Cleaning up third_party readmes and adding a template for future use....

Cleaning up third_party readmes and adding a template for future use.
The next step is a presubmit rule that will make people use the template.
We are doing this so that we can better track dependancy versions.

BUG=None
TEST=N/A

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=78316

[scherkus (not reviewing), 2011-03-04 00:26:41]

what about third_party stuff pulled in via DEPS?

http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/ffmpeg/source/RE...
http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/libvpx/README.ch...

[Cris Neckar, 2011-03-04 01:44:13]

> what about third_party stuff pulled in via DEPS?

I have to do this in a separate CL as the base is /deps/ right? Are you saying I
shouldn't update the files in /src/third_party/ that are pulled in via DEPS and
instead just do the readmes in /deps/third_party/?

[scherkus (not reviewing), 2011-03-04 01:46:32]

oh it was just a reminder :)

yeah feel free to do a separate CL, etc, etc.!

[Cris Neckar, 2011-03-04 18:02:24]

> oh it was just a reminder :)
> 
> yeah feel free to do a separate CL, etc, etc.!

Oh cool. I don't really know the structure of all this stuff yet so I figured I
would ask :)

[Chris Evans, 2011-03-04 22:13:37]

LGTM

Is there any benefit in a "Security critical:" field? Values could be "No" for
something like bsdiff and "Yes" for libxml, libpng etc.

On 2011/03/04 18:02:24, cdn wrote:
> > oh it was just a reminder :)
> > 
> > yeah feel free to do a separate CL, etc, etc.!
> 
> Oh cool. I don't really know the structure of all this stuff yet so I figured
I
> would ask :)

[Cris Neckar, 2011-03-04 22:18:06]

> Is there any benefit in a "Security critical:" field? Values could be "No" for
> something like bsdiff and "Yes" for libxml, libpng etc.

I like the idea but BooBoo doesn't have a way to differentiate. Unless we want
to not update the things that don't matter.

For this to add value we will need to have something parsing the incoming BooBoo
reports that ups the priority assuming it is a security relevant package.

I think I'll add this to the template anyway though.

[Cris Neckar, 2011-03-04 22:35:15]

Evan, can you sanity check these changes. Nothing scary I just want to make sure
I am doign this in a sane way.

[Evan Martin, 2011-03-04 22:40:37]

Can you give me a higher-level description of what you're trying to do?  I have
no context.

[Cris Neckar, 2011-03-14 18:40:50]

Modified these files based on our out of band conversation.

[Evan Martin, 2011-03-14 18:52:48]

Now that I'm seeing the version/revision metadata clearly, I really see its
value.  Thank you for doing this!

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
File third_party/README.chromium.template (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
third_party/README.chromium.template:5: Revision: The current revision of the
package
Perhaps clarify what this means.  I think you mean like SVN revision?  What
about packages maintained by git?

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
third_party/README.chromium.template:6: License: The license under which the
package is distributed
We want to drop this, right?

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
third_party/README.chromium.template:7: License File: File that contains a copy
of the packages license
typo: "package's"

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
third_party/README.chromium.template:8: Security Critical: Either 1 or 0
depending on whether this package is shipped in releases. For example openssl is
critical where cygwin is not.
It might make more sense to make this more explicit as to what it's tracking. 
For example "Included in Release:" would be easier for people who don't
understand your purposes to get the metadata right.  (I'm thinking like if we
had some script that generates public keys or something, someone might mark it
"security critical" even when it's not included in the release.)

The other reason it'd be nice to have "included in release" metadata is that it
means we can drop the licensing info for stuff that isn't included in the
release from about:credits.  (Confusingly, we use GPL code but *not* in the
release.)

http://codereview.chromium.org/6610030/diff/11001/third_party/gpsd/README.chr...
File third_party/gpsd/README.chromium (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/gpsd/README.chr...
third_party/gpsd/README.chromium:4: Version: 2.94
Hm, I hope it's ok given that we're using the older version too...

http://codereview.chromium.org/6610030/diff/11001/third_party/harfbuzz-ng/REA...
File third_party/harfbuzz-ng/README.chromium (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/harfbuzz-ng/REA...
third_party/harfbuzz-ng/README.chromium:11:
(git://anongit.freedesktop.org/harfbuzz).  I also deleted all
You can remove this bit, since the hash is above.

http://codereview.chromium.org/6610030/diff/11001/third_party/harfbuzz/README...
File third_party/harfbuzz/README.chromium (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/harfbuzz/README...
third_party/harfbuzz/README.chromium:7: This code was taken from
b0d396aa88b3cdf8cea896bfeeba197656e1cdb1
You can remove this bit, because the hash is above.

http://codereview.chromium.org/6610030/diff/11001/third_party/libwebp/README....
File third_party/libwebp/README.chromium (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/libwebp/README....
third_party/libwebp/README.chromium:10: Change-Id:
I943a335b92b5ee6c2980c2ba9d4092f0b79f9a6b, "handle corner case of
Should this go into "revision"?  I guess it's the change-id not the commit.

http://codereview.chromium.org/6610030/diff/11001/third_party/modp_b64/README...
File third_party/modp_b64/README.chromium (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/modp_b64/README...
third_party/modp_b64/README.chromium:4: License File: modp_b64.cc
This means we'll inline the text of this file into about:credits.  I don't think
that's what we want.  Better to leave the license file field out.

http://codereview.chromium.org/6610030/diff/11001/third_party/tcmalloc/README...
File third_party/tcmalloc/README.chromium (right):

http://codereview.chromium.org/6610030/diff/11001/third_party/tcmalloc/README...
third_party/tcmalloc/README.chromium:4: Version: 0
unknown

http://codereview.chromium.org/6610030/diff/11001/third_party/tcmalloc/README...
third_party/tcmalloc/README.chromium:6: Date: 2010-04-22
I think you said you wanted to remove date, right?

[Cris Neckar, 2011-03-14 20:15:12]

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
> third_party/README.chromium.template:5: Revision: The current revision of the
> package
> Perhaps clarify what this means.  I think you mean like SVN revision?  What
> about packages maintained by git?
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
> third_party/README.chromium.template:6: License: The license under which the
> package is distributed
> We want to drop this, right?
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
> third_party/README.chromium.template:7: License File: File that contains a
copy
> of the packages license
> typo: "package's"
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/README.chromium...
> third_party/README.chromium.template:8: Security Critical: Either 1 or 0
> depending on whether this package is shipped in releases. For example openssl
is
> critical where cygwin is not.
> It might make more sense to make this more explicit as to what it's tracking. 
> For example "Included in Release:" would be easier for people who don't
> understand your purposes to get the metadata right.  (I'm thinking like if we
> had some script that generates public keys or something, someone might mark it
> "security critical" even when it's not included in the release.)
> 
> The other reason it'd be nice to have "included in release" metadata is that
it
> means we can drop the licensing info for stuff that isn't included in the
> release from about:credits.  (Confusingly, we use GPL code but *not* in the
> release.)
Yeah I agree this is better wording. I am still not sure how we are going to
treat these differently but I think it useful to at least have the data
available. I changed the key to what you suggest.

http://codereview.chromium.org/6610030/diff/11001/third_party/gpsd/README.chr...
> third_party/gpsd/README.chromium:4: Version: 2.94
> Hm, I hope it's ok given that we're using the older version too...
Yeah we have a couple of weird corner cases like this. I think I will list the
old version so that we get warnings about all the versions that we use instead
of only the latest.

http://codereview.chromium.org/6610030/diff/11001/third_party/harfbuzz-ng/REA...
> third_party/harfbuzz-ng/README.chromium:11:
> (git://anongit.freedesktop.org/harfbuzz).  I also deleted all
> You can remove this bit, since the hash is above.
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/harfbuzz/README...
> third_party/harfbuzz/README.chromium:7: This code was taken from
> b0d396aa88b3cdf8cea896bfeeba197656e1cdb1
> You can remove this bit, because the hash is above.
Done.


http://codereview.chromium.org/6610030/diff/11001/third_party/libwebp/README....
> third_party/libwebp/README.chromium:10: Change-Id:
> I943a335b92b5ee6c2980c2ba9d4092f0b79f9a6b, "handle corner case of
> Should this go into "revision"?  I guess it's the change-id not the commit.
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/modp_b64/README...
> third_party/modp_b64/README.chromium:4: License File: modp_b64.cc
> This means we'll inline the text of this file into about:credits.  I don't
think
> that's what we want.  Better to leave the license file field out.
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/tcmalloc/README...
> third_party/tcmalloc/README.chromium:4: Version: 0
> unknown
Done.

http://codereview.chromium.org/6610030/diff/11001/third_party/tcmalloc/README...
> third_party/tcmalloc/README.chromium:6: Date: 2010-04-22
> I think you said you wanted to remove date, right?
Done.

[Evan Martin, 2011-03-14 20:48:10]

LGTM

[Cris Neckar, 2011-03-15 00:10:39]

On 2011/03/14 20:48:10, Evan Martin wrote:
> LGTM

I forgot to add one file.. Can you sanity check the skia readme just for
completeness?

Thanks for the review :)

[Evan Martin, 2011-03-15 05:11:22]

oops,  forgot to send

http://codereview.chromium.org/6610030/diff/16001/third_party/skia/README.chr...
File third_party/skia/README.chromium (right):

http://codereview.chromium.org/6610030/diff/16001/third_party/skia/README.chr...
third_party/skia/README.chromium:1: Name: Skia 2D Graphics Context
Context is wrong.  Library?

[Cris Neckar, 2011-03-15 18:36:55]

http://codereview.chromium.org/6610030/diff/16001/third_party/skia/README.chr...
> third_party/skia/README.chromium:1: Name: Skia 2D Graphics Context
> Context is wrong.  Library?

Done.

[Evan Martin, 2011-03-15 18:39:49]

LGTM

(note that we do know the skia version, it comes from DEPS, but we can fix that
later)