From f3b31aeeb68923e659d464a54c2a8fde2e980072 Mon Sep 17 00:00:00 2001
From: Vladimir Davydov <vdavydov@tarantool.org>
Date: Sat, 4 Nov 2023 20:11:29 +0300
Subject: [PATCH] cmake: allow to bundle static dependencies in main project

The BUILD_STATIC cmake config option forces the build system link
Tarantool binary statically with its dependencies. It expects that all
static libraries on which Tarantool binary depends are available at
build time.

We don't use this option directly to create static binaries because it
would produce different results on different build systems. Instead, we
use the separate cmake config located in the static-build directory,
which fetches all Tarantool dependencies from a predefined location
before building a static binary.

Having a separate cmake config is inconvenient. Let's enable bundling of
static binary dependencies right in the main project cmake config, like
we bundle, for example, libcurl. To achieve that, the new build option
was introduced BUILD_STATIC_WITH_BUNDLED_LIBS. It implies BUILD_STATIC
and also fetches and builds all required dependencies, like the
static-build cmake config used to. The latter doesn't do it anymore;
from now on, it just sets BUILD_STATIC_WITH_BUNDLED_LIBS when building
Tarantool. We can't remove the static-build cmake config yet because
there are quire a few CI workflows depending on it.

Note that, just like BUILD_STATIC, BUILD_STATIC_WITH_BUNDLED_LIBS
doesn't imply OPENSSL_USE_STATIC_LIBS so the latter should be set
explicitly if one wants to use the static openssl library. However,
setting OPENSSL_USE_STATIC_LIBS with BUILD_STATIC_WITH_BUNDLED_LIBS will
force the build system use bundled static openssl library.

This patch is relatively straightforward. It just moves the external
projects from /static-build/cmake/AddDependencyProjects.cmake to /cmake
adding build dependencies where required and setting variables that are
set by the corresponding /cmake/FindXXX.cmake configs.

There are a few things that should be noted separately though:
 - We dropped the ZLIB_FOUND check from the main project cmake config.
   It was used for building EE but the latter is going to be broken
   anyway once this patch is committed. We'll fix it in following
   commits.
 - FindLibUnwind referenced zlib library by ZLIB::ZLIB. We don't set
   it for bundled zlib so let's use ZLIB_LIBRARIES instead.
 - We don't need to detect dependency cflags while building bundled
   libraries as we can reuse the flags set by the main project.
 - We don't use HARDENING_LDFLAGS because it makes no sense when
   building static libraries.

Closes #9242

NO_DOC=build
NO_TEST=build
NO_CHANGELOG=build

(cherry picked from commit 98b38e89ba0545543b85aa6f164f66309c2343c4)
---
 .gitignore                                    |   1 -
 CMakeLists.txt                                |  83 ++++--
 cmake/BuildICONV.cmake                        |  42 +++
 cmake/BuildICU.cmake                          |  77 ++++++
 cmake/BuildLibCURL.cmake                      |   8 +
 cmake/BuildLibYAML.cmake                      |   4 +
 cmake/BuildOpenSSL.cmake                      |  57 ++++
 cmake/BuildReadline.cmake                     | 104 ++++++++
 cmake/BuildZLIB.cmake                         |  39 +++
 cmake/FindLibUnwind.cmake                     |   2 +-
 .../icu-tarantool-security-45.patch           |   0
 .../icu-tarantool-security-59.patch           |   0
 .../icu-tarantool-security-61.patch           |   0
 .../icu-tarantool-security-96.patch           |   0
 .../openssl-111q-gh-18720.patch               |   0
 .../openssl-tarantool-security-27.patch       |   0
 .../openssl-tarantool-security-54.patch       |   0
 .../openssl-tarantool-security-90.patch       |   0
 .../readline-tarantool-security-95.patch      |   0
 .../patches => patches}/readline80-001.patch  |   0
 src/lib/coll/CMakeLists.txt                   |   4 +
 src/lib/core/CMakeLists.txt                   |   8 +
 src/lib/crypto/CMakeLists.txt                 |   4 +
 src/lib/json/CMakeLists.txt                   |   4 +
 static-build/CMakeLists.txt                   |   1 -
 .../cmake/AddDependencyProjects.cmake         | 252 ------------------
 static-build/cmake/AddTarantoolProject.cmake  |  11 +-
 27 files changed, 422 insertions(+), 279 deletions(-)
 create mode 100644 cmake/BuildICONV.cmake
 create mode 100644 cmake/BuildICU.cmake
 create mode 100644 cmake/BuildOpenSSL.cmake
 create mode 100644 cmake/BuildReadline.cmake
 create mode 100644 cmake/BuildZLIB.cmake
 rename {static-build/patches => patches}/icu-tarantool-security-45.patch (100%)
 rename {static-build/patches => patches}/icu-tarantool-security-59.patch (100%)
 rename {static-build/patches => patches}/icu-tarantool-security-61.patch (100%)
 rename {static-build/patches => patches}/icu-tarantool-security-96.patch (100%)
 rename {static-build/patches => patches}/openssl-111q-gh-18720.patch (100%)
 rename {static-build/patches => patches}/openssl-tarantool-security-27.patch (100%)
 rename {static-build/patches => patches}/openssl-tarantool-security-54.patch (100%)
 rename {static-build/patches => patches}/openssl-tarantool-security-90.patch (100%)
 rename {static-build/patches => patches}/readline-tarantool-security-95.patch (100%)
 rename {static-build/patches => patches}/readline80-001.patch (100%)
 delete mode 100644 static-build/cmake/AddDependencyProjects.cmake

diff --git a/.gitignore b/.gitignore
index abaf1d37a9..487f5ff28f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,7 +6,6 @@ _CPack_Packages
 *.gcno
 *.gcda
 *.gcov
-/patches/
 .git-ignore/
 .pc/
 coverity/
diff --git a/CMakeLists.txt b/CMakeLists.txt
index debf2973a9..49c1915311 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -56,6 +56,10 @@ endif()
 # Define GNU standard installation directories
 include(GNUInstallDirs)
 
+if(BUILD_STATIC_WITH_BUNDLED_LIBS)
+    set(BUILD_STATIC ON)
+endif()
+
 include(cmake/utils.cmake)
 include(cmake/pod2man.cmake)
 # the order is significant: we need to know os and compiler to configure libs
@@ -378,6 +382,9 @@ find_package_message(MODULE_LIBPATH "Lua package.cpath: ${MODULE_LIBPATH}"
 ## Third-Party libraries
 ##
 
+# URL of the backup storage to download bundled dependencies from.
+set(BACKUP_STORAGE https://distrib.hb.vkcs.cloud)
+
 set(EMBED_LUAZLIB ${BUILD_STATIC})
 set(EMBED_LUAROCKS ${BUILD_STATIC})
 
@@ -413,14 +420,12 @@ endif()
 # ZLIB
 #
 
-#
-# If tarantool is built as a part of enterpirse version,
-# zlib package will be found there and the second attempt
-# to find it will cause an error. Search for it only if it
-# has not been found before.
-#
-
-if (NOT ZLIB_FOUND)
+option(ENABLE_BUNDLED_ZLIB "Enable building of the bundled zlib"
+    ${BUILD_STATIC_WITH_BUNDLED_LIBS})
+if(ENABLE_BUNDLED_ZLIB)
+    include(BuildZLIB)
+    add_dependencies(build_bundled_libs bundled-zlib)
+else()
     set(ZLIB_FIND_REQUIRED ON)
     find_package(ZLIB)
 endif()
@@ -436,7 +441,20 @@ endif()
 #
 # OpenSSL
 #
-find_package(OpenSSL)
+
+set(ENABLE_BUNDLED_OPENSSL_DEFAULT OFF)
+if(BUILD_STATIC_WITH_BUNDLED_LIBS AND OPENSSL_USE_STATIC_LIBS)
+    set(ENABLE_BUNDLED_OPENSSL_DEFAULT ON)
+endif()
+option(ENABLE_BUNDLED_OPENSSL "Enable building of the bundled openssl"
+    ${ENABLE_BUNDLED_OPENSSL_DEFAULT})
+if(ENABLE_BUNDLED_OPENSSL)
+    set(OPENSSL_USE_STATIC_LIBS ON)
+    include(BuildOpenSSL)
+    add_dependencies(build_bundled_libs bundled-openssl)
+else()
+    find_package(OpenSSL)
+endif()
 if (OPENSSL_FOUND)
     message(STATUS "OpenSSL ${OPENSSL_VERSION} found")
     include_directories(${OPENSSL_INCLUDE_DIR})
@@ -450,6 +468,9 @@ endif()
 #
 if(OPENSSL_USE_STATIC_LIBS)
     set(OPENSSL_LIBRARIES ${OPENSSL_LIBRARIES} ${ZLIB_LIBRARIES})
+    if(ENABLED_BUNDLED_OPENSSL AND ENABLE_BUNDLED_ZLIB)
+        add_dependencies(bundled-openssl bundled-zlib)
+    endif()
 endif()
 
 #
@@ -505,21 +526,48 @@ message(STATUS "EXPORT_LIBCURL_SYMBOLS: ${EXPORT_LIBCURL_SYMBOLS}")
 # ReadLine
 #
 
-set(Readline_FIND_REQUIRED ON)
-find_package(Readline)
+option(ENABLE_BUNDLED_READLINE "Enable building of the bundled readline"
+    ${BUILD_STATIC_WITH_BUNDLED_LIBS})
+if(ENABLE_BUNDLED_READLINE)
+    include(BuildReadline)
+    add_dependencies(build_bundled_libs bundled-readline)
+else()
+    set(Readline_FIND_REQUIRED ON)
+    find_package(Readline)
+endif()
 
 #
 # ICONV
 #
-set(ICONV_FIND_REQUIRED ON)
-find_package(ICONV)
+
+# In Linux iconv is embedded into glibc.
+set(ENABLE_BUNDLED_ICONV_DEFAULT OFF)
+if(APPLE AND BUILD_STATIC_WITH_BUNDLED_LIBS)
+    set(ENABLE_BUNDLED_ICONV_DEFAULT ON)
+endif()
+option(ENABLE_BUNDLED_ICONV "Enable building of the bundled iconv"
+    ${ENABLE_BUNDLED_ICONV_DEFAULT})
+if(ENABLE_BUNDLED_ICONV)
+    include(BuildICONV)
+    add_dependencies(build_bundled_libs bundled-iconv)
+else()
+    set(ICONV_FIND_REQUIRED ON)
+    find_package(ICONV)
+endif()
 
 #
 # ICU
 #
 
-set(ICU_FIND_REQUIRED ON)
-find_package(ICU)
+option(ENABLE_BUNDLED_ICU "Enable building of the bundled icu"
+    ${BUILD_STATIC_WITH_BUNDLED_LIBS})
+if(ENABLE_BUNDLED_ICU)
+    include(BuildICU)
+    add_dependencies(build_bundled_libs bundled-icu)
+else()
+    set(ICU_FIND_REQUIRED ON)
+    find_package(ICU)
+endif()
 
 #
 # libunwind
@@ -789,8 +837,13 @@ set(options PACKAGE VERSION BUILD C_COMPILER CXX_COMPILER C_FLAGS CXX_FLAGS
     ENABLE_HARDENING
     ENABLE_DOC
     ENABLE_DIST
+    ENABLE_BUNDLED_ZLIB
+    ENABLE_BUNDLED_OPENSSL
     ENABLE_BUNDLED_LIBCURL
     BUNDLED_LIBCURL_USE_ARES
+    ENABLE_BUNDLED_READLINE
+    ENABLE_BUNDLED_ICONV
+    ENABLE_BUNDLED_ICU
     ENABLE_BUNDLED_LIBYAML
     ENABLE_BUNDLED_MSGPUCK
     ENABLE_BUNDLED_LIBUNWIND
diff --git a/cmake/BuildICONV.cmake b/cmake/BuildICONV.cmake
new file mode 100644
index 0000000000..ebd71bc1b1
--- /dev/null
+++ b/cmake/BuildICONV.cmake
@@ -0,0 +1,42 @@
+set(ICONV_VERSION 1.17)
+set(ICONV_HASH d718cd5a59438be666d1575855be72c3)
+set(ICONV_INSTALL_DIR ${PROJECT_BINARY_DIR}/build/iconv)
+set(ICONV_INCLUDE_DIR ${ICONV_INSTALL_DIR}/include)
+set(ICONV_LIBRARY ${ICONV_INSTALL_DIR}/lib/libiconv.a)
+set(ICONV_CFLAGS "${DEPENDENCY_CFLAGS} -O2")
+set(ICONV_CPPFLAGS "")
+set(ICONV_LDFLAGS "")
+
+if(APPLE)
+    set(ICONV_CFLAGS "${ICONV_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(ICONV_CPPFLAGS "${ICONV_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+endif()
+
+ExternalProject_Add(bundled-iconv-project
+    PREFIX ${ICONV_INSTALL_DIR}
+    URL URL ${BACKUP_STORAGE}/libiconv/libiconv-${ICONV_VERSION}.tar.gz
+    URL_MD5 ${ICONV_HASH}
+    CONFIGURE_COMMAND <SOURCE_DIR>/configure
+        CC=${CMAKE_C_COMPILER}
+        CFLAGS=${ICONV_CFLAGS}
+        CPPFLAGS=${ICONV_CPPFLAGS}
+        LDFLAGS=${ICONV_LDFLAGS}
+
+        --prefix=<INSTALL_DIR>
+        --disable-shared
+        --enable-static
+        --with-gnu-ld
+    STEP_TARGETS download
+    BUILD_BYPRODUCTS ${ICONV_LIBRARY}
+)
+
+add_library(bundled-iconv STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-iconv PROPERTIES IMPORTED_LOCATION
+    ${ICONV_LIBRARY})
+add_dependencies(bundled-iconv bundled-iconv-project)
+
+set(ICONV_FOUND TRUE)
+set(ICONV_LIBRARIES ${ICONV_LIBRARY})
+set(ICONV_INCLUDE_DIRS ${ICONV_INCLUDE_DIR})
+
+message(STATUS "Using bundled iconv")
diff --git a/cmake/BuildICU.cmake b/cmake/BuildICU.cmake
new file mode 100644
index 0000000000..4810a41453
--- /dev/null
+++ b/cmake/BuildICU.cmake
@@ -0,0 +1,77 @@
+set(ICU_VERSION release-71-1/icu4c-71_1)
+set(ICU_HASH e06ffc96f59762bd3c929b217445aaec)
+set(ICU_PATCHES_DIR ${PROJECT_SOURCE_DIR}/patches)
+set(ICU_INSTALL_DIR ${PROJECT_BINARY_DIR}/build/icu)
+set(ICU_INCLUDE_DIR ${ICU_INSTALL_DIR}/include)
+set(ICU_I18N_LIBRARY ${ICU_INSTALL_DIR}/lib/libicui18n.a)
+set(ICU_UC_LIBRARY ${ICU_INSTALL_DIR}/lib/libicuuc.a)
+set(ICU_DATA_LIBRARY ${ICU_INSTALL_DIR}/lib/libicudata.a)
+set(ICU_CFLAGS "${DEPENDENCY_CFLAGS} -O2")
+set(ICU_CXXFLAGS "${DEPENDENCY_CXXFLAGS} -O2")
+set(ICU_CPPFLAGS "")
+set(ICU_LDFLAGS "")
+
+if(APPLE)
+    set(ICU_CFLAGS "${ICU_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(ICU_CXXFLAGS "${ICU_CXXFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(ICU_CPPFLAGS "${ICU_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+endif()
+
+ExternalProject_Add(bundled-icu-project
+    PREFIX ${ICU_INSTALL_DIR}
+    URL https://github.com/unicode-org/icu/releases/download/${ICU_VERSION}-src.tgz
+    URL_MD5 ${ICU_HASH}
+    CONFIGURE_COMMAND <SOURCE_DIR>/source/configure
+        CC=${CMAKE_C_COMPILER}
+        CXX=${CMAKE_CXX_COMPILER}
+        CFLAGS=${ICU_CFLAGS}
+        CXXFLAGS=${ICU_CXXFLAGS}
+        CPPFLAGS=${ICU_CPPFLAGS}
+        LDFLAGS=${ICU_LDFLAGS}
+
+        --with-data-packaging=static
+        --prefix=<INSTALL_DIR>
+        --disable-shared
+        --enable-static
+        --disable-renaming
+        --disable-tests
+        --disable-samples
+    INSTALL_COMMAND
+        $(MAKE) install &&
+        ${CMAKE_COMMAND} -E touch <BINARY_DIR>/uconfig.h &&
+        cat <BINARY_DIR>/uconfig.h.prepend <INSTALL_DIR>/include/unicode/uconfig.h >> <BINARY_DIR>/uconfig.h &&
+        ${CMAKE_COMMAND} -E copy_if_different <BINARY_DIR>/uconfig.h <INSTALL_DIR>/include/unicode/uconfig.h
+    PATCH_COMMAND patch -d <SOURCE_DIR> -p1 -i "${ICU_PATCHES_DIR}/icu-tarantool-security-45.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${ICU_PATCHES_DIR}/icu-tarantool-security-59.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${ICU_PATCHES_DIR}/icu-tarantool-security-61.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${ICU_PATCHES_DIR}/icu-tarantool-security-96.patch"
+    BUILD_BYPRODUCTS ${ICU_I18N_LIBRARY} ${ICU_UC_LIBRARY} ${ICU_DATA_LIBRARY}
+)
+
+add_library(bundled-icu-i18n STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-icu-i18n PROPERTIES IMPORTED_LOCATION
+    ${ICU_I18N_LIBRARY})
+add_dependencies(bundled-icu-i18n bundled-icu-project)
+
+add_library(bundled-icu-uc STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-icu-uc PROPERTIES IMPORTED_LOCATION
+    ${ICU_UC_LIBRARY})
+add_dependencies(bundled-icu-uc bundled-icu-project)
+
+add_library(bundled-icu-data STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-icu-data PROPERTIES IMPORTED_LOCATION
+    ${ICU_DATA_LIBRARY})
+add_dependencies(bundled-icu-data bundled-icu-project)
+
+add_custom_target(bundled-icu
+    DEPENDS bundled-icu-i18n bundled-icu-uc bundled-icu-data)
+
+set(ICU_FOUND TRUE)
+set(ICU_ROOT ${ICU_INSTALL_DIR})
+set(ICU_LIBRARIES ${ICU_I18N_LIBRARY} ${ICU_UC_LIBRARY} ${ICU_DATA_LIBRARY}
+    ${CMAKE_DL_LIBS})
+set(ICU_INCLUDE_DIRS ${ICU_INCLUDE_DIR})
+
+set(HAVE_ICU_STRCOLLUTF TRUE)
+
+message(STATUS "Using bundled icu")
diff --git a/cmake/BuildLibCURL.cmake b/cmake/BuildLibCURL.cmake
index 4760d05271..4104884031 100644
--- a/cmake/BuildLibCURL.cmake
+++ b/cmake/BuildLibCURL.cmake
@@ -220,6 +220,14 @@ macro(curl_build)
     add_library(bundled-libcurl STATIC IMPORTED GLOBAL)
     set_target_properties(bundled-libcurl PROPERTIES IMPORTED_LOCATION
         ${LIBCURL_INSTALL_DIR}/lib/libcurl.a)
+    if (ENABLE_BUNDLED_ZLIB)
+        # Need to build zlib first
+        add_dependencies(bundled-libcurl-project bundled-zlib)
+    endif()
+    if (ENABLE_BUNDLED_OPENSSL)
+        # Need to build openssl first
+        add_dependencies(bundled-libcurl-project bundled-openssl)
+    endif()
     if (BUNDLED_LIBCURL_USE_ARES)
         # Need to build ares first
         add_dependencies(bundled-libcurl-project bundled-ares)
diff --git a/cmake/BuildLibYAML.cmake b/cmake/BuildLibYAML.cmake
index 2144b03f85..4a3fc4e517 100644
--- a/cmake/BuildLibYAML.cmake
+++ b/cmake/BuildLibYAML.cmake
@@ -24,6 +24,10 @@ macro(libyaml_build)
         BUILD_BYPRODUCTS ${LIBYAML_LIBRARY}
     )
 
+    if(ENABLE_BUNDLED_ICU)
+        add_dependencies(bundled-libyaml-project bundled-icu)
+    endif()
+
     add_library(bundled-libyaml STATIC IMPORTED GLOBAL)
     set_target_properties(bundled-libyaml PROPERTIES IMPORTED_LOCATION
         ${LIBYAML_LIBRARY})
diff --git a/cmake/BuildOpenSSL.cmake b/cmake/BuildOpenSSL.cmake
new file mode 100644
index 0000000000..4c440e5692
--- /dev/null
+++ b/cmake/BuildOpenSSL.cmake
@@ -0,0 +1,57 @@
+set(OPENSSL_VERSION 1.1.1q)
+set(OPENSSL_HASH c685d239b6a6e1bd78be45624c092f51)
+set(OPENSSL_PATCHES_DIR ${PROJECT_SOURCE_DIR}/patches)
+set(OPENSSL_INSTALL_DIR ${PROJECT_BINARY_DIR}/build/openssl)
+set(OPENSSL_INCLUDE_DIR ${OPENSSL_INSTALL_DIR}/include)
+set(OPENSSL_CRYPTO_LIBRARY ${OPENSSL_INSTALL_DIR}/lib/libcrypto.a)
+set(OPENSSL_SSL_LIBRARY ${OPENSSL_INSTALL_DIR}/lib/libssl.a)
+set(OPENSSL_CFLAGS "${DEPENDENCY_CFLAGS} -O2")
+set(OPENSSL_CPPFLAGS "")
+set(OPENSSL_LDFLAGS "")
+
+if(APPLE)
+    set(OPENSSL_CFLAGS "${OPENSSL_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(OPENSSL_CPPFLAGS "${OPENSSL_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+endif()
+
+ExternalProject_Add(bundled-openssl-project
+    PREFIX ${OPENSSL_INSTALL_DIR}
+    URL ${BACKUP_STORAGE}/openssl/openssl-${OPENSSL_VERSION}.tar.gz
+    URL_MD5 ${OPENSSL_HASH}
+    CONFIGURE_COMMAND <SOURCE_DIR>/config
+        CC=${CMAKE_C_COMPILER}
+        CXX=${CMAKE_CXX_COMPILER}
+        CFLAGS=${OPENSSL_CFLAGS}
+        CPPFLAGS=${OPENSSL_CPPFLAGS}
+        LDFLAGS=${OPENSSL_LDFLAGS}
+
+        --prefix=<INSTALL_DIR>
+        --libdir=lib
+        no-shared
+    INSTALL_COMMAND ${CMAKE_MAKE_PROGRAM} install_sw
+    PATCH_COMMAND patch -d <SOURCE_DIR> -p1 -i "${OPENSSL_PATCHES_DIR}/openssl-111q-gh-18720.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${OPENSSL_PATCHES_DIR}/openssl-tarantool-security-27.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${OPENSSL_PATCHES_DIR}/openssl-tarantool-security-54.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${OPENSSL_PATCHES_DIR}/openssl-tarantool-security-90.patch"
+    BUILD_BYPRODUCTS ${OPENSSL_CRYPTO_LIBRARY} ${OPENSSL_SSL_LIBRARY}
+)
+
+add_library(bundled-openssl-ssl STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-openssl-ssl PROPERTIES IMPORTED_LOCATION
+    ${OPENSSL_SSL_LIBRARY})
+add_dependencies(bundled-openssl-ssl bundled-openssl-project)
+
+add_library(bundled-openssl-crypto STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-openssl-crypto PROPERTIES IMPORTED_LOCATION
+    ${OPENSSL_CRYPTO_LIBRARY})
+add_dependencies(bundled-openssl-crypto bundled-openssl-project)
+
+add_custom_target(bundled-openssl
+    DEPENDS bundled-openssl-ssl bundled-openssl-crypto)
+
+set(OPENSSL_FOUND TRUE)
+set(OPENSSL_LIBRARIES ${OPENSSL_SSL_LIBRARY} ${OPENSSL_CRYPTO_LIBRARY}
+    ${CMAKE_DL_LIBS})
+set(OPENSSL_INCLUDE_DIRS ${OPENSSL_INCLUDE_DIR})
+
+message(STATUS "Using bundled openssl")
diff --git a/cmake/BuildReadline.cmake b/cmake/BuildReadline.cmake
new file mode 100644
index 0000000000..1516efc491
--- /dev/null
+++ b/cmake/BuildReadline.cmake
@@ -0,0 +1,104 @@
+set(NCURSES_VERSION 6.3-20220716)
+set(NCURSES_HASH 2b7a0e31ebbd8144680f985d61f5bbd5)
+set(NCURSES_INSTALL_DIR ${PROJECT_BINARY_DIR}/build/ncurses)
+set(NCURSES_LIBRARY ${NCURSES_INSTALL_DIR}/lib/libncurses.a)
+set(NCURSES_TINFO_LIBRARY ${NCURSES_INSTALL_DIR}/lib/libtinfo.a)
+set(NCURSES_CFLAGS "${DEPENDENCY_CFLAGS} -O2")
+set(NCURSES_CXXFLAGS "${DEPENDENCY_CXXFLAGS} -O2")
+set(NCURSES_CPPFLAGS "")
+set(NCURSES_LDFLAGS "")
+
+set(READLINE_VERSION 8.0)
+set(READLINE_HASH 7e6c1f16aee3244a69aba6e438295ca3)
+set(READLINE_PATCHES_DIR ${PROJECT_SOURCE_DIR}/patches)
+set(READLINE_INSTALL_DIR ${PROJECT_BINARY_DIR}/build/readline)
+set(READLINE_INCLUDE_DIR ${READLINE_INSTALL_DIR}/include)
+set(READLINE_LIBRARY ${READLINE_INSTALL_DIR}/lib/libreadline.a)
+set(READLINE_CFLAGS "${DEPENDENCY_CFLAGS} -O2")
+set(READLINE_CPPFLAGS "")
+set(READLINE_LDFLAGS "")
+
+if(APPLE)
+    set(NCURSES_CFLAGS "${NCURSES_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(NCURSES_CXXFLAGS "${NCURSES_CXXFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(NCURSES_CPPFLAGS "${NCURSES_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+
+    set(READLINE_CFLAGS "${READLINE_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(READLINE_CPPFLAGS "${READLINE_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+endif()
+
+ExternalProject_Add(bundled-ncurses-project
+    PREFIX ${NCURSES_INSTALL_DIR}
+    URL ${BACKUP_STORAGE}/ncurses/ncurses-${NCURSES_VERSION}.tgz
+    URL_MD5 ${NCURSES_HASH}
+    CONFIGURE_COMMAND <SOURCE_DIR>/configure
+        CC=${CMAKE_C_COMPILER}
+        CXX=${CMAKE_CXX_COMPILER}
+        CFLAGS=${NCURSES_CFLAGS}
+        CXXFLAGS=${NCURSES_CXXFLAGS}
+        CPPFLAGS=${NCURSES_CPPFLAGS}
+        LDFLAGS=${NCURSES_LDFLAGS}
+
+        --prefix=<INSTALL_DIR>
+
+        # This flag enables creation of libcurses.a as a symlink to libncurses.a
+        # and disables subdir creation `ncurses` at <install_dir>/include. It is
+        # necessary for correct work of FindCurses.cmake module (this module is
+        # builtin at cmake package) which used in cmake/FindReadline.cmake
+        --enable-overwrite
+
+        # enable building libtinfo to prevent linking with libtinfo from system
+        # directories
+        --with-termlib
+
+        # set search paths for terminfo db
+        --with-terminfo-dirs=/lib/terminfo:/usr/share/terminfo:/etc/terminfo
+
+        # disable install created terminfo db, use db from system
+        --disable-db-install
+        --without-progs
+        --without-manpages
+    BUILD_BYPRODUCTS ${NCURSES_LIBRARY} ${NCURSES_TINFO_LIBRARY}
+)
+
+add_library(bundled-ncurses STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-ncurses PROPERTIES IMPORTED_LOCATION
+    ${NCURSES_LIBRARY})
+add_dependencies(bundled-ncurses bundled-ncurses-project)
+
+add_library(bundled-ncurses-tinfo STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-ncurses-tinfo PROPERTIES IMPORTED_LOCATION
+    ${NCURSES_TINFO_LIBRARY})
+add_dependencies(bundled-ncurses-tinfo bundled-ncurses-project)
+
+ExternalProject_Add(bundled-readline-project
+    PREFIX ${READLINE_INSTALL_DIR}
+    URL ${BACKUP_STORAGE}/readline/readline-${READLINE_VERSION}.tar.gz
+    URL_MD5 ${READLINE_HASH}
+    CONFIGURE_COMMAND <SOURCE_DIR>/configure
+        CC=${CMAKE_C_COMPILER}
+        CFLAGS=${READLINE_CFLAGS}
+        CPPFLAGS=${READLINE_CPPFLAGS}
+        LDFLAGS=${READLINE_LDFLAGS}
+
+        --prefix=<INSTALL_DIR>
+        --disable-shared
+    PATCH_COMMAND patch -d <SOURCE_DIR> -p0 -i "${READLINE_PATCHES_DIR}/readline80-001.patch"
+    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${READLINE_PATCHES_DIR}/readline-tarantool-security-95.patch"
+    BUILD_BYPRODUCTS ${READLINE_LIBRARY}
+)
+
+add_library(bundled-readline STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-readline PROPERTIES IMPORTED_LOCATION
+    ${READLINE_LIBRARY})
+add_dependencies(bundled-readline bundled-readline-project
+    bundled-ncurses bundled-ncurses-tinfo)
+
+set(READLINE_FOUND TRUE)
+set(READLINE_LIBRARIES ${READLINE_LIBRARY} ${NCURSES_LIBRARY}
+    ${NCURSES_TINFO_LIBRARY})
+set(READLINE_INCLUDE_DIRS ${READLINE_INCLUDE_DIR})
+
+set(HAVE_GNU_READLINE TRUE)
+
+message(STATUS "Using bundled readline")
diff --git a/cmake/BuildZLIB.cmake b/cmake/BuildZLIB.cmake
new file mode 100644
index 0000000000..f813102ac0
--- /dev/null
+++ b/cmake/BuildZLIB.cmake
@@ -0,0 +1,39 @@
+set(ZLIB_VERSION 1.2.12)
+set(ZLIB_HASH 5fc414a9726be31427b440b434d05f78)
+set(ZLIB_INSTALL_DIR ${PROJECT_BINARY_DIR}/build/zlib)
+set(ZLIB_INCLUDE_DIR ${ZLIB_INSTALL_DIR}/include)
+set(ZLIB_LIBRARY ${ZLIB_INSTALL_DIR}/lib/libz.a)
+set(ZLIB_CFLAGS "${DEPENDENCY_CFLAGS} -O2")
+set(ZLIB_CPPFLAGS "")
+set(ZLIB_LDFLAGS "")
+
+if(APPLE)
+    set(ZLIB_CFLAGS "${ZLIB_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+    set(ZLIB_CPPFLAGS "${ZLIB_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
+endif()
+
+ExternalProject_Add(bundled-zlib-project
+    PREFIX ${ZLIB_INSTALL_DIR}
+    URL ${BACKUP_STORAGE}/zlib/zlib-${ZLIB_VERSION}.tar.gz
+    URL_MD5 ${ZLIB_HASH}
+    CONFIGURE_COMMAND env
+        CC=${CMAKE_C_COMPILER}
+        CFLAGS=${ZLIB_CFLAGS}
+        CPPFLAGS=${ZLIB_CPPFLAGS}
+        LDFLAGS=${ZLIB_LDFLAGS}
+        <SOURCE_DIR>/configure
+        --prefix=<INSTALL_DIR>
+        --static
+    BUILD_BYPRODUCTS ${ZLIB_LIBRARY}
+)
+
+add_library(bundled-zlib STATIC IMPORTED GLOBAL)
+set_target_properties(bundled-zlib PROPERTIES IMPORTED_LOCATION
+    ${ZLIB_LIBRARY})
+add_dependencies(bundled-zlib bundled-zlib-project)
+
+set(ZLIB_FOUND TRUE)
+set(ZLIB_LIBRARIES ${ZLIB_LIBRARY})
+set(ZLIB_INCLUDE_DIRS ${ZLIB_INCLUDE_DIR})
+
+message(STATUS "Using bundled zlib")
diff --git a/cmake/FindLibUnwind.cmake b/cmake/FindLibUnwind.cmake
index 5fb4f4a53e..74b703910b 100644
--- a/cmake/FindLibUnwind.cmake
+++ b/cmake/FindLibUnwind.cmake
@@ -70,7 +70,7 @@ if(BUILD_STATIC)
     endif()
     # Ditto,
     # https://github.com/libunwind/libunwind/blob/4feb1152d1c4aaafbb2d504dbe34c6db5b6fe9f2/configure.ac#L319-L334
-    set(LIBUNWIND_LIBRARIES ${LIBUNWIND_LIBRARIES} ZLIB::ZLIB)
+    set(LIBUNWIND_LIBRARIES ${LIBUNWIND_LIBRARIES} ${ZLIB_LIBRARIES})
 endif()
 
 if(PC_LIBUNWIND_VERSION)
diff --git a/static-build/patches/icu-tarantool-security-45.patch b/patches/icu-tarantool-security-45.patch
similarity index 100%
rename from static-build/patches/icu-tarantool-security-45.patch
rename to patches/icu-tarantool-security-45.patch
diff --git a/static-build/patches/icu-tarantool-security-59.patch b/patches/icu-tarantool-security-59.patch
similarity index 100%
rename from static-build/patches/icu-tarantool-security-59.patch
rename to patches/icu-tarantool-security-59.patch
diff --git a/static-build/patches/icu-tarantool-security-61.patch b/patches/icu-tarantool-security-61.patch
similarity index 100%
rename from static-build/patches/icu-tarantool-security-61.patch
rename to patches/icu-tarantool-security-61.patch
diff --git a/static-build/patches/icu-tarantool-security-96.patch b/patches/icu-tarantool-security-96.patch
similarity index 100%
rename from static-build/patches/icu-tarantool-security-96.patch
rename to patches/icu-tarantool-security-96.patch
diff --git a/static-build/patches/openssl-111q-gh-18720.patch b/patches/openssl-111q-gh-18720.patch
similarity index 100%
rename from static-build/patches/openssl-111q-gh-18720.patch
rename to patches/openssl-111q-gh-18720.patch
diff --git a/static-build/patches/openssl-tarantool-security-27.patch b/patches/openssl-tarantool-security-27.patch
similarity index 100%
rename from static-build/patches/openssl-tarantool-security-27.patch
rename to patches/openssl-tarantool-security-27.patch
diff --git a/static-build/patches/openssl-tarantool-security-54.patch b/patches/openssl-tarantool-security-54.patch
similarity index 100%
rename from static-build/patches/openssl-tarantool-security-54.patch
rename to patches/openssl-tarantool-security-54.patch
diff --git a/static-build/patches/openssl-tarantool-security-90.patch b/patches/openssl-tarantool-security-90.patch
similarity index 100%
rename from static-build/patches/openssl-tarantool-security-90.patch
rename to patches/openssl-tarantool-security-90.patch
diff --git a/static-build/patches/readline-tarantool-security-95.patch b/patches/readline-tarantool-security-95.patch
similarity index 100%
rename from static-build/patches/readline-tarantool-security-95.patch
rename to patches/readline-tarantool-security-95.patch
diff --git a/static-build/patches/readline80-001.patch b/patches/readline80-001.patch
similarity index 100%
rename from static-build/patches/readline80-001.patch
rename to patches/readline80-001.patch
diff --git a/src/lib/coll/CMakeLists.txt b/src/lib/coll/CMakeLists.txt
index c01e608bb1..de007e9755 100644
--- a/src/lib/coll/CMakeLists.txt
+++ b/src/lib/coll/CMakeLists.txt
@@ -1,2 +1,6 @@
 add_library(coll STATIC coll.c coll_def.c)
 target_link_libraries(coll core ${ICU_LIBRARIES})
+
+if (ENABLE_BUNDLED_ICU)
+    add_dependencies(coll bundled-icu)
+endif()
diff --git a/src/lib/core/CMakeLists.txt b/src/lib/core/CMakeLists.txt
index 233e4f0714..8d3630cb03 100644
--- a/src/lib/core/CMakeLists.txt
+++ b/src/lib/core/CMakeLists.txt
@@ -89,6 +89,14 @@ if (ENABLE_BACKTRACE)
     endif()
 endif()
 
+if (ENABLE_BUNDLED_OPENSSL)
+    add_dependencies(core bundled-openssl)
+endif()
+
+if (ENABLE_BUNDLED_ICU)
+    add_dependencies(core bundled-icu)
+endif()
+
 if (ENABLE_TUPLE_COMPRESSION)
     target_link_libraries(core ${ZSTD_LIBRARIES})
 endif()
diff --git a/src/lib/crypto/CMakeLists.txt b/src/lib/crypto/CMakeLists.txt
index 4e2e5e4036..afdac0891e 100644
--- a/src/lib/crypto/CMakeLists.txt
+++ b/src/lib/crypto/CMakeLists.txt
@@ -3,3 +3,7 @@ set(lib_sources crypto.c)
 set_source_files_compile_flags(${lib_sources})
 add_library(crypto STATIC ${lib_sources})
 target_link_libraries(crypto ${OPENSSL_LIBRARIES} core)
+
+if (ENABLE_BUNDLED_OPENSSL)
+    add_dependencies(crypto bundled-openssl)
+endif()
diff --git a/src/lib/json/CMakeLists.txt b/src/lib/json/CMakeLists.txt
index 4462ee2d70..8af6b357b4 100644
--- a/src/lib/json/CMakeLists.txt
+++ b/src/lib/json/CMakeLists.txt
@@ -5,3 +5,7 @@ set(lib_sources
 set_source_files_compile_flags(${lib_sources})
 add_library(json STATIC ${lib_sources})
 target_link_libraries(json misc)
+
+if (ENABLE_BUNDLED_ICU)
+    add_dependencies(json bundled-icu)
+endif()
diff --git a/static-build/CMakeLists.txt b/static-build/CMakeLists.txt
index b53239326c..c7600e9e3d 100644
--- a/static-build/CMakeLists.txt
+++ b/static-build/CMakeLists.txt
@@ -7,6 +7,5 @@ cmake_minimum_required(VERSION 3.1)
 # linux machine).
 project(tarantool-static C CXX)
 
-include(cmake/AddDependencyProjects.cmake)
 include(cmake/AddTarantoolProject.cmake)
 include(cmake/AddTests.cmake)
diff --git a/static-build/cmake/AddDependencyProjects.cmake b/static-build/cmake/AddDependencyProjects.cmake
deleted file mode 100644
index 80bc2d97a4..0000000000
--- a/static-build/cmake/AddDependencyProjects.cmake
+++ /dev/null
@@ -1,252 +0,0 @@
-include(CheckLibraryExists)
-include(CheckCSourceCompiles)
-include(FindPackageMessage)
-include(ExternalProject)
-
-include(${CMAKE_CURRENT_LIST_DIR}/../../cmake/os.cmake)
-include(${CMAKE_CURRENT_LIST_DIR}/../../cmake/profile.cmake)
-include(${CMAKE_CURRENT_LIST_DIR}/../../cmake/hardening.cmake)
-include(${CMAKE_CURRENT_LIST_DIR}/../../cmake/prefix.cmake)
-
-set(LIBICU_VERSION release-71-1/icu4c-71_1)
-set(LIBICU_HASH e06ffc96f59762bd3c929b217445aaec)
-set(LIBICONV_VERSION 1.17)
-set(LIBICONV_HASH d718cd5a59438be666d1575855be72c3)
-set(OPENSSL_VERSION 1.1.1q)
-set(OPENSSL_HASH c685d239b6a6e1bd78be45624c092f51)
-set(ZLIB_VERSION 1.2.12)
-set(ZLIB_HASH 5fc414a9726be31427b440b434d05f78)
-set(NCURSES_VERSION 6.3-20220716)
-set(NCURSES_HASH 2b7a0e31ebbd8144680f985d61f5bbd5)
-set(READLINE_VERSION 8.0)
-set(READLINE_HASH 7e6c1f16aee3244a69aba6e438295ca3)
-set(BACKUP_STORAGE https://distrib.hb.vkcs.cloud)
-
-# Pass -isysroot=<SDK_PATH> option on Mac OS to a preprocessor and a C
-# compiler to find header files installed with an SDK.
-#
-# The idea is to set these (DEPENDENCY_*) variables to corresponding
-# environment variables at each dependency configure script.
-#
-# Note: Passing of CPPFLAGS / CFLAGS explicitly discards using of
-# corresponding environment variables. So pass empty LDFLAGS to discard
-# using of corresponding environment variable. It is possible that a
-# linker flag assumes that some compilation flag is set. We don't pass
-# CFLAGS from environment, so we should not do it for LDFLAGS too.
-#
-# Note: A configure script generated by autoconf doesn't enable compiler
-# optimizations if CFLAGS / CXXFLAGS is set so we have to enable them
-# explicitly, see https://github.com/tarantool/tarantool/issues/8606
-#
-set(DEPENDENCY_CFLAGS "-O2")
-set(DEPENDENCY_CXXFLAGS "-O2")
-set(DEPENDENCY_CPPFLAGS "")
-set(DEPENDENCY_LDFLAGS "")
-
-if (APPLE)
-    set(DEPENDENCY_CFLAGS "${DEPENDENCY_CFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
-    set(DEPENDENCY_CXXFLAGS "${DEPENDENCY_CXXFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
-    set(DEPENDENCY_CPPFLAGS "${DEPENDENCY_CPPFLAGS} ${CMAKE_C_SYSROOT_FLAG} ${CMAKE_OSX_SYSROOT}")
-endif()
-
-set(DEPENDENCY_CFLAGS "${DEPENDENCY_CFLAGS} ${HARDENING_FLAGS}")
-set(DEPENDENCY_CXXFLAGS "${DEPENDENCY_CXXFLAGS} ${HARDENING_FLAGS}")
-set(DEPENDENCY_LDFLAGS "${DEPENDENCY_LDFLAGS} ${HARDENING_LDFLAGS}")
-
-set(DEPENDENCY_CFLAGS "${DEPENDENCY_CFLAGS} ${PREFIX_MAP_FLAGS}")
-set(DEPENDENCY_CXXFLAGS "${DEPENDENCY_CXXFLAGS} ${PREFIX_MAP_FLAGS}")
-
-set(PATCHES_DIR "${CMAKE_CURRENT_LIST_DIR}/../patches")
-
-# Install all libraries required by tarantool at current build dir
-
-#
-# OpenSSL
-#
-# Patched to build on Mac OS. See
-# https://github.com/openssl/openssl/issues/18720
-#
-ExternalProject_Add(openssl
-    URL ${BACKUP_STORAGE}/openssl/openssl-${OPENSSL_VERSION}.tar.gz
-    URL_MD5 ${OPENSSL_HASH}
-    CONFIGURE_COMMAND <SOURCE_DIR>/config
-        CC=${CMAKE_C_COMPILER}
-        CXX=${CMAKE_CXX_COMPILER}
-        CFLAGS=${DEPENDENCY_CFLAGS}
-        CPPFLAGS=${DEPENDENCY_CPPFLAGS}
-        LDFLAGS=${DEPENDENCY_LDFLAGS}
-
-        --prefix=<INSTALL_DIR>
-        --libdir=lib
-        no-shared
-    INSTALL_COMMAND ${CMAKE_MAKE_PROGRAM} install_sw
-    PATCH_COMMAND patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/openssl-111q-gh-18720.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/openssl-tarantool-security-27.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/openssl-tarantool-security-54.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/openssl-tarantool-security-90.patch"
-)
-set(TARANTOOL_DEPENDS openssl ${TARANTOOL_DEPENDS})
-
-#
-# ICU
-#
-ExternalProject_Add(icu
-    URL https://github.com/unicode-org/icu/releases/download/${LIBICU_VERSION}-src.tgz
-    URL_MD5 ${LIBICU_HASH}
-    # By default libicu is built by using clang/clang++ compiler (if it
-    # exists). Here is a link for detecting compilers at libicu configure
-    # script: https://github.com/unicode-org/icu/blob/7c7b8bd5702310b972f888299169bc3cc88bf0a6/icu4c/source/configure.ac#L135
-    # This will cause the problem on linux machine: tarantool is built
-    # with gcc/g++ and libicu is built with clang/clang++ (if it exists)
-    # so at linking stage `rellocation` errors will occur. To solve this,
-    # we can set CC/CXX to CMAKE_C_COMPILER/CMAKE_CXX_COMPILER variables
-    # manually which are detected above (by cmake `project()` command)
-    CONFIGURE_COMMAND <SOURCE_DIR>/source/configure
-        CC=${CMAKE_C_COMPILER}
-        CXX=${CMAKE_CXX_COMPILER}
-        CFLAGS=${DEPENDENCY_CFLAGS}
-        CXXFLAGS=${DEPENDENCY_CXXFLAGS}
-        CPPFLAGS=${DEPENDENCY_CPPFLAGS}
-        LDFLAGS=${DEPENDENCY_LDFLAGS}
-
-        --with-data-packaging=static
-        --prefix=<INSTALL_DIR>
-        --disable-shared
-        --enable-static
-        --disable-renaming
-        --disable-tests
-        --disable-samples
-    INSTALL_COMMAND
-        $(MAKE) install &&
-        ${CMAKE_COMMAND} -E touch <BINARY_DIR>/uconfig.h &&
-        cat <BINARY_DIR>/uconfig.h.prepend <INSTALL_DIR>/include/unicode/uconfig.h >> <BINARY_DIR>/uconfig.h &&
-        ${CMAKE_COMMAND} -E copy_if_different <BINARY_DIR>/uconfig.h <INSTALL_DIR>/include/unicode/uconfig.h
-    PATCH_COMMAND patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/icu-tarantool-security-45.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/icu-tarantool-security-59.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/icu-tarantool-security-61.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/icu-tarantool-security-96.patch"
-)
-set(TARANTOOL_DEPENDS icu ${TARANTOOL_DEPENDS})
-
-#
-# ZLIB
-#
-ExternalProject_Add(zlib
-    URL ${BACKUP_STORAGE}/zlib/zlib-${ZLIB_VERSION}.tar.gz
-    URL_MD5 ${ZLIB_HASH}
-    CONFIGURE_COMMAND env
-        CC=${CMAKE_C_COMPILER}
-        CFLAGS=${DEPENDENCY_CFLAGS}
-        CPPFLAGS=${DEPENDENCY_CPPFLAGS}
-        LDFLAGS=${DEPENDENCY_LDFLAGS}
-        <SOURCE_DIR>/configure
-        --prefix=<INSTALL_DIR>
-        --static
-)
-set(TARANTOOL_DEPENDS zlib ${TARANTOOL_DEPENDS})
-
-#
-# Ncurses
-#
-ExternalProject_Add(ncurses
-    URL ${BACKUP_STORAGE}/ncurses/ncurses-${NCURSES_VERSION}.tgz
-    URL_MD5 ${NCURSES_HASH}
-    CONFIGURE_COMMAND <SOURCE_DIR>/configure
-        CC=${CMAKE_C_COMPILER}
-        CXX=${CMAKE_CXX_COMPILER}
-        CFLAGS=${DEPENDENCY_CFLAGS}
-        CPPFLAGS=${DEPENDENCY_CPPFLAGS}
-        CXXFLAGS=${DEPENDENCY_CXXFLAGS}
-        LDFLAGS=${DEPENDENCY_LDFLAGS}
-
-        --prefix=<INSTALL_DIR>
-
-        # This flag enables creation of libcurses.a as a symlink to libncurses.a
-        # and disables subdir creation `ncurses` at <install_dir>/include. It is
-        # necessary for correct work of FindCurses.cmake module (this module is
-        # builtin at cmake package) which used in cmake/FindReadline.cmake
-        --enable-overwrite
-
-        # enable building libtinfo to prevent linking with libtinfo from system
-        # directories
-        --with-termlib
-
-        # set search paths for terminfo db
-        --with-terminfo-dirs=/lib/terminfo:/usr/share/terminfo:/etc/terminfo
-
-        # disable install created terminfo db, use db from system
-        --disable-db-install
-        --without-progs
-        --without-manpages
-)
-set(TARANTOOL_DEPENDS ncurses ${TARANTOOL_DEPENDS})
-
-#
-# ReadLine
-#
-# Patched to fix file descriptor leak with zero-length history file.
-#
-ExternalProject_Add(readline
-    URL ${BACKUP_STORAGE}/readline/readline-${READLINE_VERSION}.tar.gz
-    URL_MD5 ${READLINE_HASH}
-    CONFIGURE_COMMAND <SOURCE_DIR>/configure
-        CC=${CMAKE_C_COMPILER}
-        CFLAGS=${DEPENDENCY_CFLAGS}
-        CPPFLAGS=${DEPENDENCY_CPPFLAGS}
-        LDFLAGS=${DEPENDENCY_LDFLAGS}
-
-        --prefix=<INSTALL_DIR>
-        --disable-shared
-    PATCH_COMMAND patch -d <SOURCE_DIR> -p0 -i "${PATCHES_DIR}/readline80-001.patch"
-    COMMAND       patch -d <SOURCE_DIR> -p1 -i "${PATCHES_DIR}/readline-tarantool-security-95.patch"
-)
-set(TARANTOOL_DEPENDS readline ${TARANTOOL_DEPENDS})
-
-#
-# ICONV
-#
-if (APPLE)
-    ExternalProject_Add(iconv
-        URL URL ${BACKUP_STORAGE}/libiconv/libiconv-${LIBICONV_VERSION}.tar.gz
-        URL_MD5 ${LIBICONV_HASH}
-        CONFIGURE_COMMAND <SOURCE_DIR>/configure
-            CC=${CMAKE_C_COMPILER}
-            CFLAGS=${DEPENDENCY_CFLAGS}
-            CPPFLAGS=${DEPENDENCY_CPPFLAGS}
-            LDFLAGS=${DEPENDENCY_LDFLAGS}
-
-            --prefix=<INSTALL_DIR>
-            --disable-shared
-            --enable-static
-            --with-gnu-ld
-        STEP_TARGETS download
-    )
-else()
-    # In linux iconv is embedded into glibc
-    # So we find system header and copy it locally
-    find_path(ICONV_INCLUDE_DIR iconv.h)
-    if(NOT ICONV_INCLUDE_DIR)
-        message(FATAL_ERROR "iconv include header not found")
-    endif()
-
-    set(ICONV_INSTALL_PREFIX "${CMAKE_CURRENT_BINARY_DIR}/iconv-prefix")
-
-    add_custom_command(
-        OUTPUT "${ICONV_INSTALL_PREFIX}/include/iconv.h"
-        COMMAND ${CMAKE_COMMAND} -E make_directory
-            "${ICONV_INSTALL_PREFIX}/include"
-        COMMAND ${CMAKE_COMMAND} -E copy
-            "${ICONV_INCLUDE_DIR}/iconv.h"
-            "${ICONV_INSTALL_PREFIX}/include/iconv.h"
-    )
-    add_custom_target(iconv
-        DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/iconv-prefix/include/iconv.h"
-    )
-    # This is a hack for further getting install directory of library
-    # by ExternalProject_Get_Property
-    set_target_properties(iconv
-        PROPERTIES _EP_INSTALL_DIR ${ICONV_INSTALL_PREFIX}
-    )
-endif()
-
-set(TARANTOOL_DEPENDS iconv ${TARANTOOL_DEPENDS})
diff --git a/static-build/cmake/AddTarantoolProject.cmake b/static-build/cmake/AddTarantoolProject.cmake
index 23a33d8d5a..cd52881930 100644
--- a/static-build/cmake/AddTarantoolProject.cmake
+++ b/static-build/cmake/AddTarantoolProject.cmake
@@ -1,10 +1,4 @@
-# Get install directories of built libraries for building
-# tarantool with custom CMAKE_PREFIX_PATH
-foreach(proj IN LISTS TARANTOOL_DEPENDS)
-    ExternalProject_Get_Property(${proj} install_dir)
-    set(CMAKE_PREFIX_PATH ${CMAKE_PREFIX_PATH}:${install_dir})
-    message(STATUS "Add external project ${proj} in ${install_dir}")
-endforeach()
+include(ExternalProject)
 
 ExternalProject_Add(tarantool
     DEPENDS ${TARANTOOL_DEPENDS}
@@ -15,9 +9,8 @@ ExternalProject_Add(tarantool
         # https://cmake.org/cmake/help/v3.4/module/GNUInstallDirs.html#special-cases
         -DCMAKE_INSTALL_LOCALSTATEDIR=<INSTALL_DIR>/var
         -DCMAKE_INSTALL_PREFIX=<INSTALL_DIR>
-        -DCMAKE_PREFIX_PATH=${CMAKE_PREFIX_PATH}
         -DOPENSSL_USE_STATIC_LIBS=TRUE
-        -DBUILD_STATIC=TRUE
+        -DBUILD_STATIC_WITH_BUNDLED_LIBS=TRUE
         -DENABLE_DIST=TRUE
         -DENABLE_HARDENING=${ENABLE_HARDENING}
         -DCMAKE_C_COMPILER=${CMAKE_C_COMPILER}
-- 
GitLab