2035704 - Use UpdateBot patch lists to manage Cairo vendoring

Status: RESOLVED FIXED

(Core :: Graphics, defect, P1)

Description

[Jim Blandy :jimb]

UpdateBot should vendor gfx/cairo by applying a series of patches to the official Cairo source repository, rather than consulting a Mozilla fork of Cairo.

Bug 2034315 put Cairo vendoring under UpdateBot control, but rather than using a patch stack, 2034315 had UpdateBot vendor gfx/cairo/cairo from a branch in a Mozilla fork of the upstream Cairo git repository. The idea was that Firefox maintainers would push changes to that branch, and then run UpdateBot manually (mach vendor gfx/cairo/moz.yaml) to make Mozilla Central match the fork. The hope was that managing local changes as a branch rather than a series of patch files would be easier to maintain: the old Cairo patch stack (managed by hand, not by UpdateBot) had gotten badly out of date.

However, this has a number of disadvantages:

• It's different from the way UpdateBot is generally used elsewhere in the source tree, so the advantages of familiarity and consistency are lost.
• Since UpdateBot isn't pointed at upstream sources, the cron job isn't going to notice when Cairo is changed upstream. Active monitoring is one of the main advantages of using UpdateBot.
• Requiring security-sensitive changes to be posted to an external repo before they can be merged into Mozilla Central probably increases the window during which they're disclosed but not fixed.
• For ordinary changes, it makes it unclear when the patch is really reviewed: do we submit PRs to our Cairo fork, or do we just post the change there and review the Mozilla Central change posted to Phab?

While stacks of patch files are still error-prone, telling UpdateBot about them at least ensures that we'll get an automatic notification if the patches go stale, or don't actually produce the vendored sources.

Comment 1

[Jim Blandy :jimb]

Marking P1, since the current situation complicates fixing Cairo bugs.

Comment 2

[Jim Blandy :jimb]

Attachment: Bug 2035704: Manage Cairo vendoring using UpdateBot's `patches` list. r=#gfx-reviewers

Change the way UpdateBot vendors Cairo into Mozilla Central to better
integrate with UpdateBot's periodic upstream checks, and to clarify
the approval process for security-sensitive patches.

In gfx/cairo/moz.yaml:

• Have UpdateBot consult the true Cairo upstream,
  https://gitlab.freedesktop.org/cairo/cairo, rather than a Mozilla
  fork of that.

• Have UpdateBot apply a series of patches stored in
  gfx/cairo/patches to the Cairo upstream, rather than managing
  our local patches as a branch in a Mozilla fork.

Place patch files as patch files in gfx/cairo/patches for all of
Firefox's local changes to Cairo.

This partially reverses the approach established by bug 2034315, so as
to use UpdateBot more as it was intended.

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/4fec48e67999
https://hg.mozilla.org/integration/autoland/rev/796c45479486
Manage Cairo vendoring using UpdateBot's `patches` list. r=gfx-reviewers,tnikkel

Comment 5

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/796c45479486