dependencies/cmake: Only use abs paths as link args

When taking library dependencies from CMake, we first attempt to look
the dependency up in the target list, then fall back to treating it as a
path, which we add if the path exists.

As there is no check for whether or not the path is really a path, this
can cause false positives; for example if a 'uuid' dependency was passed
intending to be a target, but it cannot be found and the current
directory also contains a file or directory named 'uuid', we will just
include the string 'uuid' in library dependencies.

This is particularly prevalent on Windows, where a system library called
'version' exists, and thanks to case insensitivity will match a file
called 'VERSION' if found in the source root when running Meson from the
source directory, or a generated file when running Meson from the build
directory.

Fix this check to only look up filesystem existence on absolute paths,
not unqualified.

This also adds a fallback warning in case an argument cannot be found,
rather than silently falling back.

1 files changed, 5 insertions, 1 deletions

diff --git a/mesonbuild/dependencies/base.py b/mesonbuild/dependencies/base.py
index ea1fff8..8b452cd 100644
--- a/mesonbuild/dependencies/base.py
+++ b/mesonbuild/dependencies/base.py
@@ -1481,7 +1481,9 @@ class CMakeDependency(ExternalDependency):
                 for j in otherDeps:
                     if j in self.traceparser.targets:
                         targets += [j]
-                    elif reg_is_lib.match(j) or os.path.exists(j):
+                    elif reg_is_lib.match(j):
+                        libraries += [j]
+                    elif os.path.isabs(j) and os.path.exists(j):
                         libraries += [j]
                     elif mesonlib.is_windows() and reg_is_maybe_bare_lib.match(j):
                         # On Windows, CMake library dependencies can be passed as bare library names,
@@ -1491,6 +1493,8 @@ class CMakeDependency(ExternalDependency):
                         # same, but must assume any bare argument passed which is not also a CMake
                         # target must be a system library we should try to link against
                         libraries += ["{}.lib".format(j)]
+                    else:
+                        mlog.warning('CMake: Dependency', mlog.bold(j), 'for', mlog.bold(name), 'target', mlog.bold(self._original_module_name(curr)), 'was not found')
 
                 processed_targets += [curr]