couchbase 3.8.1 → 3.9.0

data/ext/cache/mozilla-ca-bundle.sha256

@@ -1 +1 @@
-86a1f3366afac7c6f8ae9f3c779ac221129328c43f0ab2b8817eb2f362a5025c  cacert.pem
+796f1389bfea13c0ed78f663b765baaff54a508e5483786bd6ece73c5e3e3cbe  cacert.pem

data/ext/couchbase/CMakeLists.txt

@@ -14,14 +14,9 @@ if(NOT DEFINED COUCHBASE_CXX_CLIENT_MASTER_PROJECT)
   endif()
 endif()
 
-option(COUCHBASE_CXX_CLIENT_COLUMNAR "Build with Columnar additions" FALSE)
-if(COUCHBASE_CXX_CLIENT_COLUMNAR)
-  message(STATUS "COUCHBASE_CXX_CLIENT_COLUMNAR=${COUCHBASE_CXX_CLIENT_COLUMNAR} building with Columnar additions.")
-endif()
-
 project(
   couchbase_cxx_client
-  VERSION "1.3.2"
+  VERSION "1.5.0"
   LANGUAGES CXX C)
 message(
   STATUS
@@ -32,6 +27,33 @@ if(WIN32)
   message(STATUS "Windows SDK: ${CMAKE_VS_WINDOWS_TARGET_PLATFORM_VERSION}")
 endif()
 
+# On Windows ARM64, MSVC's <winbase.h> defines C++ overloads for the
+# _Interlocked* intrinsics that clash with the intrinsic declarations pulled
+# in transitively (e.g. via asio/BoringSSL), breaking the build. Disabling
+# the C++ overloads restores the plain intrinsic declarations. Match both the
+# native case (CMAKE_SYSTEM_PROCESSOR) and the cross-compile case
+# (-A ARM64 sets CMAKE_GENERATOR_PLATFORM).
+if(MSVC AND (CMAKE_SYSTEM_PROCESSOR MATCHES "ARM64" OR CMAKE_GENERATOR_PLATFORM STREQUAL "ARM64"))
+  message(STATUS "Applying WinBase Interlocked macro for Windows ARM64")
+  add_compile_definitions(MICROSOFT_WINDOWS_WINBASE_H_DEFINE_INTERLOCKED_CPLUSPLUS_OVERLOADS=0)
+endif()
+
+# Multi-process compile for MSVC. With the Visual Studio generator each
+# .vcxproj invokes a single cl.exe that processes its source files
+# serially; /MP turns each invocation into a parallel batch driven by
+# NUMBER_OF_PROCESSORS. Combined with MSBuild's /m:N (project-level
+# parallelism) this lets a Windows agent saturate its cores. Must be
+# applied at directory scope before ThirdPartyDependencies.cmake so
+# the FetchContent-built dependencies (gRPC, protobuf, abseil, curl,
+# boringssl, ...) inherit it — they are the bulk of the Windows build.
+#
+# Scoped to C and CXX via COMPILE_LANGUAGE: NASM (used by BoringSSL's
+# x86 assembly) and other ASM dialects do not understand /MP and would
+# abort with `nasm.exe ... /MP ... exited with code 1`.
+if(MSVC)
+  add_compile_options($<$<COMPILE_LANGUAGE:C,CXX>:/MP>)
+endif()
+
 include(cmake/TarballRelease.cmake OPTIONAL)
 
 include(cmake/PreventInSourceBuilds.cmake)
@@ -62,9 +84,66 @@ endif()
 find_package(Threads REQUIRED)
 
 option(COUCHBASE_CXX_CLIENT_BUILD_OPENTELEMETRY "Build with OpenTelemetry" ${COUCHBASE_CXX_CLIENT_MASTER_PROJECT})
+option(COUCHBASE_CXX_CLIENT_BUILD_TOOLS "Build tools" ${COUCHBASE_CXX_CLIENT_MASTER_PROJECT})
+# fit_performer links gRPC/Protobuf, which cmake/GrpcProtobuf.cmake resolves from the platform or
+# builds from source, so this no longer depends on what the platform packages. Turning it OFF only
+# skips the tool.
+option(COUCHBASE_CXX_CLIENT_BUILD_FIT_PERFORMER
+       "Build the FIT performer integration-test tool"
+       ${COUCHBASE_CXX_CLIENT_BUILD_TOOLS})
+
+# couchbase2:// (Protostellar) support. Like the FIT performer it pulls in gRPC and protobuf. Default
+# OFF: the transport is experimental and opt-in. When enabled it vendors the Protostellar schema,
+# builds the generated stubs, and compiles the couchbase2 transport into the client library on top of
+# them.
+option(COUCHBASE_CXX_CLIENT_BUILD_COUCHBASE2
+       "Build with couchbase2:// (Protostellar/gRPC) support"
+       OFF)
+
+# Build the way the redistributable packages are built.
+#
+# The packages must carry every vendored dependency inside their own artefacts, so this switch makes
+# the build resolve gRPC, Protobuf and their transitive dependencies from source, hide the generated
+# Protostellar stubs from the shared library's exported ABI, and link the in-tree executables against
+# the static client so each holds exactly one copy of them.
+#
+# All of that is expensive: a source build of gRPC on every configure, and a full copy of the client
+# and the vendored stack in every executable that is linked. A development or CI build needs none of
+# it -- it wants the platform's gRPC where one exists and the shared client everywhere -- so the
+# switch is off by default and the packaging manifests turn it on.
+option(COUCHBASE_CXX_CLIENT_PACKAGE_BUILD
+       "Resolve and link the vendored dependencies the way the redistributable packages do" FALSE)
 
 include(cmake/ThirdPartyDependencies.cmake)
 
+if(COUCHBASE_CXX_CLIENT_BUILD_COUCHBASE2)
+  # Vendors the Protostellar schema (CPM) and builds the generated gRPC/protobuf stubs library.
+  include(cmake/Protostellar.cmake)
+endif()
+
+# Remove the staging prefix at the end of ANY install, not only the three packaging manifests.
+#
+# The vendored dependencies declare install rules no option switches off, and they are redirected
+# under one throwaway prefix. The RPM, DEB and Alpine steps each delete it -- but nothing else does,
+# so a plain "cmake --install" left gRPC's headers, archives and roots.pem sitting under
+# <prefix>/vendored-not-installed. That affects every source build with a vendored dependency, which
+# since AUTO includes any host without a system gRPC.
+#
+# Declared here, unconditionally, rather than in cmake/Packaging.cmake: that file is included only
+# when COUCHBASE_CXX_CLIENT_INSTALL is ON, while the vendored dependencies register their install
+# rules regardless, so with INSTALL off "cmake --install" still staged them and nothing removed them.
+# install(CODE) runs in declaration order, and this point is after the dependencies were added.
+# CMAKE_INSTALL_PREFIX is escaped so the generated script reads it at install time: "cmake --install
+# --prefix <other>" stages the redirected files under the override, and expanding the configured
+# prefix here would try to delete them from somewhere else entirely, leaving them behind.
+install(CODE "
+  set(_junk \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${COUCHBASE_CXX_CLIENT_VENDORED_INSTALL_JUNK_DIR}\")
+  if(EXISTS \"\${_junk}\")
+    message(STATUS \"Removing vendored staging prefix: \${_junk}\")
+    file(REMOVE_RECURSE \"\${_junk}\")
+  endif()
+")
+
 include(cmake/VersionInfo.cmake)
 
 include(cmake/RPath.cmake)
@@ -77,6 +156,8 @@ set(couchbase_cxx_client_FILES
     core/agent_group.cxx
     core/agent_group_config.cxx
     core/analytics_query_options.cxx
+    core/analytics_stream.cxx
+    core/analytics_stream_component.cxx
     core/app_telemetry_address.cxx
     core/app_telemetry_meter.cxx
     core/app_telemetry_reporter.cxx
@@ -87,14 +168,6 @@ set(couchbase_cxx_client_FILES
     core/cluster_credentials.cxx
     core/cluster_options.cxx
     core/collections_component.cxx
-    core/columnar/backoff_calculator.cxx
-    core/columnar/columnar_agent.cxx
-    core/columnar/columnar_agent_config.cxx
-    core/columnar/columnar_error.cxx
-    core/columnar/error_codes.cxx
-    core/columnar/management_component.cxx
-    core/columnar/query_component.cxx
-    core/columnar/query_result.cxx
     core/config_profiles.cxx
     core/core_sdk_shim.cxx
     core/crud_component.cxx
@@ -113,6 +186,7 @@ set(couchbase_cxx_client_FILES
     core/impl/boolean_query.cxx
     core/impl/bucket_manager.cxx
     core/impl/collection.cxx
+    core/operations/document_get_replica.cxx
     core/impl/collection_manager.cxx
     core/impl/common_error_category.cxx
     core/impl/configuration_profiles_registry.cxx
@@ -135,7 +209,6 @@ set(couchbase_cxx_client_FILES
     core/impl/geo_bounding_box_query.cxx
     core/impl/geo_distance_query.cxx
     core/impl/geo_polygon_query.cxx
-    core/impl/get_replica.cxx
     core/impl/internal_date_range_facet_result.cxx
     core/impl/internal_error_context.cxx
     core/impl/internal_numeric_range_facet_result.cxx
@@ -162,10 +235,14 @@ set(couchbase_cxx_client_FILES
     core/impl/observe_seqno.cxx
     core/impl/phrase_query.cxx
     core/impl/prefix_query.cxx
+    core/impl/public_analytics_stream_result.cxx
     core/impl/public_bucket.cxx
     core/impl/public_cluster.cxx
     core/impl/public_logger.cxx
+    core/impl/public_query_stream_result.cxx
     core/impl/public_scan_result.cxx
+    core/impl/public_transaction_get_multi_replicas_from_preferred_server_group_result.cxx
+    core/impl/public_transaction_get_multi_result.cxx
     core/impl/public_transaction_get_result.cxx
     core/impl/query.cxx
     core/impl/query_error_category.cxx
@@ -191,6 +268,7 @@ set(couchbase_cxx_client_FILES
     core/impl/search_sort_id.cxx
     core/impl/search_sort_score.cxx
     core/impl/streaming_json_lexer_error_category.cxx
+    core/impl/wait_until_ready.cxx
     core/impl/subdoc/array_add_unique.cxx
     core/impl/subdoc/array_append.cxx
     core/impl/subdoc/array_insert.cxx
@@ -222,7 +300,7 @@ set(couchbase_cxx_client_FILES
     core/impl/wildcard_query.cxx
     core/impl/crypto.cxx
     core/impl/observability_recorder.cxx
-    core/io/config_tracker.cxx
+    core/impl/transactions.cxx
     core/io/dns_client.cxx
     core/io/dns_config.cxx
     core/io/http_parser.cxx
@@ -253,6 +331,7 @@ set(couchbase_cxx_client_FILES
     core/metrics/logging_meter.cxx
     core/metrics/meter_wrapper.cxx
     core/n1ql_query_options.cxx
+    core/operations/analytics_response_parsing.cxx
     core/operations/document_analytics.cxx
     core/operations/document_append.cxx
     core/operations/document_decrement.cxx
@@ -267,6 +346,7 @@ set(couchbase_cxx_client_FILES
     core/operations/document_mutate_in.cxx
     core/operations/document_prepend.cxx
     core/operations/document_query.cxx
+    core/operations/query_response_parsing.cxx
     core/operations/document_remove.cxx
     core/operations/document_replace.cxx
     core/operations/document_search.cxx
@@ -389,6 +469,8 @@ set(couchbase_cxx_client_FILES
     core/protocol/cmd_upsert.cxx
     core/protocol/frame_info_utils.cxx
     core/protocol/status.cxx
+    core/query_stream.cxx
+    core/query_stream_component.cxx
     core/range_scan_load_balancer.cxx
     core/range_scan_options.cxx
     core/range_scan_orchestrator.cxx
@@ -449,6 +531,11 @@ set(couchbase_cxx_client_FILES
     core/cluster_label_listener.cxx
 )
 
+if(COUCHBASE_CXX_CLIENT_BUILD_COUCHBASE2)
+  # The Protostellar transport is compiled into the client library (see cmake/Protostellar.cmake).
+  list(APPEND couchbase_cxx_client_FILES ${couchbase_cxx_protostellar_TRANSPORT_FILES})
+endif()
+
 set(couchbase_cxx_client_LIBRARIES)
 set(couchbase_cxx_client_DEFAULT_LIBRARY)
 
@@ -509,10 +596,9 @@ foreach(TARGET ${couchbase_cxx_client_LIBRARIES})
 
   target_include_directories(
     ${TARGET} SYSTEM
-    PRIVATE $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/third_party/cxx_function>
-            $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/third_party/expected/include>
-            $<BUILD_INTERFACE:$<TARGET_PROPERTY:jsonsl,INTERFACE_INCLUDE_DIRECTORIES>>
-            $<BUILD_INTERFACE:$<TARGET_PROPERTY:asio,INTERFACE_INCLUDE_DIRECTORIES>>)
+    PRIVATE $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}/third_party/expected/include>
+            $<BUILD_INTERFACE:$<TARGET_PROPERTY:jsonsl,INTERFACE_SYSTEM_INCLUDE_DIRECTORIES>>
+            $<BUILD_INTERFACE:$<TARGET_PROPERTY:asio,INTERFACE_SYSTEM_INCLUDE_DIRECTORIES>>)
 
   target_include_directories(${TARGET} PUBLIC $<BUILD_INTERFACE:${PROJECT_SOURCE_DIR}>)
   target_include_directories(${TARGET} PUBLIC $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
@@ -535,6 +621,10 @@ foreach(TARGET ${couchbase_cxx_client_LIBRARIES})
   if(COUCHBASE_CXX_CLIENT_BUILD_OPENTELEMETRY)
     target_link_libraries(${TARGET} PRIVATE $<BUILD_INTERFACE:opentelemetry_api>)
   endif()
+  if(COUCHBASE_CXX_CLIENT_BUILD_COUCHBASE2)
+    # Generated Protostellar stubs + gRPC/protobuf, consumed by core/protostellar/*.
+    target_link_libraries(${TARGET} PRIVATE $<BUILD_INTERFACE:couchbase_cxx_protostellar>)
+  endif()
 
   if(HAVE_BACKTRACE)
     target_link_libraries(${TARGET} PRIVATE ${PLATFORM_LIBRARIES})
@@ -586,10 +676,30 @@ if(COUCHBASE_CXX_CLIENT_BUILD_STATIC)
 endif()
 
 option(COUCHBASE_CXX_CLIENT_BUILD_TESTS "Build test programs" ${COUCHBASE_CXX_CLIENT_MASTER_PROJECT})
+
+# CNG (Protostellar) tests use a hand-rolled framework (NOT Catch2), so they can be built
+# independently of the main (Catch2) test suite. The framework itself links no client code; each
+# test links only what it exercises (see test/cng/CMakeLists.txt).
+option(COUCHBASE_CXX_CLIENT_BUILD_CNG_TESTS "Build CNG (Protostellar) tests"
+       ${COUCHBASE_CXX_CLIENT_BUILD_TESTS})
+
+# The hand-rolled framework both test trees build on, and its self-test. It precedes
+# cmake/Testing.cmake so couchbase_add_test() is defined before test/CMakeLists.txt is read.
+# Testing is enabled at the top level here so `ctest` from the build root discovers these even when
+# the main (Catch2) suite is disabled and cmake/Testing.cmake was not included.
+if(COUCHBASE_CXX_CLIENT_BUILD_TESTS OR COUCHBASE_CXX_CLIENT_BUILD_CNG_TESTS)
+  enable_testing()
+  include(cmake/TestFramework.cmake)
+endif()
+
 if(COUCHBASE_CXX_CLIENT_BUILD_TESTS)
   include(cmake/Testing.cmake)
 endif()
 
+if(COUCHBASE_CXX_CLIENT_BUILD_CNG_TESTS)
+  add_subdirectory(test/cng)
+endif()
+
 option(COUCHBASE_CXX_CLIENT_BUILD_DOCS "Build API documentation" ${COUCHBASE_CXX_CLIENT_MASTER_PROJECT})
 if(COUCHBASE_CXX_CLIENT_BUILD_DOCS)
   include(cmake/Documentation.cmake)
@@ -600,7 +710,6 @@ if(COUCHBASE_CXX_CLIENT_BUILD_EXAMPLES)
   add_subdirectory(examples)
 endif()
 
-option(COUCHBASE_CXX_CLIENT_BUILD_TOOLS "Build tools" ${COUCHBASE_CXX_CLIENT_MASTER_PROJECT})
 if(COUCHBASE_CXX_CLIENT_BUILD_TOOLS)
   add_subdirectory(tools)
 endif()

data/ext/couchbase/cmake/APKBUILD.in

@@ -25,13 +25,15 @@ url="https://docs.couchbase.com/cxx-sdk/current/hello-world/overview.html"
 arch="all"
 license="Apache-2.0"
 depends=""
+# The -dev subpackage installs the static library's CMake config, which runs find_dependency(ZLIB);
+# a build dependency does not reach whoever installs that package, so zlib-dev is declared for it
+# here as it is in the RPM and Debian manifests.
+depends_dev="zlib-dev"
 makedepends="
 	linux-headers
 	cmake
 	ninja
-	curl-dev
-	protobuf-dev
-	grpc-dev
+	zlib-dev
 	nlohmann-json
 "
 subpackages="${pkgname}-dev ${pkgname}-tools"
@@ -49,6 +51,7 @@ build() {
 		-DCOUCHBASE_CXX_CLIENT_PKGCONFIG_VERSION="${pkgver}" \
 		-DCOUCHBASE_CXX_CLIENT_INSTALL=ON \
 		-DCOUCHBASE_CXX_CLIENT_STATIC_BORINGSSL=ON \
+		-DCOUCHBASE_CXX_CLIENT_PACKAGE_BUILD=ON \
 		-DCOUCHBASE_CXX_CLIENT_BUILD_EXAMPLES=OFF \
 		-DCOUCHBASE_CXX_CLIENT_BUILD_TESTS=OFF \
 		-DCOUCHBASE_CXX_CLIENT_BUILD_OPENTELEMETRY=ON \
@@ -60,11 +63,29 @@ build() {
 
 tools() {
 	pkgdesc="${pkgdesc} (tools)"
-	depends="${pkgname}=${pkgver}-r${pkgrel}"
 
 	amove usr/bin
+
+	# cbc no longer depends on the library package and carries the SDK and taocpp code inside the
+	# binary, so the notices for that code have to ship with it. Copied under this subpackage's own
+	# documentation directory rather than shared with the base package, which is what the Debian
+	# packaging has to do -- dpkg rejects two packages owning one path even when the contents match.
+	# Whether apk would tolerate sharing was not established; a private directory needs no answer.
+	local _doc="${subpkgdir}/usr/share/doc/${subpkgname}"
+	mkdir -p "${_doc}/tao/json" "${_doc}/tao/pegtl"
+	cp "${pkgdir}/usr/share/doc/couchbase_cxx_client/LICENSE.txt" "${_doc}/"
+	cp "${pkgdir}/usr/share/doc/tao/json/LICENSE" "${_doc}/tao/json/"
+	cp "${pkgdir}/usr/share/doc/tao/pegtl/LICENSE" "${_doc}/tao/pegtl/"
+	# And the notices for the vendored dependencies compiled into cbc, which the base package
+	# receives from the install step but this subpackage does not.
+	cp -r "${pkgdir}/usr/share/doc/couchbase_cxx_client/third_party" "${_doc}/"
 }
 
 package() {
 	DESTDIR="${pkgdir}" cmake --install apk-build
+	# The vendored gRPC and curl install their headers, archives and pkg-config files regardless of
+	# the options that are supposed to gate them; cmake/GrpcProtobuf.cmake and
+	# cmake/ThirdPartyDependencies.cmake redirect all of it under this one prefix so it can be
+	# dropped in a single step. Nothing packaged here comes from it.
+	rm -rf "${pkgdir}/usr/vendored-not-installed"
 }

data/ext/couchbase/cmake/Bundler.cmake

@@ -31,12 +31,24 @@ function(bundle_static_library tgt_name bundled_tgt_name)
   endfunction()
 
   function(_recursively_collect_dependencies input_target)
-    set(_input_link_libraries LINK_LIBRARIES)
+    # Both properties, not one. A concrete target's LINK_LIBRARIES holds what it links for itself,
+    # while INTERFACE_LINK_LIBRARIES holds what it imposes on whoever links IT -- and the second is
+    # exactly what a consumer of the installed archive inherits. cmake/DetectStandardFilesystem.cmake
+    # adds stdc++fs that way, so reading only the first would drop a library that is mandatory on
+    # older toolchains. An INTERFACE_LIBRARY has no LINK_LIBRARIES at all; get_target_property simply
+    # reports it absent and the loop below skips the sentinel.
+    set(public_dependencies)
     get_target_property(_input_type ${input_target} TYPE)
-    if(${_input_type} STREQUAL "INTERFACE_LIBRARY")
-      set(_input_link_libraries INTERFACE_LINK_LIBRARIES)
+    if(NOT ${_input_type} STREQUAL "INTERFACE_LIBRARY")
+      get_target_property(_own_dependencies ${input_target} LINK_LIBRARIES)
+      if(_own_dependencies)
+        list(APPEND public_dependencies ${_own_dependencies})
+      endif()
+    endif()
+    get_target_property(_interface_dependencies ${input_target} INTERFACE_LINK_LIBRARIES)
+    if(_interface_dependencies)
+      list(APPEND public_dependencies ${_interface_dependencies})
     endif()
-    get_target_property(public_dependencies ${input_target} ${_input_link_libraries})
     foreach(candidate IN LISTS public_dependencies)
       strip_build_interface("${candidate}" dependency)
       if(TARGET ${dependency})
@@ -47,32 +59,152 @@ function(bundle_static_library tgt_name bundled_tgt_name)
         get_target_property(_type ${dependency} TYPE)
         if(${_type} STREQUAL "STATIC_LIBRARY")
           list(APPEND static_libs ${dependency})
+        else()
+          get_target_property(_imported ${dependency} IMPORTED)
+          if(_type MATCHES "^(SHARED|MODULE|UNKNOWN)_LIBRARY$"
+             OR (_type STREQUAL "INTERFACE_LIBRARY" AND _imported))
+            # Its content stays outside the archive, so a consumer of the installed archive has to
+            # be told about it. Recorded, not archived.
+            #
+            # An IMPORTED interface library counts even though it contributes no objects: that is
+            # the shape pkg_check_modules(... IMPORTED_TARGET) produces, and dropping it would lose
+            # the link directories and options that come with it -- which is the whole reason
+            # cmake/OpenSSL.cmake falls back to pkg-config in the first place. An interface target
+            # defined in this build is a different thing: it carries headers, and whatever it links
+            # is reached by recursing through it.
+            #
+            # OBJECT libraries are never recorded: their objects are compiled straight into the
+            # target being archived.
+            list(APPEND external_libs ${dependency})
+          endif()
         endif()
 
+        # Recurse into targets this build defines, and stop at imported ones.
+        #
+        # An imported target describes something already built elsewhere: whatever it needs comes
+        # back with it when the consumer calls find_dependency on the package that defines it, so
+        # naming its interface piecemeal adds nothing. Descending into one is actively harmful --
+        # the platform's gRPC drags in around a hundred and seventy absl:: interface targets, none
+        # of which a consumer has to name because linking gRPC::grpc++ supplies them all.
+        # An imported STATIC library is the exception: it gets archived like any other, so whatever
+        # it needs is now inside the bundle and its interface still has to be walked. Only imported
+        # targets that stay OUTSIDE the archive are left unexplored.
+        get_target_property(_dependency_imported ${dependency} IMPORTED)
+        if(_type STREQUAL "STATIC_LIBRARY")
+          set(_dependency_imported FALSE)
+        endif()
         get_property(library_already_added GLOBAL PROPERTY _${tgt_name}_static_bundle_${dependency})
-        if(NOT library_already_added)
+        if(NOT library_already_added AND NOT _dependency_imported)
           set_property(GLOBAL PROPERTY _${tgt_name}_static_bundle_${dependency} ON)
           _recursively_collect_dependencies(${dependency})
         endif()
+      elseif(dependency
+             AND NOT dependency MATCHES "NOTFOUND$"
+             AND NOT dependency MATCHES "^\\$<"
+             AND NOT dependency MATCHES "^-[^l]")
+        # A plain link item rather than a target -- bcrypt.lib, iphlpapi, m, rt, or an absolute path
+        # from find_library. These are exactly the dependencies that were repeatedly missed when the
+        # installed interface was maintained by hand, because they are contributed from wherever the
+        # subdirectory that needs them happens to be.
+        #
+        # Two things are not link items and are skipped: a generator expression, which cannot be
+        # evaluated here, and the "<var>-NOTFOUND" sentinel get_target_property returns for a target
+        # that has no link property at all, which would otherwise be published verbatim as
+        # -lpublic_dependencies-NOTFOUND.
+        list(APPEND external_libs ${dependency})
+      elseif(dependency MATCHES "^-[^l]")
+        # A link OPTION rather than a library -- enable_sanitizers() adds -fsanitize=... PUBLIC, and
+        # an archive built with it carries references into the sanitizer runtime that a consumer's
+        # link line must repeat. Kept apart from the libraries because the two are published
+        # differently: options as INTERFACE_LINK_OPTIONS and raw entries in Libs.private, libraries
+        # as -l names.
+        list(APPEND external_opts ${dependency})
       endif()
     endforeach()
     set(static_libs
         ${static_libs}
         PARENT_SCOPE)
+    set(external_libs
+        ${external_libs}
+        PARENT_SCOPE)
+    set(external_opts
+        ${external_opts}
+        PARENT_SCOPE)
   endfunction()
 
   _recursively_collect_dependencies(${tgt_name})
 
   list(REMOVE_DUPLICATES static_libs)
+  if(external_libs)
+    list(REMOVE_DUPLICATES external_libs)
+  endif()
+  if(external_opts)
+    list(REMOVE_DUPLICATES external_opts)
+  endif()
+  # Published for cmake/Packaging.cmake, which turns it into the installed target's link interface
+  # and its pkg-config Libs.private, and warns about anything it does not already name.
+  set_property(GLOBAL PROPERTY ${bundled_tgt_name}_EXTERNAL_LIBS "${external_libs}")
+  set_property(GLOBAL PROPERTY ${bundled_tgt_name}_EXTERNAL_OPTS "${external_opts}")
 
   set(bundled_tgt_full_name
       ${CMAKE_BINARY_DIR}/${CMAKE_STATIC_LIBRARY_PREFIX}${bundled_tgt_name}${CMAKE_STATIC_LIBRARY_SUFFIX})
 
-  if(CMAKE_CXX_COMPILER_ID MATCHES "^(Clang|GNU)$")
+  # Selected on the platform before the compiler, because what matters here is which ar is on PATH,
+  # not who compiled the objects. Apple's ar comes from cctools and has no MRI mode -- no -M, no
+  # ADDLIB -- so on macOS the archives are unpacked and re-archived instead. Keying that branch on
+  # AppleClang alone left the MRI path selected for a macOS build driven by any other Clang, a
+  # Homebrew or MacPorts LLVM among them, where it cannot work.
+  if(APPLE)
+    find_program(find NAMES find REQUIRED)
+
+    set(AR_EXTRACT_DIR "${CMAKE_CURRENT_BINARY_DIR}/tmp_ar_extract")
+    set(EXTRACT_COMMANDS "")
+    foreach(tgt IN LISTS static_libs)
+      list(
+        APPEND EXTRACT_COMMANDS
+        COMMAND ${CMAKE_COMMAND} -E make_directory ${AR_EXTRACT_DIR}/${tgt}
+        COMMAND ${CMAKE_COMMAND} -E chdir ${AR_EXTRACT_DIR}/${tgt} ${CMAKE_AR} -x $<TARGET_FILE:${tgt}>)
+    endforeach()
+
+    add_custom_command(
+      OUTPUT ${bundled_tgt_full_name}
+      COMMAND ${CMAKE_COMMAND} -E rm -rf ${AR_EXTRACT_DIR}
+      COMMAND ${CMAKE_COMMAND} -E make_directory ${AR_EXTRACT_DIR} ${EXTRACT_COMMANDS}
+      COMMAND ${find} ${AR_EXTRACT_DIR} -name *.o -exec ${CMAKE_AR} -rcs ${bundled_tgt_full_name} {} +
+      COMMAND ${CMAKE_AR} -s ${bundled_tgt_full_name}
+      COMMAND ${CMAKE_COMMAND} -E rm -rf ${AR_EXTRACT_DIR}
+      DEPENDS ${tgt_name} ${static_libs}
+      COMMENT "Bundling ${bundled_tgt_name}"
+      VERBATIM)
+  elseif(CMAKE_CXX_COMPILER_ID MATCHES "^(Clang|GNU)$")
     file(WRITE ${CMAKE_BINARY_DIR}/${bundled_tgt_name}.ar.in "CREATE ${bundled_tgt_full_name}\n")
 
+    # GNU ar's MRI lexer does not accept '+' in a filename. binutils 2.35 (EL9) reads
+    # "ADDLIB .../libgrpc++.a" as the file ".../libgrpc" followed by the stray token "++" and fails
+    # with "libgrpc: No such file or directory"; 2.47 accepts it, so this only shows up on older
+    # toolchains. gRPC contributes libgrpc++.a and several siblings, so any archive whose name
+    # carries a '+' is staged under a '+'-free name just before ar runs. MRI needs nothing of that
+    # path but the name, so how it gets there does not matter -- except on Windows, which this
+    # branch also covers through MinGW, and where creating a symlink needs a privilege an ordinary
+    # account does not hold. Copy there and link everywhere else.
+    set(_bundle_staging ${CMAKE_BINARY_DIR}/bundle_staging)
+    set(_bundle_stage_commands COMMAND ${CMAKE_COMMAND} -E make_directory ${_bundle_staging})
+    if(WIN32)
+      set(_bundle_stage_verb copy)
+    else()
+      set(_bundle_stage_verb create_symlink)
+    endif()
+
     foreach(tgt IN LISTS static_libs)
-      file(APPEND ${CMAKE_BINARY_DIR}/${bundled_tgt_name}.ar.in "ADDLIB $<TARGET_FILE:${tgt}>\n")
+      if(tgt MATCHES "\\+")
+        string(REPLACE "+" "_plus" _bundle_safe_name "${tgt}")
+        set(_bundle_staged_lib "${_bundle_staging}/lib${_bundle_safe_name}.a")
+        list(APPEND _bundle_stage_commands COMMAND ${CMAKE_COMMAND} -E ${_bundle_stage_verb}
+             $<TARGET_FILE:${tgt}> ${_bundle_staged_lib})
+        file(APPEND ${CMAKE_BINARY_DIR}/${bundled_tgt_name}.ar.in "ADDLIB ${_bundle_staged_lib}\n")
+      else()
+        file(APPEND ${CMAKE_BINARY_DIR}/${bundled_tgt_name}.ar.in "ADDLIB $<TARGET_FILE:${tgt}>\n")
+      endif()
     endforeach()
 
     file(APPEND ${CMAKE_BINARY_DIR}/${bundled_tgt_name}.ar.in "SAVE\n")
@@ -88,13 +220,12 @@ function(bundle_static_library tgt_name bundled_tgt_name)
       set(ar_tool ${CMAKE_CXX_COMPILER_AR})
     endif()
 
-    if(APPLE)
-      find_program(SED gsed)
-    else()
-      find_program(SED sed)
-    endif()
+    # GNU sed: -i takes no argument here. macOS never reaches this branch, so the BSD sed that
+    # needed gsed is out of scope.
+    find_program(SED sed REQUIRED)
 
     add_custom_command(
+      ${_bundle_stage_commands}
       COMMAND ${SED} -i "s|${CMAKE_BINARY_DIR}/||g" ${bundled_tgt_name}.ar
       COMMAND ${ar_tool} -M < ${bundled_tgt_name}.ar
       OUTPUT ${bundled_tgt_full_name}
@@ -102,28 +233,6 @@ function(bundle_static_library tgt_name bundled_tgt_name)
       WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
       COMMENT "Bundling ${bundled_tgt_name}"
       VERBATIM)
-  elseif(CMAKE_CXX_COMPILER_ID STREQUAL "AppleClang")
-    find_program(find NAMES find REQUIRED)
-
-    set(AR_EXTRACT_DIR "${CMAKE_CURRENT_BINARY_DIR}/tmp_ar_extract")
-    set(EXTRACT_COMMANDS "")
-    foreach(tgt IN LISTS static_libs)
-      list(
-        APPEND EXTRACT_COMMANDS
-        COMMAND ${CMAKE_COMMAND} -E make_directory ${AR_EXTRACT_DIR}/${tgt}
-        COMMAND ${CMAKE_COMMAND} -E chdir ${AR_EXTRACT_DIR}/${tgt} ${CMAKE_AR} -x $<TARGET_FILE:${tgt}>)
-    endforeach()
-
-    add_custom_command(
-      OUTPUT ${bundled_tgt_full_name}
-      COMMAND ${CMAKE_COMMAND} -E rm -rf ${AR_EXTRACT_DIR}
-      COMMAND ${CMAKE_COMMAND} -E make_directory ${AR_EXTRACT_DIR} ${EXTRACT_COMMANDS}
-      COMMAND ${find} ${AR_EXTRACT_DIR} -name *.o -exec ${CMAKE_AR} -rcs ${bundled_tgt_full_name} {} +
-      COMMAND ${CMAKE_AR} -s ${bundled_tgt_full_name}
-      COMMAND ${CMAKE_COMMAND} -E rm -rf ${AR_EXTRACT_DIR}
-      DEPENDS ${tgt_name} ${static_libs}
-      COMMENT "Bundling ${bundled_tgt_name}"
-      VERBATIM)
   elseif(MSVC)
     get_filename_component(LINKER_DIR "${CMAKE_LINKER}" DIRECTORY)
     find_program(