Global
/
vcpkg
mirror of https://github.com/microsoft/vcpkg.git
1
0
Fork 0
Code Activity

Scripts changes for CMake variables in SBOMs. 

This is the "scripts tree" changes for the generated SBOMs fix. I had to change `ports.cmake` anyway, so I also normalized every file in `scripts` to have LF line endings (except those with signatures which would be invalidated by that change).

build_info.cmake: Write the SPDX resources
ports.cmake: Include the new helper

vcpkg_download_distfile.cmake: Split into a z_ helper which does the raw thing, and the "public" version which also records SPDX resource information.

Elsewhere: Use the internal helper when not intending to add SPDX resources, add SPDX resource records, remove meaningless QUIET
This commit is contained in:
Billy Robert O'Neal III 2026-07-17 16:10:47 -07:00
parent 9c49a77ea9
commit 5397c5c9f1
No known key found for this signature in database
12 changed files with 119 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
scripts/build_info.cmake
View File

@ -89,4 +89,11 @@ if (DEFINED VCPKG_HEAD_VERSION)
string(APPEND "Z_BUILD_INFO_FILE_CONTENTS" "Version: ${VCPKG_HEAD_VERSION}\n")
endif()
get_property(Z_VCPKG_SPDX_OBJECTS GLOBAL PROPERTY Z_VCPKG_SPDX_OBJECTS)
if(Z_VCPKG_SPDX_OBJECTS)
string(JOIN ",\n" Z_VCPKG_SPDX_PACKAGES ${Z_VCPKG_SPDX_OBJECTS})
file(WRITE "${CURRENT_PACKAGES_DIR}/share/${PORT}/vcpkg-spdx-resources.json"
"{\n \"packages\": [\n${Z_VCPKG_SPDX_PACKAGES}\n ]\n}\n")
endif()
file(WRITE "${CURRENT_PACKAGES_DIR}/BUILD_INFO" "${Z_BUILD_INFO_FILE_CONTENTS}")

3
scripts/cmake/vcpkg_acquire_msys.cmake
View File

@ -22,11 +22,10 @@ function(z_vcpkg_acquire_msys_download_package out_archive)
list(APPEND all_urls "${mirror_url}")
endforeach()
vcpkg_download_distfile(msys_archive
z_vcpkg_download_distfile(msys_archive
URLS ${all_urls}
SHA512 "${arg_SHA512}"
FILENAME "${arg_FILENAME}"
QUIET
)
set("${out_archive}" "${msys_archive}" PARENT_SCOPE)
endfunction()

34
scripts/cmake/vcpkg_download_distfile.cmake
View File

@ -1,20 +1,18 @@
function(vcpkg_download_distfile out_var)
function(z_vcpkg_download_distfile out_var)
cmake_parse_arguments(PARSE_ARGV 1 arg
"SKIP_SHA512;SILENT_EXIT;QUIET;ALWAYS_REDOWNLOAD"
"FILENAME;SHA512"
"URLS;HEADERS"
)
# SILENT_EXIT and QUIET are meaningless but accepting and ignoring them allows
# vcpkg_download_distfile to pass through parameters without needing manipulation.
if(NOT DEFINED arg_URLS)
message(FATAL_ERROR "vcpkg_download_distfile requires a URLS argument.")
endif()
if(NOT DEFINED arg_FILENAME)
message(FATAL_ERROR "vcpkg_download_distfile requires a FILENAME argument.")
endif()
if(arg_SILENT_EXIT)
message(WARNING "SILENT_EXIT no longer has any effect. To resolve this warning, remove SILENT_EXIT.")
endif()
# Note that arg_ALWAYS_REDOWNLOAD implies arg_SKIP_SHA512, and NOT arg_SKIP_SHA512 implies NOT arg_ALWAYS_REDOWNLOAD
if(arg_ALWAYS_REDOWNLOAD AND NOT arg_SKIP_SHA512)
message(FATAL_ERROR "ALWAYS_REDOWNLOAD requires SKIP_SHA512")
@ -138,3 +136,29 @@ If you do not know the SHA512, add it as 'SHA512 0' and retry.")
set("${out_var}" "${downloaded_file_path}" PARENT_SCOPE)
endfunction()
function(vcpkg_download_distfile out_var)
cmake_parse_arguments(PARSE_ARGV 1 arg
"SKIP_SHA512;SILENT_EXIT;QUIET;ALWAYS_REDOWNLOAD"
"FILENAME;SHA512"
"URLS;HEADERS"
)
if(DEFINED arg_UNPARSED_ARGUMENTS)
message(FATAL_ERROR "vcpkg_download_distfile was passed extra arguments: ${arg_UNPARSED_ARGUMENTS}")
endif()
if(arg_SILENT_EXIT)
message(WARNING "SILENT_EXIT no longer has any effect. To resolve this warning, remove SILENT_EXIT.")
endif()
z_vcpkg_function_arguments(forwarded_args 1)
z_vcpkg_download_distfile("${out_var}" ${forwarded_args})
set("${out_var}" "${${out_var}}" PARENT_SCOPE)
list(GET arg_URLS 0 spdx_download_location)
z_vcpkg_add_spdx_resource(
NAME "${arg_FILENAME}"
FILENAME "${arg_FILENAME}"
DOWNLOAD_LOCATION "${spdx_download_location}"
SHA512 "${arg_SHA512}"
)
endfunction()

8
scripts/cmake/vcpkg_download_sourceforge.cmake
View File

@ -27,13 +27,13 @@ function(vcpkg_download_sourceforge out_var)
- an organization name without any slashes, or
- an organization name followed by a repository name separated by a single slash")
endif()
if(NOT "${arg_REF}" STREQUAL "")
set(url "${sourceforge_host}/${org_name}/files/${repo_name}/${arg_REF}/${arg_FILENAME}")
else()
set(url "${sourceforge_host}/${arg_REPO}/files/${arg_FILENAME}")
endif()
string(SUBSTRING "${arg_SHA512}" 0 10 sanitized_ref)
set(sourceforge_mirrors
@ -72,8 +72,8 @@ function(vcpkg_download_sourceforge out_var)
foreach(mirror IN LISTS sourceforge_mirrors)
list(APPEND all_urls "${url}/download?use_mirror=${mirror}")
endforeach()
vcpkg_download_distfile(archive
z_vcpkg_download_distfile(archive
URLS ${all_urls}
SHA512 "${arg_SHA512}"
FILENAME "${arg_FILENAME}"

3
scripts/cmake/vcpkg_find_acquire_program.cmake
View File

@ -190,6 +190,7 @@ function(vcpkg_find_acquire_program program)
VERSION_COMMAND ${version_command}
)
endif()
if(NOT ${program})
if("${download_urls}" STREQUAL "" AND "${sourceforge_args}" STREQUAL "")
set(example ".")
@ -202,7 +203,7 @@ function(vcpkg_find_acquire_program program)
endif()
if("${sourceforge_args}" STREQUAL "")
vcpkg_download_distfile(archive_path
z_vcpkg_download_distfile(archive_path
URLS ${download_urls}
SHA512 "${download_sha512}"
FILENAME "${download_filename}"

9
scripts/cmake/vcpkg_from_bitbucket.cmake
View File

@ -57,7 +57,7 @@ function(vcpkg_from_bitbucket)
# exports VCPKG_HEAD_VERSION to the caller. This will get picked up by ports.cmake after the build.
if(VCPKG_USE_HEAD_VERSION)
vcpkg_download_distfile(archive_version
z_vcpkg_download_distfile(archive_version
URLS "https://api.bitbucket.com/2.0/repositories/${org_name}/${repo_name}/refs/branches/${arg_HEAD_REF}"
FILENAME "${downloaded_file_name}.version"
SKIP_SHA512
@ -76,7 +76,7 @@ ${version_contents}
endif()
# download the file information from bitbucket.
vcpkg_download_distfile(archive
z_vcpkg_download_distfile(archive
URLS "https://bitbucket.com/${org_name}/${repo_name}/get/${ref_to_use}.tar.gz"
FILENAME "${downloaded_file_name}"
${sha512_param}
@ -89,5 +89,10 @@ ${version_contents}
PATCHES ${arg_PATCHES}
${working_directory_param}
)
z_vcpkg_add_spdx_resource(
NAME "${arg_REPO}"
DOWNLOAD_LOCATION "git+https://bitbucket.com/${arg_REPO}@${ref_to_use}"
SHA512 "${arg_SHA512}"
)
set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
endfunction()

9
scripts/cmake/vcpkg_from_git.cmake
View File

@ -185,5 +185,14 @@ SHA is in the history. For example, you may be able to fix this error by changin
${skip_patch_check_param}
)
if(VCPKG_USE_HEAD_VERSION AND DEFINED arg_HEAD_REF)
set(spdx_ref "${rev_parse_ref}")
else()
set(spdx_ref "${arg_REF}")
endif()
z_vcpkg_add_spdx_resource(
NAME "${arg_URL}"
DOWNLOAD_LOCATION "git+${arg_URL}@${spdx_ref}"
)
set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
endfunction()

9
scripts/cmake/vcpkg_from_github.cmake
View File

@ -57,7 +57,7 @@ function(vcpkg_from_github)
# exports VCPKG_HEAD_VERSION to the caller. This will get picked up by ports.cmake after the build.
if(VCPKG_USE_HEAD_VERSION)
string(REPLACE "/" "_-" sanitized_head_ref "${arg_HEAD_REF}")
vcpkg_download_distfile(archive_version
z_vcpkg_download_distfile(archive_version
URLS "${github_api_url}/repos/${org_name}/${repo_name}/git/refs/heads/${arg_HEAD_REF}"
FILENAME "${org_name}-${repo_name}-${sanitized_head_ref}.version"
${headers_param}
@ -117,7 +117,7 @@ Error was: ${head_version_err}
endif()
# Try to download the file information from github
vcpkg_download_distfile(archive
z_vcpkg_download_distfile(archive
URLS "${download_url}"
FILENAME "${downloaded_file_name}"
${headers_param}
@ -132,5 +132,10 @@ Error was: ${head_version_err}
${working_directory_param}
${skip_patch_check_param}
)
z_vcpkg_add_spdx_resource(
NAME "${arg_REPO}"
DOWNLOAD_LOCATION "git+${github_host}/${arg_REPO}@${ref_to_use}"
SHA512 "${arg_SHA512}"
)
set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
endfunction()

11
scripts/cmake/vcpkg_from_gitlab.cmake
View File

@ -1,5 +1,3 @@
include(vcpkg_execute_in_download_mode)
function(z_uri_encode input output_variable)
string(HEX "${input}" hex)
string(LENGTH "${hex}" length)
@ -94,7 +92,7 @@ function(vcpkg_from_gitlab)
if(VCPKG_USE_HEAD_VERSION AND NOT DEFINED VCPKG_HEAD_VERSION)
z_uri_encode("${arg_REPO}" encoded_repo_path)
set(version_url "${arg_GITLAB_URL}/api/v4/projects/${encoded_repo_path}/repository/branches/${arg_HEAD_REF}")
vcpkg_download_distfile(archive_version
z_vcpkg_download_distfile(archive_version
URLS "${version_url}"
FILENAME "${downloaded_file_name}.version"
${headers_param}
@ -110,7 +108,7 @@ function(vcpkg_from_gitlab)
endif()
# download the file information from gitlab
vcpkg_download_distfile(archive
z_vcpkg_download_distfile(archive
URLS "${gitlab_link}/-/archive/${ref_to_use}/${repo_name}-${ref_to_use}.tar.gz"
FILENAME "${downloaded_file_name}"
${headers_param}
@ -124,5 +122,10 @@ function(vcpkg_from_gitlab)
PATCHES ${arg_PATCHES}
${working_directory_param}
)
z_vcpkg_add_spdx_resource(
NAME "${arg_REPO}"
DOWNLOAD_LOCATION "git+${arg_GITLAB_URL}/${arg_REPO}@${ref_to_use}"
SHA512 "${arg_SHA512}"
)
set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
endfunction()

6
scripts/cmake/vcpkg_from_sourceforge.cmake
View File

@ -42,5 +42,11 @@ function(vcpkg_from_sourceforge)
PATCHES ${arg_PATCHES}
)
z_vcpkg_add_spdx_resource(
NAME "${arg_FILENAME}"
FILENAME "${arg_FILENAME}"
DOWNLOAD_LOCATION "https://sourceforge.net/projects/${arg_REPO}/files/${arg_REF}/${arg_FILENAME}"
SHA512 "${arg_SHA512}"
)
set("${arg_OUT_SOURCE_PATH}" "${SOURCE_PATH}" PARENT_SCOPE)
endfunction()

37
scripts/cmake/z_vcpkg_spdx.cmake Normal file
View File

@ -0,0 +1,37 @@
function(z_vcpkg_add_spdx_resource)
cmake_parse_arguments(PARSE_ARGV 0 "arg"
""
"NAME;DOWNLOAD_LOCATION;SHA512;FILENAME"
"")
if(DEFINED arg_UNPARSED_ARGUMENTS)
message(FATAL_ERROR "z_vcpkg_add_spdx_resource was passed extra arguments: ${arg_UNPARSED_ARGUMENTS}")
endif()
get_property(Z_VCPKG_SPDX_OBJECTS GLOBAL PROPERTY Z_VCPKG_SPDX_OBJECTS)
list(LENGTH Z_VCPKG_SPDX_OBJECTS resource_index)
set(resource "{}")
string(JSON resource SET "${resource}" "SPDXID" "\"SPDXRef-resource-${resource_index}\"")
string(JSON value STRING_ENCODE "${arg_NAME}")
string(JSON resource SET "${resource}" "name" "${value}")
if(DEFINED arg_FILENAME)
string(JSON value STRING_ENCODE "${arg_FILENAME}")
string(JSON resource SET "${resource}" "packageFileName" "${value}")
endif()
string(JSON value STRING_ENCODE "${arg_DOWNLOAD_LOCATION}")
string(JSON resource SET "${resource}" "downloadLocation" "${value}")
foreach(property IN ITEMS licenseConcluded licenseDeclared copyrightText)
string(JSON resource SET "${resource}" "${property}" [["NOASSERTION"]])
endforeach()
if(DEFINED arg_SHA512 AND NOT "${arg_SHA512}" STREQUAL "")
string(TOLOWER "${arg_SHA512}" sha512)
string(JSON checksum SET "{}" "algorithm" [["SHA512"]])
string(JSON checksum SET "${checksum}" "checksumValue" "\"${sha512}\"")
string(JSON checksums SET "[]" 0 "${checksum}")
string(JSON resource SET "${resource}" "checksums" "${checksums}")
endif()
vcpkg_list(APPEND Z_VCPKG_SPDX_OBJECTS "${resource}")
set_property(GLOBAL PROPERTY Z_VCPKG_SPDX_OBJECTS "${Z_VCPKG_SPDX_OBJECTS}")
endfunction()

3
scripts/ports.cmake
View File

@ -34,6 +34,9 @@ list(APPEND CMAKE_MODULE_PATH "${SCRIPTS}/cmake")
# Increment this number if we intentionally need to invalidate all binary caches due a change in
# the following scripts: 1
include("${SCRIPTS}/cmake/execute_process.cmake")
include("${SCRIPTS}/cmake/vcpkg_execute_in_download_mode.cmake")
include("${SCRIPTS}/cmake/z_vcpkg_spdx.cmake")
include("${SCRIPTS}/cmake/vcpkg_acquire_msys.cmake")
include("${SCRIPTS}/cmake/vcpkg_add_to_path.cmake")
include("${SCRIPTS}/cmake/vcpkg_apply_patches.cmake")