Add Submodule Version Check to cmake Configuration (#750)

Author: sbSteveK

CMakeLists.txt

@@ -3,6 +3,7 @@ cmake_minimum_required(VERSION 3.9...3.31)
 option(BUILD_DEPS "Builds aws common runtime dependencies as part of build. Turn off if you want to control your dependency chain." ON)
 option(BYO_CRYPTO "Don't build a tls implementation or link against a crypto interface. This feature is only for unix builds currently" OFF)
 option(USE_OPENSSL "Set this if you want to use your system's OpenSSL 1.0.2/1.1.1 compatible libcrypto" OFF)
+option(ENFORCE_SUBMODULE_VERSIONS "Check and enforce submodule versions to verify they are the minimum expected version or later. Versioning is only checked if BUILD_DEPS is ON." ON)
 
 # Let aws-iot-device-sdk-cpp-v2 report its own version in MQTT connections (instead of reporting aws-crt-cpp's version).
 option(AWS_IOT_SDK_VERSION "Set the version reported by Aws::Iot::MqttClientConnectionConfigBuilder")
@@ -27,6 +28,8 @@ project("aws-crt-cpp"
 
 include(CTest)
 include(GNUInstallDirs)
+include(cmake/EnforceSubmoduleVersions.cmake) # for check_submodule_commit()
+
 
 if(NOT CMAKE_CXX_STANDARD)
     set(CMAKE_CXX_STANDARD 11)
@@ -52,12 +55,19 @@ if(BUILD_DEPS)
     set(IN_SOURCE_BUILD ON)
     set(BUILD_TESTING_PREV ${BUILD_TESTING})
     set(BUILD_TESTING OFF)
+    if(ENFORCE_SUBMODULE_VERSIONS)
+        check_submodule_commit("aws-c-common" "crt/aws-c-common")
+    endif()
     add_subdirectory(crt/aws-c-common)
 
     if(UNIX AND NOT APPLE AND NOT BYO_CRYPTO)
         if(NOT USE_OPENSSL)
             include(AwsPrebuildDependency)
 
+            if(ENFORCE_SUBMODULE_VERSIONS)
+                check_submodule_commit("aws-lc" "crt/aws-lc")
+            endif()
+
             set(AWSLC_CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
 
             # temporarily disable certain warnings as errors for the aws-lc build
@@ -89,9 +99,25 @@ if(BUILD_DEPS)
         endif()
 
         set(UNSAFE_TREAT_WARNINGS_AS_ERRORS OFF CACHE BOOL "Disable warnings-as-errors when building S2N")
+        if(ENFORCE_SUBMODULE_VERSIONS)
+            check_submodule_commit("s2n" "crt/s2n")
+        endif()
         add_subdirectory(crt/s2n)
     endif()
 
+    if(ENFORCE_SUBMODULE_VERSIONS)
+        check_submodule_commit("aws-c-sdkutils" "crt/aws-c-sdkutils")
+        check_submodule_commit("aws-c-io" "crt/aws-c-io")
+        check_submodule_commit("aws-c-cal" "crt/aws-c-cal")
+        check_submodule_commit("aws-c-compression" "crt/aws-c-compression")
+        check_submodule_commit("aws-c-http" "crt/aws-c-http")
+        check_submodule_commit("aws-c-auth" "crt/aws-c-auth")
+        check_submodule_commit("aws-c-mqtt" "crt/aws-c-mqtt")
+        check_submodule_commit("aws-checksums" "crt/aws-checksums")
+        check_submodule_commit("aws-c-event-stream" "crt/aws-c-event-stream")
+        check_submodule_commit("aws-c-s3" "crt/aws-c-s3")
+    endif()
+
     add_subdirectory(crt/aws-c-sdkutils)
     add_subdirectory(crt/aws-c-io)
     add_subdirectory(crt/aws-c-cal)

cmake/EnforceSubmoduleVersions.cmake

@@ -0,0 +1,82 @@
+# cmake/EnforceSubmoduleVersions.cmake
+#
+# Guard against multiple inclusion (for CMake 3.9 we cannot use
+# the include_guard() command yet).
+if(DEFINED _AWSCRT_ENFORCE_SUBMODULE_VERSIONS_INCLUDED)
+    return()
+endif()
+set(_AWSCRT_ENFORCE_SUBMODULE_VERSIONS_INCLUDED TRUE)
+
+# Nothing to do if the caller disabled the checks *or* if BUILD_DEPS is OFF
+if(NOT ENFORCE_SUBMODULE_VERSIONS OR NOT BUILD_DEPS)
+    return()
+endif()
+
+# Ensure Git is available
+find_package(Git QUIET)
+if(NOT GIT_FOUND)
+    message(FATAL_ERROR
+        "ENFORCE_SUBMODULE_VERSIONS is ON but Git was not found.\n"
+        "  • Install Git and ensure it is in PATH,          e.g.   sudo apt install git\n"
+        "  • or tell CMake where Git lives:                 -DGIT_EXECUTABLE=/path/git\n"
+        "  • or rerun CMake with commit checks disabled:    -DENFORCE_SUBMODULE_VERSIONS=OFF")
+endif()
+
+function(check_submodule_commit name rel_path)
+    set(_sub_dir  "${PROJECT_SOURCE_DIR}/${rel_path}")
+
+    # determine baseline from super repository (aws-crt-cpp) to get expected commit of submodule
+    # ask Git for the SHA that is stored in the super-repo’s index
+    execute_process(
+        COMMAND           ${GIT_EXECUTABLE} "rev-parse" "HEAD:${rel_path}"
+        WORKING_DIRECTORY "${PROJECT_SOURCE_DIR}"
+        OUTPUT_VARIABLE   _baseline
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+        ERROR_VARIABLE    _err
+        RESULT_VARIABLE   _rc)
+
+    if(_rc OR "${_baseline}" STREQUAL "")
+        message(FATAL_ERROR "Could not query git-link for ${rel_path}: ${_err}")
+    endif()
+
+    # ensure the commit object exists (deepens shallow clones/branches)
+    execute_process(
+        COMMAND ${GIT_EXECUTABLE} cat-file -e ${_baseline}^{commit}
+        WORKING_DIRECTORY "${_sub_dir}"
+        RESULT_VARIABLE _missing ERROR_QUIET)
+
+    if(_missing)
+        execute_process(
+            COMMAND ${GIT_EXECUTABLE} fetch --depth 1 origin ${_baseline}
+            WORKING_DIRECTORY "${_sub_dir}" RESULT_VARIABLE _rc ERROR_QUIET)
+        if(_rc)
+            execute_process(
+                COMMAND ${GIT_EXECUTABLE} fetch --unshallow --tags origin
+                WORKING_DIRECTORY "${_sub_dir}" ERROR_QUIET)
+        endif()
+    endif()
+
+    # ancestry check
+    execute_process(COMMAND ${GIT_EXECUTABLE} rev-parse --verify HEAD
+                    WORKING_DIRECTORY "${_sub_dir}"
+                    OUTPUT_VARIABLE _head
+                    OUTPUT_STRIP_TRAILING_WHITESPACE)
+
+    execute_process(COMMAND ${GIT_EXECUTABLE} merge-base --is-ancestor
+                            ${_baseline} ${_head}
+                    WORKING_DIRECTORY "${_sub_dir}"
+                    RESULT_VARIABLE _is_anc ERROR_QUIET)
+
+    if(_is_anc GREATER 0)
+        message(FATAL_ERROR
+            "Sub-module ${name} at ${_sub_dir}\n"
+            "  HEAD     : ${_head}\n"
+            "  baseline : ${_baseline}\n"
+            "is **older** or on a divergent branch.\n"
+            "This check can be disabled with: -DENFORCE_SUBMODULE_VERSIONS=OFF")
+    else()
+        string(SUBSTRING "${_head}"     0 7 _head_short)
+        string(SUBSTRING "${_baseline}" 0 7 _base_short)
+        message(STATUS "Submodule ${name} commit:${_head_short} ≥ baseline:${_base_short}")
+    endif()
+endfunction()