Update expat to be based on 2.7.0

 Could NOT find EXPAT: Found unsuitable version "2.5.0", but required is at least "2.6.3" (found
 /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib/libexpat.tbd)

The expat that's shipped in macOS is labelled version 2.5, but it's pretty common for security fixes to be cherry picked and backported, and thus the version doesn't really increment.

macOS patched libexpat recently for example: https://support.apple.com/en-us/121839

Does this version check have to be there?

https://formulae.brew.sh/formula/expat

What of it?

That would solve your compilation problem. We can’t assume that a package manager would fix a bug. We just go by versions otherwise it would be a zoo of checks. I hope that makes sense.

What about restoring the minimum but adding a warning for < 2.6.3 versions like we do for old Pythons?

You mean the following?

# Check deprecated versions of Python
if (NOT VTK_LEGACY_SILENT AND vtk_python_version VERSION_LESS vtk_python_version_support)
  message(DEPRECATION
    "Python ${vtk_python_version} support is deprecated, use Python ${vtk_python_version_support}+")
endif ()

The fact is, your check is not checking what you think it is.

As I said, it is extremely common, not just on Apple, but on Ubuntu and many others too, for security fixes to get backported. That's how you get version numbers like "libexpat 2.4.7-1ubuntu0.5". It's 2.4.7 with various security fixes backported.

So failing your version check does not mean the library version has any unfixed security issues.

Our app has always dynamically linked to the expat that's bundled with macOS. That's one less thing for me to build, update, etc. This harsh check now makes that impossible as even the very newest macOS is at 2.5 (+ patches).

What would be the problem of using the internal expat and not your system's one?

What would be the problem of using the internal expat and not your system's one?

Why, are you going to remove VTK_MODULE_USE_EXTERNAL_VTK_expat too? :)

It's just one less thing to build, one less thing to include in our binary, one less thing to document (medical software requires documentation for 3rd party software). Offloading it to just being part of the OS is a nice simplification.

What would be the problem of downgrading the version check to a warning?

There would be no problem, that's why i asked @ben.boeckel if that's the check that he meant.

Nonetheless, if there is a solution that does not require code changes, i think it should be considered.

Yes, that looks like the thing to do. You can probably skip the VTK_LEGACY_* bits as we really don't need to add more usages.

Update expat to be based on 2.7.0

Merged by Kitware Robot 1 month ago (Mar 18, 2025 2:20pm UTC) 1 month ago

Activity

Update expat to be based on 2.7.0

Merge request reports

Merged by Kitware Robot 1 month ago (Mar 18, 2025 2:20pm UTC) 1 month ago

Activity