Centralize CPM dependency source metadata

ci/check_style.sh

@@ -29,3 +29,6 @@ wget -O ${RAPIDS_CMAKE_FORMAT_FILE} "${FORMAT_FILE_URL}"
 
 # Run pre-commit checks
 pre-commit run --all-files --show-diff-on-failure
+
+# Keep third-party source pins in the central CPM catalog so parent projects can override them.
+cpp/scripts/check-cpm-source-metadata.sh

cpp/cmake/thirdparty/get_croaring.cmake

@@ -8,13 +8,12 @@
 # Find or build the CRoaring library needed for libcudf tests and benchmarks.
 function(find_and_configure_roaring VERSION EXCLUDE_FROM_ALL)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(roaring VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    roaring ${VERSION}
+    roaring ${version} ${find_args}
     GLOBAL_TARGETS roaring::roaring
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/RoaringBitmap/CRoaring.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "ROARING_BUILD_STATIC ON"
             "BUILD_SHARED_LIBS OFF"

cpp/cmake/thirdparty/get_cudf.cmake

@@ -32,14 +32,13 @@ function(find_and_configure_cudf VERSION EXPORT_SET)
   if(BUILD_TESTS)
     list(APPEND cudf_components COMPONENTS testing)
   endif()
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(cudf VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    cudf ${VERSION} ${cudf_components}
+    cudf ${version} ${find_args} ${cudf_components}
     BUILD_EXPORT_SET ${EXPORT_SET}
     INSTALL_EXPORT_SET ${EXPORT_SET}
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/NVIDIA/cudf.git
-    GIT_TAG "${RAPIDS_BRANCH}"
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     OPTIONS "BUILD_TESTS OFF" "BUILD_BENCHMARKS OFF"
   )
   # If after loading cudf we now have the CMAKE_CUDA_COMPILER variable we know that we need to

cpp/cmake/thirdparty/get_dlpack.cmake

@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2020-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2020-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -10,12 +10,14 @@ function(find_and_configure_dlpack VERSION EXCLUDE_FROM_ALL)
 
   include(${rapids-cmake-dir}/find/generate_module.cmake)
   rapids_find_generate_module(DLPACK HEADER_NAMES dlpack.h)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(
+    dlpack VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args
+  )
 
   rapids_cpm_find(
-    dlpack ${VERSION}
-    GIT_REPOSITORY https://github.com/dmlc/dlpack.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    dlpack ${version} ${find_args}
+    CPM_ARGS ${cpm_args}
     DOWNLOAD_ONLY TRUE
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "BUILD_MOCK OFF"

cpp/cmake/thirdparty/get_flatbuffers.cmake

@@ -1,20 +1,21 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
 
 # Use CPM to find or clone flatbuffers
 function(find_and_configure_flatbuffers VERSION EXCLUDE_FROM_ALL)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(
+    flatbuffers VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args
+  )
   rapids_cpm_find(
-    flatbuffers ${VERSION}
+    flatbuffers ${version} ${find_args}
     GLOBAL_TARGETS flatbuffers
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/google/flatbuffers.git
-    GIT_TAG v${VERSION}
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "FLATBUFFERS_BUILD_TESTS OFF"
   )

cpp/cmake/thirdparty/get_kvikio.cmake

@@ -1,20 +1,19 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2022-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2022-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
 
 # This function finds KvikIO
 function(find_and_configure_kvikio VERSION)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(kvikio VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    kvikio ${VERSION}
+    kvikio ${version} ${find_args}
     GLOBAL_TARGETS kvikio::kvikio
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/rapidsai/kvikio.git
-    GIT_TAG "${RAPIDS_BRANCH}"
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
     OPTIONS "KvikIO_BUILD_EXAMPLES OFF" "KvikIO_REMOTE_SUPPORT ${CUDF_KVIKIO_REMOTE_IO}"
             "BUILD_SHARED_LIBS OFF"

cpp/cmake/thirdparty/get_nanoarrow.cmake

@@ -7,13 +7,14 @@
 
 # This function finds nanoarrow and sets any additional necessary environment variables.
 function(find_and_configure_nanoarrow BUILD_SHARED EXCLUDE_FROM_ALL)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(
+    nanoarrow VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args
+  )
   rapids_cpm_find(
-    nanoarrow 0.8.0
+    nanoarrow ${version} ${find_args}
     GLOBAL_TARGETS nanoarrow_static nanoarrow_shared
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/apache/arrow-nanoarrow.git
-    GIT_TAG apache-arrow-nanoarrow-0.8.0
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     OPTIONS "BUILD_SHARED_LIBS ${BUILD_SHARED}" "NANOARROW_NAMESPACE cudf"
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
   )

cpp/cmake/thirdparty/get_rtcx.cmake

@@ -11,13 +11,12 @@ function(find_and_configure_rtcx VERSION)
   # install(EXPORT) validation. In static builds consumers need to link librtcx.a directly.
   set(RTCX_INSTALL ON)
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(rtcx VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    rtcx ${VERSION}
+    rtcx ${version} ${find_args}
     GLOBAL_TARGETS rtcx::rtcx
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/rapidsai/librtcx.git
-    GIT_TAG a9f63f8cdd4b0b41a2d88a9f705576a61b4222ec
-    GIT_SHALLOW FALSE
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
   )
 

cpp/cmake/thirdparty/get_xxhash.cmake

@@ -12,13 +12,12 @@ function(find_and_configure_xxhash)
   rapids_find_generate_module(xxhash HEADER_NAMES xxhash.h xxh3.h)
 
   set(CPM_DOWNLOAD_xxhash ON)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(xxhash VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    xxhash 0.8.3
+    xxhash ${version} ${find_args}
     GLOBAL_TARGETS xxhash
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/Cyan4973/xxHash.git
-    GIT_TAG e626a72bc2321cd320e953a0ccf1584cad60f363
-    GIT_SHALLOW TRUE
+    CPM_ARGS ${cpm_args}
     DOWNLOAD_ONLY TRUE
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
   )

cpp/cmake/thirdparty/get_zstd.cmake

@@ -1,6 +1,6 @@
 # =============================================================================
 # cmake-format: off
-# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION.
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 # SPDX-License-Identifier: Apache-2.0
 # cmake-format: on
 # =============================================================================
@@ -9,13 +9,12 @@
 function(find_and_configure_zstd)
 
   set(CPM_DOWNLOAD_zstd ON)
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(zstd VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
   rapids_cpm_find(
-    zstd 1.5.7
+    zstd ${version} ${find_args}
     GLOBAL_TARGETS zstd
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/facebook/zstd.git
-    GIT_TAG v1.5.7
-    GIT_SHALLOW FALSE SOURCE_SUBDIR build/cmake
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${CUDF_EXCLUDE_DEPS_FROM_ALL}
     OPTIONS "ZSTD_BUILD_STATIC ON" "ZSTD_BUILD_SHARED OFF" "ZSTD_BUILD_TESTS OFF"
             "ZSTD_BUILD_PROGRAMS OFF" "BUILD_SHARED_LIBS OFF"

cpp/cmake/thirdparty/rapids-cpm-versions.json

@@ -0,0 +1,68 @@
+{
+  "packages": {
+    "Arrow": {
+      "version": "${CUDF_VERSION_Arrow}",
+      "git_url": "https://github.com/apache/arrow.git",
+      "git_tag": "apache-arrow-${version}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "cudf": {
+      "version": "${CUDF_VERSION_MAJOR}.${CUDF_VERSION_MINOR}.00",
+      "git_url": "https://github.com/NVIDIA/cudf.git",
+      "git_tag": "${RAPIDS_BRANCH}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "dlpack": {
+      "version": "0.8",
+      "git_url": "https://github.com/dmlc/dlpack.git",
+      "git_tag": "v${version}",
+      "git_shallow": true
+    },
+    "flatbuffers": {
+      "version": "24.3.25",
+      "git_url": "https://github.com/google/flatbuffers.git",
+      "git_tag": "v${version}",
+      "git_shallow": true
+    },
+    "kvikio": {
+      "version": "${rapids-cmake-version}",
+      "git_url": "https://github.com/rapidsai/kvikio.git",
+      "git_tag": "${RAPIDS_BRANCH}",
+      "git_shallow": true,
+      "source_subdir": "cpp"
+    },
+    "nanoarrow": {
+      "version": "0.8.0",
+      "git_url": "https://github.com/apache/arrow-nanoarrow.git",
+      "git_tag": "apache-arrow-nanoarrow-${version}",
+      "git_shallow": true
+    },
+    "roaring": {
+      "version": "4.4.2",
+      "git_url": "https://github.com/RoaringBitmap/CRoaring.git",
+      "git_tag": "v${version}",
+      "git_shallow": true
+    },
+    "zstd": {
+      "version": "1.5.7",
+      "git_url": "https://github.com/facebook/zstd.git",
+      "git_tag": "v${version}",
+      "git_shallow": false,
+      "source_subdir": "build/cmake"
+    },
+    "xxhash": {
+      "version": "0.8.3",
+      "git_url": "https://github.com/Cyan4973/xxHash.git",
+      "git_tag": "e626a72bc2321cd320e953a0ccf1584cad60f363",
+      "git_shallow": true
+    },
+    "rtcx": {
+      "version": "0.1",
+      "git_url": "https://github.com/rapidsai/librtcx.git",
+      "git_tag": "a9f63f8cdd4b0b41a2d88a9f705576a61b4222ec",
+      "git_shallow": false
+    }
+  }
+}

cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake

@@ -0,0 +1,19 @@
+# =============================================================================
+# cmake-format: off
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+# cmake-format: on
+# =============================================================================
+
+include_guard(GLOBAL)
+
+set(_CUDF_CPM_PROJECT_VERSIONS_FILE "${CMAKE_CURRENT_LIST_DIR}/rapids-cpm-versions.json")
+
+# Resolve project-owned defaults through rapids-cmake so a parent build can
+# replace a package source with RAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE.
+macro(cudf_cpm_project_package_info)
+  include("${rapids-cmake-dir}/cpm/package_override.cmake")
+  rapids_cpm_package_override("${_CUDF_CPM_PROJECT_VERSIONS_FILE}")
+  include("${rapids-cmake-dir}/cpm/detail/package_info.cmake")
+  rapids_cpm_package_info(${ARGV})
+endmacro()

cpp/scripts/check-cpm-source-metadata.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Project dependency sources belong in rapids-cpm-versions.json. That allows
+# RAPIDS_CMAKE_CPM_OVERRIDE_VERSION_FILE to replace them without source patches.
+set -euo pipefail
+
+for cmake_file in "$@"; do
+  if grep -nE '^[[:space:]]*GIT_(REPOSITORY|TAG|SHALLOW)[[:space:]]' "${cmake_file}"; then
+    echo "ERROR: ${cmake_file} declares a direct Git source." >&2
+    echo "Move its source metadata to the project rapids-cpm-versions.json catalog and use cudf_cpm_project_package_info()." >&2
+    exit 1
+  fi
+done

java/src/main/native/cmake/thirdparty/get_arrow.cmake

@@ -89,15 +89,15 @@ function(find_and_configure_arrow VERSION BUILD_STATIC EXCLUDE_FROM_ALL ENABLE_P
     list(APPEND ARROW_PARQUET_OPTIONS "ARROW_DEPENDENCY_SOURCE AUTO")
   endif()
 
+  include("${CMAKE_CURRENT_FUNCTION_LIST_DIR}/../../../../../../cpp/cmake/thirdparty/rapids_cpm_project_package_info.cmake")
+  cudf_cpm_project_package_info(Arrow VERSION_VAR version FIND_VAR find_args CPM_VAR cpm_args)
+
   rapids_cpm_find(
-    Arrow ${VERSION}
+    Arrow ${version} ${find_args}
     GLOBAL_TARGETS
       arrow_shared parquet_shared arrow_acero_shared arrow_dataset_shared arrow_compute_shared
       arrow_static parquet_static arrow_acero_static arrow_dataset_static arrow_compute_static
-    CPM_ARGS
-    GIT_REPOSITORY https://github.com/apache/arrow.git
-    GIT_TAG apache-arrow-${VERSION}
-    GIT_SHALLOW TRUE SOURCE_SUBDIR cpp
+    CPM_ARGS ${cpm_args}
     EXCLUDE_FROM_ALL ${EXCLUDE_FROM_ALL}
     OPTIONS "CMAKE_VERBOSE_MAKEFILE ON"
             "ARROW_ACERO ON"