November 2025 - Boost-users

b2 --show-libraries
by Keith Bennett 23 Nov '25

23 Nov '25

Hi guys, Why does `b2 --show-libraries` not show the libraries and exit as --help says it should? I am using boostorg/boost 02b24152984db5f8291778699f87a24dfce49aca, and also see the same behavior on tag boost-1.89.0. It instead goes on to build everything. That's opposite of the --help documentation. Is there not a unit test for this basic feature??? How many other basic features don't have unit tests? How do I just use cmake add_subdirectory(boost) from the boostorg/boost repo? I'm stuck trying to use externalproject_add I just need to build static libraries for packages, and want to have a loop in cmake that does --without-<library> for all of the libraries that I don't depend on. Or, even better, let CMake handle all of the dependencies for any boost libs that depend on each other, if I depend on one of them -- Keith Bennett

2 2

[regex] PR #263 - Fix for MSVC static analysis warning C33010 in get_default_error_string
by Phil Deets 22 Nov '25

22 Nov '25

Hello, I've submitted a PR to fix a static analysis warning in Boost.Regex: https://github.com/boostorg/regex/pull/263 - return (n > ::boost::regex_constants::error_unknown) ? s_default_error_messages[::boost::regex_constants::error_unknown] : s_default_error_messages[n]; + typedef typename std::make_unsigned<regex_constants::error_type>::type unsigned_type; + return (static_cast<unsigned_type>(n) > ::boost::regex_constants::error_unknown) ? s_default_error_messages[::boost::regex_constants::error_unknown] : s_default_error_messages[n]; The function get_default_error_string() in regex_traits_defaults.hpp<https://github.com/boostorg/regex/blob/develop/include/boost/regex/v5/regex…> triggers warning C33010 (unchecked lower bound for enum used as index)<https://learn.microsoft.com/en-us/cpp/code-quality/c33010?view=msvc-170>. There are regulations that require the Windows product to address all occurrences of this warning in any open-source code pulled into the Windows repository. I'm addressing this in the short term by using a Vcpkg overlay port to apply the patch from my PR, but I would like to upstream the fix so I can switch back to the default Vcpkg port for Boost in the future once the fix is released. The fix simply casts the enum value to an unsigned type before doing a bounds check. This ensures that negative values are treated as large positive values in the comparison so they will be detected to be out of bounds. I used a typedef with std::make_unsigned for the type used in the cast. This was done to be consistent with similar code farther up in the file in the is_extended function. Thanks, Phil

1 0

Cmake 4.1
by schoch+boost.org＠starnet.com 21 Nov '25

21 Nov '25

I'm having trouble getting cmake 4.1 to work with boost 1.88. I set the cmake BOOST_ROOT variable to C:\boost_1_88_0 and when my CMakeLists.txt file calls find_package(Boost REQUIRED) it successfully finds the file C:\boost_1_88_0\tools\cmake\config\BoostConfig.cmake, but when that file calls find_package(boost_headers ...) cmake fails, saying it can't find boost_headers-config.cmake, even though I can find that file deep under the C:\boost_1_88_0 directory. Is there an easy way to get boost to work with cmake 4.1?

5 6

Boost.Python - registration for multiple modules only works with dynamic linking?
by Andrej 17 Nov '25

17 Nov '25

Hi! I've stumbled upon `TypeError: No to_python (by-value) converter found for C++ type: class MyClass` kind of error and trying to debug it I came to the conclusion in the thread subject and wanted to verify if I'm not missing something, since I'm not very familar with Boost. So let's say there is `libA` that defines `MyClass` and there's a `libB` that's using it (e.g.. it has `MyClass produce_my_class()`). If `libA` and `libB` are statically linked against Boost.Python, then using `libB` method fails to find a converter (code snippet is below). If I link `libA` and `libB` against shared Boost.Python library, then the issue is resolved. I assume registration is kind of happen *per-Boost.Python-static-instance*, not *per-process*? What's the common practice for this? E.g. let's say there's an independant math library `Math` and it's using Boost.Python. For it to be distributable it typically would statically link Boost.Python. Then there's another library `Geometry` that's trying to use `Math` using Boost.Python bindings. Then the only way it would be able find the converters, if it redefines them? ```python import libA print(libA.MyClass(25)) # <libA.MyClass object at 0x00000199048BC270> import libB print(libB.produce_my_class(25)) # Traceback (most recent call last): # File "<string>", line 1, in <module> # TypeError: No to_python (by-value) converter found for C++ type: class MyClass ```

1 0

Re: [asio-users] boost::asio and seccomp
by Vinícius dos Santos Oliveira 17 Nov '25

17 Nov '25

Em seg., 17 de nov. de 2025 às 13:09, Marek Küthe <m-k-mailling-list(a)mk16.de> escreveu: > Hello, Hi Marek, I have lots of experience with containerization & sandboxing on Linux (and FreeBSD), but very few people to talk to about it (which I do miss more of). Let's keep in contact after I try to help answer your questions. > I would like to make my program more secure under Linux with seccomp. > My question is: how can I query which backend boost::asio uses (epoll, > select, etc.)? Boost.Asio doesn't have fallback logic. You choose which backend to use at compile time by defining macros. Given most vendors disable io_uring nowadays[1], the ideal implementation would not work as Boost.Asio does. The ideal implementation would have fallback logic and try io_uring first. This would also help with sandboxes because seccomp is a terrible model to secure io_uring in capability sandboxes (io_uring communicates with the kernel through message writes, but seccomp only filters syscalls). So if Boost.Asio had fallback logic your application would be able to fork the process, and disable io_uring. On the forked process, Boost.Asio could use epoll while the parent process would use io_uring. That's not possible today. Landlock is a promising new Linux approach that won't ever replace seccomp, but has the potential to secure some interfaces that seccomp can't. Until Landlock is mature and more complete, we have to do stuff such as avoiding io_uring entirely within sandboxes. For Boost.Asio this means using the epoll backend. > I would also like to know which system calls boost::asio > uses for which Linux backend. io_uring doesn't use syscalls so there's no point in filtering syscalls to secure io_uring. For the epoll backend, everyone does basically the same things. Just go through the list of syscalls and enable everything epoll-related. You can look at Kafel for an easy to use language to define seccomp policies. I wrote a few policy groups if you're interested. The only weird thing about Boost.Asio is that it still relies on the ancient'n'fragile FIONBIO[2] instead of fcntl/O_NONBLOCK by default (and MSG_DONTWAIT when available to save syscalls/performance). I complained to Chris until he fixed almost all of my complaints. Nowadays you can use Boost.Asio in many models of capability sandboxes, but not all. The only missing piece is MSG_DONTWAIT which matters to avoid DoS when file descriptors are shared among untrusted processes (necessary for capability sandboxes). I wrote a very detailed article explaining how to develop sandboxes for Linux and FreeBSD, but I suspect only 2 people have actually read the whole thing: https://blog.emilua.org/2025/01/12/software-sandboxing-basics/ The described model is implemented in Emilua which is a runtime (similar to NodeJS) for LuaJIT using Boost.Asio (you can also configure it to use the standalone version of ASIO if you want). Emilua is also a container runtime. You can prototype stuff quickly in Lua using Emilua and implement a high-performance version in pure C++ later if the need arises. That's the last demo I made for Emilua: https://www.youtube.com/watch?v=anu-onpDMBc I'm now keeping in contact with Matthew Flatt to implement sandboxes for Racket. However Racket doesn't use Boost.Asio. I'm also designing a thing to more easily implement sandboxes in C++, but it's still too soon to show this work. I've tried to collaborate with JS runtime developers to implement sandboxes too, but every time I've left these meetings frustrated. JS guys have no ambition at all. They only want to mirror what NodeJS already does (and perhaps do the same stuff but only slightly faster). I have no intention to collaborate with JS communities again. I want to collaborate with ambitious programmers who want to do more than what's possible today. I don't want to collaborate with programmers whose souls are already dead. > Can anyone help me with this? Is this documented anywhere? There's no documentation. I hope my attempts to explain seccomp, io_uring and Boost.Asio were useful to you. [1] https://security.googleblog.com/2023/06/learnings-from-kctf-vrps-42-linux.h… [2] https://stackoverflow.com/a/1151077/883113

1 0

[release] Boost 1.90.0 beta 1 released
by Marshall Clow 14 Nov '25

14 Nov '25

Boost release 1.90.0 beta 1 is now available at: https://archives.boost.io/beta/1.90.0.beta1/source/ The SHA256 checksums are: 8072831c2c54c7e0e99c69e934b5694574565dd435de19a0a43f7bf7dabad71b boost_1_90_0_b1.zip d1754f544e83418c2b5fe18245666830088948cb3629d2b346d56f31c71138e5 boost_1_90_0_b1.tar.bz2 c94235eb00edc732253d3ae8000a489ffc5773f34cd98bd7645d54cb4ae2482a boost_1_90_0_b1.7z 0f55a646eaed4daf110eeec7c2c70e2c7058efa77eef31137248a6e2cf1412da boost_1_90_0_b1.tar.gz Please try the beta and report any problems you encounter. Thanks to everyone who contributed to the release. -- The release managers

3 3