fix release workflow

PiperOrigin-RevId: 822073417

.github/workflows/build_test.yml

@@ -6,12 +6,16 @@
 # Workflow for building and running tests under Ubuntu
 
 name: Build/Test
+
 on:
   push:
     branches:
       - master
   pull_request:
-    types: [opened, reopened, labeled, synchronize]
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
@@ -28,18 +32,36 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          - name: cmake:gcc
+            build_system: cmake
+            c_compiler: gcc
+            cxx_compiler: g++
+
           - name: cmake:gcc-old
             build_system: cmake
             c_compiler: gcc
             cxx_compiler: g++
             os: ubuntu-22.04
 
+          - name: cmake:clang
+            build_system: cmake
+            c_compiler: clang
+            cxx_compiler: clang
+
           - name: cmake:clang-old
             build_system: cmake
             c_compiler: clang
             cxx_compiler: clang
             os: ubuntu-22.04
 
+          - name: cmake:package
+            build_system: cmake
+            cmake_args: -DBROTLI_BUILD_FOR_PACKAGE=ON
+
+          - name: cmake:static
+            build_system: cmake
+            cmake_args: -DBUILD_SHARED_LIBS=OFF
+
           - name: cmake:clang:asan
             build_system: cmake
             sanitizer: address
@@ -174,6 +196,12 @@ jobs:
       CXX: ${{ matrix.cxx_compiler || 'gcc' }}
 
     steps:
+
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Install extra deps @ Ubuntu
       if: ${{ runner.os == 'Linux' }}
       # Already installed: bazel, clang{13-15}, cmake, gcc{9.5-13.1}, java{8,11,17,21}, maven, python{3.10}
@@ -183,7 +211,7 @@ jobs:
         sudo apt install -y ${EXTRA_PACKAGES}
 
     - name: Checkout the source
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: false
         fetch-depth: 1
@@ -192,7 +220,7 @@ jobs:
       if: ${{ matrix.build_system == 'cmake' }}
       run: |
         export ASAN_OPTIONS=detect_leaks=0
-        declare -a CMAKE_OPTIONS=()
+        declare -a CMAKE_OPTIONS=(${{ matrix.cmake_args || '' }})
         CMAKE_OPTIONS+=("-DCMAKE_VERBOSE_MAKEFILE=ON")
         [ ! -z '${{ matrix.c_compiler || '' }}' ] && CMAKE_OPTIONS+=(-DCMAKE_C_COMPILER='${{ matrix.c_compiler }}')
         [ ! -z '${{ matrix.cxx_compiler || '' }}' ] && CMAKE_OPTIONS+=(-DCMAKE_CXX_COMPILER='${{ matrix.cxx_compiler }}')
@@ -287,11 +315,13 @@ jobs:
       with:
         python-version: ${{ matrix.python_version }}
 
+     # TODO(eustas): use modern setuptools (split out testing)
     - name: Build / Test with Python
       if: ${{ matrix.build_system == 'python' }}
       run: |
         python -VV
         python -c "import sys; sys.exit('Invalid python version') if '.'.join(map(str,sys.version_info[0:2])) != '${{ matrix.python_version }}' else True"
+        pip install setuptools==51.3.3
         python setup.py ${{ matrix.py_setuptools_cmd || 'test'}}
 
   build_test_py27:
@@ -301,6 +331,11 @@ jobs:
       image: ubuntu:22.04
     steps:
 
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Install deps
       run: |
         apt update
@@ -310,7 +345,7 @@ jobs:
         python2.7 -m pip install distutils-pytest==0.1
 
     - name: Checkout the source
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: false
         fetch-depth: 1

.github/workflows/build_test_wasm.yml

@@ -0,0 +1,70 @@
+# Copyright 2025 Google Inc. All Rights Reserved.
+#
+# Distributed under MIT license.
+# See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+
+# Workflow for building and running tests with WASM
+
+name: Build/Test WASM
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  build_test_wasm:
+    name: Build and test with WASM
+    runs-on: ubuntu-latest
+    env:
+      CCACHE_DIR: ${{ github.workspace }}/.ccache
+      BUILD_TARGET: wasm32
+      EM_VERSION: 3.1.51
+      # As of 28.08.2025 ubuntu-latest is 24.04; it is shipped with node 22.18
+      NODE_VERSION: 22
+
+    steps:
+
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: true
+        fetch-depth: 1
+
+    - name: Install node
+      uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+      with:
+        node-version: ${{env.NODE_VERSION}}
+
+    - name: Get non-EMSDK node path
+      run: which node >> $HOME/.base_node_path
+
+    - name: Install emsdk
+      uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
+      with:
+        version: ${{env.EM_VERSION}}
+        no-cache: true
+
+    - name: Set EMSDK node version
+      run: |
+        echo "NODE_JS='$(cat $HOME/.base_node_path)'" >> $EMSDK/.emscripten
+        emsdk construct_env
+
+    - name: Build
+      run: |
+        LDFLAGS=" -s ALLOW_MEMORY_GROWTH=1 -s NODERAWFS=1 " emcmake cmake -B out .
+        cmake --build out
+        cd out; ctest --output-on-failure; cd ..

.github/workflows/codeql.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '18 15 * * 0'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -30,12 +33,18 @@ jobs:
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
 
     steps:
+
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Checkout repository
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@43750fe4fc4f068f04f2215206e6f6a29c78c763 # v2.14.4
+      uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v3.29.5
       with:
         languages: ${{ matrix.language }}
         # CodeQL is currently crashing on files with large lists:
@@ -47,7 +56,7 @@ jobs:
 
     - if: matrix.language == 'cpp'
       name: Build CPP
-      uses: github/codeql-action/autobuild@43750fe4fc4f068f04f2215206e6f6a29c78c763 # v2.14.4
+      uses: github/codeql-action/autobuild@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v3.29.5
 
     - if: matrix.language == 'cpp' || matrix.language == 'java'
       name: Build Java
@@ -57,7 +66,7 @@ jobs:
 
     - if: matrix.language == 'javascript'
       name: Build JS
-      uses: github/codeql-action/autobuild@43750fe4fc4f068f04f2215206e6f6a29c78c763 # v2.14.4
+      uses: github/codeql-action/autobuild@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v3.29.5
 
     - if: matrix.language == 'cpp' || matrix.language == 'python'
       name: Build Python
@@ -65,7 +74,7 @@ jobs:
         python setup.py build_ext
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@43750fe4fc4f068f04f2215206e6f6a29c78c763 # v2.14.4
+      uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v3.29.5
       with:
         category: "/language:${{matrix.language}}"
         ref: "${{ github.ref != 'master' && github.ref || '/refs/heads/master' }}"

.github/workflows/fuzz.yml

@@ -6,8 +6,12 @@
 # Workflow for building / running oss-fuzz.
 
 name: CIFuzz
+
 on: [pull_request]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -16,17 +20,25 @@ jobs:
   Fuzzing:
     runs-on: ubuntu-latest
     steps:
+
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Build Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@3e6a7fd7bcd631647ab9beed1fe0897498e6af39 # 22.09.2025
       with:
         oss-fuzz-project-name: 'brotli'
         dry-run: false
+
     - name: Run Fuzzers
-      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@3e6a7fd7bcd631647ab9beed1fe0897498e6af39 # 22.09.2025
       with:
         oss-fuzz-project-name: 'brotli'
         fuzz-seconds: 600
         dry-run: false
+
     - name: Upload Crash
       uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       if: failure()

.github/workflows/lint.yml

@@ -1,3 +1,10 @@
+# Copyright 2025 Google Inc. All Rights Reserved.
+#
+# Distributed under MIT license.
+# See file LICENSE for detail or copy at https://opensource.org/licenses/MIT
+
+# Workflow for checking typos and buildifier, formatting, etc.
+
 name: "Lint"
 
 on:
@@ -8,6 +15,9 @@ on:
   schedule:
     - cron: '18 15 * * 0'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -18,8 +28,14 @@ jobs:
     runs-on: 'ubuntu-latest'
 
     steps:
+
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Checkout repository
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Install tools
       run: |

.github/workflows/release.yaml

@@ -14,7 +14,10 @@ on:
   release:
     types: [ published ]
   pull_request:
-    types: [opened, reopened, labeled, synchronize]
+    types: [opened, reopened, labeled, unlabeled, synchronize]
+
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
@@ -59,8 +62,14 @@ jobs:
       VCPKG_DISABLE_METRICS: 1
 
     steps:
+
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Checkout the source
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: false
         fetch-depth: 1
@@ -76,7 +85,7 @@ jobs:
       shell: 'powershell'
       run: |
         Invoke-WebRequest -Uri "https://github.com/microsoft/vcpkg/archive/refs/tags/${{ env.VCPKG_VERSION }}.zip" -OutFile "vcpkg.zip"
-        
+
     - name: Bootstrap vcpkg
       if: steps.cache-vcpkg.outputs.cache-hit != 'true'
       shell: 'bash'
@@ -100,23 +109,19 @@ jobs:
           -DCMAKE_TOOLCHAIN_FILE=${VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake \
           -DVCPKG_TARGET_TRIPLET=${{ matrix.triplet }} \
         #
+
     - name: Build
       shell: 'bash'
       run: |
         set -x
         cmake --build out --config Release
+
     - name: Install
       shell: 'bash'
       run: |
         set -x
         cmake --build out --config Release --target install
         cp LICENSE prefix/bin/LICENSE.brotli
-    - name: Upload artifacts
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-      with:
-        name: brotli-${{matrix.triplet}}
-        path: |
-          prefix/bin/*
 
     - name: Package release zip
       shell: 'powershell'
@@ -124,11 +129,12 @@ jobs:
         Compress-Archive -Path prefix\bin\* `
           -DestinationPath brotli-${{matrix.triplet}}.zip
 
-    - name: Upload binaries to release
-      if: github.event_name == 'release'
-      uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836 # v0.1.15
+    - name: Upload package
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
-        files: brotli-${{matrix.triplet}}.zip
+        name: brotli-${{matrix.triplet}}
+        path: brotli-${{matrix.triplet}}.zip
+        compression-level: 0
 
   testdata_upload:
     name: Upload testdata
@@ -138,8 +144,13 @@ jobs:
         shell: bash
     steps:
 
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Checkout the source
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: false
         fetch-depth: 1
@@ -148,14 +159,42 @@ jobs:
       run: |
         tar cvfJ testdata.txz tests/testdata
 
-    - name: Upload archive to release
-      if: github.event_name == 'release'
-      uses: softprops/action-gh-release@6cbd405e2c4e67a21c47fa9e383d020e4e28b836 # v0.1.15
+    - name: Upload archive
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
-        files: testdata.txz
+        name: testdata
+        path: testdata.txz
+        compression-level: 0
+
+  publish_release_assets:
+    name: Publish release assets
+    needs: [windows_build, testdata_upload]
+    if: github.event_name == 'release'
+    runs-on: [ubuntu-latest]
+    permissions:
+      contents: write
+
+    steps:
+    - name: Checkout the source
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        submodules: false
+        fetch-depth: 1
+
+    - name: Download all artifacts
+      uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+      with:
+        path: release_assets
+        merge-multiple: true
+
+    - name: Publish assets
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh release upload ${{ github.event.release.tag_name }} ./release_assets/*
 
   archive_build:
-    needs: testdata_upload
+    needs: publish_release_assets
     name: Build and test from archive
     runs-on: 'ubuntu-latest'
     defaults:
@@ -163,8 +202,13 @@ jobs:
         shell: bash
     steps:
 
+    - name: Harden Runner
+      uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+      with:
+        egress-policy: audit
+
     - name: Checkout the source
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         submodules: false
         fetch-depth: 1

.github/workflows/scorecard.yml

@@ -3,6 +3,7 @@
 # policy, and support documentation.
 
 name: Scorecard supply-chain security
+
 on:
   # For Branch-Protection check. Only the default branch is supported. See
   # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
@@ -14,13 +15,13 @@ on:
   push:
     branches: [ "master" ]
 
+# Declare default permissions as read only.
+permissions: read-all
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
-# Declare default permissions as read only.
-permissions: read-all
-
 jobs:
   analysis:
     name: Scorecard analysis
@@ -35,13 +36,18 @@ jobs:
       # actions: read
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
       - name: "Checkout code"
-        uses: actions/checkout@v4 # v3.1.0
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -71,6 +77,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
+        uses: github/codeql-action/upload-sarif@17783bfb99b07f70fae080b654aed0c514057477 # v2.23.3
         with:
           sarif_file: results.sarif

CMakeLists.txt

@@ -10,11 +10,8 @@ cmake_minimum_required(VERSION 3.15)
 cmake_policy(SET CMP0048 NEW)
 project(brotli C)
 
-option(BUILD_SHARED_LIBS "Build shared libraries" ON)
-set(BROTLI_BUILD_TOOLS ON CACHE BOOL "Build/install CLI tools")
-
-if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
-  message(STATUS "Setting build type to Release as none was specified.")
+if (NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
+  message(STATUS "Setting build type to Release as none was specified")
   set(CMAKE_BUILD_TYPE "Release" CACHE STRING "Choose the type of build" FORCE)
 else()
   message(STATUS "Build type is '${CMAKE_BUILD_TYPE}'")
@@ -33,20 +30,34 @@ else()
   message("-- Compiler is not EMSCRIPTEN")
 endif()
 
+if (BROTLI_EMSCRIPTEN)
+  message(STATUS "Switching to static build for EMSCRIPTEN")
+  set(BUILD_SHARED_LIBS OFF)
+endif()
+
+# Reflect CMake variable as a build option.
+option(BUILD_SHARED_LIBS "Build shared libraries" ON)
+set(BROTLI_BUILD_TOOLS ON CACHE BOOL "Build/install CLI tools")
+set(BROTLI_BUILD_FOR_PACKAGE OFF CACHE BOOL "Build/install both shared and static libraries")
+
+if (BROTLI_BUILD_FOR_PACKAGE AND NOT BUILD_SHARED_LIBS)
+  message(FATAL_ERROR "Both BROTLI_BUILD_FOR_PACKAGE and BUILD_SHARED_LIBS are set")
+endif()
+
 # If Brotli is being bundled in another project, we don't want to
 # install anything.  However, we want to let people override this, so
 # we'll use the BROTLI_BUNDLED_MODE variable to let them do that; just
 # set it to OFF in your project before you add_subdirectory(brotli).
 get_directory_property(BROTLI_PARENT_DIRECTORY PARENT_DIRECTORY)
-if(NOT DEFINED BROTLI_BUNDLED_MODE)
+if (NOT DEFINED BROTLI_BUNDLED_MODE)
   # Bundled mode hasn't been set one way or the other, set the default
   # depending on whether or not we are the top-level project.
-  if(BROTLI_PARENT_DIRECTORY)
+  if (BROTLI_PARENT_DIRECTORY)
     set(BROTLI_BUNDLED_MODE ON)
   else()
     set(BROTLI_BUNDLED_MODE OFF)
   endif()
-endif()
+endif()  # BROTLI_BUNDLED_MODE
 mark_as_advanced(BROTLI_BUNDLED_MODE)
 
 include(GNUInstallDirs)
@@ -80,66 +91,79 @@ endif ()
 
 include(CheckLibraryExists)
 set(LIBM_LIBRARY)
+set(LIBM_DEP)
 CHECK_LIBRARY_EXISTS(m log2 "" HAVE_LIB_M)
-if(HAVE_LIB_M)
+if (HAVE_LIB_M)
   set(LIBM_LIBRARY "m")
+  if (NOT BUILD_SHARED_LIBS)
+    set(LIBM_DEP "-lm")
+  endif()
 endif()
 
 set(BROTLI_INCLUDE_DIRS "${CMAKE_CURRENT_SOURCE_DIR}/c/include")
 mark_as_advanced(BROTLI_INCLUDE_DIRS)
 
-set(BROTLI_LIBRARIES_CORE brotlienc brotlidec brotlicommon)
-set(BROTLI_LIBRARIES ${BROTLI_LIBRARIES_CORE} ${LIBM_LIBRARY})
+if (BROTLI_BUILD_FOR_PACKAGE)
+  set(BROTLI_SHARED_LIBRARIES brotlienc brotlidec brotlicommon)
+  set(BROTLI_STATIC_LIBRARIES brotlienc-static brotlidec-static brotlicommon-static)
+  set(BROTLI_LIBRARIES ${BROTLI_SHARED_LIBRARIES} ${LIBM_LIBRARY})
+else()  # NOT BROTLI_BUILD_FOR_PACKAGE
+  if (BUILD_SHARED_LIBS)
+    set(BROTLI_SHARED_LIBRARIES brotlienc brotlidec brotlicommon)
+    set(BROTLI_STATIC_LIBRARIES)
+  else()  # NOT BUILD_SHARED_LIBS
+    set(BROTLI_SHARED_LIBRARIES)
+    set(BROTLI_STATIC_LIBRARIES brotlienc brotlidec brotlicommon)
+  endif()
+  set(BROTLI_LIBRARIES ${BROTLI_SHARED_LIBRARIES} ${BROTLI_STATIC_LIBRARIES} ${LIBM_LIBRARY})
+endif()  # BROTLI_BUILD_FOR_PACKAGE
 mark_as_advanced(BROTLI_LIBRARIES)
 
-if(${CMAKE_SYSTEM_NAME} MATCHES "Linux")
-  add_definitions(-DOS_LINUX)
-elseif(${CMAKE_SYSTEM_NAME} MATCHES "FreeBSD")
-  add_definitions(-DOS_FREEBSD)
-elseif(${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
-  add_definitions(-DOS_MACOSX)
-endif()
+if (MSVC)
+  message(STATUS "Defining _CRT_SECURE_NO_WARNINGS to avoid warnings about security")
 
-if(BROTLI_EMSCRIPTEN)
-  set(BUILD_SHARED_LIBS OFF)
+  add_definitions(-D_CRT_SECURE_NO_WARNINGS)
 endif()
 
 file(GLOB_RECURSE BROTLI_COMMON_SOURCES RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} c/common/*.c)
-add_library(brotlicommon ${BROTLI_COMMON_SOURCES})
-
 file(GLOB_RECURSE BROTLI_DEC_SOURCES RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} c/dec/*.c)
-add_library(brotlidec ${BROTLI_DEC_SOURCES})
-
 file(GLOB_RECURSE BROTLI_ENC_SOURCES RELATIVE ${CMAKE_CURRENT_SOURCE_DIR} c/enc/*.c)
+
+add_library(brotlicommon ${BROTLI_COMMON_SOURCES})
+add_library(brotlidec ${BROTLI_DEC_SOURCES})
 add_library(brotlienc ${BROTLI_ENC_SOURCES})
 
+if (BROTLI_BUILD_FOR_PACKAGE)
+  add_library(brotlicommon-static STATIC ${BROTLI_COMMON_SOURCES})
+  add_library(brotlidec-static STATIC ${BROTLI_DEC_SOURCES})
+  add_library(brotlienc-static STATIC ${BROTLI_ENC_SOURCES})
+endif()
+
 # Older CMake versions does not understand INCLUDE_DIRECTORIES property.
 include_directories(${BROTLI_INCLUDE_DIRS})
 
-if(BUILD_SHARED_LIBS)
-  foreach(lib ${BROTLI_LIBRARIES_CORE})
+if (BUILD_SHARED_LIBS)
+  foreach(lib ${BROTLI_SHARED_LIBRARIES})
     target_compile_definitions(${lib} PUBLIC "BROTLI_SHARED_COMPILATION" )
     string(TOUPPER "${lib}" LIB)
     set_target_properties (${lib} PROPERTIES DEFINE_SYMBOL "${LIB}_SHARED_COMPILATION")
   endforeach()
-endif()
+endif()  # BUILD_SHARED_LIBS
 
-foreach(lib ${BROTLI_LIBRARIES_CORE})
+foreach(lib ${BROTLI_SHARED_LIBRARIES} ${BROTLI_STATIC_LIBRARIES})
   target_link_libraries(${lib} ${LIBM_LIBRARY})
   set_property(TARGET ${lib} APPEND PROPERTY INCLUDE_DIRECTORIES ${BROTLI_INCLUDE_DIRS})
   set_target_properties(${lib} PROPERTIES
     VERSION "${BROTLI_ABI_COMPATIBILITY}.${BROTLI_ABI_AGE}.${BROTLI_ABI_REVISION}"
     SOVERSION "${BROTLI_ABI_COMPATIBILITY}")
-  if(NOT BROTLI_EMSCRIPTEN)
+  if (NOT BROTLI_EMSCRIPTEN)
     set_target_properties(${lib} PROPERTIES POSITION_INDEPENDENT_CODE TRUE)
   endif()
   set_property(TARGET ${lib} APPEND PROPERTY INTERFACE_INCLUDE_DIRECTORIES "$<BUILD_INTERFACE:${BROTLI_INCLUDE_DIRS}>")
-endforeach()
+endforeach()  # BROTLI_xxx_LIBRARIES
 
-if(NOT BROTLI_EMSCRIPTEN)
-  target_link_libraries(brotlidec brotlicommon)
-  target_link_libraries(brotlienc brotlicommon)
-endif()
+target_link_libraries(brotlidec brotlicommon)
+target_link_libraries(brotlienc brotlicommon)
 
 # For projects stuck on older versions of CMake, this will set the
 # BROTLI_INCLUDE_DIRS and BROTLI_LIBRARIES variables so they still
@@ -147,19 +171,19 @@ endif()
 #
 #   include_directories(${BROTLI_INCLUDE_DIRS})
 #   target_link_libraries(foo ${BROTLI_LIBRARIES})
-if(BROTLI_PARENT_DIRECTORY)
+if (BROTLI_PARENT_DIRECTORY)
   set(BROTLI_INCLUDE_DIRS "${BROTLI_INCLUDE_DIRS}" PARENT_SCOPE)
   set(BROTLI_LIBRARIES "${BROTLI_LIBRARIES}" PARENT_SCOPE)
 endif()
 
 # Build the brotli executable
-if(BROTLI_BUILD_TOOLS)
+if (BROTLI_BUILD_TOOLS)
   add_executable(brotli c/tools/brotli.c)
   target_link_libraries(brotli ${BROTLI_LIBRARIES})
 endif()
 
 # Installation
-if(NOT BROTLI_BUNDLED_MODE)
+if (NOT BROTLI_BUNDLED_MODE)
   if (BROTLI_BUILD_TOOLS)
     install(
       TARGETS brotli
@@ -168,7 +192,7 @@ if(NOT BROTLI_BUNDLED_MODE)
   endif()
 
   install(
-    TARGETS ${BROTLI_LIBRARIES_CORE}
+    TARGETS ${BROTLI_SHARED_LIBRARIES} ${BROTLI_STATIC_LIBRARIES}
     ARCHIVE DESTINATION "${CMAKE_INSTALL_LIBDIR}"
     LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}"
     RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}"
@@ -183,17 +207,28 @@ endif()  # BROTLI_BUNDLED_MODE
 # Tests
 
 # Integration tests, those depend on `brotli` binary
-if(NOT BROTLI_DISABLE_TESTS AND BROTLI_BUILD_TOOLS)
+if (NOT BROTLI_DISABLE_TESTS AND BROTLI_BUILD_TOOLS)
   # If we're targeting Windows but not running on Windows, we need Wine
   # to run the tests...
-  if(WIN32 AND NOT CMAKE_HOST_WIN32)
+  if (WIN32 AND NOT CMAKE_HOST_WIN32)
     find_program(BROTLI_WRAPPER NAMES wine)
 
-    if(NOT BROTLI_WRAPPER)
+    if (NOT BROTLI_WRAPPER)
       message(STATUS "wine not found, disabling tests")
       set(BROTLI_DISABLE_TESTS TRUE)
     endif()
-  endif()
+  endif()  # WIN32 emulation
+  if (BROTLI_EMSCRIPTEN)
+    find_program(BROTLI_WRAPPER NAMES node)
+    if (NOT BROTLI_WRAPPER)
+      message(STATUS "node not found, disabling tests")
+      set(BROTLI_DISABLE_TESTS TRUE)
+    endif()
+  endif()  # BROTLI_EMSCRIPTEN
+endif()  # BROTLI_DISABLE_TESTS
+
+# NB: BROTLI_DISABLE_TESTS might have changed.
+if (NOT BROTLI_DISABLE_TESTS AND BROTLI_BUILD_TOOLS)
   # If our compiler is a cross-compiler that we know about (arm/aarch64),
   # then we need to use qemu to execute the tests.
   if ("${CMAKE_C_COMPILER}" MATCHES "^.*/arm-linux-gnueabihf-.*$")
@@ -286,19 +321,19 @@ function(generate_pkg_config_path outvar path)
     get_filename_component(value_full "${value}" ABSOLUTE)
     string(LENGTH "${value}" value_length)
 
-    if(path_length EQUAL value_length AND path STREQUAL value)
+    if (path_length EQUAL value_length AND path STREQUAL value)
       set("${outvar}" "\${${name}}")
       break()
-    elseif(path_length GREATER value_length)
+    elseif (path_length GREATER value_length)
       # We might be in a subdirectory of the value, but we have to be
       # careful about a prefix matching but not being a subdirectory
       # (for example, /usr/lib64 is not a subdirectory of /usr/lib).
       # We'll do this by making sure the next character is a directory
       # separator.
       string(SUBSTRING "${path}" ${value_length} 1 sep)
-      if(sep STREQUAL "/")
+      if (sep STREQUAL "/")
         string(SUBSTRING "${path}" 0 ${value_length} s)
-        if(s STREQUAL value)
+        if (s STREQUAL value)
           string(SUBSTRING "${path}" "${value_length}" -1 suffix)
           set("${outvar}" "\${${name}}${suffix}")
           break()
@@ -319,6 +354,7 @@ function(transform_pc_file INPUT_FILE OUTPUT_FILE VERSION)
   set(PREFIX "${CMAKE_INSTALL_PREFIX}")
   string(REGEX REPLACE "@prefix@" "${PREFIX}" TEXT ${TEXT})
   string(REGEX REPLACE "@exec_prefix@" "${PREFIX}" TEXT ${TEXT})
+  string(REGEX REPLACE "@libm@" "${LIBM_DEP}" TEXT ${TEXT})
 
   generate_pkg_config_path(LIBDIR "${CMAKE_INSTALL_FULL_LIBDIR}" prefix "${PREFIX}")
   string(REGEX REPLACE "@libdir@" "${LIBDIR}" TEXT ${TEXT})
@@ -337,7 +373,7 @@ transform_pc_file("scripts/libbrotlidec.pc.in" "${CMAKE_CURRENT_BINARY_DIR}/libb
 
 transform_pc_file("scripts/libbrotlienc.pc.in" "${CMAKE_CURRENT_BINARY_DIR}/libbrotlienc.pc" "${BROTLI_VERSION}")
 
-if(NOT BROTLI_BUNDLED_MODE)
+if (NOT BROTLI_BUNDLED_MODE)
   install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libbrotlicommon.pc"
     DESTINATION "${CMAKE_INSTALL_LIBDIR}/pkgconfig")
   install(FILES "${CMAKE_CURRENT_BINARY_DIR}/libbrotlidec.pc"

c/common/platform.h

@@ -203,9 +203,19 @@ OR:
 #define BROTLI_TARGET_LOONGARCH64
 #endif
 
+/* This does not seem to be an indicator of z/Architecture (64-bit); neither
+   that allows to use unaligned loads. */
+#if defined(__s390x__)
+#define BROTLI_TARGET_S390X
+#endif
+
+#if defined(__mips64)
+#define BROTLI_TARGET_MIPS64
+#endif
+
 #if defined(BROTLI_TARGET_X64) || defined(BROTLI_TARGET_ARMV8_64) || \
     defined(BROTLI_TARGET_POWERPC64) || defined(BROTLI_TARGET_RISCV64) || \
-    defined(BROTLI_TARGET_LOONGARCH64)
+    defined(BROTLI_TARGET_LOONGARCH64) || defined(BROTLI_TARGET_MIPS64)
 #define BROTLI_TARGET_64_BITS 1
 #else
 #define BROTLI_TARGET_64_BITS 0

c/include/brotli/port.h

@@ -269,20 +269,20 @@
 #if defined(_WIN32)
 #if defined(BROTLICOMMON_SHARED_COMPILATION)
 #define BROTLI_COMMON_API __declspec(dllexport)
-#else
+#else  /* !BROTLICOMMON_SHARED_COMPILATION */
 #define BROTLI_COMMON_API __declspec(dllimport)
 #endif  /* BROTLICOMMON_SHARED_COMPILATION */
 #if defined(BROTLIDEC_SHARED_COMPILATION)
 #define BROTLI_DEC_API __declspec(dllexport)
-#else
+#else   /* !BROTLIDEC_SHARED_COMPILATION */
 #define BROTLI_DEC_API __declspec(dllimport)
 #endif  /* BROTLIDEC_SHARED_COMPILATION */
 #if defined(BROTLIENC_SHARED_COMPILATION)
 #define BROTLI_ENC_API __declspec(dllexport)
-#else
+#else  /* !BROTLIENC_SHARED_COMPILATION */
 #define BROTLI_ENC_API __declspec(dllimport)
 #endif  /* BROTLIENC_SHARED_COMPILATION */
-#else  /* _WIN32 */
+#else  /* !_WIN32 */
 #define BROTLI_COMMON_API BROTLI_PUBLIC
 #define BROTLI_DEC_API BROTLI_PUBLIC
 #define BROTLI_ENC_API BROTLI_PUBLIC

java/org/brotli/dec/BitReader.java

@@ -72,10 +72,10 @@ final class BitReader {
     while (bytesInBuffer < CAPACITY) {
       final int spaceLeft = CAPACITY - bytesInBuffer;
       final int len = Utils.readInput(s, s.byteBuffer, bytesInBuffer, spaceLeft);
-      // EOF is -1 in Java, but 0 in C#.
       if (len < BROTLI_ERROR) {
         return len;
       }
+      // EOF is -1 in Java, but 0 in C#.
       if (len <= 0) {
         s.endOfStreamReached = 1;
         s.tailBytes = bytesInBuffer;
@@ -276,10 +276,10 @@ final class BitReader {
     // Now it is possible to copy bytes directly.
     while (len > 0) {
       final int chunkLen = Utils.readInput(s, data, pos, len);
-      // EOF is -1 in Java, but 0 in C#.
-      if (len < BROTLI_ERROR) {
-        return len;
+      if (chunkLen < BROTLI_ERROR) {
+        return chunkLen;
       }
+      // EOF is -1 in Java, but 0 in C#.
       if (chunkLen <= 0) {
         return Utils.makeError(s, BROTLI_ERROR_TRUNCATED_INPUT);
       }

scripts/libbrotlicommon.pc.in

@@ -7,5 +7,5 @@ Name: libbrotlicommon
 URL: https://github.com/google/brotli
 Description: Brotli common dictionary library
 Version: @PACKAGE_VERSION@
-Libs: -L${libdir} -lbrotlicommon
+Libs: -L${libdir} -lbrotlicommon @libm@
 Cflags: -I${includedir}

setup.py

@@ -94,9 +94,7 @@ class BuildExt(build_ext):
         objects = []
 
         macros = ext.define_macros[:]
-        if platform.system() == "Darwin":
-            macros.append(("OS_MACOSX", "1"))
-        elif self.compiler.compiler_type == "mingw32":
+        if self.compiler.compiler_type == "mingw32":
             # On Windows Python 2.7, pyconfig.h defines "hypot" as "_hypot",
             # This clashes with GCC's cmath, and causes compilation errors when
             # building under MinGW: http://bugs.python.org/issue11566
@@ -160,7 +158,8 @@ CLASSIFIERS = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
     "Intended Audience :: Developers",
-    "License :: OSI Approved :: MIT License",
+    # Deprecated, see https://packaging.python.org/en/latest/guides/writing-pyproject-toml/#license for details.
+    # "License :: OSI Approved :: MIT License",
     "Operating System :: MacOS :: MacOS X",
     "Operating System :: Microsoft :: Windows",
     "Operating System :: POSIX :: Linux",