{"id":46101303,"url":"https://github.com/tipi-build/hfc","last_synced_at":"2026-03-01T19:38:19.975Z","repository":{"id":272683757,"uuid":"917115626","full_name":"tipi-build/hfc","owner":"tipi-build","description":"Enhanced FetchContent for Hermetic project dependency builds in CMake ","archived":false,"fork":false,"pushed_at":"2026-02-06T17:32:15.000Z","size":416,"stargazers_count":27,"open_issues_count":7,"forks_count":2,"subscribers_count":8,"default_branch":"main","last_synced_at":"2026-02-07T01:37:46.919Z","etag":null,"topics":["cmake","cpp","cps","fetchcontent","package-manager"],"latest_commit_sha":null,"homepage":"https://tipi-build.github.io/hfc/","language":"CMake","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tipi-build.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-01-15T11:38:13.000Z","updated_at":"2026-01-24T21:52:24.000Z","dependencies_parsed_at":null,"dependency_job_id":"e55dc0d4-98df-47f3-a292-75dab5d09d9a","html_url":"https://github.com/tipi-build/hfc","commit_stats":null,"previous_names":["tipi-build/hfc"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tipi-build/hfc","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tipi-build%2Fhfc","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tipi-build%2Fhfc/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tipi-build%2Fhfc/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tipi-build%2Fhfc/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tipi-build","download_url":"https://codeload.github.com/tipi-build/hfc/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tipi-build%2Fhfc/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29981694,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-01T16:35:47.903Z","status":"ssl_error","status_checked_at":"2026-03-01T16:35:44.899Z","response_time":124,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cmake","cpp","cps","fetchcontent","package-manager"],"created_at":"2026-03-01T19:38:19.846Z","updated_at":"2026-03-01T19:38:19.958Z","avatar_url":"https://github.com/tipi-build.png","language":"CMake","funding_links":[],"categories":[],"sub_categories":[],"readme":"# tipi.build HermeticFetchContent\n\nEnhanced and compatible `FetchContent` with source+build caching, install tree caching and  \n\nUsable with either `cmake` or `cmake-re` this CMake module provides an \nintegration of  Third-party libraries into the project's CMake build system \ngiving better control (in regard to especially toolchain matter).\n\n## Usage\n\n* ➡ Add `include(HermeticFetchContent)` to the CMakelists\n* 📘 Learn more in the [reference documentation](https://tipi-build.github.io/hfc/)\n* 🚀 [Get Started](./example/get-started/)\n```cmake\n# Bootstrap hfc : Copy this after your project() call\ninclude(FetchContent)\nFetchContent_Populate(hfc\n  GIT_REPOSITORY https://github.com/tipi-build/hfc.git\n  GIT_TAG main\n  SOURCE_DIR \"${PROJECT_SOURCE_DIR}/thirdparty/cache/hfc/src\"\n  SUBBUILD_DIR \"${PROJECT_SOURCE_DIR}/thirdparty/cache/hfc/subbuild\"\n  BINARY_DIR \"${PROJECT_SOURCE_DIR}/thirdparty/cache/hfc/bin\"\n)\nFetchContent_GetProperties(hfc)\nlist(APPEND CMAKE_MODULE_PATH \"${hfc_SOURCE_DIR}/cmake\")\ninclude(HermeticFetchContent)\n```\n\nThe different dependencies are made available to the project's targets as \nlibraries and executables that can be \"target linked\" or \"found\" as one would \nnormally expect in a modern CMake build system.\n\n### Hermeticity\n\nWhen used with `cmake` the dependency builds are placed as content builds in \nisolated source / build / install trees in a folder structure under\n`\u003cbuild-prefix\u003e/_deps/\u003ccontent-name\u003e-\u003csrc|build|install|...\u003e`.\n \nThe hermeticity extends to the level that the dependency builds are not aware\nof each other *unless* they are made `find_package`-able explicitely using \nthe options in the `FetchContent_MakeHermetic()` declaration for each\nrespective dependency.\n\n### Build Graph reorganization\n\nDepending on the selection of either being made available at build time or \nconfigure time by using:\n\n  * `HermeticFetchContent_MakeAvailableAtBuildTime(\u003ccontent-name\u003e)`\n  * `HermeticFetchContent_MakeAvailableAtConfigureTime(\u003ccontent-name\u003e)`\n\nThe dependency will be either just configured or build and configured during the\nproject's configure phase. The former case guarentees best performance when \nrunning the builds because dependencies can be built as needed (as they are \nfully integrated in the build graph).\n\n### Cacheability\n\nRelying targets scanning technique to enable depending only on FetchContent \ninstall/ trees, when used with `cmake-re` the builds of the dependencies are\nexecuted in a manner that enables them to be cached independently of the project\nto improve cache hits and library build reeuses on the L1 cache (by using\n `cmake-re`'s mirroring and caching technology).\n\nThis feature allows to save time needlessly spent on CI runs checking out code\nof thirdparties instead of building changes.\n\n### SBOM\n\nHermetic FetchContent provides an out of the box integration with \n[cmake-SBOM by DEMCON](https://github.com/DEMCON/cmake-sbom.git) (which can be \neither auto-bootstrapped or provided by your project - if `include(sbom)` works\nthe provided version is used)\n\nThe feature is enabled by default but can be disabled by setting the option\n`HFC_ENABLE_CMAKE_SBOM` to `OFF`\n\nTo add information about licences and author to the metadata you can:\n\n```cmake\nFetchContent_MakeHermetic(\n  \u003ccontent_name\u003e\n  [...snip...]\n  SBOM_LICENSE \"MIT License\"\n  SBOM_SUPPLIER \"Mr. Wonderful\"\n)\n```\n\nHere's how to trigger the actual SBOM generation (should be placed after all dependencies were registered)\n\n```cmake\ninclude(hfc_sbom)\nhfc_generate_sbom(\n  OUTPUT \"my-awesome-sbom.spdx\"\n  LICENSE \"Proprietary\"\n  SUPPLIER \"You\"\n  SUPPLIER_URL \"your-url.com\"\n  NO_VERIFY\n)\n```\n\n### How does it extend the FetchContent ecosystem\nThis project isn't yet-another-package-manager, it's an extension to CMake FetchContent.\n\nCMake FetchContent popularity is growing with projects like CPM or cmake-init. HermeticFetchContent is not a replacement for CPM or FetchContent but an extension and improvement to those !\n\nHowever plain FetchContent or CPM (which is based on FetchContent) lack some features :\n  - Only works with high quality CMake dependencies: OpenSSL, autotools build systems and real-life CMake projects with no consideration for FetchContent aren't supported\n  - It needs to clone all sources on builds\n    * `hfc` can fetch only the install tree of a dependency when `cmake-re` is enabled\n  - It builds everything from source every time : no build caching\n  - Needs polluting main projet and descendent variable scope to configure dependencies\n    * If one wants to configure 2 dependencies using the same option name with different value it can be problematic.\n  - Missing support for dependencies traceability and SBOMs\n\nWith **HermeticFetchContent** we solve this by enhancing FetchContent with :\n#### Hermeticity\n  - Dependencies are made available to each other selectively\n  - FetchContent libraries that can find_package their dependencies\n  - If cmake-re in use absolute hermeticity guaranteed\n\n#### Cacheability\nWhen run within cmake-re : If an install cache is available it doesn't even pull the sources\nIf pointed to an HERMETIC_FETCHCONTENT_INSTALL_DIR, it can reuse install tree locally also in plain CMake. With `cmake-re` it pulls it automatically from your user or organization cache. \n\n#### Build Graph Reorganization\n  - Choose wether the library needs to be built before project builds or mixed in your build graph :\n    - `HermeticFetchContent_MakeAvailableAtBuildTime()`\n    - `HermeticFetchContent_MakeAvailableAtConfigureTime()`\n\n#### SBOMs\n  - Run `cmake --build build/ --target hfc_generate_sbom` and you will get you a full SBOM in SPDX format\n\n## Developer Guide\n\nYou can run the HermeticFetchContent test suite this way:\n\n  * `cmake -S . -B build/ -DCMAKE_TOOLCHAIN_FILE=toolchain/toolchain.cmake -GNinja` **[*]** \n  * `cmake --build build/`\n  * `ctest -R check_options_and_defines_forwarding`\n\n\n**[*]** Additionally the following variable can be defined to ease development:\n\n  * `export HFC_TEST_SHARED_TOOLS_DIR=$PWD/thirdparty/cache/.hfc_tools`\n\n  * `HFC_PROJECT_HFC_SOURCE_CACHEDIR` to use a common source cache for the builds of the test project \n  * `HFC_PROJECT_HFC_BASEDIR` to use a common \"HFC base dir\" (which will contain the dependency install trees)\n  * `HERMETIC_FETCHCONTENT_TOOLS_DIR` if you have one, avoid rebuilding `goldilock` too frequently, by default a `${CMAKE_BINARY_DIR}/.hfc_tools/` directory will be created\n\n## Contributing\n\nPlease refer to [Contributing](./CONTRIBUTING.md) for details.\n\n## Authors\n\nAuthored with love, blood and tears in Zürich, Switzerland by team **[tipi.build](https://tipi.build)**.\n\nSee all awesome contributors in [LICENSE](./LICENSE) :\n* Ruslan Baratov\n  * Parts of `HermeticFetchContent` rely on CMake modules extracted from\n    Ruslan Baratov's [hunter](https://github.com/ruslo/hunter)\n    (BSD 2-Clause \"Simplified\" License)\n* Edward Nolan [@enolan-maystreet](https://github.com/enolan-maystreet)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftipi-build%2Fhfc","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftipi-build%2Fhfc","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftipi-build%2Fhfc/lists"}