libacl import options to address -fPIC and other similar issue

.bazelrc

@@ -41,6 +41,9 @@ build --credential_helper="*.qnx.com=%workspace%/.github/tools/qnx_credential_he
 build --features=minimal_warnings --features=-strict_warnings --features=warnings_as_errors
 build --incompatible_strict_action_env
 build --per_file_copt=external/.*google_benchmark.*@-Wno-error
+# acl is vendored third-party source (see third_party/acl/acl.BUILD); it does not
+# meet this repo's strict warning bar (e.g. -Wcast-qual), so demote its warnings.
+build --per_file_copt=external/.*acl-src.*@-Wno-error
 
 # Common flags for tests
 test:_bl_common --build_tests_only

MODULE.bazel

@@ -160,18 +160,20 @@ llvm.toolchain(
 use_repo(llvm, "llvm_toolchain")
 
 deb = use_repo_rule("@download_utils//download/deb:defs.bzl", "download_deb")
+archive = use_repo_rule("@download_utils//download/archive:defs.bzl", "download_archive")
 
-deb(
-    name = "acl-deb",
-    build = "//third_party/acl:acl.BUILD",
-    urls = ["https://archive.ubuntu.com/ubuntu/pool/main/a/acl/libacl1-dev_2.3.1-1_amd64.deb"],
-    visibility = ["//visibility:public"],
-)
-
-deb(
-    name = "acl-deb-aarch64",
+# acl is vendored from upstream source instead of a prebuilt, arch-pinned Ubuntu .deb
+# (see third_party/acl/acl.BUILD and score/os/BUILD's `:acl` target) to avoid the
+# recurring -fPIC/arch breakage tracked by SWP-278650 (eclipse-score/baselibs#172, #496, #78).
+archive(
+    name = "acl-src",
     build = "//third_party/acl:acl.BUILD",
-    urls = ["https://ports.ubuntu.com/ubuntu-ports/pool/main/a/acl/libacl1-dev_2.3.1-1_arm64.deb"],
+    integrity = "sha256-5mETFFbScIoBxhSg9ADhHX0b+utvPnS3W7mAty8BYaM=",
+    strip_prefix = "acl-2.4.0",
+    urls = [
+        "https://download.savannah.nongnu.org/releases/acl/acl-2.4.0.tar.xz",
+        "http://download-mirror.savannah.nongnu.org/releases/acl/acl-2.4.0.tar.xz",
+    ],
     visibility = ["//visibility:public"],
 )
 

NOTICE

@@ -54,3 +54,16 @@ The license text can be found in licenses/llvm-libcxx.txt.
 //===----------------------------------------------------------------------===//
 
 [1] https://github.com/llvm/llvm-project/tree/main/libcxx
+
+## acl
+
+third_party/acl vendors the plain POSIX ACL portion of libacl's source (excluding
+acl_delete_def_file_at and perm_copy_fd/perm_copy_file) from acl 2.4.0 [2],
+compiled directly as a score_baselibs cc_library instead of installing a prebuilt,
+architecture-pinned Ubuntu .deb package (see SWP-278650 and
+https://github.com/eclipse-score/baselibs/issues/172, /issues/496, /issues/78).
+
+libacl is provided under the GNU Lesser General Public License v2.1 (or later).
+The license text can be found in licenses/acl-lgpl.txt.
+
+[2] https://download.savannah.nongnu.org/releases/acl/acl-2.4.0.tar.xz

score/os/test/BUILD

@@ -354,6 +354,7 @@ cc_test(
     srcs = [
         "acl_test.cpp",
     ],
+    dynamic_deps = ["@score_baselibs//third_party/acl:acl_shared"],
     features = COMPILER_WARNING_FEATURES + [
         "aborts_upon_exception",
     ],

score/os/utils/acl/BUILD

@@ -56,6 +56,7 @@ cc_library(
 cc_test(
     name = "unit_test",
     srcs = ["access_control_list_test.cpp"],
+    dynamic_deps = ["@score_baselibs//third_party/acl:acl_shared"],
     features = COMPILER_WARNING_FEATURES,
     tags = ["unit"],
     visibility = [

third_party/acl/BUILD

@@ -11,11 +11,57 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
+load("@bazel_skylib//rules:common_settings.bzl", "bool_flag")
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+# Bazel-native equivalent of upstream acl's `./configure --enable-nls`: gates
+# whether include/misc.h's `_()` macro (see @acl-src//:acl) routes through gettext().
+bool_flag(
+    name = "enable_nls",
+    build_setting_default = False,
+)
+
+config_setting(
+    name = "nls_enabled",
+    flag_values = {":enable_nls": "True"},
+    visibility = ["@acl-src//:__pkg__"],
+)
+
+# Hand-written stand-in for acl's autoconf-generated include/config.h, consumed by
+# @acl-src (see MODULE.bazel and acl.BUILD) which vendors libacl from source.
+cc_library(
+    name = "config_h",
+    hdrs = ["config.h"],
+    defines = select({
+        ":nls_enabled": ["ENABLE_NLS=1"],
+        "//conditions:default": [],
+    }),
+    includes = ["."],
+    visibility = ["@acl-src//:__pkg__"],
+)
+
+# Exposed as plain files (rather than only via the cc_library above) so
+# @acl-src//:config_drift_test (see acl.BUILD) can read config.h as test data and
+# run check_config_drift.py without needing a C++ toolchain.
+exports_files(
+    [
+        "config.h",
+        "check_config_drift.py",
+    ],
+    visibility = ["@acl-src//:__pkg__"],
+)
+
+# Static linking is not exposed to general consumers; score/os:acl is the only
+# target that needs the static compile-time interface, everyone else must use
+# :acl_shared (paired with dynamic_deps) instead.
 alias(
     name = "acl",
-    actual = select({
-        "@platforms//cpu:aarch64": "@acl-deb-aarch64//:acl",
-        "//conditions:default": "@acl-deb//:acl",
-    }),
+    actual = "@acl-src//:acl",
+    visibility = ["@score_baselibs//score/os:__pkg__"],
+)
+
+alias(
+    name = "acl_shared",
+    actual = "@acl-src//:acl_shared",
     visibility = ["//:__subpackages__"],
 )

third_party/acl/acl.BUILD

@@ -1,5 +1,5 @@
 # *******************************************************************************
-# Copyright (c) 2025 Contributors to the Eclipse Foundation
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
 #
 # See the NOTICE file(s) distributed with this work for additional
 # information regarding copyright ownership.
@@ -11,18 +11,92 @@
 # SPDX-License-Identifier: Apache-2.0
 # *******************************************************************************
 
+# BUILD file for the vendored acl-2.4.0 source (https://savannah.nongnu.org/projects/acl),
+# used as the `build` file for the `acl-src` download_archive repository declared in
+# MODULE.bazel. Only the plain POSIX ACL API is vendored (see srcs/hdrs below).
+#
+# acl_get_file(), acl_set_file(), acl_extended_file() and acl_extended_file_nofollow()
+# are thin AT_FDCWD wrappers around the fd-relative acl_get_file_at()/acl_set_file_at()/
+# acl_extended_file_at(), so those three "_at" files (and the libmisc getxattrat/
+# setxattrat compat shims they need, since this toolchain's glibc predates those
+# syscalls) are vendored too. acl_delete_def_file_at.c and perm_copy_fd.c/
+# perm_copy_file.c (which pulls in a separate libattr dependency via
+# <attr/error_context.h>) are intentionally excluded because score/os/acl_impl.cpp
+# never calls them.
+
+load("@rules_cc//cc:cc_shared_library.bzl", "cc_shared_library")
 load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@rules_python//python:defs.bzl", "py_test")
+load("@score_baselibs//third_party/acl:acl_sources.bzl", "ACL_HDRS", "ACL_SRCS")
+
+# include/acl.h and include/libacl.h declare their public API with a bare `EXPORT`
+# marker. Upstream's install rule (include/Makemodule.am's SUBST_INSTALL_HEADER)
+# rewrites `EXPORT` to `extern` via sed when installing these headers; since we vendor
+# the headers directly instead of installing them, replicate that substitution with a
+# transitive `defines` so any consumer compiling against these headers gets it too.
 
+# include/acl.h remapped to the angle-include path <sys/acl.h>, matching score/os/acl.h.
+cc_library(
+    name = "sys_acl_h",
+    hdrs = ["include/acl.h"],
+    defines = ["EXPORT=extern"],
+    include_prefix = "sys",
+    strip_include_prefix = "include",
+    visibility = ["//visibility:public"],
+)
+
+# include/libacl.h remapped to the angle-include path <acl/libacl.h>, matching score/os/acl.h.
+cc_library(
+    name = "acl_libacl_h",
+    hdrs = ["include/libacl.h"],
+    defines = ["EXPORT=extern"],
+    include_prefix = "acl",
+    strip_include_prefix = "include",
+    visibility = ["//visibility:public"],
+)
+
+# Static compile-time interface, kept private to the one wrapper that needs it
+# (score/os:acl); everyone else must go through :acl_shared instead.
 cc_library(
     name = "acl",
-    srcs = select({
-        "@platforms//cpu:aarch64": ["usr/lib/aarch64-linux-gnu/libacl.a"],
-        "@platforms//cpu:x86_64": ["usr/lib/x86_64-linux-gnu/libacl.a"],
-    }),
-    hdrs = [
-        "usr/include/acl/libacl.h",
-        "usr/include/sys/acl.h",
+    srcs = ACL_SRCS,
+    hdrs = ACL_HDRS,
+    includes = [
+        "include",
+        # Several vendored files quote-include with a redundant leading directory
+        # (e.g. "include/visibility-hidden.h", "libmisc/proc-self-fd.h"); adding the
+        # repo root lets those resolve as-is instead of needing per-file patches.
+        ".",
     ],
-    includes = ["usr/include/"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["@score_baselibs//third_party/acl:__pkg__"],
+    deps = [
+        ":acl_libacl_h",
+        ":sys_acl_h",
+        "@score_baselibs//third_party/acl:config_h",
+    ],
+)
+
+# libacl.so, for consumers that want to link against acl dynamically instead of
+# statically (e.g. so the vendored LGPL code can be replaced at runtime without
+# relinking, per LGPL-2.1 section 6).
+cc_shared_library(
+    name = "acl_shared",
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:public"],
+    deps = [":acl"],
+)
+
+# Fails if a vendored source/header references an autoconf-style feature macro
+# (HAVE_*, ENABLE_*, etc.) that config.h doesn't define or document as intentionally
+# unset, or if a vendored file's header claims the GPL rather than the LGPL, so both
+# kinds of drift are caught automatically on every acl version bump or file-list change.
+py_test(
+    name = "config_drift_test",
+    srcs = ["@score_baselibs//third_party/acl:check_config_drift.py"],
+    main = "@score_baselibs//third_party/acl:check_config_drift.py",
+    args = ["$(location @score_baselibs//third_party/acl:config.h)"] +
+           ["$(location %s)" % f for f in ACL_SRCS + ACL_HDRS],
+    data = ACL_SRCS + ACL_HDRS + ["@score_baselibs//third_party/acl:config.h"],
     visibility = ["//visibility:public"],
 )

third_party/acl/acl_sources.bzl

@@ -0,0 +1,102 @@
+# *******************************************************************************
+# Copyright (c) 2026 Contributors to the Eclipse Foundation
+#
+# See the NOTICE file(s) distributed with this work for additional
+# information regarding copyright ownership.
+#
+# This program and the accompanying materials are made available under the
+# terms of the Apache License Version 2.0 which is available at
+# https://www.apache.org/licenses/LICENSE-2.0
+#
+# SPDX-License-Identifier: Apache-2.0
+# *******************************************************************************
+
+# Single source of truth for which acl-2.4.0 files are vendored, shared between
+# acl.BUILD (the `:acl` cc_library) and BUILD's `:config_drift_test` (which checks
+# that config.h still covers every autoconf-style macro these files reference).
+
+ACL_SRCS = [
+    # POSIX_CFILES (Makemodule.am).
+    "libacl/acl_add_perm.c",
+    "libacl/acl_calc_mask.c",
+    "libacl/acl_clear_perms.c",
+    "libacl/acl_copy_entry.c",
+    "libacl/acl_copy_ext.c",
+    "libacl/acl_copy_int.c",
+    "libacl/acl_create_entry.c",
+    "libacl/acl_delete_def_file.c",
+    "libacl/acl_delete_entry.c",
+    "libacl/acl_delete_perm.c",
+    "libacl/acl_dup.c",
+    "libacl/acl_free.c",
+    "libacl/acl_from_text.c",
+    "libacl/acl_get_entry.c",
+    "libacl/acl_get_fd.c",
+    "libacl/acl_get_file.c",
+    "libacl/acl_get_file_at.c",
+    "libacl/acl_get_perm.c",
+    "libacl/acl_get_permset.c",
+    "libacl/acl_get_qualifier.c",
+    "libacl/acl_get_tag_type.c",
+    "libacl/acl_init.c",
+    "libacl/acl_set_fd.c",
+    "libacl/acl_set_file.c",
+    "libacl/acl_set_file_at.c",
+    "libacl/acl_set_permset.c",
+    "libacl/acl_set_qualifier.c",
+    "libacl/acl_set_tag_type.c",
+    "libacl/acl_size.c",
+    "libacl/acl_to_text.c",
+    "libacl/acl_valid.c",
+    # LIBACL_CFILES.
+    "libacl/acl_check.c",
+    "libacl/acl_cmp.c",
+    "libacl/acl_entries.c",
+    "libacl/acl_equiv_mode.c",
+    "libacl/acl_error.c",
+    "libacl/acl_extended_fd.c",
+    "libacl/acl_extended_file.c",
+    "libacl/acl_extended_file_at.c",
+    "libacl/acl_extended_file_nofollow.c",
+    "libacl/acl_from_mode.c",
+    "libacl/acl_to_any_text.c",
+    # INTERNAL_CFILES.
+    "libacl/__acl_apply_mask_to_mode.c",
+    "libacl/__acl_from_xattr.c",
+    "libacl/__acl_reorder_obj_p.c",
+    "libacl/__acl_to_any_text.c",
+    "libacl/__acl_to_xattr.c",
+    "libacl/__libobj.c",
+    # libmisc compat shims needed by the "_at" files above (this toolchain's glibc
+    # doesn't provide getxattrat()/setxattrat(), so config.h leaves HAVE_GETXATTRAT/
+    # HAVE_SETXATTRAT undefined and xattrat_compat.h maps them to these instead).
+    # xattrat.c provides the raw syscall-based getxattrat()/setxattrat() that the
+    # *_compat.c shims try first, falling back to proc-self-fd-based emulation
+    # (via ENOSYS) on kernels that predate the getxattrat/setxattrat syscalls.
+    "libmisc/xattrat.c",
+    "libmisc/getxattrat_compat.c",
+    "libmisc/setxattrat_compat.c",
+    "libmisc/proc-self-fd.c",
+    # Helpers used by acl_from_text.c/acl_to_any_text.c (quoting/unquoting of
+    # non-printable user and group names) and acl_get_qualifier.c (uid/gid lookup).
+    "libmisc/quote.c",
+    "libmisc/unquote.c",
+    "libmisc/uid_gid_lookup.c",
+    "libmisc/high_water_alloc.c",
+]
+
+ACL_HDRS = [
+    # HFILES (Makemodule.am): private headers shared between the .c files above.
+    "libacl/libobj.h",
+    "libacl/libacl.h",
+    "libacl/byteorder.h",
+    "libacl/__acl_from_xattr.h",
+    "libacl/__acl_to_xattr.h",
+    # Internal (noinst) headers pulled in by the .c files above.
+    "include/acl_ea.h",
+    "include/misc.h",
+    "include/visibility-hidden.h",
+    "include/xattrat.h",
+    "include/xattrat_compat.h",
+    "libmisc/proc-self-fd.h",
+]