diff --git a/.gitignore b/.gitignore
index 68361591c2..1a1836e133 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@
 /Doxyfile
 /setupenv.bash
 /autom4te.cache
+/port.sh
 
 doc/*.gz
 doc/*.mtree
@@ -21,8 +22,8 @@ src/*
 !src/*/
 src/*/*_autoconf.tcl
 src/cregistry/macports.sqlext
-src/darwintracelib1.0/*.d
-src/darwintracelib1.0/sip_copy_proc.[ch]
+src/darwintrace1.0/*.d
+src/darwintrace1.0/sip_copy_proc.[ch]
 src/machista1.0/tests/libmachista-test
 src/port/*
 !src/port/*.tcl
diff --git a/Makefile.in b/Makefile.in
index 96119fa8ec..fe7d56b1ee 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -16,7 +16,7 @@ include Mk/macports.autoconf.mk
 
 all:: Mk/macports.autoconf.mk
 
-Mk/macports.autoconf.mk: Mk/macports.autoconf.mk.in src/config.h.in Makefile.in doc/Makefile.in src/Makefile.in src/cregistry/Makefile.in src/darwintracelib1.0/Makefile.in src/machista1.0/Makefile.in src/macports1.0/Makefile.in src/mpcommon1.0/Makefile.in src/package1.0/Makefile.in src/pextlib1.0/Makefile.in src/port/Makefile.in src/port1.0/Makefile.in src/programs/Makefile.in src/programs/daemondo/Makefile.in src/registry2.0/Makefile.in tests/Makefile.in vendor/Makefile.in config.status
+Mk/macports.autoconf.mk: Mk/macports.autoconf.mk.in src/config.h.in Makefile.in doc/Makefile.in src/Makefile.in src/cregistry/Makefile.in src/darwintrace1.0/Makefile.in src/machista1.0/Makefile.in src/macports1.0/Makefile.in src/mpcommon1.0/Makefile.in src/package1.0/Makefile.in src/pextlib1.0/Makefile.in src/port/Makefile.in src/port1.0/Makefile.in src/programs/Makefile.in src/programs/daemondo/Makefile.in src/registry2.0/Makefile.in tests/Makefile.in vendor/Makefile.in config.status
 	./config.status
 	${MAKE} clean
 
@@ -156,7 +156,7 @@ test::
 # want things getting rebuilt after they're signed just because a dependency
 # has a later mtime because it was also signed.
 codesign::
-	@for subdir in vendor src/darwintracelib1.0 src/machista1.0 src/macports1.0 src/registry2.0 src/pextlib1.0 src/programs/daemondo ; do\
+	@for subdir in vendor src/darwintrace1.0 src/machista1.0 src/macports1.0 src/registry2.0 src/pextlib1.0 src/programs/daemondo ; do\
 		echo ===\> making $@ in ${DIRPRFX}$$subdir; \
 		( cd $$subdir && $(MAKE) DIRPRFX=${DIRPRFX}$$subdir/ $@) || exit 1; \
 	done
diff --git a/configure b/configure
index e71cddeafd..87ded6af63 100755
--- a/configure
+++ b/configure
@@ -3213,6 +3213,27 @@ printf "%s\n" "$as_me: WARNING: Please consider upgrading as some ports fail com
         ;;
 esac
 
+# Check whether the source location is valid; Tcl does not build in
+# locations containing spaces, and we don't support out-of-source
+# builds.
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for in-tree build" >&5
+printf %s "checking for in-tree build... " >&6; }
+if test "x$srcdir" != "x."; then
+   as_fn_error $? "failed; out-of-source builds not supported" "$LINENO" 5
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ok" >&5
+printf "%s\n" "ok" >&6; }
+fi
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether source directory location is valid" >&5
+printf %s "checking whether source directory location is valid... " >&6; }
+if echo "$ac_abs_confdir" | grep -q ' '; then
+   as_fn_error $? "failed; path to source directory must not contain spaces" "$LINENO" 5
+else
+  { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: ok" >&5
+printf "%s\n" "ok" >&6; }
+fi
+
 # Checks for programs.
 
 
@@ -9991,8 +10012,10 @@ printf "%s\n" "yes" >&6; }
 
 
 # Output
-ac_config_files="$ac_config_files Doxyfile Makefile Mk/macports.autoconf.mk doc/Makefile doc/base.mtree doc/macosx.mtree doc/macports.conf doc/prefix.mtree doc/pubkeys.conf portmgr/dmg/postflight setupenv.bash src/Makefile src/cregistry/Makefile src/compat/Makefile src/darwintracelib1.0/Makefile src/machista1.0/Makefile src/macports1.0/Makefile src/macports1.0/macports_autoconf.tcl src/macports1.0/macports_test_autoconf.tcl src/mpcommon1.0/Makefile src/package1.0/Makefile src/package1.0/package_test_autoconf.tcl src/pextlib1.0/Makefile src/port/Makefile src/port1.0/Makefile src/port1.0/port_autoconf.tcl src/port1.0/port_test_autoconf.tcl src/programs/Makefile src/registry2.0/Makefile src/registry2.0/registry_autoconf.tcl tests/Makefile tests/test.tcl tests/test/library.tcl tests/test/trace/test.tcl vendor/Makefile"
+ac_config_files="$ac_config_files Doxyfile Makefile Mk/macports.autoconf.mk doc/Makefile doc/base.mtree doc/macosx.mtree doc/macports.conf doc/prefix.mtree doc/pubkeys.conf portmgr/dmg/postflight setupenv.bash src/Makefile src/cregistry/Makefile src/compat/Makefile src/darwintrace1.0/Makefile src/machista1.0/Makefile src/macports1.0/Makefile src/macports1.0/macports_autoconf.tcl src/macports1.0/macports_test_autoconf.tcl src/mpcommon1.0/Makefile src/package1.0/Makefile src/package1.0/package_test_autoconf.tcl src/pextlib1.0/Makefile src/port/Makefile src/port1.0/Makefile src/port1.0/port_autoconf.tcl src/port1.0/port_test_autoconf.tcl src/programs/Makefile src/registry2.0/Makefile src/registry2.0/registry_autoconf.tcl tests/Makefile tests/test.tcl tests/test/library.tcl tests/test/trace/test.tcl vendor/Makefile"
+
 
+ac_config_files="$ac_config_files port.sh"
 
 ac_config_files="$ac_config_files vendor/tclsh"
 
@@ -10708,7 +10731,7 @@ do
     "src/Makefile") CONFIG_FILES="$CONFIG_FILES src/Makefile" ;;
     "src/cregistry/Makefile") CONFIG_FILES="$CONFIG_FILES src/cregistry/Makefile" ;;
     "src/compat/Makefile") CONFIG_FILES="$CONFIG_FILES src/compat/Makefile" ;;
-    "src/darwintracelib1.0/Makefile") CONFIG_FILES="$CONFIG_FILES src/darwintracelib1.0/Makefile" ;;
+    "src/darwintrace1.0/Makefile") CONFIG_FILES="$CONFIG_FILES src/darwintrace1.0/Makefile" ;;
     "src/machista1.0/Makefile") CONFIG_FILES="$CONFIG_FILES src/machista1.0/Makefile" ;;
     "src/macports1.0/Makefile") CONFIG_FILES="$CONFIG_FILES src/macports1.0/Makefile" ;;
     "src/macports1.0/macports_autoconf.tcl") CONFIG_FILES="$CONFIG_FILES src/macports1.0/macports_autoconf.tcl" ;;
@@ -10729,6 +10752,7 @@ do
     "tests/test/library.tcl") CONFIG_FILES="$CONFIG_FILES tests/test/library.tcl" ;;
     "tests/test/trace/test.tcl") CONFIG_FILES="$CONFIG_FILES tests/test/trace/test.tcl" ;;
     "vendor/Makefile") CONFIG_FILES="$CONFIG_FILES vendor/Makefile" ;;
+    "port.sh") CONFIG_FILES="$CONFIG_FILES port.sh" ;;
     "vendor/tclsh") CONFIG_FILES="$CONFIG_FILES vendor/tclsh" ;;
     "src/cxx_stdlib_overridden.tcl") CONFIG_FILES="$CONFIG_FILES src/cxx_stdlib_overridden.tcl" ;;
     "src/dedup_portfiles.tcl") CONFIG_FILES="$CONFIG_FILES src/dedup_portfiles.tcl" ;;
@@ -11287,6 +11311,7 @@ printf "%s\n" "$as_me: $ac_file is unchanged" >&6;}
 
 
   case $ac_file$ac_mode in
+    "port.sh":F) chmod +x port.sh ;;
     "vendor/tclsh":F) chmod +x vendor/tclsh ;;
     "src/cxx_stdlib_overridden.tcl":F) chmod +x src/cxx_stdlib_overridden.tcl ;;
     "src/dedup_portfiles.tcl":F) chmod +x src/dedup_portfiles.tcl ;;
diff --git a/configure.ac b/configure.ac
index d06d62b704..fa8c658d01 100644
--- a/configure.ac
+++ b/configure.ac
@@ -101,6 +101,23 @@ case "$XCODE_VERSION" in
     ;;
 esac
 
+# Check whether the source location is valid; Tcl does not build in
+# locations containing spaces, and we don't support out-of-source
+# builds.
+AC_MSG_CHECKING(for in-tree build)
+if test "x$srcdir" != "x."; then
+   AC_MSG_ERROR([failed; out-of-source builds not supported])
+else
+  AC_MSG_RESULT([ok])
+fi
+
+AC_MSG_CHECKING(whether source directory location is valid)
+if echo "$ac_abs_confdir" | grep -q ' '; then
+   AC_MSG_ERROR([failed; path to source directory must not contain spaces])
+else
+  AC_MSG_RESULT([ok])
+fi
+
 # Checks for programs.
 AC_PROG_CC([clang cc gcc])
 AC_PROG_INSTALL
@@ -422,7 +439,7 @@ AC_CONFIG_FILES([
 	src/Makefile
 	src/cregistry/Makefile
 	src/compat/Makefile
-	src/darwintracelib1.0/Makefile
+	src/darwintrace1.0/Makefile
 	src/machista1.0/Makefile
 	src/macports1.0/Makefile
 	src/macports1.0/macports_autoconf.tcl
@@ -445,6 +462,7 @@ AC_CONFIG_FILES([
 	vendor/Makefile
 ])
 
+AC_CONFIG_FILES([port.sh], [chmod +x port.sh])
 AC_CONFIG_FILES([vendor/tclsh], [chmod +x vendor/tclsh])
 AC_CONFIG_FILES([src/cxx_stdlib_overridden.tcl], [chmod +x src/cxx_stdlib_overridden.tcl])
 AC_CONFIG_FILES([src/dedup_portfiles.tcl], [chmod +x src/dedup_portfiles.tcl])
diff --git a/port.sh.in b/port.sh.in
new file mode 100644
index 0000000000..626652a281
--- /dev/null
+++ b/port.sh.in
@@ -0,0 +1,40 @@
+#!/bin/sh
+#
+# Simple shell script to invoke MacPorts from the source directory
+#
+
+# force the locally built, vendored Tcl
+export TCL_LIBRARY="@abs_srcdir@/@VENDOR_DESTROOT@@TCL_PACKAGE_PATH@/tcl@TCL_VERSION@"
+
+# tell it about the location of the MacPorts source files
+export TCLLIBPATH="@abs_srcdir@/src"
+
+# this sandbox profile actively prevents MacPorts from loading the Tcl
+# sources from @prefix@
+sandbox_profile="
+(version 1)
+
+; allow everything
+(allow default)
+
+; ...but deny access to installed Tcl files
+(deny file* (subpath \"@TCL_PREFIX@\"))
+
+; ...and fix trace mode by allowing reexecution in another sandbox
+(allow process-exec (with no-sandbox)
+ (literal \"@SANDBOX_EXEC@\")
+ (regex #\"^@DARWINTRACE_SIP_WORKAROUND_PATH@/[0-9]*@SANDBOX_EXEC@\$\"))
+"
+
+# give a nice error if the source isn't built
+if ! [ -d "$TCL_LIBRARY" ] || ! [ -f "@abs_srcdir@/src/port/port" ]
+then
+    echo "please build MacPorts before running this script!" 1>&2
+    exit 1
+elif [ -z "@SANDBOX_EXEC@" ]
+then
+    exec "@INTREE_TCLSH@" "@abs_srcdir@/src/port/port" "$@"
+else
+    exec "@SANDBOX_EXEC@" -p "$sandbox_profile" \
+         "@INTREE_TCLSH@" "@abs_srcdir@/src/port/port" "$@"
+fi
diff --git a/src/Makefile.in b/src/Makefile.in
index a3085ab155..120fa05253 100644
--- a/src/Makefile.in
+++ b/src/Makefile.in
@@ -12,7 +12,7 @@ TCLPKG=		cregistry \
 SUBDIR=		compat ${TCLPKG} port programs
 
 ifeq (@TRACEMODE_SUPPORT@,1)
-TCLPKG+= darwintracelib1.0
+TCLPKG+= darwintrace1.0
 endif
 
 all::
diff --git a/src/darwintracelib1.0/Makefile.in b/src/darwintrace1.0/Makefile.in
similarity index 100%
rename from src/darwintracelib1.0/Makefile.in
rename to src/darwintrace1.0/Makefile.in
diff --git a/src/darwintracelib1.0/access.c b/src/darwintrace1.0/access.c
similarity index 100%
rename from src/darwintracelib1.0/access.c
rename to src/darwintrace1.0/access.c
diff --git a/src/darwintracelib1.0/close.c b/src/darwintrace1.0/close.c
similarity index 100%
rename from src/darwintracelib1.0/close.c
rename to src/darwintrace1.0/close.c
diff --git a/src/darwintracelib1.0/darwintrace.c b/src/darwintrace1.0/darwintrace.c
similarity index 100%
rename from src/darwintracelib1.0/darwintrace.c
rename to src/darwintrace1.0/darwintrace.c
diff --git a/src/darwintracelib1.0/darwintrace.h b/src/darwintrace1.0/darwintrace.h
similarity index 100%
rename from src/darwintracelib1.0/darwintrace.h
rename to src/darwintrace1.0/darwintrace.h
diff --git a/src/darwintracelib1.0/dup2.c b/src/darwintrace1.0/dup2.c
similarity index 100%
rename from src/darwintracelib1.0/dup2.c
rename to src/darwintrace1.0/dup2.c
diff --git a/src/darwintracelib1.0/mkdir.c b/src/darwintrace1.0/mkdir.c
similarity index 100%
rename from src/darwintracelib1.0/mkdir.c
rename to src/darwintrace1.0/mkdir.c
diff --git a/src/darwintracelib1.0/open.c b/src/darwintrace1.0/open.c
similarity index 100%
rename from src/darwintracelib1.0/open.c
rename to src/darwintrace1.0/open.c
diff --git a/src/darwintracelib1.0/proc.c b/src/darwintrace1.0/proc.c
similarity index 100%
rename from src/darwintracelib1.0/proc.c
rename to src/darwintrace1.0/proc.c
diff --git a/src/darwintracelib1.0/readdir.c b/src/darwintrace1.0/readdir.c
similarity index 100%
rename from src/darwintracelib1.0/readdir.c
rename to src/darwintrace1.0/readdir.c
diff --git a/src/darwintracelib1.0/readlink.c b/src/darwintrace1.0/readlink.c
similarity index 100%
rename from src/darwintracelib1.0/readlink.c
rename to src/darwintrace1.0/readlink.c
diff --git a/src/darwintracelib1.0/rename.c b/src/darwintrace1.0/rename.c
similarity index 100%
rename from src/darwintracelib1.0/rename.c
rename to src/darwintrace1.0/rename.c
diff --git a/src/darwintracelib1.0/rmdir.c b/src/darwintrace1.0/rmdir.c
similarity index 100%
rename from src/darwintracelib1.0/rmdir.c
rename to src/darwintrace1.0/rmdir.c
diff --git a/src/darwintracelib1.0/sandbox_actions.h b/src/darwintrace1.0/sandbox_actions.h
similarity index 100%
rename from src/darwintracelib1.0/sandbox_actions.h
rename to src/darwintrace1.0/sandbox_actions.h
diff --git a/src/darwintracelib1.0/stat.c b/src/darwintrace1.0/stat.c
similarity index 100%
rename from src/darwintracelib1.0/stat.c
rename to src/darwintrace1.0/stat.c
diff --git a/src/darwintracelib1.0/unlink.c b/src/darwintrace1.0/unlink.c
similarity index 100%
rename from src/darwintracelib1.0/unlink.c
rename to src/darwintrace1.0/unlink.c
diff --git a/src/macports1.0/macports.tcl b/src/macports1.0/macports.tcl
index c1f34bfeaa..9deeb96b37 100644
--- a/src/macports1.0/macports.tcl
+++ b/src/macports1.0/macports.tcl
@@ -1218,6 +1218,7 @@ match macports.conf.default."
         USER GROUP LANG
         http_proxy HTTPS_PROXY FTP_PROXY ALL_PROXY NO_PROXY
         COLUMNS LINES
+        TCLLIBPATH TCL_LIBRARY
     }
     if {[info exists extra_env]} {
         set keepenvkeys [concat $keepenvkeys $extra_env]
diff --git a/src/pextlib1.0/Makefile.in b/src/pextlib1.0/Makefile.in
index 10ccdda66c..feb8578870 100644
--- a/src/pextlib1.0/Makefile.in
+++ b/src/pextlib1.0/Makefile.in
@@ -49,7 +49,7 @@ INSTALLDIR= ${TCL_PACKAGE_PATH}/pextlib1.0
 include $(srcdir)/../../Mk/macports.tea.mk
 
 # tracelib.o has an additional dependency
-tracelib.o: ../darwintracelib1.0/sandbox_actions.h
+tracelib.o: ../darwintrace1.0/sandbox_actions.h
 
 CFLAGS+= ${CURL_CFLAGS} ${MD5_CFLAGS} ${READLINE_CFLAGS}
 LIBS+= ${CURL_LIBS} ${MD5_LIBS} ${READLINE_LIBS}
diff --git a/src/pextlib1.0/tracelib.c b/src/pextlib1.0/tracelib.c
index fa96dfd690..39564b749d 100644
--- a/src/pextlib1.0/tracelib.c
+++ b/src/pextlib1.0/tracelib.c
@@ -59,7 +59,7 @@
 #include <cregistry/portgroup.h>
 #include <cregistry/entry.h>
 #include <registry2.0/registry.h>
-#include <darwintracelib1.0/sandbox_actions.h>
+#include <darwintrace1.0/sandbox_actions.h>
 
 #if defined(LOCAL_PEERPID) && defined(HAVE_LIBPROC_H)
 #include <libproc.h>
diff --git a/src/port1.0/portsandbox.tcl b/src/port1.0/portsandbox.tcl
index cff38a6d9c..429c43d5ed 100644
--- a/src/port1.0/portsandbox.tcl
+++ b/src/port1.0/portsandbox.tcl
@@ -44,7 +44,7 @@ default portsandbox_profile {}
 # sandbox-exec -p '(version 1) (allow default) (deny file-write*) (allow file-write* <filter>)' some-command
 proc portsandbox::set_profile {target} {
     global os.major portsandbox_profile workpath distpath \
-        package.destpath configure.ccache ccache_dir \
+        package.destpath configure.ccache ccache_dir env \
         sandbox_network configure.distcc porttrace prefix_frozen
 
     switch $target {
@@ -101,6 +101,22 @@ proc portsandbox::set_profile {target} {
         lappend perms file-write-setugid
     }
 
+    if {[info exists env(TCL_LIBRARY)]} {
+        ui_debug "adding ${env(TCL_LIBRARY)} to allowed Sandbox paths"
+        append portsandbox_profile "\
+(allow file-read* (subpath \"${env(TCL_LIBRARY)}\"))
+"
+    }
+
+
+    if {[info exists env(TCLLIBPATH)]} {
+        foreach libpath $env(TCLLIBPATH) {
+            ui_debug "adding ${libpath} to allowed Sandbox paths"
+            append portsandbox_profile "\
+(allow file-read* (subpath \"${libpath}\"))
+"
+        }
+    }
     # If ${prefix} is on its own volume, grant access to its
     # temporary items directory, used by Xcode tools
     if {[catch {get_mountpoint ${prefix_frozen}} mountpoint]} {
diff --git a/src/port1.0/porttrace.tcl b/src/port1.0/porttrace.tcl
index e3beab91eb..19da64846f 100644
--- a/src/port1.0/porttrace.tcl
+++ b/src/port1.0/porttrace.tcl
@@ -164,7 +164,8 @@ namespace eval porttrace {
         create_slave $workpath $fifo
 
         # Launch darwintrace.dylib.
-        set darwintracepath [file join ${portutil::autoconf::tcl_package_path} darwintrace1.0 darwintrace.dylib]
+        set pkgdir [file dirname [file dirname [dict get [info frame -1] file]]]
+        set darwintracepath [file join ${pkgdir} darwintrace1.0 darwintrace.dylib]
 
         # Add darwintrace.dylib as last entry in DYLD_INSERT_LIBRARIES
         if {[info exists env(DYLD_INSERT_LIBRARIES)] && [string length $env(DYLD_INSERT_LIBRARIES)] > 0} {