pkgconf-3.0.2

[Bruce Dubbs]

Check if this is a development version. The current version is 2.5.1.

[Xi Ruoyao]

It's a development release for upcoming 3.0.

3.0 will deprecate the autotools support so we'd have to switch to meson. It's a little difficult. What seems working for me:

1. Move ninja before pkgconf. No changes are needed for instructions.
2. Build pkgconf with an "uninstalled" meson:

   tar -xf ../meson-1.11.1.tar.gz
   # ch. 07 Python is not built with zlib so the import will fail,
   # but thanks to the dynamic nature of Python we can simply remove it
   # as long as it's not really used at runtime
   sed '/import gzip/d' -i meson-1.11.1/mesonbuild/wrap/wrap.py
   
   mkdir build
   cd build
   python3 ../meson-1.11.1/meson.py setup --prefix=/usr --buildtype=release
   ninja
   ninja install
   mv /usr/share/doc/pkgconf{,-2.5.1}
   

[Xi Ruoyao]

An alternative would be adding zlib into ch. 07 (before Python) instead of hacking meson with the sed.

It would have an additional benefit that we'd be able to extract the sqlite doc zip archive using python3 -m zipfile -e, so we'd no longer need to reformat the archive and upload it to anduin.

[Bruce Dubbs]

Not at version 2.9.98.

[Bruce Dubbs]

Not at 2.9.99,

[zeckma]

Now 3.0.0. Deprecation is now in stable and will be removed in 3.1.

[zeckma]

I was thinking maybe we can compile pkgconf-lite which will stick around as a Makefile project. It's part of actual pkgconf, but it's static and more limited, but should do the trick as a first pass. So pkgconf-lite can be early in chapter 8, compile things that need it, install Meson, then finally do a full build of pkgconf.

There were some ideas floating around that involved actually dealing with muon, but I'd rather not for many reasons.

I don't like any of the solutions, but I think Xi's solution is the most simple, here.

For the record, for any ideas with Muon, I will say that it still isn't ready as a suitable replacement for Meson. It even goes against some compatibility, like --prefix and --buildtype not existing, and must be -D prefix and -D buildtype, which would require every single page using Meson to be altered. It also doesn't support Rust projects. Mesa, Glycin, etc. will not go well. And not part of standard LFS/BLFS procedure but important for stuff like MLFS, crossfile support is in shambles and just doesn't work, and different pkg-config variable paths can lead to it tripping up and linking against wrong libraries. samurai also needs to be involved in the process. SLFS already covers samurai, but if Muon gets involved, samurai will also need to be involved. As a temporary tool, it would work. Long-term, it isn't suitable. So we'll absolutely need to stick with Meson and try to work around pkgconf switching to Meson fully.

Maybe with Muon, things will change and the process will become easier, or we'll get another Meson alternative. But we'll have to keep using Meson.

[Bruce Dubbs]

I'll give Xi's suggestion a try this weekend. My plan is to do most of the testing for the mid-July release on Monday and push it on Tuesday.

I do like the idea of adding zlib to Chapter 7 so the build of sqlite is simplified, at least for editors.

[Bruce Dubbs]

Changes from 2.5.1 to 3.0.0:

• DEPRECATION: The autotools build system will be dropped after the 3.0 release. Building pkgconf with muon is recommended for early bootstrap and meson in later stages of bootstrap. Alternatively users can use pkgconf-lite for early bootstrap. Continuous integration now exercises both the muon and pkgconf-lite builds. See ​https://github.com/pkgconf/pkgconf/issues/481 for rationale and discussion.

• DEPRECATION: Support for setting PKG_CONFIG_PATH from the Windows registry is slated for removal in 3.1. It is recommended PKG_CONFIG_PATH be set from the environment on Windows. See ​https://github.com/pkgconf/pkgconf/issues/546 for rationale and discussion.

• SPDX Software Bill of Materials (SBOM) generation:
  • New spdxtool(1) utility which generates SPDX Lite 3.0.1 SBOM files. Initial implementation by Tuukka Pasanen, sponsored by The FreeBSD Foundation, and substantially improved since, with major contributions by Elizabeth Ashford and additional patches by Joshua Watt and Pierre Pronchery.
  • bomtool now supports a --output option, which writes the generated SBOM to a file instead of standard output, and --define-variable, as the pkgconf CLI does. The --define-variable support is by Tuukka Pasanen.
  • bomtool now supports a --creation-time option, like spdxtool, which sets the SBOM creation timestamp (in ISO 8601 format) instead of using the current time, and no longer embeds the pkgconf version in its output. Both changes allow for reproducible SBOM generation.
  • bomtool now honors the SOURCE_DATE_EPOCH environment variable, deriving the SBOM creation timestamp from it when --creation-time is not given, for reproducible builds.
  • bomtool: improved SPDX conformance. Mandatory PackageCopyrightText and PackageLicenseConcluded fields are emitted as NOASSERTION when unavailable, a Created timestamp is included, invalid PackageVerificationCode output was removed, the package identifier charset was corrected, PackageDownloadLocation is derived from the Source tag, and SPDX 2.3 package names are used. Patches by Stéphane Rochoy and Tuukka Pasanen.

• New pccritic(1) utility which scores the quality of pc(5) files. Each module or .pc file is graded from A to F based on findings across several categories: required and recommended metadata, version sanity, relocatability of libdir and includedir, Cflags and Libs hygiene, the Requires relationship, the NTIA SBOM minimum elements, and file-formatting style. Supports --quiet for a one-line score per target, --min-score for use as a CI gate, and colorized output.

• New test and I/O framework.
  • kyua is no longer required to run tests.
  • Declarative configuration for integration tests, C unit tests for functional tests.
  • Tests now run on Windows.
  • .pc and personality files are now opened in binary mode, and the line reader was reworked to correctly handle LF, CRLF and lone-CR line endings, including on non-seekable streams. Binary-mode handling by moi15moi. Major contributions by Elizabeth Ashford.

• New pc(5) features:
  • Source tag: a URI which describes where a given package may be downloaded.
  • License.file tag: a path to a license file that is on disk.
  • Requires.shared tag: like Requires.private, except a list of dependencies only used when building in shared mode.
  • Cflags.shared tag: like Cflags.private, except a list of CFLAGS only used when building in shared mode.
  • Libs.shared tag: like Libs.private, except a list of LIBS only used when building in shared mode.
  • Link.ABI tag: a comma-separated list of tags describing the application binary interfaces a consumer must link a package against, such as c++ or fortran. Tags are case-insensitive and normalized to lowercase, and may be queried with --link-abi. The Source and License.file tags are by Tuukka Pasanen; additional patches by Elizabeth Ashford.

• Windows support has been significantly improved.
  • pkgconf can now be built and tested with Visual Studio and clang-cl.
  • Windows on ARM builds are supported, and MSI installers are produced for x86, x64 and arm64 using MSVC.
  • The console code page is set to UTF-8 and non-ASCII entries in PKG_CONFIG_PATH are now handled correctly. The clang-cl support, MSI installers and UTF-8 console handling are by moi15moi.

• Portability:
  • pkgconf is now built and tested in continuous integration on NetBSD, FreeBSD, OpenBSD, Haiku, OmniOS, macOS and Cygwin in addition to Linux and Windows.
  • pkgconf now falls back to readlink(2) on systems which lack readlinkat(2).
  • A fallback is provided for platforms without nl_langinfo_l, and xlocale.h is included where needed to build on macOS.
  • Fixed -Werror=format build failures on MinGW caused by the PRIu64 macro expanding to an MSVCRT format specifier that the GNU format-string checker rejects; serial and identifier values are now printed with %llu. The expanded platform CI and the nl_langinfo_l/xlocale.h fallbacks are by moi15moi.

• Security hardening:
  • Variable substitution is now guarded against denial-of-service inputs, including billion-laughs style expansion and excessively complex bytecode programs.
  • Dependency traversal is now limited to 256 levels by default to prevent stack exhaustion from excessively deep graphs. A depth of -1 explicitly enables unlimited traversal.
  • Bytecode validation now uses overflow-safe bounds checks and rejects truncated, oversized and otherwise malformed programs.
  • Dynamic buffers now reject overlapping source and destination storage and guard allocation-size arithmetic against overflow.
  • LLVM libFuzzer targets were added for the pc(5) parser and the solver, and the numerous out-of-memory and crash paths they surfaced were hardened.
  • Allocation failures are now propagated through parsing, rendering, output and SBOM generation instead of silently producing partial results.
  • Dropped use of strlcpy, strlcat and other silently truncating string functions.

• CLI changes:
  • New --newlines option, which separates emitted fragments with newlines instead of spaces.
  • New --print-digraph-query-nodes option, which annotates the --digraph output with the nodes that were part of the original query.
  • --list-all and --list-package-names now include synthesized virtual packages provided via the Provides tag.
  • Variables can now be overridden using PKG_CONFIG_MODULENAME_VARIABLENAME environment variables. This was formally specified but never implemented in pkgconf.
  • PKG_CONFIG_LOG is now appended to rather than overwritten.
  • --dump-personality output is now consistent with the pkgconf-personality(5) format and additionally reports WantDefaultPure and WantDefaultStatic.
  • The vestigial --relocate=path option, which existed only for the old test suite, has been removed.
  • pccritic --min-score now strictly accepts integer values from 0 through 100.

• Build system changes:
  • The meson build gained a with-pkg-config-dir option to override the default package search path, matching the autotools --with-pkg-config-dir option.

• pkg.m4 changes:
  • PKG_WITH_MODULES now properly quotes its action arguments (serial 16). Patch by Antonin Décimo.
  • The macros no longer direct users to the freedesktop pkg-config project.

• Correctness fixes:
  • The built-in pkg-config and pkgconf packages are now constructed from the configured personality instead of being hardcoded, so their reported data reflects the active personality. They are also exposed as proper versioned virtual packages.
  • ${pc_sysrootdir} now defaults to an empty string instead of '/'.
  • Variable substitution was reimplemented using a bytecode engine, which tracks whether special variables such as ${pc_sysrootdir} have already been applied so that they are not substituted more than once.
  • The solver now re-checks the final solution for conflicts before returning success, and tracks the origin of conflict rules.
  • Requires.internal is now treated as a weaker form of Requires.private: its dependency nodes need not be satisfied when link libraries are not requested.
  • pkgconf now warns about .pc files that duplicate a dependency-list field, whose behavior is inconsistent across pkg-config implementations.
  • Version comparison was reworked to use a structured algorithm modeled on apk-tools.
  • Newline folding behavior when parsing multi-line fields has been adjusted.
  • Bare variable expansions inside fragment lists are now re-parsed so that any flags they expand to are tokenized correctly.
  • ${pc_sysrootdir} is now only injected when it matches a complete path boundary, and obviously bogus sysroot_dir definitions are ignored, fixing incorrect sysroot injection.
  • Arguments are now combined when a flag is expected to carry a separate value, such as -I dir or -framework name.
  • SPDX license expressions in the License field are now properly parsed and validated.
• The libpkgconf API and ABI were substantially reworked, breaking both API and ABI compatibility. Consumers will need source changes as well as a rebuild. The libpkgconf soversion is now 8.
  • An abstract pkgconf_buffer_t type is now used throughout libpkgconf in place of fixed-size stack buffers, removing a class of truncation bugs.
  • A new pkgconf_output API abstracts all output, allowing the output stream to be set per-client and redirected (pkgconf_client_set_output, pkgconf_output_file_fmt and friends).
  • The pkgconf_tuple_parse API has been removed; variables are now evaluated via pkgconf_variable_eval (backed by the new bytecode engine).
  • The fragment rendering API was reworked around pkgconf_buffer_t, and the old pkgconf_fragment_render API has been removed. Fragment renderer callbacks and pkgconf_fragment_render_buf now return bool so allocation and rendering failures can be reported.
  • pkgconf_license_render now returns bool so allocation failures can be reported.
  • The package copyright field was migrated to a bufferset.
  • Environment variable lookups can now be mocked via pkgconf_client_getenv.
  • Client construction gained an options-based API: pkgconf_client_init_with_options and pkgconf_client_new_with_options accept a pkgconf_client_options_t struct, with the original pkgconf_client_init and pkgconf_client_new retained as wrappers. The unveil handler may now be supplied directly as a client option.
  • New pkgconf_variable_eval_name API, which evaluates a named variable and applies sysroot fixups to the result.
  • The pkgconf_pkg_traverse_func_t callback gained a trailing iter_flags argument carrying per-traversal state (PKGCONF_PKG_ITERF_*), replacing the removed PKGCONF_PKG_PKGF_ITER_PKG_IS_PRIVATE client flag.

[Bruce Dubbs]

Now version 3.0.1.

[Bruce Dubbs]

Changes from 3.0.0 to 3.0.1:

• Various Meson-related fixes and improvements.

[Bruce Dubbs]

Now version 3.0.2.

Changes from 3.0.1 to 3.0.2:

• Fix build on systems where readlinkat(2) is missing, such as Illumos when built without appropriate CFLAGS.

• Fix detection of readlinkat(2) on systems where it is gated behind _ATFILE_SOURCE, such as on certain builds of Illumos.

[Bruce Dubbs]

Fixed at commit 8cccf6a12c.

    Add mpdecimal-4.0.1.
    Update to tzdata-2026c.
    Update to setuptools-83.0.0.
    Update to pkgconf-3.0.2.
    Update to meson-1.11.2.
    Update to libffi-3.7.1.
    Update to linux-7.1.3.
    Update to gawk-5.4.1.
    Update to findutils-4.11.0.