depends: build expat with CMake

[fanquake]

Bumps expat from 2.4.8 -> 2.6.2

• Switches to downloading the source code, rather than a bootstrapped tarball.
• Source changes currently unreviewed, but done for now, given the amount of CMake related fixes listed in the changelog.

Switch to building Expat with CMake, instead of Autotools.

[DrahtBot]

The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

Code Coverage

For detailed information about the code coverage, see the test coverage report.

Reviews

See the guideline for information on the review process.
A summary of reviews will appear here.

Conflicts

Reviewers, this pull request conflicts with the following ones:

• #29923 (depends: Remove Qt build-time dependencies by laanwj)

If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.

[fanquake]

Looks like there could be issues with expat, CMake and 32-bit builds:

• https://cirrus-ci.com/task/6695396838211584
• https://cirrus-ci.com/task/5850971908079616

[DrahtBot]

Guix builds (on x86_64)

File	commit 07720b1 (master)	commit 6531a10 (master and this pull)
SHA256SUMS.part	0f592e2a4dd1a72c...
*-aarch64-linux-gnu-debug.tar.gz	950b785908a964e9...
*-aarch64-linux-gnu.tar.gz	a79beb29c3cf15fc...
*-arm-linux-gnueabihf-debug.tar.gz	f53bfd09ff2c3449...
*-arm-linux-gnueabihf.tar.gz	4085f43478898128...
*-arm64-apple-darwin-unsigned.tar.gz	2312bc4f6987ce91...
*-arm64-apple-darwin-unsigned.zip	ed306c20047de31a...
*-arm64-apple-darwin.tar.gz	3e16b326765dedf9...
*-powerpc64-linux-gnu-debug.tar.gz	18243000b23c1660...
*-powerpc64-linux-gnu.tar.gz	efef0490f676adbc...
*-riscv64-linux-gnu-debug.tar.gz	16656dd37f2be4c0...
*-riscv64-linux-gnu.tar.gz	004af01b9c027530...
*-x86_64-apple-darwin-unsigned.tar.gz	937e2be89036f0c5...
*-x86_64-apple-darwin-unsigned.zip	42bde44f6715a089...
*-x86_64-apple-darwin.tar.gz	a24116ec51ffc113...
*-x86_64-linux-gnu-debug.tar.gz	3ae204424646236a...
*-x86_64-linux-gnu.tar.gz	91654c6f24f022a1...
*.tar.gz	64e1ce578ca601ac...
guix_build.log	3525746f599ef84b...	5e76f8f5f3323ce3...
guix_build.log.diff		245fae1f5e15ccac...

[tobtoht]

(Testing a script I'm developing on this PR)

• This package was signed with a GPG key that was used to sign a previous release: 3176EF7DB2367F1FCA4F306B1F9B0E909AF37285
• All files in common with the git repository have matching hashes.
• 26 files present in the tarball are not present in the git repository for a total of 57709 lines: https://paste.debian.net/plainh/ba0edfca
• After removal of the files above, this package contains no binaries, no archives and 4 generated scripts: https://paste.debian.net/plainh/ed6bbbc7

[fanquake]

26 files present in the tarball are not present in the git repository for a total of 57709 lines: https://paste.debian.net/plainh/ba0edfca
After removal of the files above, this package contains no binaries, no archives and 4 generated scripts: https://paste.debian.net/plainh/ed6bbbc7

I've pushed a change that switches to downloading the unbootstraped source tarball. Want to re-run your script?

[tobtoht]

Want to re-run your script?

• No signature file found, however git tag R_2_6_2 is signed with a GPG key that was used to sign a previous release: 3176EF7DB2367F1FCA4F306B1F9B0E909AF37285
• All files in common with the git repository have matching hashes.
• Tarball does not contain any files that are not present in the git repository.
• This package contains no binaries, no archives and 4 generated scripts: https://paste.debian.net/plainh/beafa9aa

Those generated scripts are short and look harmless, btw.

I've pushed a change that switches to downloading the unbootstraped source tarball.

GitHub generated source archives may not have stable hashes: https://github.blog/2023-02-21-update-on-the-future-stability-of-source-code-archives-and-hashes/

I'm not sure if depends currently supports this, but falling back to the mirror on a hash mismatch may be sensible.

[laanwj]

FWIW #29923 removes the need to deal with expat in any way (as it's a dependency of a Qt dependency).