From 53ffb56aaede877d34d3491e226aefb7e4bbe6be Mon Sep 17 00:00:00 2001 From: leonarski_f Date: Sat, 11 Jul 2026 18:45:51 +0200 Subject: [PATCH] viewer/curl: clean stale CI build dir + guard against system libcurl shadowing Self-hosted runners reuse the workspace Docker volume, so a stale build/ dir could leave jfjoch_viewer linking a system libcurl instead of the vendored FetchContent static one (curl configured but never compiled; viewer linked the OS curl). Add a "Clean previous build" step (rm -rf build) to the two Linux viewer jobs (build-viewer-tgz, build-rpm), and assert libcurl_static exists after FetchContent_MakeAvailable(curl) so any future shadowing fails loudly instead of silently linking the OS curl with the wrong TLS/Kerberos backend. Co-Authored-By: Claude Opus 4.8 --- .gitea/workflows/build_and_test.yml | 8 ++++++++ CMakeLists.txt | 9 +++++++++ 2 files changed, 17 insertions(+) diff --git a/.gitea/workflows/build_and_test.yml b/.gitea/workflows/build_and_test.yml index f85a93e6..661e08d5 100644 --- a/.gitea/workflows/build_and_test.yml +++ b/.gitea/workflows/build_and_test.yml @@ -124,6 +124,10 @@ jobs: use_cuda: 'OFF' steps: - uses: actions/checkout@v4 + - name: Clean previous build + shell: bash + run: rm -rf build # self-hosted runners reuse the workspace volume; a stale build dir + # can leave the viewer linking a system libcurl instead of the vendored one - name: Configure viewer build shell: bash run: | @@ -219,6 +223,10 @@ jobs: upload_url: https://gitea.psi.ch/api/packages/mx/debian/pool/noble/nocuda/upload steps: - uses: actions/checkout@v4 + - name: Clean previous build + shell: bash + run: rm -rf build # self-hosted runners reuse the workspace volume; a stale build dir + # can leave the viewer linking a system libcurl instead of the vendored one - name: Setup build (cmake) shell: bash run: | diff --git a/CMakeLists.txt b/CMakeLists.txt index ced3b92d..fe778f4e 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -296,6 +296,15 @@ IF (JFJOCH_VIEWER_BUILD OR JFJOCH_VIEWER_ONLY) GIT_TAG curl-8_11_1 EXCLUDE_FROM_ALL) FetchContent_MakeAvailable(curl) + # The viewer must link the vendored static libcurl, never a system one. If FetchContent is + # ever short-circuited (find_package / a dependency provider resolving CURL to the OS libcurl, + # or a stale runner build dir), the libcurl_static target is absent -- fail loudly instead of + # silently linking the system curl with the wrong TLS/Kerberos backend. + IF (NOT TARGET libcurl_static) + MESSAGE(FATAL_ERROR + "libcurl was not built from FetchContent (libcurl_static target missing) -- a " + "system libcurl is shadowing the vendored one; wipe the build dir and reconfigure.") + ENDIF() ENDIF() IF (JFJOCH_VIEWER_ONLY)