jonkeane commented on code in PR #55491:
URL: https://github.com/apache/arrow/pull/55491#discussion_r4538357635
##########
r/tools/nixlibs.R:
##########
@@ -874,26 +915,53 @@ set_thirdparty_urls <- function(env_var_list) {
env_var_list
}
-# libarrow requires some thirdparty dependencies, even for a minimal build.
-# The libarrow build uses them from the system if they are available and
-# otherwise builds them from source, downloading from ARROW_*_URL. To make sure
-# that works without network access, `make sync-cpp` saves their source
-# tarballs into vendored_dependency_dir and we point ARROW_*_URL at them here.
+# The libarrow build uses thirdparty dependencies from the system if they are
+# available and otherwise builds them from source, downloading from
ARROW_*_URL.
+# Some are required even for a minimal build. To make sure that works without
+# network access, `make sync-cpp` saves (trimmed) source tarballs into
+# vendored_dependency_dir and we point ARROW_*_URL at them here.
# This does not change whether the system versions are used.
-with_vendored_dependencies <- function(env_var_list) {
- if (!dir.exists(vendored_dependency_dir)) {
+# `vendored` is the result of `usable_vendored_dependencies()`.
+with_vendored_dependencies <- function(env_var_list, vendored) {
+ for (env_varname in names(vendored)) {
+ if (!is.null(env_var_list[[env_varname]]) || !env_is(env_varname, "")) {
+ # Respect the user's (or set_thirdparty_urls()'s) choice
+ next
+ }
+ env_var_list <- replace(env_var_list, env_varname, vendored[[env_varname]])
+ }
+ env_var_list
+}
+
+# Returns the paths of the vendored tarballs that the libarrow source in
+# `src_dir` can use, named by their ARROW_*_URL.
+# The tarballs are trimmed, so the libarrow build only accepts them once
+# `use_vendored_checksums()` has put their checksums in versions.txt. We only
+# do that to the package's own copy of the source (tools/cpp), not e.g. ../cpp
+# of a git checkout, and only for tarballs that were trimmed from the version
+# that versions.txt pins (according to the checksums.txt file that
+# tools/vendor_dependencies.sh writes).
+usable_vendored_dependencies <- function(src_dir) {
Review Comment:
Checking the vendored checksums is honestly a little bit silly — we compute
them ourselves and include them with the package, so it's not really an
independent verification (if someone wanted to make a change to them and
distribute the source package, they could also just update the hash). But I do
think it's ok to have as an integrity check or if we mess up something in our
vendoring it'll fall back to downloading.
We also already do an integrity check when we download the dependencies
before trimming.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
