Centralize CPM dependency source metadata

ci/check_style.sh

@@ -29,3 +29,8 @@ wget -O ${RAPIDS_CMAKE_FORMAT_FILE} "${FORMAT_FILE_URL}"
 
 # Run pre-commit checks
 pre-commit run --all-files --show-diff-on-failure
+
+# Keep third-party source pins in the central CPM catalog so parent projects can override them.
+cpp/scripts/check-cpm-source-metadata.sh \
+  cpp/cmake/thirdparty/get_*.cmake \
+  java/src/main/native/cmake/thirdparty/get_*.cmake

cpp/cmake/tests/CMakeLists.txt

@@ -34,3 +34,29 @@ add_test(NAME cudf_export_consumer COMMAND ${CMAKE_COMMAND} --build
 
 set_tests_properties(cudf_export_consumer_configure PROPERTIES FIXTURES_SETUP cudf_export_consumer)
 set_tests_properties(cudf_export_consumer PROPERTIES FIXTURES_REQUIRED cudf_export_consumer)
+
+set(cpm_project_package_info_source_dir "${CMAKE_CURRENT_LIST_DIR}/cpm_project_package_info")
+set(cpm_project_package_info_default_build_dir
+    "${CMAKE_CURRENT_BINARY_DIR}/cpm_project_package_info_default"
+)
+set(cpm_project_package_info_override_build_dir
+    "${CMAKE_CURRENT_BINARY_DIR}/cpm_project_package_info_override"
+)
+
+add_test(
+  NAME cpm_project_package_info_default
+  COMMAND
+    ${CMAKE_COMMAND} -S "${cpm_project_package_info_source_dir}" -B
+    "${cpm_project_package_info_default_build_dir}" -G "${CMAKE_GENERATOR}"
+    "-DCUDF_REPOSITORY_DIR=${CUDF_REPOSITORY_DIR}"
+)
+
+add_test(
+  NAME cpm_project_package_info_override
+  COMMAND
+    ${CMAKE_COMMAND} -S "${cpm_project_package_info_source_dir}" -B
+    "${cpm_project_package_info_override_build_dir}" -G "${CMAKE_GENERATOR}"
+    "-DCUDF_REPOSITORY_DIR=${CUDF_REPOSITORY_DIR}"
+    "-DRAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE=${cpm_project_package_info_source_dir}/override.json"
+    "-DEXPECTED_DLPACK_VERSION=9.9.9"
+)

cpp/cmake/tests/cpm_project_package_info/CMakeLists.txt

@@ -0,0 +1,35 @@
+# =============================================================================
+# cmake-format: off
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# cmake-format: on
+# =============================================================================
+cmake_minimum_required(VERSION 4.0 FATAL_ERROR)
+
+project(cpm_project_package_info_test LANGUAGES NONE)
+
+set(CUDF_REPOSITORY_DIR
+    ""
+    CACHE PATH "Path to the cuDF repository root"
+)
+if(NOT CUDF_REPOSITORY_DIR)
+  cmake_path(SET CUDF_REPOSITORY_DIR NORMALIZE "${CMAKE_CURRENT_LIST_DIR}/../../../..")
+endif()
+
+set(EXPECTED_DLPACK_VERSION
+    "0.8"
+    CACHE STRING "Expected resolved DLPack version"
+)
+
+include("${CUDF_REPOSITORY_DIR}/cmake/rapids_config.cmake")
+include("${rapids-cmake-dir}/cpm/init.cmake")
+rapids_cpm_init()
+include("${CUDF_REPOSITORY_DIR}/cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake")
+
+cudf_cpm_project_package_info(dlpack VERSION_VAR resolved_dlpack_version)
+if(NOT resolved_dlpack_version STREQUAL EXPECTED_DLPACK_VERSION)
+  message(
+    FATAL_ERROR
+      "Expected DLPack version ${EXPECTED_DLPACK_VERSION}, got ${resolved_dlpack_version}"
+  )
+endif()

cpp/cmake/tests/cpm_project_package_info/override.json

@@ -0,0 +1,10 @@
+{
+  "packages": {
+    "dlpack": {
+      "version": "9.9.9",
+      "git_url": "https://github.com/dmlc/dlpack.git",
+      "git_tag": "365b823cedb281cd0240ca601aba9b78771f91a3",
+      "git_shallow": true
+    }
+  }
+}

cpp/cmake/thirdparty/get_croaring.cmake

@@ -8,13 +8,12 @@
 # Find or build the CRoaring library needed for libcudf tests and benchmarks.
 function(find_and_configure_roaring VERSION EXCLUDE_FROM_ALL)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(roaring VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    roaring ${VERSION}
+    roaring ${version} ${find_args}
     GLOBAL_TARGETS roaring::roaring
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/RoaringBitmap/CRoaring.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "ROARING_BUILD_STATIC ON"
             "BUILD_SHARED_LIBS OFF"

cpp/cmake/thirdparty/get_cudf.cmake

@@ -32,14 +32,13 @@ function(find_and_configure_cudf VERSION EXPORT_SET)
   if(BUILD_TESTS)
     list(APPEND cudf_components COMPONENTS testing)
   endif()
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(cudf FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    cudf ${VERSION} ${cudf_components}
+    cudf ${VERSION} ${find_args} ${cudf_components}
     BUILD_EXPORT_SET ${EXPORT_SET}
     INSTALL_EXPORT_SET ${EXPORT_SET}
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/NVIDIA/cudf.git
-    GIT_TAG "${RAPIDS_BRANCH}"
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     OPTIONS "BUILD_TESTS OFF" "BUILD_BENCHMARKS OFF"
   )
   # If after loading cudf we now have the CMAKE_CUDA_COMPILER variable we know that we need to

cpp/cmake/thirdparty/get_dlpack.cmake

@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2020-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2020-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -10,12 +10,14 @@ function(find_and_configure_dlpack VERSION EXCLUDE_FROM_ALL)
 
   include(${rapids-cmake-dir}/find/generate_module.cmake)
   rapids_find_generate_module(DLPACK HEADER_NAMES dlpack.h)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(
+    dlpack VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args
+  )
 
   rapids_cpm_find(
-    dlpack ${VERSION}
-    GIT_REPOSITORY https://github.com/dmlc/dlpack.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    dlpack ${version} ${find_args}
+    CPM_ARGS ${cpm_args}
     DOWNLOAD_ONLY TRUE
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "BUILD_MOCK OFF"

cpp/cmake/thirdparty/get_flatbuffers.cmake

@@ -1,20 +1,21 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
 
 # Use CPM to find or clone flatbuffers
 function(find_and_configure_flatbuffers VERSION EXCLUDE_FROM_ALL)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(
+    flatbuffers VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args
+  )
   rapids_cpm_find(
-    flatbuffers ${VERSION}
+    flatbuffers ${version} ${find_args}
     GLOBAL_TARGETS flatbuffers
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/google/flatbuffers.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "FLATBUFFERS_BUILD_TESTS OFF"
   )

cpp/cmake/thirdparty/get_kvikio.cmake

@@ -1,20 +1,19 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2022-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2022-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
 
 # This function finds KvikIO
 function(find_and_configure_kvikio VERSION)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(kvikio VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    kvikio ${VERSION}
+    kvikio ${version} ${find_args}
     GLOBAL_TARGETS kvikio::kvikio
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/rapidsai/kvikio.git
-    GIT_TAG "${RAPIDS_BRANCH}"
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
     OPTIONS "KvikIO_BUILD_EXAMPLES OFF" "KvikIO_REMOTE_SUPPORT ${CUDF_KVIKIO_REMOTE_IO}"
             "BUILD_SHARED_LIBS OFF"

cpp/cmake/thirdparty/get_nanoarrow.cmake

@@ -7,13 +7,14 @@
 
 # This function finds nanoarrow and sets any additional necessary environment variables.
 function(find_and_configure_nanoarrow BUILD_SHARED EXCLUDE_FROM_ALL)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(
+    nanoarrow VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args
+  )
   rapids_cpm_find(
-    nanoarrow 0.8.0
+    nanoarrow ${version} ${find_args}
     GLOBAL_TARGETS nanoarrow_static nanoarrow_shared
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/apache/arrow-nanoarrow.git
-    GIT_TAG apache-arrow-nanoarrow-0.8.0
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     OPTIONS "BUILD_SHARED_LIBS ${BUILD_SHARED}" "NANOARROW_NAMESPACE cudf"
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
   )

cpp/cmake/thirdparty/get_rtcx.cmake

@@ -11,13 +11,12 @@ function(find_and_configure_rtcx VERSION)
   # install(EXPORT) validation. In static builds consumers need to link librtcx.a directly.
   set(RTCX_INSTALL ON)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(rtcx VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    rtcx ${VERSION}
+    rtcx ${version} ${find_args}
     GLOBAL_TARGETS rtcx::rtcx
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/rapidsai/librtcx.git
-    GIT_TAG a9f63f8cdd4b0b41a2d88a9f705576a61b4222ec
-    GIT_SHALLOW FALSE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
   )
 

cpp/cmake/thirdparty/get_xxhash.cmake

@@ -12,13 +12,12 @@ function(find_and_configure_xxhash)
   rapids_find_generate_module(xxhash HEADER_NAMES xxhash.h xxh3.h)
 
   set(CPM_DOWNLOAD_xxhash ON)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(xxhash VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    xxhash 0.8.3
+    xxhash ${version} ${find_args}
     GLOBAL_TARGETS xxhash
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/Cyan4973/xxHash.git
-    GIT_TAG e626a72bc2321cd320e953a0ccf1584cad60f363
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     DOWNLOAD_ONLY TRUE
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
   )

cpp/cmake/thirdparty/get_zstd.cmake

@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -9,13 +9,12 @@
 function(find_and_configure_zstd)
 
   set(CPM_DOWNLOAD_zstd ON)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(zstd VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    zstd 1.5.7
+    zstd ${version} ${find_args}
     GLOBAL_TARGETS zstd
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/facebook/zstd.git
-    GIT_TAG v1.5.7
-    GIT_SHALLOW FALSE SOURCE_SUBDIR build/cmake
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
     OPTIONS "ZSTD_BUILD_STATIC ON" "ZSTD_BUILD_SHARED OFF" "ZSTD_BUILD_TESTS OFF"
             "ZSTD_BUILD_PROGRAMS OFF" "BUILD_SHARED_LIBS OFF"

cpp/cmake/thirdparty/rapids-cpm-versions.json

@@ -0,0 +1,76 @@
+{
+  "packages": {
+    "Arrow": {
+      "version": "${CUDF_VERSION_Arrow}",
+      "git_url": "https://github.com/apache/arrow.git",
+      "git_tag": "ee4d09ebef61c663c1efbfa4c18e518a03b798be",
+      "git_tag_alias": "apache-arrow-21.0.0",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "cudf": {
+      "version": "${CUDF_VERSION_MAJOR}.${CUDF_VERSION_MINOR}.00",
+      "git_url": "https://github.com/NVIDIA/cudf.git",
+      "git_tag": "742e4fd85f3ae440ca78a3a722ed1603d44a841f",
+      "git_tag_alias": "${RAPIDS_BRANCH}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "dlpack": {
+      "version": "0.8",
+      "git_url": "https://github.com/dmlc/dlpack.git",
+      "git_tag": "365b823cedb281cd0240ca601aba9b78771f91a3",
+      "git_tag_alias": "v0.8",
+      "git_shallow": true
+    },
+    "flatbuffers": {
+      "version": "24.3.25",
+      "git_url": "https://github.com/google/flatbuffers.git",
+      "git_tag": "595bf0007ab1929570c7671f091313c8fc20644e",
+      "git_tag_alias": "v24.3.25",
+      "git_shallow": true
+    },
+    "kvikio": {
+      "version": "${CUDF_VERSION_MAJOR}.${CUDF_VERSION_MINOR}",
+      "git_url": "https://github.com/rapidsai/kvikio.git",
+      "git_tag": "e4cb3cab779fcdc3341e0ef446d28a31f2a96d8a",
+      "git_tag_alias": "${RAPIDS_BRANCH}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "nanoarrow": {
+      "version": "0.8.0",
+      "git_url": "https://github.com/apache/arrow-nanoarrow.git",
+      "git_tag": "a579fbf5d192e85b6249935e117de7d02a6dc4e9",
+      "git_tag_alias": "apache-arrow-nanoarrow-0.8.0",
+      "git_shallow": true
+    },
+    "roaring": {
+      "version": "4.4.2",
+      "git_url": "https://github.com/RoaringBitmap/CRoaring.git",
+      "git_tag": "24835ad92064137eda061abfc019dd2b4ebc87a9",
+      "git_tag_alias": "v4.4.2",
+      "git_shallow": true
+    },
+    "zstd": {
+      "version": "1.5.7",
+      "git_url": "https://github.com/facebook/zstd.git",
+      "git_tag": "f8745da6ff1ad1e7bab384bd1f9d742439278e99",
+      "git_tag_alias": "v1.5.7",
+      "git_shallow": false,
+      "source_subdir": "build/cmake"
+    },
+    "xxhash": {
+      "version": "0.8.3",
+      "git_url": "https://github.com/Cyan4973/xxHash.git",
+      "git_tag": "e626a72bc2321cd320e953a0ccf1584cad60f363",
+      "git_shallow": true
+    },
+    "rtcx": {
+      "version": "0.1",
+      "git_url": "https://github.com/rapidsai/librtcx.git",
+      "git_tag": "a9f63f8cdd4b0b41a2d88a9f705576a61b4222ec",
+      "git_shallow": false
+    }
+  }
+}

cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake

@@ -0,0 +1,19 @@
+# =============================================================================
+# cmake-format: off
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# cmake-format: on
+# =============================================================================
+
+include_guard(GLOBAL)
+
+set(_CUDF_CPM_PROJECT_VERSIONS_FILE "${CMAKE_CURRENT_LIST_DIR}/rapids-cpm-versions.json")
+
+# Resolve project-owned defaults through rapids-cmake so a parent build can
+# replace a package source with RAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE.
+macro(cudf_cpm_project_package_info)
+  include("${rapids-cmake-dir}/cpm/package_override.cmake")
+  rapids_cpm_package_override("${_CUDF_CPM_PROJECT_VERSIONS_FILE}")
+  include("${rapids-cmake-dir}/cpm/detail/package_info.cmake")
+  rapids_cpm_package_info(${ARGV})
+endmacro()