Repository navigation
fix(build): pin croaring, nlohmann_json, spdlog, cpr, sqlpp23 fetches - #1082
Conversation
6de16db to
41435ca
Compare
These FetchContent downloads had no integrity pin, unlike Arrow, nanoarrow, and utf8proc in the same file, so a tampered archive or mirror would be compiled unverified. nlohmann_json keeps a URL_HASH (its tarball is a stable uploaded release asset). The other four use GitHub's auto-generated tag-archive endpoint, which is not byte-stable across requests and cannot be hash-pinned reliably (confirmed: the same tag download returned different checksums on different requests), so they switch to GIT_REPOSITORY + GIT_TAG pinned to the tag's full commit SHA, the same pattern already used here for Avro, googletest, and google_benchmark.
41435ca to
c9c507d
Compare
gty404
changed the title
| set(ENABLE_ROARING_TESTS OFF) | ||
| set(ENABLE_ROARING_MICROBENCHMARKS OFF) | ||
|
|
||
| # GitHub's auto-generated tag-archive tarball is not byte-stable across |
There was a problem hiding this comment.
That's wired, do we have this problem in our gh actions? I can't reproduce this locally, Could you explain how you got this issue?
There was a problem hiding this comment.
Hit it in this PR's own CI, not hypothetical: https://github.com/apache/iceberg-cpp/actions/runs/41434821884/job/125242025243 — the v4.7.1 tarball failed URL_HASH 6 times in a row with 6 different checksums, then Each download failed!.
Reproduced manually too: fetched https://github.com/RoaringBitmap/CRoaring/archive/refs/tags/v4.7.1.tar.gz 3x plus once via codeload.github.com directly — 4 different SHA256 each time, none matching what I'd pinned. GitHub's tag-archive endpoint just isn't byte-stable across requests; only uploaded release assets (like nlohmann_json's) are.
Summary
FetchContentdownloads incmake_modules/IcebergThirdpartyToolchain.cmake(croaring,nlohmann_json,spdlog,cpr,sqlpp23) had no integrity pin, unlikeArrow,nanoarrow, andutf8procin the same file.nlohmann_jsongets aURL_HASH(its tarball is a stable uploaded release asset, same pattern asArrow/nanoarrow/utf8proc).croaring,spdlog,cpr,sqlpp23) use GitHub's auto-generated tag-archive endpoint (archive/refs/tags/*.tar.gz), which is not byte-stable across requests — the same tag download returned different checksums across repeated requests, so it can't be pinned withURL_HASH. These switch toGIT_REPOSITORY+GIT_TAGpinned to the tag's full commit SHA, the same pattern already used in this file forAvro,googletest, andgoogle_benchmark.ICEBERG_*_URLenv vars) are still honored.