build: build every static library for the deployment target the app ships

.github/workflows/repo-hygiene.yml

@@ -86,6 +86,12 @@ jobs:
       - name: Check the plugin manifest against the plugin classes
         run: python3 scripts/ci/check-plugin-manifest.py
 
+      # A build script that writes the deployment target down itself goes stale the next time the
+      # app's floor moves, and the result is an archive built for a newer macOS than the app that
+      # links it. That shipped: #2874 moved the app to macOS 13 and five copies of "14.0" stayed.
+      - name: Check no build script hardcodes the deployment target
+        run: bash scripts/ci/check-deployment-target.sh
+
       # The iOS app compiles source files that belong to macOS plugin targets, and it alone sets
       # SWIFT_DEFAULT_ACTOR_ISOLATION: MainActor, so one unmarked declaration in a shared file is
       # @MainActor on iOS and nonisolated in the plugin. The macOS suite cannot see it and the iOS

Libs/checksums.sha256

@@ -1,60 +1,60 @@
-95190fa8792bc3e76d936e47f8b60a3280131233f0bcaa8e665d12c4d122191f  Libs/libbson_arm64.a
-a629129545493275496aa7a1ee71d54820b9d1e60beeb9537f9d06b1f3bdbc0c  Libs/libbson_universal.a
-89a8bc9cb581bee9da7467af7c58f776608a090e6fb44d8957c37d54461d8727  Libs/libbson_x86_64.a
-a629129545493275496aa7a1ee71d54820b9d1e60beeb9537f9d06b1f3bdbc0c  Libs/libbson.a
-8d7e31145470a339f4f57930831936db30412393a339598deece6f650214865a  Libs/libcassandra_arm64.a
-9bfd7d7cb4a7ee9823b4c5141e942a8534de63395983388722dc7c98e5d7731e  Libs/libcassandra_universal.a
-7f1d058c77b66273db2b3867103c19f62ed0518fb38611b178ce04029213d5d8  Libs/libcassandra_x86_64.a
-9bfd7d7cb4a7ee9823b4c5141e942a8534de63395983388722dc7c98e5d7731e  Libs/libcassandra.a
-a891a67c2619e2ac1dce64dafc6a24bfde9cabe15312dac6b70a19385664ea84  Libs/libcrypto_arm64.a
-732adf315bc49f77e2511a9293e49a65e18eb54a3e6d01d8a24eee2d671d2a8a  Libs/libcrypto_universal.a
-965ccd38fea5cd97bc878dbf58567e4eed2b2337120f8d46a2da62c094b3c821  Libs/libcrypto_x86_64.a
-732adf315bc49f77e2511a9293e49a65e18eb54a3e6d01d8a24eee2d671d2a8a  Libs/libcrypto.a
-e325cc7f47ad2ac91f777d075e5533b0ef34769e16cd728496d3f9229ed6ff9b  Libs/libduckdb_arm64.a
-b578aa2a73b0b84ba36e436d0cade00d5e98f1cb1ebbc849374758e9054985a9  Libs/libduckdb_universal.a
-76737d65affec9b13676e0a39d3bd1054ee17642a04fa2ce34b9c2e998693fa0  Libs/libduckdb_x86_64.a
-b578aa2a73b0b84ba36e436d0cade00d5e98f1cb1ebbc849374758e9054985a9  Libs/libduckdb.a
-7e63017fa22c2eb7744eccad13857361a5088aa7b2772ab02cd026c8c7b78341  Libs/libhiredis_arm64.a
-f1cfc36a7ab47361e9705fe32b1c919b318f606989478e91a808707d93db55a5  Libs/libhiredis_ssl_arm64.a
-fb7a32c2c724cb4f3f880030cb19afbbc7db52121ad8e35e00a2e818da9562cf  Libs/libhiredis_ssl_universal.a
-7eb76bcb7ad4c10da0a0a5d43de182619f74f11c1ae9096823adc5c85280e34b  Libs/libhiredis_ssl_x86_64.a
-fb7a32c2c724cb4f3f880030cb19afbbc7db52121ad8e35e00a2e818da9562cf  Libs/libhiredis_ssl.a
-c855b0bf6fb8a2f52175a8e212c88a99ddf02890a1f88239613728c145607915  Libs/libhiredis_universal.a
-5e89a8a3b48590f2c68bdcfc0cfde134145e3156d48264c1fd751dc9ef3be505  Libs/libhiredis_x86_64.a
-c855b0bf6fb8a2f52175a8e212c88a99ddf02890a1f88239613728c145607915  Libs/libhiredis.a
-1fa33b78f52d4815761aeeec20add208719e4f01e0585e417a4d0d6dc98d3e2d  Libs/libmariadb_arm64.a
-bdec9e92f4e94ccb20fcfc4c121aab42de510cd214e23c0e334057de11889b9a  Libs/libmariadb_universal.a
-6ca5ea9b190b515108ba577b1db89458c1ac2f3263f2a4e4edcc94d5a66c5984  Libs/libmariadb_x86_64.a
-bdec9e92f4e94ccb20fcfc4c121aab42de510cd214e23c0e334057de11889b9a  Libs/libmariadb.a
-e05f73a64a8166704aa728445f11bccfb2a183bf617a72e02387396c20f7923f  Libs/libmongoc_arm64.a
-e2b01b498b62b01059e897bad2b0d3d0c5c8d78e74399cc3ec5824737885a997  Libs/libmongoc_universal.a
-f6baadba56e3ca1cb06ee9d40e4cde7eac35735ee499ec3c12a643c7b0667155  Libs/libmongoc_x86_64.a
-e2b01b498b62b01059e897bad2b0d3d0c5c8d78e74399cc3ec5824737885a997  Libs/libmongoc.a
-5dbf2cb5ef37d8adbf607db82461b36a3fd7037c11d891383e6e918378a33d78  Libs/libpgcommon_arm64.a
-3ca491a723b9d9dfc13b815659b44a82253b540dd6b115f03ac68c5154ec26db  Libs/libpgcommon_universal.a
-4bfad7376aefa866d1ed0b7e54966ec6c9d70dcfed928e1311c20321bf08881c  Libs/libpgcommon_x86_64.a
-3ca491a723b9d9dfc13b815659b44a82253b540dd6b115f03ac68c5154ec26db  Libs/libpgcommon.a
-813b962c5ae1c317bf6facfe68bd1301fa766768e074f3063fc2e8243213fe13  Libs/libpgport_arm64.a
-efba529b1ad767de988a58ca2c3fdcc26c38ce79df044a988f41fddbf9fde118  Libs/libpgport_universal.a
-bf71cc776245c0ce44bfd7b0286664d5c9771992fd70ec32a0c27fc669e4422f  Libs/libpgport_x86_64.a
-efba529b1ad767de988a58ca2c3fdcc26c38ce79df044a988f41fddbf9fde118  Libs/libpgport.a
-70cb70b88130c1c88ccf108e31e17d45dbbc2d10267db7ff33d63305a6a05baf  Libs/libpq_arm64.a
-b86ecf68d2b0dd8aa7712d13607c9584df2297aca4cd651428e8ee974c6bdf80  Libs/libpq_universal.a
-1ce2b45af228915fad05e07f54e96621af7143e199e002e5100777261a7f4a13  Libs/libpq_x86_64.a
-b86ecf68d2b0dd8aa7712d13607c9584df2297aca4cd651428e8ee974c6bdf80  Libs/libpq.a
-ba616a85e4de9800ba73095a888602c5202d320fd8d6cca80cf489ca7d923372  Libs/libssh2_arm64.a
-c1249063c458a7db695d866c379ba21173fab24b41c4f94bf50370ebbc1202a1  Libs/libssh2_universal.a
-c7d0d6e1caa7b44f56712f8f9f01b6f232dbb2c9888843c44c11b64c6f3af7fb  Libs/libssh2_x86_64.a
-c1249063c458a7db695d866c379ba21173fab24b41c4f94bf50370ebbc1202a1  Libs/libssh2.a
-b3861975896ebf35255d8c3efccdc59ad39874c9b70fdd710ebd15f0a58c4e10  Libs/libssl_arm64.a
-3ca208dedf57dbae4f5cb0a22bfbedeba80dc6740d626484d9d815811d64a2aa  Libs/libssl_universal.a
-34de647ccd0951095f987591562a5236348bac2d4b3e217877559a7b170cf4e4  Libs/libssl_x86_64.a
-3ca208dedf57dbae4f5cb0a22bfbedeba80dc6740d626484d9d815811d64a2aa  Libs/libssl.a
-441c590db5c38e36ad2594bfb06f46024a0904adfc925e225d6581476d2191c9  Libs/libsybdb_arm64.a
-0dd845300fe29433aac4e34ee14cee563161bfbb0dbaac2b889e8f9907029927  Libs/libsybdb_universal.a
-c4d38adabaee3ca97da991bd3dfb86739d5aa1a7038ca5bdb655e56594f22379  Libs/libsybdb_x86_64.a
-0dd845300fe29433aac4e34ee14cee563161bfbb0dbaac2b889e8f9907029927  Libs/libsybdb.a
-beff08628396ffb7c2e23b9f1db08ce92be215fbfd50c6e62088e216d73a0897  Libs/libuv_arm64.a
-8f8135b8214cfef035b49486a863f891979efc04d97d75e2bc14cb4e28aed233  Libs/libuv_universal.a
-2592a74df696709dcc631e9ad48894763157e9c5a34f0cb6a23a4036bce0c472  Libs/libuv_x86_64.a
-8f8135b8214cfef035b49486a863f891979efc04d97d75e2bc14cb4e28aed233  Libs/libuv.a
+5ae0f098630956648e1ae5d85504c1e1f35879179667a417c5c9c7c943431220  Libs/libbson_arm64.a
+6a951787bce30d3c8db1ea77909018c04ba8fac3699d3285bbd086a94da3002b  Libs/libbson_universal.a
+9b30579a1f65cdc4b759303bc25a19800c4ac46d37a79661b821edbcef295db3  Libs/libbson_x86_64.a
+6a951787bce30d3c8db1ea77909018c04ba8fac3699d3285bbd086a94da3002b  Libs/libbson.a
+4aa0aba80e71bacf96e1a38f874493da00a7f545924ff6d16eace3a76259d14e  Libs/libcassandra_arm64.a
+a3f312f5923a4acfe27049b3c49d2a8dd23aa2d971bb916e6fcff3dbae4fd25c  Libs/libcassandra_universal.a
+be3c89916064b63f1f3a5449ef957b560018200f030f8cee8dacb6413cb4e9d5  Libs/libcassandra_x86_64.a
+a3f312f5923a4acfe27049b3c49d2a8dd23aa2d971bb916e6fcff3dbae4fd25c  Libs/libcassandra.a
+f158c9fde50c57fe19995137a6edd3b9fe1904c31072c4323201923cf3634777  Libs/libcrypto_arm64.a
+35a59937f7aaa2fc3f64a337a5fb45cc8a7cecb6385e4c78618b40a70d5db759  Libs/libcrypto_universal.a
+ea95cc4e196b7f145536061943c5b0c429e391dc8f500c88ea0dd442e2e6a5c0  Libs/libcrypto_x86_64.a
+35a59937f7aaa2fc3f64a337a5fb45cc8a7cecb6385e4c78618b40a70d5db759  Libs/libcrypto.a
+f833d1edba062e03a5a7f7b5e40fbfe0f015c081158b8dd455d6129bf4515c12  Libs/libduckdb_arm64.a
+c1aef28aa225d34bb4d8be853000f4d2640a77366ff4b2cfa61f53648290c357  Libs/libduckdb_universal.a
+e971a4c84689626699482ba5e2f148345b50e53fc1aed57b6e37fbb90c85db9c  Libs/libduckdb_x86_64.a
+c1aef28aa225d34bb4d8be853000f4d2640a77366ff4b2cfa61f53648290c357  Libs/libduckdb.a
+5017c3fecadf4955fad1db923a8358fc9943fa17e8a5d54288db6a28fc5a3aa8  Libs/libhiredis_arm64.a
+58974eb81d5fefca9fb6732bd15921f1cf12a23f9a2402b1b099ec6c089f1e35  Libs/libhiredis_ssl_arm64.a
+09c8cb4acb62a54c09c4f2605bbc464b93d9e2ea5b2ae89a1d2165f8adaa9b9c  Libs/libhiredis_ssl_universal.a
+ddf109b36422fff456fdf38bb019fe17cd86417753f3367c3e599507983e3684  Libs/libhiredis_ssl_x86_64.a
+09c8cb4acb62a54c09c4f2605bbc464b93d9e2ea5b2ae89a1d2165f8adaa9b9c  Libs/libhiredis_ssl.a
+986bbf6f31a0ac0c7ebc322f1870b73d1cb9afcb79806a0535fc752aa8ff4ca2  Libs/libhiredis_universal.a
+252a3e2c43a83b6dd991f7d3ee851449a8da540b099f8f199ac851a7775c5cb1  Libs/libhiredis_x86_64.a
+986bbf6f31a0ac0c7ebc322f1870b73d1cb9afcb79806a0535fc752aa8ff4ca2  Libs/libhiredis.a
+592cdbdf41e80f28477f87c1c65acde64176f99db667e6da53769da402750f07  Libs/libmariadb_arm64.a
+56bfedce8c4a1be0dd72a193270d63a45c2b8486029da0d66e5d390b7eb6513e  Libs/libmariadb_universal.a
+9bffd093bd93a4744bee9dc730627ddd5e6eec8ebcc29a73797a214ce80717a8  Libs/libmariadb_x86_64.a
+56bfedce8c4a1be0dd72a193270d63a45c2b8486029da0d66e5d390b7eb6513e  Libs/libmariadb.a
+8688fdbf28572efc02fcdab427af3b6bd2f33514b2df844b66111b2d6a240824  Libs/libmongoc_arm64.a
+8f377a6ce494cb57a553bcdf7e1e99f9b47a8669d1a814a273d29dedd77b5965  Libs/libmongoc_universal.a
+890ceee56ecbb56b29f3067b7a94c92e68ac1c644914a889486b5c7d02dc6049  Libs/libmongoc_x86_64.a
+8f377a6ce494cb57a553bcdf7e1e99f9b47a8669d1a814a273d29dedd77b5965  Libs/libmongoc.a
+aff710c1797a69abc0e72d0db1a75e580dcb7d8111426e85b870c8b15d695d1a  Libs/libpgcommon_arm64.a
+16c6a68402ec4b8368450142f9a389ef33851065e63ac26b076842ef236308c0  Libs/libpgcommon_universal.a
+a9626008dc82ad6d7d594aa0967ae18805d5ba893fe635fd752373e5f05542f1  Libs/libpgcommon_x86_64.a
+16c6a68402ec4b8368450142f9a389ef33851065e63ac26b076842ef236308c0  Libs/libpgcommon.a
+4cf0f686f329084f48ee2b2c8d929bbf043f212a21931d694944e6e69ae8f193  Libs/libpgport_arm64.a
+1df1b928995d2b04e4a715d2518ca2050e78554db48500635b15d86f49ef2fea  Libs/libpgport_universal.a
+3a940d6492488eac3cf71e9ea7b5ae770805c1ae1ce960ea923694db7ae1ce5b  Libs/libpgport_x86_64.a
+1df1b928995d2b04e4a715d2518ca2050e78554db48500635b15d86f49ef2fea  Libs/libpgport.a
+3248f34800776b46eaa44d280a3f9173edc5fcbb921409b12124a0892a10713b  Libs/libpq_arm64.a
+96515ba6636a85a04cbc28d6d177814b8cdcdafae8fffb9b3d33dee9a5b85616  Libs/libpq_universal.a
+d97f65597c0b3f10e6b452578a3e2e6e44bc76c2a6a8454e21507ba0f94bdf9d  Libs/libpq_x86_64.a
+96515ba6636a85a04cbc28d6d177814b8cdcdafae8fffb9b3d33dee9a5b85616  Libs/libpq.a
+974af73a3b6d2794a15316c70724ea1c9b5153dfa94ea927872606851f091773  Libs/libssh2_arm64.a
+15d6e4bf252c258978c253f604863f0bd1a6474e2d25e27f4afb1b0ca5536332  Libs/libssh2_universal.a
+fa4de157849f15f494510935600f155d7ba08251336371ea471fad63366477a6  Libs/libssh2_x86_64.a
+15d6e4bf252c258978c253f604863f0bd1a6474e2d25e27f4afb1b0ca5536332  Libs/libssh2.a
+06159ebb4704d28af52d9b5bef56ed5c38691800b7bfe34adc926c4a707d4b4f  Libs/libssl_arm64.a
+86b180e122ccb1b107c2d519bf3ffe42905236cd95cd3994db5d2a2a86dcdb6f  Libs/libssl_universal.a
+bd5ca537003db380ae720155a5e7179376339261fcddcd3b78e05b3e8d07b8f4  Libs/libssl_x86_64.a
+86b180e122ccb1b107c2d519bf3ffe42905236cd95cd3994db5d2a2a86dcdb6f  Libs/libssl.a
+b4d10bafbbd3b79822778c720493773a5524a7dd5dd844400721660c69c11bf8  Libs/libsybdb_arm64.a
+d9b4012b2c04fe836974f8ad1dae58c2e6870d00cc68257796f3e95842929c0a  Libs/libsybdb_universal.a
+62dd9d1e0554ed3a0c0aa5b49fdbb438a0e5dda325f46978f5ec5718a242fdb5  Libs/libsybdb_x86_64.a
+d9b4012b2c04fe836974f8ad1dae58c2e6870d00cc68257796f3e95842929c0a  Libs/libsybdb.a
+3a5dac8615431476b4551758de81a088bade04900ab0540a213ba879207640f6  Libs/libuv_arm64.a
+c148a281d2ed01d0f8f4ffcb720bdbe044d1ab33aa6998e82d2dd2d33ad795bc  Libs/libuv_universal.a
+9dd8f21a97901a6db76cdac3b61c3fe876d908526eb5ae7e5895ab1eb9742580  Libs/libuv_x86_64.a
+c148a281d2ed01d0f8f4ffcb720bdbe044d1ab33aa6998e82d2dd2d33ad795bc  Libs/libuv.a

Plugins/MongoDBDriverPlugin/CLibMongoc/include/mongoc/mongoc-config.h

@@ -36,7 +36,7 @@
 
 /* MONGOC_USER_SET_CFLAGS is set from config based on what compiler flags were
  * used to compile mongoc */
-#define MONGOC_USER_SET_CFLAGS "-mmacosx-version-min=14.0"
+#define MONGOC_USER_SET_CFLAGS "-mmacosx-version-min=13.0"
 
 #define MONGOC_USER_SET_LDFLAGS ""
 

Plugins/PostgreSQLDriverPlugin/CLibPQ/include/pg_config_ext.h

@@ -1,6 +1,8 @@
+/* src/include/pg_config_ext.h.  Generated from pg_config_ext.h.in by configure.  */
 /*
- * src/include/pg_config_ext.h.  Generated from pg_config_ext.h.in by configure.
+ * src/include/pg_config_ext.h.in.  This is generated manually, not by
+ * autoheader, since we want to limit which symbols get defined here.
  */
 
 /* Define to the name of a signed 64-bit integer type. */
-#define PG_INT64_TYPE long long int
+#define PG_INT64_TYPE long int

Plugins/PostgreSQLDriverPlugin/LibPQPluginConnection.swift

@@ -22,8 +22,8 @@ import TableProPluginKit
 final class LibPQPluginConnection: @unchecked Sendable {
     static let logger = Logger(subsystem: "com.TablePro.PostgreSQLDriver", category: "LibPQPluginConnection")
 
-    private static let connectTimeoutMicroseconds: Int64 = 10_000_000
-    private static let pollSliceMicroseconds: Int64 = 100_000
+    private static let connectTimeoutMicroseconds: pg_usec_time_t = 10_000_000
+    private static let pollSliceMicroseconds: pg_usec_time_t = 100_000
 
     private var conn: OpaquePointer?
     private let queue = DispatchQueue(label: "com.TablePro.libpq.plugin", qos: .userInitiated)

scripts/build-cassandra.sh

@@ -16,10 +16,11 @@ CASSANDRA_SHA256="e6ab5f5c60a916dd6c0dd9a19a883a4a1ab3d6b4e95cab925a186fecff0834
 LIBUV_VERSION="1.48.0"
 LIBUV_SHA256="7f1db8ac368d89d1baf163bac1ea5fe5120697a73910c8ae6b2fffb3551d59fb"
 BUILD_DIR="/tmp/cassandra-build"
-LIBS_DIR="$(cd "$(dirname "$0")/.." && pwd)/Libs"
+LIBS_DIR="${LIBS_DIR:-$(cd "$(dirname "$0")/.." && pwd)/Libs}"
 HEADERS_DIR="$(cd "$(dirname "$0")/.." && pwd)/Plugins/CassandraDriverPlugin/CCassandra/include"
 ARCH="${1:-both}"
-MACOS_TARGET="14.0"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/deployment-target.sh"
+MACOS_TARGET="$DEPLOY_TARGET"
 
 echo "Building DataStax Cassandra C driver $CASSANDRA_VERSION..."
 

scripts/build-dameng.sh

@@ -6,9 +6,10 @@ BRIDGE_DIR="$ROOT_DIR/Native/DamengBridge"
 # Not Libs/. That directory holds prebuilt slices downloaded and checksum-verified by
 # download-libs.sh, and publish-libs.sh treats anything unrecognised there as an error.
 # The bridge is compiled from in-tree Rust instead, so its output stays beside its source.
-LIBS_DIR="$BRIDGE_DIR/lib"
+LIBS_DIR="${LIBS_DIR:-$BRIDGE_DIR/lib}"
 ARCH="${1:-both}"
-MACOS_TARGET="14.0"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/deployment-target.sh"
+MACOS_TARGET="$DEPLOY_TARGET"
 RUST_TOOLCHAIN="1.91.1"
 
 if ! rustup toolchain list | grep -q "^${RUST_TOOLCHAIN}"; then

scripts/build-duckdb.sh

@@ -23,7 +23,8 @@ set -euo pipefail
 #   scripts/publish-libs.sh libduckdb_arm64.a libduckdb_x86_64.a libduckdb_universal.a libduckdb.a
 
 DUCKDB_VERSION="v1.5.2"
-DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-14.0}"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/deployment-target.sh"
+DEPLOYMENT_TARGET="${MACOSX_DEPLOYMENT_TARGET:-$DEPLOY_TARGET}"
 
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 # Overridable so a verification run can write somewhere else. Libs/*.a is shared with

scripts/build-freetds.sh

@@ -17,7 +17,7 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
-LIBS_DIR="$PROJECT_DIR/Libs"
+LIBS_DIR="${LIBS_DIR:-$PROJECT_DIR/Libs}"
 IOS_LIBS_DIR="$LIBS_DIR/ios"
 FREETDS_VERSION="1.4.22"
 FREETDS_SHA256="6acb9086350425f5178e544bbe2d54a001097e8e20277a2b766ad0799a2e7d87"
@@ -34,7 +34,8 @@ trap cleanup_freetds EXIT
 CACHE_DIR="${TMPDIR:-/tmp}/tablepro-freetds-cache"
 mkdir -p "$CACHE_DIR"
 SOURCE_DIR="$BUILD_DIR/freetds-${FREETDS_VERSION}"
-MACOS_DEPLOYMENT_TARGET="14.0"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/deployment-target.sh"
+MACOS_DEPLOYMENT_TARGET="$DEPLOY_TARGET"
 IOS_DEPLOYMENT_TARGET="17.0"
 
 MACOS_OPENSSL_PREFIX="$(brew --prefix openssl@3)"

scripts/build-libmongoc.sh

@@ -23,9 +23,15 @@ set -eo pipefail
 #
 # Prerequisites:
 #   - Xcode Command Line Tools
-#   - CMake 3.15+ (brew install cmake)
+#   - CMake 3.15 or later, and BELOW 4. Measured with 4.4.3: configure dies in
+#     src/libmongoc/CMakeLists.txt's accept() detection with
+#     `The warning category "error -DCMAKE_CXX_LINK_EXECUTABLE=..." is not known`, because CMake 4
+#     joins that TRY_COMPILE's two CMAKE_FLAGS entries and reads the result as a -W flag. 1.30.11
+#     carries the same line, so a version bump does not help. Point CMAKE_BIN at a 3.x if the one on
+#     PATH is 4.x; 3.31.6 from cmake.org builds this cleanly.
 #   - curl
 
+CMAKE_BIN="${CMAKE_BIN:-cmake}"
 MONGOC_VERSION="1.28.1"
 MONGOC_SHA256="a93259840f461b28e198311e32144f5f8dc9fbd74348029f2793774d781bb7da"
 # shellcheck source=lib/macos.sh
@@ -84,8 +90,11 @@ build_mongoc() {
         openssl_lib_dir="$openssl_prefix/lib64"
     fi
 
+    # Snappy is pinned off rather than left to detection: on a machine that has Homebrew's
+    # snappy, CMake links it and the archive gains three undefined symbols the shipped one
+    # never had, which is a plugin that fails to load on every other machine.
     run_quiet env MACOSX_DEPLOYMENT_TARGET=$DEPLOY_TARGET \
-    cmake .. \
+    "$CMAKE_BIN" .. \
         -DCMAKE_INSTALL_PREFIX="$prefix" \
         -DCMAKE_BUILD_TYPE=Release \
         -DCMAKE_OSX_ARCHITECTURES="$arch" \
@@ -99,6 +108,7 @@ build_mongoc() {
         -DENABLE_SRV=ON \
         -DENABLE_ZLIB=SYSTEM \
         -DENABLE_ZSTD=OFF \
+        -DENABLE_SNAPPY=OFF \
         -DENABLE_SSL=OPENSSL \
         -DENABLE_TESTS=OFF \
         -DENABLE_EXAMPLES=OFF \
@@ -107,8 +117,8 @@ build_mongoc() {
         -DOPENSSL_SSL_LIBRARY="$openssl_lib_dir/libssl.a" \
         -DOPENSSL_CRYPTO_LIBRARY="$openssl_lib_dir/libcrypto.a"
 
-    run_quiet cmake --build . --parallel "$NCPU"
-    run_quiet cmake --install .
+    run_quiet "$CMAKE_BIN" --build . --parallel "$NCPU"
+    run_quiet "$CMAKE_BIN" --install .
 
     echo "✅ libmongoc $arch: $(ls -lh "$prefix/lib/libmongoc-static-1.0.a" 2>/dev/null || ls -lh "$prefix/lib64/libmongoc-static-1.0.a" 2>/dev/null | awk '{print $5}') (libmongoc) $(ls -lh "$prefix/lib/libbson-static-1.0.a" 2>/dev/null || ls -lh "$prefix/lib64/libbson-static-1.0.a" 2>/dev/null | awk '{print $5}') (libbson)"
 }

scripts/build-mariadb.sh

@@ -31,7 +31,7 @@ source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/macos.sh"
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-LIBS_DIR="$PROJECT_DIR/Libs"
+LIBS_DIR="${LIBS_DIR:-$PROJECT_DIR/Libs}"
 make_build_dir
 
 if [ -z "$OPENSSL_ROOT" ] || [ ! -d "$OPENSSL_ROOT" ]; then

scripts/ci/check-deployment-target.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+#
+# Fails when a build script writes the macOS deployment target down itself.
+#
+# The number belongs to project.yml and reaches the scripts through
+# scripts/lib/deployment-target.sh. It used to live in five places, and when #2874 moved the app to
+# macOS 13 none of them followed: every archive in Libs/ was built for macOS 14 and linked into a
+# 13.0 app, which the linker reported 121 times into a build that silenced linker warnings.
+#
+# Usage: check-deployment-target.sh
+
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+cd "$REPO_ROOT"
+
+offenders=$(
+    grep -rnE '(MACOS|DEPLOY|MIN)[A-Z_]*(TARGET|MACOS)[A-Z_]*="[0-9]+(\.[0-9]+)?"' scripts/*.sh scripts/lib/*.sh 2> /dev/null |
+        grep -viE 'ios|iphone|watch|tv|visionos' || true
+)
+
+if [ -n "$offenders" ]; then
+    echo "A macOS deployment target is written down in a build script." >&2
+    echo "Source scripts/lib/deployment-target.sh and use \$DEPLOY_TARGET instead:" >&2
+    echo "$offenders" >&2
+    exit 1
+fi
+
+echo "No build script hardcodes the macOS deployment target."

scripts/create-openssl-dylibs.sh

@@ -2,9 +2,10 @@
 set -euo pipefail
 
 ARCH="${1:-both}"
-LIBS_DIR="Libs"
+LIBS_DIR="${LIBS_DIR:-Libs}"
 OUT_DIR="$LIBS_DIR/dylibs"
-MIN_MACOS="13.0"
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/deployment-target.sh"
+MIN_MACOS="$DEPLOY_TARGET"
 
 mkdir -p "$OUT_DIR"
 

scripts/lib/common.sh

@@ -19,7 +19,9 @@ TABLEPRO_LIB_COMMON_SOURCED=1
 
 TABLEPRO_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$TABLEPRO_LIB_DIR/../.." && pwd)"
-LIBS_DIR="$REPO_ROOT/Libs"
+# Overridable so a rebuild can stage into a scratch directory and be verified before it
+# replaces the archives every worktree links against.
+LIBS_DIR="${LIBS_DIR:-$REPO_ROOT/Libs}"
 
 # OpenSSL is built from source on both platforms so it carries the right deployment target; a
 # Homebrew build targets whatever macOS that machine runs, which is what produced the