Walk an installed vcpkg tree, convert each port's SPDX document into a
qt_attribution.json next to it, and write an index mapping installed
library paths to port names. Qt's SBOM machinery reads
qt_attribution.json, so this gets license and provenance information for
vcpkg provided third party libraries into Qt's SBOM without duplicating
that data in Qt repositories.
Ports that install nothing outside share/ and tools/ are skipped. They
are metaports that exist only to depend on other ports, can never be
linked, and are also the only ports whose license metadata is unusable.
Filtering on that rather than on a missing license keeps a real library
with broken metadata visible, which is the case that must not be hidden.
The index exists because a MODULE mode find_package sets no <Package>_DIR
to resolve, and because the vcpkg install database is not shipped in the
developer archives. Its keys are relative to the prefix, so the same file
serves both the vcpkg installed tree and the flattened archive.
A port whose .list file is missing still gets an attribution file, since
emitting nothing would hide a real library. A missing install database
directory, by contrast, is fatal: it would silently disable the whole
feature for every port.
Task-number: QTBUG-150865
Change-Id: I6383169ee321cd88dfe90477e92aa071448c4d6d
Reviewed-by: Alexandru Croitor <[email protected]>
Brings the isExternal property for Components, which is useful to add
for Qt product sboms for system library components.
Pick-to: 6.8 6.12
Change-Id: Iff8e7a50688eefc585322f512681a33202fab437
Reviewed-by: Joerg Bornemann <[email protected]>
All Qt repos should now be ready for the stricter 6.2.0 reuse license
parser.
Some of our platforms don't have Python 3.10 though (RHEL 9.6) which
is a requirement for reuse 6.2.0, so we keep provisioning the older
5.1.1 version on those platforms.
Pick-to: 6.12
Task-number: QTBUG-149427
Task-number: QTBUG-140916
Change-Id: I17a77b16345c974dc076edda3e7481b6ef005a6f
Reviewed-by: Joerg Bornemann <[email protected]>
Building the additional packages for the x86_64 target needs an x64
counterpart to the arm64-ohos-qt triplet. Without it vcpkg rejects the
triplet name outright.
It differs from arm64-ohos-qt only in the target architecture and the
matching values from the OHOS CMake toolchain: OHOS_ARCH x86_64 and the
x86_64-unknown-linux-ohos make build triplet.
Change-Id: Ied8c9db9946b9d3dec27d05a0123473927f6d50c
Reviewed-by: Liang Qi <[email protected]>
Provision the Android 17 SDK platform and build tools,
and compile the Gradle cache project against them.
Pick-to: 6.12
Task-number: QTBUG-136620
Change-Id: I6470f60c08f028a2bfbc6ed09a99492d4a174402
Reviewed-by: Ville Voutilainen <[email protected]>
The manifest has pinned openssl to 3.0.7 port-version 2 since a5a63931
(Nov 2023), which was the version manual provisioning shipped at the
time. Support for the OpenSSL 3.0 line ended on 2026-09-07, and manual
provisioning has since moved to 3.5.4.
qtgrpc is the only module that opts into vcpkg today, and it does link
the vcpkg copy: the qtgrpc_standalone_tests configure reports OpenSSL
3.0.7 out of installed/<triplet> on Linux, Windows and macOS, and
grpc_testserver, tst_grpc_client_end2end and
tst_grpc_client_interceptors link it. So the stale pin is live, not
dormant.
Pin 3.5.4 port-version 0 rather than dropping the override: it matches
install-openssl.sh and openssl.ps1 exactly, and 3.5 is an LTS release
whereas the registry baseline 3.6.3 is not. The port exists at the
registry tag we already pin, so vcpkg_version.txt stays untouched.
Request the "tools" feature at the same time. 3.0.7 installed the
openssl executable unconditionally; 3.5.4 puts it behind that feature,
which is not enabled by default. qtgrpc's test_server does
find_program(openssl) to regenerate its TLS test certificates and only
warns when the executable is missing, leaving the TLS tests to fail
later on absent key.pem and cert.pem. Building the tool alongside the
libraries keeps the CLI and the linked library at the same version and
drops a hidden dependency on manually provisioned OpenSSL being on
PATH, which is what we want to retire.
The feature is scoped to non-Android, because vcpkg puts the target
triplet's tools directory on CMAKE_PROGRAM_PATH. A cross-built openssl
there would be picked up by find_program and fail to run on the host,
which is the same trap as QTBUG-145933 for protoc. Android keeps the
plain port; the certificates are generated by the host tool anyway.
Task-number: QTBUG-115715
Pick-to: 6.12
Change-Id: I3b36677837fae3080e9362526bd35012e31fc04e
Reviewed-by: Alexandru Croitor <[email protected]>
This switches vcpkg back to a specific tag of the master branch of our
fork. That's why we can remove the "reference" key from the
configuration too, since master is the default branch.
The updated protobuf port only builds the libprotoc compiler library
when the target triplet equals the host triplet, or when the libprotoc
or target-protoc feature is requested. Since we always build against
our custom *-qt triplets, which never match the host triplet, request
the libprotoc feature so that protobuf::libprotoc is available and
qtgrpc can build qtprotobufgen.
Pick-to: 6.12
Change-Id: Ief4b12c57c082f94b2bcfae6fd02ebac7018a5c9
Reviewed-by: Alexandru Croitor <[email protected]>
Qt for Android builds run Gradle which needs to frequently
request download artifacts from Gradle and Maven, and that
can sometimes fail due to network issues, or worse in times
or many request might get temporarily blocked.
To avoid that, this uses the internal Gradle mirror. This
is done by installing an init script routing every
repository through the internal Nexus mirror.
Also, since Qt's build runs offline, ~/.gradle must be
fully prepared during provisioning, without reaching
public repositories. That's achieve by priming the cache
by building the shared proiect and seeding the Gradle
distribution from the internal mirror into the wrapper
cache, so no wrapper externally request Gradle.
Pick-to: 6.12
Fixes: QTQAINFRA-6166
Task-number: QTQAINFRA-7942
Change-Id: I1e8dacf8ea5f3c492f12270c5f407bd4e5a2e756
Reviewed-by: Ville-Pekka Karhu <[email protected]>
Add Qt Gradle plugin to the provisioning Gradle cache to avoid
potential fetching on each build in qtdeclarative tests.
Pick-to: 6.12 6.11 6.8
Fixes: QTBUG-147567
Change-Id: I2ac5ef09b958e50d808a024479ee6d4ed111aff0
Reviewed-by: Toni Saario <[email protected]>
Add feature-delivery plugin to the provisioning Gradle cache
to avoid potential fetching on each build in qtbase tests.
Pick-to: 6.12 6.11 6.8
Change-Id: Ie9126114287aff77abcd2f68bfff4d8dc25fa6a9
Reviewed-by: Toni Saario <[email protected]>
The FFmpeg components 'avdevice' and 'avfilter' are not used in Qt.
By not building them, we save some time during provisioning in CI.
Pick-to: 6.12 6.11
Change-Id: Id9219f6c00bd48d35d1d5c5b87eecb45f8c16c45
Reviewed-by: Mikko Hallamaa <[email protected]>
Reviewed-by: Artem Dyomin <[email protected]>
Reviewed-by: Elias Toivola <[email protected]>
The upstream vcpkg *-ohos triplets have been changed to build static
libraries in multi-config mode. Add (and use) an arm64-ohos-qt triplet
that builds shared libs in release mode.
The triplet differs from the upstream one only in the values
VCPKG_LIBRARY_LINKAGE and VCPKG_BUILD_TYPE.
This patch is a preparation for merging vcpkg upstream back to our
fork.
Pick-to: 6.12
Change-Id: Iac6a4798b0322e9c57cf09ca35a408c66504ba46
Reviewed-by: Alexandru Croitor <[email protected]>
vcpkg-tool release tag 2026-05-27 contains the patch necessary for
HarmonyOS support. We can use the unpatched upstream vcpkg-tool again.
Change the provisioning scripts back to fetch the tool from upstream's
release artifacts page.
Pick-to: 6.12
Fixes: QTQAINFRA-7902
Change-Id: I84ef4582ef8ff5ca6e8e135128fe515438ac2a22
Reviewed-by: Elias Toivola <[email protected]>
Reviewed-by: Alexandru Croitor <[email protected]>
The new tag and new baseline include the previous qt port
customizations, but also brings in new necessary port changes
to install ohos-related packages.
Done-with: Joerg Bornemann <[email protected]>
Change-Id: I813e84b7708656329b3373073a795ed0b9ac45d8
Reviewed-by: Alexandru Croitor <[email protected]>
Add an :app and :lib modules so both com.android.application
and com.android.library paths are exercised, and add a Kotlin
source + JUnit test in each module. This makes gradlew build
pull the kotlin toolchain jars (compiler-embeddable, reflect,
coroutines) that Qt Android JAR and app builds could need
later. This way we ensure all possible artifacts are made
available in the cache during provisioning and avoid or at
least reduce the chances or later downloads.
Task-number: QTBUG-132915
Change-Id: Ic518f96370ffc40f921bcb3063257f8663e41615
Reviewed-by: Alexandru Croitor <[email protected]>
This feature enables us to build protobuf with different host/target
triplets to lipo the result.
Fixes: QTBUG-145933
Change-Id: I1456c148686c27cecc6f1f2f5decdeb6f0a2304d
Reviewed-by: Alexandru Croitor <[email protected]>
It's a new fork under a qtbuildsystem group, but with the contents of
the aledelev fork.
The older mrmsdbdl fork is not used anymore, so it's removed.
Pick-to: 6.8 6.11
Change-Id: I641cf8b86e3809f399cfddbe6c5d71ee6174917c
Reviewed-by: Joerg Bornemann <[email protected]>
Add scripts to download and cache Gradle distribution
and its dependencies during provisioning for all hosts
so that Qt builds don't have to fetch them on every Qt
module and test build.
Add those scripts to various RHEL, Ubuntu, macos and
windows configurations after Android has been run
since the Gradle build for Android requires Android
SDK.
Prior to this, to avoid having a full Gradle project added
to the coin tree, some Gradle files were being fetched from
qtbase using a commit sha, that was aiming to reduce the
amount of changes each time, but that's a bit awkward since
the files here and this commit sha needs to be updated
anyways. So just have a full Gradle project here and update
its values whenever we bump Gradle or Android supported
versions.
Task-number: QTBUG-132915
Change-Id: Id4876ad90a09cdaada5b96c457820c691e2be426
Reviewed-by: Simo Fält <[email protected]>
Reviewed-by: Dimitrios Apostolou <[email protected]>
In the current Android FFmpeg provisioning, we rely on the tool
'readelf' to be installed on the host. On macOS we currently pull this
tool through the Homebrew 'binutils' package. This has proven
unreliable on older macOS hosts.
The Android NDK provides the same tool under the name 'llvm-readelf'.
This patch makes us rely on this tool during provisioning, which is
guaranteed to be provided.
Pick-to: 6.11
Change-Id: I47a186d2dd4b442929b82f35b4d257d011cb9d10
Reviewed-by: Artem Dyomin <[email protected]>
Reviewed-by: Dimitrios Apostolou <[email protected]>
Reviewed-by: Tero Heikkinen <[email protected]>
With Python 3.12 SBOM needs jsonschema package newer than 4.19
but cannot uninstall current one installed by RPM:
Error:
Attempting uninstall: jsonschema
Found existing installation: jsonschema 4.19.1
error: uninstall-no-record-file
× Cannot uninstall jsonschema 4.19.1
Therefore virtual env is used to fix this.
Pick-to: 6.11
Task-number: QTQAINFRA-7554
Change-Id: I1260ef7fdf0c1ba96acaee1738ed9612e47bedad
Reviewed-by: Alexandru Croitor <[email protected]>
Because RHEL 10 comes with an older version of jsonschema (4.19),
which breaks cyclonedx verification at qtbase runtime.
Pick-to: 6.11
Change-Id: Ib7044b6d4107e5382015adfdd8eb747be8605934
Reviewed-by: Alexandru Croitor <[email protected]>
Android arm64 and x86_64 builds now require 16KB page size alignment in
native binaries, this includes FFmpeg. When running patchelf on the
binaries, it will implicitly re-align the affected sections to 4KB page
size.
This patch solves this by using the --page-size flag for patchelf, only
for the builds that require it.
Pick-to: 6.11 6.10 6.8
Fixes: QTBUG-142332
Change-Id: Iba88bf702fd075d2b4432d9cde94f779b14de52f
Reviewed-by: Assam Boudjelthia <[email protected]>
These scripts are generic for both linux and macos, we may parameterize
them and reuse on both platforms.
Change-Id: Ia61cfbbf5c91e2135e38253c4a96605015d2d1b6
Reviewed-by: Alexey Edelev <[email protected]>
There is not particular reason to hold multiple manifests for the vcpkg
for different platforms, since we expect that the direct dependency set
that is used from vcpkg will remain the same on each platform.
Keeping copies of the vcpkg manifest doesn't make much sense.
The vcpkg manifest and configuration file are now in the
coin/provisioning/common/shared/vcpkg directory.
Change-Id: Icc9c88592c68cb591216f3d0668f9984592d6c7b
Reviewed-by: Simo Fält <[email protected]>
The fetching from 3rd party repos has become very flaky.
To avoid mirrors throttling us and other flaky issues cache
the dependencies and set -o to enable offline mode.
This seems to also speed up the step considerably.
Pick-to: 6.10 6.9 6.8 6.5
Change-Id: I01663e60baa44ab828d8880ab8b346034a50b60e
Reviewed-by: Jukka Jokiniva <[email protected]>
At the time of writing, homebrew ships patchelf version 0.18.0. This
version of patchelf has a bug specific to Androd binaries. The macOS
14 arm64 host currently uses this version of patchelf. This causes an
issue during runtime linking in Qt Multimedia applications on Android.
This patch modifies the macOS 14 arm64 host to use patchelf v0.17.2
that we compile from source. It also adds warnings to the provisioning
log should someone try to use v0.18.0 in the future.
Fixes: QTBUG-136930
Pick-to: 6.10 6.9 6.8
Change-Id: Id66b560e6a1d4300a54017e9c3366720dc291944
Reviewed-by: Artem Dyomin <[email protected]>
In preparation for generating a CycloneDX SBOM for Qt framework,
install the cyclonedx-python-lib package which will be a required
dependency for the SBOM generation process (assuming CycloneDX
generation feature is enabled in the build).
Pick-to: 6.8 6.9 6.10
Task-number: QTBUG-129598
Change-Id: Iacaeb22aa568cecd6ffbe2ece30de953e37c5cf2
Reviewed-by: Alexey Edelev <[email protected]>
This script has previously failed under some configurations, while
also failing to stop provisioning.
This patch enables fast-fail behavior, catches potential issues with
missing executables early with a descriptive error message. This
should allow us to detect if the required packages are missing
in the future, and stop provisioning accordingly.
This patch also installs the necessary packages on the relevant
CI build targets.
Task-number: QTBUG-136930
Pick-to: 6.10 6.9 6.8
Change-Id: I7c781264ad67508d19fd44556a9caf0f201638d4
Reviewed-by: Assam Boudjelthia <[email protected]>
Prefer static linking for now, to bypass the deployment issues.
We will switch to dynamic libraries once online installer deliver the
vcpkg installed libraries.
Change-Id: Iac9a888237742ae886df8fb9b742b45f4727e28a
Reviewed-by: Alexandru Croitor <[email protected]>
We may read the installed package information from the 'vcpkg list'
command instead of parsing the vcpkg.json. Also instead of using
the jq as a parser, use the cmake script. This allows skipping the
jq installation.
Change-Id: Id3ace62f8f40ff1bd059878da3fd13e466861830
Reviewed-by: Alexandru Croitor <[email protected]>
* add FFmpeg stubs to the 'Required.private' section.
This will make the logic more robust after integration this
in qt multimedia.
* add some script comments.
* fix shellcheck.
* add validity checks.
Pick-to: 6.8 6.9
Change-Id: I28639d21c7210109e52ff98ce682da51f8744287
Reviewed-by: Jøger Hansegård <[email protected]>
Reviewed-by: Pavel Dubsky <[email protected]>
It's easier to manage the vcpkg tool versions using this file,
but not editing script each time.
Change-Id: If6d04a8ac07731ec1fab46b1f663b86bbe640631
Reviewed-by: Joerg Bornemann <[email protected]>
Joerg Bornemann