Building without network access

[jpalus]

For distribution packaged software it is desirable to do compilation in an isolated environment without network access (reproducible builds, no risk of downloading malicious code etc). In latest devilutionx version (1.3.0) that is no longer possible since ie asio must be downloaded. Therefore would it be possible to provide "full" source tarball as a part of release including all dependencies that are otherwise downloaded?

[AJenbo]

The needed dependencies depend on the target platform. If this is desirable for you I suggest having the system that downloads the code in the first place also download the dependencies before pushing it to your build server.

[StephenCWills]

In latest devilutionx version (1.3.0) that is no longer possible since ie asio must be downloaded.

FYI, it's not necessary to download ASIO during the build process.
cmake -DFETCHCONTENT_SOURCE_DIR_ASIO=/path/to/asio ...

[glebm]

First, set this option:

-DFETCHCONTENT_FULLY_DISCONNECTED=ON

This will make sure none of the FetchContent calls do any network access.

You can then specify every dependency similar to how it's done in this Linux distribution:

https://github.com/batocera-linux/batocera.linux/blob/82712b8efb498d226edeb99c0a392fb22e5bcdd9/package/batocera/ports/devilutionx/devilutionx.mk#L45-L55

There is no better way at the moment.

[jpalus]

While I'm interested in particular platform it does not change the fact that I believe all sources which cannot be satisfied by system library should be included in source release. So I wouldn't mind including SDL2 in a source tarball because Android needs it. Not up to me though. Thanks for the tips with FETCHCONTENT_* vars -- I will start maintaining dependencies manually.

[AJenbo]

Including them in git will affect performance during development, if you develop a script for generating a full tarball you are welcome to open a PR with it. It's worth noting that we do checksum validation on dependencies so reproducible builds are assured as the build will fail if they change.

[glebm]

@jpalus DevilutionX now provides a full source tarball that includes all the FetchContent dependencies and devilutionx.mpq.
This makes packaging it a lot easier, e.g. batocera-linux/batocera.linux#5146