Don't depend on any binary blobs
- Dominant language
- C++
- Stars
- 8k
- Forks
- 351
- Avg merge
- 12h 31m
- Merged PRs (30d)
- 102
Description
Currently the tests depend a bunch of prebuilt binaries through submodules, e.g. `External/fex-gcc-target-tests-bins` and some others.
Binary blobs are bad from an auditability perspective. One could say that "those are just for tests so they don't count", but I am not aware of any distro packaging system that lets one (easily) selectively clone submodules, so in practice they are all present during builds.
Building the test binaries from source would be an obvious idea, but e.g. pulling in the whole gcc repo is probably even less desirable than the current solution, so I see why it's not done.
Ideas for alternatives:
- Instead of using submodules, manually `git clone --depth 1` the bin repos in the CI.
- Maybe there is some way to configure `.gitmodules` to not clone these submodules by default with `git clone --recursive`? E.g. not sure if `submodule..fetchRecurseSubmodules` does that.
In either case, it should be documented which submodules are needed for building FEX and which ones only for the tests (and which tests), currently it's a bit of a guessing game.
Also honorable mention to `Source/Windows/wine_builtin.bin`, but that's small enough to be audited by hand with a hex editor, so it's not a priority. (It's just text with some null bytes afterwards.)
Contributor guide
Assessment
This issue has not been assessed yet.