Re: [LFS Trac] #5962: pkgconf-3.0.0

#5962: pkgconf-3.0.0
-------------------------+-----------------------
 Reporter:  Bruce Dubbs  |       Owner:  lfs-book
     Type:  enhancement  |      Status:  new
 Priority:  normal       |   Milestone:  13.1
Component:  Book         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-----------------------
Comment (by Bruce Dubbs):

 Changes from 2.5.1 to 3.0.0:

 * DEPRECATION: The autotools build system will be dropped after the 3.0
 release.
   Building pkgconf with muon is recommended for early bootstrap and meson
 in later
   stages of bootstrap.
   Alternatively users can use pkgconf-lite for early bootstrap.
   Continuous integration now exercises both the muon and pkgconf-lite
 builds.
   See https://github.com/pkgconf/pkgconf/issues/481 for rationale and
 discussion.

 * DEPRECATION: Support for setting `PKG_CONFIG_PATH` from the Windows
 registry
   is slated for removal in 3.1.  It is recommended `PKG_CONFIG_PATH` be
 set from
   the environment on Windows.
   See https://github.com/pkgconf/pkgconf/issues/546 for rationale and
 discussion.

 * SPDX Software Bill of Materials (SBOM) generation:
   - New spdxtool(1) utility which generates SPDX Lite 3.0.1 SBOM files.
 Initial
     implementation by Tuukka Pasanen, sponsored by The FreeBSD Foundation,
 and
     substantially improved since, with major contributions by Elizabeth
 Ashford
     and additional patches by Joshua Watt and Pierre Pronchery.
   - bomtool now supports a --output option, which writes the generated
 SBOM to
     a file instead of standard output, and --define-variable, as the
 pkgconf CLI
     does.  The --define-variable support is by Tuukka Pasanen.
   - bomtool now supports a --creation-time option, like spdxtool, which
 sets the
     SBOM creation timestamp (in ISO 8601 format) instead of using the
 current
     time, and no longer embeds the pkgconf version in its output.  Both
 changes
     allow for reproducible SBOM generation.
   - bomtool now honors the SOURCE_DATE_EPOCH environment variable,
 deriving the
     SBOM creation timestamp from it when --creation-time is not given, for
     reproducible builds.
   - bomtool: improved SPDX conformance.  Mandatory PackageCopyrightText
 and
     PackageLicenseConcluded fields are emitted as NOASSERTION when
 unavailable,
     a Created timestamp is included, invalid PackageVerificationCode
 output was
     removed, the package identifier charset was corrected,
     PackageDownloadLocation is derived from the Source tag, and SPDX 2.3
 package
     names are used.  Patches by Stéphane Rochoy and Tuukka Pasanen.

 * New pccritic(1) utility which scores the quality of pc(5) files.  Each
 module
   or .pc file is graded from A to F based on findings across several
 categories:
   required and recommended metadata, version sanity, relocatability of
 libdir
   and includedir, Cflags and Libs hygiene, the Requires relationship, the
 NTIA
   SBOM minimum elements, and file-formatting style.  Supports --quiet for
 a
   one-line score per target, --min-score for use as a CI gate, and
 colorized
   output.

 * New test and I/O framework.
   - kyua is no longer required to run tests.
   - Declarative configuration for integration tests, C unit tests for
 functional tests.
   - Tests now run on Windows.
   - .pc and personality files are now opened in binary mode, and the line
 reader
     was reworked to correctly handle LF, CRLF and lone-CR line endings,
 including
     on non-seekable streams.  Binary-mode handling by moi15moi.
   Major contributions by Elizabeth Ashford.

 * New pc(5) features:
   - Source tag: a URI which describes where a given package may be
 downloaded.
   - License.file tag: a path to a license file that is on disk.
   - Requires.shared tag: like Requires.private, except a list of
 dependencies only used
     when building in shared mode.
   - Cflags.shared tag: like Cflags.private, except a list of CFLAGS only
 used when building
     in shared mode.
   - Libs.shared tag: like Libs.private, except a list of LIBS only used
 when building
     in shared mode.
   - Link.ABI tag: a comma-separated list of tags describing the
 application binary
     interfaces a consumer must link a package against, such as c++ or
 fortran.
     Tags are case-insensitive and normalized to lowercase, and may be
 queried
     with --link-abi.
   The Source and License.file tags are by Tuukka Pasanen; additional
 patches by
   Elizabeth Ashford.

 * Windows support has been significantly improved.
   - pkgconf can now be built and tested with Visual Studio and clang-cl.
   - Windows on ARM builds are supported, and MSI installers are produced
 for
     x86, x64 and arm64 using MSVC.
   - The console code page is set to UTF-8 and non-ASCII entries in
     PKG_CONFIG_PATH are now handled correctly.
   The clang-cl support, MSI installers and UTF-8 console handling are by
   moi15moi.

 * Portability:
   - pkgconf is now built and tested in continuous integration on NetBSD,
     FreeBSD, OpenBSD, Haiku, OmniOS, macOS and Cygwin in addition to Linux
 and
     Windows.
   - pkgconf now falls back to readlink(2) on systems which lack
 readlinkat(2).
   - A fallback is provided for platforms without nl_langinfo_l, and
 xlocale.h is
     included where needed to build on macOS.
   - Fixed -Werror=format build failures on MinGW caused by the PRIu64
 macro
     expanding to an MSVCRT format specifier that the GNU format-string
 checker
     rejects; serial and identifier values are now printed with %llu.
   The expanded platform CI and the nl_langinfo_l/xlocale.h fallbacks are
 by
   moi15moi.

 * Security hardening:
   - Variable substitution is now guarded against denial-of-service inputs,
     including billion-laughs style expansion and excessively complex
 bytecode
     programs.
   - Dependency traversal is now limited to 256 levels by default to
 prevent
     stack exhaustion from excessively deep graphs.  A depth of -1
 explicitly
     enables unlimited traversal.
   - Bytecode validation now uses overflow-safe bounds checks and rejects
     truncated, oversized and otherwise malformed programs.
   - Dynamic buffers now reject overlapping source and destination storage
 and
     guard allocation-size arithmetic against overflow.
   - LLVM libFuzzer targets were added for the pc(5) parser and the solver,
 and
     the numerous out-of-memory and crash paths they surfaced were
 hardened.
   - Allocation failures are now propagated through parsing, rendering,
 output
     and SBOM generation instead of silently producing partial results.
   - Dropped use of strlcpy, strlcat and other silently truncating string
     functions.

 * CLI changes:
   - New --newlines option, which separates emitted fragments with newlines
     instead of spaces.
   - New --print-digraph-query-nodes option, which annotates the --digraph
     output with the nodes that were part of the original query.
   - --list-all and --list-package-names now include synthesized virtual
     packages provided via the Provides tag.
   - Variables can now be overridden using
 PKG_CONFIG_MODULENAME_VARIABLENAME
     environment variables.  This was formally specified but never
 implemented
     in pkgconf.
   - PKG_CONFIG_LOG is now appended to rather than overwritten.
   - --dump-personality output is now consistent with the
     pkgconf-personality(5) format and additionally reports WantDefaultPure
 and
     WantDefaultStatic.
   - The vestigial --relocate=path option, which existed only for the old
 test
     suite, has been removed.
   - pccritic --min-score now strictly accepts integer values from 0
 through 100.

 * Build system changes:
   - The meson build gained a with-pkg-config-dir option to override the
 default
     package search path, matching the autotools --with-pkg-config-dir
 option.

 * pkg.m4 changes:
   - PKG_WITH_MODULES now properly quotes its action arguments (serial 16).
     Patch by Antonin Décimo.
   - The macros no longer direct users to the freedesktop pkg-config
 project.

 * Correctness fixes:
   - The built-in pkg-config and pkgconf packages are now constructed from
 the
     configured personality instead of being hardcoded, so their reported
 data
     reflects the active personality.  They are also exposed as proper
 versioned
     virtual packages.
   - ${pc_sysrootdir} now defaults to an empty string instead of '/'.
   - Variable substitution was reimplemented using a bytecode engine, which
     tracks whether special variables such as ${pc_sysrootdir} have already
 been
     applied so that they are not substituted more than once.
   - The solver now re-checks the final solution for conflicts before
 returning
     success, and tracks the origin of conflict rules.
   - Requires.internal is now treated as a weaker form of Requires.private:
 its
     dependency nodes need not be satisfied when link libraries are not
     requested.
   - pkgconf now warns about .pc files that duplicate a dependency-list
 field,
     whose behavior is inconsistent across pkg-config implementations.
   - Version comparison was reworked to use a structured algorithm modeled
 on
     apk-tools.
   - Newline folding behavior when parsing multi-line fields has been
 adjusted.
   - Bare variable expansions inside fragment lists are now re-parsed so
 that any
     flags they expand to are tokenized correctly.
   - ${pc_sysrootdir} is now only injected when it matches a complete path
     boundary, and obviously bogus sysroot_dir definitions are ignored,
 fixing
     incorrect sysroot injection.
   - Arguments are now combined when a flag is expected to carry a separate
     value, such as -I dir or -framework name.
   - SPDX license expressions in the License field are now properly parsed
 and
     validated.
 * The libpkgconf API and ABI were substantially reworked, breaking both
 API and
   ABI compatibility.  Consumers will need source changes as well as a
 rebuild.
   The libpkgconf soversion is now 8.
   - An abstract pkgconf_buffer_t type is now used throughout libpkgconf in
 place
     of fixed-size stack buffers, removing a class of truncation bugs.
   - A new pkgconf_output API abstracts all output, allowing the output
 stream to
     be set per-client and redirected (pkgconf_client_set_output,
     pkgconf_output_file_fmt and friends).
   - The pkgconf_tuple_parse API has been removed; variables are now
 evaluated
     via pkgconf_variable_eval (backed by the new bytecode engine).
   - The fragment rendering API was reworked around pkgconf_buffer_t, and
 the old
     pkgconf_fragment_render API has been removed.  Fragment renderer
 callbacks
     and pkgconf_fragment_render_buf now return bool so allocation and
 rendering
     failures can be reported.
   - pkgconf_license_render now returns bool so allocation failures can be
     reported.
   - The package copyright field was migrated to a bufferset.
   - Environment variable lookups can now be mocked via
 pkgconf_client_getenv.
   - Client construction gained an options-based API:
 pkgconf_client_init_with_options
     and pkgconf_client_new_with_options accept a pkgconf_client_options_t
 struct, with
     the original pkgconf_client_init and pkgconf_client_new retained as
 wrappers.  The
     unveil handler may now be supplied directly as a client option.
   - New pkgconf_variable_eval_name API, which evaluates a named variable
 and
     applies sysroot fixups to the result.
   - The pkgconf_pkg_traverse_func_t callback gained a trailing iter_flags
     argument carrying per-traversal state (PKGCONF_PKG_ITERF_*), replacing
 the
     removed PKGCONF_PKG_PKGF_ITER_PKG_IS_PRIVATE client flag.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/lfs/ticket/5962#comment:9>
LFS Trac <https://wiki.linuxfromscratch.org/lfs/>
Linux From Scratch: Your Distro, Your Rules.

-- 
http://lists.linuxfromscratch.org/sympa/info/lfs-book
Unsubscribe: See the above information page