Pin external libexpat and libxml2 for CI stability

.. for a stable build, unless -DLIB_PROTO_MUTATOR_EXAMPLES_USE_LATEST=ON
is passed so that OSS-Fuzz has a chance to keep fuzzing the very latest.
The other two calls to `ExternalProject_Add` for GoogleTest and Protobuf
were pinned already.

List of Git tags for libexpat and libxml2:
- https://github.com/libexpat/libexpat/tags
- https://gitlab.gnome.org/GNOME/libxml2/-/tags

Related code in OSS-Fuzz:
https://github.com/google/oss-fuzz/blob/22bf164795d077841e099c7a70b595b15158b36f/projects/libprotobuf-mutator/build.sh#L27

Signed-off-by: Sebastian Pipping <[email protected]>

Author: hartwork

CMakeLists.txt

@@ -23,6 +23,7 @@ option(LIB_PROTO_MUTATOR_EXAMPLES "Enable examples building" ON)
 option(LIB_PROTO_MUTATOR_DOWNLOAD_PROTOBUF
        "Automatically download working protobuf" OFF)
 option(LIB_PROTO_MUTATOR_WITH_ASAN "Enable address sanitizer" OFF)
+option(LIB_PROTO_MUTATOR_EXAMPLES_USE_LATEST "Use latest libexpat/libxml2 for expat_example/libxml2_example" OFF)
 set(PKG_CONFIG_PATH "share/pkgconfig" CACHE STRING "Directory to install pkgconfig file")
 set(LIB_PROTO_MUTATOR_FUZZER_LIBRARIES "" CACHE STRING "Fuzzing engine libs")
 

cmake/external/expat.cmake

@@ -37,11 +37,20 @@ if(DEFINED CMAKE_C_COMPILER_LAUNCHER AND DEFINED CMAKE_CXX_COMPILER_LAUNCHER)
   set(EXPAT_CXX_COMPILER "${CMAKE_CXX_COMPILER_LAUNCHER} ${EXPAT_CXX_COMPILER}")
 endif()
 
+# NOTE: Fuzzer "expat_example" is being used for actual fuzzing in OSS-Fuzz.
+#       We want a rock-solid build by default (hence the pinning to a
+#       specific version) but also be fuzzing the very latest in OSS-Fuzz.
+if (LIB_PROTO_MUTATOR_EXAMPLES_USE_LATEST)
+  set(EXPAT_GIT_TAG "master")
+else()
+  set(EXPAT_GIT_TAG "R_2_6_4")
+endif()
+
 include (ExternalProject)
 ExternalProject_Add(${EXPAT_TARGET}
     PREFIX ${EXPAT_TARGET}
     GIT_REPOSITORY https://github.com/libexpat/libexpat
-    GIT_TAG master
+    GIT_TAG ${EXPAT_GIT_TAG}
     UPDATE_COMMAND ""
     CONFIGURE_COMMAND cd ${EXPAT_SRC_DIR} && ./buildconf.sh  && ./configure
                                                     --prefix=${EXPAT_INSTALL_DIR}

cmake/external/libxml2.cmake

@@ -30,11 +30,20 @@ foreach(lib IN LISTS LIBXML2_LIBRARIES)
   add_dependencies(${lib} ${LIBXML2_TARGET})
 endforeach(lib)
 
+# NOTE: Fuzzer "libxml2_example" is being used for actual fuzzing in OSS-Fuzz.
+#       We want a rock-solid build by default (hence the pinning to a
+#       specific version) but also be fuzzing the very latest in OSS-Fuzz.
+if (LIB_PROTO_MUTATOR_EXAMPLES_USE_LATEST)
+  set(LIBXML2_GIT_TAG "master")
+else()
+  set(LIBXML2_GIT_TAG "v2.13.6")
+endif()
+
 include (ExternalProject)
 ExternalProject_Add(${LIBXML2_TARGET}
     PREFIX ${LIBXML2_TARGET}
     GIT_REPOSITORY GIT_REPOSITORY https://gitlab.gnome.org/GNOME/libxml2
-    GIT_TAG master
+    GIT_TAG ${LIBXML2_GIT_TAG}
     UPDATE_COMMAND ""
     CMAKE_CACHE_ARGS -DCMAKE_C_COMPILER:FILEPATH=${CMAKE_C_COMPILER}
                      -DCMAKE_CXX_COMPILER:FILEPATH=${CMAKE_CXX_COMPILER}