QThread/Unix: move the pthread_key to a file-scope static

So that the pthread_key is destroyed much later than now, at QtCore
unload time instead of a bit earlier in exit(). That's important so it
runs later than the Q_DESTRUCTOR_FUNCTION for QLibraryStore
(qlibrary.cpp), which is what unloads plugins, whose unload-time
destructors may be attempting to quit() & wait() for their worker
threads.

I had to keep the destruction of the exiting thread's adopted thread
where it was: a function-local static's destructor. As noted in the
comment added by 1da7558bfd7626bcc40a214a90ae5027f32f6c7f, we need
QThreadData::cleanup() to run before the libraries start to unload
because we need to delete the event dispatcher.

Init priority 10 will place it after the QHash random seed and qsimd
initialization, on ELF systems and on Windows. On other systems (incl.
Apple ones), the order probably depends on the order of the files in the
CMakeLists.txt. I thought that would mean the destructor for thread/
would run before plugin/ but that apparently is not the case. But that's
fragile.

Amends 1da7558bfd7626bcc40a214a90ae5027f32f6c7f, which amended other
things...

Fixes: QTBUG-132697
Task-number: QTBUG-102984
Task-number: QTBUG-132381
Pick-to: 6.8
Change-Id: Id7263d6ffe7a5949cd84e35d942ad0e02df1b455
Reviewed-by: Fabian Kosmale <fabian.kosmale@qt.io>
(cherry picked from commit 2f69a05bd0cd7ce63890f709ff3ed7a4f78acd70)
Reviewed-by: Qt Cherry-pick Bot <cherrypick_bot@qt-project.org>

REUSE.toml

@@ -24,7 +24,7 @@ SPDX-License-Identifier = "LicenseRef-Qt-Commercial OR GPL-3.0-only"
 path = ["bin/*", "coin/**","libexec/*","**_clang-format", "**.cmake", "**.conf", "**.cmake.in",
         "**.prf", "libexec/qt-internal-configure-*", "config.tests/.qmake.conf",
         "**.pro", "**.pri", "**.yaml", "cmake/**.in", "cmake/ios/LaunchScreen.storyboard",
-        "cmake/**md", "**.yml", "**.dynlist",
+        "cmake/**md", "**.yml", "**.dynlist", "cmake/**.plist",
         "src/corelib/global/qconfig.cpp.in", "src/corelib/Qt6CoreConfigureFileTemplate.in",
         "**.cfg"]
 precedence = "closest"

cmake/QtAutoDetectHelpers.cmake

@@ -152,7 +152,12 @@ function(qt_auto_detect_android)
 endfunction()
 
 function(qt_auto_detect_vcpkg)
-    if(QT_USE_VCPKG AND DEFINED ENV{VCPKG_ROOT})
+    if(QT_USE_VCPKG)
+        if(NOT DEFINED ENV{VCPKG_ROOT})
+            message(FATAL_ERROR
+                "Usage of vcpkg was requested but the environment variable VCPKG_ROOT is not set."
+            )
+        endif()
         set(vcpkg_toolchain_file "$ENV{VCPKG_ROOT}/scripts/buildsystems/vcpkg.cmake")
         get_filename_component(vcpkg_toolchain_file "${vcpkg_toolchain_file}" ABSOLUTE)
 

cmake/QtBaseGlobalTargets.cmake

@@ -366,7 +366,15 @@ if(APPLE)
         DESTINATION "${__GlobalConfig_build_dir}/${platform_shortname}"
     )
 
-    if(IOS)
+    if(MACOS)
+        # Test entitlements
+        qt_copy_or_install(FILES "cmake/${platform_shortname}/test.entitlements.plist"
+            DESTINATION "${__GlobalConfig_install_dir}/${platform_shortname}"
+        )
+        file(COPY "cmake/${platform_shortname}/test.entitlements.plist"
+            DESTINATION "${__GlobalConfig_build_dir}/${platform_shortname}"
+        )
+    elseif(IOS)
         qt_copy_or_install(FILES "cmake/ios/LaunchScreen.storyboard"
             DESTINATION "${__GlobalConfig_install_dir}/ios"
         )

cmake/QtBuildHelpers.cmake

@@ -246,6 +246,7 @@ function(qt_internal_get_qt_build_private_files_to_install out_var)
         QtGenerateLibPri.cmake
         QtGenerateVersionScript.cmake
         QtModuleConfig.cmake.in
+        QtModuleConfigPrivate.cmake.in
         QtModuleDependencies.cmake.in
         QtModuleHeadersCheck.cmake
         QtModuleToolsConfig.cmake.in
@@ -292,8 +293,17 @@ function(qt_internal_get_qt_build_public_helpers out_var)
         QtPublicGitHelpers
         QtPublicPluginHelpers
         QtPublicPluginHelpers_v2
+        QtPublicSbomAttributionHelpers
+        QtPublicSbomCpeHelpers
+        QtPublicSbomDepHelpers
+        QtPublicSbomFileHelpers
         QtPublicSbomGenerationHelpers
         QtPublicSbomHelpers
+        QtPublicSbomLicenseHelpers
+        QtPublicSbomOpsHelpers
+        QtPublicSbomPurlHelpers
+        QtPublicSbomPythonHelpers
+        QtPublicSbomSystemDepHelpers
         QtPublicTargetHelpers
         QtPublicTestHelpers
         QtPublicToolHelpers

cmake/QtCMakeVersionHelpers.cmake

@@ -169,9 +169,8 @@ function(qt_internal_force_allow_unsuitable_cmake_version_for_building_qt out_va
     # Temporarily allow any version when building in Qt's CI, so we can decouple the provisioning
     # of the minimum CMake version from the bump of the minimum CMake version.
     # The COIN_UNIQUE_JOB_ID env var is set in Qt's CI for both build and test work items.
-    # Current state is that this check is enabled.
+    # Current state is that this check is disabled.
-    # TODO: Disable it once provisioning is merged.
+    set(allow_any_version_in_ci FALSE)
-    set(allow_any_version_in_ci TRUE)
 
     if(allow_any_version_in_ci AND DEFINED ENV{COIN_UNIQUE_JOB_ID})
         set(allow_any_version TRUE)

cmake/QtFrameworkHelpers.cmake

@@ -38,6 +38,7 @@ macro(qt_find_apple_system_frameworks)
         qt_internal_find_apple_system_framework(FWEventKit EventKit)
         qt_internal_find_apple_system_framework(FWHealthKit HealthKit)
         qt_internal_find_apple_system_framework(FWUniformTypeIdentifiers UniformTypeIdentifiers)
+        qt_internal_find_apple_system_framework(FWOpenGL OpenGL)
     endif()
 endmacro()
 

cmake/QtGenerateLibHelpers.cmake

@@ -10,7 +10,8 @@ function(qt_get_library_name_without_prefix_and_suffix out_var file_path)
     if(NOT file_path MATCHES "^-") # not a linker flag
         get_filename_component(basename "${file_path}" NAME_WE)
         get_filename_component(ext "${file_path}" EXT)
-        if(NOT ext) # seems like a library name without prefix and suffix
+        if(NOT ext AND NOT IS_ABSOLUTE "${file_path}")
+            # seems like a library name without prefix and suffix
             set(${out_var} "${file_path}" PARENT_SCOPE)
             return()
         endif()

cmake/QtModuleConfig.cmake.in

@@ -32,7 +32,47 @@ if (NOT QT_NO_CREATE_TARGETS AND @INSTALL_CMAKE_NAMESPACE@@target@_FOUND)
     include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@AdditionalTargetInfo.cmake")
     include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@ExtraProperties.cmake"
         OPTIONAL)
+endif()
 
+# Find the private module counterpart.
+if (@INSTALL_CMAKE_NAMESPACE@@target@_FOUND AND NOT @arg_NO_PRIVATE_MODULE@)
+    if(NOT @INSTALL_CMAKE_NAMESPACE@@target_private@_FOUND)
+        if("${_qt_cmake_dir}" STREQUAL "")
+            set(_qt_cmake_dir "${QT_TOOLCHAIN_RELOCATABLE_CMAKE_DIR}")
+        endif()
+        set(__qt_use_no_default_path_for_qt_packages "NO_DEFAULT_PATH")
+        if(QT_DISABLE_NO_DEFAULT_PATH_IN_QT_PACKAGES)
+            set(__qt_use_no_default_path_for_qt_packages "")
+        endif()
+        find_package(@INSTALL_CMAKE_NAMESPACE@@target_private@ "@PROJECT_VERSION@" EXACT
+            QUIET
+            CONFIG
+            PATHS
+                ${QT_BUILD_CMAKE_PREFIX_PATH}
+                "${CMAKE_CURRENT_LIST_DIR}/.."
+                "${_qt_cmake_dir}"
+                ${_qt_additional_packages_prefix_paths}
+            ${__qt_use_no_default_path_for_qt_packages}
+        )
+    endif()
+    if(NOT @INSTALL_CMAKE_NAMESPACE@@target_private@_FOUND)
+        get_property(@INSTALL_CMAKE_NAMESPACE@@target_private@_warning_shown GLOBAL PROPERTY
+            @INSTALL_CMAKE_NAMESPACE@@target_private@_warning_shown
+        )
+        if(NOT @INSTALL_CMAKE_NAMESPACE@@target_private@_warning_shown)
+            message(VERBOSE
+                "The private module package '@INSTALL_CMAKE_NAMESPACE@@target_private@' "
+                "could not be found. It possibly needs to be installed separately with your "
+                "package manager."
+            )
+            set_property(GLOBAL PROPERTY
+                @INSTALL_CMAKE_NAMESPACE@@target_private@_warning_shown ON
+            )
+        endif()
+    endif()
+endif()
+
+if (NOT QT_NO_CREATE_TARGETS AND @INSTALL_CMAKE_NAMESPACE@@target@_FOUND)
     # DEPRECATED
     # Provide old style variables for includes, compile definitions, etc.
     # These variables are deprecated and only provided on a best-effort basis to facilitate porting.

cmake/QtModuleConfigPrivate.cmake.in

@@ -0,0 +1,51 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+@PACKAGE_INIT@
+
+cmake_minimum_required(VERSION @min_new_policy_version@...@max_new_policy_version@)
+
+include(CMakeFindDependencyMacro)
+
+# Find required dependencies, if any.
+if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@Dependencies.cmake")
+    include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@Dependencies.cmake")
+    _qt_internal_suggest_dependency_debugging(@target_private@
+        __qt_@target_private@_pkg ${CMAKE_FIND_PACKAGE_NAME}_NOT_FOUND_MESSAGE)
+endif()
+
+# If *ConfigDependencies.cmake exists, the variable value will be defined there.
+# Don't override it in that case.
+if(NOT DEFINED "@INSTALL_CMAKE_NAMESPACE@@target_private@_FOUND")
+    set("@INSTALL_CMAKE_NAMESPACE@@target_private@_FOUND" TRUE)
+endif()
+
+if(NOT QT_NO_CREATE_TARGETS AND @INSTALL_CMAKE_NAMESPACE@@target_private@_FOUND)
+    include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@Targets.cmake")
+    include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@AdditionalTargetInfo.cmake")
+    include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@ExtraProperties.cmake"
+        OPTIONAL)
+endif()
+
+if(TARGET @QT_CMAKE_EXPORT_NAMESPACE@::@target_private@)
+    if(NOT QT_NO_CREATE_VERSIONLESS_TARGETS)
+        if(CMAKE_VERSION VERSION_LESS 3.18 OR QT_USE_OLD_VERSION_LESS_TARGETS)
+            include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@VersionlessTargets.cmake")
+        else()
+            include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@VersionlessAliasTargets.cmake")
+        endif()
+    endif()
+else()
+    set(@INSTALL_CMAKE_NAMESPACE@@target_private@_FOUND FALSE)
+    if(NOT DEFINED @INSTALL_CMAKE_NAMESPACE@@target_private@_NOT_FOUND_MESSAGE)
+        set(@INSTALL_CMAKE_NAMESPACE@@target_private@_NOT_FOUND_MESSAGE
+            "Target \"@QT_CMAKE_EXPORT_NAMESPACE@::@target_private@\" was not found.")
+
+        if(QT_NO_CREATE_TARGETS)
+            string(APPEND @INSTALL_CMAKE_NAMESPACE@@target_private@_NOT_FOUND_MESSAGE
+                "Possibly due to QT_NO_CREATE_TARGETS being set to TRUE and thus "
+                "${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target_private@Targets.cmake was not "
+                "included to define the target.")
+        endif()
+    endif()
+endif()

cmake/QtModuleDependencies.cmake.in

@@ -32,16 +32,20 @@ endif()
 set(__qt_@target@_third_party_deps "@third_party_deps@")
 @third_party_deps_extra_info@
 _qt_internal_find_third_party_dependencies("@target@" __qt_@target@_third_party_deps)
+unset(__qt_@target@_third_party_deps)
 
 # Find Qt tool package.
 set(__qt_@target@_tool_deps "@main_module_tool_deps@")
 _qt_internal_find_tool_dependencies("@target@" __qt_@target@_tool_deps)
+unset(__qt_@target@_tool_deps)
 
 # note: target_deps example: "Qt6Core\;5.12.0;Qt6Gui\;5.12.0"
 set(__qt_@target@_target_deps "@target_deps@")
 set(__qt_@target@_find_dependency_paths "${CMAKE_CURRENT_LIST_DIR}/.." "${_qt_cmake_dir}")
 _qt_internal_find_qt_dependencies("@target@" __qt_@target@_target_deps
                                   __qt_@target@_find_dependency_paths)
+unset(__qt_@target@_target_deps)
+unset(__qt_@target@_find_dependency_paths)
 
 set(_@QT_CMAKE_EXPORT_NAMESPACE@@target@_MODULE_DEPENDENCIES "@qt_module_dependencies@")
 set(@INSTALL_CMAKE_NAMESPACE@@target@_FOUND TRUE)

cmake/QtModuleHelpers.cmake

@@ -340,6 +340,9 @@ function(qt_internal_add_module target)
         )
         set_property(TARGET "${target_private}" APPEND PROPERTY
                      EXPORT_PROPERTIES "${export_properties}")
+
+        # Let find_package(Qt6FooPrivate) also find_package(Qt6Foo).
+        qt_register_target_dependencies("${target_private}" "Qt::${target}" "")
     endif()
 
     # FIXME: This workaround is needed because the deployment logic
@@ -691,6 +694,12 @@ function(qt_internal_add_module target)
     set(path_suffix "${INSTALL_CMAKE_NAMESPACE}${target}")
     qt_path_join(config_build_dir ${QT_CONFIG_BUILD_DIR} ${path_suffix})
     qt_path_join(config_install_dir ${QT_CONFIG_INSTALL_DIR} ${path_suffix})
+    if(NOT arg_NO_PRIVATE_MODULE)
+        set(path_suffix "${INSTALL_CMAKE_NAMESPACE}${target_private}")
+        qt_path_join(private_config_build_dir ${QT_CONFIG_BUILD_DIR} ${path_suffix})
+        qt_path_join(private_config_install_dir ${QT_CONFIG_INSTALL_DIR} ${path_suffix})
+    endif()
+    unset(path_suffix)
 
     set(extra_cmake_files)
     set(extra_cmake_includes)
@@ -781,10 +790,9 @@ set(QT_ALLOW_MISSING_TOOLS_PACKAGES TRUE)")
 
     qt_internal_get_min_new_policy_cmake_version(min_new_policy_version)
     qt_internal_get_max_new_policy_cmake_version(max_new_policy_version)
-    configure_package_config_file(
+    qt_internal_write_basic_module_package("${target}" "${target_private}"
-        "${QT_CMAKE_DIR}/QtModuleConfig.cmake.in"
+        CONFIG_BUILD_DIR ${config_build_dir}
-        "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}Config.cmake"
+        CONFIG_INSTALL_DIR ${config_install_dir}
-        INSTALL_DESTINATION "${config_install_dir}"
     )
 
     if (EXISTS "${CMAKE_CURRENT_LIST_DIR}/${INSTALL_CMAKE_NAMESPACE}${target}BuildInternals.cmake")
@@ -794,38 +802,44 @@ set(QT_ALLOW_MISSING_TOOLS_PACKAGES TRUE)")
         list(APPEND extra_cmake_files "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}BuildInternals.cmake")
     endif()
 
-    write_basic_package_version_file(
-        "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}ConfigVersionImpl.cmake"
-        VERSION ${PROJECT_VERSION}
-        COMPATIBILITY AnyNewerVersion
-    )
-    qt_internal_write_qt_package_version_file(
-        "${INSTALL_CMAKE_NAMESPACE}${target}"
-        "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}ConfigVersion.cmake"
-    )
     qt_install(FILES
-        "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}Config.cmake"
-        "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}ConfigVersion.cmake"
-        "${config_build_dir}/${INSTALL_CMAKE_NAMESPACE}${target}ConfigVersionImpl.cmake"
         ${extra_cmake_files}
         DESTINATION "${config_install_dir}"
         COMPONENT Devel
     )
 
-    file(COPY ${extra_cmake_files} DESTINATION "${config_build_dir}")
+    if(NOT arg_NO_PRIVATE_MODULE)
-    set(exported_targets ${target})
+        qt_internal_write_basic_module_package(${target} ${target_private}
-    if(NOT ${arg_NO_PRIVATE_MODULE})
+            PRIVATE
-        list(APPEND exported_targets ${target_private})
+            CONFIG_BUILD_DIR ${private_config_build_dir}
+            CONFIG_INSTALL_DIR ${private_config_install_dir}
+        )
     endif()
-    set(export_name "${INSTALL_CMAKE_NAMESPACE}${target}Targets")
 
-    qt_install(TARGETS ${exported_targets}
+    file(COPY ${extra_cmake_files} DESTINATION "${config_build_dir}")
-        EXPORT ${export_name}
+
-        RUNTIME DESTINATION ${INSTALL_BINDIR}
+    set(targets_to_export ${target})
-        LIBRARY DESTINATION ${INSTALL_LIBDIR}
+    if(NOT ${arg_NO_PRIVATE_MODULE})
-        ARCHIVE DESTINATION ${INSTALL_LIBDIR}
+        list(APPEND targets_to_export ${target_private})
-        FRAMEWORK DESTINATION ${INSTALL_LIBDIR}
+    endif()
+
+    _qt_internal_forward_function_args(
+        FORWARD_PREFIX arg
+        FORWARD_OUT_VAR export_module_args
+        FORWARD_OPTIONS NO_ADDITIONAL_TARGET_INFO
     )
+    qt_internal_export_module(${target}
+        ${export_module_args}
+        CONFIG_BUILD_DIR ${config_build_dir}
+        CONFIG_INSTALL_DIR ${config_install_dir}
+    )
+    if(NOT arg_NO_PRIVATE_MODULE)
+        qt_internal_export_module(${target_private}
+            ${export_module_args}
+            CONFIG_BUILD_DIR ${private_config_build_dir}
+            CONFIG_INSTALL_DIR ${private_config_install_dir}
+        )
+    endif()
 
     if(BUILD_SHARED_LIBS)
         qt_apply_rpaths(TARGET "${target}" INSTALL_PATH "${INSTALL_LIBDIR}" RELATIVE_RPATH)
@@ -839,29 +853,6 @@ set(QT_ALLOW_MISSING_TOOLS_PACKAGES TRUE)")
             QT_ANDROID_MODULE_INSTALL_DIR ${INSTALL_LIBDIR})
     endif()
 
-    qt_install(EXPORT ${export_name}
-               NAMESPACE ${QT_CMAKE_EXPORT_NAMESPACE}::
-               DESTINATION ${config_install_dir})
-
-    if(NOT arg_NO_ADDITIONAL_TARGET_INFO)
-        qt_internal_export_additional_targets_file(
-            TARGETS ${exported_targets}
-            EXPORT_NAME_PREFIX ${INSTALL_CMAKE_NAMESPACE}${target}
-            CONFIG_INSTALL_DIR "${config_install_dir}")
-    endif()
-
-    qt_internal_export_modern_cmake_config_targets_file(
-        TARGETS ${exported_targets}
-        EXPORT_NAME_PREFIX ${INSTALL_CMAKE_NAMESPACE}${target}
-        CONFIG_BUILD_DIR "${config_build_dir}"
-        CONFIG_INSTALL_DIR "${config_install_dir}"
-    )
-
-    qt_internal_export_genex_properties(TARGETS ${target}
-        EXPORT_NAME_PREFIX ${INSTALL_CMAKE_NAMESPACE}${target}
-        CONFIG_INSTALL_DIR "${config_install_dir}"
-    )
-
     ### fixme: cmake is missing a built-in variable for this. We want to apply it only to modules and plugins
     # that belong to Qt.
     if(NOT arg_HEADER_MODULE)
@@ -986,6 +977,104 @@ set(QT_ALLOW_MISSING_TOOLS_PACKAGES TRUE)")
     qt_add_list_file_finalizer(qt_finalize_module ${target} ${arg_INTERNAL_MODULE} ${arg_NO_PRIVATE_MODULE})
 endfunction()
 
+# Write and install the basic Qt6Foo and Qt6FooPrivate packages.
+#
+# If PRIVATE is specified, write Qt6FooPrivate.
+# Otherwise write its public counterpart.
+#
+# Note that this function is supposed to be called from qt_internal_add_module, and depends on
+# variables set in the scope of that function, e.g. target and target_private.
+function(qt_internal_write_basic_module_package)
+    set(no_value_options
+        PRIVATE
+    )
+    set(single_value_options
+        CONFIG_BUILD_DIR
+        CONFIG_INSTALL_DIR
+    )
+    set(multi_value_options "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg
+        "${no_value_options}" "${single_value_options}" "${multi_value_options}"
+    )
+
+    if(arg_PRIVATE)
+        set(package_name "${INSTALL_CMAKE_NAMESPACE}${target_private}")
+        set(module_config_input_file "QtModuleConfigPrivate.cmake.in")
+    else()
+        set(package_name "${INSTALL_CMAKE_NAMESPACE}${target}")
+        set(module_config_input_file "QtModuleConfig.cmake.in")
+    endif()
+
+    configure_package_config_file(
+        "${QT_CMAKE_DIR}/${module_config_input_file}"
+        "${arg_CONFIG_BUILD_DIR}/${package_name}Config.cmake"
+        INSTALL_DESTINATION "${arg_CONFIG_INSTALL_DIR}"
+    )
+    write_basic_package_version_file(
+        "${arg_CONFIG_BUILD_DIR}/${package_name}ConfigVersionImpl.cmake"
+        VERSION ${PROJECT_VERSION}
+        COMPATIBILITY AnyNewerVersion
+    )
+    qt_internal_write_qt_package_version_file(
+        "${package_name}"
+        "${arg_CONFIG_BUILD_DIR}/${package_name}ConfigVersion.cmake"
+    )
+    qt_install(FILES
+        "${arg_CONFIG_BUILD_DIR}/${package_name}Config.cmake"
+        "${arg_CONFIG_BUILD_DIR}/${package_name}ConfigVersion.cmake"
+        "${arg_CONFIG_BUILD_DIR}/${package_name}ConfigVersionImpl.cmake"
+        DESTINATION "${arg_CONFIG_INSTALL_DIR}"
+        COMPONENT Devel
+    )
+endfunction()
+
+function(qt_internal_export_module target)
+    set(no_value_options
+        NO_ADDITIONAL_TARGET_INFO
+    )
+    set(single_value_options
+        CONFIG_BUILD_DIR
+        CONFIG_INSTALL_DIR
+    )
+    set(multi_value_options "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg
+        "${no_value_options}" "${single_value_options}" "${multi_value_options}"
+    )
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(export_name "${INSTALL_CMAKE_NAMESPACE}${target}Targets")
+    qt_install(TARGETS ${target}
+        EXPORT ${export_name}
+        RUNTIME DESTINATION ${INSTALL_BINDIR}
+        LIBRARY DESTINATION ${INSTALL_LIBDIR}
+        ARCHIVE DESTINATION ${INSTALL_LIBDIR}
+        FRAMEWORK DESTINATION ${INSTALL_LIBDIR}
+    )
+
+    qt_install(EXPORT ${export_name}
+               NAMESPACE ${QT_CMAKE_EXPORT_NAMESPACE}::
+               DESTINATION ${arg_CONFIG_INSTALL_DIR})
+
+    if(NOT arg_NO_ADDITIONAL_TARGET_INFO)
+        qt_internal_export_additional_targets_file(
+            TARGETS ${target}
+            EXPORT_NAME_PREFIX ${INSTALL_CMAKE_NAMESPACE}${target}
+            CONFIG_INSTALL_DIR "${arg_CONFIG_INSTALL_DIR}")
+    endif()
+
+    qt_internal_export_modern_cmake_config_targets_file(
+        TARGETS ${target}
+        EXPORT_NAME_PREFIX ${INSTALL_CMAKE_NAMESPACE}${target}
+        CONFIG_BUILD_DIR "${arg_CONFIG_BUILD_DIR}"
+        CONFIG_INSTALL_DIR "${arg_CONFIG_INSTALL_DIR}"
+    )
+
+    qt_internal_export_genex_properties(TARGETS ${target}
+        EXPORT_NAME_PREFIX ${INSTALL_CMAKE_NAMESPACE}${target}
+        CONFIG_INSTALL_DIR "${arg_CONFIG_INSTALL_DIR}"
+    )
+endfunction()
+
 function(qt_internal_apply_apple_privacy_manifest target)
     # Avoid "INTERFACE_LIBRARY targets may only have whitelisted properties" error on CMake < 3.17.
     get_target_property(target_type ${target} TYPE)

cmake/QtModuleToolsDependencies.cmake.in

@@ -2,15 +2,10 @@
 # SPDX-License-Identifier: BSD-3-Clause
 
 # Find "ModuleTools" dependencies, which are other ModuleTools packages.
-set(@INSTALL_CMAKE_NAMESPACE@@target@_FOUND FALSE)
-set(__qt_@target@_tool_deps "@package_deps@")
-foreach(__qt_@target@_target_dep ${__qt_@target@_tool_deps})
-    list(GET __qt_@target@_target_dep 0 __qt_@target@_pkg)
-    list(GET __qt_@target@_target_dep 1 __qt_@target@_version)
-
-    if (NOT ${__qt_@target@_pkg}_FOUND)
-        find_dependency(${__qt_@target@_pkg} ${__qt_@target@_version})
-    endif()
-endforeach()
-
 set(@INSTALL_CMAKE_NAMESPACE@@target@_FOUND TRUE)
+
+set(__qt_@target@_tool_third_party_deps "@third_party_deps@")
+_qt_internal_find_third_party_dependencies("@target@" __qt_@target@_tool_third_party_deps)
+
+set(__qt_@target@_tool_deps "@package_deps@")
+_qt_internal_find_tool_dependencies("@target@" __qt_@target@_tool_deps)

cmake/QtPluginConfig.cmake.in

@@ -29,8 +29,12 @@ if (NOT QT_NO_CREATE_TARGETS)
     # Find required dependencies, if any.
     if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@Dependencies.cmake")
         include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@Dependencies.cmake")
+    else()
+        set(@target@_FOUND TRUE)
     endif()
 
-    include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@Targets.cmake")
+    if(@target@_FOUND)
-    include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@AdditionalTargetInfo.cmake")
+        include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@Targets.cmake")
+        include("${CMAKE_CURRENT_LIST_DIR}/@INSTALL_CMAKE_NAMESPACE@@target@AdditionalTargetInfo.cmake")
+    endif()
 endif()

cmake/QtPluginDependencies.cmake.in

@@ -1,11 +1,12 @@
 # Copyright (C) 2024 The Qt Company Ltd.
 # SPDX-License-Identifier: BSD-3-Clause
 
-set(@target@_FOUND FALSE)
+set(@target@_FOUND TRUE)
 
 # note: _third_party_deps example: "ICU\\;FALSE\\;1.0\\;i18n uc data;ZLIB\\;FALSE\\;\\;"
 set(__qt_@target@_third_party_deps "@third_party_deps@")
 _qt_internal_find_third_party_dependencies("@target@" __qt_@target@_third_party_deps)
+unset(__qt_@target@_third_party_deps)
 
 set(__qt_use_no_default_path_for_qt_packages "NO_DEFAULT_PATH")
 if(QT_DISABLE_NO_DEFAULT_PATH_IN_QT_PACKAGES)
@@ -17,5 +18,9 @@ set(__qt_@target@_target_deps "@target_deps@")
 set(__qt_@target@_find_dependency_paths "@find_dependency_paths@")
 _qt_internal_find_qt_dependencies("@target@" __qt_@target@_target_deps
                                   __qt_@target@_find_dependency_paths)
+unset(__qt_@target@_target_deps)
+unset(__qt_@target@_find_dependency_paths)
 
-set(@target@_FOUND TRUE)
+if(__qt_${target}_missing_deps)
+    set(@target@_FOUND FALSE)
+endif()

cmake/QtPostProcessHelpers.cmake

@@ -29,7 +29,7 @@ macro(qt_collect_third_party_deps target)
     endif()
     unset(_target_is_static)
 
-    foreach(dep ${${depends_var}} ${optional_public_depends} ${extra_third_party_deps})
+    foreach(dep ${${depends_var}} ${extra_third_party_deps})
         # Gather third party packages that should be found when using the Qt module.
         # Also handle nolink target dependencies.
         string(REGEX REPLACE "_nolink$" "" base_dep "${dep}")
@@ -48,9 +48,6 @@ macro(qt_collect_third_party_deps target)
             if(dep_seen EQUAL -1 AND package_name)
                 list(APPEND third_party_deps_seen ${dep})
                 get_target_property(package_is_optional ${dep} INTERFACE_QT_PACKAGE_IS_OPTIONAL)
-                if(NOT package_is_optional AND dep IN_LIST optional_public_depends)
-                    set(package_is_optional TRUE)
-                endif()
                 get_target_property(package_version ${dep} INTERFACE_QT_PACKAGE_VERSION)
                 if(NOT package_version)
                     set(package_version "")
@@ -143,6 +140,13 @@ function(qt_internal_remove_qt_dependency_duplicates out_deps deps)
 endfunction()
 
 function(qt_internal_create_module_depends_file target)
+    set(no_value_options "")
+    set(single_value_options "")
+    set(multi_value_options "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg
+        "${no_value_options}" "${single_value_options}" "${multi_value_options}"
+    )
+
     get_target_property(target_type "${target}" TYPE)
     set(is_interface_lib FALSE)
     if(target_type STREQUAL "INTERFACE_LIBRARY")
@@ -156,11 +160,6 @@ function(qt_internal_create_module_depends_file target)
 
     get_target_property(public_depends "${target}" INTERFACE_LINK_LIBRARIES)
 
-    unset(optional_public_depends)
-    if(TARGET "${target}Private")
-        get_target_property(optional_public_depends "${target}Private" INTERFACE_LINK_LIBRARIES)
-    endif()
-
     # Used for collecting Qt module dependencies that should be find_package()'d in
     # ModuleDependencies.cmake.
     get_target_property(target_deps "${target}" _qt_target_deps)
@@ -337,7 +336,6 @@ function(qt_internal_create_plugin_depends_file target)
     get_target_property(depends "${target}" LINK_LIBRARIES)
     get_target_property(public_depends "${target}" INTERFACE_LINK_LIBRARIES)
     get_target_property(target_deps "${target}" _qt_target_deps)
-    unset(optional_public_depends)
     set(target_deps_seen "")
 
 
@@ -398,7 +396,6 @@ function(qt_internal_create_qt6_dependencies_file)
     set(actual_target Platform)
     get_target_property(public_depends "${actual_target}" INTERFACE_LINK_LIBRARIES)
     unset(depends)
-    unset(optional_public_depends)
 
     set(third_party_deps "")
     set(third_party_deps_seen "")
@@ -467,6 +464,9 @@ function(qt_internal_create_depends_files)
 
     foreach (target ${repo_known_modules})
         qt_internal_create_module_depends_file(${target})
+        if(TARGET "${target}Private")
+            qt_internal_create_module_depends_file(${target}Private)
+        endif()
     endforeach()
 
     foreach (target ${QT_KNOWN_PLUGINS})

cmake/QtPublicAppleHelpers.cmake

@@ -844,9 +844,9 @@ function(_qt_internal_get_cached_xcode_version out_var)
     set(${out_var} "${xcode_version}" PARENT_SCOPE)
 endfunction()
 
-# Warn when the platform SDK or Xcode version are not supported.
+# Warn or error out when the platform SDK or Xcode version are not supported.
 #
-# The warnings are currently only shown when building Qt, not when building user projects
+# The messages are currently only shown when building Qt, not when building user projects
 # with CMake.
 # The warnings ARE shown for qmake user projects.
 #
@@ -891,11 +891,14 @@ function(_qt_internal_check_apple_sdk_and_xcode_versions)
     endif()
 
     # The default differs in different branches.
-    set(failed_check_should_error FALSE)
+    set(failed_check_should_error TRUE)
 
     if(failed_check_should_error)
         # Allow downgrading the error into a warning.
-        if(QT_FORCE_WARN_APPLE_SDK_AND_XCODE_CHECK)
+        #
+        # Our cmake build tests might be executed on older not officially supported Xcode or SDK
+        # versions in the CI. Downgrade the error in this case as well.
+        if(QT_FORCE_WARN_APPLE_SDK_AND_XCODE_CHECK OR QT_INTERNAL_IS_CMAKE_BUILD_TEST)
             set(message_type WARNING)
             set(extra_message " Due to QT_FORCE_WARN_APPLE_SDK_AND_XCODE_CHECK being ON "
                 "the build will continue, but it will likely fail. Use at your own risk.")

cmake/QtPublicCMakeVersionHelpers.cmake

@@ -55,9 +55,8 @@ function(__qt_internal_force_allow_unsuitable_cmake_version_for_using_qt out_var
     # Temporarily allow any version when using Qt in Qt's CI, so we can decouple the provisioning
     # of the minimum CMake version from the bump of the minimum CMake version.
     # The COIN_UNIQUE_JOB_ID env var is set in Qt's CI for both build and test work items.
-    # Current state is that this check is enabled.
+    # Current state is that this check is disabled.
-    # TODO: Disable it once provisioning is merged.
+    set(allow_any_version_in_ci FALSE)
-    set(allow_any_version_in_ci TRUE)
 
     if(allow_any_version_in_ci AND DEFINED ENV{COIN_UNIQUE_JOB_ID})
         set(allow_any_version TRUE)

cmake/QtPublicDependencyHelpers.cmake

@@ -34,6 +34,9 @@ macro(_qt_internal_find_third_party_dependencies target target_dep_list)
             find_package(${__qt_${target}_find_package_args})
         else()
             find_dependency(${__qt_${target}_find_package_args})
+            if(NOT ${__qt_${target}_pkg}_FOUND)
+                list(APPEND __qt_${target}_missing_deps "${__qt_${target}_pkg}")
+            endif()
         endif()
 
         _qt_internal_get_package_components_id(
@@ -129,7 +132,6 @@ macro(_qt_internal_find_qt_dependencies target target_dep_list find_dependency_p
         list(GET __qt_${target}_target_dep 1 __qt_${target}_version)
 
         if (NOT ${__qt_${target}_pkg}_FOUND)
-
             # TODO: Remove Private handling once sufficient time has passed, aka all developers
             # updated their builds not to contain stale FooDependencies.cmake files without the
             # _qt_package_name property.
@@ -149,19 +151,13 @@ macro(_qt_internal_find_qt_dependencies target target_dep_list find_dependency_p
                     ${_qt_additional_packages_prefix_paths}
                 ${__qt_use_no_default_path_for_qt_packages}
             )
+            if(NOT ${__qt_${target}_pkg}_FOUND)
+                list(APPEND __qt_${target}_missing_deps "${__qt_${target}_pkg}")
+            endif()
         endif()
     endforeach()
 endmacro()
 
-
-# TODO: Remove once a dependency update completes and most developers have the Dependencies.cmake
-# files updated in their builds.
-# The name is too generic, it doesn't look for any kind of dependencies but only Qt package
-# dependencies.
-macro(_qt_internal_find_dependencies target_dep_list find_dependency_path_list)
-    _qt_internal_find_qt_dependencies("none" "${target_dep_list}" "${find_dependency_path_list}")
-endmacro()
-
 # If a dependency package was not found, provide some hints in the error message on how to debug
 # the issue.
 #

cmake/QtPublicSbomAttributionHelpers.cmake

@@ -0,0 +1,516 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Handles attribution information for a target.
+#
+# If CREATE_SBOM_FOR_EACH_ATTRIBUTION is set, a separate sbom target is created for each parsed
+# attribution entry, and the new targets are added as dependencies to the parent target.
+#
+# If CREATE_SBOM_FOR_EACH_ATTRIBUTION is not set, the information read from the first attribution
+# entry is added directly to the parent target, aka the the values are propagated to the outer
+# function scope to be read.. The rest of the attribution entries are created as separate targets
+# and added as dependencies, as if the option was passed.
+#
+# Handles multiple attribution files and entries within a file.
+# Attribution files can be specified either via directories and direct file paths.
+# If ATTRIBUTION_ENTRY_INDEX is set, only that specific attribution entry will be processed
+# from the given attribution file.
+function(_qt_internal_sbom_handle_qt_attribution_files out_prefix_outer)
+    if(NOT QT_GENERATE_SBOM)
+        return()
+    endif()
+
+    if(CMAKE_VERSION LESS_EQUAL "3.19")
+        message(DEBUG "CMake version is too low, can't parse attribution.json file.")
+        return()
+    endif()
+
+    set(opt_args
+        CREATE_SBOM_FOR_EACH_ATTRIBUTION
+    )
+    set(single_args
+        PARENT_TARGET
+    )
+    set(multi_args "")
+
+    _qt_internal_get_sbom_specific_options(sbom_opt_args sbom_single_args sbom_multi_args)
+    list(APPEND opt_args ${sbom_opt_args})
+    list(APPEND single_args ${sbom_single_args})
+    list(APPEND multi_args ${sbom_multi_args})
+
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(attribution_files "")
+    set(attribution_file_count 0)
+
+    foreach(attribution_file_path IN LISTS arg_ATTRIBUTION_FILE_PATHS)
+        get_filename_component(real_path "${attribution_file_path}" REALPATH)
+        list(APPEND attribution_files "${real_path}")
+        math(EXPR attribution_file_count "${attribution_file_count} + 1")
+    endforeach()
+
+    foreach(attribution_file_dir_path IN LISTS arg_ATTRIBUTION_FILE_DIR_PATHS)
+        get_filename_component(real_path
+            "${attribution_file_dir_path}/qt_attribution.json" REALPATH)
+        list(APPEND attribution_files "${real_path}")
+        math(EXPR attribution_file_count "${attribution_file_count} + 1")
+    endforeach()
+
+    # If CREATE_SBOM_FOR_EACH_ATTRIBUTION is set, that means the parent target was a qt entity,
+    # and not a 3rd party library.
+    # In which case we don't want to proagate options like CPE to the child attribution targets,
+    # because the CPE is meant for the parent target.
+    set(propagate_sbom_options_to_new_attribution_targets TRUE)
+    if(arg_CREATE_SBOM_FOR_EACH_ATTRIBUTION)
+        set(propagate_sbom_options_to_new_attribution_targets FALSE)
+        if(NOT arg_PARENT_TARGET)
+            message(FATAL_ERROR "PARENT_TARGET must be set")
+        endif()
+    endif()
+
+    if(arg_ATTRIBUTION_ENTRY_INDEX AND attribution_file_count GREATER 1)
+        message(FATAL_ERROR
+            "ATTRIBUTION_ENTRY_INDEX should only be set if a single attribution "
+            "file is specified."
+        )
+    endif()
+
+    set(file_index 0)
+    set(first_attribution_processed FALSE)
+    foreach(attribution_file_path IN LISTS attribution_files)
+        # Collect all processed attribution files to later create a configure-time dependency on
+        # them so that the SBOM is regenerated (and CMake is re-ran) if they are modified.
+        set_property(GLOBAL APPEND PROPERTY _qt_internal_project_attribution_files
+            "${attribution_file_path}")
+
+        # Set a unique out_prefix that will not overlap when multiple entries are processed.
+        set(out_prefix_file "${out_prefix_outer}_${file_index}")
+
+        # Get the number of entries in the attribution file.
+        _qt_internal_sbom_read_qt_attribution(${out_prefix_file}
+            GET_ATTRIBUTION_ENTRY_COUNT
+            OUT_VAR_VALUE attribution_entry_count
+            FILE_PATH "${attribution_file_path}"
+        )
+
+        # If a specific entry was specified, we will only process it from the file.
+        if(NOT "${arg_ATTRIBUTION_ENTRY_INDEX}" STREQUAL "")
+            set(entry_index ${arg_ATTRIBUTION_ENTRY_INDEX})
+        else()
+            set(entry_index 0)
+        endif()
+
+        # Go through each entry in the attribution file.
+        while("${entry_index}" LESS "${${out_prefix_file}_attribution_entry_count}")
+            # If this is the first entry to be processed, or if CREATE_SBOM_FOR_EACH_ATTRIBUTION
+            # is not set, we read the attribution file entry directly, and propagate the values
+            # to the parent scope.
+            if(NOT first_attribution_processed AND NOT arg_CREATE_SBOM_FOR_EACH_ATTRIBUTION)
+                # Set a prefix without indices, so that the parent scope add_sbom call can
+                # refer to the values directly with the outer prefix, without any index infix.
+                set(out_prefix "${out_prefix_outer}")
+
+                _qt_internal_sbom_read_qt_attribution(${out_prefix}
+                    GET_DEFAULT_KEYS
+                    ENTRY_INDEX "${entry_index}"
+                    OUT_VAR_ASSIGNED_VARIABLE_NAMES variable_names
+                    FILE_PATH "${attribution_file_path}"
+                )
+
+                # Propagate the values to the outer scope.
+                foreach(variable_name IN LISTS variable_names)
+                    set(${out_prefix}_${variable_name} "${${out_prefix}_${variable_name}}"
+                        PARENT_SCOPE)
+                endforeach()
+
+                get_filename_component(relative_attribution_file_path
+                    "${attribution_file_path}" REALPATH)
+
+                set(${out_prefix}_chosen_attribution_file_path "${relative_attribution_file_path}"
+                    PARENT_SCOPE)
+                set(${out_prefix}_chosen_attribution_entry_index "${entry_index}"
+                    PARENT_SCOPE)
+
+                set(first_attribution_processed TRUE)
+                if(NOT "${arg_ATTRIBUTION_ENTRY_INDEX}" STREQUAL "")
+                    # We had a specific index to process, so break right after processing it.
+                    break()
+                endif()
+            else()
+                # We are processing the second or later entry, or CREATE_SBOM_FOR_EACH_ATTRIBUTION
+                # was set. Instead of directly reading all the keys from the attribution file,
+                # we get the Id, and create a new sbom target for the entry.
+                # That will recursively call this function with a specific attribution file path
+                # and index, to process the specific entry.
+
+                set(out_prefix "${out_prefix_outer}_${file_index}_${entry_index}")
+
+                # Get the attribution id.
+                _qt_internal_sbom_read_qt_attribution(${out_prefix}
+                    GET_KEY
+                    KEY Id
+                    OUT_VAR_VALUE attribution_id
+                    ENTRY_INDEX "${entry_index}"
+                    FILE_PATH "${attribution_file_path}"
+                )
+
+                # If no Id was retrieved, just add a numeric one, to make the sbom target
+                # unique.
+                set(attribution_target "${arg_PARENT_TARGET}_Attribution_")
+                if(NOT ${out_prefix}_attribution_id)
+                    string(APPEND attribution_target "${file_index}_${entry_index}")
+                else()
+                    string(APPEND attribution_target "${${out_prefix}_attribution_id}")
+                endif()
+
+                set(sbom_args "")
+
+                if(propagate_sbom_options_to_new_attribution_targets)
+                    # Filter out the attributtion options, they will be passed mnaually
+                    # depending on which file and index is currently being processed.
+                    _qt_internal_get_sbom_specific_options(
+                        sbom_opt_args sbom_single_args sbom_multi_args)
+                    list(REMOVE_ITEM sbom_opt_args NO_CURRENT_DIR_ATTRIBUTION)
+                    list(REMOVE_ITEM sbom_single_args ATTRIBUTION_ENTRY_INDEX)
+                    list(REMOVE_ITEM sbom_multi_args
+                        ATTRIBUTION_FILE_PATHS
+                        ATTRIBUTION_FILE_DIR_PATHS
+                    )
+
+                    # Also filter out the FRIENDLY_PACKAGE_NAME option, otherwise we'd try to
+                    # file(GENERATE) multiple times with the same file name, but different content.
+                    list(REMOVE_ITEM sbom_single_args FRIENDLY_PACKAGE_NAME)
+
+                    _qt_internal_forward_function_args(
+                        FORWARD_APPEND
+                        FORWARD_PREFIX arg
+                        FORWARD_OUT_VAR sbom_args
+                        FORWARD_OPTIONS
+                            ${sbom_opt_args}
+                        FORWARD_SINGLE
+                            ${sbom_single_args}
+                        FORWARD_MULTI
+                            ${sbom_multi_args}
+                    )
+                endif()
+
+                # Create another sbom target with the id as a hint for the target name,
+                # the attribution file passed, and make the new target a dependency of the
+                # parent one.
+                _qt_internal_add_sbom("${attribution_target}"
+                    IMMEDIATE_FINALIZATION
+                    TYPE QT_THIRD_PARTY_SOURCES
+                    ATTRIBUTION_FILE_PATHS "${attribution_file_path}"
+                    ATTRIBUTION_ENTRY_INDEX "${entry_index}"
+                    NO_CURRENT_DIR_ATTRIBUTION
+                    ${sbom_args}
+                )
+
+                _qt_internal_extend_sbom_dependencies(${arg_PARENT_TARGET}
+                    SBOM_DEPENDENCIES ${attribution_target}
+                )
+            endif()
+
+            math(EXPR entry_index "${entry_index} + 1")
+        endwhile()
+
+        math(EXPR file_index "${file_index} + 1")
+    endforeach()
+endfunction()
+
+# Helper to parse a qt_attribution.json file and do various operations:
+# - GET_DEFAULT_KEYS extracts the license id, copyrights, version, etc.
+# - GET_KEY extracts a single given json key's value, as specified with KEY and saved into
+#   OUT_VAR_VALUE
+# - GET_ATTRIBUTION_ENTRY_COUNT returns the number of entries in the json file, set in
+#   OUT_VAR_VALUE
+#
+# ENTRY_INDEX can be used to specify the array index to select a specific entry in the json file.
+#
+# Any retrieved value is set in the outer scope.
+# The variables are prefixed with ${out_prefix}.
+# OUT_VAR_ASSIGNED_VARIABLE_NAMES contains the list of variables set in the parent scope, the
+# variables names in this list are not prefixed with ${out_prefix}.
+#
+# Requires cmake 3.19 for json parsing.
+function(_qt_internal_sbom_read_qt_attribution out_prefix)
+    if(NOT QT_GENERATE_SBOM)
+        return()
+    endif()
+
+    if(CMAKE_VERSION LESS_EQUAL "3.19")
+        message(DEBUG "CMake version is too low, can't parse attribution.json file.")
+        return()
+    endif()
+
+    set(opt_args
+        GET_DEFAULT_KEYS
+        GET_KEY
+        GET_ATTRIBUTION_ENTRY_COUNT
+    )
+    set(single_args
+        FILE_PATH
+        KEY
+        ENTRY_INDEX
+        OUT_VAR_VALUE
+        OUT_VAR_ASSIGNED_VARIABLE_NAMES
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(file_path "${arg_FILE_PATH}")
+
+    if(NOT file_path)
+        message(FATAL_ERROR "qt attribution file path not given")
+    endif()
+
+    file(READ "${file_path}" contents)
+    if(NOT contents)
+        message(FATAL_ERROR "qt attribution file is empty: ${file_path}")
+    endif()
+
+    if(NOT arg_GET_DEFAULT_KEYS AND NOT arg_GET_KEY AND NOT arg_GET_ATTRIBUTION_ENTRY_COUNT)
+        message(FATAL_ERROR
+            "No valid operation specified to _qt_internal_sbom_read_qt_attribution call.")
+    endif()
+
+    if(arg_GET_KEY)
+        if(NOT arg_KEY)
+            message(FATAL_ERROR "KEY must be set")
+        endif()
+        if(NOT arg_OUT_VAR_VALUE)
+            message(FATAL_ERROR "OUT_VAR_VALUE must be set")
+        endif()
+    endif()
+
+    get_filename_component(attribution_file_dir "${file_path}" DIRECTORY)
+
+    # Parse the json file.
+    # The first element might be an array, or an object. We need to detect which one.
+    # Do that by trying to query index 0 of the potential root array.
+    # If the index is found, that means the root is an array, and elem_error is set to NOTFOUND,
+    # because there was no error.
+    # Otherwise elem_error will be something like 'member '0' not found', and we can assume the
+    # root is an object.
+    string(JSON first_elem_type ERROR_VARIABLE elem_error TYPE "${contents}" 0)
+    if(elem_error STREQUAL "NOTFOUND")
+        # Root is an array. The attribution file might contain multiple entries.
+        # Pick the first one if no specific index was specified, otherwise use the given index.
+        if(NOT "${arg_ENTRY_INDEX}" STREQUAL "")
+            set(indices "${arg_ENTRY_INDEX}")
+        else()
+            set(indices "0")
+        endif()
+        set(is_array TRUE)
+    else()
+        # Root is an object, not an array, which means the file has a single entry.
+        set(indices "")
+        set(is_array FALSE)
+    endif()
+
+    set(variable_names "")
+
+    if(arg_GET_KEY)
+        _qt_internal_sbom_get_attribution_key(${arg_KEY} ${arg_OUT_VAR_VALUE} ${out_prefix})
+    endif()
+
+    if(arg_GET_ATTRIBUTION_ENTRY_COUNT)
+        if(NOT arg_OUT_VAR_VALUE)
+            message(FATAL_ERROR "OUT_VAR_VALUE must be set")
+        endif()
+
+        if(is_array)
+            string(JSON attribution_entry_count ERROR_VARIABLE elem_error LENGTH "${contents}")
+            # There was an error getting the length of the array, so we assume it's empty.
+            if(NOT elem_error STREQUAL "NOTFOUND")
+                set(attribution_entry_count 0)
+            endif()
+        else()
+            set(attribution_entry_count 1)
+        endif()
+
+        set(${out_prefix}_${arg_OUT_VAR_VALUE} "${attribution_entry_count}" PARENT_SCOPE)
+    endif()
+
+    if(arg_GET_DEFAULT_KEYS)
+        # Some calls are currently commented out, to save on json parsing time because we don't have
+        # a usage for them yet.
+        # _qt_internal_sbom_get_attribution_key(License license)
+        _qt_internal_sbom_get_attribution_key(LicenseId license_id "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(Version version "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(Homepage homepage "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(Name attribution_name "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(Description description "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(QtUsage qt_usage "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(DownloadLocation download_location "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(Copyright copyrights "${out_prefix}" IS_MULTI_VALUE)
+        _qt_internal_sbom_get_attribution_key(CopyrightFile copyright_file "${out_prefix}")
+        _qt_internal_sbom_get_attribution_key(PURL purls "${out_prefix}" IS_MULTI_VALUE)
+        _qt_internal_sbom_get_attribution_key(CPE cpes "${out_prefix}" IS_MULTI_VALUE)
+
+        # Some attribution files contain a copyright file that contains the actual list of
+        # copyrights. Read it and use it.
+        set(copyright_file_path "${attribution_file_dir}/${copyright_file}")
+        get_filename_component(copyright_file_path "${copyright_file_path}" REALPATH)
+        if(NOT copyrights AND copyright_file AND EXISTS "${copyright_file_path}")
+            file(READ "${copyright_file_path}" copyright_contents)
+            if(copyright_contents)
+                set(copyright_contents "${copyright_contents}")
+                set(copyrights "${copyright_contents}")
+                set(${out_prefix}_copyrights "${copyright_contents}" PARENT_SCOPE)
+                list(APPEND variable_names "copyrights")
+            endif()
+        endif()
+    endif()
+
+    if(arg_OUT_VAR_ASSIGNED_VARIABLE_NAMES)
+        set(${arg_OUT_VAR_ASSIGNED_VARIABLE_NAMES} "${variable_names}" PARENT_SCOPE)
+    endif()
+endfunction()
+
+# Extracts a string or an array of strings from a json index path, depending on the extracted value
+# type.
+#
+# Given the 'contents' of the whole json document and the EXTRACTED_VALUE of a json key specified
+# by the INDICES path, it tries to determine whether the value is an array, in which case the array
+# is converted to a cmake list and assigned to ${out_var} in the parent scope.
+# Otherwise the function assumes the EXTRACTED_VALUE was not an array, and just assigns the value
+# of EXTRACTED_VALUE to ${out_var}
+function(_qt_internal_sbom_handle_attribution_json_array contents)
+    set(opt_args "")
+    set(single_args
+        EXTRACTED_VALUE
+        OUT_VAR
+    )
+    set(multi_args
+        INDICES
+    )
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    # Write the original value to the parent scope, in case it was not an array.
+    set(${arg_OUT_VAR} "${arg_EXTRACTED_VALUE}" PARENT_SCOPE)
+
+    if(NOT arg_EXTRACTED_VALUE)
+        return()
+    endif()
+
+    string(JSON element_type TYPE "${contents}" ${arg_INDICES})
+
+    if(NOT element_type STREQUAL "ARRAY")
+        return()
+    endif()
+
+    set(json_array "${arg_EXTRACTED_VALUE}")
+    string(JSON array_len LENGTH "${json_array}")
+
+    set(value_list "")
+
+    math(EXPR array_len "${array_len} - 1")
+    foreach(index RANGE 0 "${array_len}")
+        string(JSON value GET "${json_array}" ${index})
+        if(value)
+            list(APPEND value_list "${value}")
+        endif()
+    endforeach()
+
+    if(value_list)
+        set(${arg_OUT_VAR} "${value_list}" PARENT_SCOPE)
+    endif()
+endfunction()
+
+# Escapes various characters in json content, so that the generate cmake code to append the content
+# to the spdx document is syntactically valid.
+function(_qt_internal_sbom_escape_json_content content out_var)
+    # Escape backslashes
+    string(REPLACE "\\" "\\\\" escaped_content "${content}")
+
+    # Escape quotes
+    string(REPLACE "\"" "\\\"" escaped_content "${escaped_content}")
+
+    set(${out_var} "${escaped_content}" PARENT_SCOPE)
+endfunction()
+
+# This macro reads a json key from a qt_attribution.json file, and assigns the escaped value to
+# out_var.
+# Also appends the name of the out_var to the parent scope 'variable_names' var.
+#
+# Expects 'contents' and 'indices' to already be set in the calling scope.
+#
+# If IS_MULTI_VALUE is set, handles the key as if it contained an array of
+# values, by converting the array of json values to a cmake list.
+macro(_qt_internal_sbom_get_attribution_key json_key out_var out_prefix)
+    cmake_parse_arguments(arg "IS_MULTI_VALUE" "" "" ${ARGN})
+
+    string(JSON "${out_var}" ERROR_VARIABLE get_error GET "${contents}" ${indices} "${json_key}")
+    if(NOT "${${out_var}}" STREQUAL "" AND NOT get_error)
+        set(extracted_value "${${out_var}}")
+
+        if(arg_IS_MULTI_VALUE)
+            _qt_internal_sbom_handle_attribution_json_array("${contents}"
+                EXTRACTED_VALUE "${extracted_value}"
+                INDICES ${indices} ${json_key}
+                OUT_VAR value_list
+            )
+            if(value_list)
+                set(extracted_value "${value_list}")
+            endif()
+        endif()
+
+        _qt_internal_sbom_escape_json_content("${extracted_value}" escaped_content)
+
+        set(${out_prefix}_${out_var} "${escaped_content}" PARENT_SCOPE)
+        list(APPEND variable_names "${out_var}")
+
+        unset(extracted_value)
+        unset(escaped_content)
+        unset(value_list)
+    endif()
+endmacro()
+
+# Replaces placeholders in CPE and PURL strings read from qt_attribution.json files.
+#
+# VALUES - list of CPE or PURL strings
+# OUT_VAR - variable to store the replaced values
+# VERSION - version to replace in the placeholders
+
+# Known placeholders:
+# $<VERSION> - Replaces occurrences of the placeholder with the value passed to the VERSION option.
+# $<VERSION_DASHED> - Replaces occurrences of the placeholder with the value passed to the VERSION
+# option, but with dots replaced by dashes.
+function(_qt_internal_sbom_replace_qa_placeholders)
+    set(opt_args "")
+    set(single_args
+        OUT_VAR
+        VERSION
+    )
+    set(multi_args
+        VALUES
+    )
+
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_OUT_VAR)
+        message(FATAL_ERROR "OUT_VAR must be set")
+    endif()
+
+    set(result "")
+
+    if(arg_VERSION)
+        string(REPLACE "." "-" dashed_version "${arg_VERSION}")
+    endif()
+
+    foreach(value IN LISTS arg_VALUES)
+        if(arg_VERSION)
+            string(REPLACE "$<VERSION>" "${arg_VERSION}" value "${value}")
+            string(REPLACE "$<VERSION_DASHED>" "${dashed_version}" value "${value}")
+        endif()
+
+        list(APPEND result "${value}")
+    endforeach()
+
+    set(${arg_OUT_VAR} "${result}" PARENT_SCOPE)
+endfunction()

cmake/QtPublicSbomCpeHelpers.cmake

@@ -0,0 +1,90 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Computes a security CPE for a given set of attributes.
+#
+# When a part is not specified, a wildcard is added.
+#
+# References:
+# https://spdx.github.io/spdx-spec/v2.3/external-repository-identifiers/#f22-cpe23type
+# https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf
+# https://nvd.nist.gov/products/cpe
+#
+# Each attribute means:
+# 1. part
+# 2. vendor
+# 3. product
+# 4. version
+# 5. update
+# 6. edition
+# 7. language
+# 8. sw_edition
+# 9. target_sw
+# 10. target_hw
+# 11. other
+function(_qt_internal_sbom_compute_security_cpe out_cpe)
+    set(opt_args "")
+    set(single_args
+        PART
+        VENDOR
+        PRODUCT
+        VERSION
+        UPDATE
+        EDITION
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(cpe_template "cpe:2.3:PART:VENDOR:PRODUCT:VERSION:UPDATE:EDITION:*:*:*:*:*")
+
+    set(cpe "${cpe_template}")
+    foreach(attribute_name IN LISTS single_args)
+        if(arg_${attribute_name})
+            set(${attribute_name}_value "${arg_${attribute_name}}")
+        else()
+            if(attribute_name STREQUAL "PART")
+                set(${attribute_name}_value "a")
+            else()
+                set(${attribute_name}_value "*")
+            endif()
+        endif()
+        string(REPLACE "${attribute_name}" "${${attribute_name}_value}" cpe "${cpe}")
+    endforeach()
+
+    set(${out_cpe} "${cpe}" PARENT_SCOPE)
+endfunction()
+
+# Computes the default security CPE for the Qt framework.
+function(_qt_internal_sbom_get_cpe_qt out_var)
+    _qt_internal_sbom_get_root_project_name_lower_case(repo_project_name_lowercase)
+    _qt_internal_sbom_compute_security_cpe(repo_cpe
+        VENDOR "qt"
+        PRODUCT "${repo_project_name_lowercase}"
+        VERSION "${QT_REPO_MODULE_VERSION}"
+    )
+    set(${out_var} "${repo_cpe}" PARENT_SCOPE)
+endfunction()
+
+# Computes the default security CPE for a given qt repository.
+function(_qt_internal_sbom_get_cpe_qt_repo out_var)
+    _qt_internal_sbom_compute_security_cpe(qt_cpe
+        VENDOR "qt"
+        PRODUCT "qt"
+        VERSION "${QT_REPO_MODULE_VERSION}"
+    )
+    set(${out_var} "${qt_cpe}" PARENT_SCOPE)
+endfunction()
+
+# Computes the list of security CPEs for Qt, including both the repo-specific one and generic one.
+function(_qt_internal_sbom_compute_security_cpe_for_qt out_cpe_list)
+    set(cpe_list "")
+
+    _qt_internal_sbom_get_cpe_qt(repo_cpe)
+    list(APPEND cpe_list "${repo_cpe}")
+
+    _qt_internal_sbom_get_cpe_qt_repo(qt_cpe)
+    list(APPEND cpe_list "${qt_cpe}")
+
+    set(${out_cpe_list} "${cpe_list}" PARENT_SCOPE)
+endfunction()

cmake/QtPublicSbomDepHelpers.cmake

@@ -0,0 +1,327 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Walks a target's direct dependencies and assembles a list of relationships between the packages
+# of the target dependencies.
+# Currently handles various Qt targets and system libraries.
+function(_qt_internal_sbom_handle_target_dependencies target)
+    set(opt_args "")
+    set(single_args
+        SPDX_ID
+        OUT_RELATIONSHIPS
+    )
+    set(multi_args
+        LIBRARIES
+        PUBLIC_LIBRARIES
+    )
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_SPDX_ID)
+        message(FATAL_ERROR "SPDX_ID must be set")
+    endif()
+    set(package_spdx_id "${arg_SPDX_ID}")
+
+
+    set(libraries "")
+    if(arg_LIBRARIES)
+        list(APPEND libraries "${arg_LIBRARIES}")
+    endif()
+
+    get_target_property(extend_libraries "${target}" _qt_extend_target_libraries)
+    if(extend_libraries)
+        list(APPEND libraries ${extend_libraries})
+    endif()
+
+    get_target_property(target_type ${target} TYPE)
+    set(valid_target_types
+        EXECUTABLE
+        SHARED_LIBRARY
+        MODULE_LIBRARY
+        STATIC_LIBRARY
+        OBJECT_LIBRARY
+    )
+    if(target_type IN_LIST valid_target_types)
+        get_target_property(link_libraries "${target}" LINK_LIBRARIES)
+        if(link_libraries)
+            list(APPEND libraries ${link_libraries})
+        endif()
+    endif()
+
+    set(public_libraries "")
+    if(arg_PUBLIC_LIBRARIES)
+        list(APPEND public_libraries "${arg_PUBLIC_LIBRARIES}")
+    endif()
+
+    get_target_property(extend_public_libraries "${target}" _qt_extend_target_public_libraries)
+    if(extend_public_libraries)
+        list(APPEND public_libraries ${extend_public_libraries})
+    endif()
+
+    set(sbom_dependencies "")
+    if(arg_SBOM_DEPENDENCIES)
+        list(APPEND sbom_dependencies "${arg_SBOM_DEPENDENCIES}")
+    endif()
+
+    get_target_property(extend_sbom_dependencies "${target}" _qt_extend_target_sbom_dependencies)
+    if(extend_sbom_dependencies)
+        list(APPEND sbom_dependencies ${extend_sbom_dependencies})
+    endif()
+
+    list(REMOVE_DUPLICATES libraries)
+    list(REMOVE_DUPLICATES public_libraries)
+    list(REMOVE_DUPLICATES sbom_dependencies)
+
+    set(all_direct_libraries ${libraries} ${public_libraries} ${sbom_dependencies})
+    list(REMOVE_DUPLICATES all_direct_libraries)
+
+    set(spdx_dependencies "")
+    set(relationships "")
+
+    # Go through each direct linked lib.
+    foreach(direct_lib IN LISTS all_direct_libraries)
+        if(NOT TARGET "${direct_lib}")
+            continue()
+        endif()
+
+        # Some targets are Qt modules, even though they are not prefixed with Qt::, targets
+        # like Bootstrap and QtLibraryInfo. We use the property to differentiate them.
+        get_target_property(is_marked_as_qt_module "${direct_lib}" _qt_sbom_is_qt_module)
+
+        # Custom sbom targets created by _qt_internal_create_sbom_target are always imported, so we
+        # need to differentiate them via this property.
+        get_target_property(is_custom_sbom_target "${direct_lib}" _qt_sbom_is_custom_sbom_target)
+
+        if("${direct_lib}" MATCHES "^(Qt::.*)|(${QT_CMAKE_EXPORT_NAMESPACE}::.*)")
+            set(is_qt_prefixed TRUE)
+        else()
+            set(is_qt_prefixed FALSE)
+        endif()
+
+        # is_qt_dependency is not strictly only a qt dependency, it applies to custom sbom
+        # targets as well. But I'm having a hard time to come up with a better name.
+        if(is_marked_as_qt_module OR is_custom_sbom_target OR is_qt_prefixed)
+            set(is_qt_dependency TRUE)
+        else()
+            set(is_qt_dependency FALSE)
+        endif()
+
+        # Regular Qt dependency, depend on the relevant package, either within the current
+        # document or via an external document.
+        if(is_qt_dependency)
+            _qt_internal_sbom_is_external_target_dependency("${direct_lib}"
+                OUT_VAR is_dependency_in_external_document
+            )
+
+            if(is_dependency_in_external_document)
+                # External document case.
+                _qt_internal_sbom_add_external_target_dependency(
+                    "${package_spdx_id}" "${direct_lib}"
+                    extra_spdx_dependencies
+                    extra_spdx_relationships
+                )
+                if(extra_spdx_dependencies)
+                    list(APPEND spdx_dependencies "${extra_spdx_dependencies}")
+                endif()
+                if(extra_spdx_relationships)
+                    list(APPEND relationships "${extra_spdx_relationships}")
+                endif()
+            else()
+                # Dependency is part of current repo build.
+                _qt_internal_sbom_get_spdx_id_for_target("${direct_lib}" dep_spdx_id)
+                if(dep_spdx_id)
+                    list(APPEND spdx_dependencies "${dep_spdx_id}")
+                else()
+                    message(DEBUG "Could not add target dependency on ${direct_lib} "
+                        "because no spdx id could be found")
+                endif()
+            endif()
+        else()
+            # If it's not a Qt dependency, then it's most likely a 3rd party dependency.
+            # If we are looking at a FindWrap dependency, we need to depend on either
+            # the system or vendored lib, whichever one the FindWrap script points to.
+            # If we are looking at a non-Wrap dependency, it's 99% a system lib.
+            __qt_internal_walk_libs(
+                "${direct_lib}"
+                lib_walked_targets
+                _discarded_out_var
+                "sbom_targets"
+                "collect_targets")
+
+            # Detect if we are dealing with a vendored / bundled lib.
+            set(bundled_targets_found FALSE)
+            if(lib_walked_targets)
+                foreach(lib_walked_target IN LISTS lib_walked_targets)
+                    get_target_property(is_3rdparty_bundled_lib
+                        "${lib_walked_target}" _qt_module_is_3rdparty_library)
+                    _qt_internal_sbom_get_spdx_id_for_target("${lib_walked_target}" lib_spdx_id)
+
+                    # Add a dependency on the vendored lib instead of the Wrap target.
+                    if(is_3rdparty_bundled_lib AND lib_spdx_id)
+                        list(APPEND spdx_dependencies "${lib_spdx_id}")
+                        set(bundled_targets_found TRUE)
+                    endif()
+                endforeach()
+            endif()
+
+            # If no bundled libs were found as a result of walking the Wrap lib, we consider this
+            # a system lib, and add a dependency on it directly.
+            if(NOT bundled_targets_found)
+                _qt_internal_sbom_get_spdx_id_for_target("${direct_lib}" lib_spdx_id)
+                _qt_internal_sbom_is_external_target_dependency("${direct_lib}"
+                    SYSTEM_LIBRARY
+                    OUT_VAR is_dependency_in_external_document
+                )
+
+                if(lib_spdx_id)
+                    if(NOT is_dependency_in_external_document)
+                        list(APPEND spdx_dependencies "${lib_spdx_id}")
+
+                        # Mark the system library is used, so that we later generate an sbom for it.
+                        _qt_internal_append_to_cmake_property_without_duplicates(
+                            _qt_internal_sbom_consumed_system_library_targets
+                            "${direct_lib}"
+                        )
+                    else()
+                        # Refer to the package in the external document. This can be the case
+                        # in a top-level build, where a system library is reused across repos.
+                        _qt_internal_sbom_add_external_target_dependency(
+                            "${package_spdx_id}" "${direct_lib}"
+                            extra_spdx_dependencies
+                            extra_spdx_relationships
+                        )
+                        if(extra_spdx_dependencies)
+                            list(APPEND spdx_dependencies "${extra_spdx_dependencies}")
+                        endif()
+                        if(extra_spdx_relationships)
+                            list(APPEND relationships "${extra_spdx_relationships}")
+                        endif()
+                    endif()
+                else()
+                    message(DEBUG "Could not add target dependency on system library ${direct_lib} "
+                        "because no spdx id could be found")
+                endif()
+            endif()
+        endif()
+    endforeach()
+
+    foreach(dep_spdx_id IN LISTS spdx_dependencies)
+        set(relationship
+            "${package_spdx_id} DEPENDS_ON ${dep_spdx_id}"
+        )
+        list(APPEND relationships "${relationship}")
+    endforeach()
+
+    set(${arg_OUT_RELATIONSHIPS} "${relationships}" PARENT_SCOPE)
+endfunction()
+
+# Checks whether the current target will have its sbom generated into the current repo sbom
+# document, or whether it is present in an external sbom document.
+function(_qt_internal_sbom_is_external_target_dependency target)
+    set(opt_args
+        SYSTEM_LIBRARY
+    )
+    set(single_args
+        OUT_VAR
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    get_target_property(is_imported "${target}" IMPORTED)
+    get_target_property(is_custom_sbom_target "${target}" _qt_sbom_is_custom_sbom_target)
+
+    _qt_internal_sbom_get_root_project_name_lower_case(current_repo_project_name)
+    get_property(target_repo_project_name TARGET ${target}
+        PROPERTY _qt_sbom_spdx_repo_project_name_lowercase)
+
+    if(NOT "${target_repo_project_name}" STREQUAL ""
+            AND NOT "${target_repo_project_name}" STREQUAL "${current_repo_project_name}")
+        set(part_of_other_repo TRUE)
+    else()
+        set(part_of_other_repo FALSE)
+    endif()
+
+    # A target is in an external document if
+    # 1) it is imported, and not a custom sbom target, and not a system library
+    # 2) it was created as part of another repo in a top-level build
+    if((is_imported AND NOT is_custom_sbom_target AND NOT arg_SYSTEM_LIBRARY)
+            OR part_of_other_repo)
+        set(is_dependency_in_external_document TRUE)
+    else()
+        set(is_dependency_in_external_document FALSE)
+    endif()
+
+    set(${arg_OUT_VAR} "${is_dependency_in_external_document}" PARENT_SCOPE)
+endfunction()
+
+# Handles generating an external document reference SDPX element for each target package that is
+# located in a different spdx document.
+function(_qt_internal_sbom_add_external_target_dependency
+        current_package_spdx_id
+        target_dep
+        out_spdx_dependencies
+        out_spdx_relationships
+    )
+    set(target "${target_dep}")
+
+    _qt_internal_sbom_get_spdx_id_for_target("${target}" dep_spdx_id)
+
+    if(NOT dep_spdx_id)
+        message(DEBUG "Could not add external target dependency on ${target} "
+            "because no spdx id could be found")
+        set(${out_spdx_dependencies} "" PARENT_SCOPE)
+        set(${out_spdx_relationships} "" PARENT_SCOPE)
+        return()
+    endif()
+
+    set(spdx_dependencies "")
+    set(spdx_relationships "")
+
+    # Get the external document path and the repo it belongs to for the given target.
+    get_property(relative_installed_repo_document_path TARGET ${target}
+        PROPERTY _qt_sbom_spdx_relative_installed_repo_document_path)
+
+    get_property(project_name_lowercase TARGET ${target}
+        PROPERTY _qt_sbom_spdx_repo_project_name_lowercase)
+
+    if(relative_installed_repo_document_path AND project_name_lowercase)
+        _qt_internal_sbom_get_external_document_ref_spdx_id(
+            "${project_name_lowercase}" external_document_ref)
+
+        get_cmake_property(known_external_document
+            _qt_known_external_documents_${external_document_ref})
+
+        set(relationship
+            "${current_package_spdx_id} DEPENDS_ON ${external_document_ref}:${dep_spdx_id}")
+
+        list(APPEND spdx_relationships "${relationship}")
+
+        # Only add a reference to the external document package, if we haven't done so already.
+        if(NOT known_external_document)
+            set(install_prefixes "")
+
+            get_cmake_property(install_prefix _qt_internal_sbom_install_prefix)
+            list(APPEND install_prefixes "${install_prefix}")
+
+            set(external_document "${relative_installed_repo_document_path}")
+
+            _qt_internal_sbom_generate_add_external_reference(
+                EXTERNAL_DOCUMENT_FILE_PATH "${external_document}"
+                EXTERNAL_DOCUMENT_INSTALL_PREFIXES ${install_prefixes}
+                EXTERNAL_DOCUMENT_SPDX_ID "${external_document_ref}"
+            )
+
+            set_property(GLOBAL PROPERTY
+                _qt_known_external_documents_${external_document_ref} TRUE)
+            set_property(GLOBAL APPEND PROPERTY
+                _qt_known_external_documents "${external_document_ref}")
+        endif()
+    else()
+        message(WARNING "Missing spdx document path for external ref: "
+            "package_name_for_spdx_id ${package_name_for_spdx_id} direct_lib ${direct_lib}")
+    endif()
+
+    set(${out_spdx_dependencies} "${spdx_dependencies}" PARENT_SCOPE)
+    set(${out_spdx_relationships} "${spdx_relationships}" PARENT_SCOPE)
+endfunction()

cmake/QtPublicSbomLicenseHelpers.cmake

@@ -0,0 +1,108 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Adds a license id and its text to the sbom.
+function(_qt_internal_sbom_add_license)
+    if(NOT QT_GENERATE_SBOM)
+        return()
+    endif()
+
+    set(opt_args
+        NO_LICENSE_REF_PREFIX
+    )
+    set(single_args
+        LICENSE_ID
+        LICENSE_PATH
+        EXTRACTED_TEXT
+    )
+    set(multi_args
+    )
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_LICENSE_ID)
+        message(FATAL_ERROR "LICENSE_ID must be set")
+    endif()
+
+    if(NOT arg_TEXT AND NOT arg_LICENSE_PATH)
+        message(FATAL_ERROR "Either TEXT or LICENSE_PATH must be set")
+    endif()
+
+    # Sanitize the content a bit.
+    if(arg_TEXT)
+        set(text "${arg_TEXT}")
+        string(REPLACE ";" "$<SEMICOLON>" text "${text}")
+        string(REPLACE "\"" "\\\"" text "${text}")
+    else()
+        file(READ "${arg_LICENSE_PATH}" text)
+        string(REPLACE ";" "$<SEMICOLON>" text "${text}")
+        string(REPLACE "\"" "\\\"" text "${text}")
+    endif()
+
+    set(license_id "${arg_LICENSE_ID}")
+    if(NOT arg_NO_LICENSE_REF_PREFIX)
+        set(license_id "LicenseRef-${license_id}")
+    endif()
+
+    _qt_internal_sbom_generate_add_license(
+        LICENSE_ID "${license_id}"
+        EXTRACTED_TEXT "<text>${text}</text>"
+    )
+endfunction()
+
+# Get a qt spdx license expression given the id.
+function(_qt_internal_sbom_get_spdx_license_expression id out_var)
+    set(license "")
+
+    # The default for modules / plugins
+    if(id STREQUAL "QT_DEFAULT" OR id STREQUAL "QT_COMMERCIAL_OR_LGPL3")
+        set(license "LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only")
+
+    # For commercial only entities
+    elseif(id STREQUAL "QT_COMMERCIAL")
+        set(license "LicenseRef-Qt-Commercial")
+
+    # For GPL3 only modules
+    elseif(id STREQUAL "QT_COMMERCIAL_OR_GPL3")
+        set(license "LicenseRef-Qt-Commercial OR GPL-3.0-only")
+
+    # For tools and apps
+    elseif(id STREQUAL "QT_COMMERCIAL_OR_GPL3_WITH_EXCEPTION")
+        set(license "LicenseRef-Qt-Commercial OR GPL-3.0-only WITH Qt-GPL-exception-1.0")
+
+    # For things like the qtmain library
+    elseif(id STREQUAL "QT_COMMERCIAL_OR_BSD3")
+        set(license "LicenseRef-Qt-Commercial OR BSD-3-Clause")
+
+    # For documentation
+    elseif(id STREQUAL "QT_COMMERCIAL_OR_GFDL1_3")
+        set(license "LicenseRef-Qt-Commercial OR GFDL-1.3-no-invariants-only")
+
+    # For examples and the like
+    elseif(id STREQUAL "BSD3")
+        set(license "BSD-3-Clause")
+
+    endif()
+
+    if(NOT license)
+        message(FATAL_ERROR "No SPDX license expression found for id: ${id}")
+    endif()
+
+    set(${out_var} "${license}" PARENT_SCOPE)
+endfunction()
+
+# Joins two license IDs with the given ${op}, avoiding parenthesis when possible.
+function(_qt_internal_sbom_join_two_license_ids_with_op left_id op right_id out_var)
+    if(NOT left_id)
+        set(${out_var} "${right_id}" PARENT_SCOPE)
+        return()
+    endif()
+
+    if(NOT right_id)
+        set(${out_var} "${left_id}" PARENT_SCOPE)
+        return()
+    endif()
+
+    set(value "(${left_id}) ${op} (${right_id})")
+    set(${out_var} "${value}" PARENT_SCOPE)
+endfunction()

cmake/QtPublicSbomOpsHelpers.cmake

@@ -0,0 +1,579 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# Copyright (C) 2023-2024 Jochem Rutgers
+# SPDX-License-Identifier: MIT AND BSD-3-Clause
+
+# Handles the look up of Python, Python spdx dependencies and other various post-installation steps
+# like NTIA validation, auditing, json generation, etc.
+function(_qt_internal_sbom_setup_project_ops_generation)
+    set(opt_args
+        GENERATE_JSON
+        GENERATE_JSON_REQUIRED
+        GENERATE_SOURCE_SBOM
+        VERIFY_SBOM
+        VERIFY_SBOM_REQUIRED
+        VERIFY_NTIA_COMPLIANT
+        LINT_SOURCE_SBOM
+        LINT_SOURCE_SBOM_NO_ERROR
+        SHOW_TABLE
+        AUDIT
+        AUDIT_NO_ERROR
+    )
+    set(single_args "")
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(arg_GENERATE_JSON AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        set(op_args
+            OP_KEY "GENERATE_JSON"
+            OUT_VAR_DEPS_FOUND deps_found
+        )
+        if(arg_GENERATE_JSON_REQUIRED)
+            list(APPEND op_args REQUIRED)
+        endif()
+
+        _qt_internal_sbom_find_and_handle_sbom_op_dependencies(${op_args})
+        if(deps_found)
+            _qt_internal_sbom_generate_json()
+        endif()
+    endif()
+
+    if(arg_VERIFY_SBOM AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        set(op_args
+            OP_KEY "VERIFY_SBOM"
+            OUT_VAR_DEPS_FOUND deps_found
+        )
+        if(arg_VERIFY_SBOM_REQUIRED)
+            list(APPEND op_args REQUIRED)
+        endif()
+
+        _qt_internal_sbom_find_and_handle_sbom_op_dependencies(${op_args})
+        if(deps_found)
+            _qt_internal_sbom_verify_valid()
+        endif()
+    endif()
+
+    if(arg_VERIFY_NTIA_COMPLIANT AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        _qt_internal_sbom_find_and_handle_sbom_op_dependencies(REQUIRED OP_KEY "RUN_NTIA")
+        _qt_internal_sbom_verify_ntia_compliant()
+    endif()
+
+    if(arg_SHOW_TABLE AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        _qt_internal_sbom_find_python_dependency_program(NAME sbom2doc REQUIRED)
+        _qt_internal_sbom_show_table()
+    endif()
+
+    if(arg_AUDIT AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        set(audit_no_error_option "")
+        if(arg_AUDIT_NO_ERROR)
+            set(audit_no_error_option NO_ERROR)
+        endif()
+        _qt_internal_sbom_find_python_dependency_program(NAME sbomaudit REQUIRED)
+        _qt_internal_sbom_audit(${audit_no_error_option})
+    endif()
+
+    if(arg_GENERATE_SOURCE_SBOM AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        _qt_internal_sbom_find_python_dependency_program(NAME reuse REQUIRED)
+        _qt_internal_sbom_generate_reuse_source_sbom()
+    endif()
+
+    if(arg_LINT_SOURCE_SBOM AND NOT QT_INTERNAL_NO_SBOM_PYTHON_OPS)
+        set(lint_no_error_option "")
+        if(arg_LINT_SOURCE_SBOM_NO_ERROR)
+            set(lint_no_error_option NO_ERROR)
+        endif()
+        _qt_internal_sbom_find_python_dependency_program(NAME reuse REQUIRED)
+        _qt_internal_sbom_run_reuse_lint(
+            ${lint_no_error_option}
+            BUILD_TIME_SCRIPT_PATH_OUT_VAR reuse_lint_script
+        )
+    endif()
+endfunction()
+
+# Helper to find a python interpreter and a specific python dependency, e.g. to be able to generate
+# a SPDX JSON SBOM, or run post-installation steps like NTIA verification.
+# The exact dependency should be specified as the OP_KEY.
+#
+# Caches the found python executable in a separate cache var QT_INTERNAL_SBOM_PYTHON_EXECUTABLE, to
+# avoid conflicts with any other found python interpreter.
+function(_qt_internal_sbom_find_and_handle_sbom_op_dependencies)
+    set(opt_args
+        REQUIRED
+    )
+    set(single_args
+        OP_KEY
+        OUT_VAR_DEPS_FOUND
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_OP_KEY)
+        message(FATAL_ERROR "OP_KEY is required")
+    endif()
+
+    set(supported_ops "GENERATE_JSON" "VERIFY_SBOM" "RUN_NTIA")
+
+    if(arg_OP_KEY STREQUAL "GENERATE_JSON" OR arg_OP_KEY STREQUAL "VERIFY_SBOM")
+        set(import_statement "import spdx_tools.spdx.clitools.pyspdxtools")
+    elseif(arg_OP_KEY STREQUAL "RUN_NTIA")
+        set(import_statement "import ntia_conformance_checker.main")
+    else()
+        message(FATAL_ERROR "OP_KEY must be one of ${supported_ops}")
+    endif()
+
+    # Return early if we found the dependencies.
+    if(QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${arg_OP_KEY})
+        if(arg_OUT_VAR_DEPS_FOUND)
+            set(${arg_OUT_VAR_DEPS_FOUND} TRUE PARENT_SCOPE)
+        endif()
+        return()
+    endif()
+
+    # NTIA-compliance checker requires Python 3.9 or later, so we use it as the minimum for all
+    # SBOM OPs.
+    set(required_version "3.9")
+
+    set(python_common_args
+        VERSION "${required_version}"
+    )
+
+    set(everything_found FALSE)
+
+    # On macOS FindPython prefers looking in the system framework location, but that usually would
+    # not have the required dependencies. So we first look in it, and then fallback to any other
+    # non-framework python found.
+    if(CMAKE_HOST_APPLE)
+        set(extra_python_args SEARCH_IN_FRAMEWORKS QUIET)
+        _qt_internal_sbom_find_python_and_dependency_helper_lambda()
+    endif()
+
+    if(NOT everything_found)
+        set(extra_python_args QUIET)
+        _qt_internal_sbom_find_python_and_dependency_helper_lambda()
+    endif()
+
+    if(NOT everything_found)
+        if(arg_REQUIRED)
+            set(message_type "FATAL_ERROR")
+        else()
+            set(message_type "DEBUG")
+        endif()
+
+        if(NOT python_found)
+            # Look for python one more time, this time without QUIET, to show an error why it
+            # wasn't found.
+            if(arg_REQUIRED)
+                _qt_internal_sbom_find_python_helper(${python_common_args}
+                    OUT_VAR_PYTHON_PATH unused_python
+                    OUT_VAR_PYTHON_FOUND unused_found
+                )
+            endif()
+            message(${message_type} "Python ${required_version} for running SBOM ops not found.")
+        elseif(NOT dep_found)
+            message(${message_type} "Python dependency for running SBOM op ${arg_OP_KEY} "
+                "not found:\n Python: ${python_path} \n Output: \n${dep_find_output}")
+        endif()
+    else()
+        message(DEBUG "Using Python ${python_path} for running SBOM ops.")
+
+        if(NOT QT_INTERNAL_SBOM_PYTHON_EXECUTABLE)
+            set(QT_INTERNAL_SBOM_PYTHON_EXECUTABLE "${python_path}" CACHE INTERNAL
+                "Python interpeter used for SBOM generation.")
+        endif()
+
+        set(QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${arg_OP_KEY} "TRUE" CACHE INTERNAL
+            "All dependencies found to run SBOM OP ${arg_OP_KEY}")
+    endif()
+
+    if(arg_OUT_VAR_DEPS_FOUND)
+        set(${arg_OUT_VAR_DEPS_FOUND} "${QT_INTERNAL_SBOM_DEPS_FOUND_FOR_${arg_OP_KEY}}"
+            PARENT_SCOPE)
+    endif()
+endfunction()
+
+# Helper to generate a SPDX JSON file from a tag/value format file.
+# This also implies some additional validity checks, useful to ensure a proper sbom file.
+function(_qt_internal_sbom_generate_json)
+    if(NOT QT_INTERNAL_SBOM_PYTHON_EXECUTABLE)
+        message(FATAL_ERROR "Python interpreter not found for generating SBOM json file.")
+    endif()
+    if(NOT QT_INTERNAL_SBOM_DEPS_FOUND_FOR_GENERATE_JSON)
+        message(FATAL_ERROR "Python dependencies not found for generating SBOM json file.")
+    endif()
+
+    set(content "
+        message(STATUS \"Generating JSON: \${QT_SBOM_OUTPUT_PATH}.json\")
+        execute_process(
+            COMMAND ${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE} -m spdx_tools.spdx.clitools.pyspdxtools
+            -i \"\${QT_SBOM_OUTPUT_PATH}\" -o \"\${QT_SBOM_OUTPUT_PATH}.json\"
+            RESULT_VARIABLE res
+        )
+        if(NOT res EQUAL 0)
+            message(FATAL_ERROR \"SBOM conversion to JSON failed: \${res}\")
+        endif()
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(verify_sbom "${sbom_dir}/convert_to_json.cmake")
+    file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}")
+endfunction()
+
+# Helper to generate a tag/value SPDX file from a SPDX JSON format file.
+#
+# Will be used by WebEngine to convert the Chromium JSON file to a tag/value SPDX file.
+#
+# This conversion needs to happen before the document is referenced in the SBOM generation process,
+# so that the file already exists when it is parsed for its unique id and namespace.
+# It also needs to happen before verification codes are computed for the current document
+# that will depend on the target one, to ensure the the file exists and its checksum can be
+# computed.
+#
+# OPERATION_ID - a unique id for the operation, used to generate a unique cmake file name for
+# the SBOM generation process.
+#
+# INPUT_JSON_PATH - the absolute path to the input JSON file.
+#
+# OUTPUT_FILE_PATH - the absolute path where to create the output tag/value SPDX file.
+# Note that if the output file path is set, it is up to the caller to also copy / install the file
+# into the build and install directories where the build system expects to find all external
+# document references.
+#
+# OUTPUT_FILE_NAME - when OUTPUT_FILE_PATH is not specified, the output directory is automatically
+# set to the SBOM output directory. In this case OUTPUT_FILE_NAME can be used to override the
+# outout file name. If not specified, it will be derived from the input file name.
+#
+# OUT_VAR_OUTPUT_FILE_NAME - output variable where to store the output file.
+#
+# OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH - output variable where to store the output file path.
+# Note that the path will contain an unresolved '${QT_SBOM_OUTPUT_DIR}' which only has a value at
+# install time. So the path can't be used sensibly during configure time.
+function(_qt_internal_sbom_generate_tag_value_spdx_document)
+    if(NOT QT_GENERATE_SBOM)
+        return()
+    endif()
+
+    set(opt_args "")
+    set(single_args
+        OPERATION_ID
+        INPUT_JSON_FILE_PATH
+        OUTPUT_FILE_PATH
+        OUTPUT_FILE_NAME
+        OUT_VAR_OUTPUT_FILE_NAME
+        OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT QT_INTERNAL_SBOM_PYTHON_EXECUTABLE)
+        message(FATAL_ERROR "Python interpreter not found for generating tag/value file from JSON.")
+    endif()
+    if(NOT QT_INTERNAL_SBOM_DEPS_FOUND_FOR_GENERATE_JSON)
+        message(FATAL_ERROR
+            "Python dependencies not found for generating tag/value file from JSON.")
+    endif()
+
+    if(NOT arg_OPERATION_ID)
+        message(FATAL_ERROR "OPERATION_ID is required")
+    endif()
+
+    if(NOT arg_INPUT_JSON_FILE_PATH)
+        message(FATAL_ERROR "INPUT_JSON_FILE_PATH is required")
+    endif()
+
+    if(arg_OUTPUT_FILE_PATH)
+        set(output_path "${arg_OUTPUT_FILE_PATH}")
+    else()
+        if(arg_OUTPUT_FILE_NAME)
+            set(output_name "${arg_OUTPUT_FILE_NAME}")
+        else()
+            # Use the input file name without the last extension (without .json) as the output name.
+            get_filename_component(output_name "${arg_INPUT_JSON_FILE_PATH}" NAME_WLE)
+        endif()
+        set(output_path "\${QT_SBOM_OUTPUT_DIR}/${output_name}")
+    endif()
+
+    if(arg_OUT_VAR_OUTPUT_FILE_NAME)
+        get_filename_component(output_name_resolved "${output_path}" NAME)
+        set(${arg_OUT_VAR_OUTPUT_FILE_NAME} "${output_name_resolved}" PARENT_SCOPE)
+    endif()
+
+    if(arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH)
+        set(${arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH} "${output_path}" PARENT_SCOPE)
+    endif()
+
+    set(content "
+        message(STATUS
+            \"Generating tag/value SPDX document: ${output_path} from \"
+        \"${arg_INPUT_JSON_FILE_PATH}\")
+        execute_process(
+            COMMAND ${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE} -m spdx_tools.spdx.clitools.pyspdxtools
+            -i \"${arg_INPUT_JSON_FILE_PATH}\" -o \"${output_path}\"
+            RESULT_VARIABLE res
+        )
+        if(NOT res EQUAL 0)
+            message(FATAL_ERROR \"SBOM conversion to tag/value failed: \${res}\")
+        endif()
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(convert_sbom "${sbom_dir}/convert_to_tag_value_${arg_OPERATION_ID}.cmake")
+    file(GENERATE OUTPUT "${convert_sbom}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_include_files
+        "${convert_sbom}")
+endfunction()
+
+# Helper to verify the generated sbom is valid.
+function(_qt_internal_sbom_verify_valid)
+    if(NOT QT_INTERNAL_SBOM_PYTHON_EXECUTABLE)
+        message(FATAL_ERROR "Python interpreter not found for verifying SBOM file.")
+    endif()
+
+    if(NOT QT_INTERNAL_SBOM_DEPS_FOUND_FOR_VERIFY_SBOM)
+        message(FATAL_ERROR "Python dependencies not found for verifying SBOM file")
+    endif()
+
+    set(content "
+        message(STATUS \"Verifying: \${QT_SBOM_OUTPUT_PATH}\")
+        execute_process(
+            COMMAND ${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE} -m spdx_tools.spdx.clitools.pyspdxtools
+            -i \"\${QT_SBOM_OUTPUT_PATH}\"
+            RESULT_VARIABLE res
+        )
+        if(NOT res EQUAL 0)
+            message(FATAL_ERROR \"SBOM verification failed: \${res}\")
+        endif()
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(verify_sbom "${sbom_dir}/verify_valid.cmake")
+    file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}")
+endfunction()
+
+# Helper to verify the generated sbom is NTIA compliant.
+function(_qt_internal_sbom_verify_ntia_compliant)
+    if(NOT QT_INTERNAL_SBOM_PYTHON_EXECUTABLE)
+        message(FATAL_ERROR "Python interpreter not found for verifying SBOM file.")
+    endif()
+
+    if(NOT QT_INTERNAL_SBOM_DEPS_FOUND_FOR_RUN_NTIA)
+        message(FATAL_ERROR "Python dependencies not found for running the SBOM NTIA checker.")
+    endif()
+
+    set(content "
+        message(STATUS \"Checking for NTIA compliance: \${QT_SBOM_OUTPUT_PATH}\")
+        execute_process(
+            COMMAND ${QT_INTERNAL_SBOM_PYTHON_EXECUTABLE} -m ntia_conformance_checker.main
+            --file \"\${QT_SBOM_OUTPUT_PATH}\"
+            RESULT_VARIABLE res
+        )
+        if(NOT res EQUAL 0)
+            message(FATAL_ERROR \"SBOM NTIA verification failed: \{res}\")
+        endif()
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(verify_sbom "${sbom_dir}/verify_ntia.cmake")
+    file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}")
+endfunction()
+
+# Helper to show the main sbom document info in the form of a CLI table.
+function(_qt_internal_sbom_show_table)
+    set(extra_code_begin "")
+    if(DEFINED ENV{COIN_UNIQUE_JOB_ID})
+        # The output of the process dynamically adjusts the width of the shown table based on the
+        # console width. In the CI, the width is very short for some reason, and thus the output
+        # is truncated in the CI log. Explicitly set a bigger width to avoid this.
+        set(extra_code_begin "
+set(backup_env_columns \$ENV{COLUMNS})
+set(ENV{COLUMNS} 150)
+")
+set(extra_code_end "
+set(ENV{COLUMNS} \${backup_env_columns})
+")
+    endif()
+
+    set(content "
+        message(STATUS \"Showing main SBOM document info: \${QT_SBOM_OUTPUT_PATH}\")
+
+        ${extra_code_begin}
+        execute_process(
+            COMMAND ${QT_SBOM_PROGRAM_SBOM2DOC} -i \"\${QT_SBOM_OUTPUT_PATH}\"
+            RESULT_VARIABLE res
+        )
+        ${extra_code_end}
+        if(NOT res EQUAL 0)
+            message(FATAL_ERROR \"Showing SBOM document failed: \${res}\")
+        endif()
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(verify_sbom "${sbom_dir}/show_table.cmake")
+    file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}")
+endfunction()
+
+# Helper to audit the generated sbom.
+function(_qt_internal_sbom_audit)
+    set(opt_args NO_ERROR)
+    set(single_args "")
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(handle_error "")
+    if(NOT arg_NO_ERROR)
+        set(handle_error "
+            if(NOT res EQUAL 0)
+                message(FATAL_ERROR \"SBOM Audit failed: \${res}\")
+            endif()
+")
+    endif()
+
+    set(content "
+        message(STATUS \"Auditing SBOM: \${QT_SBOM_OUTPUT_PATH}\")
+        execute_process(
+            COMMAND ${QT_SBOM_PROGRAM_SBOMAUDIT} -i \"\${QT_SBOM_OUTPUT_PATH}\"
+                    --disable-license-check --cpecheck --offline
+            RESULT_VARIABLE res
+        )
+        ${handle_error}
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(verify_sbom "${sbom_dir}/audit.cmake")
+    file(GENERATE OUTPUT "${verify_sbom}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${verify_sbom}")
+endfunction()
+
+# Returns path to project's potential root source reuse.toml file.
+function(_qt_internal_sbom_get_project_reuse_toml_path out_var)
+    set(reuse_toml_path "${PROJECT_SOURCE_DIR}/REUSE.toml")
+    set(${out_var} "${reuse_toml_path}" PARENT_SCOPE)
+endfunction()
+
+# Helper to generate and install a source SBOM using reuse.
+function(_qt_internal_sbom_generate_reuse_source_sbom)
+    set(opt_args NO_ERROR)
+    set(single_args "")
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(file_op "${sbom_dir}/generate_reuse_source_sbom.cmake")
+
+    _qt_internal_sbom_get_project_reuse_toml_path(reuse_toml_path)
+    if(NOT EXISTS "${reuse_toml_path}" AND NOT QT_FORCE_SOURCE_SBOM_GENERATION)
+        set(skip_message
+            "Skipping source SBOM generation: No reuse.toml file found at '${reuse_toml_path}'.")
+        message(STATUS "${skip_message}")
+
+        set(content "
+            message(STATUS \"${skip_message}\")
+")
+
+        file(GENERATE OUTPUT "${file_op}" CONTENT "${content}")
+        set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_post_generation_include_files
+            "${file_op}")
+        return()
+    endif()
+
+    set(handle_error "")
+    if(NOT arg_NO_ERROR)
+        set(handle_error "
+            if(NOT res EQUAL 0)
+                message(FATAL_ERROR \"Source SBOM generation using reuse tool failed: \${res}\")
+            endif()
+")
+    endif()
+
+    set(source_sbom_path "\${QT_SBOM_OUTPUT_PATH_WITHOUT_EXT}.source.spdx")
+
+    set(content "
+        message(STATUS \"Generating source SBOM using reuse tool: ${source_sbom_path}\")
+        execute_process(
+            COMMAND ${QT_SBOM_PROGRAM_REUSE} --root \"${PROJECT_SOURCE_DIR}\" spdx
+                    -o ${source_sbom_path}
+            RESULT_VARIABLE res
+        )
+        ${handle_error}
+")
+
+    file(GENERATE OUTPUT "${file_op}" CONTENT "${content}")
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_post_generation_include_files "${file_op}")
+endfunction()
+
+# Helper to run 'reuse lint' on the project source dir.
+function(_qt_internal_sbom_run_reuse_lint)
+    set(opt_args
+        NO_ERROR
+    )
+    set(single_args
+        BUILD_TIME_SCRIPT_PATH_OUT_VAR
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    # If no reuse.toml file exists, it means the repo is likely not reuse compliant yet,
+    # so we shouldn't error out during installation when running the lint.
+    _qt_internal_sbom_get_project_reuse_toml_path(reuse_toml_path)
+    if(NOT EXISTS "${reuse_toml_path}" AND NOT QT_FORCE_REUSE_LINT_ERROR)
+        set(arg_NO_ERROR TRUE)
+    endif()
+
+    set(handle_error "")
+    if(NOT arg_NO_ERROR)
+        set(handle_error "
+            if(NOT res EQUAL 0)
+                message(FATAL_ERROR \"Running 'reuse lint' failed: \${res}\")
+            endif()
+")
+    endif()
+
+    set(content "
+        message(STATUS \"Running 'reuse lint' in '${PROJECT_SOURCE_DIR}'.\")
+        execute_process(
+            COMMAND ${QT_SBOM_PROGRAM_REUSE} --root \"${PROJECT_SOURCE_DIR}\" lint
+            RESULT_VARIABLE res
+        )
+        ${handle_error}
+")
+
+    _qt_internal_get_current_project_sbom_dir(sbom_dir)
+    set(file_op_build "${sbom_dir}/run_reuse_lint_build.cmake")
+    file(GENERATE OUTPUT "${file_op_build}" CONTENT "${content}")
+
+    # Allow skipping running 'reuse lint' during installation. But still allow running it during
+    # build time. This is a fail safe opt-out in case some repo needs it.
+    if(QT_FORCE_SKIP_REUSE_LINT_ON_INSTALL)
+        set(skip_message "Skipping running 'reuse lint' in '${PROJECT_SOURCE_DIR}'.")
+
+        set(content "
+            message(STATUS \"${skip_message}\")
+")
+        set(file_op_install "${sbom_dir}/run_reuse_lint_install.cmake")
+        file(GENERATE OUTPUT "${file_op_install}" CONTENT "${content}")
+    else()
+        # Just reuse the already generated script for installation as well.
+        set(file_op_install "${file_op_build}")
+    endif()
+
+    set_property(GLOBAL APPEND PROPERTY _qt_sbom_cmake_verify_include_files "${file_op_install}")
+
+    if(arg_BUILD_TIME_SCRIPT_PATH_OUT_VAR)
+        set(${arg_BUILD_TIME_SCRIPT_PATH_OUT_VAR} "${file_op_build}" PARENT_SCOPE)
+    endif()
+endfunction()

cmake/QtPublicSbomPurlHelpers.cmake

@@ -0,0 +1,446 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Parse purl arguments for a specific purl variant, e.g. for parsing all values of arg_PURL_QT_ARGS.
+# arguments_var_name is the variable name that contains the args.
+macro(_qt_internal_sbom_parse_purl_variant_options prefix arguments_var_name)
+    _qt_internal_get_sbom_purl_parsing_options(purl_opt_args purl_single_args purl_multi_args)
+
+    cmake_parse_arguments(arg "${purl_opt_args}" "${purl_single_args}" "${purl_multi_args}"
+        ${${arguments_var_name}})
+    _qt_internal_validate_all_args_are_parsed(arg)
+endmacro()
+
+# Returns a vcs url where for purls where qt entities of the current repo are hosted.
+function(_qt_internal_sbom_get_qt_entity_vcs_url target)
+    set(opt_args "")
+    set(single_args
+        REPO_NAME
+        VERSION
+        OUT_VAR
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_REPO_NAME)
+        message(FATAL_ERROR "REPO_NAME must be set")
+    endif()
+
+    if(NOT arg_OUT_VAR)
+        message(FATAL_ERROR "OUT_VAR must be set")
+    endif()
+
+    set(version_part "")
+    if(arg_VERSION)
+        set(version_part "@${arg_VERSION}")
+    endif()
+
+    set(vcs_url "https://code.qt.io/qt/${arg_REPO_NAME}.git${version_part}")
+    set(${arg_OUT_VAR} "${vcs_url}" PARENT_SCOPE)
+endfunction()
+
+# Returns a relative path to the source where the target was created, to be embedded into a
+# mirror purl as a subpath.
+function(_qt_internal_sbom_get_qt_entity_repo_source_dir target)
+    set(opt_args "")
+    set(single_args
+        OUT_VAR
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_OUT_VAR)
+        message(FATAL_ERROR "OUT_VAR must be set")
+    endif()
+
+    get_target_property(repo_source_dir "${target}" SOURCE_DIR)
+
+    # Get the path relative to the PROJECT_SOURCE_DIR
+    file(RELATIVE_PATH relative_repo_source_dir "${PROJECT_SOURCE_DIR}" "${repo_source_dir}")
+
+    set(sub_path "${relative_repo_source_dir}")
+    set(${arg_OUT_VAR} "${sub_path}" PARENT_SCOPE)
+endfunction()
+
+# Handles purl arguments specified to functions like qt_internal_add_sbom.
+# Currently accepts arguments for 3 variants of purls, each of which will generate a separate purl.
+# If no arguments are specified, for qt entity types, default values will be chosen.
+#
+# Purl variants:
+# - PURL_QT_ARGS
+#       args to override Qt's generic purl for Qt modules or patched 3rd party libs
+#       defaults to something like pkg:generic/TheQtCompany/${repo_name}-${target}@SHA1
+# - PURL_MIRROR_ARGS
+#       args to override Qt's mirror purl, which is hosted on github
+#       defaults to something like pkg:github/qt/${repo_name}@SHA1
+# - PURL_3RDPARTY_UPSTREAM_ARGS
+#       args to specify a purl pointing to an upstream repo, usually to github or another forge
+#       no defaults, but could look like: pkg:github/harfbuzz/harfbuzz@v8.5.0
+# Example values for harfbuzz:
+#     PURL_3RDPARTY_UPSTREAM_ARGS
+#         PURL_TYPE "github"
+#         PURL_NAMESPACE "harfbuzz"
+#         PURL_NAME "harfbuzz"
+#         PURL_VERSION "v8.5.0" # tag
+function(_qt_internal_sbom_handle_purl_values target)
+    _qt_internal_get_sbom_purl_handling_options(opt_args single_args multi_args)
+    list(APPEND single_args OUT_VAR)
+
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_OUT_VAR)
+        message(FATAL_ERROR "OUT_VAR must be set")
+    endif()
+
+    # List of purl variants to process.
+    set(purl_variants "")
+
+    _qt_internal_sbom_get_git_version_vars()
+
+    set(third_party_types
+        QT_THIRD_PARTY_MODULE
+        QT_THIRD_PARTY_SOURCES
+    )
+
+    if(arg_IS_QT_ENTITY_TYPE)
+        # Qt entities have two purls by default, a QT generic one and a MIRROR hosted on github.
+        list(APPEND purl_variants MIRROR QT)
+    elseif(arg_TYPE IN_LIST third_party_types)
+        # Third party libraries vendored in Qt also have at least two purls, like regular Qt
+        # libraries, but might also have an upstream one.
+
+        # The order in which the purls are generated matters for tools that consume the SBOM. Some
+        # tools can only handle one PURL per package, so the first one should be the important one.
+        # For now, I deem that the upstream one if present. Otherwise the github mirror.
+        if(arg_PURL_3RDPARTY_UPSTREAM_ARGS)
+            list(APPEND purl_variants 3RDPARTY_UPSTREAM)
+        endif()
+
+        list(APPEND purl_variants MIRROR QT)
+    else()
+        # If handling another entity type, handle based on whether any of the purl arguments are
+        # set.
+        set(known_purl_variants QT MIRROR 3RDPARTY_UPSTREAM)
+        foreach(known_purl_variant IN LISTS known_purl_variants)
+            if(arg_PURL_${known_purl_variant}_ARGS)
+                list(APPEND purl_variants ${known_purl_variant})
+            endif()
+        endforeach()
+    endif()
+
+    if(arg_IS_QT_ENTITY_TYPE
+            OR arg_TYPE STREQUAL "QT_THIRD_PARTY_MODULE"
+            OR arg_TYPE STREQUAL "QT_THIRD_PARTY_SOURCES"
+        )
+        set(is_qt_purl_entity_type TRUE)
+    else()
+        set(is_qt_purl_entity_type FALSE)
+    endif()
+
+    _qt_internal_get_sbom_purl_parsing_options(purl_opt_args purl_single_args purl_multi_args)
+
+    set(project_package_options "")
+
+    foreach(purl_variant IN LISTS purl_variants)
+        # Clear previous values.
+        foreach(option_name IN LISTS purl_opt_args purl_single_args purl_multi_args)
+            unset(arg_${option_name})
+        endforeach()
+
+        _qt_internal_sbom_parse_purl_variant_options(arg arg_PURL_${purl_variant}_ARGS)
+
+        # Check if custom purl args were specified.
+        set(purl_args_available FALSE)
+        if(arg_PURL_${purl_variant}_ARGS)
+            set(purl_args_available TRUE)
+        endif()
+
+        # We want to create a purl either if it's one of Qt's entities and one of it's default
+        # purl types, or if custom args were specified.
+        set(consider_purl_processing FALSE)
+        if((purl_args_available OR is_qt_purl_entity_type) AND NOT arg_NO_PURL)
+            set(consider_purl_processing TRUE)
+        endif()
+
+        if(consider_purl_processing)
+            set(purl_args "")
+
+            # Override the purl version with the package version.
+            if(arg_PURL_USE_PACKAGE_VERSION AND arg_VERSION)
+                set(arg_PURL_VERSION "${arg_VERSION}")
+            endif()
+
+            # Append a vcs_url to the qualifiers if specified.
+            if(arg_PURL_VCS_URL)
+                list(APPEND arg_PURL_QUALIFIERS "vcs_url=${arg_PURL_VCS_URL}")
+            endif()
+
+            _qt_internal_forward_function_args(
+                FORWARD_APPEND
+                FORWARD_PREFIX arg
+                FORWARD_OUT_VAR purl_args
+                FORWARD_OPTIONS
+                    ${purl_opt_args}
+                FORWARD_SINGLE
+                    ${purl_single_args}
+                FORWARD_MULTI
+                    ${purl_multi_args}
+            )
+
+            # Qt entity types get special treatment purl.
+            if(is_qt_purl_entity_type AND NOT arg_NO_DEFAULT_QT_PURL AND
+                    (purl_variant STREQUAL "QT" OR purl_variant STREQUAL "MIRROR"))
+                _qt_internal_sbom_get_root_project_name_lower_case(repo_project_name_lowercase)
+
+                # Add a vcs_url to the generic QT variant.
+                if(purl_variant STREQUAL "QT")
+                    set(entity_vcs_url_version_option "")
+                    # Can be empty.
+                    if(QT_SBOM_GIT_HASH_SHORT)
+                        set(entity_vcs_url_version_option VERSION "${QT_SBOM_GIT_HASH_SHORT}")
+                    endif()
+
+                    _qt_internal_sbom_get_qt_entity_vcs_url(${target}
+                        REPO_NAME "${repo_project_name_lowercase}"
+                        ${entity_vcs_url_version_option}
+                        OUT_VAR vcs_url)
+                    list(APPEND purl_args PURL_QUALIFIERS "vcs_url=${vcs_url}")
+                endif()
+
+                # Add the subdirectory path where the target was created as a custom qualifier.
+                _qt_internal_sbom_get_qt_entity_repo_source_dir(${target} OUT_VAR sub_path)
+                if(sub_path)
+                    list(APPEND purl_args PURL_SUBPATH "${sub_path}")
+                endif()
+
+                # Add the target name as a custom qualifer.
+                list(APPEND purl_args PURL_QUALIFIERS "library_name=${target}")
+
+                # Can be empty.
+                if(QT_SBOM_GIT_HASH_SHORT)
+                    list(APPEND purl_args VERSION "${QT_SBOM_GIT_HASH_SHORT}")
+                endif()
+
+                # Get purl args the Qt entity type, taking into account defaults.
+                _qt_internal_sbom_get_qt_entity_purl_args(${target}
+                    NAME "${repo_project_name_lowercase}-${target}"
+                    REPO_NAME "${repo_project_name_lowercase}"
+                    SUPPLIER "${arg_SUPPLIER}"
+                    PURL_VARIANT "${purl_variant}"
+                    ${purl_args}
+                    OUT_VAR purl_args
+                )
+            endif()
+
+            _qt_internal_sbom_assemble_purl(${target}
+                ${purl_args}
+                OUT_VAR package_manager_external_ref
+            )
+            list(APPEND project_package_options ${package_manager_external_ref})
+        endif()
+    endforeach()
+
+    set(direct_values
+        PURL_QT_VALUES
+        PURL_MIRROR_VALUES
+        PURL_3RDPARTY_UPSTREAM_VALUES
+    )
+
+    foreach(direct_value IN LISTS direct_values)
+        if(arg_${direct_value})
+            set(direct_values_per_type "")
+            foreach(direct_value IN LISTS arg_${direct_value})
+                _qt_internal_sbom_get_purl_value_extref(
+                    VALUE "${direct_value}" OUT_VAR package_manager_external_ref)
+
+                list(APPEND direct_values_per_type ${package_manager_external_ref})
+            endforeach()
+            # The order in which the purls are generated, matters for tools that consume the SBOM.
+            # Some tools can only handle one PURL per package, so the first one should be the
+            # important one.
+            # For now, I deem that the directly specified ones (probably via a qt_attribution.json
+            # file) are the more important ones. So we prepend them.
+            list(PREPEND project_package_options ${direct_values_per_type})
+        endif()
+    endforeach()
+
+    set(${arg_OUT_VAR} "${project_package_options}" PARENT_SCOPE)
+endfunction()
+
+# Gets a list of arguments to pass to _qt_internal_sbom_assemble_purl when handling a Qt entity
+# type. The purl for Qt entity types have Qt-specific defaults, but can be overridden per purl
+# component.
+# The arguments are saved in OUT_VAR.
+function(_qt_internal_sbom_get_qt_entity_purl_args target)
+    set(opt_args "")
+    set(single_args
+        NAME
+        REPO_NAME
+        SUPPLIER
+        VERSION
+        PURL_VARIANT
+        OUT_VAR
+    )
+    set(multi_args "")
+
+    _qt_internal_get_sbom_purl_parsing_options(purl_opt_args purl_single_args purl_multi_args)
+    list(APPEND opt_args ${purl_opt_args})
+    list(APPEND single_args ${purl_single_args})
+    list(APPEND multi_args ${purl_multi_args})
+
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(supported_purl_variants QT MIRROR)
+    if(NOT arg_PURL_VARIANT IN_LIST supported_purl_variants)
+        message(FATAL_ERROR "PURL_VARIANT unknown: ${arg_PURL_VARIANT}")
+    endif()
+
+    if(arg_PURL_VARIANT STREQUAL "QT")
+        set(purl_type "generic")
+        set(purl_namespace "${arg_SUPPLIER}")
+        set(purl_name "${arg_NAME}")
+        set(purl_version "${arg_VERSION}")
+    elseif(arg_PURL_VARIANT STREQUAL "MIRROR")
+        set(purl_type "github")
+        set(purl_namespace "qt")
+        set(purl_name "${arg_REPO_NAME}")
+        set(purl_version "${arg_VERSION}")
+    endif()
+
+    if(arg_PURL_TYPE)
+        set(purl_type "${arg_PURL_TYPE}")
+    endif()
+
+    if(arg_PURL_NAMESPACE)
+        set(purl_namespace "${arg_PURL_NAMESPACE}")
+    endif()
+
+    if(arg_PURL_NAME)
+        set(purl_name "${arg_PURL_NAME}")
+    endif()
+
+    if(arg_PURL_VERSION)
+        set(purl_version "${arg_PURL_VERSION}")
+    endif()
+
+    set(purl_version_option "")
+    if(purl_version)
+        set(purl_version_option PURL_VERSION "${purl_version}")
+    endif()
+
+    set(purl_args
+        PURL_TYPE "${purl_type}"
+        PURL_NAMESPACE "${purl_namespace}"
+        PURL_NAME "${purl_name}"
+        ${purl_version_option}
+    )
+
+    if(arg_PURL_QUALIFIERS)
+        list(APPEND purl_args PURL_QUALIFIERS "${arg_PURL_QUALIFIERS}")
+    endif()
+
+    if(arg_PURL_SUBPATH)
+        list(APPEND purl_args PURL_SUBPATH "${arg_PURL_SUBPATH}")
+    endif()
+
+    set(${arg_OUT_VAR} "${purl_args}" PARENT_SCOPE)
+endfunction()
+
+# Assembles an external reference purl identifier.
+# PURL_TYPE and PURL_NAME are required.
+# Stores the result in the OUT_VAR.
+# Accepted options:
+#    PURL_TYPE
+#    PURL_NAME
+#    PURL_NAMESPACE
+#    PURL_VERSION
+#    PURL_SUBPATH
+#    PURL_QUALIFIERS
+function(_qt_internal_sbom_assemble_purl target)
+    set(opt_args "")
+    set(single_args
+        OUT_VAR
+    )
+    set(multi_args "")
+
+    _qt_internal_get_sbom_purl_parsing_options(purl_opt_args purl_single_args purl_multi_args)
+    list(APPEND opt_args ${purl_opt_args})
+    list(APPEND single_args ${purl_single_args})
+    list(APPEND multi_args ${purl_multi_args})
+
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(purl_scheme "pkg")
+
+    if(NOT arg_PURL_TYPE)
+        message(FATAL_ERROR "PURL_TYPE must be set")
+    endif()
+
+    if(NOT arg_PURL_NAME)
+        message(FATAL_ERROR "PURL_NAME must be set")
+    endif()
+
+    if(NOT arg_OUT_VAR)
+        message(FATAL_ERROR "OUT_VAR must be set")
+    endif()
+
+    # https://github.com/package-url/purl-spec
+    # Spec is 'scheme:type/namespace/name@version?qualifiers#subpath'
+    set(purl "${purl_scheme}:${arg_PURL_TYPE}")
+
+    if(arg_PURL_NAMESPACE)
+        string(APPEND purl "/${arg_PURL_NAMESPACE}")
+    endif()
+
+    string(APPEND purl "/${arg_PURL_NAME}")
+
+    if(arg_PURL_VERSION)
+        string(APPEND purl "@${arg_PURL_VERSION}")
+    endif()
+
+    if(arg_PURL_QUALIFIERS)
+        # TODO: Note that the qualifiers are expected to be URL encoded, which this implementation
+        # is not doing at the moment.
+        list(JOIN arg_PURL_QUALIFIERS "&" qualifiers)
+        string(APPEND purl "?${qualifiers}")
+    endif()
+
+    if(arg_PURL_SUBPATH)
+        string(APPEND purl "#${arg_PURL_SUBPATH}")
+    endif()
+
+    _qt_internal_sbom_get_purl_value_extref(VALUE "${purl}" OUT_VAR result)
+
+    set(${arg_OUT_VAR} "${result}" PARENT_SCOPE)
+endfunction()
+
+# Takes a PURL VALUE and returns an SBOM purl external reference in OUT_VAR.
+function(_qt_internal_sbom_get_purl_value_extref)
+    set(opt_args "")
+    set(single_args
+        OUT_VAR
+        VALUE
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_OUT_VAR)
+        message(FATAL_ERROR "OUT_VAR must be set")
+    endif()
+
+    if(NOT arg_VALUE)
+        message(FATAL_ERROR "VALUE must be set")
+    endif()
+
+    # SPDX SBOM External reference type.
+    set(ext_ref_prefix "PACKAGE-MANAGER purl")
+    set(external_ref "${ext_ref_prefix} ${arg_VALUE}")
+    set(result "EXTREF" "${external_ref}")
+    set(${arg_OUT_VAR} "${result}" PARENT_SCOPE)
+endfunction()

cmake/QtPublicSbomPythonHelpers.cmake

@@ -0,0 +1,250 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Helper macro to find python and a given dependency. Expects the caller to set all of the vars.
+# Meant to reduce the line noise due to the repeated calls.
+macro(_qt_internal_sbom_find_python_and_dependency_helper_lambda)
+    _qt_internal_sbom_find_python_and_dependency_helper(
+        PYTHON_ARGS
+            ${extra_python_args}
+            ${python_common_args}
+        DEPENDENCY_ARGS
+            DEPENDENCY_IMPORT_STATEMENT "${import_statement}"
+        OUT_VAR_PYTHON_PATH python_path
+        OUT_VAR_PYTHON_FOUND python_found
+        OUT_VAR_DEP_FOUND dep_found
+        OUT_VAR_PYTHON_AND_DEP_FOUND everything_found
+        OUT_VAR_DEP_FIND_OUTPUT dep_find_output
+    )
+endmacro()
+
+# Tries to find python and a given dependency based on the args passed to PYTHON_ARGS and
+# DEPENDENCY_ARGS which are forwarded to the respective finding functions.
+# Returns the path to the python interpreter, whether it was found, whether the dependency was
+# found, whether both were found, and the reason why the dependency might not be found.
+function(_qt_internal_sbom_find_python_and_dependency_helper)
+    set(opt_args)
+    set(single_args
+        OUT_VAR_PYTHON_PATH
+        OUT_VAR_PYTHON_FOUND
+        OUT_VAR_DEP_FOUND
+        OUT_VAR_PYTHON_AND_DEP_FOUND
+        OUT_VAR_DEP_FIND_OUTPUT
+    )
+    set(multi_args
+        PYTHON_ARGS
+        DEPENDENCY_ARGS
+    )
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(everything_found_inner FALSE)
+    set(deps_find_output_inner "")
+
+    if(NOT arg_OUT_VAR_PYTHON_PATH)
+        message(FATAL_ERROR "OUT_VAR_PYTHON_PATH var is required")
+    endif()
+
+    if(NOT arg_OUT_VAR_PYTHON_FOUND)
+        message(FATAL_ERROR "OUT_VAR_PYTHON_FOUND var is required")
+    endif()
+
+    if(NOT arg_OUT_VAR_DEP_FOUND)
+        message(FATAL_ERROR "OUT_VAR_DEP_FOUND var is required")
+    endif()
+
+    if(NOT arg_OUT_VAR_PYTHON_AND_DEP_FOUND)
+        message(FATAL_ERROR "OUT_VAR_PYTHON_AND_DEP_FOUND var is required")
+    endif()
+
+    if(NOT arg_OUT_VAR_DEP_FIND_OUTPUT)
+        message(FATAL_ERROR "OUT_VAR_DEP_FIND_OUTPUT var is required")
+    endif()
+
+    _qt_internal_sbom_find_python_helper(
+        ${arg_PYTHON_ARGS}
+        OUT_VAR_PYTHON_PATH python_path_inner
+        OUT_VAR_PYTHON_FOUND python_found_inner
+    )
+
+    if(python_found_inner AND python_path_inner)
+        _qt_internal_sbom_find_python_dependency_helper(
+            ${arg_DEPENDENCY_ARGS}
+            PYTHON_PATH "${python_path_inner}"
+            OUT_VAR_FOUND dep_found_inner
+            OUT_VAR_OUTPUT dep_find_output_inner
+        )
+
+        if(dep_found_inner)
+            set(everything_found_inner TRUE)
+        endif()
+    endif()
+
+    set(${arg_OUT_VAR_PYTHON_PATH} "${python_path_inner}" PARENT_SCOPE)
+    set(${arg_OUT_VAR_PYTHON_FOUND} "${python_found_inner}" PARENT_SCOPE)
+    set(${arg_OUT_VAR_DEP_FOUND} "${dep_found_inner}" PARENT_SCOPE)
+    set(${arg_OUT_VAR_PYTHON_AND_DEP_FOUND} "${everything_found_inner}" PARENT_SCOPE)
+    set(${arg_OUT_VAR_DEP_FIND_OUTPUT} "${dep_find_output_inner}" PARENT_SCOPE)
+endfunction()
+
+# Tries to find the python intrepreter, given the QT_SBOM_PYTHON_INTERP path hint, as well as
+# other options.
+# Ignores any previously found python.
+# Returns the python interpreter path and whether it was successfully found.
+#
+# This is intentionally a function, and not a macro, to prevent overriding the Python3_EXECUTABLE
+# non-cache variable in a global scope in case if a different python is found and used for a
+# different purpose (e.g. qtwebengine or qtinterfaceframework).
+# The reason to use a different python is that an already found python might not be the version we
+# need, or might lack the dependencies we need.
+# https://gitlab.kitware.com/cmake/cmake/-/issues/21797#note_901621 claims that finding multiple
+# python versions in separate directory scopes is possible, and I claim a function scope is as
+# good as a directory scope.
+function(_qt_internal_sbom_find_python_helper)
+    set(opt_args
+        SEARCH_IN_FRAMEWORKS
+        QUIET
+    )
+    set(single_args
+        VERSION
+        OUT_VAR_PYTHON_PATH
+        OUT_VAR_PYTHON_FOUND
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_OUT_VAR_PYTHON_PATH)
+        message(FATAL_ERROR "OUT_VAR_PYTHON_PATH var is required")
+    endif()
+
+    if(NOT arg_OUT_VAR_PYTHON_FOUND)
+        message(FATAL_ERROR "OUT_VAR_PYTHON_FOUND var is required")
+    endif()
+
+    # Allow disabling looking for a python interpreter shipped as part of a macOS system framework.
+    if(NOT arg_SEARCH_IN_FRAMEWORKS)
+        set(Python3_FIND_FRAMEWORK NEVER)
+    endif()
+
+    set(required_version "")
+    if(arg_VERSION)
+        set(required_version "${arg_VERSION}")
+    endif()
+
+    set(find_quiet "")
+    if(arg_QUIET)
+        set(find_quiet "QUIET")
+    endif()
+
+    # Locally reset any executable that was possibly already found.
+    # We do this to ensure we always re-do the lookup/
+    # This needs to be set to an empty string, to override any cache variable
+    set(Python3_EXECUTABLE "")
+
+    # This needs to be unset, because the Python module checks whether the variable is defined, not
+    # whether it is empty.
+    unset(_Python3_EXECUTABLE)
+
+    if(QT_SBOM_PYTHON_INTERP)
+        set(Python3_ROOT_DIR ${QT_SBOM_PYTHON_INTERP})
+    endif()
+
+    find_package(Python3 ${required_version} ${find_quiet} COMPONENTS Interpreter)
+
+    set(${arg_OUT_VAR_PYTHON_PATH} "${Python3_EXECUTABLE}" PARENT_SCOPE)
+    set(${arg_OUT_VAR_PYTHON_FOUND} "${Python3_Interpreter_FOUND}" PARENT_SCOPE)
+endfunction()
+
+# Helper that takes an python import statement to run using the given python interpreter path,
+# to confirm that the given python dependency can be found.
+# Returns whether the dependency was found and the output of running the import, for error handling.
+function(_qt_internal_sbom_find_python_dependency_helper)
+    set(opt_args "")
+    set(single_args
+        DEPENDENCY_IMPORT_STATEMENT
+        PYTHON_PATH
+        OUT_VAR_FOUND
+        OUT_VAR_OUTPUT
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_PYTHON_PATH)
+        message(FATAL_ERROR "Python interpreter path not given.")
+    endif()
+
+    if(NOT arg_DEPENDENCY_IMPORT_STATEMENT)
+        message(FATAL_ERROR "Python depdendency import statement not given.")
+    endif()
+
+    if(NOT arg_OUT_VAR_FOUND)
+        message(FATAL_ERROR "Out var found variable not given.")
+    endif()
+
+    set(python_path "${arg_PYTHON_PATH}")
+    execute_process(
+        COMMAND
+            ${python_path} -c "${arg_DEPENDENCY_IMPORT_STATEMENT}"
+        RESULT_VARIABLE res
+        OUTPUT_VARIABLE output
+        ERROR_VARIABLE output
+    )
+
+    if("${res}" STREQUAL "0")
+        set(found TRUE)
+        set(output "${output}")
+    else()
+        set(found FALSE)
+        string(CONCAT output "SBOM Python dependency ${arg_DEPENDENCY_IMPORT_STATEMENT} not found. "
+            "Error:\n${output}")
+    endif()
+
+    set(${arg_OUT_VAR_FOUND} "${found}" PARENT_SCOPE)
+    if(arg_OUT_VAR_OUTPUT)
+        set(${arg_OUT_VAR_OUTPUT} "${output}" PARENT_SCOPE)
+    endif()
+endfunction()
+
+# Helper to find a python installed CLI utility.
+# Expected to be in PATH.
+function(_qt_internal_sbom_find_python_dependency_program)
+    set(opt_args
+        REQUIRED
+    )
+    set(single_args
+        NAME
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    set(program_name "${arg_NAME}")
+    string(TOUPPER "${program_name}" upper_name)
+    set(cache_var "QT_SBOM_PROGRAM_${upper_name}")
+
+    set(hints "")
+
+    # The path to python installed apps is different on Windows compared to UNIX, so we use
+    # a different path than where the python interpreter might be located.
+    if(QT_SBOM_PYTHON_APPS_PATH)
+        list(APPEND hints ${QT_SBOM_PYTHON_APPS_PATH})
+    endif()
+
+    find_program(${cache_var}
+        NAMES ${program_name}
+        HINTS ${hints}
+    )
+
+    if(NOT ${cache_var})
+        if(arg_REQUIRED)
+            set(message_type "FATAL_ERROR")
+            set(prefix "Required ")
+        else()
+            set(message_type "STATUS")
+            set(prefix "Optional ")
+        endif()
+        message(${message_type} "${prefix}SBOM python program '${program_name}' not found.")
+    endif()
+endfunction()

cmake/QtPublicSbomSystemDepHelpers.cmake

@@ -0,0 +1,162 @@
+# Copyright (C) 2024 The Qt Company Ltd.
+# SPDX-License-Identifier: BSD-3-Clause
+
+# Records information about a system library target, usually due to a qt_find_package call.
+# This information is later used to generate packages for the system libraries, but only after
+# confirming that the library was used (linked) into any of the Qt targets.
+function(_qt_internal_sbom_record_system_library_usage target)
+    if(NOT QT_GENERATE_SBOM)
+        return()
+    endif()
+
+    set(opt_args "")
+    set(single_args
+        TYPE
+        PACKAGE_VERSION
+        FRIENDLY_PACKAGE_NAME
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 1 arg "${opt_args}" "${single_args}" "${multi_args}")
+    _qt_internal_validate_all_args_are_parsed(arg)
+
+    if(NOT arg_TYPE)
+        message(FATAL_ERROR "TYPE must be set")
+    endif()
+
+    # A package might be looked up more than once, make sure to record it once.
+    get_property(already_recorded GLOBAL PROPERTY
+        _qt_internal_sbom_recorded_system_library_target_${target})
+
+    if(already_recorded)
+        return()
+    endif()
+
+    set_property(GLOBAL PROPERTY
+        _qt_internal_sbom_recorded_system_library_target_${target} TRUE)
+
+    # Defer spdx id creation until _qt_internal_sbom_begin_project is called, so we know the
+    # project name. The project name is used in the package infix generation of the system library,
+    # but _qt_internal_sbom_record_system_library_usage might be called before sbom generation
+    # has started, e.g. during _qt_internal_find_third_party_dependencies.
+    set(spdx_options
+        ${target}
+        TYPE "${arg_TYPE}"
+        PACKAGE_NAME "${arg_FRIENDLY_PACKAGE_NAME}"
+    )
+
+    get_cmake_property(sbom_repo_begin_called _qt_internal_sbom_repo_begin_called)
+    if(sbom_repo_begin_called AND TARGET "${target}")
+        _qt_internal_sbom_record_system_library_spdx_id(${target} ${spdx_options})
+    else()
+        set_property(GLOBAL PROPERTY
+            _qt_internal_sbom_recorded_system_library_spdx_options_${target} "${spdx_options}")
+    endif()
+
+    # Defer sbom info creation until we detect usage of the system library (whether the library is
+    # linked into any other target).
+    set_property(GLOBAL APPEND PROPERTY
+        _qt_internal_sbom_recorded_system_library_targets "${target}")
+    set_property(GLOBAL PROPERTY
+        _qt_internal_sbom_recorded_system_library_options_${target} "${ARGN}")
+endfunction()
+
+# Helper to record spdx ids of all system library targets that were found so far.
+function(_qt_internal_sbom_record_system_library_spdx_ids)
+    get_property(recorded_targets GLOBAL PROPERTY _qt_internal_sbom_recorded_system_library_targets)
+
+    if(NOT recorded_targets)
+        return()
+    endif()
+
+    foreach(target IN LISTS recorded_targets)
+        get_property(args GLOBAL PROPERTY
+            _qt_internal_sbom_recorded_system_library_spdx_options_${target})
+
+        # qt_find_package PROVIDED_TARGETS might refer to non-existent targets in certain cases,
+        # like zstd::libzstd_shared for qt_find_package(WrapZSTD), because we are not sure what
+        # kind of zstd build was done. Make sure to check if the target exists before recording it.
+        if(TARGET "${target}")
+            set(target_unaliased "${target}")
+            get_target_property(aliased_target "${target}" ALIASED_TARGET)
+            if(aliased_target)
+                set(target_unaliased ${aliased_target})
+            endif()
+
+            _qt_internal_sbom_record_system_library_spdx_id(${target_unaliased} ${args})
+        else()
+            message(DEBUG
+                "Skipping recording system library for SBOM because target does not exist: "
+                " ${target}")
+        endif()
+    endforeach()
+endfunction()
+
+# Helper to record the spdx id of a system library target.
+function(_qt_internal_sbom_record_system_library_spdx_id target)
+    # Save the spdx id before the sbom info is added, so we can refer to it in relationships.
+    _qt_internal_sbom_record_target_spdx_id(${ARGN} OUT_VAR package_spdx_id)
+
+    if(NOT package_spdx_id)
+        message(FATAL_ERROR "Could not generate spdx id for system library target: ${target}")
+    endif()
+
+    set_property(GLOBAL PROPERTY
+        _qt_internal_sbom_recorded_system_library_package_${target} "${package_spdx_id}")
+endfunction()
+
+# Goes through the list of consumed system libraries (those that were linked in) and creates
+# sbom packages for them.
+# Uses information from recorded system libraries (calls to qt_find_package).
+function(_qt_internal_sbom_add_recorded_system_libraries)
+    get_property(recorded_targets GLOBAL PROPERTY _qt_internal_sbom_recorded_system_library_targets)
+    get_property(consumed_targets GLOBAL PROPERTY _qt_internal_sbom_consumed_system_library_targets)
+
+    set(unconsumed_targets "${recorded_targets}")
+    set(generated_package_names "")
+
+    foreach(target IN LISTS consumed_targets)
+        # Some system targets like qtspeech SpeechDispatcher::SpeechDispatcher might be aliased,
+        # and we can't set properties on them, so unalias the target name.
+        set(target_original "${target}")
+        get_target_property(aliased_target "${target}" ALIASED_TARGET)
+        if(aliased_target)
+            set(target ${aliased_target})
+        endif()
+
+        get_property(args GLOBAL PROPERTY
+            _qt_internal_sbom_recorded_system_library_options_${target})
+        get_property(package_name GLOBAL PROPERTY
+            _qt_internal_sbom_recorded_system_library_package_${target})
+
+        set_property(GLOBAL PROPERTY _qt_internal_sbom_recorded_system_library_target_${target} "")
+        set_property(GLOBAL PROPERTY _qt_internal_sbom_recorded_system_library_options_${target} "")
+        set_property(GLOBAL PROPERTY _qt_internal_sbom_recorded_system_library_package_${target} "")
+
+        # Guard against generating a package multiple times. Can happen when multiple targets belong
+        # to the same package.
+        if(sbom_generated_${package_name})
+            continue()
+        endif()
+
+        # Automatic system library sbom recording happens at project root source dir scope, which
+        # means it might accidentally pick up a qt_attribution.json file from the project root,
+        # that is not intended to be use for system libraries.
+        # For now, explicitly disable using the root attribution file.
+        list(APPEND args NO_CURRENT_DIR_ATTRIBUTION)
+
+        list(APPEND generated_package_names "${package_name}")
+        set(sbom_generated_${package_name} TRUE)
+
+        _qt_internal_extend_sbom(${target} ${args})
+        _qt_internal_finalize_sbom(${target})
+
+        list(REMOVE_ITEM unconsumed_targets "${target_original}")
+    endforeach()
+
+    message(DEBUG "System libraries that were recorded, but not consumed: ${unconsumed_targets}")
+    message(DEBUG "Generated SBOMs for the following system packages: ${generated_package_names}")
+
+    # Clean up, before configuring next repo project.
+    set_property(GLOBAL PROPERTY _qt_internal_sbom_consumed_system_library_targets "")
+    set_property(GLOBAL PROPERTY _qt_internal_sbom_recorded_system_library_targets "")
+endfunction()

cmake/QtPublicTestHelpers.cmake

@@ -68,7 +68,10 @@ is not specified")
         # It's necessary to call actual test inside 'cmd.exe', because 'execute_process' uses
         # SW_HIDE to avoid showing a console window, it affects other GUI as well.
         # See https://gitlab.kitware.com/cmake/cmake/-/issues/17690 for details.
-        set(extra_runner "cmd /c")
+        #
+        # Run the command using the proxy 'call' command to avoid issues related to invalid
+        # processing of quotes and spaces in cmd.exe arguments.
+        set(extra_runner "cmd /c call")
     endif()
 
     if(arg_PRE_RUN)

cmake/QtSbomHelpers.cmake

@@ -31,3 +31,77 @@ function(qt_internal_sbom_end_qt_repo_project)
     _qt_internal_sbom_end_qt_repo_project(${ARGN})
 endfunction()
 
+function(qt_internal_sbom_add_files)
+    _qt_internal_sbom_add_files(${ARGN})
+endfunction()
+
+function(qt_internal_sbom_add_cmake_include_step)
+    _qt_internal_sbom_add_cmake_include_step(${ARGN})
+endfunction()
+
+function(qt_internal_sbom_add_external_reference)
+    _qt_internal_sbom_generate_add_external_reference(${ARGN})
+endfunction()
+
+function(qt_internal_sbom_add_project_relationship)
+    _qt_internal_sbom_generate_add_project_relationship(${ARGN})
+endfunction()
+
+function(qt_internal_sbom_generate_tag_value_spdx_document)
+    _qt_internal_sbom_generate_tag_value_spdx_document(${ARGN})
+
+    set(opt_args "")
+    set(single_args
+        OUT_VAR_OUTPUT_FILE_NAME
+        OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH
+    )
+    set(multi_args "")
+    cmake_parse_arguments(PARSE_ARGV 0 arg "${opt_args}" "${single_args}" "${multi_args}")
+
+    if(arg_OUT_VAR_OUTPUT_FILE_NAME)
+        set(${arg_OUT_VAR_OUTPUT_FILE_NAME} "${${arg_OUT_VAR_OUTPUT_FILE_NAME}}" PARENT_SCOPE)
+    endif()
+
+    if(arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH)
+        set(${arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH} "${${arg_OUT_VAR_OUTPUT_ABSOLUTE_FILE_PATH}}"
+            PARENT_SCOPE)
+    endif()
+endfunction()
+
+function(qt_internal_sbom_get_project_spdx_id out_var)
+    set(result "")
+
+    if(QT_GENERATE_SBOM)
+        get_cmake_property(project_spdx_id _qt_internal_sbom_project_spdx_id)
+        if(project_spdx_id)
+            set(result "${project_spdx_id}")
+        endif()
+    endif()
+
+    set(${out_var} "${result}" PARENT_SCOPE)
+endfunction()
+
+function(qt_internal_sbom_get_target_spdx_id target out_var)
+    set(result "")
+
+    if(QT_GENERATE_SBOM)
+        _qt_internal_sbom_get_spdx_id_for_target(${target} result)
+    endif()
+
+    set(${out_var} "${result}" PARENT_SCOPE)
+endfunction()
+
+function(qt_internal_sbom_get_external_document_ref_spdx_id project_name out_var)
+    set(result "")
+
+    if(QT_GENERATE_SBOM)
+        string(TOLOWER "${project_name}" project_name_lowercase)
+        _qt_internal_sbom_get_external_document_ref_spdx_id("${project_name_lowercase}" result)
+    endif()
+
+    set(${out_var} "${result}" PARENT_SCOPE)
+endfunction()
+
+macro(qt_internal_sbom_get_git_version_vars)
+    _qt_internal_sbom_get_git_version_vars()
+endmacro()

cmake/QtTestHelpers.cmake

@@ -902,6 +902,20 @@ function(qt_internal_add_test name)
         endif()
     endif()
 
+    if(MACOS AND NOT CMAKE_GENERATOR STREQUAL "Xcode")
+        # Add com.apple.security.get-task-allow entitlement to each
+        # test binary, so we can hook into the Swift crash handling.
+        if(NOT arg_QMLTEST AND arg_SOURCES)
+            set(entitlements_file
+                "${__qt_internal_cmake_apple_support_files_path}/test.entitlements.plist")
+            add_custom_command(TARGET "${name}"
+                POST_BUILD COMMAND codesign --sign -
+                    --entitlements "${entitlements_file}"
+                    "$<TARGET_FILE:${name}>"
+                )
+        endif()
+    endif()
+
     qt_internal_add_test_finalizers("${name}")
 endfunction()
 

cmake/QtToolHelpers.cmake

@@ -385,6 +385,7 @@ function(qt_export_tools module_name)
 
     # List of package dependencies that need be find_package'd when using the Tools package.
     set(package_deps "")
+    set(third_party_deps "")
 
     # Additional cmake files to install
     set(extra_cmake_files "")
@@ -397,7 +398,15 @@ function(qt_export_tools module_name)
         # e.g. qtwaylandscanner depends on WaylandScanner (non-qt package).
         get_target_property(extra_packages "${tool_name}" QT_EXTRA_PACKAGE_DEPENDENCIES)
         if(extra_packages)
-            list(APPEND package_deps "${extra_packages}")
+            foreach(third_party_dep IN LISTS extra_packages)
+                list(GET third_party_dep 0 third_party_dep_name)
+                list(GET third_party_dep 1 third_party_dep_version)
+
+                # Assume that all tool thirdparty deps are mandatory.
+                # TODO: Components are not supported
+                list(APPEND third_party_deps
+                    "${third_party_dep_name}\\\;FALSE\\\;${third_party_dep_version}\\\;\\\;")
+            endforeach()
         endif()
 
         get_target_property(_extra_cmake_files "${tool_name}" EXTRA_CMAKE_FILES)

cmake/QtWasmHelpers.cmake

@@ -7,10 +7,10 @@ function (qt_internal_setup_wasm_target_properties wasmTarget)
 
     target_link_options("${wasmTarget}" INTERFACE
     "SHELL:-s MAX_WEBGL_VERSION=2"
-    "SHELL:-s FETCH=1"
     "SHELL:-s WASM_BIGINT=1"
     "SHELL:-s STACK_SIZE=5MB")
 
+    set(executable_link_flags "-sFETCH")
     ## wasm64
     if (WASM64)
         target_compile_options("${wasmTarget}" INTERFACE "SHELL:-s MEMORY64=1" )
@@ -99,7 +99,7 @@ function (qt_internal_setup_wasm_target_properties wasmTarget)
         set(enable_side_module_if_needed
             "$<$<IN_LIST:$<TARGET_PROPERTY:TYPE>,${side_modules}>:SHELL:-s SIDE_MODULE=1>")
         set(enable_main_module_if_needed
-            "$<$<IN_LIST:$<TARGET_PROPERTY:TYPE>,EXECUTABLE>:SHELL:-s MAIN_MODULE=1>")
+            "$<$<IN_LIST:$<TARGET_PROPERTY:TYPE>,EXECUTABLE>:SHELL:-sMAIN_MODULE=1 ${executable_link_flags}>")
         set(set_shared_module_type_if_needed
             "${enable_side_module_if_needed}"
             "${enable_main_module_if_needed}"
@@ -115,7 +115,7 @@ function (qt_internal_setup_wasm_target_properties wasmTarget)
         target_link_options("${wasmTarget}" INTERFACE "${set_shared_module_type_if_needed}")
 
     else()
-        target_link_options("${wasmTarget}" INTERFACE "SHELL:-s ERROR_ON_UNDEFINED_SYMBOLS=1")
+        target_link_options("${wasmTarget}" INTERFACE "SHELL:-sERROR_ON_UNDEFINED_SYMBOLS=1 ${executable_link_flags}")
     endif()
 
     # Suppress warnings for known issues for developer builds

cmake/QtWindowsHelpers.cmake

@@ -8,7 +8,7 @@ function(qt_internal_check_msvc_versions)
     set(min_msvc_version "1930")
     if(MSVC_VERSION VERSION_LESS min_msvc_version)
         message(FATAL_ERROR
-            "Qt requires at least Visual Studio 2019 (MSVC ${min_msvc_version} or newer), "
+            "Qt requires at least Visual Studio 2022 (MSVC ${min_msvc_version} or newer), "
             "you're building against version ${MSVC_VERSION}. "
             "You can turn off this version check by setting QT_NO_MSVC_MIN_VERSION_CHECK to ON."
         )

cmake/macos/test.entitlements.plist

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>com.apple.security.get-task-allow</key>
+    <true/>
+  </dict>
+</plist>

coin/instructions/cmake_run_ctest.yaml

@@ -141,6 +141,16 @@ instructions:
         maxTimeBetweenOutput: 14400
         userMessageOnFailure: >
           Failed to run tests.
+      - type: ExecuteCommand
+        command: >
+          cmake -E copy
+            Testing{{.Env.CI_PATH_SEP}}Temporary{{.Env.CI_PATH_SEP}}LastTest.log
+            {{.Env.COIN_CTEST_RESULTSDIR}}{{.Env.CI_PATH_SEP}}CTest.log
+        executeCommandArgumentSplitingBehavior: SplitAfterVariableSubstitution
+        ignoreExitCode: false
+        userMessageOnFailure: >
+          Failed to copy LastTest.log to testresults directory.
+        executeOn: always
   - type: Group
     enable_if:
       condition: runtime
@@ -155,16 +165,13 @@ instructions:
         maxTimeBetweenOutput: 14400
         userMessageOnFailure: >
           Failed to run tests.
-
-  - type: Group
-    instructions:
       - type: ExecuteCommand
         command: >
           cmake -E copy
             Testing{{.Env.CI_PATH_SEP}}Temporary{{.Env.CI_PATH_SEP}}LastTest.log
             {{.Env.COIN_CTEST_RESULTSDIR}}{{.Env.CI_PATH_SEP}}CTest.log
         executeCommandArgumentSplitingBehavior: SplitAfterVariableSubstitution
-        ignoreExitCode: false
+        ignoreExitCode: true
         userMessageOnFailure: >
           Failed to copy LastTest.log to testresults directory.
         executeOn: always

coin/instructions/vxworks_testrunner.yaml

@@ -10,7 +10,7 @@ instructions:
       testdir="$(dirname $1)"
       testexecutable="$1"
       echo RUNNING via serial: "$quoted_args"
-      echo "cmd rtp exec -p 200 -t 0x01000000 -u 1000000 $testexecutable -- $quoted_args" > /home/qt/work/vx.sh
+      echo "cmd rtp exec -p 200 -t 0x01000000 -u 0x1000000 $testexecutable -- $quoted_args" > /home/qt/work/vx.sh
       echo "cmd echo \"qtest_in_vxworks_complete: $?\"" >> /home/qt/work/vx.sh
       #rtp exec            Execute a process.
       #               -p : specify the initial task priority
@@ -22,11 +22,17 @@ instructions:
 
       # qtest_in_vxworks_complete echo is used to detect test process completion as it will
       # be echoed after test process ends normally or crashes when normal log lines are not present.
+
       # Check that emulator is functioning
-      echo "cmd echo \"health check\"" > /tmp/guest.in
+      ( echo "cmd echo \"health check\"" > /tmp/guest.in ) & pid=$!
-      sleep 0.5
+      ( sleep 5 && kill -HUP $pid ) 2>/dev/null & watcher=$!
-      read -t 5 echoline</tmp/guest.out
+      wait $pid 2>/dev/null && pkill -HUP -P $watcher
-      read -t 1 testline</tmp/guest.out
+
+      if [[ "$?" -eq "0" ]]; then
+          read -t 5 echoline</tmp/guest.out
+          read -t 1 testline</tmp/guest.out
+      fi
+
       if [[ -z "$testline" ]]; then
           echo "Restarting  stuck emulator"
           pkill qemu-system
@@ -58,4 +64,16 @@ instructions:
               exitcode=$(echo "$line" | sed -nr 's/qtest_in_vxworks_complete: (-?[0-9]+)/\1/gp' | tr -d '\r')
               exit $exitcode
           fi
+
+          # Handle crashes
+          if echo "$line" | /usr/bin/grep -qE "(SIGSEGV)|(SIGABRT)"
+          then
+              # Empty output pipe
+              while read -t 1 line; do
+                  echo $line
+              done < /tmp/guest.out
+              echo "Test crashed"
+              pkill qemu-system  # Kill emulator to force restart on next test start
+              exit 1
+          fi
       done < /tmp/guest.out

doc/global/config.qdocconf

@@ -15,6 +15,9 @@ productname = Qt
 navigation.homepage = index.html
 navigation.hometitle = "$productname $QT_VER"
 
+# Set trademarks page (located in qt/qtdoc)
+navigation.trademarkspage = Trademarks
+
 #Words to ignore for auto-linking
 ignorewords += \
     macOS \

doc/global/externalsites/external-resources.qdoc

@@ -36,6 +36,10 @@
     \externalpage https://developer.android.com/build/configure-app-module
     \title Android: Configure the app module
 */
+/*!
+    \externalpage https://developer.android.com/ndk/guides/ndk-stack
+    \title Android: ndk-stack
+*/
 /*!
     \externalpage https://developer.apple.com/documentation/uikit/uiapplication/1622952-canopenurl
     \title iOS: canOpenURL:

doc/global/macros.qdocconf

@@ -126,8 +126,9 @@ macro.QtMinorVersion.match  = "\\d+\\.(\\d+)"
 # along with the offline docs, you must specify it manually. In .qdocconf, to do it for all formats
 # at once, add:
 #
-# {HTML.extraimages,qhp.QtDoc.extraFiles, DocBook.extraimages} += images/dQw4w9WgXcQ.jpg
+# {HTML.extraimages,qhp.<qhp_project>.extraFiles,DocBook.extraimages} += images/dQw4w9WgXcQ.jpg
 #
+# Where <qhp_project> is a project name listed in `qhp.projects`.
 macro.youtube.HTML = "<div class=\"video\">\n" \
                      "<a href=\"https://www.youtube.com/watch/?v=\1\">\n"\
                      "<img src=\"images/\1.jpg\"" \

examples/corelib/mimetypes/mimetypebrowser/main.cpp

@@ -6,10 +6,26 @@
 #include <QApplication>
 #include <QCommandLineParser>
 #include <QScreen>
+#if QT_CONFIG(translation)
+#  include <QLocale>
+#  include <QLibraryInfo>
+#  include <QTranslator>
+#endif
+
+using namespace Qt::StringLiterals;
 
 int main(int argc, char *argv[])
 {
     QApplication app(argc, argv);
+
+#if QT_CONFIG(translation)
+    QTranslator translator;
+    if (translator.load(QLocale::system(), "qtbase"_L1, "_"_L1,
+                        QLibraryInfo::path(QLibraryInfo::TranslationsPath))) {
+        app.installTranslator(&translator);
+    }
+#endif
+
     QCoreApplication::setApplicationVersion(QT_VERSION_STR);
 
     QCommandLineParser parser;

examples/sql/sqlbrowser/browser.cpp

@@ -18,7 +18,7 @@
 
 Browser::Browser(QWidget *parent)
     : QWidget(parent)
-    , m_ui(new Ui::Browser)
+    , m_ui{std::make_unique<Ui::Browser>()}
 {
     m_ui->setupUi(this);
 
@@ -60,9 +60,7 @@ Browser::Browser(QWidget *parent)
 }
 
 Browser::~Browser()
-{
+    = default;
-    delete m_ui;
-}
 
 void Browser::exec()
 {

examples/sql/sqlbrowser/browser.h

@@ -7,6 +7,8 @@
 #include <QWidget>
 #include <QSqlTableModel>
 
+#include <memory>
+
 QT_FORWARD_DECLARE_CLASS(QSqlError)
 
 QT_BEGIN_NAMESPACE
@@ -20,8 +22,8 @@ class Browser : public QWidget
 {
     Q_OBJECT
 public:
-    Browser(QWidget *parent = nullptr);
+    explicit Browser(QWidget *parent = nullptr);
-    ~Browser();
+    ~Browser() override;
 
     QSqlError addConnection(const QString &driver, const QString &dbName, const QString &host,
                             const QString &user, const QString &passwd, int port);
@@ -50,7 +52,7 @@ signals:
     void statusMessage(const QString &message);
 
 private:
-    Ui::Browser *m_ui;
+    const std::unique_ptr<Ui::Browser> m_ui;
 };
 
 class CustomModel : public QSqlTableModel

examples/sql/sqlbrowser/connectionwidget.cpp

@@ -14,6 +14,7 @@ ConnectionWidget::ConnectionWidget(QWidget *parent)
     , tree(new QTreeWidget(this))
 {
     QVBoxLayout *layout = new QVBoxLayout(this);
+    layout->setContentsMargins({});
     tree->setHeaderLabels(QStringList(tr("Database")));
     tree->header()->setStretchLastSection(true);
     QAction *refreshAction = new QAction(tr("Refresh"), tree);
@@ -33,9 +34,7 @@ ConnectionWidget::ConnectionWidget(QWidget *parent)
 }
 
 ConnectionWidget::~ConnectionWidget()
-{
+    = default;
-}
-
 
 void ConnectionWidget::refresh()
 {

examples/sql/sqlbrowser/connectionwidget.h

@@ -14,8 +14,8 @@ class ConnectionWidget : public QWidget
 {
     Q_OBJECT
 public:
-    ConnectionWidget(QWidget *parent = nullptr);
+    explicit ConnectionWidget(QWidget *parent = nullptr);
-    ~ConnectionWidget();
+    ~ConnectionWidget() override;
 
     QSqlDatabase currentDatabase() const;
 

examples/sql/sqlbrowser/qsqlconnectiondialog.cpp

@@ -11,7 +11,7 @@
 
 QSqlConnectionDialog::QSqlConnectionDialog(QWidget *parent)
     : QDialog(parent)
-    , m_ui(new Ui::QSqlConnectionDialogUi)
+    , m_ui{std::make_unique<Ui::QSqlConnectionDialogUi>()}
 {
     m_ui->setupUi(this);
 
@@ -21,19 +21,10 @@ QSqlConnectionDialog::QSqlConnectionDialog(QWidget *parent)
         m_ui->dbCheckBox->setEnabled(false);
 
     m_ui->comboDriver->addItems(drivers);
-
-    connect(m_ui->okButton, &QPushButton::clicked,
-            this, &QSqlConnectionDialog::onOkButton);
-    connect(m_ui->cancelButton, &QPushButton::clicked,
-            this, &QSqlConnectionDialog::reject);
-    connect(m_ui->dbCheckBox, &QCheckBox::stateChanged,
-            this, &QSqlConnectionDialog::onDbCheckBox);
 }
 
 QSqlConnectionDialog::~QSqlConnectionDialog()
-{
+    = default;
-    delete m_ui;
-}
 
 QString QSqlConnectionDialog::driverName() const
 {
@@ -70,18 +61,13 @@ bool QSqlConnectionDialog::useInMemoryDatabase() const
     return m_ui->dbCheckBox->isChecked();
 }
 
-void QSqlConnectionDialog::onOkButton()
+void QSqlConnectionDialog::accept()
 {
     if (m_ui->comboDriver->currentText().isEmpty()) {
         QMessageBox::information(this, tr("No database driver selected"),
                                  tr("Please select a database driver"));
         m_ui->comboDriver->setFocus();
     } else {
-        accept();
+        QDialog::accept();
     }
 }
-
-void QSqlConnectionDialog::onDbCheckBox()
-{
-    m_ui->connGroupBox->setEnabled(!m_ui->dbCheckBox->isChecked());
-}

examples/sql/sqlbrowser/qsqlconnectiondialog.h

@@ -6,6 +6,8 @@
 
 #include <QDialog>
 
+#include <memory>
+
 QT_BEGIN_NAMESPACE
 namespace Ui
 {
@@ -17,8 +19,8 @@ class QSqlConnectionDialog : public QDialog
 {
     Q_OBJECT
 public:
-    QSqlConnectionDialog(QWidget *parent = nullptr);
+    explicit QSqlConnectionDialog(QWidget *parent = nullptr);
-    ~QSqlConnectionDialog();
+    ~QSqlConnectionDialog() override;
 
     QString driverName() const;
     QString databaseName() const;
@@ -28,12 +30,10 @@ public:
     int port() const;
     bool useInMemoryDatabase() const;
 
-private slots:
+    void accept() override;
-    void onOkButton();
-    void onDbCheckBox();
 
 private:
-    Ui::QSqlConnectionDialogUi *m_ui;
+    const std::unique_ptr<Ui::QSqlConnectionDialogUi> m_ui;
 };
 
 #endif

examples/sql/sqlbrowser/qsqlconnectiondialog.ui

@@ -27,13 +27,7 @@
      <property name="title" >
       <string>Connection settings</string>
      </property>
-     <layout class="QGridLayout" >
+     <layout class="QFormLayout" name="formLayout">
-      <property name="margin" >
-       <number>8</number>
-      </property>
-      <property name="spacing" >
-       <number>6</number>
-      </property>
       <item row="0" column="1" >
        <widget class="QComboBox" name="comboDriver" />
       </item>
@@ -163,47 +157,11 @@
     </layout>
    </item>
    <item>
-    <layout class="QHBoxLayout" >
+    <widget class="QDialogButtonBox" name="buttonBox">
-     <property name="margin" >
+     <property name="standardButtons">
-      <number>0</number>
+      <set>QDialogButtonBox::StandardButton::Cancel|QDialogButtonBox::StandardButton::Ok</set>
      </property>
-     <property name="spacing" >
+    </widget>
-      <number>6</number>
-     </property>
-     <item>
-      <spacer>
-       <property name="orientation" >
-        <enum>Qt::Horizontal</enum>
-       </property>
-       <property name="sizeType" >
-        <enum>QSizePolicy::Expanding</enum>
-       </property>
-       <property name="sizeHint" >
-        <size>
-         <width>20</width>
-         <height>20</height>
-        </size>
-       </property>
-      </spacer>
-     </item>
-     <item>
-      <widget class="QPushButton" name="okButton" >
-       <property name="text" >
-        <string>&amp;OK</string>
-       </property>
-       <property name="default" >
-        <bool>true</bool>
-       </property>
-      </widget>
-     </item>
-     <item>
-      <widget class="QPushButton" name="cancelButton" >
-       <property name="text" >
-        <string>&amp;Cancel</string>
-       </property>
-      </widget>
-     </item>
-    </layout>
    </item>
   </layout>
  </widget>
@@ -216,9 +174,56 @@
   <tabstop>editHostname</tabstop>
   <tabstop>portSpinBox</tabstop>
   <tabstop>dbCheckBox</tabstop>
-  <tabstop>okButton</tabstop>
-  <tabstop>cancelButton</tabstop>
  </tabstops>
  <resources/>
- <connections/>
+ <connections>
+  <connection>
+   <sender>dbCheckBox</sender>
+   <signal>toggled(bool)</signal>
+   <receiver>connGroupBox</receiver>
+   <slot>setDisabled(bool)</slot>
+   <hints>
+    <hint type="sourcelabel">
+     <x>165</x>
+     <y>248</y>
+    </hint>
+    <hint type="destinationlabel">
+     <x>107</x>
+     <y>221</y>
+    </hint>
+   </hints>
+  </connection>
+  <connection>
+   <sender>buttonBox</sender>
+   <signal>accepted()</signal>
+   <receiver>QSqlConnectionDialogUi</receiver>
+   <slot>accept()</slot>
+   <hints>
+    <hint type="sourcelabel">
+     <x>19</x>
+     <y>278</y>
+    </hint>
+    <hint type="destinationlabel">
+     <x>20</x>
+     <y>244</y>
+    </hint>
+   </hints>
+  </connection>
+  <connection>
+   <sender>buttonBox</sender>
+   <signal>rejected()</signal>
+   <receiver>QSqlConnectionDialogUi</receiver>
+   <slot>reject()</slot>
+   <hints>
+    <hint type="sourcelabel">
+     <x>58</x>
+     <y>276</y>
+    </hint>
+    <hint type="destinationlabel">
+     <x>58</x>
+     <y>258</y>
+    </hint>
+   </hints>
+  </connection>
+ </connections>
 </ui>

examples/widgets/doc/src/analogclock.qdoc

@@ -106,11 +106,10 @@
     system counterclockwise by a number of degrees determined by the current
     hour and minute. This means that the hand will be shown rotated clockwise
     by the required amount.
-    We save and restore the transformation matrix before and after the
+    We save and restore the transformation matrix before and after the rotation
-    rotation because we want to place the minute hand without having to
+    by instantiating a QPainterStateGuard because we want to place the minute
-    take into account any previous rotations.
+    hand without having to take into account any previous rotations.
 
-    \snippet widgets/analogclock/analogclock.cpp 17
     \snippet widgets/analogclock/analogclock.cpp 19
 
     We draw markers around the edge of the clock for each hour in the same
@@ -123,7 +122,7 @@
 
     \snippet widgets/analogclock/analogclock.cpp 21
 
-    For the seconds hand we do the same and add two cicles as a visual highlight.
+    For the seconds hand we do the same and add two circles as a visual highlight.
 
     \snippet widgets/analogclock/analogclock.cpp 23
     \codeline

examples/widgets/doc/src/basicdrawing.qdoc

@@ -370,8 +370,8 @@
     RenderArea widget, and we calculate their positions using two \c
     for loops and the widgets height and width.
 
-    For each copy we first save the current painter state (pushes the
+    For each copy we first save the current painter state by instantiating
-    state onto a stack). Then we translate the coordinate system,
+    a QPainterStateGuard. Then we translate the coordinate system,
     using the QPainter::translate() function, to the position
     determined by the variables of the \c for loops. If we omit this
     translation of the coordinate system all the copies of the shape
@@ -420,9 +420,9 @@
 
     \snippet painting/basicdrawing/renderarea.cpp 13
 
-    Then, when we are finished rendering a copy of the shape we can
+    Then, when we are finished rendering a copy of the shape,
-    restore the original painter state, with its associated coordinate
+    the original painter state is restored by QPainterStateGuard,
-    system, using the QPainter::restore() function. In this way we
+    which calls the QPainter::restore() function. In this way, we
     ensure that the next shape copy will be rendered in the correct
     position.
 

examples/widgets/doc/src/transformations.qdoc

@@ -161,13 +161,11 @@
 
     \snippet painting/transformations/renderarea.cpp 6
 
-    Before we start to render the shape, we call the QPainter::save()
+    Before we start to render the shape, we instantiate
-    function.
+    a QPainterStateGuard to save the current painter state (i.e. push the
-
+    state onto a stack) including the current coordinate system while
-    QPainter::save() saves the current painter state (i.e. pushes the
+    in scope. The rationale for saving the painter state is that the
-    state onto a stack) including the current coordinate system. The
+    following call to the \c transformPainter() function will transform the
-    rationale for saving the painter state is that the following call
-    to the \c transformPainter() function will transform the
     coordinate system depending on the currently chosen transformation
     operations, and we need a way to get back to the original state to
     draw the outline.

examples/widgets/painting/affine/xform.cpp

@@ -6,6 +6,7 @@
 
 #include <QLayout>
 #include <QPainter>
+#include <QPainterStateGuard>
 #include <QPainterPath>
 
 const int alpha = 155;
@@ -76,7 +77,7 @@ void XFormView::resizeEvent(QResizeEvent *e)
 
 void XFormView::paint(QPainter *p)
 {
-    p->save();
+    QPainterStateGuard guard(p);
     p->setRenderHint(QPainter::Antialiasing);
     p->setRenderHint(QPainter::SmoothPixmapTransform);
     switch (m_type) {
@@ -90,7 +91,6 @@ void XFormView::paint(QPainter *p)
         drawTextType(p);
         break;
     }
-    p->restore();
 }
 
 void XFormView::updateControlPoints(const QPolygonF &points)

examples/widgets/painting/basicdrawing/renderarea.cpp

@@ -5,6 +5,7 @@
 
 #include <QPainter>
 #include <QPainterPath>
+#include <QPainterStateGuard>
 
 //! [0]
 RenderArea::RenderArea(QWidget *parent)
@@ -106,7 +107,7 @@ void RenderArea::paintEvent(QPaintEvent * /* event */)
 //! [10]
     for (int x = 0; x < width(); x += 100) {
         for (int y = 0; y < height(); y += 100) {
-            painter.save();
+            QPainterStateGuard guard(&painter);
             painter.translate(x, y);
 //! [10] //! [11]
             if (transformed) {
@@ -161,7 +162,6 @@ void RenderArea::paintEvent(QPaintEvent * /* event */)
                 painter.drawPixmap(10, 10, pixmap);
             }
 //! [12] //! [13]
-            painter.restore();
         }
     }
 

examples/widgets/painting/transformations/renderarea.cpp

@@ -4,6 +4,7 @@
 #include "renderarea.h"
 
 #include <QPainter>
+#include <QPainterStateGuard>
 #include <QPaintEvent>
 
 //! [0]
@@ -61,10 +62,11 @@ void RenderArea::paintEvent(QPaintEvent *event)
 //! [5]
 
 //! [6]
-    painter.save();
+    {
-    transformPainter(painter);
+        QPainterStateGuard guard(&painter);
-    drawShape(painter);
+        transformPainter(painter);
-    painter.restore();
+        drawShape(painter);
+    }
 //! [6]
 
 //! [7]

examples/widgets/widgets/analogclock/analogclock.cpp

@@ -4,6 +4,7 @@
 #include "analogclock.h"
 
 #include <QPainter>
+#include <QPainterStateGuard>
 #include <QTime>
 #include <QTimer>
 
@@ -78,12 +79,12 @@ void AnalogClock::paintEvent(QPaintEvent *)
 //! [16]
 //! [18]
 
-//! [17]
+//! [19]
-    painter.save();
+    {
-//! [17] //! [19]
+        QPainterStateGuard guard(&painter);
-    painter.rotate(30.0 * ((time.hour() + time.minute() / 60.0)));
+        painter.rotate(30.0 * ((time.hour() + time.minute() / 60.0)));
-    painter.drawConvexPolygon(hourHand, 4);
+        painter.drawConvexPolygon(hourHand, 4);
-    painter.restore();
+    }
 //! [18] //! [19]
 
 //! [20]
@@ -97,10 +98,11 @@ void AnalogClock::paintEvent(QPaintEvent *)
     painter.setBrush(minuteColor);
 
 //! [22]
-    painter.save();
+    {
-    painter.rotate(6.0 * time.minute());
+        QPainterStateGuard guard(&painter);
-    painter.drawConvexPolygon(minuteHand, 4);
+        painter.rotate(6.0 * time.minute());
-    painter.restore();
+        painter.drawConvexPolygon(minuteHand, 4);
+    }
 //! [21] //! [22]
 
 
@@ -109,12 +111,13 @@ void AnalogClock::paintEvent(QPaintEvent *)
 //! [23]
 
 //! [24]
-    painter.save();
+    {
-    painter.rotate(6.0 * time.second());
+        QPainterStateGuard guard(&painter);
-    painter.drawConvexPolygon(secondsHand, 4);
+        painter.rotate(6.0 * time.second());
-    painter.drawEllipse(-3, -3, 6, 6);
+        painter.drawConvexPolygon(secondsHand, 4);
-    painter.drawEllipse(-5, -68, 10, 10);
+        painter.drawEllipse(-3, -3, 6, 6);
-    painter.restore();
+        painter.drawEllipse(-5, -68, 10, 10);
+    }
 //! [24]
 
 //! [25]

examples/widgets/widgets/shapedclock/shapedclock.cpp

@@ -7,6 +7,7 @@
 #include <QCoreApplication>
 #include <QMouseEvent>
 #include <QPainter>
+#include <QPainterStateGuard>
 #include <QTime>
 #include <QTimer>
 
@@ -93,10 +94,11 @@ void ShapedClock::paintEvent(QPaintEvent *)
     painter.setPen(Qt::NoPen);
     painter.setBrush(hourColor);
 
-    painter.save();
+    {
-    painter.rotate(30.0 * ((time.hour() + time.minute() / 60.0)));
+        QPainterStateGuard guard(&painter);
-    painter.drawConvexPolygon(hourHand, 4);
+        painter.rotate(30.0 * ((time.hour() + time.minute() / 60.0)));
-    painter.restore();
+        painter.drawConvexPolygon(hourHand, 4);
+    }
 
     for (int i = 0; i < 12; ++i) {
         painter.drawRect(73, -3, 16, 6);
@@ -105,19 +107,21 @@ void ShapedClock::paintEvent(QPaintEvent *)
 
     painter.setBrush(minuteColor);
 
-    painter.save();
+    {
-    painter.rotate(6.0 * time.minute());
+        QPainterStateGuard guard(&painter);
-    painter.drawConvexPolygon(minuteHand, 4);
+        painter.rotate(6.0 * time.minute());
-    painter.restore();
+        painter.drawConvexPolygon(minuteHand, 4);
+    }
 
     painter.setBrush(secondsColor);
 
-    painter.save();
+    {
-    painter.rotate(6.0 * time.second());
+        QPainterStateGuard guard(&painter);
-    painter.drawConvexPolygon(secondsHand, 4);
+        painter.rotate(6.0 * time.second());
-    painter.drawEllipse(-3, -3, 6, 6);
+        painter.drawConvexPolygon(secondsHand, 4);
-    painter.drawEllipse(-5, -68, 10, 10);
+        painter.drawEllipse(-3, -3, 6, 6);
-    painter.restore();
+        painter.drawEllipse(-5, -68, 10, 10);
+    }
 
     painter.setPen(minuteColor);
 

licenseRule.json

@@ -32,6 +32,11 @@
                 "file type" : "build system",
                 "spdx" : ["MIT AND BSD-3-Clause"]
             },
+            "cmake/QtPublicSbomOpsHelpers.cmake" : {
+                "comment" : "MIT licensed copied parts",
+                "file type" : "build system",
+                "spdx" : ["MIT AND BSD-3-Clause"]
+            },
             "tests/auto/cmake/test_plugin_shared_static_flavor\\.cmake" : {
                 "comment" : "Exception. This is a test file.",
                 "file type" : "test",

src/3rdparty/D3D12MemoryAllocator/qt_attribution.json

@@ -1,6 +1,6 @@
 [
     {
-        "Id": "D3D12MemoryAllocator",
+        "Id": "d3d12memoryallocator",
         "Name": "D3D12 Memory Allocator",
         "QDocModule": "qtgui",
         "Description": "D3D12 Memory Allocator",
@@ -8,7 +8,7 @@
 
         "Homepage": "https://github.com/GPUOpen-LibrariesAndSDKs/D3D12MemoryAllocator",
         "Version": "f128d39b7a95b4235bd228d231646278dc6c24b2",
-        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/D3D12MemoryAllocator@f128d39b7a95b4235bd228d231646278dc6c24b2",
+        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/D3D12MemoryAllocator@$<VERSION>",
         "License": "MIT License",
         "LicenseId": "MIT",
         "LicenseFile": "LICENSE.txt",

src/3rdparty/VulkanMemoryAllocator/qt_attribution.json

@@ -1,6 +1,6 @@
 [
     {
-        "Id": "VulkanMemoryAllocator",
+        "Id": "vulkanmemoryallocator",
         "Name": "Vulkan Memory Allocator",
         "QDocModule": "qtgui",
         "Description": "Vulkan Memory Allocator",
@@ -8,7 +8,7 @@
 
         "Homepage": "https://github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator",
         "Version": "3.1.0",
-        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator@v3.1.0",
+        "PURL": "pkg:github/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator@v$<VERSION>",
         "License": "MIT License",
         "LicenseId": "MIT",
         "LicenseFile": "LICENSE.txt",

src/3rdparty/blake2/0001-mark-the-API-static-so-it-cant-be-exported-from-QtCore.patch

@@ -0,0 +1,67 @@
+From eb08d0a94e6f64c2ba78536c00c654102ed5cc41 Mon Sep 17 00:00:00 2001
+From: Thiago Macieira <thiago.macieira@intel.com>
+Date: Thu, 19 Dec 2024 14:02:08 -0300
+Subject: mark the API static so it can't be exported
+ from QtCore
+ 
+This affects static builds, where symbol visibility doesn't apply.
+---
+ src/3rdparty/blake2/src/blake2.h | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/src/3rdparty/blake2/src/blake2.h b/src/3rdparty/blake2/src/blake2.h
+index ca390305e60..0a90a9d2294 100644
+--- a/src/3rdparty/blake2/src/blake2.h
++++ b/src/3rdparty/blake2/src/blake2.h
+@@ -142,17 +142,17 @@ extern "C" {
+   };
+ 
+   /* Streaming API */
+-  int blake2s_init( blake2s_state *S, size_t outlen );
+-  int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
+-  int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
+-  int blake2s_update( blake2s_state *S, const void *in, size_t inlen );
+-  int blake2s_final( blake2s_state *S, void *out, size_t outlen );
+-
+-  int blake2b_init( blake2b_state *S, size_t outlen );
+-  int blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
+-  int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
+-  int blake2b_update( blake2b_state *S, const void *in, size_t inlen );
+-  int blake2b_final( blake2b_state *S, void *out, size_t outlen );
++  static int blake2s_init( blake2s_state *S, size_t outlen );
++  static int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
++  static int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
++  static int blake2s_update( blake2s_state *S, const void *in, size_t inlen );
++  static int blake2s_final( blake2s_state *S, void *out, size_t outlen );
++
++  static int blake2b_init( blake2b_state *S, size_t outlen );
++  static int blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
++  static int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
++  static int blake2b_update( blake2b_state *S, const void *in, size_t inlen );
++  static int blake2b_final( blake2b_state *S, void *out, size_t outlen );
+ 
+   int blake2sp_init( blake2sp_state *S, size_t outlen );
+   int blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
+@@ -176,8 +176,8 @@ extern "C" {
+   int blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
+ 
+   /* Simple API */
+-  int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+-  int blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
++  static int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
++  static int blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+ 
+   int blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+   int blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+@@ -186,7 +186,7 @@ extern "C" {
+   int blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+ 
+   /* This is simply an alias for blake2b */
+-  int blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
++  static int blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+ 
+ #if defined(__cplusplus)
+ }
+-- 
+2.47.1
+

src/3rdparty/blake2/REUSE.toml

@@ -1,7 +1,7 @@
 version = 1
 
 [[annotations]]
-path = ["src/blake2b-ref.c", "src/blake2s-ref.c", "src/blake2.h", "src/blake2-impl.h"]
+path = ["src/blake2b-ref.c", "src/blake2s-ref.c", "src/blake2.h", "src/blake2-impl.h", "0001-mark-the-API-static-so-it-cant-be-exported-from-QtCore.patch"]
 comment = "Copyright line mixed with other text."
 precedence = "override"
 SPDX-FileCopyrightText = "Copyright 2012, Samuel Neves <sneves@dei.uc.pt>"

src/3rdparty/blake2/qt_attribution.json

@@ -7,9 +7,9 @@
 
     "Description": "BLAKE2 is a cryptographic hash function faster than MD5, SHA-1, SHA-2, and SHA-3, yet is at least as secure as the latest standard SHA-3.",
     "Homepage": "https://blake2.net/",
-    "Version": "54f4faa4c16ea34bcd59d16e8da46a64b259fc07",
+    "Version": "ed1974ea83433eba7b2d95c5dcd9ac33cb847913",
-    "DownloadLocation": "https://github.com/BLAKE2/BLAKE2/tree/54f4faa4c16ea34bcd59d16e8da46a64b259fc07",
+    "DownloadLocation": "https://github.com/BLAKE2/BLAKE2/tree/ed1974ea83433eba7b2d95c5dcd9ac33cb847913",
-    "PURL": "pkg:github/BLAKE2/BLAKE2@54f4faa4c16ea34bcd59d16e8da46a64b259fc07",
+    "PURL": "pkg:github/BLAKE2/BLAKE2@$<VERSION>",
     "CPE": "cpe:2.3:a:blake2:blake2:*:*:*:*:*:*:*:*",
     "License": "Creative Commons Zero v1.0 Universal or Apache License 2.0",
     "LicenseId": "CC0-1.0 OR Apache-2.0",

src/3rdparty/blake2/src/blake2.h

@@ -142,17 +142,17 @@ extern "C" {
   };
 
   /* Streaming API */
-  int blake2s_init( blake2s_state *S, size_t outlen );
+  static int blake2s_init( blake2s_state *S, size_t outlen );
-  int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
+  static int blake2s_init_key( blake2s_state *S, size_t outlen, const void *key, size_t keylen );
-  int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
+  static int blake2s_init_param( blake2s_state *S, const blake2s_param *P );
-  int blake2s_update( blake2s_state *S, const void *in, size_t inlen );
+  static int blake2s_update( blake2s_state *S, const void *in, size_t inlen );
-  int blake2s_final( blake2s_state *S, void *out, size_t outlen );
+  static int blake2s_final( blake2s_state *S, void *out, size_t outlen );
 
-  int blake2b_init( blake2b_state *S, size_t outlen );
+  static int blake2b_init( blake2b_state *S, size_t outlen );
-  int blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
+  static int blake2b_init_key( blake2b_state *S, size_t outlen, const void *key, size_t keylen );
-  int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
+  static int blake2b_init_param( blake2b_state *S, const blake2b_param *P );
-  int blake2b_update( blake2b_state *S, const void *in, size_t inlen );
+  static int blake2b_update( blake2b_state *S, const void *in, size_t inlen );
-  int blake2b_final( blake2b_state *S, void *out, size_t outlen );
+  static int blake2b_final( blake2b_state *S, void *out, size_t outlen );
 
   int blake2sp_init( blake2sp_state *S, size_t outlen );
   int blake2sp_init_key( blake2sp_state *S, size_t outlen, const void *key, size_t keylen );
@@ -176,8 +176,8 @@ extern "C" {
   int blake2xb_final(blake2xb_state *S, void *out, size_t outlen);
 
   /* Simple API */
-  int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  static int blake2s( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
-  int blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  static int blake2b( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
   int blake2sp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
   int blake2bp( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
@@ -186,7 +186,7 @@ extern "C" {
   int blake2xb( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
   /* This is simply an alias for blake2b */
-  int blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
+  static int blake2( void *out, size_t outlen, const void *in, size_t inlen, const void *key, size_t keylen );
 
 #if defined(__cplusplus)
 }

src/3rdparty/double-conversion/qt_attribution.json

@@ -7,8 +7,8 @@
     "Homepage": "https://github.com/google/double-conversion",
     "Version": "3.3.0",
     "DownloadLocation": "https://github.com/google/double-conversion/releases/tag/v3.3.0",
-    "PURL": "pkg:github/google/double-conversion@v3.3.0",
+    "PURL": "pkg:github/google/double-conversion@v$<VERSION>",
-    "CPE": "cpe:2.3:a:google:double-conversion:3.3.0:*:*:*:*:*:*:*",
+    "CPE": "cpe:2.3:a:google:double-conversion:$<VERSION>:*:*:*:*:*:*:*",
     "License": "BSD 3-clause \"New\" or \"Revised\" License",
     "LicenseId": "BSD-3-Clause",
     "LicenseFile": "LICENSE",

src/3rdparty/freetype/qt_attribution.json

@@ -11,10 +11,10 @@
         "Version": "2.13.3",
         "DownloadLocation": "https://download.savannah.gnu.org/releases/freetype/freetype-2.13.3.tar.gz",
         "PURL": [
-            "pkg:github/freetype/freetype@VER-2-13-3"
+            "pkg:github/freetype/freetype@VER-$<VERSION_DASHED>"
         ],
         "CPE": [
-            "cpe:2.3:a:freetype:freetype:2.13:3:*:*:*:*:*:*"
+            "cpe:2.3:a:freetype:freetype:$<VERSION>:*:*:*:*:*:*:*"
         ],
 
         "License": "Freetype Project License or GNU General Public License v2.0 only",

src/3rdparty/gradle/qt_attribution.json

@@ -6,8 +6,8 @@
     "Homepage": "https://gradle.org",
     "Version": "8.10",
     "DownloadLocation": "https://github.com/gradle/gradle/releases/tag/v8.10.0",
-    "PURL": "pkg:github/gradle/gradle@v8.10.0",
+    "PURL": "pkg:github/gradle/gradle@v$<VERSION>",
-    "CPE": "cpe:2.3:a:gradle:gradle:8.10.0:*:*:*:*:*:*:*",
+    "CPE": "cpe:2.3:a:gradle:gradle:$<VERSION>:*:*:*:*:*:*:*",
     "QtUsage": "Needed to create Android packages",
     "License": "Apache License 2.0",
     "LicenseId": "Apache-2.0",

src/3rdparty/harfbuzz-ng/qt_attribution.json

@@ -9,8 +9,8 @@
     "Homepage": "http://harfbuzz.org",
     "Version": "10.1.0",
     "DownloadLocation": "https://github.com/harfbuzz/harfbuzz/releases/tag/10.1.0",
-    "PURL": "pkg:github/harfbuzz/harfbuzz@10.1.0",
+    "PURL": "pkg:github/harfbuzz/harfbuzz@$<VERSION>",
-    "CPE": "cpe:2.3:a:harfbuzz_project:harfbuzz:10.1.0:*:*:*:*:*:*:*",
+    "CPE": "cpe:2.3:a:harfbuzz_project:harfbuzz:$<VERSION>:*:*:*:*:*:*:*",
     "License": "MIT License",
     "LicenseId": "MIT",
     "LicenseFile": "COPYING",

src/3rdparty/icc/qt_attribution.json

@@ -1,6 +1,6 @@
 [
     {
-        "Id": "icc-sRGB-color-profile",
+        "Id": "icc-srgb-color-profile",
         "Name": "sRGB color profile icc file",
         "QDocModule": "qtgui",
         "QtUsage": "Used in Qt Gui (Embedded into PDF/A-1b files generated by QPrinter/QPdfWriter).",

src/3rdparty/libjpeg/ChangeLog.md

@@ -1,3 +1,122 @@
+3.1.0
+=====
+
+### Significant changes relative to 3.1 beta1:
+
+1. Fixed an issue in the TurboJPEG API whereby, when generating a
+lossless JPEG image with more than 8 bits per sample, specifying a point
+transform value greater than 7 resulted in an error ("Parameter value out of
+range") unless `TJPARAM_PRECISION`/`TJ.PARAM_PRECISION` was specified before
+`TJPARAM_LOSSLESSPT`/`TJ.PARAM_LOSSLESSPT`.
+
+2. Fixed a regression introduced by 1.4 beta1[3] that prevented
+`jpeg_set_defaults()` from resetting the Huffman tables to default (baseline)
+values if Huffman table optimization or progressive mode was previously enabled
+in the same libjpeg instance.
+
+3. Fixed an issue whereby lossless JPEG compression could not be disabled if it
+was previously enabled in a libjpeg or TurboJPEG instance.
+`jpeg_set_defaults()` now disables lossless JPEG compression in a libjpeg
+instance, and setting `TJPARAM_LOSSLESS`/`TJ.PARAM_LOSSLESS` to `0` now
+disables lossless JPEG compression in a TurboJPEG instance.
+
+
+3.1 beta1
+=========
+
+### Significant changes relative to 3.0.4:
+
+1. The libjpeg-turbo source tree has been reorganized to make it easier to find
+the README files, license information, and build instructions.  The
+documentation for the libjpeg API library and associated programs has been
+moved into the **doc/** subdirectory, all C source code and headers have been
+moved into a new **src/** subdirectory, and test scripts have been moved into a
+new **test/** subdirectory.
+
+2. cjpeg no longer allows GIF input files to be converted into
+12-bit-per-sample JPEG files.  That was never a useful feature, since GIF
+images have at most 256 colors referenced from a palette of 8-bit-per-component
+RGB values.
+
+3. Added support for lossless JPEG images with 2 to 15 bits per sample to the
+libjpeg and TurboJPEG APIs.  When creating or decompressing a lossless JPEG
+image and when loading or saving a PBMPLUS image, functions/methods specific to
+8-bit samples now handle 8-bit samples with 2 to 8 bits of data precision
+(specified using the `data_precision` field in `jpeg_compress_struct` or
+`jpeg_decompress_struct` or using `TJPARAM_PRECISION`/`TJ.PARAM_PRECISION`),
+functions/methods specific to 12-bit samples now handle 12-bit samples with 9
+to 12 bits of data precision, and functions/methods specific to 16-bit samples
+now handle 16-bit samples with 13 to 16 bits of data precision.  Refer to
+[libjpeg.txt](doc/libjpeg.txt), [usage.txt](doc/usage.txt), and the TurboJPEG
+API documentation for more details.
+
+4. All deprecated constants and methods in the TurboJPEG Java API have been
+removed.
+
+5. TJBench command-line arguments are now more consistent with those of cjpeg,
+djpeg, and jpegtran.  More specifically:
+
+     - `-copynone` has been replaced with `-copy none`.
+     - `-fastdct` has been replaced with `-dct fast`.
+     - `-fastupsample` has been replaced with `-nosmooth`.
+     - `-hflip` and `-vflip` have been replaced with
+`-flip {horizontal|vertical}`.
+     - `-limitscans` has been replaced with `-maxscans`, which allows the scan
+limit to be specified.
+     - `-rgb`, `-bgr`, `-rgbx`, `-bgrx`, `-xbgr`, `-xrgb`, and `-cmyk` have
+been replaced with `-pixelformat {rgb|bgr|rgbx|bgrx|xbgr|xrgb|cmyk}`.
+     - `-rot90`, `-rot180`, and `-rot270` have been replaced with
+`-rotate {90|180|270}`.
+     - `-stoponwarning` has been replaced with `-strict`.
+     - British spellings for `gray` (`grey`) and `optimize` (`optimise`) are
+now allowed.
+
+    The old command-line arguments are deprecated and will be removed in a
+future release.  TJBench command-line arguments can now be abbreviated as well.
+(Where possible, the abbreviations are the same as those supported by cjpeg,
+djpeg, and jpegtran.)
+
+6. Added a new TJBench option (`-pixelformat gray`) that can be used to test
+the performance of compressing/decompressing a grayscale JPEG image from/to a
+packed-pixel grayscale image.
+
+7. Fixed an issue whereby, if `TJPARAM_NOREALLOC` was set, TurboJPEG
+compression and lossless transformation functions ignored the JPEG buffer
+size(s) passed to them and assumed that the JPEG buffer(s) had been allocated
+to a worst-case size returned by `tj3JPEGBufSize()`.  This behavior was never
+documented, although the documentation was unclear regarding whether the JPEG
+buffer size should be specified if a JPEG buffer is pre-allocated to a
+worst-case size.
+
+8. The TurboJPEG C and Java APIs have been improved in the following ways:
+
+     - New image I/O methods (`TJCompressor.loadSourceImage()` and
+`TJDecompressor.saveImage()`) have been added to the Java API.  These methods
+work similarly to the `tj3LoadImage*()` and `tj3SaveImage*()` functions in the
+C API.
+     - The TurboJPEG lossless transformation function and methods now add
+restart markers to all destination images if
+`TJPARAM_RESTARTBLOCKS`/`TJ.PARAM_RESTARTBLOCKS` or
+`TJPARAM_RESTARTROWS`/`TJ.PARAM_RESTARTROWS` is set.
+     - New functions/methods (`tj3SetICCProfile()` /
+`TJCompressor.setICCProfile()` / `TJTransformer.setICCProfile()` and
+`tj3GetICCProfile()` / `TJDecompressor.getICCProfile()`) can be used to embed
+and retrieve ICC profiles.
+     - A new parameter (`TJPARAM_SAVEMARKERS`/`TJ.PARAM_SAVEMARKERS`) can be
+used to specify the types of markers that will be copied from the source image
+to the destination image during lossless transformation if
+`TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` is not specified.
+     - A new convenience function/method (`tj3TransformBufSize()` /
+`TJTransformer.bufSize()`) can be used to compute the worst-case destination
+buffer size for a given lossless transform, taking into account cropping,
+transposition of the width and height, grayscale conversion, and the embedded
+or extracted ICC profile.
+
+9. TJExample has been replaced with three programs (TJComp, TJDecomp, and
+TJTran) that demonstrate how to approximate the functionality of cjpeg, djpeg,
+and jpegtran using the TurboJPEG C and Java APIs.
+
+
 3.0.4
 =====
 
@@ -51,7 +170,11 @@ cropping regions to be unduly rejected when performing 90-degree rotation,
 270-degree rotation, transposition, transverse transposition, or grayscale
 conversion.
 
-8. Fixed an issue whereby the TurboJPEG lossless transformation function and
+8. Fixed a regression, introduced by 3.0 beta2[4], that prevented the
+`tjTransform()` backward compatibility function from copying extra markers from
+the source image to the destination image.
+
+9. Fixed an issue whereby the TurboJPEG lossless transformation function and
 methods did not honor `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it
 was specified for all lossless transforms.
 
@@ -302,8 +425,8 @@ information.
 `TJPARAM_LOSSLESSPT`/`TJ.PARAM_LOSSLESSPT`), and a cjpeg/TJBench option
 (`-lossless`) can be used to create a lossless JPEG image.  (Decompression of
 lossless JPEG images is handled automatically.)  Refer to
-[libjpeg.txt](libjpeg.txt), [usage.txt](usage.txt), and the TurboJPEG API
+[libjpeg.txt](doc/libjpeg.txt), [usage.txt](doc/usage.txt), and the TurboJPEG
-documentation for more details.
+API documentation for more details.
 
 6. Added support for 12-bit-per-component (lossy and lossless) and
 16-bit-per-component (lossless) JPEG images to the libjpeg and TurboJPEG APIs:
@@ -330,8 +453,8 @@ to create a 12-bit-per-component or 16-bit-per-component JPEG image.
 (Decompression and transformation of 12-bit-per-component and
 16-bit-per-component JPEG images is handled automatically.)
 
-    Refer to [libjpeg.txt](libjpeg.txt), [usage.txt](usage.txt), and the
+    Refer to [libjpeg.txt](doc/libjpeg.txt), [usage.txt](doc/usage.txt), and
-TurboJPEG API documentation for more details.
+the TurboJPEG API documentation for more details.
 
 
 2.1.5.1
@@ -1392,7 +1515,7 @@ use of AltiVec instructions.
 
 2. Added two new libjpeg API functions (`jpeg_skip_scanlines()` and
 `jpeg_crop_scanline()`) that can be used to partially decode a JPEG image.  See
-[libjpeg.txt](libjpeg.txt) for more details.
+[libjpeg.txt](doc/libjpeg.txt) for more details.
 
 3. The TJCompressor and TJDecompressor classes in the TurboJPEG Java API now
 implement the Closeable interface, so those classes can be used with a

src/3rdparty/libjpeg/LICENSE

@@ -94,7 +94,7 @@ intended solely for clarification.
 The Modified (3-clause) BSD License
 ===================================
 
-Copyright (C)2009-2023 D. R. Commander.  All Rights Reserved.<br>
+Copyright (C)2009-2024 D. R. Commander.  All Rights Reserved.<br>
 Copyright (C)2015 Viktor Szathmáry.  All Rights Reserved.
 
 Redistribution and use in source and binary forms, with or without

src/3rdparty/libjpeg/README.ijg

@@ -36,16 +36,18 @@ TO DO               Plans for future IJG releases.
 Other documentation files in the distribution are:
 
 User documentation:
-  usage.txt         Usage instructions for cjpeg, djpeg, jpegtran,
+  doc/usage.txt         Usage instructions for cjpeg, djpeg, jpegtran,
-                    rdjpgcom, and wrjpgcom.
+                        rdjpgcom, and wrjpgcom.
-  *.1               Unix-style man pages for programs (same info as usage.txt).
+  doc/*.1               Unix-style man pages for programs (same info as
-  wizard.txt        Advanced usage instructions for JPEG wizards only.
+                        usage.txt).
-  change.log        Version-to-version change highlights.
+  doc/wizard.txt        Advanced usage instructions for JPEG wizards only.
+  doc/change.log        Version-to-version change highlights.
 Programmer and internal documentation:
-  libjpeg.txt       How to use the JPEG library in your own programs.
+  doc/libjpeg.txt       How to use the JPEG library in your own programs.
-  example.c         Sample code for calling the JPEG library.
+  src/example.c         Sample code for calling the JPEG library.
-  structure.txt     Overview of the JPEG library's internal structure.
+  doc/structure.txt     Overview of the JPEG library's internal structure.
-  coderules.txt     Coding style rules --- please read if you contribute code.
+  doc/coderules.txt     Coding style rules --- please read if you contribute
+                        code.
 
 Please read at least usage.txt.  Some information can also be found in the JPEG
 FAQ (Frequently Asked Questions) article.  See ARCHIVE LOCATIONS below to find

src/3rdparty/libjpeg/README.md

@@ -69,8 +69,10 @@ JPEG images:
   generating planar YUV images and performing multiple simultaneous lossless
   transforms on an image.  The Java interface for libjpeg-turbo is written on
   top of the TurboJPEG API.  The TurboJPEG API is recommended for first-time
-  users of libjpeg-turbo.  Refer to [tjexample.c](tjexample.c) and
+  users of libjpeg-turbo.  Refer to [tjcomp.c](src/tjcomp.c),
-  [TJExample.java](java/TJExample.java) for examples of its usage and to
+  [tjdecomp.c](src/tjdecomp.c), [tjtran.c](src/tjtran.c),
+  [TJComp.java](java/TJComp.java), [TJDecomp.java](java/TJDecomp.java), and
+  [TJTran.java](java/TJTran.java) for examples of its usage and to
   <https://libjpeg-turbo.org/Documentation/Documentation> for API
   documentation.
 
@@ -80,8 +82,9 @@ JPEG images:
   more powerful.  The libjpeg API implementation in libjpeg-turbo is both
   API/ABI-compatible and mathematically compatible with libjpeg v6b.  It can
   also optionally be configured to be API/ABI-compatible with libjpeg v7 and v8
-  (see below.)  Refer to [cjpeg.c](cjpeg.c) and [djpeg.c](djpeg.c) for examples
+  (see below.)  Refer to [cjpeg.c](src/cjpeg.c) and [djpeg.c](src/djpeg.c) for
-  of its usage and to [libjpeg.txt](libjpeg.txt) for API documentation.
+  examples of its usage and to [libjpeg.txt](doc/libjpeg.txt) for API
+  documentation.
 
 There is no significant performance advantage to either API when both are used
 to perform similar operations.
@@ -133,9 +136,9 @@ extensions at compile time with:
 
     #ifdef JCS_ALPHA_EXTENSIONS
 
-[jcstest.c](jcstest.c), located in the libjpeg-turbo source tree, demonstrates
+[jcstest.c](src/jcstest.c), located in the libjpeg-turbo source tree,
-how to check for the existence of the colorspace extensions at compile time and
+demonstrates how to check for the existence of the colorspace extensions at
-run time.
+compile time and run time.
 
 libjpeg v7 and v8 API/ABI Emulation
 -----------------------------------

src/3rdparty/libjpeg/import_from_libjpeg_tarball.sh

@@ -40,12 +40,11 @@ copy_file() {
 }
 
 copy_file "LICENSE.md" "LICENSE"
+copy_file "ChangeLog.md" "ChangeLog.md"
+copy_file "README.md" "README.md"
+copy_file "README.ijg" "README.ijg"
 
 FILES="
-   change.log
-   ChangeLog.md
-   README.md
-   README.ijg
    jconfig.h.in
    jconfigint.h.in
 
@@ -136,9 +135,9 @@ FILES="
 "
 
 for i in $FILES; do
-    copy_file "$i" "src/$i"
+    copy_file "src/$i" "src/$i"
 done
-copy_file "jversion.h.in" "src/jversion.h"
+copy_file "src/jversion.h.in" "src/jversion.h"
 
 cyear=$(grep COPYRIGHT_YEAR $LIBJPEG_DIR/CMakeLists.txt | sed -e 's/.*"\(.*\)".*/\1/')
 sed -i -e "s/@COPYRIGHT_YEAR@/$cyear/" $TARGET_DIR/src/jversion.h

src/3rdparty/libjpeg/qt_attribution.json

@@ -7,10 +7,10 @@
 
     "Description": "The Independent JPEG Group's JPEG software",
     "Homepage": "http://libjpeg-turbo.virtualgl.org/",
-    "Version": "3.0.4",
+    "Version": "3.1.0",
-    "DownloadLocation": "https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/3.0.4/libjpeg-turbo-3.0.4.tar.gz",
+    "DownloadLocation": "https://github.com/libjpeg-turbo/libjpeg-turbo/releases/download/3.1.0/libjpeg-turbo-3.1.0.tar.gz",
-    "PURL": "pkg:github/libjpeg-turbo/libjpeg-turbo@3.0.4",
+    "PURL": "pkg:github/libjpeg-turbo/libjpeg-turbo@$<VERSION>",
-    "CPE": "cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:3.0.4:*:*:*:*:*:*:*",
+    "CPE": "cpe:2.3:a:libjpeg-turbo:libjpeg-turbo:$<VERSION>:*:*:*:*:*:*:*",
 
     "License": "Independent JPEG Group License and BSD 3-Clause \"New\" or \"Revised\" License",
     "LicenseId": "IJG AND BSD-3-Clause",

src/3rdparty/libjpeg/src/jcapimin.c

@@ -5,7 +5,7 @@
  * Copyright (C) 1994-1998, Thomas G. Lane.
  * Modified 2003-2010 by Guido Vollbeding.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -194,19 +194,19 @@ jpeg_finish_compress(j_compress_ptr cinfo)
       /* We bypass the main controller and invoke coef controller directly;
        * all work is being done from the coefficient buffer.
        */
-      if (cinfo->data_precision == 16) {
+      if (cinfo->data_precision <= 8) {
+        if (!(*cinfo->coef->compress_data) (cinfo, (JSAMPIMAGE)NULL))
+          ERREXIT(cinfo, JERR_CANT_SUSPEND);
+      } else if (cinfo->data_precision <= 12) {
+        if (!(*cinfo->coef->compress_data_12) (cinfo, (J12SAMPIMAGE)NULL))
+          ERREXIT(cinfo, JERR_CANT_SUSPEND);
+      } else {
 #ifdef C_LOSSLESS_SUPPORTED
         if (!(*cinfo->coef->compress_data_16) (cinfo, (J16SAMPIMAGE)NULL))
           ERREXIT(cinfo, JERR_CANT_SUSPEND);
 #else
         ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-      } else if (cinfo->data_precision == 12) {
-        if (!(*cinfo->coef->compress_data_12) (cinfo, (J12SAMPIMAGE)NULL))
-          ERREXIT(cinfo, JERR_CANT_SUSPEND);
-      } else {
-        if (!(*cinfo->coef->compress_data) (cinfo, (JSAMPIMAGE)NULL))
-          ERREXIT(cinfo, JERR_CANT_SUSPEND);
       }
     }
     (*cinfo->master->finish_pass) (cinfo);

src/3rdparty/libjpeg/src/jcapistd.c

@@ -4,7 +4,7 @@
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1994-1996, Thomas G. Lane.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -88,8 +88,21 @@ _jpeg_write_scanlines(j_compress_ptr cinfo, _JSAMPARRAY scanlines,
 #if BITS_IN_JSAMPLE != 16 || defined(C_LOSSLESS_SUPPORTED)
   JDIMENSION row_ctr, rows_left;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef C_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   if (cinfo->global_state != CSTATE_SCANNING)
     ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state);

src/3rdparty/libjpeg/src/jccolor.c

@@ -5,7 +5,7 @@
  * Copyright (C) 1991-1996, Thomas G. Lane.
  * libjpeg-turbo Modifications:
  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
- * Copyright (C) 2009-2012, 2015, 2022, D. R. Commander.
+ * Copyright (C) 2009-2012, 2015, 2022, 2024, D. R. Commander.
  * Copyright (C) 2014, MIPS Technologies, Inc., California.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
@@ -552,8 +552,21 @@ _jinit_color_converter(j_compress_ptr cinfo)
 {
   my_cconvert_ptr cconvert;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef C_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   cconvert = (my_cconvert_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
@@ -607,9 +620,11 @@ _jinit_color_converter(j_compress_ptr cinfo)
    */
   switch (cinfo->jpeg_color_space) {
   case JCS_GRAYSCALE:
+#ifdef C_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless &&
         cinfo->in_color_space != cinfo->jpeg_color_space)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     if (cinfo->num_components != 1)
       ERREXIT(cinfo, JERR_BAD_J_COLORSPACE);
     if (cinfo->in_color_space == JCS_GRAYSCALE)
@@ -631,8 +646,10 @@ _jinit_color_converter(j_compress_ptr cinfo)
     break;
 
   case JCS_RGB:
+#ifdef C_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless && !IsExtRGB(cinfo->in_color_space))
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     if (cinfo->num_components != 3)
       ERREXIT(cinfo, JERR_BAD_J_COLORSPACE);
     if (rgb_red[cinfo->in_color_space] == 0 &&
@@ -652,9 +669,11 @@ _jinit_color_converter(j_compress_ptr cinfo)
     break;
 
   case JCS_YCbCr:
+#ifdef C_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless &&
         cinfo->in_color_space != cinfo->jpeg_color_space)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     if (cinfo->num_components != 3)
       ERREXIT(cinfo, JERR_BAD_J_COLORSPACE);
     if (IsExtRGB(cinfo->in_color_space)) {
@@ -679,9 +698,11 @@ _jinit_color_converter(j_compress_ptr cinfo)
     break;
 
   case JCS_CMYK:
+#ifdef C_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless &&
         cinfo->in_color_space != cinfo->jpeg_color_space)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     if (cinfo->num_components != 4)
       ERREXIT(cinfo, JERR_BAD_J_COLORSPACE);
     if (cinfo->in_color_space == JCS_CMYK) {
@@ -696,9 +717,11 @@ _jinit_color_converter(j_compress_ptr cinfo)
     break;
 
   case JCS_YCCK:
+#ifdef C_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless &&
         cinfo->in_color_space != cinfo->jpeg_color_space)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     if (cinfo->num_components != 4)
       ERREXIT(cinfo, JERR_BAD_J_COLORSPACE);
     if (cinfo->in_color_space == JCS_CMYK) {

src/3rdparty/libjpeg/src/jcdiffct.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -346,6 +346,14 @@ _jinit_c_diff_controller(j_compress_ptr cinfo, boolean need_full_buffer)
   int ci, row;
   jpeg_component_info *compptr;
 
+#if BITS_IN_JSAMPLE == 8
+  if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+  if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+      cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+
   diff = (my_diff_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
                                 sizeof(my_diff_controller));

src/3rdparty/libjpeg/src/jcinit.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2020, 2022, D. R. Commander.
+ * Copyright (C) 2020, 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -40,7 +40,16 @@ jinit_compress_master(j_compress_ptr cinfo)
 
   /* Preprocessing */
   if (!cinfo->raw_data_in) {
-    if (cinfo->data_precision == 16) {
+    if (cinfo->data_precision <= 8) {
+      jinit_color_converter(cinfo);
+      jinit_downsampler(cinfo);
+      jinit_c_prep_controller(cinfo, FALSE /* never need full buffer here */);
+    } else if (cinfo->data_precision <= 12) {
+      j12init_color_converter(cinfo);
+      j12init_downsampler(cinfo);
+      j12init_c_prep_controller(cinfo,
+                                FALSE /* never need full buffer here */);
+    } else {
 #ifdef C_LOSSLESS_SUPPORTED
       j16init_color_converter(cinfo);
       j16init_downsampler(cinfo);
@@ -49,27 +58,18 @@ jinit_compress_master(j_compress_ptr cinfo)
 #else
       ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-    } else if (cinfo->data_precision == 12) {
-      j12init_color_converter(cinfo);
-      j12init_downsampler(cinfo);
-      j12init_c_prep_controller(cinfo,
-                                FALSE /* never need full buffer here */);
-    } else {
-      jinit_color_converter(cinfo);
-      jinit_downsampler(cinfo);
-      jinit_c_prep_controller(cinfo, FALSE /* never need full buffer here */);
     }
   }
 
   if (cinfo->master->lossless) {
 #ifdef C_LOSSLESS_SUPPORTED
     /* Prediction, sample differencing, and point transform */
-    if (cinfo->data_precision == 16)
+    if (cinfo->data_precision <= 8)
-      j16init_lossless_compressor(cinfo);
+      jinit_lossless_compressor(cinfo);
-    else if (cinfo->data_precision == 12)
+    else if (cinfo->data_precision <= 12)
       j12init_lossless_compressor(cinfo);
     else
-      jinit_lossless_compressor(cinfo);
+      j16init_lossless_compressor(cinfo);
     /* Entropy encoding: either Huffman or arithmetic coding. */
     if (cinfo->arith_code) {
       ERREXIT(cinfo, JERR_ARITH_NOTIMPL);
@@ -78,26 +78,26 @@ jinit_compress_master(j_compress_ptr cinfo)
     }
 
     /* Need a full-image difference buffer in any multi-pass mode. */
-    if (cinfo->data_precision == 16)
+    if (cinfo->data_precision <= 8)
-      j16init_c_diff_controller(cinfo, (boolean)(cinfo->num_scans > 1 ||
+      jinit_c_diff_controller(cinfo, (boolean)(cinfo->num_scans > 1 ||
-                                                 cinfo->optimize_coding));
+                                               cinfo->optimize_coding));
-    else if (cinfo->data_precision == 12)
+    else if (cinfo->data_precision <= 12)
       j12init_c_diff_controller(cinfo, (boolean)(cinfo->num_scans > 1 ||
                                                  cinfo->optimize_coding));
     else
-      jinit_c_diff_controller(cinfo, (boolean)(cinfo->num_scans > 1 ||
+      j16init_c_diff_controller(cinfo, (boolean)(cinfo->num_scans > 1 ||
-                                               cinfo->optimize_coding));
+                                                 cinfo->optimize_coding));
 #else
     ERREXIT(cinfo, JERR_NOT_COMPILED);
 #endif
   } else {
-    if (cinfo->data_precision == 16)
-      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
     /* Forward DCT */
-    if (cinfo->data_precision == 12)
+    if (cinfo->data_precision == 8)
+      jinit_forward_dct(cinfo);
+    else if (cinfo->data_precision == 12)
       j12init_forward_dct(cinfo);
     else
-      jinit_forward_dct(cinfo);
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
     /* Entropy encoding: either Huffman or arithmetic coding. */
     if (cinfo->arith_code) {
 #ifdef C_ARITH_CODING_SUPPORTED
@@ -125,16 +125,16 @@ jinit_compress_master(j_compress_ptr cinfo)
                                                cinfo->optimize_coding));
   }
 
-  if (cinfo->data_precision == 16)
+  if (cinfo->data_precision <= 8)
+    jinit_c_main_controller(cinfo, FALSE /* never need full buffer here */);
+  else if (cinfo->data_precision <= 12)
+    j12init_c_main_controller(cinfo, FALSE /* never need full buffer here */);
+  else
 #ifdef C_LOSSLESS_SUPPORTED
     j16init_c_main_controller(cinfo, FALSE /* never need full buffer here */);
 #else
     ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-  else if (cinfo->data_precision == 12)
-    j12init_c_main_controller(cinfo, FALSE /* never need full buffer here */);
-  else
-    jinit_c_main_controller(cinfo, FALSE /* never need full buffer here */);
 
   jinit_marker_writer(cinfo);
 

src/3rdparty/libjpeg/src/jclossls.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -308,6 +308,14 @@ _jinit_lossless_compressor(j_compress_ptr cinfo)
 {
   lossless_comp_ptr losslessc;
 
+#if BITS_IN_JSAMPLE == 8
+  if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+  if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+      cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+
   /* Create subobject in permanent pool */
   losslessc = (lossless_comp_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,

src/3rdparty/libjpeg/src/jcmainct.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -140,8 +140,21 @@ _jinit_c_main_controller(j_compress_ptr cinfo, boolean need_full_buffer)
   jpeg_component_info *compptr;
   int data_unit = cinfo->master->lossless ? 1 : DCTSIZE;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef C_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   main_ptr = (my_main_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,

src/3rdparty/libjpeg/src/jcmaster.c

@@ -190,13 +190,19 @@ initial_setup(j_compress_ptr cinfo, boolean transcode_only)
   if ((long)jd_samplesperrow != samplesperrow)
     ERREXIT(cinfo, JERR_WIDTH_OVERFLOW);
 
+  /* Lossy JPEG images must have 8 or 12 bits per sample.  Lossless JPEG images
+   * can have 2 to 16 bits per sample.
+   */
 #ifdef C_LOSSLESS_SUPPORTED
-  if (cinfo->data_precision != 8 && cinfo->data_precision != 12 &&
+  if (cinfo->master->lossless) {
-      cinfo->data_precision != 16)
+    if (cinfo->data_precision < 2 || cinfo->data_precision > 16)
-#else
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
-  if (cinfo->data_precision != 8 && cinfo->data_precision != 12)
+  } else
 #endif
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  {
+    if (cinfo->data_precision != 8 && cinfo->data_precision != 12)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   /* Check that number of components won't exceed internal array sizes */
   if (cinfo->num_components > MAX_COMPONENTS)
@@ -731,6 +737,7 @@ jinit_c_master_control(j_compress_ptr cinfo, boolean transcode_only)
     cinfo->num_scans = 1;
   }
 
+#ifdef C_LOSSLESS_SUPPORTED
   /* Disable smoothing and subsampling in lossless mode, since those are lossy
    * algorithms.  Set the JPEG colorspace to the input colorspace.  Disable raw
    * (downsampled) data input, because it isn't particularly useful without
@@ -747,6 +754,7 @@ jinit_c_master_control(j_compress_ptr cinfo, boolean transcode_only)
          ci++, compptr++)
       compptr->h_samp_factor = compptr->v_samp_factor = 1;
   }
+#endif
 
   /* Validate parameters, determine derived values */
   initial_setup(cinfo, transcode_only);

src/3rdparty/libjpeg/src/jcparam.c

@@ -7,7 +7,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2009-2011, 2018, 2023, D. R. Commander.
+ * Copyright (C) 2009-2011, 2018, 2023-2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -220,6 +220,9 @@ jpeg_set_defaults(j_compress_ptr cinfo)
   cinfo->scan_info = NULL;
   cinfo->num_scans = 0;
 
+  /* Default is lossy output */
+  cinfo->master->lossless = FALSE;
+
   /* Expect normal source image, not raw downsampled data */
   cinfo->raw_data_in = FALSE;
 
@@ -297,9 +300,11 @@ jpeg_default_colorspace(j_compress_ptr cinfo)
   case JCS_EXT_BGRA:
   case JCS_EXT_ABGR:
   case JCS_EXT_ARGB:
+#ifdef C_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless)
       jpeg_set_colorspace(cinfo, JCS_RGB);
     else
+#endif
       jpeg_set_colorspace(cinfo, JCS_YCbCr);
     break;
   case JCS_YCbCr:
@@ -479,10 +484,12 @@ jpeg_simple_progression(j_compress_ptr cinfo)
   if (cinfo->global_state != CSTATE_START)
     ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state);
 
+#ifdef C_LOSSLESS_SUPPORTED
   if (cinfo->master->lossless) {
     cinfo->master->lossless = FALSE;
     jpeg_default_colorspace(cinfo);
   }
+#endif
 
   /* Figure space needed for script.  Calculation must match code below! */
   if (ncomps == 3 && cinfo->jpeg_color_space == JCS_YCbCr) {

src/3rdparty/libjpeg/src/jcprepct.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -324,8 +324,21 @@ _jinit_c_prep_controller(j_compress_ptr cinfo, boolean need_full_buffer)
   jpeg_component_info *compptr;
   int data_unit = cinfo->master->lossless ? 1 : DCTSIZE;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef C_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   if (need_full_buffer)         /* safety check */
     ERREXIT(cinfo, JERR_BAD_BUFFER_MODE);

src/3rdparty/libjpeg/src/jcsample.c

@@ -8,7 +8,7 @@
  * libjpeg-turbo Modifications:
  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
  * Copyright (C) 2014, MIPS Technologies, Inc., California.
- * Copyright (C) 2015, 2019, 2022, D. R. Commander.
+ * Copyright (C) 2015, 2019, 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -470,8 +470,21 @@ _jinit_downsampler(j_compress_ptr cinfo)
   jpeg_component_info *compptr;
   boolean smoothok = TRUE;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef C_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   downsample = (my_downsample_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,

src/3rdparty/libjpeg/src/jdapimin.c

@@ -161,17 +161,21 @@ default_decompress_parms(j_decompress_ptr cinfo)
       int cid2 = cinfo->comp_info[2].component_id;
 
       if (cid0 == 1 && cid1 == 2 && cid2 == 3) {
+#ifdef D_LOSSLESS_SUPPORTED
         if (cinfo->master->lossless)
           cinfo->jpeg_color_space = JCS_RGB; /* assume RGB w/out marker */
         else
+#endif
           cinfo->jpeg_color_space = JCS_YCbCr; /* assume JFIF w/out marker */
       } else if (cid0 == 82 && cid1 == 71 && cid2 == 66)
         cinfo->jpeg_color_space = JCS_RGB; /* ASCII 'R', 'G', 'B' */
       else {
         TRACEMS3(cinfo, 1, JTRC_UNKNOWN_IDS, cid0, cid1, cid2);
+#ifdef D_LOSSLESS_SUPPORTED
         if (cinfo->master->lossless)
           cinfo->jpeg_color_space = JCS_RGB; /* assume it's RGB */
         else
+#endif
           cinfo->jpeg_color_space = JCS_YCbCr; /* assume it's YCbCr */
       }
     }

src/3rdparty/libjpeg/src/jdapistd.c

@@ -128,20 +128,19 @@ output_pass_setup(j_decompress_ptr cinfo)
       }
       /* Process some data */
       last_scanline = cinfo->output_scanline;
-#ifdef D_LOSSLESS_SUPPORTED
+      if (cinfo->data_precision <= 8)
-      if (cinfo->data_precision == 16)
+        (*cinfo->main->process_data) (cinfo, (JSAMPARRAY)NULL,
-        (*cinfo->main->process_data_16) (cinfo, (J16SAMPARRAY)NULL,
+                                      &cinfo->output_scanline, (JDIMENSION)0);
-                                         &cinfo->output_scanline,
+      else if (cinfo->data_precision <= 12)
-                                         (JDIMENSION)0);
-      else
-#endif
-      if (cinfo->data_precision == 12)
         (*cinfo->main->process_data_12) (cinfo, (J12SAMPARRAY)NULL,
                                          &cinfo->output_scanline,
                                          (JDIMENSION)0);
+#ifdef D_LOSSLESS_SUPPORTED
       else
-        (*cinfo->main->process_data) (cinfo, (JSAMPARRAY)NULL,
+        (*cinfo->main->process_data_16) (cinfo, (J16SAMPARRAY)NULL,
-                                      &cinfo->output_scanline, (JDIMENSION)0);
+                                         &cinfo->output_scanline,
+                                         (JDIMENSION)0);
+#endif
       if (cinfo->output_scanline == last_scanline)
         return FALSE;           /* No progress made, must suspend */
     }
@@ -314,8 +313,21 @@ _jpeg_read_scanlines(j_decompress_ptr cinfo, _JSAMPARRAY scanlines,
 #if BITS_IN_JSAMPLE != 16 || defined(D_LOSSLESS_SUPPORTED)
   JDIMENSION row_ctr;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef D_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   if (cinfo->global_state != DSTATE_SCANNING)
     ERREXIT1(cinfo, JERR_BAD_STATE, cinfo->global_state);

src/3rdparty/libjpeg/src/jdcolor.c

@@ -6,7 +6,7 @@
  * Modified 2011 by Guido Vollbeding.
  * libjpeg-turbo Modifications:
  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
- * Copyright (C) 2009, 2011-2012, 2014-2015, 2022, D. R. Commander.
+ * Copyright (C) 2009, 2011-2012, 2014-2015, 2022, 2024, D. R. Commander.
  * Copyright (C) 2013, Linaro Limited.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
@@ -759,8 +759,21 @@ _jinit_color_deconverter(j_decompress_ptr cinfo)
   my_cconvert_ptr cconvert;
   int ci;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef D_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   cconvert = (my_cconvert_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
@@ -802,9 +815,11 @@ _jinit_color_deconverter(j_decompress_ptr cinfo)
 
   switch (cinfo->out_color_space) {
   case JCS_GRAYSCALE:
+#ifdef D_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless &&
         cinfo->jpeg_color_space != cinfo->out_color_space)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     cinfo->out_color_components = 1;
     if (cinfo->jpeg_color_space == JCS_GRAYSCALE ||
         cinfo->jpeg_color_space == JCS_YCbCr) {
@@ -830,8 +845,10 @@ _jinit_color_deconverter(j_decompress_ptr cinfo)
   case JCS_EXT_BGRA:
   case JCS_EXT_ABGR:
   case JCS_EXT_ARGB:
+#ifdef D_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless && cinfo->jpeg_color_space != JCS_RGB)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     cinfo->out_color_components = rgb_pixelsize[cinfo->out_color_space];
     if (cinfo->jpeg_color_space == JCS_YCbCr) {
 #ifdef WITH_SIMD
@@ -858,8 +875,10 @@ _jinit_color_deconverter(j_decompress_ptr cinfo)
     break;
 
   case JCS_RGB565:
+#ifdef D_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     cinfo->out_color_components = 3;
     if (cinfo->dither_mode == JDITHER_NONE) {
       if (cinfo->jpeg_color_space == JCS_YCbCr) {
@@ -893,9 +912,11 @@ _jinit_color_deconverter(j_decompress_ptr cinfo)
     break;
 
   case JCS_CMYK:
+#ifdef D_LOSSLESS_SUPPORTED
     if (cinfo->master->lossless &&
         cinfo->jpeg_color_space != cinfo->out_color_space)
       ERREXIT(cinfo, JERR_CONVERSION_NOTIMPL);
+#endif
     cinfo->out_color_components = 4;
     if (cinfo->jpeg_color_space == JCS_YCCK) {
       cconvert->pub._color_convert = ycck_cmyk_convert;

src/3rdparty/libjpeg/src/jddiffct.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -350,6 +350,14 @@ _jinit_d_diff_controller(j_decompress_ptr cinfo, boolean need_full_buffer)
   int ci;
   jpeg_component_info *compptr;
 
+#if BITS_IN_JSAMPLE == 8
+  if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+  if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+      cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+
   diff = (my_diff_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
                                 sizeof(my_diff_controller));

src/3rdparty/libjpeg/src/jdinput.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2010, 2016, 2018, 2022, D. R. Commander.
+ * Copyright (C) 2010, 2016, 2018, 2022, 2024, D. R. Commander.
  * Copyright (C) 2015, Google, Inc.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
@@ -56,14 +56,19 @@ initial_setup(j_decompress_ptr cinfo)
       (long)cinfo->image_width > (long)JPEG_MAX_DIMENSION)
     ERREXIT1(cinfo, JERR_IMAGE_TOO_BIG, (unsigned int)JPEG_MAX_DIMENSION);
 
-  /* For now, precision must match compiled-in value... */
+  /* Lossy JPEG images must have 8 or 12 bits per sample.  Lossless JPEG images
+   * can have 2 to 16 bits per sample.
+   */
 #ifdef D_LOSSLESS_SUPPORTED
-  if (cinfo->data_precision != 8 && cinfo->data_precision != 12 &&
+  if (cinfo->master->lossless) {
-      cinfo->data_precision != 16)
+    if (cinfo->data_precision < 2 || cinfo->data_precision > 16)
-#else
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
-  if (cinfo->data_precision != 8 && cinfo->data_precision != 12)
+  } else
 #endif
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  {
+    if (cinfo->data_precision != 8 && cinfo->data_precision != 12)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   /* Check that number of components won't exceed internal array sizes */
   if (cinfo->num_components > MAX_COMPONENTS)

src/3rdparty/libjpeg/src/jdlossls.c

@@ -6,7 +6,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022, D. R. Commander.
+ * Copyright (C) 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -278,6 +278,14 @@ _jinit_lossless_decompressor(j_decompress_ptr cinfo)
 {
   lossless_decomp_ptr losslessd;
 
+#if BITS_IN_JSAMPLE == 8
+  if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+  if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+      cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+
   /* Create subobject in permanent pool */
   losslessd = (lossless_decomp_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_PERMANENT,

src/3rdparty/libjpeg/src/jdmainct.c

@@ -4,7 +4,7 @@
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1994-1996, Thomas G. Lane.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2010, 2016, 2022, D. R. Commander.
+ * Copyright (C) 2010, 2016, 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -431,8 +431,21 @@ _jinit_d_main_controller(j_decompress_ptr cinfo, boolean need_full_buffer)
   int ci, rgroup, ngroups;
   jpeg_component_info *compptr;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef D_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   main_ptr = (my_main_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,

src/3rdparty/libjpeg/src/jdmaster.c

@@ -7,7 +7,7 @@
  * Lossless JPEG Modifications:
  * Copyright (C) 1999, Ken Murchison.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2009-2011, 2016, 2019, 2022-2023, D. R. Commander.
+ * Copyright (C) 2009-2011, 2016, 2019, 2022-2024, D. R. Commander.
  * Copyright (C) 2013, Linaro Limited.
  * Copyright (C) 2015, Google, Inc.
  * For conditions of distribution and use, see the accompanying README.ijg
@@ -422,7 +422,50 @@ prepare_range_limit_table(j_decompress_ptr cinfo)
 #endif
   int i;
 
-  if (cinfo->data_precision == 16) {
+  if (cinfo->data_precision <= 8) {
+    table = (JSAMPLE *)
+      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
+                  (5 * (MAXJSAMPLE + 1) + CENTERJSAMPLE) * sizeof(JSAMPLE));
+    table += (MAXJSAMPLE + 1);  /* allow negative subscripts of simple table */
+    cinfo->sample_range_limit = table;
+    /* First segment of "simple" table: limit[x] = 0 for x < 0 */
+    memset(table - (MAXJSAMPLE + 1), 0, (MAXJSAMPLE + 1) * sizeof(JSAMPLE));
+    /* Main part of "simple" table: limit[x] = x */
+    for (i = 0; i <= MAXJSAMPLE; i++)
+      table[i] = (JSAMPLE)i;
+    table += CENTERJSAMPLE;     /* Point to where post-IDCT table starts */
+    /* End of simple table, rest of first half of post-IDCT table */
+    for (i = CENTERJSAMPLE; i < 2 * (MAXJSAMPLE + 1); i++)
+      table[i] = MAXJSAMPLE;
+    /* Second half of post-IDCT table */
+    memset(table + (2 * (MAXJSAMPLE + 1)), 0,
+           (2 * (MAXJSAMPLE + 1) - CENTERJSAMPLE) * sizeof(JSAMPLE));
+    memcpy(table + (4 * (MAXJSAMPLE + 1) - CENTERJSAMPLE),
+           cinfo->sample_range_limit, CENTERJSAMPLE * sizeof(JSAMPLE));
+  } else if (cinfo->data_precision <= 12) {
+    table12 = (J12SAMPLE *)
+      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
+                  (5 * (MAXJ12SAMPLE + 1) + CENTERJ12SAMPLE) *
+                  sizeof(J12SAMPLE));
+    table12 += (MAXJ12SAMPLE + 1);  /* allow negative subscripts of simple
+                                       table */
+    cinfo->sample_range_limit = (JSAMPLE *)table12;
+    /* First segment of "simple" table: limit[x] = 0 for x < 0 */
+    memset(table12 - (MAXJ12SAMPLE + 1), 0,
+           (MAXJ12SAMPLE + 1) * sizeof(J12SAMPLE));
+    /* Main part of "simple" table: limit[x] = x */
+    for (i = 0; i <= MAXJ12SAMPLE; i++)
+      table12[i] = (J12SAMPLE)i;
+    table12 += CENTERJ12SAMPLE; /* Point to where post-IDCT table starts */
+    /* End of simple table, rest of first half of post-IDCT table */
+    for (i = CENTERJ12SAMPLE; i < 2 * (MAXJ12SAMPLE + 1); i++)
+      table12[i] = MAXJ12SAMPLE;
+    /* Second half of post-IDCT table */
+    memset(table12 + (2 * (MAXJ12SAMPLE + 1)), 0,
+           (2 * (MAXJ12SAMPLE + 1) - CENTERJ12SAMPLE) * sizeof(J12SAMPLE));
+    memcpy(table12 + (4 * (MAXJ12SAMPLE + 1) - CENTERJ12SAMPLE),
+           cinfo->sample_range_limit, CENTERJ12SAMPLE * sizeof(J12SAMPLE));
+  } else {
 #ifdef D_LOSSLESS_SUPPORTED
     table16 = (J16SAMPLE *)
       (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
@@ -449,49 +492,6 @@ prepare_range_limit_table(j_decompress_ptr cinfo)
 #else
     ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-  } else if (cinfo->data_precision == 12) {
-    table12 = (J12SAMPLE *)
-      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
-                  (5 * (MAXJ12SAMPLE + 1) + CENTERJ12SAMPLE) *
-                  sizeof(J12SAMPLE));
-    table12 += (MAXJ12SAMPLE + 1);  /* allow negative subscripts of simple
-                                       table */
-    cinfo->sample_range_limit = (JSAMPLE *)table12;
-    /* First segment of "simple" table: limit[x] = 0 for x < 0 */
-    memset(table12 - (MAXJ12SAMPLE + 1), 0,
-           (MAXJ12SAMPLE + 1) * sizeof(J12SAMPLE));
-    /* Main part of "simple" table: limit[x] = x */
-    for (i = 0; i <= MAXJ12SAMPLE; i++)
-      table12[i] = (J12SAMPLE)i;
-    table12 += CENTERJ12SAMPLE; /* Point to where post-IDCT table starts */
-    /* End of simple table, rest of first half of post-IDCT table */
-    for (i = CENTERJ12SAMPLE; i < 2 * (MAXJ12SAMPLE + 1); i++)
-      table12[i] = MAXJ12SAMPLE;
-    /* Second half of post-IDCT table */
-    memset(table12 + (2 * (MAXJ12SAMPLE + 1)), 0,
-           (2 * (MAXJ12SAMPLE + 1) - CENTERJ12SAMPLE) * sizeof(J12SAMPLE));
-    memcpy(table12 + (4 * (MAXJ12SAMPLE + 1) - CENTERJ12SAMPLE),
-           cinfo->sample_range_limit, CENTERJ12SAMPLE * sizeof(J12SAMPLE));
-  } else {
-    table = (JSAMPLE *)
-      (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,
-                  (5 * (MAXJSAMPLE + 1) + CENTERJSAMPLE) * sizeof(JSAMPLE));
-    table += (MAXJSAMPLE + 1);  /* allow negative subscripts of simple table */
-    cinfo->sample_range_limit = table;
-    /* First segment of "simple" table: limit[x] = 0 for x < 0 */
-    memset(table - (MAXJSAMPLE + 1), 0, (MAXJSAMPLE + 1) * sizeof(JSAMPLE));
-    /* Main part of "simple" table: limit[x] = x */
-    for (i = 0; i <= MAXJSAMPLE; i++)
-      table[i] = (JSAMPLE)i;
-    table += CENTERJSAMPLE;     /* Point to where post-IDCT table starts */
-    /* End of simple table, rest of first half of post-IDCT table */
-    for (i = CENTERJSAMPLE; i < 2 * (MAXJSAMPLE + 1); i++)
-      table[i] = MAXJSAMPLE;
-    /* Second half of post-IDCT table */
-    memset(table + (2 * (MAXJSAMPLE + 1)), 0,
-           (2 * (MAXJSAMPLE + 1) - CENTERJSAMPLE) * sizeof(JSAMPLE));
-    memcpy(table + (4 * (MAXJSAMPLE + 1) - CENTERJSAMPLE),
-           cinfo->sample_range_limit, CENTERJSAMPLE * sizeof(JSAMPLE));
   }
 }
 
@@ -521,10 +521,12 @@ master_selection(j_decompress_ptr cinfo)
    * particularly useful without subsampling and has not been tested in
    * lossless mode.
    */
+#ifdef D_LOSSLESS_SUPPORTED
   if (cinfo->master->lossless) {
     cinfo->raw_data_out = FALSE;
     cinfo->scale_num = cinfo->scale_denom = 1;
   }
+#endif
 
   /* Initialize dimensions and other stuff */
   jpeg_calc_output_dimensions(cinfo);
@@ -570,12 +572,12 @@ master_selection(j_decompress_ptr cinfo)
 
     if (cinfo->enable_1pass_quant) {
 #ifdef QUANT_1PASS_SUPPORTED
-      if (cinfo->data_precision == 16)
+      if (cinfo->data_precision == 8)
-        ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+        jinit_1pass_quantizer(cinfo);
       else if (cinfo->data_precision == 12)
         j12init_1pass_quantizer(cinfo);
       else
-        jinit_1pass_quantizer(cinfo);
+        ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
       master->quantizer_1pass = cinfo->cquantize;
 #else
       ERREXIT(cinfo, JERR_NOT_COMPILED);
@@ -585,12 +587,12 @@ master_selection(j_decompress_ptr cinfo)
     /* We use the 2-pass code to map to external colormaps. */
     if (cinfo->enable_2pass_quant || cinfo->enable_external_quant) {
 #ifdef QUANT_2PASS_SUPPORTED
-      if (cinfo->data_precision == 16)
+      if (cinfo->data_precision == 8)
-        ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+        jinit_2pass_quantizer(cinfo);
       else if (cinfo->data_precision == 12)
         j12init_2pass_quantizer(cinfo);
       else
-        jinit_2pass_quantizer(cinfo);
+        ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
       master->quantizer_2pass = cinfo->cquantize;
 #else
       ERREXIT(cinfo, JERR_NOT_COMPILED);
@@ -605,41 +607,41 @@ master_selection(j_decompress_ptr cinfo)
   if (!cinfo->raw_data_out) {
     if (master->using_merged_upsample) {
 #ifdef UPSAMPLE_MERGING_SUPPORTED
-      if (cinfo->data_precision == 16)
+      if (cinfo->data_precision == 8)
-        ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+        jinit_merged_upsampler(cinfo); /* does color conversion too */
       else if (cinfo->data_precision == 12)
         j12init_merged_upsampler(cinfo); /* does color conversion too */
       else
-        jinit_merged_upsampler(cinfo); /* does color conversion too */
+        ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #else
       ERREXIT(cinfo, JERR_NOT_COMPILED);
 #endif
     } else {
-      if (cinfo->data_precision == 16) {
+      if (cinfo->data_precision <= 8) {
+        jinit_color_deconverter(cinfo);
+        jinit_upsampler(cinfo);
+      } else if (cinfo->data_precision <= 12) {
+        j12init_color_deconverter(cinfo);
+        j12init_upsampler(cinfo);
+      } else {
 #ifdef D_LOSSLESS_SUPPORTED
         j16init_color_deconverter(cinfo);
         j16init_upsampler(cinfo);
 #else
         ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-      } else if (cinfo->data_precision == 12) {
-        j12init_color_deconverter(cinfo);
-        j12init_upsampler(cinfo);
-      } else {
-        jinit_color_deconverter(cinfo);
-        jinit_upsampler(cinfo);
       }
     }
-    if (cinfo->data_precision == 16)
+    if (cinfo->data_precision <= 8)
+      jinit_d_post_controller(cinfo, cinfo->enable_2pass_quant);
+    else if (cinfo->data_precision <= 12)
+      j12init_d_post_controller(cinfo, cinfo->enable_2pass_quant);
+    else
 #ifdef D_LOSSLESS_SUPPORTED
       j16init_d_post_controller(cinfo, cinfo->enable_2pass_quant);
 #else
       ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-    else if (cinfo->data_precision == 12)
-      j12init_d_post_controller(cinfo, cinfo->enable_2pass_quant);
-    else
-      jinit_d_post_controller(cinfo, cinfo->enable_2pass_quant);
   }
 
   if (cinfo->master->lossless) {
@@ -647,12 +649,12 @@ master_selection(j_decompress_ptr cinfo)
     /* Prediction, sample undifferencing, point transform, and sample size
      * scaling
      */
-    if (cinfo->data_precision == 16)
+    if (cinfo->data_precision <= 8)
-      j16init_lossless_decompressor(cinfo);
+      jinit_lossless_decompressor(cinfo);
-    else if (cinfo->data_precision == 12)
+    else if (cinfo->data_precision <= 12)
       j12init_lossless_decompressor(cinfo);
     else
-      jinit_lossless_decompressor(cinfo);
+      j16init_lossless_decompressor(cinfo);
     /* Entropy decoding: either Huffman or arithmetic coding. */
     if (cinfo->arith_code) {
       ERREXIT(cinfo, JERR_ARITH_NOTIMPL);
@@ -663,23 +665,23 @@ master_selection(j_decompress_ptr cinfo)
     /* Initialize principal buffer controllers. */
     use_c_buffer = cinfo->inputctl->has_multiple_scans ||
                    cinfo->buffered_image;
-    if (cinfo->data_precision == 16)
+    if (cinfo->data_precision <= 8)
-      j16init_d_diff_controller(cinfo, use_c_buffer);
+      jinit_d_diff_controller(cinfo, use_c_buffer);
-    else if (cinfo->data_precision == 12)
+    else if (cinfo->data_precision <= 12)
       j12init_d_diff_controller(cinfo, use_c_buffer);
     else
-      jinit_d_diff_controller(cinfo, use_c_buffer);
+      j16init_d_diff_controller(cinfo, use_c_buffer);
 #else
     ERREXIT(cinfo, JERR_NOT_COMPILED);
 #endif
   } else {
-    if (cinfo->data_precision == 16)
-      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
     /* Inverse DCT */
-    if (cinfo->data_precision == 12)
+    if (cinfo->data_precision == 8)
+      jinit_inverse_dct(cinfo);
+    else if (cinfo->data_precision == 12)
       j12init_inverse_dct(cinfo);
     else
-      jinit_inverse_dct(cinfo);
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
     /* Entropy decoding: either Huffman or arithmetic coding. */
     if (cinfo->arith_code) {
 #ifdef D_ARITH_CODING_SUPPORTED
@@ -708,18 +710,18 @@ master_selection(j_decompress_ptr cinfo)
   }
 
   if (!cinfo->raw_data_out) {
-    if (cinfo->data_precision == 16)
+    if (cinfo->data_precision <= 8)
+      jinit_d_main_controller(cinfo, FALSE /* never need full buffer here */);
+    else if (cinfo->data_precision <= 12)
+      j12init_d_main_controller(cinfo,
+                                FALSE /* never need full buffer here */);
+    else
 #ifdef D_LOSSLESS_SUPPORTED
       j16init_d_main_controller(cinfo,
                                 FALSE /* never need full buffer here */);
 #else
       ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
 #endif
-    else if (cinfo->data_precision == 12)
-      j12init_d_main_controller(cinfo,
-                                FALSE /* never need full buffer here */);
-    else
-      jinit_d_main_controller(cinfo, FALSE /* never need full buffer here */);
   }
 
   /* We can now tell the memory manager to allocate virtual arrays. */

src/3rdparty/libjpeg/src/jdpostct.c

@@ -4,7 +4,7 @@
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1994-1996, Thomas G. Lane.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2022-2023, D. R. Commander.
+ * Copyright (C) 2022-2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -267,8 +267,21 @@ _jinit_d_post_controller(j_decompress_ptr cinfo, boolean need_full_buffer)
 {
   my_post_ptr post;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef D_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   post = (my_post_ptr)
     (*cinfo->mem->alloc_small) ((j_common_ptr)cinfo, JPOOL_IMAGE,

src/3rdparty/libjpeg/src/jdsample.c

@@ -5,7 +5,7 @@
  * Copyright (C) 1991-1996, Thomas G. Lane.
  * libjpeg-turbo Modifications:
  * Copyright 2009 Pierre Ossman <ossman@cendio.se> for Cendio AB
- * Copyright (C) 2010, 2015-2016, 2022, D. R. Commander.
+ * Copyright (C) 2010, 2015-2016, 2022, 2024, D. R. Commander.
  * Copyright (C) 2014, MIPS Technologies, Inc., California.
  * Copyright (C) 2015, Google, Inc.
  * Copyright (C) 2019-2020, Arm Limited.
@@ -421,8 +421,21 @@ _jinit_upsampler(j_decompress_ptr cinfo)
   boolean need_buffer, do_fancy;
   int h_in_group, v_in_group, h_out_group, v_out_group;
 
-  if (cinfo->data_precision != BITS_IN_JSAMPLE)
+#ifdef D_LOSSLESS_SUPPORTED
-    ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  if (cinfo->master->lossless) {
+#if BITS_IN_JSAMPLE == 8
+    if (cinfo->data_precision > BITS_IN_JSAMPLE || cinfo->data_precision < 2)
+#else
+    if (cinfo->data_precision > BITS_IN_JSAMPLE ||
+        cinfo->data_precision < BITS_IN_JSAMPLE - 3)
+#endif
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  } else
+#endif
+  {
+    if (cinfo->data_precision != BITS_IN_JSAMPLE)
+      ERREXIT1(cinfo, JERR_BAD_PRECISION, cinfo->data_precision);
+  }
 
   if (!cinfo->master->jinit_upsampler_no_alloc) {
     upsample = (my_upsample_ptr)

src/3rdparty/libjpeg/src/jmemmgr.c

@@ -4,7 +4,7 @@
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1991-1997, Thomas G. Lane.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2016, 2021-2022, D. R. Commander.
+ * Copyright (C) 2016, 2021-2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -156,8 +156,9 @@ typedef my_memory_mgr *my_mem_ptr;
 
 struct jvirt_sarray_control {
   JSAMPARRAY mem_buffer;        /* => the in-memory buffer (if
-                                   cinfo->data_precision is 12, then this is
+                                   cinfo->data_precision > 8, then this is
-                                   actually a J12SAMPARRAY) */
+                                   actually a J12SAMPARRAY or a
+                                   J16SAMPARRAY) */
   JDIMENSION rows_in_array;     /* total virtual array height */
   JDIMENSION samplesperrow;     /* width of array (and of memory buffer) */
   JDIMENSION maxaccess;         /* max rows accessed by access_virt_sarray */
@@ -449,8 +450,8 @@ alloc_sarray(j_common_ptr cinfo, int pool_id, JDIMENSION samplesperrow,
   int data_precision = cinfo->is_decompressor ?
                         ((j_decompress_ptr)cinfo)->data_precision :
                         ((j_compress_ptr)cinfo)->data_precision;
-  size_t sample_size = data_precision == 16 ?
+  size_t sample_size = data_precision > 12 ?
-                       sizeof(J16SAMPLE) : (data_precision == 12 ?
+                       sizeof(J16SAMPLE) : (data_precision > 8 ?
                                             sizeof(J12SAMPLE) :
                                             sizeof(JSAMPLE));
 
@@ -477,7 +478,44 @@ alloc_sarray(j_common_ptr cinfo, int pool_id, JDIMENSION samplesperrow,
     rowsperchunk = numrows;
   mem->last_rowsperchunk = rowsperchunk;
 
-  if (data_precision == 16) {
+  if (data_precision <= 8) {
+    /* Get space for row pointers (small object) */
+    result = (JSAMPARRAY)alloc_small(cinfo, pool_id,
+                                     (size_t)(numrows * sizeof(JSAMPROW)));
+
+    /* Get the rows themselves (large objects) */
+    currow = 0;
+    while (currow < numrows) {
+      rowsperchunk = MIN(rowsperchunk, numrows - currow);
+      workspace = (JSAMPROW)alloc_large(cinfo, pool_id,
+        (size_t)((size_t)rowsperchunk * (size_t)samplesperrow * sample_size));
+      for (i = rowsperchunk; i > 0; i--) {
+        result[currow++] = workspace;
+        workspace += samplesperrow;
+      }
+    }
+
+    return result;
+  } else if (data_precision <= 12) {
+    /* Get space for row pointers (small object) */
+    result12 = (J12SAMPARRAY)alloc_small(cinfo, pool_id,
+                                         (size_t)(numrows *
+                                                  sizeof(J12SAMPROW)));
+
+    /* Get the rows themselves (large objects) */
+    currow = 0;
+    while (currow < numrows) {
+      rowsperchunk = MIN(rowsperchunk, numrows - currow);
+      workspace12 = (J12SAMPROW)alloc_large(cinfo, pool_id,
+        (size_t)((size_t)rowsperchunk * (size_t)samplesperrow * sample_size));
+      for (i = rowsperchunk; i > 0; i--) {
+        result12[currow++] = workspace12;
+        workspace12 += samplesperrow;
+      }
+    }
+
+    return (JSAMPARRAY)result12;
+  } else {
 #if defined(C_LOSSLESS_SUPPORTED) || defined(D_LOSSLESS_SUPPORTED)
     /* Get space for row pointers (small object) */
     result16 = (J16SAMPARRAY)alloc_small(cinfo, pool_id,
@@ -501,43 +539,6 @@ alloc_sarray(j_common_ptr cinfo, int pool_id, JDIMENSION samplesperrow,
     ERREXIT1(cinfo, JERR_BAD_PRECISION, data_precision);
     return NULL;
 #endif
-  } else if (data_precision == 12) {
-    /* Get space for row pointers (small object) */
-    result12 = (J12SAMPARRAY)alloc_small(cinfo, pool_id,
-                                         (size_t)(numrows *
-                                                  sizeof(J12SAMPROW)));
-
-    /* Get the rows themselves (large objects) */
-    currow = 0;
-    while (currow < numrows) {
-      rowsperchunk = MIN(rowsperchunk, numrows - currow);
-      workspace12 = (J12SAMPROW)alloc_large(cinfo, pool_id,
-        (size_t)((size_t)rowsperchunk * (size_t)samplesperrow * sample_size));
-      for (i = rowsperchunk; i > 0; i--) {
-        result12[currow++] = workspace12;
-        workspace12 += samplesperrow;
-      }
-    }
-
-    return (JSAMPARRAY)result12;
-  } else {
-    /* Get space for row pointers (small object) */
-    result = (JSAMPARRAY)alloc_small(cinfo, pool_id,
-                                     (size_t)(numrows * sizeof(JSAMPROW)));
-
-    /* Get the rows themselves (large objects) */
-    currow = 0;
-    while (currow < numrows) {
-      rowsperchunk = MIN(rowsperchunk, numrows - currow);
-      workspace = (JSAMPROW)alloc_large(cinfo, pool_id,
-        (size_t)((size_t)rowsperchunk * (size_t)samplesperrow * sample_size));
-      for (i = rowsperchunk; i > 0; i--) {
-        result[currow++] = workspace;
-        workspace += samplesperrow;
-      }
-    }
-
-    return result;
   }
 }
 
@@ -703,8 +704,8 @@ realize_virt_arrays(j_common_ptr cinfo)
   int data_precision = cinfo->is_decompressor ?
                         ((j_decompress_ptr)cinfo)->data_precision :
                         ((j_compress_ptr)cinfo)->data_precision;
-  size_t sample_size = data_precision == 16 ?
+  size_t sample_size = data_precision > 12 ?
-                       sizeof(J16SAMPLE) : (data_precision == 12 ?
+                       sizeof(J16SAMPLE) : (data_precision > 8 ?
                                             sizeof(J12SAMPLE) :
                                             sizeof(JSAMPLE));
 
@@ -821,8 +822,8 @@ do_sarray_io(j_common_ptr cinfo, jvirt_sarray_ptr ptr, boolean writing)
   int data_precision = cinfo->is_decompressor ?
                         ((j_decompress_ptr)cinfo)->data_precision :
                         ((j_compress_ptr)cinfo)->data_precision;
-  size_t sample_size = data_precision == 16 ?
+  size_t sample_size = data_precision > 12 ?
-                       sizeof(J16SAMPLE) : (data_precision == 12 ?
+                       sizeof(J16SAMPLE) : (data_precision > 8 ?
                                             sizeof(J12SAMPLE) :
                                             sizeof(JSAMPLE));
 
@@ -840,7 +841,27 @@ do_sarray_io(j_common_ptr cinfo, jvirt_sarray_ptr ptr, boolean writing)
     if (rows <= 0)              /* this chunk might be past end of file! */
       break;
     byte_count = rows * bytesperrow;
-    if (data_precision == 16) {
+    if (data_precision <= 8) {
+      if (writing)
+        (*ptr->b_s_info.write_backing_store) (cinfo, &ptr->b_s_info,
+                                              (void *)ptr->mem_buffer[i],
+                                              file_offset, byte_count);
+      else
+        (*ptr->b_s_info.read_backing_store) (cinfo, &ptr->b_s_info,
+                                             (void *)ptr->mem_buffer[i],
+                                             file_offset, byte_count);
+    } else if (data_precision <= 12) {
+      J12SAMPARRAY mem_buffer12 = (J12SAMPARRAY)ptr->mem_buffer;
+
+      if (writing)
+        (*ptr->b_s_info.write_backing_store) (cinfo, &ptr->b_s_info,
+                                              (void *)mem_buffer12[i],
+                                              file_offset, byte_count);
+      else
+        (*ptr->b_s_info.read_backing_store) (cinfo, &ptr->b_s_info,
+                                             (void *)mem_buffer12[i],
+                                             file_offset, byte_count);
+    } else {
 #if defined(C_LOSSLESS_SUPPORTED) || defined(D_LOSSLESS_SUPPORTED)
       J16SAMPARRAY mem_buffer16 = (J16SAMPARRAY)ptr->mem_buffer;
 
@@ -855,26 +876,6 @@ do_sarray_io(j_common_ptr cinfo, jvirt_sarray_ptr ptr, boolean writing)
 #else
       ERREXIT1(cinfo, JERR_BAD_PRECISION, data_precision);
 #endif
-    } else if (data_precision == 12) {
-      J12SAMPARRAY mem_buffer12 = (J12SAMPARRAY)ptr->mem_buffer;
-
-      if (writing)
-        (*ptr->b_s_info.write_backing_store) (cinfo, &ptr->b_s_info,
-                                              (void *)mem_buffer12[i],
-                                              file_offset, byte_count);
-      else
-        (*ptr->b_s_info.read_backing_store) (cinfo, &ptr->b_s_info,
-                                             (void *)mem_buffer12[i],
-                                             file_offset, byte_count);
-    } else {
-      if (writing)
-        (*ptr->b_s_info.write_backing_store) (cinfo, &ptr->b_s_info,
-                                              (void *)ptr->mem_buffer[i],
-                                              file_offset, byte_count);
-      else
-        (*ptr->b_s_info.read_backing_store) (cinfo, &ptr->b_s_info,
-                                             (void *)ptr->mem_buffer[i],
-                                             file_offset, byte_count);
     }
     file_offset += byte_count;
   }
@@ -926,8 +927,8 @@ access_virt_sarray(j_common_ptr cinfo, jvirt_sarray_ptr ptr,
   int data_precision = cinfo->is_decompressor ?
                         ((j_decompress_ptr)cinfo)->data_precision :
                         ((j_compress_ptr)cinfo)->data_precision;
-  size_t sample_size = data_precision == 16 ?
+  size_t sample_size = data_precision > 12 ?
-                       sizeof(J16SAMPLE) : (data_precision == 12 ?
+                       sizeof(J16SAMPLE) : (data_precision > 8 ?
                                             sizeof(J12SAMPLE) :
                                             sizeof(JSAMPLE));
 

src/3rdparty/libjpeg/src/jpeglib.h

@@ -86,22 +86,26 @@ extern "C" {
 /* Data structures for images (arrays of samples and of DCT coefficients).
  */
 
-typedef JSAMPLE *JSAMPROW;      /* ptr to one image row of pixel samples. */
+typedef JSAMPLE *JSAMPROW;      /* ptr to one image row of pixel samples with
-typedef JSAMPROW *JSAMPARRAY;   /* ptr to some rows (a 2-D sample array) */
+                                   2-bit through 8-bit data precision. */
-typedef JSAMPARRAY *JSAMPIMAGE; /* a 3-D sample array: top index is color */
+typedef JSAMPROW *JSAMPARRAY;   /* ptr to some JSAMPLE rows (a 2-D JSAMPLE
+                                   array) */
+typedef JSAMPARRAY *JSAMPIMAGE; /* a 3-D JSAMPLE array: top index is color */
 
-typedef J12SAMPLE *J12SAMPROW;      /* ptr to one image row of 12-bit pixel
+typedef J12SAMPLE *J12SAMPROW;      /* ptr to one image row of pixel samples
-                                       samples. */
+                                       with 9-bit through 12-bit data
-typedef J12SAMPROW *J12SAMPARRAY;   /* ptr to some 12-bit sample rows (a 2-D
+                                       precision. */
-                                       12-bit sample array) */
+typedef J12SAMPROW *J12SAMPARRAY;   /* ptr to some J12SAMPLE rows (a 2-D
-typedef J12SAMPARRAY *J12SAMPIMAGE; /* a 3-D 12-bit sample array: top index is
+                                       J12SAMPLE array) */
+typedef J12SAMPARRAY *J12SAMPIMAGE; /* a 3-D J12SAMPLE array: top index is
                                        color */
 
-typedef J16SAMPLE *J16SAMPROW;      /* ptr to one image row of 16-bit pixel
+typedef J16SAMPLE *J16SAMPROW;      /* ptr to one image row of pixel samples
-                                       samples. */
+                                       with 13-bit through 16-bit data
-typedef J16SAMPROW *J16SAMPARRAY;   /* ptr to some 16-bit sample rows (a 2-D
+                                       precision. */
-                                       16-bit sample array) */
+typedef J16SAMPROW *J16SAMPARRAY;   /* ptr to some J16SAMPLE rows (a 2-D
-typedef J16SAMPARRAY *J16SAMPIMAGE; /* a 3-D 16-bit sample array: top index is
+                                       J16SAMPLE array) */
+typedef J16SAMPARRAY *J16SAMPIMAGE; /* a 3-D J16SAMPLE array: top index is
                                        color */
 
 typedef JCOEF JBLOCK[DCTSIZE2]; /* one block of coefficients */
@@ -708,11 +712,12 @@ struct jpeg_decompress_struct {
    */
 
   JSAMPLE *sample_range_limit;  /* table for fast range-limiting
-                                   If data_precision is 12 or 16, then this is
+                                   If data_precision is 9 to 12, then this is
-                                   actually a J12SAMPLE pointer or a J16SAMPLE
+                                   actually a J12SAMPLE pointer, and if
-                                   pointer, so callers must type-cast it in
+                                   data_precision is 13 to 16, then this is
-                                   order to read 12-bit or 16-bit samples from
+                                   actually a J16SAMPLE pointer, so callers
-                                   the array. */
+                                   must type-cast it in order to read samples
+                                   from the array. */
 
   /*
    * These fields are valid during any one scan.

src/3rdparty/libjpeg/src/jsamplecomp.h

@@ -93,7 +93,6 @@
 
 /* Image I/O functions (cdjpeg.h) */
 #ifdef C_LOSSLESS_SUPPORTED
-#define _jinit_read_gif  j16init_read_gif
 #define _jinit_read_ppm  j16init_read_ppm
 #endif
 
@@ -209,7 +208,6 @@
 #define _buffer  buffer12
 
 /* Image I/O functions (cdjpeg.h) */
-#define _jinit_read_gif  j12init_read_gif
 #define _jinit_write_gif  j12init_write_gif
 #define _jinit_read_ppm  j12init_read_ppm
 #define _jinit_write_ppm  j12init_write_ppm
@@ -324,7 +322,6 @@
 #define _buffer  buffer
 
 /* Image I/O functions (cdjpeg.h) */
-#define _jinit_read_gif  jinit_read_gif
 #define _jinit_write_gif  jinit_write_gif
 #define _jinit_read_ppm  jinit_read_ppm
 #define _jinit_write_ppm  jinit_write_ppm

src/3rdparty/libjpeg/src/jstdhuff.c

@@ -4,7 +4,7 @@
  * This file was part of the Independent JPEG Group's software:
  * Copyright (C) 1991-1998, Thomas G. Lane.
  * libjpeg-turbo Modifications:
- * Copyright (C) 2013, 2022, D. R. Commander.
+ * Copyright (C) 2013, 2022, 2024, D. R. Commander.
  * For conditions of distribution and use, see the accompanying README.ijg
  * file.
  *
@@ -25,7 +25,7 @@ add_huff_table(j_common_ptr cinfo, JHUFF_TBL **htblptr, const UINT8 *bits,
 
   if (*htblptr == NULL)
     *htblptr = jpeg_alloc_huff_table(cinfo);
-  else
+  else if (cinfo->is_decompressor)
     return;
 
   /* Copy the number-of-symbols-of-each-code-length counts */