Updating Dependencies

The Open Screen Library uses several external libraries that are compiled from source and fetched from additional git repositories into folders below third_party/. These libraries are listed in the DEPS file in the root of the repository. (DEPS listed with dep_type: cipd or gcs are not managed through git.)

Periodically the versions of these libraries are updated to pick up bug and security fixes from upstream repositories.

Library versions are tracked both in the DEPS file and in git submodules. Using the roll-dep script below will keep the two in sync.

The process is roughly as follows:

  1. Identify the git commit for the new version of the library that you want to roll.
    • For libraries that are also used by Chromium, prefer rolling to the same version listed in Chromium DEPS. These libraries are listed below.
    • For other libraries, prefer the most recent stable or general availability release.
  2. Use the roll-dep script to update the git hashes in DEPS and the corresponding git submodule.
    • This will generate and upload a CL to Gerrit.
    • Example: roll-dep -r jophba --roll-to 229b04537a191ce272a96734b0f4ddcccc31f241 third_party/quiche/src
    • More documentation in Rolling Dependencies
  3. Update your CL if needed, such as updating the BUILD.gn file for the corresponding library to handle files moving around, compiler flag adjustments, etc.
  4. Use a tryjob to verify that nothing is broken and send for code review.

Libraries used in Chromium

  • build (mirrored from Chromium)
  • third_party/libprotobuf-mutator/src
  • third_party/jsoncpp/src
  • third_party/googletest/src (not kept in sync with Chromium, see comment in DEPS)
  • third_party/quiche/src
  • third_party/abseil/src (not kept in sync with Chromium, see comment in DEPS)
  • third_party/libfuzzer/src
  • third_party/googleurl/src (not kept in sync with Chromium, see comment in DEPS)

Rolling buildtools/

buildtools/ is a special case because it is interdependent with third_party/libc++/src and third_party/libc++abi/src; they must all be rolled in one CL.

The steps to roll:

  1. Get the current commit hash of the buildtools mirror (call it X).
  2. Get the commit hash of libc++ from deps_revisions.gni (call it Y).
  3. Get the commit hash of libc++abi (call it Z) from chromium/src/DEPS.
  4. In the same local branch:
    • $ roll-dep --roll-to X -r <reviewer>@chromium.org buildtools/
    • $ roll=dep --ignore-dirty-tree --roll-to Y third_party/libc++/src
    • $ roll=dep --ignore-dirty-tree --roll-to Z third_party/libc++abi/src
  5. $ git cl upload the resulting commits.

Roll buildtools/ 5df641722..eca5f0685 (13 commits) is an example of a successful roll CL.

Other special cases that are updated manually

  • third_party/protobuf: See instructions in third-party/protobuf/README.chromium
  • third_party/boringssl/src: See instructions in third_party/boringssl/README.openscreen.md

Rolling GCS dependencies

TODO: Find and link instructions, and list GCS dependencies