jr0me
commented
1 month ago Update
Started looking into this issue. Although in previous investigations we have concluded that Vcpkg is fit to handle precompiled binaries I decided to put it to test so we can compare it to Conan to the full extent of our requirements. Yet I've bumped into a steep learning curve to get specific versions of our dependencies. So far we have tried using dependencies without stating specific versions, in order to lock one for each of them, the process is proving to be somewhat cumbersome. It's necessary to define an additional configuration file.
For a vcpkg.json file such as:
{
"name": "wazuh-agent-mvp",
"version": "5.0.0",
"dependencies": [
"boost-asio",
"boost-beast",
"bzip2",
"gtest",
"cjson"
],
"overrides": [
{
"name": "boost-asio",
"version": "1.84.0"
},
{
"name": "boost-beast",
"version": "1.84.0"
},
{
"name": "bzip2",
"version": "1.0.8"
},
{
"name": "cjson",
"version": "1.7.12"
},
{
"name": "gtest",
"version": "1.14.0"
}
]
}...it's necessary to also define a vcpkg-configuration.json with the following values:
{
"default-registry": {
"kind": "git",
"repository": "https://github.com/Microsoft/vcpkg",
"baseline": "f7423ee180c4b7f40d43402c2feb3859161ef625"
},
"registries": [
{
"kind": "git",
"repository": "https://github.com/Microsoft/vcpkg",
"baseline": "8ccb84df727bdf83045e53c319af05c554838b80",
"packages": [ "boost*", "boost-*"]
}
]
}These baselines are commits in the vcpkg repository where the port is defined for the specific version needed. Finding out this can be done by running this command in the vcpkg repository: git log "--format=%H %cd %s" --date=short --left-only -- versions/b-/boost-asio.json. Commits that update the port info will be listed.
Despite CPython not being necessary for building the old Agent, it still needs to be pointed out that the version required by the Wazuh Manager is not available. Moreover I struggled to build the following version and not yet succeeded.
It's also important to note that we don't just use dependencies as they come publicly packaged, we configure and build them using specific options. We need to also evaluate if this is possible using either Vcpkg or Conan. It looks like this can be achived with Vcpkg by creating our own ports. But that would mean that we need to create a fork of vcpkg, since apparently there is where they are expected to be found (at least, according to my current understanding).
TomasTurina
Description
We need to research and identify suitable tools and systems for managing dependencies in Wazuh. The goal is to find a solution that allows us to define, modify, and build dependencies individually, supports multiple platforms, and handles transitive dependencies effectively.
Tasks
Investigate Dependency Management Tools:
List Available Dependencies:
Tool Evaluation:
Documentation:
Acceptance Criteria
Related Issues