Maintainable approach for updating PCRE on Windows

[digitalcircuit]

In short

PCRE should be built from source on Windows to keep up with bug-fixes, security improvements, and enable building a 64-bit version of Fuzzball for Windows.

Implementation

To build from source, Makefile.win will need to patch the PCRE directory to build it on Windows, then build it as a .dll, packaging it with the rest of Fuzzball. The Appveyor script will to include pcre.dll in the published artifact.

For long-term ease of maintenance, two approaches come to mind:

Download source package

When building on Windows, the instructions will point to downloading the PCRE source code (e.g. from the official site here) and extracting it in the win32 folder. The Appveyor script will need updated to automatically download PCRE.

• Benefits
  • Always use the latest released version of PCRE
  • Minimal maintenance effort for Fuzzball
• Drawbacks
  • Build process depends upon remote server that could have downtime or be hacked. (The Conan.io setup for OpenSSL faces a similar issue, though as a general-purpose package manager they may be less likely to go down)
  • If PCRE makes a breaking change, intentional or accidental, Fuzzball will need updated at the same time

    Mirror PCRE repository

Fuzzball will provide a Git mirror of the PCRE source code, either uploading the extracted source package, or directly importing using a tool. The main Fuzzball repository can include the PCRE source as a Git submodule.

• Benefits
  • Control over the PCRE source, offering reasonable confidence that it's available and consistent
  • Ability to set up separate tests for PCRE, e.g. Appveyor builds
• Drawbacks
  • Extra maintenance effort to maintain a second repository, especially with getting security updates out in a timely manner
  • Some duplication of effort with copying a repository

    Discussion

Both approaches have trade-offs and advantages without a clear winner. More research may be needed to see how other projects approach dependencies.

Other options exist, too - since Conan.io is already used for OpenSSL, a PCRE package could be contributed. Or, though not ideal, a separate repository could contain only PCRE.lib builds, akin to how CyanogenMod handles dependencies.

---

I pulled this from the email discussion in order to have a single cohesive thread for updates and discussion, keeping it from getting lost.

[digitalcircuit]

There's a few Linux scripts to cross-compile OpenSSL and PCRE for Windows that Attila shared (Freenode/#quassel). These could probably be adapted to compiling natively on Windows. I'm not yet sure.

I know there's two community contributed native Windows/Visual Studio setups, one on Psyon.org, another on Airesoft.co.uk.

Quassel currently faces an issue with their OpenSSL package on Windows using msvc2013, while Quassel itself builds with msvc2015. One option a few are considering is automating building OpenSSL from source, which would likely help Fuzzball, too. I'll relay any relevant knowledge over here, and vice-versa.

[digitalcircuit]

Conan now has PCRE packages for Windows, but unfortunately there's only 64-bit builds available, and I couldn't easily figure out how to set up 32-bit builds. I'll try contacting lasote, the maintainer of those packages, in the near-ish future to see if 32-bit builds can be added.