_file [file join $tool_dir lib run $config::target.tcl]
+	if {$config::target == "common" || ![file exists $target_file]} {
+		exit_with_error "Target '$config::target' not available (see 'goa help targets')" }
 
 	source $target_file
 
@@ -230,7 +230,7 @@ if {$perform(run-dir)} {
 if {$perform(run)} {
 
 	# start recording
-	set filename [file join $var_dir $project_name.log]
+	set filename [file join $config::var_dir $config::project_name.log]
 	log_file -noappend $filename
 
 	run_genode
@@ -256,15 +256,15 @@ if {$perform(run)} {
 			                "\n argument."
 		}
 
-		if {![file exists [file join $run_dir $binary_name]]} {
-			exit_with_error "binary '$binary_name' does not exist in run directory" \
+		if {![file exists [file join $config::run_dir $config::binary_name]]} {
+			exit_with_error "binary '$config::binary_name' does not exist in run directory" \
 			                "\n You can define the binary name explicitly by " \
 			                "\n specifying the '--binary-name <name>' command-line " \
 			                "\n argument."
 		}
 
-		cd $run_dir
-		exec [file join $tool_dir lib backtrace] $binary_name >@ stdout < $filename
+		cd $config::run_dir
+		exec [file join $tool_dir lib backtrace] $config::binary_name >@ stdout < $filename
 	}
 
 	exit
@@ -281,7 +281,7 @@ if {$perform(export)} {
 	goa export-src
 	goa export-pkgs  exported_archives
 	goa export-bin   exported_archives
-	if {$debug} { goa export-dbg }
+	if {$config::debug} { goa export-dbg }
 	goa export-index exported_archives
 
 	array set export_projects { }
@@ -292,7 +292,7 @@ if {$perform(export)} {
 
 if {$perform(publish)} {
 
-	set pubkey_file [file join $depot_dir $depot_user pubkey]
+	set pubkey_file [file join $config::depot_dir $config::depot_user pubkey]
 	if {![file exists $pubkey_file]} {
 		exit_with_error "missing public key at $pubkey_file\n" \
 		                "\n You may use the 'goa add-depot-user' command." \
diff --git a/share/goa/lib/actions/build.tcl b/share/goa/lib/actions/build.tcl
index edd847f..6130f2a 100644
--- a/share/goa/lib/actions/build.tcl
+++ b/share/goa/lib/actions/build.tcl
@@ -83,7 +83,9 @@ namespace eval goa {
 	#
 	proc prepare_abi_stubs { used_apis } {
 
-		global tool_dir depot_dir abi_dir cross_dev_prefix ld_march cc_march verbose project_name arch
+		global tool_dir verbose
+		global config::depot_dir config::abi_dir config::cross_dev_prefix
+		global config::ld_march config::cc_march config::project_name config::arch
 
 		set     cmd "make -f $tool_dir/lib/gen_abi_stubs.mk"
 		lappend cmd "TOOL_DIR=$tool_dir"
@@ -110,7 +112,9 @@ namespace eval goa {
 	#
 	proc prepare_ldso_support_stub { used_apis } {
 
-		global tool_dir depot_dir abi_dir cross_dev_prefix cc_march verbose project_name arch
+		global tool_dir verbose
+		global config::depot_dir config::abi_dir config::cross_dev_prefix
+		global config::cc_march config::project_name config::arch
 
 		set so_api { }
 		foreach api_path $used_apis {
@@ -145,8 +149,11 @@ namespace eval goa {
 	#
 	proc build-dir { } {
 
-		global cross_dev_prefix tool_dir depot_dir rebuild arch olevel cc_march
-		global debug cc_cxx_opt_std ld_march abi_dir build_dir api_dirs
+		global tool_dir
+		global config::cross_dev_prefix config::depot_dir config::rebuild
+		global config::arch config::olevel config::cc_march config::debug
+		global config::cc_cxx_opt_std config::ld_march config::abi_dir
+		global config::build_dir config::api_dirs
 
 		#
 		# Check for availability of the Genode tool chain
@@ -339,8 +346,9 @@ namespace eval goa {
 	
 	proc extract_artifacts_from_build_dir { } {
 
-		global project_dir build_dir bin_dir dbg_dir debug
-		global library_artifacts
+		global config::project_dir config::build_dir config::bin_dir
+		global config::dbg_dir config::debug
+		variable library_artifacts { }
 	
 		set artifacts_file_path [file join $project_dir artifacts]
 	
@@ -356,7 +364,6 @@ namespace eval goa {
 		file mkdir $bin_dir
 		if { $debug } { file mkdir $dbg_dir }
 	
-		set library_artifacts { }
 		foreach file [artifact_file_list_from_list_file $artifacts_file_path $build_dir] {
 			set symlink_path [file join $bin_dir [file tail $file]]
 			file link $symlink_path $file
@@ -377,7 +384,9 @@ namespace eval goa {
 	
 	proc check_abis { } {
 
-		global arch project_dir tool_dir library_artifacts
+		global tool_dir
+		global config::arch config::project_dir
+		variable library_artifacts
 	
 		foreach library $library_artifacts {
 	
@@ -399,7 +408,7 @@ namespace eval goa {
 
 	proc extract_api_artifacts { } {
 
-		global project_dir build_dir api_dir
+		global config::project_dir config::build_dir config::api_dir
 	
 		set api_file_path [file join $project_dir api]
 	
@@ -429,7 +438,8 @@ namespace eval goa {
 	
 	proc extract_library_symbols { } {
 
-		global build_dir project_dir tool_dir
+		global tool_dir
+		global config::build_dir config::project_dir
 	
 		set artifacts_file_path [file join $project_dir artifacts]
 	
diff --git a/share/goa/lib/actions/depot.tcl b/share/goa/lib/actions/depot.tcl
index 0606995..032b456 100644
--- a/share/goa/lib/actions/depot.tcl
+++ b/share/goa/lib/actions/depot.tcl
@@ -13,8 +13,10 @@ namespace eval goa {
 	# Run `goa export` in specified project directory
 	#
 	proc export_dependent_project { dir arch { pkg_name "" } } {
-		global argv0 jobs depot_user depot_dir versions_from_genode_dir
-		global public_dir common_var_dir var_dir verbose search_dir debug
+		global argv0 config::jobs config::depot_user config::depot_dir
+		global config::versions_from_genode_dir config::public_dir config::debug
+		global config::common_var_dir config::var_dir config::verbose
+		global config::search_dir
 
 		set orig_pwd [pwd]
 		cd $search_dir
@@ -59,7 +61,7 @@ namespace eval goa {
 
 
 	proc download_archives { archives { no_err 0 } { dbg 0 }} {
-		global tool_dir depot_dir public_dir
+		global tool_dir config::depot_dir config::public_dir
 
 		if {[llength $archives] > 0} {
 			set cmd "[file join $tool_dir depot download]"
@@ -99,7 +101,7 @@ namespace eval goa {
 	#
 	proc prepare_depot_with_apis { } {
 
-		global depot_user arch
+		global config::depot_user config::arch
 
 		assert_definition_of_depot_user
 
@@ -128,7 +130,7 @@ namespace eval goa {
 	# Download archives into depot
 	#
 	proc prepare_depot_with_archives { archive_list } {
-		global depot_dir
+		global config::depot_dir
 
 		# create list of depot users without duplicates
 		set depot_users { }
@@ -161,7 +163,7 @@ namespace eval goa {
 	# Try downloading debug archives into depot
 	#
 	proc prepare_depot_with_debug_archives { archive_list } {
-		global depot_dir
+		global config::depot_dir
 
 		set missing_debug_archives {}
 		foreach archive $archive_list {
@@ -183,7 +185,8 @@ namespace eval goa {
 	#
 	proc versioned_project_archive { type { pkg_name ""} } {
 	
-		global depot_user project_dir project_name version arch sculpt_version
+		global config::depot_user config::project_dir config::project_name
+		global config::version config::arch config::sculpt_version
 	
 		set name $project_name
 	
@@ -242,7 +245,7 @@ namespace eval goa {
 	# \return path to the archive directory (or file if type=="index")
 	#
 	proc prepare_project_archive_directory { type { pkg_name "" } } {
-		global depot_dir
+		global config::depot_dir
 	
 		set policy [depot_policy]
 		set archive [versioned_project_archive $type $pkg_name]
@@ -274,7 +277,7 @@ namespace eval goa {
 	# Return path to the license file as defined for the project
 	#
 	proc license_file { } {
-		global project_dir license
+		global config::project_dir config::license
 	
 		set local_license_file [file join $project_dir LICENSE]
 		if {[file exists $local_license_file]} {
@@ -298,7 +301,7 @@ namespace eval goa {
 	# Supplement index file pkg paths with user and version information
 	#
 	proc augment_index_versions { src_file dst_file } {
-		global depot_user
+		global config::depot_user
 	
 		# read src_file
 		set fd [open $src_file r]
@@ -321,7 +324,7 @@ namespace eval goa {
 
 	proc export-api { } {
 
-		global api_dir project_dir
+		global config::api_dir config::project_dir
 
 		if {[file exists $api_dir] && [file isdirectory $api_dir]} {
 			set dst_dir [prepare_project_archive_directory api]
@@ -369,7 +372,7 @@ namespace eval goa {
 
 	proc export-raw { } {
 
-		global project_dir
+		global config::project_dir
 
 		set raw_dir [file join $project_dir raw]
 		if {[file exists $raw_dir] && [file isdirectory $raw_dir]} {
@@ -387,7 +390,7 @@ namespace eval goa {
 
 	proc export-src { } {
 
-		global project_dir
+		global config::project_dir
 
 		# create src archive
 		set src_dir [file join $project_dir src]
@@ -430,12 +433,12 @@ namespace eval goa {
 
 	proc export-pkgs { &exported_archives } {
 
-		global publish_pkg arch
+		global args config::arch
 		upvar  ${&exported_archives} exported_archives
 
 		set pkg_expr "*"
-		if {$publish_pkg != ""} {
-			set pkg_expr $publish_pkg }
+		if {$args(publish_pkg) != ""} {
+			set pkg_expr $args(publish_pkg) }
 		set pkgs [glob -nocomplain -directory pkg -tail $pkg_expr -type d]
 		foreach pkg $pkgs {
 	
@@ -486,7 +489,7 @@ namespace eval goa {
 
 	proc export-bin { &exported_archives } {
 
-		global bin_dir
+		global config::bin_dir
 		upvar  ${&exported_archives} exported_archives
 
 		# create bin archive
@@ -529,7 +532,7 @@ namespace eval goa {
 
 	proc export-index { &exported_archives } {
 
-		global project_dir depot_user
+		global config::project_dir config::depot_user
 		upvar  ${&exported_archives} exported_archives
 
 		set index_file [file join $project_dir index]
@@ -580,7 +583,8 @@ namespace eval goa {
 
 	proc import-dependencies { exported_archives &export_projects} {
 
-		global tool_dir depot_dir public_dir depot_user arch
+		global tool_dir
+		global config::depot_dir config::public_dir config::depot_user config::arch
 		upvar  ${&export_projects} export_projects
 	
 		# determine dependent projects that need exporting
@@ -636,7 +640,7 @@ namespace eval goa {
 
 	proc export-dependencies { &export_projects } {
 
-		global arch
+		global config::arch
 		upvar ${&export_projects} export_projects
 
 		# export bin/pkg archives first and delay arch-independent archives
@@ -676,7 +680,8 @@ namespace eval goa {
 
 	proc published-archives { } {
 
-		global project_dir publish_pkg bin_dir api_dir arch
+		global args
+		global config::project_dir config::bin_dir config::api_dir config::arch
 		set archives { }
 	
 		set raw_dir [file join $project_dir raw]
@@ -693,8 +698,8 @@ namespace eval goa {
 		if {[file exists $api_dir] && [file isdirectory $api_dir]} {
 			lappend archives [versioned_project_archive api] }
 	
-		if {$publish_pkg != ""} {
-			lappend archives [apply_arch [versioned_project_archive pkg $publish_pkg] $arch]
+		if {$args(publish_pkg) != ""} {
+			lappend archives [apply_arch [versioned_project_archive pkg $args(publish_pkg)] $arch]
 		} else {
 			set pkgs [glob -nocomplain -directory pkg -tail * -type d]
 			foreach pkg $pkgs {
@@ -720,7 +725,7 @@ namespace eval goa {
 
 	proc download-foreign { archives } {
 
-		global tool_dir depot_dir public_dir depot_user
+		global tool_dir config::depot_dir config::public_dir config::depot_user
 
 		set missing_archives ""
 		if {[llength $archives] > 0} {
@@ -763,7 +768,8 @@ namespace eval goa {
 
 	proc publish { archives } {
 
-		global tool_dir depot_dir public_dir debug jobs
+		global tool_dir
+		global config::depot_dir config::public_dir config::debug config::jobs
 
 		if {[llength $archives] > 0} {
 			set cmd "[file join $tool_dir depot publish]"
diff --git a/share/goa/lib/actions/generic.tcl b/share/goa/lib/actions/generic.tcl
index 147a641..c45a012 100644
--- a/share/goa/lib/actions/generic.tcl
+++ b/share/goa/lib/actions/generic.tcl
@@ -69,7 +69,7 @@ namespace eval goa {
 	#
 	proc _depot_exists { } {
 
-		global depot_dir
+		global config::depot_dir
 		return [expr {[file exists $depot_dir] && [file isdirectory $depot_dir]}]
 	}
 
@@ -91,7 +91,7 @@ namespace eval goa {
 	proc depot-dir { } {
 
 		global tool_dir
-		global depot_dir
+		global config::depot_dir
 
 		# create default depot
 		if {![_depot_exists]} {
@@ -106,7 +106,7 @@ namespace eval goa {
 	#
 	proc add-depot-user { new_depot_user depot_url pubkey_file gpg_user_id } {
 
-		global depot_dir
+		global config::depot_dir
 
 		set policy [depot_policy]
 
diff --git a/share/goa/lib/actions/import.tcl b/share/goa/lib/actions/import.tcl
index 8d66afc..8fdd516 100644
--- a/share/goa/lib/actions/import.tcl
+++ b/share/goa/lib/actions/import.tcl
@@ -7,7 +7,7 @@ namespace eval goa {
 
 	proc calc_import_hash { } {
 
-		global tool_dir project_dir
+		global tool_dir config::project_dir
 
 		set     cmd "make"
 		lappend cmd "-f" [file join $tool_dir ports mk print_hash.mk]
@@ -25,7 +25,7 @@ namespace eval goa {
 	#
 	proc check_modified { subdir } {
 
-		global contrib_dir
+		global config::contrib_dir
 
 		set dir_a [file join $contrib_dir $subdir]
 		set dir_b [file join $subdir]
@@ -43,7 +43,7 @@ namespace eval goa {
 	# Diff between originally imported contrib code and local edits
 	#
 	proc diff { subdir } {
-		global contrib_dir
+		global config::contrib_dir
 
 		set dir_a [file join $contrib_dir $subdir]
 		set dir_b [file join $subdir]
@@ -70,7 +70,9 @@ namespace eval goa {
 	#
 	proc import { } {
 
-		global contrib_dir verbose jobs project_dir build_dir tool_dir import_dir
+		global verbose tool_dir
+		global config::contrib_dir config::jobs config::project_dir
+		global config::build_dir config::import_dir
 
 		if {![file exists import] || ![file isfile import]} {
 			exit_with_error "missing 'import' file" }
diff --git a/share/goa/lib/actions/run.tcl b/share/goa/lib/actions/run.tcl
index 30d1fb7..2f4195d 100644
--- a/share/goa/lib/actions/run.tcl
+++ b/share/goa/lib/actions/run.tcl
@@ -10,7 +10,7 @@ namespace eval goa {
 	#
 	proc update_depot_roms { archive_list &rom_modules } {
 
-		global depot_dir
+		global config::depot_dir
 		upvar  ${&rom_modules} rom_modules
 
 		# append rom modules of runtimes
@@ -22,10 +22,11 @@ namespace eval goa {
 
 	proc run-dir { } {
 
-		global tool_dir project_dir run_pkg run_dir dbg_dir bin_dir depot_dir
-		global debug
+		global tool_dir args
+		global config::project_dir config::run_dir config::dbg_dir config::bin_dir
+		global config::depot_dir config::debug
 	
-		set pkg_dir [file join $project_dir pkg $run_pkg]
+		set pkg_dir [file join $project_dir pkg $args(run_pkg)]
 	
 		if {![file exists $pkg_dir]} {
 			exit_with_error "no runtime defined at $pkg_dir" }
diff --git a/share/goa/lib/actions/versions.tcl b/share/goa/lib/actions/versions.tcl
index b1b65a7..9d93db5 100644
--- a/share/goa/lib/actions/versions.tcl
+++ b/share/goa/lib/actions/versions.tcl
@@ -7,7 +7,7 @@ namespace eval goa {
 
 	proc bump-version { target_version } {
 
-		global project_dir
+		global config::project_dir
 
 		set version_file [file join $project_dir version]
 		if {[file exists $version_file]} {
@@ -41,7 +41,7 @@ namespace eval goa {
 	# Get a list of pkg+arch-list pairs from an index file
 	#
 	proc pkgs_from_index { index_file } {
-		global depot_user
+		global config::depot_user
 
 		# get supported archs
 		if {[catch { set supported_archs [query_attrs_from_file /index/supports arch $index_file] }]} {
@@ -83,7 +83,8 @@ namespace eval goa {
 
 	proc archive-versions { } {
 
-		global versions_from_genode_dir depot_user version project_dir
+		global config::versions_from_genode_dir config::depot_user config::version
+		global config::project_dir
 
 		if {[info exists versions_from_genode_dir] && [info exists depot_user]} {
 
diff --git a/share/goa/lib/build/autoconf.tcl b/share/goa/lib/build/autoconf.tcl
index 00c361f..b9f7bcd 100644
--- a/share/goa/lib/build/autoconf.tcl
+++ b/share/goa/lib/build/autoconf.tcl
@@ -3,8 +3,9 @@ proc create_or_update_build_dir { } {
 
 	mirror_source_dir_to_build_dir
 
-	global build_dir cross_dev_prefix project_name project_dir
 	global cppflags cflags cxxflags ldflags ldlibs_common ldlibs_exe
+	global config::build_dir config::cross_dev_prefix config::project_name
+	global config::project_dir
 
 	# invoke configure script only once
 	if {[file exists [file join $build_dir config.status]]} {
@@ -74,7 +75,8 @@ proc create_or_update_build_dir { } {
 
 proc build { } {
 
-	global build_dir verbose project_name jobs project_dir ldlibs_common ldlibs_exe
+	global verbose ldlibs_common ldlibs_exe
+	global config::build_dir config::project_name config::jobs config::project_dir
 
 	set cmd { }
 
diff --git a/share/goa/lib/build/cargo.tcl b/share/goa/lib/build/cargo.tcl
index fa130f7..7e44f39 100644
--- a/share/goa/lib/build/cargo.tcl
+++ b/share/goa/lib/build/cargo.tcl
@@ -2,7 +2,9 @@
 proc create_or_update_build_dir { } { mirror_source_dir_to_build_dir }
 
 proc generate_static_stubs { libs } {
-	global tool_dir abi_dir cross_dev_prefix cc_march cflags cppflags verbose project_name lib_src
+	global tool_dir verbose cflags cppflags lib_src
+	global config::abi_dir config::cross_dev_prefix config::cc_march config::project_name
+
 	set     cmd "make -f $tool_dir/lib/gen_static_stubs.mk"
 	lappend cmd "LIBS=[join $libs { }]"
 	lappend cmd "TOOL_DIR=$tool_dir"
@@ -26,9 +28,10 @@ proc generate_static_stubs { libs } {
 
 proc build { } {
 
-	global build_dir cross_dev_prefix verbose debug project_name jobs project_dir
+	global verbose tool_dir
 	global cppflags cflags cxxflags ldflags ldlibs_common ldlibs_exe lib_src
-	global cc_march tool_dir
+	global config::build_dir config::cross_dev_prefix config::debug
+	global config::project_name config::jobs config::project_dir config::cc_march
 
 	set rustflags { }
 	set gcc_unwind [exec $cross_dev_prefix\gcc $cc_march -print-file-name=libgcc_eh.a]
diff --git a/share/goa/lib/build/cmake.tcl b/share/goa/lib/build/cmake.tcl
index 1a7425e..2f80184 100644
--- a/share/goa/lib/build/cmake.tcl
+++ b/share/goa/lib/build/cmake.tcl
@@ -1,10 +1,12 @@
 
 proc create_or_update_build_dir { } {
 
-	global build_dir project_dir abi_dir tool_dir cross_dev_prefix include_dirs
-	global cppflags cflags cxxflags ldflags ldflags_so ldlibs_common ldlibs_exe ldlibs_so project_name
-	global cmake_quirk_args
-	global env api_dirs
+	global tool_dir
+	global cppflags cflags cxxflags ldflags ldflags_so ldlibs_common ldlibs_exe
+	global ldlibs_so env cmake_quirk_args
+	global config::build_dir config::project_dir config::abi_dir
+	global config::cross_dev_prefix config::include_dirs config::project_name
+	global config::api_dirs
 
 	if {![file exists $build_dir]} {
 		file mkdir $build_dir }
@@ -49,7 +51,8 @@ proc create_or_update_build_dir { } {
 
 
 proc build { } {
-	global build_dir jobs project_name verbose
+	global verbose
+	global config::build_dir config::jobs config::project_name
 
 	set cmd [list make -C $build_dir "-j$jobs"]
 
diff --git a/share/goa/lib/build/make.tcl b/share/goa/lib/build/make.tcl
index db7458d..5b851e7 100644
--- a/share/goa/lib/build/make.tcl
+++ b/share/goa/lib/build/make.tcl
@@ -1,6 +1,7 @@
 proc _make_cmd { } {
-	global build_dir cross_dev_prefix verbose jobs project_dir
+	global verbose
 	global cppflags cflags cxxflags ldflags ldlibs_common ldlibs_exe lib_src
+	global config::build_dir config::cross_dev_prefix config::jobs config::project_dir
 
 	set cmd { }
 
@@ -27,7 +28,7 @@ proc _make_cmd { } {
 
 
 proc create_or_update_build_dir { } {
-	global build_dir
+	global config::build_dir
 
 	# compare make command and clear directory if anything changed
 	set signature_file [file join $build_dir ".goa_make_command"]
@@ -55,7 +56,7 @@ proc create_or_update_build_dir { } {
 
 
 proc build { } {
-	global project_name
+	global config::project_name
 
 	set cmd [_make_cmd]
 
diff --git a/share/goa/lib/build/meson.tcl b/share/goa/lib/build/meson.tcl
index 63e7690..b5af7d9 100644
--- a/share/goa/lib/build/meson.tcl
+++ b/share/goa/lib/build/meson.tcl
@@ -3,8 +3,7 @@
 #
 
 proc api_status { } {
-	global build_dir
-
+	global config::build_dir
 
 	set pkg_config_log [file join $build_dir "pkg-config.log"]
 	set module_status  [read_file_content_as_list $pkg_config_log]
@@ -22,7 +21,8 @@ proc api_status { } {
 
 
 proc create_cross_file { dir } {
-	global cross_dev_prefix tool_dir
+	global tool_dir
+	global config::cross_dev_prefix
 
 	set cross_file [file join $dir meson-cross-genode]
 
@@ -59,11 +59,10 @@ proc create_cross_file { dir } {
 
 
 proc create_or_update_build_dir { } {
-	global build_dir project_dir abi_dir project_name
-	global cross_dev_prefix
-	global cppflags cflags cxxflags cc_cxx_opt_std
+	global cppflags cflags cxxflags
 	global ldflags ldlibs_common ldlibs_exe
-	global debug
+	global config::build_dir config::project_dir config::abi_dir config::project_name
+	global config::cross_dev_prefix config::cc_cxx_opt_std config::debug
 
 	if {![file exists $build_dir]} {
 		file mkdir $build_dir }
@@ -138,7 +137,8 @@ proc create_or_update_build_dir { } {
 
 
 proc build { } {
-	global build_dir jobs project_name verbose
+	global verbose
+	global config::build_dir config::jobs config::project_name
 
 	set cmd [list ninja -C $build_dir "-j $jobs"]
 
diff --git a/share/goa/lib/build/qmake.tcl b/share/goa/lib/build/qmake.tcl
index e8e54bf..73802cd 100644
--- a/share/goa/lib/build/qmake.tcl
+++ b/share/goa/lib/build/qmake.tcl
@@ -1,9 +1,10 @@
 
 proc create_or_update_build_dir { } {
 
-	global build_dir project_dir abi_dir cross_dev_prefix arch
 	global cppflags cxxflags ldflags ldflags_so ldlibs_common
-	global ldlibs_exe ldlibs_so project_name env
+	global ldlibs_exe ldlibs_so env
+	global config::build_dir config::project_dir config::abi_dir
+	global config::cross_dev_prefix config::arch config::project_name
 
 	set qt5_tool_dir "/usr/local/genode/tool/23.05/bin"
 
@@ -81,7 +82,8 @@ proc create_or_update_build_dir { } {
 
 
 proc build { } {
-	global build_dir jobs project_name verbose
+	global verbose
+	global config::build_dir config::jobs config::project_name
 
 	set cmd [list make -C $build_dir "-j$jobs"]
 
diff --git a/share/goa/lib/build/vivado.tcl b/share/goa/lib/build/vivado.tcl
index 1dc729a..f6487b7 100644
--- a/share/goa/lib/build/vivado.tcl
+++ b/share/goa/lib/build/vivado.tcl
@@ -1,8 +1,8 @@
 
 proc create_or_update_build_dir { } {
 
-	global build_dir project_dir verbose
-	global project_name
+	global verbose
+	global config::build_dir config::project_dir config::project_name
 
 	# skip if project file already exists
 	if {[file exists [glob -nocomplain [file join $build_dir * *.xpr]]]} {
@@ -42,7 +42,8 @@ proc create_or_update_build_dir { } {
 
 
 proc build { } {
-	global build_dir jobs project_name verbose tool_dir project_dir
+	global verbose tool_dir
+	global config::build_dir config::jobs config::project_name config::project_dir
 
 	set orig_pwd [pwd]
 	cd $build_dir
diff --git a/share/goa/lib/command_line.tcl b/share/goa/lib/command_line.tcl
index bcc5e1b..07145bd 100644
--- a/share/goa/lib/command_line.tcl
+++ b/share/goa/lib/command_line.tcl
@@ -1,8 +1,15 @@
+#
+# Trace callback preventing write access to immutable variables
+# Note: TCL 9.0 will supposedly support const variables.
+#
+proc const_var { n1 n2 op } {
+	exit_with_error "Write access to const variable $n1" }
+
 #
 # Determine verbosity level as evaluated by 'diag'
 #
 set verbose [consume_optional_cmdline_switch "--verbose"]
-
+trace add variable verbose write const_var
 
 ##
 # Print version and exit
@@ -12,7 +19,6 @@ if {[consume_optional_cmdline_switch "--version"]} {
 	exit 0
 }
 
-
 #
 # Handle -C argument, changing the current working directory
 #
@@ -20,7 +26,7 @@ set original_dir [pwd]
 set targeted_dir [consume_optional_cmdline_arg "-C" ""]
 if {$targeted_dir != ""} {
 	cd $targeted_dir }
-
+unset targeted_dir
 
 #
 # Search directory tree for project directories
@@ -90,137 +96,35 @@ if {[consume_optional_cmdline_switch "-r"]} {
 # Goa was called without '-r' argument, process a single project directory
 #
 
-set project_dir [pwd]
-set project_name [file tail $project_dir]
-
-# defaults, potentially being overwritten by 'goarc' files
-set arch                     ""
-set cross_dev_prefix         ""
-set rebuild                  0
-set jobs                     1
-set ld_march                 ""
-set cc_march                 ""
-set olevel                   "-O2"
-set debug                    0
-set versions_from_genode_dir ""
-set common_var_dir           ""
-set search_dir               ""
-set depot_overwrite          0
-set depot_retain             0
-set license                  ""
-set depot_user               ""
-set run_as                   "genodelabs"
-set target                   "linux"
-set sculpt_version           ""
-set cc_cxx_opt_std           "-std=gnu++20"
-set binary_name              ""
-array set target_opt {}
-
-# if /proc/cpuinfo exists, use number of CPUs as 'jobs'
-if {[file exists /proc/cpuinfo]} {
-	catch {
-		set num_cpus [exec grep "processor.*:" /proc/cpuinfo | wc -l]
-		set jobs $num_cpus
-		diag "use $jobs jobs according to /proc/cpuinfo"
-	}
-}
-
-
-source $tool_dir/goarc
-
-diag "process project '$project_name' with arguments: $argv"
-
-
-#
-# Read the hierarcy of 'goarc' files
-#
-
-set goarc_path_elements [file split $project_dir]
-set goarc_name "goarc"
-set goarc_path [file separator]
-
-
-#
-# The goarc file may contain paths relative to the local directory
-# or relative to the home directory ('~' character). Convert those
-# to absolute paths.
-#
-set path_var_names [list depot_dir public_dir cross_dev_prefix \
-                         versions_from_genode_dir common_var_dir \
-                         contrib_dir import_dir abi_dir build_dir \
-                         run_dir bin_dir dbg_dir search_dir]
-
-
-foreach path_elem $goarc_path_elements {
-
-	set goarc_path           [file join $goarc_path $path_elem]
-	set goarc_path_candidate [file join $goarc_path $goarc_name]
-	set deprecated_goarc     [file join $goarc_path .$goarc_name]
-
-	if {[file exists $deprecated_goarc]} {
-		log "ignoring hidden '.goarc' file at $goarc_path\n" \
-		    "\n Consider renaming the file to 'goarc' instead\n" }
-
-	if {[file exists $goarc_path_candidate]} {
-
-		set goarc_file_path [file join $goarc_path $goarc_name]
-
-		#
-		# Change to the directory of the goarc file before including it
-		# so that the commands of the file are executed in the expected
-		# directory.
-		#
-		cd $goarc_path
-
-		source $goarc_file_path
+source [file join $tool_dir lib config.tcl]
 
-		foreach var_name $path_var_names {
-
-			if {![info exists $var_name]} {
-				continue }
-
-			set path [set $var_name]
-
-			if {[llength $path] > 1} {
-				exit_with_error "$goarc_file_path contains malformed" \
-				                "definition of $var_name" }
-
-			# de-reference home directory
-			regsub {^~} $env(HOME) path
-
-			# convert relative path to absolute path
-			set path [file normalize $path]
-
-			set $var_name $path
-		}
-	}
-}
-
-# revert original current working directory
-cd $project_dir
+diag "process project '$config::project_name' with arguments: $argv"
 
+config load_goarc_files
 
 #
 # Override values with command-line arguments
 #
 # Change to the original PWD to resolve relative path names correctly.
 #
+foreach var_name [config path_var_names] {
 
-foreach var_name $path_var_names {
-
+	set var_name [lindex [split $var_name :] end]
 	regsub -all {_} $var_name "-" tag_name
 
 	set path [consume_optional_cmdline_arg "--$tag_name" ""]
 
 	if {$path != ""} {
-		set $var_name [file normalize $path] }
+		set config::$var_name [file normalize $path] }
 }
 
-set jobs           [consume_optional_cmdline_arg "--jobs" $jobs]
-set arch           [consume_optional_cmdline_arg "--arch" $arch]
-set ld_march       [consume_optional_cmdline_arg "--ld-march" $ld_march]
-set cc_march       [consume_optional_cmdline_arg "--cc-march" $cc_march]
-set cc_cxx_opt_std [consume_optional_cmdline_arg "--cc-cxx-opt-std" $cc_cxx_opt_std]
+namespace eval config {
+	set jobs           [consume_optional_cmdline_arg "--jobs" $jobs]
+	set arch           [consume_optional_cmdline_arg "--arch" $arch]
+	set ld_march       [consume_optional_cmdline_arg "--ld-march" $ld_march]
+	set cc_march       [consume_optional_cmdline_arg "--cc-march" $cc_march]
+	set cc_cxx_opt_std [consume_optional_cmdline_arg "--cc-cxx-opt-std" $cc_cxx_opt_std]
+}
 
 #
 # Define actions based on the primary command given at the command line
@@ -278,9 +182,9 @@ if {$perform(update-goa)} {
 }
 
 if {$perform(backtrace)} {
-	set binary_name      [consume_optional_cmdline_arg "--binary-name" ""]
-	set with_backtrace 1
-	set debug 1
+	set config::binary_name [consume_optional_cmdline_arg "--binary-name" ""]
+	set config::with_backtrace 1
+	set config::debug 1
 }
 
 if {$perform(help)} {
@@ -301,16 +205,16 @@ if {$perform(bump-version)} {
 
 if {$perform(add-depot-user)} {
 
-	set args(depot_url)       [consume_optional_cmdline_arg    "--depot-url"   ""]
-	set args(pubkey_file)     [consume_optional_cmdline_arg    "--pubkey-file" ""]
-	set args(gpg_user_id)     [consume_optional_cmdline_arg    "--gpg-user-id" ""]
-	set depot_overwrite [consume_optional_cmdline_switch "--depot-overwrite"]
-	set depot_retain    [consume_optional_cmdline_switch "--depot-retain"]
+	set args(depot_url)         [consume_optional_cmdline_arg    "--depot-url"   ""]
+	set args(pubkey_file)       [consume_optional_cmdline_arg    "--pubkey-file" ""]
+	set args(gpg_user_id)       [consume_optional_cmdline_arg    "--gpg-user-id" ""]
+	set config::depot_overwrite [consume_optional_cmdline_switch "--depot-overwrite"]
+	set config::depot_retain    [consume_optional_cmdline_switch "--depot-retain"]
 
 	set hint ""
 	append hint "\n Expected command:\n" \
-	            "\n goa add-depot-user <name> --depot-url <url>" \
-	            "\[--pubkey-file <file> | --gpg-user-id <id>\]\n"
+            	"\n goa add-depot-user <name> --depot-url <url>" \
+            	"\[--pubkey-file <file> | --gpg-user-id <id>\]\n"
 
 	if {[llength $argv] == 0} {
 		exit_with_error "missing user-name argument\n$hint" }
@@ -328,8 +232,8 @@ if {$perform(add-depot-user)} {
 
 	if {$args(pubkey_file) != "" && $args(gpg_user_id) != ""} {
 		exit_with_error "public key argument is ambigious\n" \
-		                "\n You may either specify a pubkey file or a" \
-		                "GPG user ID but not both.\n$hint" }
+	                	 "\n You may either specify a pubkey file or a" \
+	                	 "GPG user ID but not both.\n$hint" }
 
 	if {$args(pubkey_file) != "" && ![file exists $args(pubkey_file)]} {
 		exit_with_error "public-key file $args(pubkey_file) does not exist" }
@@ -338,120 +242,56 @@ if {$perform(add-depot-user)} {
 # override 'rebuild' variable via optional command-line switch
 if {$perform(build-dir)} {
 	if {[consume_optional_cmdline_switch "--rebuild"]} {
-		set rebuild 1 }
+		set config::rebuild 1 }
 }
 
 if {$perform(run-dir)} {
-	set target [consume_optional_cmdline_arg "--target" $target]
-	set run_as  [consume_optional_cmdline_arg "--run-as" $run_as]
+	set config::target [consume_optional_cmdline_arg "--target" $config::target]
+	set config::run_as [consume_optional_cmdline_arg "--run-as" $config::run_as]
 	# unless given as additional argument, run the pkg named after the project
-	set run_pkg [consume_optional_cmdline_arg "--pkg" $project_name]
+	set args(run_pkg)  [consume_optional_cmdline_arg "--pkg"    $config::project_name]
 }
 
 if {$perform(build)} {
-	if {[consume_optional_cmdline_switch "--warn-strict"   ]} { set warn_strict 1 }
-	if {[consume_optional_cmdline_switch "--no-warn-strict"]} { set warn_strict 0 }
+	if {[consume_optional_cmdline_switch "--warn-strict"   ]} { set config::warn_strict 1 }
+	if {[consume_optional_cmdline_switch "--no-warn-strict"]} { set config::warn_strict 0 }
 
-	if {[consume_optional_cmdline_switch "--with-backtrace"]} { set with_backtrace 1 }
+	if {[consume_optional_cmdline_switch "--with-backtrace"]} { set config::with_backtrace 1 }
 
 	# override 'debug' variable via optional command-line switch
-	if {[consume_optional_cmdline_switch "--debug"]} { set debug 1 }
+	if {[consume_optional_cmdline_switch "--debug"]}          { set config::debug 1 }
 
-	set olevel [consume_optional_cmdline_arg "--olevel" $olevel]
+	set config::olevel [consume_optional_cmdline_arg "--olevel" $config::olevel]
 }
 
 if {$perform(export)} {
-	set depot_overwrite [consume_optional_cmdline_switch "--depot-overwrite"]
-	set depot_retain    [consume_optional_cmdline_switch "--depot-retain"]
-	set depot_user      [consume_optional_cmdline_arg "--depot-user"     $depot_user]
-	set license         [consume_optional_cmdline_arg "--license"        $license]
-	set publish_pkg     [consume_optional_cmdline_arg "--pkg"            ""]
-	set sculpt_version  [consume_optional_cmdline_arg "--sculpt-version" $sculpt_version]
+	set config::depot_overwrite [consume_optional_cmdline_switch "--depot-overwrite"]
+	set config::depot_retain    [consume_optional_cmdline_switch "--depot-retain"]
+	set config::depot_user      [consume_optional_cmdline_arg "--depot-user"     $config::depot_user]
+	set config::license         [consume_optional_cmdline_arg "--license"        $config::license]
+	set config::sculpt_version  [consume_optional_cmdline_arg "--sculpt-version" $config::sculpt_version]
+	set args(publish_pkg)       [consume_optional_cmdline_arg "--pkg"            ""]
 }
 
 if {$perform(archive-versions)} {
-	set depot_user [consume_optional_cmdline_arg "--depot-user" $depot_user] }
+	set config::depot_user [consume_optional_cmdline_arg "--depot-user" $config::depot_user] }
 
 # consume target-specific arguments
-consume_prefixed_cmdline_args "--target-opt-" target_opt
+consume_prefixed_cmdline_args "--target-opt-" config::target_opt
 
 # consume package versions
-consume_prefixed_cmdline_args "--version-" version
+consume_prefixed_cmdline_args "--version-" config::version
 
 # back out if there is any unhandled argument
 if {[llength $argv] > 0} {
 	exit_with_error "invalid argument: [join $argv { }]" }
 
-if {$search_dir               == ""} { set search_dir "$original_dir" }
-if {$versions_from_genode_dir == ""} { unset versions_from_genode_dir }
-if {$license                  == ""} { unset license }
-if {$depot_user               == ""} { unset depot_user }
-if {$arch                     == ""} { unset arch }
-if {$cross_dev_prefix         == ""} { unset cross_dev_prefix }
-if {$ld_march                 == ""} { unset ld_march }
-if {$cc_march                 == ""} { unset cc_march }
-if {$run_as                   == ""} { unset run_as }
-if {$binary_name              == ""} { unset binary_name }
-
-if {![info exists arch]} {
-	switch [exec uname -m] {
-	aarch64 { set arch "arm_v8a" }
-	x86_64  { set arch "x86_64"  }
-	default { exit_with_error "CPU architecture is not defined" }
-	}
-}
-
-if {![info exists cross_dev_prefix]} {
-	switch $arch {
-	arm_v8a { set cross_dev_prefix "/usr/local/genode/tool/23.05/bin/genode-aarch64-" }
-	x86_64  { set cross_dev_prefix "/usr/local/genode/tool/23.05/bin/genode-x86-"  }
-	default { exit_with_error "tool-chain prefix is not defined" }
-	}
-}
-
-if {![info exists ld_march]} {
-	switch $arch {
-	x86_64  { set ld_march "-melf_x86_64"  }
-	default { set ld_march "" }
-	}
-}
-
-if {![info exists cc_march]} {
-	switch $arch {
-	x86_64  { set cc_march "-m64"  }
-	default { set cc_march "" }
-	}
-}
-
-set var_dir [file join $project_dir var]
-if {$common_var_dir != ""} {
-	set var_dir [file join $common_var_dir $project_name] }
+config set_late_defaults
 
-proc set_if_undefined { var_name value } {
+unset original_dir
 
-	upvar default_$var_name default_var
-	set default_var $value
-
-	upvar $var_name var
-	if {![info exists var]} {
-		set var $value }
+# make variables in config namespace immutable
+foreach var [info vars ::config::*] {
+	trace add variable $var write const_var
 }
 
-set_if_undefined depot_dir   [file join $var_dir depot]
-set_if_undefined public_dir  [file join $var_dir public]
-set_if_undefined contrib_dir [file join $var_dir contrib]
-set_if_undefined import_dir  [file join $var_dir import]
-set_if_undefined build_dir   [file join $var_dir build $arch]
-set_if_undefined abi_dir     [file join $var_dir abi   $arch]
-set_if_undefined bin_dir     [file join $var_dir bin   $arch]
-set_if_undefined dbg_dir     [file join $var_dir dbg   $arch]
-set_if_undefined run_dir     [file join $var_dir run]
-set_if_undefined api_dir     [file join $var_dir api]
-
-##
-# Return true if variable 'var_name' has not its default value
-#
-proc customized_variable { var_name } {
-	global $var_name "default_$var_name"
-	return [expr {[set $var_name] != [set "default_$var_name"]}]
-}
diff --git a/share/goa/lib/config.tcl b/share/goa/lib/config.tcl
new file mode 100644
index 0000000..669d1fb
--- /dev/null
+++ b/share/goa/lib/config.tcl
@@ -0,0 +1,239 @@
+#
+# goarc management
+#
+
+namespace eval ::config {
+	namespace export path_var_names load_goarc_files set_late_defaults
+
+	# defaults, potentially being overwritten by 'goarc' files
+	# Note: All variables in this namespace can be overwritten by 'goarc' files
+	variable project_dir              [pwd]
+	variable project_name             [file tail $project_dir]
+	variable arch                     ""
+	variable cross_dev_prefix         ""
+	variable rebuild                  0
+	variable jobs                     1
+	variable ld_march                 ""
+	variable cc_march                 ""
+	variable olevel                   "-O2"
+	variable debug                    0
+	variable versions_from_genode_dir ""
+	variable depot_overwrite          0
+	variable depot_retain             0
+	variable license                  ""
+	variable depot_user               ""
+	variable run_as                   "genodelabs"
+	variable target                   "linux"
+	variable sculpt_version           ""
+	variable cc_cxx_opt_std           "-std=gnu++20"
+	variable binary_name              ""
+	variable with_backtrace           0
+	variable common_var_dir           ""
+	variable search_dir               $::original_dir
+	variable depot_dir                ""
+	variable public_dir               ""
+	variable contrib_dir              ""
+	variable import_dir               ""
+	variable abi_dir                  ""
+	variable build_dir                ""
+	variable run_dir                  ""
+	variable bin_dir                  ""
+	variable dbg_dir                  ""
+	variable target_opt
+	array set target_opt {}
+	variable version
+	array set version {}
+
+
+	# if /proc/cpuinfo exists, use number of CPUs as 'jobs'
+	if {[file exists /proc/cpuinfo]} {
+		catch {
+			set num_cpus [exec grep "processor.*:" /proc/cpuinfo | wc -l]
+			set jobs $num_cpus
+			diag "use $jobs jobs according to /proc/cpuinfo"
+		}
+	}
+
+
+	# return names of path variables
+	proc path_var_names {} {
+		return [info vars ::config::*_dir] }
+
+
+	proc _path_var { name } {
+		if {[lsearch -exact [path_var_names] ::config::$name] >= 0} {
+			return 1 }
+
+		return [string equal $name "cross_dev_prefix"] \
+		    || [string equal $name "license"]
+	}
+
+
+	# used as alias for 'set' in child interpreter
+	proc _safe_set { rcfile args } {
+		set nargs [llength $args]
+		if {$nargs < 1} { return }
+
+		set name [lindex $args 0]
+
+		if {![info exists ::config::[lindex [split $name "("] 0]]} {
+			diag "variable '$name' defined in $rcfile is not a config variable"
+			return
+		}
+
+		if {$nargs == 1} {
+			return [set $name] }
+
+		set value [lindex $args 1]
+
+		if {[llength $value] > 1} {
+			exit_with_error "$rcfile contains malformed definition of $name" }
+
+		if {![_path_var $name]} {
+			# non-path variables must not contain slashes
+			if {[string first / $value] >= 0} {
+				exit_with_error "Variable definition of '$name' in $rcfile" \
+				                "must not contain slashes."
+			}
+		} else {
+			# de-reference home directory
+			regsub {^~} $::env(HOME) value
+
+			# convert relative path to absolute path
+			set value [file normalize $value]
+		}
+
+		return [set ::config::$name $value]
+	}
+
+
+	proc load_goarc_files {} {
+		global tool_dir config::project_dir
+
+		interp create -safe safeinterp
+		safeinterp hide set
+
+		set rcfile [file join $tool_dir goarc]
+		safeinterp alias set config::_safe_set $rcfile
+		safeinterp invokehidden source $rcfile
+
+		#
+		# Read the hierarcy of 'goarc' files
+		#
+
+		set goarc_path_elements [file split $project_dir]
+		set goarc_name "goarc"
+		set goarc_path [file separator]
+
+		foreach path_elem $goarc_path_elements {
+
+			set goarc_path           [file join $goarc_path $path_elem]
+			set goarc_path_candidate [file join $goarc_path $goarc_name]
+			set deprecated_goarc     [file join $goarc_path .$goarc_name]
+
+			if {[file exists $deprecated_goarc]} {
+				log "ignoring hidden '.goarc' file at $goarc_path\n" \
+				    "\n Consider renaming the file to 'goarc' instead\n" }
+
+			if {[file exists $goarc_path_candidate]} {
+
+				set goarc_file_path [file join $goarc_path $goarc_name]
+
+				#
+				# Change to the directory of the goarc file before including it
+				# so that the commands of the file are executed in the expected
+				# directory.
+				#
+				cd $goarc_path
+				safeinterp alias set config::_safe_set $goarc_file_path
+				safeinterp invokehidden source $goarc_file_path
+			}
+		}
+
+		interp delete safeinterp
+
+		# revert original current working directory
+		cd $project_dir
+	}
+
+
+	proc set_late_defaults {} {
+		variable project_dir
+		variable project_name
+		variable common_var_dir
+		variable versions_from_genode_dir
+		variable license
+		variable depot_user
+		variable arch
+		variable cross_dev_prefix
+		variable ld_march
+		variable cc_march
+		variable run_as
+		variable binary_name
+		variable var_dir
+
+		if {$versions_from_genode_dir == ""} { unset versions_from_genode_dir }
+		if {$license                  == ""} { unset license }
+		if {$depot_user               == ""} { unset depot_user }
+		if {$arch                     == ""} { unset arch }
+		if {$cross_dev_prefix         == ""} { unset cross_dev_prefix }
+		if {$ld_march                 == ""} { unset ld_march }
+		if {$cc_march                 == ""} { unset cc_march }
+		if {$run_as                   == ""} { unset run_as }
+		if {$binary_name              == ""} { unset binary_name }
+
+		if {![info exists arch]} {
+			switch [exec uname -m] {
+			aarch64 { set arch "arm_v8a" }
+			x86_64  { set arch "x86_64"  }
+			default { exit_with_error "CPU architecture is not defined" }
+			}
+		}
+
+		if {![info exists cross_dev_prefix]} {
+			switch $arch {
+			arm_v8a { set cross_dev_prefix "/usr/local/genode/tool/23.05/bin/genode-aarch64-" }
+			x86_64  { set cross_dev_prefix "/usr/local/genode/tool/23.05/bin/genode-x86-"  }
+			default { exit_with_error "tool-chain prefix is not defined" }
+			}
+		}
+
+		if {![info exists ld_march]} {
+			switch $arch {
+			x86_64  { set ld_march "-melf_x86_64"  }
+			default { set ld_march "" }
+			}
+		}
+
+		if {![info exists cc_march]} {
+			switch $arch {
+			x86_64  { set cc_march "-m64"  }
+			default { set cc_march "" }
+			}
+		}
+
+		set var_dir [file join $project_dir var]
+		if {$common_var_dir != ""} {
+			set var_dir [file join $common_var_dir $project_name] }
+
+		proc set_if_undefined { var_name value } {
+			upvar ::config::$var_name var
+			if {![info exists var] || $var == ""} {
+				set var $value }
+		}
+
+		set_if_undefined depot_dir   [file join $var_dir depot]
+		set_if_undefined public_dir  [file join $var_dir public]
+		set_if_undefined contrib_dir [file join $var_dir contrib]
+		set_if_undefined import_dir  [file join $var_dir import]
+		set_if_undefined build_dir   [file join $var_dir build $arch]
+		set_if_undefined abi_dir     [file join $var_dir abi   $arch]
+		set_if_undefined bin_dir     [file join $var_dir bin   $arch]
+		set_if_undefined dbg_dir     [file join $var_dir dbg   $arch]
+		set_if_undefined run_dir     [file join $var_dir run]
+		set_if_undefined api_dir     [file join $var_dir api]
+	}
+
+	# make namespace procs available as subcommands
+	namespace ensemble create
+}
diff --git a/share/goa/lib/run/common.tcl b/share/goa/lib/run/common.tcl
index b0901dc..a96ee5e 100644
--- a/share/goa/lib/run/common.tcl
+++ b/share/goa/lib/run/common.tcl
@@ -4,7 +4,7 @@
 # Otherwise it returns an empty string.
 #
 proc _find_rom_in_archives { rom_name binary_archives } {
-	global depot_dir
+	global config::depot_dir
 
 	foreach archive $binary_archives {
 		set file_path [file join $depot_dir $archive $rom_name]
@@ -189,7 +189,7 @@ proc generate_runtime_config { runtime_file &runtime_archives &rom_modules } {
 	upvar 1 ${&runtime_archives} runtime_archives
 	upvar 1 ${&rom_modules} rom_modules
 
-	global run_pkg run_dir var_dir run_as bin_dir
+	global args config::run_dir config::var_dir config::run_as config::bin_dir
 
 	set ram    [try_query_attr_from_file $runtime_file ram]
 	set caps   [try_query_attr_from_file $runtime_file caps]
@@ -378,7 +378,7 @@ proc generate_runtime_config { runtime_file &runtime_archives &rom_modules } {
 
 			} $start_nodes {
 
-			<start name="} $run_pkg {" caps="} $caps {">
+			<start name="} $args(run_pkg) {" caps="} $caps {">
 				<resource name="RAM" quantum="} $ram {"/>
 				<binary name="} $binary {"/>
 				<provides>} $provides {</provides>
diff --git a/share/goa/lib/run/linux.tcl b/share/goa/lib/run/linux.tcl
index 60eb4df..cc8934f 100644
--- a/share/goa/lib/run/linux.tcl
+++ b/share/goa/lib/run/linux.tcl
@@ -1,5 +1,5 @@
 proc run_genode { } {
-	global run_dir var_dir project_name depot_dir debug
+	global config::run_dir config::var_dir config::project_name config::depot_dir config::debug
 
 	##
 	# create helper file for gdb
@@ -40,7 +40,7 @@ proc parent_services { } {
 
 
 proc base_archives { } {
-	global run_as
+	global config::run_as
 
 	return [list "$run_as/src/base-linux" "$run_as/src/init"]
 }
@@ -225,7 +225,7 @@ proc bind_required_services { &services } {
 			}
 		}
 
-		global run_dir var_dir
+		global config::run_dir config::var_dir
 		# link all file systems to run_dir
 		file link -symbolic "$run_dir/fs" "$var_dir/fs"
 
@@ -321,7 +321,7 @@ proc bind_required_services { &services } {
 			_instantiate_rom_provider start_nodes archives modules
 
 			# link the rom directory
-			global run_dir var_dir
+			global config::run_dir config::var_dir
 			file link -symbolic "$run_dir/rom" "$var_dir/rom"
 		}
 	}
@@ -357,7 +357,7 @@ proc _instantiate_nitpicker { &start_nodes &archives &modules } {
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global run_as
+	global config::run_as
 
 	append start_nodes {
 			<start name="drivers" caps="1000">
@@ -471,7 +471,7 @@ proc _instantiate_network { tap_name subnet_id &start_nodes &archives &modules &
 	upvar 1 ${&modules} modules
 	upvar 1 ${&nic_node} nic_node
 
-	global run_as
+	global config::run_as
 
 	set driver_name nic_drv_$tap_name
 	set router_name nic_router_$tap_name
@@ -556,7 +556,7 @@ proc _instantiate_uplink_client { uplink_label &start_nodes &archives &modules }
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global project_name run_as
+	global config::project_name config::run_as
 
 	append start_nodes "\n" {
 			<start name="nic_drv" caps="100" ld="no">
@@ -586,7 +586,7 @@ proc _instantiate_fonts_fs { &start_nodes &archives &modules } {
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global run_as
+	global config::run_as
 
 	append start_nodes {
 		<start name="fonts_fs" caps="100">
@@ -614,7 +614,7 @@ proc _instantiate_file_system { name label writeable &start_nodes &archives &mod
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global var_dir run_as
+	global config::var_dir config::run_as
 
 	# make sure label is not empty
 	if {$label == ""} { set label "_" }
@@ -654,7 +654,7 @@ proc _instantiate_rom_provider { &start_nodes &archives &modules } {
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global run_as var_dir
+	global config::run_as config::var_dir
 
 	append start_nodes {
 			<start name="rom_fs" ld="no" caps="100">
@@ -705,7 +705,7 @@ proc _instantiate_rtc { &start_nodes &archives &modules } {
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global run_as
+	global config::run_as
 
 	append start_nodes {
 			<start name="rtc_drv" caps="100" ld="no">
@@ -727,7 +727,7 @@ proc _instantiate_clipboard { &start_nodes &archives &modules } {
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global project_name run_as
+	global config::project_name config::run_as
 
 	append start_nodes {
 			<start name="clipboard" caps="100">
diff --git a/share/goa/lib/run/sculpt.tcl b/share/goa/lib/run/sculpt.tcl
index f83c823..00fed9a 100644
--- a/share/goa/lib/run/sculpt.tcl
+++ b/share/goa/lib/run/sculpt.tcl
@@ -1,5 +1,7 @@
 proc run_genode { } {
-	global run_dir tool_dir var_dir target target_opt project_name depot_dir debug
+	global tool_dir
+	global config::run_dir config::var_dir config::target config::target_opt
+	global config::project_name config::depot_dir config::debug
 
 	if {![info exists target_opt($target-server)]} {
 		exit_with_error "missing target option '$target-server'\n" \
@@ -100,7 +102,7 @@ proc parent_services { } {
 
 
 proc base_archives { } {
-	global run_as target target_opt
+	global config::run_as config::target config::target_opt
 
 	if {[info exists target_opt($target-kernel)]} {
 		set kernel $target_opt($target-kernel)
@@ -116,7 +118,7 @@ proc log_route { } { return "<parent/>" }
 
 
 proc pd_route  { } {
-	global debug
+	global config::debug
 	if { $debug } { return "<local/>" }
 
 	return "<parent/>"
@@ -124,7 +126,7 @@ proc pd_route  { } {
 
 
 proc cpu_route { } {
-	global debug
+	global config::debug
 	if { $debug } { return "<local/>" }
 
 	return "<parent/>"
@@ -277,7 +279,7 @@ proc _instantiate_fonts_fs { &start_nodes &archives &modules } {
 	upvar 1 ${&archives} archives
 	upvar 1 ${&modules} modules
 
-	global run_as
+	global config::run_as
 
 	append start_nodes {
 			<start name="fonts_fs" caps="100">
diff --git a/share/goa/lib/util.tcl b/share/goa/lib/util.tcl
index d24217c..63a469a 100644
--- a/share/goa/lib/util.tcl
+++ b/share/goa/lib/util.tcl
@@ -15,7 +15,7 @@ proc stacktrace { } {
 
 
 proc exit_with_error { args } {
-	global project_name verbose
+	global config::project_name verbose
 	puts stderr "\[$project_name\] Error: [join $args { }]"
 	if {$verbose} { stacktrace }
 	exit 1
@@ -26,7 +26,7 @@ proc exit_with_error { args } {
 # Print diagnostic message in verbose mode
 #
 proc diag { args } {
-	global verbose project_name
+	global verbose config::project_name
 	if {$verbose} {
 		puts "\[$project_name\] [join $args { }]" }
 }
@@ -36,7 +36,7 @@ proc diag { args } {
 # Unconditionally print message, prefixed with the project name
 #
 proc log { args } {
-	global project_name
+	global config::project_name
 	puts "\[$project_name\] [join $args { }]"
 }
 
@@ -155,7 +155,7 @@ proc consume_prefixed_cmdline_args { prefix &var } {
 
 
 proc depot_policy { } {
-	global depot_overwrite depot_retain
+	global config::depot_overwrite config::depot_retain
 
 	if { $depot_retain }    { return "retain" }
 	if { $depot_overwrite } { return "overwrite" }
@@ -261,7 +261,7 @@ proc looks_like_goa_project_dir { dir } {
 # Build up cache of potential project directories
 #
 proc _build_project_dir_cache { type } {
-	global search_dir project_dir_cache
+	global config::search_dir project_dir_cache
 
 	if {![array exists project_dir_cache]} {
 		array set project_dir_cache {} }
@@ -320,7 +320,7 @@ proc _build_project_dir_cache { type } {
 # called with -C or from $search_dir
 #
 proc find_project_dir_for_archive { type name } {
-	global search_dir project_dir_cache
+	global config::search_dir project_dir_cache
 
 	if {$type == "bin"} {
 		set type "src" }
@@ -361,7 +361,7 @@ proc project_version_from_file { dir } {
 # Determine project version for a particular archive during export
 #
 proc exported_project_archive_version { dir archive } {
-	global version
+	global config::version
 
 	catch {
 		set archive_version [project_version_from_file $dir]
@@ -395,7 +395,7 @@ proc exported_project_archive_version { dir archive } {
 # If no version information is available, the original working directory is
 # scanned for corresponding Goa projects.
 proc apply_versions { archive_list } {
-	global version versions_from_genode_dir
+	global config::version config::versions_from_genode_dir
 
 	set versioned_archives { }
 	foreach archive $archive_list {
@@ -464,7 +464,7 @@ proc apply_arch { archive arch } {
 # Return list of binary archives for a given list of versioned source archives
 #
 proc binary_archives { archive_list } {
-	global arch depot_dir
+	global config::arch config::depot_dir
 
 	set bin_archives { }
 	foreach archive $archive_list {
@@ -502,7 +502,7 @@ proc binary_archives { archive_list } {
 # Return list of runtime files for a given list of versioned archives
 #
 proc runtime_files { archive_list } {
-	global arch depot_dir
+	global config::arch config::depot_dir
 
 	set runtime_file_list { }
 	foreach archive $archive_list {
@@ -607,7 +607,7 @@ proc archive_user { archive } {
 
 
 proc api_archive_dir { api_name } {
-	global used_apis depot_dir
+	global config::depot_dir
 	foreach archive [goa used_apis] {
 		archive_parts $archive user type name version
 		if {$version != "" && $name == $api_name} {
@@ -649,8 +649,7 @@ proc symlink_directory_content { file_whitelist from_dir to_dir } {
 #
 proc mirror_source_dir_to_build_dir { } {
 
-	global build_dir
-	global project_dir
+	global config::build_dir config::project_dir
 
 	#
 	# Mirror structure of source dir in build dir using symbolic links
@@ -695,7 +694,7 @@ proc mirror_source_dir_to_build_dir { } {
 # Install Genode config into run directory
 #
 proc install_config { args } {
-	global run_dir
+	global config::run_dir
 	set fh [open [file join $run_dir config] "WRONLY CREAT TRUNC"]
 	set lines [split [join $args {}] "\n"]
 
@@ -873,7 +872,7 @@ proc avail_goa_branches { } {
 
 proc assert_definition_of_depot_user { } {
 
-	global depot_user
+	global config::depot_user
 	if {[info exists depot_user]} {
 		return }
 
@@ -888,7 +887,7 @@ proc assert_definition_of_depot_user { } {
 # strip debug symbols from binary
 #
 proc strip_binary { file } {
-	global cross_dev_prefix
+	global config::cross_dev_prefix
 
 	set cmd "$cross_dev_prefix\strip"
 	lappend cmd "$file"
@@ -901,7 +900,7 @@ proc strip_binary { file } {
 # extract debug info files
 #
 proc extract_debug_info { file } {
-	global cross_dev_prefix dbg_dir
+	global config::cross_dev_prefix config::dbg_dir
 
 	##
 	# check whether file has debug info and bail if not