PR #13478 from Nir-Az: Merge development into r/256 --> 2.56.3

IntelRealSense · Oct 31, 2024 · 3a64d2a · 3a64d2a
2 parents be51e0d + 4b2ad41
commit 3a64d2a
Show file tree

Hide file tree

Showing 114 changed files with 3,082 additions and 1,254 deletions.
diff --git a/.github/workflows/build-ROS2-package-CI.yaml b/.github/workflows/build-ROS2-package-CI.yaml
@@ -43,12 +43,12 @@ jobs:
     steps:
 
       - name: setup ROS environment
-        uses: ros-tooling/[email protected]
+        uses: ros-tooling/setup-ros@a6ce30ecca1e5dcc10ae5e6a44fe2169115bf852 #v0.7
         with:
           required-ros-distributions: ${{ matrix.ros_distribution }}
 
       - name: build librealsense ROS 2
-        uses: ros-tooling/[email protected]
+        uses: ros-tooling/action-ros-ci@0c87ffc035492b66c9afb9159ca9664fb0b513e1 #v0.3
         with:
           target-ros2-distro: ${{ matrix.ros_distribution }}
           skip-tests: true

diff --git a/.github/workflows/buildsCI.yaml b/.github/workflows/buildsCI.yaml
@@ -27,7 +27,7 @@ jobs:
     runs-on: windows-2019
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Enable Long Paths
       shell: powershell
@@ -69,7 +69,7 @@ jobs:
     runs-on: windows-2019
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Enable Long Paths
       shell: powershell
@@ -111,8 +111,8 @@ jobs:
     runs-on: windows-2019
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
+    - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5
       with:
        python-version: '3.8.1'
 
@@ -171,8 +171,8 @@ jobs:
     runs-on: windows-2019
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
+    - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5
       with:
        python-version: '3.8.1'
 
@@ -215,15 +215,57 @@ jobs:
       run: |
         python3 unit-tests/run-unit-tests.py --no-color --debug --stdout --not-live --context "dds windows" ${{env.WIN_BUILD_DIR}}/Release
 
+#--------------------------------------------------------------------------------
+  Win_SH_Py_DDS_SEC:  # Windows, Shared, Python, Tools, DDS, additional security checks
+    runs-on: windows-2019
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with:
+       python-version: '3.8.1'
+
+    - name: Enable Long Paths
+      shell: powershell
+      run: |
+       New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force
+        
+    - name: Check_API
+      shell: bash
+      run: |
+        cd scripts
+        ./api_check.sh
+        cd ..   
+
+    - name: PreBuild
+      shell: bash
+      run: |
+       mkdir ${{env.WIN_BUILD_DIR}} 
+       python3 -m pip install numpy
+
+    - name: Configure CMake
+      shell: bash
+      run: |        
+        LRS_SRC_DIR=$(pwd)   
+        cd ${{env.WIN_BUILD_DIR}}
+        cmake ${LRS_SRC_DIR} -G "Visual Studio 16 2019" -DBUILD_SHARED_LIBS=true -DBUILD_EXAMPLES=false -DBUILD_TOOLS=true -DBUILD_UNIT_TESTS=false -DCHECK_FOR_UPDATES=false -DBUILD_WITH_DDS=true -DPYTHON_EXECUTABLE=${{env.PYTHON_PATH}} -DBUILD_PYTHON_BINDINGS=true -DENABLE_SECURITY_FLAGS=true
+
+    - name: Build
+      # Build your program with the given configuration
+      shell: bash
+      run: |
+        cd ${{env.WIN_BUILD_DIR}}
+        cmake --build . --config ${{env.LRS_RUN_CONFIG}} -- -m
+
 
   #--------------------------------------------------------------------------------
   Win_SH_Py_RSUSB_Csharp:  # Windows, Shared, Python, RSUSB backend, C# bindings
     runs-on: windows-2019
     timeout-minutes: 60
 
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
+    - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 #v5
       with:
        python-version: '3.8.1'
 
@@ -273,7 +315,7 @@ jobs:
     name: ${{ matrix.name }}_ST_Py_EX_CfU 
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Prebuild
       shell: bash
@@ -300,7 +342,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Prebuild
       shell: bash
@@ -343,7 +385,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Prebuild
       shell: bash
@@ -394,6 +436,55 @@ jobs:
         python3 unit-tests/run-unit-tests.py --no-color --debug --stdout --not-live --context "dds linux" --tag dds
   
 
+  #--------------------------------------------------------------------------------
+  U20_ST_Py_DDS_RSUSB_SEC:  # Ubuntu 2020, Static, Python, DDS, RSUSB, additional security checks
+    runs-on: ubuntu-20.04
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Prebuild
+      shell: bash
+      run: |
+        sudo apt-get update;
+        sudo apt-get install -qq build-essential xorg-dev libgl1-mesa-dev libglu1-mesa-dev libglew-dev libglm-dev;
+        sudo apt-get install -qq libusb-1.0-0-dev;
+        sudo apt-get install -qq libgtk-3-dev;
+        sudo apt-get install libglfw3-dev libglfw3;
+        # We force compiling with GCC 7 because the default installed GCC 9 compiled with LTO and gives an internal compiler error
+        sudo apt-get install gcc-7 g++-7;
+        sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-7 60 --slave /usr/bin/g++ g++ /usr/bin/g++-7;
+        python3 -m pip install numpy
+
+    - name: Check_API
+      shell: bash
+      run: |
+        cd scripts
+        ./api_check.sh
+        ./pr_check.sh
+        cd ..
+        mkdir build
+
+    - name: Build
+      # Note: we force RSUSB because, on Linux, the context creation will fail on GHA:
+      #     (backend-v4l2.cpp:555) Cannot access /sys/class/video4linux)
+      # And, well, we don't need any specific platform for DDS!
+      shell: bash
+      run: |
+        cd build
+        cmake .. -DCMAKE_BUILD_TYPE=${{env.LRS_RUN_CONFIG}} -DBUILD_SHARED_LIBS=false -DBUILD_EXAMPLES=false -DBUILD_TOOLS=false -DBUILD_UNIT_TESTS=false -DCHECK_FOR_UPDATES=false -DBUILD_WITH_DDS=true -DBUILD_PYTHON_BINDINGS=true -DPYTHON_EXECUTABLE=$(which python3) -DFORCE_RSUSB_BACKEND=true -DENABLE_SECURITY_FLAGS=true
+        cmake --build . -- -j4
+
+    - name: Client for realsense2-all
+      shell: bash
+      run: |
+        mkdir build/rs-all-client
+        cd build/rs-all-client
+        cmake ../../.github/workflows/rs-all-client -DBUILD_WITH_DDS=ON -DFORCE_RSUSB_BACKEND=ON
+        cmake --build . -- -j4
+        ./rs-all-client
+  
+
   #--------------------------------------------------------------------------------
   U22_U24_SH_Py_DDS_CI:  # Ubuntu, Shared, Python, DDS, LibCI without executables
     runs-on: ${{ matrix.os }}
@@ -408,7 +499,7 @@ jobs:
     name: ${{ matrix.name }}_SH_Py_DDS_CI
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Prebuild
       shell: bash
@@ -449,7 +540,7 @@ jobs:
     timeout-minutes: 60
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Check_API
       shell: bash
@@ -483,7 +574,7 @@ jobs:
     runs-on: ubuntu-20.04   
     timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 #v4
 
     - name: Check_API
       shell: bash

diff --git a/.github/workflows/static_analysis.yaml b/.github/workflows/static_analysis.yaml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 30
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #v3
 
       - name: Install 
         shell: bash
@@ -64,7 +64,7 @@ jobs:
             &&  echo "No diffs found in cppcheck_run.parsed.log"
 
       - name: Upload logs
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 #v3
         with: 
           name: cppcheck_log
           path: |
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 #v3
 
       - name: "Install Dependencies"
         run: |

diff --git a/CMake/external_fastdds.cmake b/CMake/external_fastdds.cmake
@@ -67,7 +67,10 @@ function(get_fastdds)
     message(CHECK_PASS "Done")
 endfunction()
 
+
+pop_security_flags()
+
 # Trigger the FastDDS build
 get_fastdds()
 
-
+push_security_flags()
diff --git a/CMake/external_foonathan_memory.cmake b/CMake/external_foonathan_memory.cmake
@@ -41,4 +41,8 @@ function(get_foonathan_memory)
 
 endfunction()
 
+pop_security_flags()
+
 get_foonathan_memory()
+
+push_security_flags()
diff --git a/CMake/external_libcurl.cmake b/CMake/external_libcurl.cmake
@@ -1,4 +1,7 @@
 if(CHECK_FOR_UPDATES)
+
+    pop_security_flags() # remove security flags
+
     include(ExternalProject)
     message(STATUS "Building libcurl enabled")
 
@@ -60,4 +63,5 @@ if(CHECK_FOR_UPDATES)
         endif()
     endif()
 
+    push_security_flags()
 endif() #CHECK_FOR_UPDATES
diff --git a/CMake/external_libusb.cmake b/CMake/external_libusb.cmake
@@ -2,15 +2,11 @@ include(ExternalProject)
 
 ExternalProject_Add(
     libusb
+    PREFIX libusb
+    GIT_REPOSITORY "https://github.com/libusb/libusb-cmake.git"
+    GIT_TAG "v1.0.27-1" # "v1.0.27-1" 
 
-    # Work-around for libusb master broken on Nov 26' 2020 with introduction of v1.0.24
-    # the issue has been reported in https://github.com/libusb/libusb/issues/812
-    GIT_REPOSITORY "https://github.com/ev-mp/libusb.git"
-    GIT_TAG "2a7372db54094a406a755f0b8548b614ba8c78ec" # "v1.0.22" + Mac get_device_list hang fix
-
-    UPDATE_COMMAND ${CMAKE_COMMAND} -E copy_if_different
-            ${CMAKE_CURRENT_SOURCE_DIR}/third-party/libusb/CMakeLists.txt
-            ${CMAKE_CURRENT_BINARY_DIR}/third-party/libusb/CMakeLists.txt
+    UPDATE_COMMAND ""
     PATCH_COMMAND ""
 
     SOURCE_DIR "third-party/libusb/"
@@ -19,15 +15,17 @@ ExternalProject_Add(
             -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
             -DANDROID_ABI=${ANDROID_ABI}
             -DANDROID_STL=${ANDROID_STL}
+            -DBUILD_SHARED_LIBS=OFF
             -DCMAKE_INSTALL_PREFIX=${CMAKE_CURRENT_BINARY_DIR}/libusb_install
+            -DLIBUSB_INSTALL_TARGETS=ON
             --no-warn-unused-cli
     TEST_COMMAND ""
-    BUILD_BYPRODUCTS ${CMAKE_CURRENT_BINARY_DIR}/libusb_install/lib/${CMAKE_STATIC_LIBRARY_PREFIX}usb${CMAKE_STATIC_LIBRARY_SUFFIX}
+    #BUILD_BYPRODUCTS ${CMAKE_CURRENT_BINARY_DIR}/libusb_install/lib/${CMAKE_STATIC_LIBRARY_PREFIX}usb${CMAKE_STATIC_LIBRARY_SUFFIX}
 )
 
 add_library(usb INTERFACE)
 target_include_directories(usb INTERFACE $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/third-party/libusb/libusb>)
-target_link_libraries(usb INTERFACE ${CMAKE_CURRENT_BINARY_DIR}/libusb_install/lib/${CMAKE_STATIC_LIBRARY_PREFIX}usb${CMAKE_STATIC_LIBRARY_SUFFIX})
+target_link_libraries(usb INTERFACE ${CMAKE_CURRENT_BINARY_DIR}/libusb_install/lib/${CMAKE_STATIC_LIBRARY_PREFIX}libusb-1.0${CMAKE_STATIC_LIBRARY_SUFFIX})
 set(USE_EXTERNAL_USB ON) # INTERFACE libraries can't have real deps, so targets that link with usb need to also depend on libusb
 
 set_target_properties( libusb PROPERTIES FOLDER "3rd Party")

diff --git a/CMake/lrs_options.cmake b/CMake/lrs_options.cmake
@@ -47,4 +47,5 @@ endif()
 option(BUILD_PC_STITCHING "Build pointcloud-stitching example" OFF)
 option(BUILD_WITH_DDS "Access camera devices through DDS topics (requires CMake 3.16.3)" OFF)
 option(BUILD_RS2_ALL "Build realsense2-all static bundle containing all realsense libraries (with BUILD_SHARED_LIBS=OFF)" ON)
+option(ENABLE_SECURITY_FLAGS "Enable additional compiler security flags to enhance the build's security" OFF)
 
diff --git a/CMake/security_flags_helper_functions.cmake b/CMake/security_flags_helper_functions.cmake
@@ -0,0 +1,20 @@
+macro(push_security_flags)  # remove security flags
+    set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${SECURITY_COMPILER_FLAGS}")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${SECURITY_COMPILER_FLAGS}")
+endmacro()
+
+macro(pop_security_flags)  # append security flags
+    string(REPLACE "${SECURITY_COMPILER_FLAGS}" "" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
+    string(REPLACE "${SECURITY_COMPILER_FLAGS}" "" CMAKE_C_FLAGS "${CMAKE_C_FLAGS}")
+endmacro()
+
+macro(set_security_flags_for_executable) # replace flag fPIC (Position-Independent Code) with fPIE (Position-Independent Executable)
+    string(REPLACE "-fPIC" "-fPIE" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
+    string(REPLACE "-fPIC" "-fPIE" CMAKE_C_FLAGS  "${CMAKE_C_FLAGS}")
+endmacro()
+
+macro(unset_security_flags_for_executable) # replace flag fPIE (Position-Independent Executable) with fPIC (Position-Independent Code)
+    string(REPLACE "-fPIE" "-fPIC" CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS}")
+    string(REPLACE "-fPIE" "-fPIC" CMAKE_C_FLAGS  "${CMAKE_C_FLAGS}")
+endmacro()
+