gty404 opened a new pull request, #1082: URL: https://github.com/apache/iceberg-cpp/pull/1082
## Summary - Five `FetchContent` downloads in `cmake_modules/IcebergThirdpartyToolchain.cmake` (`croaring`, `nlohmann_json`, `spdlog`, `cpr`, `sqlpp23`) had no `URL_HASH`, unlike `Arrow`, `nanoarrow`, and `utf8proc` in the same file — a compromised archive or a tampered mirror would be compiled without any integrity check. - Add `URL_HASH "SHA256=..."` to each, following the existing `ICEBERG_<NAME>_BUILD_SHA256_CHECKSUM` pattern already used for `Arrow`/`nanoarrow`/`utf8proc`. - Each checksum was computed directly from the currently pinned release/tag tarball at the exact URL already in the file; no version changes. - Mirror overrides (`ICEBERG_*_URL` env vars) are still honored, and the checksum still applies against them, matching the existing `ICEBERG_ARROW_URL` contract. ## Test plan - No test-suite hook exists for toolchain fetch behavior; enforcement is configure-time by construction (`FetchContent` fails closed on a `URL_HASH` mismatch). - Verified each checksum by downloading the pinned URL and computing its SHA-256 independently, confirming it matches the value added here. - Verified the file parses and executes cleanly with `cmake -P` through all five modified functions. - `cmake-format` and `pre-commit` pass on the changed file. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
