Skip to content

build(deps): Migrate LibArchive dependency to task-based installation: #1122

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 23 commits into
base: main
Choose a base branch
from
Open

build(deps): Migrate LibArchive dependency to task-based installation: #1122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
280ba24
Remove current libarchive installations from all os platforms
Bill-hbrhbr Jul 22, 2025
0f97d9b
Use task to install a fixed version of libarchive
Bill-hbrhbr Jul 22, 2025
0f686fd
Revert LibArchive static linking module
Bill-hbrhbr Jul 22, 2025
88f1eed
Add missing target links to make ubuntu-jammy compile
Bill-hbrhbr Jul 22, 2025
2cacc5d
Fix library name
Bill-hbrhbr Jul 22, 2025
2597a21
Misc fixes
Bill-hbrhbr Jul 22, 2025
3a53973
Add missing deps (bzip2)
Bill-hbrhbr Jul 23, 2025
3ff8669
Add missing bzip2 for manylinux
Bill-hbrhbr Jul 23, 2025
8a2407b
Address coderabbit ai review
Bill-hbrhbr Jul 23, 2025
3233f2f
Replace broken LibLZMA target with old-fashioned LZMA libraries variable
Bill-hbrhbr Jul 23, 2025
f61890b
Optimize package find logging statement
Bill-hbrhbr Jul 23, 2025
e78c035
Use existing helper to find dep modules for libarchive
Bill-hbrhbr Jul 23, 2025
5fdbc12
Make Pkgconf work in FindLibArchive
Bill-hbrhbr Jul 24, 2025
cb47228
restore cmakelists order to reduce clutter
Bill-hbrhbr Jul 24, 2025
8f5d04d
Remove centos restriction on avoiding static libs
Bill-hbrhbr Jul 24, 2025
5046d0d
Improve LibArchive find module
Bill-hbrhbr Aug 13, 2025
e65b433
Revert changes to find library deps
Bill-hbrhbr Aug 13, 2025
d54a1ea
Remove unnecessary find_package calls
Bill-hbrhbr Aug 13, 2025
2bb246b
Revert many/musllinux dep scripts and update ubuntujammy/centos/macos…
Bill-hbrhbr Aug 13, 2025
515e400
Merge branch 'main' into modernize-libarchive-install
Bill-hbrhbr Aug 13, 2025
a21c9ce
revert libarchive script
Bill-hbrhbr Aug 13, 2025
c6e03c0
Merge branch 'main' into modernize-libarchive-install
Bill-hbrhbr Sep 18, 2025
bc61453
Merge branch 'main' into modernize-libarchive-install
Bill-hbrhbr Sep 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 3 additions & 16 deletions components/core/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,16 +79,6 @@ set(CLP_USE_STATIC_LIBS ON CACHE BOOL "Whether to link against static libraries"
if (CLP_USE_STATIC_LIBS)
if (APPLE)
set(CLP_STATIC_LIBS_UNSUPPORTED_PLATFORM "macOS")
elseif (EXISTS "/etc/centos-release")
# NOTE:
# 1. We don't support static linking on any CentOS-based distro except manylinux_2_28 (which
# shows up as "AlmaLinux").
# 2. A release called "AlmaLinux" doesn't guarantee we're running on a manylinux distro, but
# we can improve this check when someone reports an issue.
file(READ "/etc/centos-release" CENTOS_RELEASE_CONTENT)
if(NOT "${CENTOS_RELEASE_CONTENT}" MATCHES "AlmaLinux")
set(CLP_STATIC_LIBS_UNSUPPORTED_PLATFORM "CentOS")
endif()
endif()

if (DEFINED CLP_STATIC_LIBS_UNSUPPORTED_PLATFORM)
Expand Down Expand Up @@ -222,12 +212,9 @@ if(CLP_NEED_LIBARCHIVE)
if(CLP_USE_STATIC_LIBS)
set(LibArchive_USE_STATIC_LIBS ON)
endif()
find_package(LibArchive REQUIRED)
if(LibArchive_FOUND)
message(STATUS "Found LibArchive ${LibArchive_VERSION}")
else()
message(FATAL_ERROR "Could not find ${CLP_LIBS_STRING} libraries for LibArchive")
endif()
# TODO: Add why we need 3.8.1
find_package(LibArchive 3.8.1 REQUIRED)
message(STATUS "Found LibArchive ${LibArchive_VERSION}")
Comment on lines +215 to +217
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick (assertive)

Replace TODO with explicit security rationale; optionally centralize required version

The version pin is correct, but the TODO should be replaced by a short rationale referencing the security fixes motivating 3.8.1. Optionally, define the required version once to ease future bumps.

Apply this diff:

-    # TODO: Add why we need 3.8.1
-    find_package(LibArchive 3.8.1 REQUIRED)
-    message(STATUS "Found LibArchive ${LibArchive_VERSION}")
+    # Require >= 3.8.1 due to security fixes in upstream libarchive:
+    # - Tar reader: handle truncation in GNU long linkname (CVE-2024-57970, v3.7.8)
+    # - Unzip: fix null pointer dereference (CVE-2025-1632, v3.7.8)
+    # - Tar reader: fix unchecked return value in list_item_verbose() (CVE-2025-25724, v3.7.8)
+    # - archive_write.c NULL pointer dereference (CVE-2022-36227, v3.6.2)
+    set(REQUIRED_LIBARCHIVE_VERSION "3.8.1")
+    find_package(LibArchive ${REQUIRED_LIBARCHIVE_VERSION} REQUIRED)
+    message(STATUS "Found LibArchive ${LibArchive_VERSION}")
🤖 Prompt for AI Agents 
In components/core/CMakeLists.txt around lines 211-213, replace the "# TODO"
with a concise security rationale explaining that LibArchive 3.8.1 is required
to pick up security fixes (mention the specific CVE IDs or advisory numbers and
a one-line summary of the vulnerability mitigated), and optionally centralize
the version by adding a single variable (e.g., LIBARCHIVE_REQUIRED_VERSION) near
the top of the file and use that variable in the find_package call so future
bumps only require one edit.

endif()

# Find and setup libcurl
Expand Down
81 changes: 42 additions & 39 deletions components/core/cmake/Modules/FindLibArchive.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,48 +1,51 @@
# Try to find LibArchive
# NOTE: The FindLibArchive.cmake included with CMake has no support for static libraries, so we use our own.
# NOTE: The FindLibArchive.cmake included with CMake has no support for static libraries, so we use
# our own.
#
# Set LibArchive_USE_STATIC_LIBS=ON to look for static libraries.
#
# Once done this will define:
# LibArchive_FOUND - Whether LibArchive was found on the system
# LibArchive_INCLUDE_DIR - The LibArchive include directories
# LibArchive_VERSION - The version of LibArchive installed on the system
# Once done, this will define:
# LibArchive_FOUND - Whether the library was found on the system
# LibArchive_INCLUDE_DIR - The library include directories
# LibArchive_LIBRARY - The path to the library file
#
# And will define the following if the package configuration file provides relevant information:
# LibArchive_VERSION - The version of library installed on the system
# LibArchive_LIBRARY_DEPENDENCIES - Any additional modules required to link with the library
#
# Conventions:
# - Variables only for use within the script are prefixed with "libarchive_"
# - Variables that should be externally visible are prefixed with "LibArchive_"

set(libarchive_LIBNAME "archive")
include(FindPackageHandleStandardArgs)

include(cmake/Modules/FindLibraryDependencies.cmake)

# On macOS, libarchive installed through brew is not linked into prefix by default.
# So it cannot be found by pkg-config and we need to manually find it.
# For more details, see https://github.com/Homebrew/homebrew-core/issues/117642
# Find and setup libarchive
if(APPLE)
execute_process(COMMAND brew --prefix libarchive OUTPUT_VARIABLE libarchive_MACOS_PREFIX)
string(STRIP "${libarchive_MACOS_PREFIX}" libarchive_MACOS_PREFIX)
set(ENV{libarchive_PREV_CMAKE_PATH} "$ENV{CMAKE_PREFIX_PATH}") # save it so we can revert it later
set(ENV{CMAKE_PREFIX_PATH} "${libarchive_MACOS_PREFIX};$ENV{CMAKE_PREFIX_PATH}")
set(libarchive_HEADER "archive.h")
set(libarchive_LIBNAME "archive")
set(libarchive_LOCAL_PREFIX "libarchive")
set(libarchive_PKGCONFIG_NAME "libarchive")

if(DEFINED LibArchive_ROOT)
set(libarchive_PKGCONFIG_DIR "${LibArchive_ROOT}/lib/pkgconfig")
set(ENV{libarchive_ORIG_PKG_CONFIG_PATH} "$ENV{PKG_CONFIG_PATH}")
set(ENV{PKG_CONFIG_PATH} "${libarchive_PKGCONFIG_DIR};$ENV{PKG_CONFIG_PATH}")
endif()

# Run pkg-config
find_package(PkgConfig)
pkg_check_modules(libarchive_PKGCONF QUIET "lib${libarchive_LIBNAME}")
pkg_check_modules(libarchive_PKGCONF QUIET "${libarchive_PKGCONFIG_NAME}")

# Set include directory
find_path(LibArchive_INCLUDE_DIR archive.h
find_path(LibArchive_INCLUDE_DIR ${libarchive_HEADER}
HINTS ${libarchive_PKGCONF_INCLUDEDIR}
PATH_SUFFIXES include
)

# Handle static libraries
if(LibArchive_USE_STATIC_LIBS)
# Save current value of CMAKE_FIND_LIBRARY_SUFFIXES
set(libarchive_ORIG_CMAKE_FIND_LIBRARY_SUFFIXES ${CMAKE_FIND_LIBRARY_SUFFIXES})

# Temporarily change CMAKE_FIND_LIBRARY_SUFFIXES to static library suffix
set(libarchive_ORIG_CMAKE_FIND_LIBRARY_SUFFIXES ${CMAKE_FIND_LIBRARY_SUFFIXES})
set(CMAKE_FIND_LIBRARY_SUFFIXES .a)
endif()

Expand All @@ -52,13 +55,10 @@ find_library(LibArchive_LIBRARY
HINTS ${libarchive_PKGCONF_LIBDIR}
PATH_SUFFIXES lib
)
if (LibArchive_LIBRARY)
# NOTE: This must be set for find_package_handle_standard_args to work
set(LibArchive_FOUND ON)
endif()

# Find dependencies
if(LibArchive_USE_STATIC_LIBS)
FindStaticLibraryDependencies(${libarchive_LIBNAME} libarchive
FindStaticLibraryDependencies(${libarchive_LIBNAME} ${libarchive_LOCAL_PREFIX}
"${libarchive_PKGCONF_STATIC_LIBRARIES}")

# Restore original value of CMAKE_FIND_LIBRARY_SUFFIXES
Expand All @@ -68,25 +68,27 @@ endif()

FindDynamicLibraryDependencies(libarchive "${libarchive_DYNAMIC_LIBS}")

message(STATUS "libarchive_PKGCONF_STATIC_LIBRARIES = ${libarchive_PKGCONF_STATIC_LIBRARIES}")
message(STATUS "libarchive_DYNAMIC_LIBS = ${libarchive_DYNAMIC_LIBS}")
message(STATUS "libarchive_LIBRARY_DEPENDENCIES = ${libarchive_LIBRARY_DEPENDENCIES}")

# Set version
set(LibArchive_VERSION ${libarchive_PKGCONF_VERSION})

include(FindPackageHandleStandardArgs)
# Set up find_package() call
find_package_handle_standard_args(LibArchive
REQUIRED_VARS LibArchive_INCLUDE_DIR
REQUIRED_VARS LibArchive_LIBRARY LibArchive_INCLUDE_DIR
VERSION_VAR LibArchive_VERSION
)

if(NOT TARGET LibArchive::LibArchive)
# Add library to build
if (LibArchive_FOUND)
if (LibArchive_USE_STATIC_LIBS)
add_library(LibArchive::LibArchive STATIC IMPORTED)
else()
# NOTE: We use UNKNOWN so that if the user doesn't have the SHARED
# libraries installed, we can still use the STATIC libraries
add_library(LibArchive::LibArchive UNKNOWN IMPORTED)
endif()
if(LibArchive_USE_STATIC_LIBS)
add_library(LibArchive::LibArchive STATIC IMPORTED)
else()
# NOTE: We use UNKNOWN so that if the user doesn't have the SHARED
# libraries installed, we can still use the STATIC libraries
add_library(LibArchive::LibArchive UNKNOWN IMPORTED)
endif()

# Set include directories for library
Expand Down Expand Up @@ -115,7 +117,8 @@ if(NOT TARGET LibArchive::LibArchive)
endif()
endif()

if(APPLE)
# remove LibArchive-specific path
set(ENV{CMAKE_PREFIX_PATH} "$ENV{libarchive_PREV_CMAKE_PATH}")
endif()
# Restore original value of PKG_CONFIG_PATH
if(DEFINED ENV{libarchive_ORIG_PKG_CONFIG_PATH})
set(ENV{PKG_CONFIG_PATH} "$ENV{libarchive_ORIG_PKG_CONFIG_PATH}")
unset(ENV{libarchive_ORIG_PKG_CONFIG_PATH})
endif()
4 changes: 3 additions & 1 deletion components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,10 @@ dnf install -y \
make \
mariadb-connector-c-devel \
openssl-devel \
python3-devel \
python3-pip \
unzip
unzip \
zlib-devel
Comment on lines +20 to +23
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

🧩 Analysis chain

Avoid system LibArchive; add pkg-config to prevent resolver drift

Given this PR migrates LibArchive to task-based installs and relies on pkg-config for discovery, installing the system libarchive-devel risks CMake/pkg-config resolving against the system copy rather than the task-installed one. Also, pkg-config isn’t explicitly ensured on CentOS Stream 9.

  • Action 1 (recommended): drop libarchive-devel from this list to avoid accidental linkage against the system LibArchive.
  • Action 2 (ensure tooling): add pkgconf-pkg-config so pkg-config is present in CI and developer machines.
  • If you keep the system package for fallback, please confirm that the task’s PKG_CONFIG_PATH is prepended so FindLibArchive.cmake consistently selects the task-installed .pc first.

Apply this diff to add pkg-config (within this hunk); remove libarchive-devel separately in the same block:

     python3-pip \
-    unzip \
-    zlib-devel
+    unzip \
+    zlib-devel \
+    pkgconf-pkg-config

Would you like me to provide a quick verification script that inspects PKG_CONFIG_PATH precedence and resolves which libarchive.pc will be used by CMake?

🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "PWD: $(pwd)"
target="components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh"

if [ -f "$target" ]; then
  echo "=== File: $target ==="
  nl -ba "$target" | sed -n '1,240p'
else
  echo "File $target not found. Searching for similar files..."
  rg -n "install-prebuilt-packages.sh|centos-stream-9" || true
  echo "Listing lib_install dir..."
  ls -R components/core/tools/scripts/lib_install || true
fi

echo
echo "=== Search repo for libarchive-devel, pkgconf-pkg-config, pkg-config, PKG_CONFIG_PATH ==="
rg -n "libarchive-devel|pkgconf-pkg-config|pkg-config|PKG_CONFIG_PATH" || true

Length of output: 165

🏁 Script executed:

#!/bin/bash
set -euo pipefail
target="components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh"
echo "PWD: $(pwd)"
echo "Target: $target"

if [ -f "$target" ]; then
  echo "=== File exists; printing up to 400 lines ==="
  sed -n '1,400p' "$target" || true
else
  echo "File not found; searching for matching files..."
  rg -n --hidden "install-prebuilt-packages.sh|centos-stream-9" || true
fi

echo
echo "=== Listing directory ==="
ls -la components/core/tools/scripts/lib_install/centos-stream-9 || true

echo
echo "=== Repo search for libarchive / pkg-config related tokens ==="
rg -n --hidden "libarchive-devel|pkgconf-pkg-config|pkg-config|PKG_CONFIG_PATH|libarchive.pc|libarchive" || true

Length of output: 23782

🏁 Script executed:

#!/bin/bash
set -euo pipefail
file="components/core/cmake/Modules/FindLibArchive.cmake"
echo "Printing $file"
sed -n '1,240p' "$file" || true

echo
echo "Printing FindLibLZMA.cmake for comparison"
sed -n '1,240p' components/core/cmake/Modules/FindLibLZMA.cmake || true

echo
echo "Printing components/core/CMakeLists.txt around libarchive setup"
sed -n '1,320p' components/core/CMakeLists.txt || true

Length of output: 17490

Avoid system LibArchive; add pkg-config to prevent resolver drift

CentOS Stream 9 install script installs libarchive-devel but does not ensure pkg-config; CMake relies on pkg-config for picking the task-installed libarchive. Also, FindLibArchive.cmake currently prepends PKG_CONFIG_PATH with a semicolon which will not produce correct precedence on Unix.

  • Add pkgconf-pkg-config to the CentOS install list and prefer removing the system libarchive package from this script (or keep it only as a documented fallback). File: components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh. Apply this hunk to add pkg-config:
     python3-pip \
-    unzip \
-    zlib-devel
+    unzip \
+    zlib-devel \
+    pkgconf-pkg-config
  • Fix PKG_CONFIG_PATH prepend in components/core/cmake/Modules/FindLibArchive.cmake — replace
    set(ENV{PKG_CONFIG_PATH} "${libarchive_PKGCONFIG_DIR};$ENV{PKG_CONFIG_PATH}")
    with a Unix-safe prepend (use ':' on Unix or mirror FindLibLZMA.cmake) so the task-installed .pc is found first.
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
python3-devel \
python3-pip \
unzip
unzip \
zlib-devel
python3-devel \
python3-pip \
unzip \
zlib-devel \
pkgconf-pkg-config
🤖 Prompt for AI Agents 
In
components/core/tools/scripts/lib_install/centos-stream-9/install-prebuilt-packages.sh
around lines 20-23, the install list installs libarchive-devel but omits
pkg-config; update the package list to add pkgconf-pkg-config and remove (or
comment out) libarchive-devel so the task-provided libarchive is preferred,
keeping libarchive-devel only as a documented fallback. In
components/core/cmake/Modules/FindLibArchive.cmake, replace the Windows-style
PKG_CONFIG_PATH prepend that uses ';' with a Unix-safe prepend that mirrors
FindLibLZMA.cmake (use ':' on Unix and preserve platform logic) so the
task-installed .pc directory is placed before existing PKG_CONFIG_PATH and is
found first.


if ! command -v pipx >/dev/null 2>&1; then
python3 -m pip install pipx
Expand Down
19 changes: 19 additions & 0 deletions taskfiles/deps/main.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ tasks:
- task: "catch2"
- task: "date"
- task: "fmt"
- task: "libarchive"
- task: "liblzma"
- task: "log-surgeon"
- task: "lz4"
Expand Down Expand Up @@ -253,6 +254,24 @@ tasks:
TARBALL_SHA256: "1250e4cc58bf06ee631567523f48848dc4596133e163f02615c97f78bab6c811"
TARBALL_URL: "https://github.com/fmtlib/fmt/archive/refs/tags/10.2.1.tar.gz"

libarchive:
internal: true
run: "once"
cmds:
- task: "utils:install-remote-cmake-lib"
vars:
CMAKE_GEN_ARGS:
- "-DCMAKE_BUILD_TYPE=Release"
- "-DCMAKE_INSTALL_LIBDIR=lib"
- "-DCMAKE_INSTALL_MESSAGE=LAZY"
- "-DCMAKE_INSTALL_PREFIX={{.G_DEPS_CORE_DIR}}/LibArchive-install"
- "-DENABLE_EXPAT=OFF"
- "-DENABLE_OPENSSL=OFF"
LIB_NAME: "LibArchive"
TARBALL_SHA256: "bde832a5e3344dc723cfe9cc37f8e54bde04565bfe6f136bc1bd31ab352e9fab"
TARBALL_URL: "https://github.com/libarchive/libarchive/releases/download/v3.8.1\
/libarchive-3.8.1.tar.gz"

liblzma:
internal: true
vars:
Expand Down
Loading