-
Notifications
You must be signed in to change notification settings - Fork 126
Offline builds (reproducibility, security) #38
Description
Jaeger's c++ bindings seem to leap out to the Internet to build private copies of build dependencies like Boost.
A bit of reading of the build code shows that
cmake -DHUNTER_ENABLED=0
is sufficient to suppress this behaviour, at which point you can configure it with local dependencies. It'd be nice if this were in the README.md.
I got partway with:
sudo dnf install boost-devel thrift-devel json-devel libyaml-devel gtest-devel
then building the opentracing C++ API from https://github.com/opentracing/opentracing-cpp and installing that first.
It still gets stuck on the rpm packaging for json-devel (nlohmann) since there's no bundled nlohmann_jsonConfig.cmake . Seems it doesn't know how to do discovery for that, I'll see if I can add it. Same with the yaml libraries.
But even when I make configs fro nlohmann and json-devel and then
cmake -DHUNTER_ENABLED=0 -Dnlohmann_json_DIR=. -Dyaml-cpp_DIR=.
it still fails with
Target "UnitTest" links to target "thrift::thrift_static" but the target
was not found. Perhaps a find_package() call is missing for an IMPORTED
target, or an ALIAS target is missing?
It could be related to version, but the CMake code doesn't do any tests for required versions and there's no documentation on required verisons, so I'm struggling to know what's required. I have:
$ rpm -q boost-devel thrift-devel json-devel libyaml-devel gtest-devel
boost-devel-1.60.0-10.fc25.x86_64
thrift-devel-0.9.1-17.fc25.5.x86_64
json-devel-2.0.2-1.fc25.x86_64
libyaml-devel-0.1.6-8.fc24.x86_64
gtest-devel-1.7.0-8.fc25.x86_64
$ cmake -version
cmake version 3.9.0
$ gcc --version|head -1
gcc (GCC) 6.4.1 20170727 (Red Hat 6.4.1-1)
$ lsb_release -a
LSB Version: :core-4.1-amd64:core-4.1-noarch:cxx-4.1-amd64:cxx-4.1-noarch:desktop-4.1-amd64:desktop-4.1-noarch:languages-4.1-amd64:languages-4.1-noarch:printing-4.1-amd64:printing-4.1-noarch
Distributor ID: Fedora
Description: Fedora release 25 (Twenty Five)
Release: 25
Codename: TwentyFive
Anyway, it'd be nice to document the dependencies and that building without "grab it all from the Internet" is supported in the README.md.
I'll experiment with it for now by letting Hunter do its thing, but I really don't want to do things like build Boost all the time...