CVS commit: pkgsrc/devel/pkgconf

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Jul 13 09:54:01 UTC 2026

Modified Files:
        pkgsrc/devel/pkgconf: Makefile PLIST distinfo
Removed Files:
        pkgsrc/devel/pkgconf/patches: patch-libpkgconf_pkg.c

Log Message:
pkgconf: update to 3.0.1.

Changes from 3.0.0 to 3.0.1:
----------------------------

* Various Meson-related fixes and improvements.
  Patches by Benjamin Gilbert.

Changes from 2.5.1 to 3.0.0:
----------------------------

* DEPRECATION: The autotools build system will be dropped after the 3.0 release.
  Building pkgconf with muon is recommended for early bootstrap and meson in later
  stages of bootstrap.
  Alternatively users can use pkgconf-lite for early bootstrap.
  Continuous integration now exercises both the muon and pkgconf-lite builds.
  See https://github.com/pkgconf/pkgconf/issues/481 for rationale and discussion.

* DEPRECATION: Support for setting `PKG_CONFIG_PATH` from the Windows registry
  is slated for removal in 3.1.  It is recommended `PKG_CONFIG_PATH` be set from
  the environment on Windows.
  See https://github.com/pkgconf/pkgconf/issues/546 for rationale and discussion.

* SPDX Software Bill of Materials (SBOM) generation:
  - New spdxtool(1) utility which generates SPDX Lite 3.0.1 SBOM files.  Initial
    implementation by Tuukka Pasanen, sponsored by The FreeBSD Foundation, and
    substantially improved since, with major contributions by Elizabeth Ashford
    and additional patches by Joshua Watt and Pierre Pronchery.
  - bomtool now supports a --output option, which writes the generated SBOM to
    a file instead of standard output, and --define-variable, as the pkgconf CLI
    does.  The --define-variable support is by Tuukka Pasanen.
  - bomtool now supports a --creation-time option, like spdxtool, which sets the
    SBOM creation timestamp (in ISO 8601 format) instead of using the current
    time, and no longer embeds the pkgconf version in its output.  Both changes
    allow for reproducible SBOM generation.
  - bomtool now honors the SOURCE_DATE_EPOCH environment variable, deriving the
    SBOM creation timestamp from it when --creation-time is not given, for
    reproducible builds.
  - bomtool: improved SPDX conformance.  Mandatory PackageCopyrightText and
    PackageLicenseConcluded fields are emitted as NOASSERTION when unavailable,
    a Created timestamp is included, invalid PackageVerificationCode output was
    removed, the package identifier charset was corrected,
    PackageDownloadLocation is derived from the Source tag, and SPDX 2.3 package
    names are used.  Patches by Stéphane Rochoy and Tuukka Pasanen.

* New pccritic(1) utility which scores the quality of pc(5) files.  Each module
  or .pc file is graded from A to F based on findings across several categories:
  required and recommended metadata, version sanity, relocatability of libdir
  and includedir, Cflags and Libs hygiene, the Requires relationship, the NTIA
  SBOM minimum elements, and file-formatting style.  Supports --quiet for a
  one-line score per target, --min-score for use as a CI gate, and colorized
  output.

* New test and I/O framework.
  - kyua is no longer required to run tests.
  - Declarative configuration for integration tests, C unit tests for functional tests.
  - Tests now run on Windows.
  - .pc and personality files are now opened in binary mode, and the line reader
    was reworked to correctly handle LF, CRLF and lone-CR line endings, including
    on non-seekable streams.  Binary-mode handling by moi15moi.
  Major contributions by Elizabeth Ashford.

* New pc(5) features:
  - Source tag: a URI which describes where a given package may be downloaded.
  - License.file tag: a path to a license file that is on disk.
  - Requires.shared tag: like Requires.private, except a list of dependencies only used
    when building in shared mode.
  - Cflags.shared tag: like Cflags.private, except a list of CFLAGS only used when building
    in shared mode.
  - Libs.shared tag: like Libs.private, except a list of LIBS only used when building
    in shared mode.
  - Link.ABI tag: a comma-separated list of tags describing the application binary
    interfaces a consumer must link a package against, such as c++ or fortran.
    Tags are case-insensitive and normalized to lowercase, and may be queried
    with --link-abi.
  The Source and License.file tags are by Tuukka Pasanen; additional patches by
  Elizabeth Ashford.

* Windows support has been significantly improved.
  - pkgconf can now be built and tested with Visual Studio and clang-cl.
  - Windows on ARM builds are supported, and MSI installers are produced for
    x86, x64 and arm64 using MSVC.
  - The console code page is set to UTF-8 and non-ASCII entries in
    PKG_CONFIG_PATH are now handled correctly.
  The clang-cl support, MSI installers and UTF-8 console handling are by
  moi15moi.

* Portability:
  - pkgconf is now built and tested in continuous integration on NetBSD,
    FreeBSD, OpenBSD, Haiku, OmniOS, macOS and Cygwin in addition to Linux and
    Windows.
  - pkgconf now falls back to readlink(2) on systems which lack readlinkat(2).
  - A fallback is provided for platforms without nl_langinfo_l, and xlocale.h is
    included where needed to build on macOS.
  - Fixed -Werror=format build failures on MinGW caused by the PRIu64 macro
    expanding to an MSVCRT format specifier that the GNU format-string checker
    rejects; serial and identifier values are now printed with %llu.
  The expanded platform CI and the nl_langinfo_l/xlocale.h fallbacks are by
  moi15moi.

* Security hardening:
  - Variable substitution is now guarded against denial-of-service inputs,
    including billion-laughs style expansion and excessively complex bytecode
    programs.
  - Dependency traversal is now limited to 256 levels by default to prevent
    stack exhaustion from excessively deep graphs.  A depth of -1 explicitly
    enables unlimited traversal.
  - Bytecode validation now uses overflow-safe bounds checks and rejects
    truncated, oversized and otherwise malformed programs.
  - Dynamic buffers now reject overlapping source and destination storage and
    guard allocation-size arithmetic against overflow.
  - LLVM libFuzzer targets were added for the pc(5) parser and the solver, and
    the numerous out-of-memory and crash paths they surfaced were hardened.
  - Allocation failures are now propagated through parsing, rendering, output
    and SBOM generation instead of silently producing partial results.
  - Dropped use of strlcpy, strlcat and other silently truncating string
    functions.

* CLI changes:
  - New --newlines option, which separates emitted fragments with newlines
    instead of spaces.
  - New --print-digraph-query-nodes option, which annotates the --digraph
    output with the nodes that were part of the original query.
  - --list-all and --list-package-names now include synthesized virtual
    packages provided via the Provides tag.
  - Variables can now be overridden using PKG_CONFIG_MODULENAME_VARIABLENAME
    environment variables.  This was formally specified but never implemented
    in pkgconf.
  - PKG_CONFIG_LOG is now appended to rather than overwritten.
  - --dump-personality output is now consistent with the
    pkgconf-personality(5) format and additionally reports WantDefaultPure and
    WantDefaultStatic.
  - The vestigial --relocate=path option, which existed only for the old test
    suite, has been removed.
  - pccritic --min-score now strictly accepts integer values from 0 through 100.

* Build system changes:
  - The meson build gained a with-pkg-config-dir option to override the default
    package search path, matching the autotools --with-pkg-config-dir option.

* pkg.m4 changes:
  - PKG_WITH_MODULES now properly quotes its action arguments (serial 16).
    Patch by Antonin Décimo.
  - The macros no longer direct users to the freedesktop pkg-config project.

* Correctness fixes:
  - The built-in pkg-config and pkgconf packages are now constructed from the
    configured personality instead of being hardcoded, so their reported data
    reflects the active personality.  They are also exposed as proper versioned
    virtual packages.
  - ${pc_sysrootdir} now defaults to an empty string instead of '/'.
  - Variable substitution was reimplemented using a bytecode engine, which
    tracks whether special variables such as ${pc_sysrootdir} have already been
    applied so that they are not substituted more than once.
  - The solver now re-checks the final solution for conflicts before returning
    success, and tracks the origin of conflict rules.
  - Requires.internal is now treated as a weaker form of Requires.private: its
    dependency nodes need not be satisfied when link libraries are not
    requested.
  - pkgconf now warns about .pc files that duplicate a dependency-list field,
    whose behavior is inconsistent across pkg-config implementations.
  - Version comparison was reworked to use a structured algorithm modeled on
    apk-tools.
  - Newline folding behavior when parsing multi-line fields has been adjusted.
  - Bare variable expansions inside fragment lists are now re-parsed so that any
    flags they expand to are tokenized correctly.
  - ${pc_sysrootdir} is now only injected when it matches a complete path
    boundary, and obviously bogus sysroot_dir definitions are ignored, fixing
    incorrect sysroot injection.
  - Arguments are now combined when a flag is expected to carry a separate
    value, such as -I dir or -framework name.
  - SPDX license expressions in the License field are now properly parsed and
    validated.  Patches by Tuukka Pasanen.

* The libpkgconf API and ABI were substantially reworked, breaking both API and
  ABI compatibility.  Consumers will need source changes as well as a rebuild.
  The libpkgconf soversion is now 8.
  - An abstract pkgconf_buffer_t type is now used throughout libpkgconf in place
    of fixed-size stack buffers, removing a class of truncation bugs.
  - A new pkgconf_output API abstracts all output, allowing the output stream to
    be set per-client and redirected (pkgconf_client_set_output,
    pkgconf_output_file_fmt and friends).
  - The pkgconf_tuple_parse API has been removed; variables are now evaluated
    via pkgconf_variable_eval (backed by the new bytecode engine).
  - The fragment rendering API was reworked around pkgconf_buffer_t, and the old
    pkgconf_fragment_render API has been removed.  Fragment renderer callbacks
    and pkgconf_fragment_render_buf now return bool so allocation and rendering
    failures can be reported.
  - pkgconf_license_render now returns bool so allocation failures can be
    reported.
  - The package copyright field was migrated to a bufferset.
  - Environment variable lookups can now be mocked via pkgconf_client_getenv.
  - Client construction gained an options-based API: pkgconf_client_init_with_options
    and pkgconf_client_new_with_options accept a pkgconf_client_options_t struct, with
    the original pkgconf_client_init and pkgconf_client_new retained as wrappers.  The
    unveil handler may now be supplied directly as a client option.
  - New pkgconf_variable_eval_name API, which evaluates a named variable and
    applies sysroot fixups to the result.
  - The pkgconf_pkg_traverse_func_t callback gained a trailing iter_flags
    argument carrying per-traversal state (PKGCONF_PKG_ITERF_*), replacing the
    removed PKGCONF_PKG_PKGF_ITER_PKG_IS_PRIVATE client flag.


To generate a diff of this commit:
cvs rdiff -u -r1.36 -r1.37 pkgsrc/devel/pkgconf/Makefile
cvs rdiff -u -r1.10 -r1.11 pkgsrc/devel/pkgconf/PLIST
cvs rdiff -u -r1.31 -r1.32 pkgsrc/devel/pkgconf/distinfo
cvs rdiff -u -r1.3 -r0 pkgsrc/devel/pkgconf/patches/patch-libpkgconf_pkg.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/pkgconf/Makefile
diff -u pkgsrc/devel/pkgconf/Makefile:1.36 pkgsrc/devel/pkgconf/Makefile:1.37
--- pkgsrc/devel/pkgconf/Makefile:1.36  Tue Dec 30 13:12:41 2025
+++ pkgsrc/devel/pkgconf/Makefile       Mon Jul 13 09:54:00 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.36 2025/12/30 13:12:41 adam Exp $
+# $NetBSD: Makefile,v 1.37 2026/07/13 09:54:00 wiz Exp $
 
-DISTNAME=      pkgconf-2.5.1
+DISTNAME=      pkgconf-3.0.1
 CATEGORIES=    devel
 MASTER_SITES=  https://distfiles.dereferenced.org/pkgconf/
 

Index: pkgsrc/devel/pkgconf/PLIST
diff -u pkgsrc/devel/pkgconf/PLIST:1.10 pkgsrc/devel/pkgconf/PLIST:1.11
--- pkgsrc/devel/pkgconf/PLIST:1.10     Tue Dec 30 13:12:41 2025
+++ pkgsrc/devel/pkgconf/PLIST  Mon Jul 13 09:54:00 2026
@@ -1,7 +1,9 @@
-@comment $NetBSD: PLIST,v 1.10 2025/12/30 13:12:41 adam Exp $
+@comment $NetBSD: PLIST,v 1.11 2026/07/13 09:54:00 wiz Exp $
 bin/bomtool
+bin/pccritic
 bin/pkg-config
 bin/pkgconf
+bin/spdxtool
 include/pkgconf/libpkgconf/bsdstubs.h
 include/pkgconf/libpkgconf/iter.h
 include/pkgconf/libpkgconf/libpkgconf-api.h
@@ -10,11 +12,16 @@ include/pkgconf/libpkgconf/stdinc.h
 lib/libpkgconf.la
 lib/pkgconfig/libpkgconf.pc
 man/man1/bomtool.1
+man/man1/pccritic.1
 man/man1/pkg-config.1
 man/man1/pkgconf.1
+man/man1/spdxtool.1
 man/man5/pc.5
 man/man5/pkgconf-personality.5
 man/man7/pkg.m4.7
 share/aclocal/pkg.m4
 share/doc/pkgconf/AUTHORS
+share/doc/pkgconf/CONTRIBUTING.md
+share/doc/pkgconf/COPYING
+share/doc/pkgconf/DCO
 share/doc/pkgconf/README.md

Index: pkgsrc/devel/pkgconf/distinfo
diff -u pkgsrc/devel/pkgconf/distinfo:1.31 pkgsrc/devel/pkgconf/distinfo:1.32
--- pkgsrc/devel/pkgconf/distinfo:1.31  Tue Dec 30 13:12:41 2025
+++ pkgsrc/devel/pkgconf/distinfo       Mon Jul 13 09:54:00 2026
@@ -1,6 +1,5 @@
-$NetBSD: distinfo,v 1.31 2025/12/30 13:12:41 adam Exp $
+$NetBSD: distinfo,v 1.32 2026/07/13 09:54:00 wiz Exp $
 
-BLAKE2s (pkgconf-2.5.1.tar.gz) = 786eafa013baadb9f5f1e9033bde343fa3d4088d49cbc2e6567ab4e98eb0c5f4
-SHA512 (pkgconf-2.5.1.tar.gz) = 4980b8bed6476c71f081b5c98c3f653acb1da4170e3a0b5b0644f33745a96bd87d56cc19772a9b63b84fb8022edd1a365779fdc5feb7241c13f2bd7989095bf3
-Size (pkgconf-2.5.1.tar.gz) = 477734 bytes
-SHA1 (patch-libpkgconf_pkg.c) = 15e6208dd17b79b2bcb341da73f6c8eda5f1d9df
+BLAKE2s (pkgconf-3.0.1.tar.gz) = 0a2d9f3f07376842738a984f6688bc62aed1ae3bbe811272b7f462052b00ba0b
+SHA512 (pkgconf-3.0.1.tar.gz) = d20f2d06c6602ee1bbf5e593f004f0ab7f0f24b831e3745e5892c86d1af02d1956d9f767946604d84347d07bb4ff3e19be70f2cd1805331c73e829388bc82f78
+Size (pkgconf-3.0.1.tar.gz) = 609395 bytes