Add brotli and tests to CI

Drive-by:
- Update sandbox policy
- Formatting fixes
- Updated comments
PiperOrigin-RevId: 453901669
Change-Id: I40e0fbd26525ba564d4e062c79752a0102c48b15

.github/workflows/ubuntu-cmake-contrib.yml

@@ -11,7 +11,7 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-20.04]
-        contrib: [jsonnet, libraw, libtiff, pffft]
+        contrib: [brotli, jsonnet, libraw, libtiff, pffft]
         ignore-errors: [true]
         include:
           - compiler: clang

contrib/brotli/CMakeLists.txt

@@ -16,6 +16,7 @@ cmake_minimum_required(VERSION 3.13..3.22)
 
 project(sapi_brotli CXX)
 include(CTest)
+include(GoogleTest)
 
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED True)
@@ -29,25 +30,22 @@ endif()
 
 FetchContent_Declare(libbrotli
   GIT_REPOSITORY https://github.com/google/brotli.git
-  GIT_TAG        f4153a09f87cbb9c826d8fc12c74642bb2d879ea
+  GIT_TAG        f4153a09f87cbb9c826d8fc12c74642bb2d879ea # 2022-01-10
 )
 FetchContent_MakeAvailable(libbrotli)
 
 set(brotli_INCLUDE_DIR "${brotli_SOURCE_DIR}/c/include")
 configure_file(brotli.gen.h.in brotli.gen.h)
 
-add_library(brotli_static INTERFACE)
-target_link_libraries(brotli_static INTERFACE
-  brotlicommon-static
-  brotlidec-static
-  brotlienc-static
+add_library(brotli_static STATIC
+  "${SAPI_BINARY_DIR}/sapi_force_cxx_linkage.cc"
+  $<TARGET_OBJECTS:brotlicommon-static>
+  $<TARGET_OBJECTS:brotlidec-static>
+  $<TARGET_OBJECTS:brotlienc-static>
 )
 
-add_sapi_library(
-  sapi_brotli
-
-  FUNCTIONS
-    BrotliDecoderCreateInstance
+add_sapi_library(sapi_brotli
+  FUNCTIONS BrotliDecoderCreateInstance
             BrotliDecoderSetParameter
             BrotliDecoderDecompressStream
             BrotliDecoderTakeOutput
@@ -59,8 +57,7 @@ add_sapi_library(
             BrotliEncoderSetParameter
             BrotliEncoderDestroyInstance
 
-  INPUTS
-    "${CMAKE_BINARY_DIR}/brotli.gen.h"
+  INPUTS "${CMAKE_BINARY_DIR}/brotli.gen.h"
 
   LIBRARY brotli_static
   LIBRARY_NAME Brotli

contrib/brotli/brotli.gen.h.in

@@ -12,8 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// The generator dosen't handle well complicated structures
-// and dependencies of brotli. We have to enforce multiple includes.
+// The libclang based generator doesn't handle complicated structures and
+// dependencies of brotli well. We have to enforce multiple includes.
 
 #include "${brotli_INCLUDE_DIR}/brotli/port.h"
 #include "${brotli_INCLUDE_DIR}/brotli/types.h"

contrib/brotli/sandboxed.h

@@ -31,7 +31,9 @@ class BrotliSapiSandbox : public BrotliSandbox {
         .AllowRead()
         .AllowWrite()
         .AllowSystemMalloc()
+        .AllowGetPIDs()
         .AllowExit()
+        .BlockSyscallWithErrno(__NR_openat, ENOENT)
         .BuildOrDie();
   }
 };

contrib/brotli/utils/utils_brotli.h

@@ -15,6 +15,7 @@
 #ifndef CONTRIB_BROTLI_UTILS_UTILS_BROTLI_H_
 #define CONTRIB_BROTLI_UTILS_UTILS_BROTLI_H_
 
+#include <cstdint>
 #include <fstream>
 #include <iostream>
 #include <string>
@@ -23,10 +24,12 @@
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 
-constexpr size_t kFileMaxSize = 1024 * 1024 * 1024;  // 1GB
+constexpr size_t kFileMaxSize = size_t{1} << 30;  // 1GiB
 
 std::streamsize GetStreamSize(std::ifstream& stream);
+
 absl::StatusOr<std::vector<uint8_t>> ReadFile(const std::string& in_file_s);
+
 absl::Status WriteFile(const std::string& out_file_s,
                        const std::vector<uint8_t>& out_buf);