Repository navigation
Pin the SDK downloads and build them in the build tree against TileDB's OpenSSL and libcurl - #17
Merged
Merged
Conversation
nalinigans
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TileDB builds the AWS SDK and google-cloud-cpp when they aren't already installed, and this changes three things about how it does so.
The downloads are pinned and checked. The AWS SDK came from the 1.8.x branch, which could change under a build; it is now the 1.8.187 release, the commit that branch points to, so the code built is unchanged. Both SDKs and the six libraries they download are checked against a SHA-256; setting AWSSDK_URL_HASH or GCSSDK_URL_HASH to empty skips the check, for building a different SDK version.
The SDKs are built in TILEDB_DEPS_INSTALL_DIR, the build tree by default, instead of $HOME/awssdk-install and $HOME/gcssdk-install, so a build no longer writes outside its own directory. A parent project, or CI with a cache, can point it elsewhere to share the SDKs between builds. This repository's CI passes $HOME, so its cache paths are unchanged. GenomicsDB's CI caches the same $HOME paths, so it will need to pass TILEDB_DEPS_INSTALL_DIR=$HOME too once its TileDB submodule moves past this; I'll include that when I update the submodule.
The SDK builds are given TileDB's OpenSSL root, its static-library setting and its libcurl, instead of finding their own, which could be different libraries from the ones TileDB links: given static OpenSSL and libcurl outside the system paths, the SDKs found the system's shared ones, so anything linking TileDB and the SDKs mixed OpenSSL versions. libcurl and OpenSSL now also follow the SDK libraries in tiledb_static's link interface, since the SDKs use them; with static libraries, GNU ld otherwise left google-cloud-cpp's reference to BIO_f_base64 unresolved.
CI rebuilds both SDKs once, as the AWS SDK's cache key changes with its version and the google-cloud-cpp key is bumped so that the new build settings are exercised. Built from scratch with the default settings and tested on macOS arm64 (CMake 4.4, Apple clang 21) and Linux aarch64 (CMake 4.4, GCC 15.2 and clang 21).