[Development] Who's responsible for 3rdparty these days (QTBUG-59586)?

[Edward Welbourne]

On 19 March 2017 at 20:01, Thiago Macieira <thiago.macieira at intel.com<mailto:thiago.macieira at intel.com>> wrote:
>> The rules are that only Qt Company people can import 3rdparty code, so I know
>> I am not responsible.
>>
>> Who do I assign the bug to?
>> https://bugreports.qt.io/browse/QTBUG-59586

QUIP 4 (see below) should perhaps address that ...

Liang Qi (29 March 2017 14:03)
> For QTBUG-59586, I have https://codereview.qt-project.org/189977 and
> https://github.com/liangqi/zlib/tree/qt .
>
> Please give some feedback.

We should find a home for our "authoritative" version on systems we
control (e.g. gerrit), rather than an individual developer's account on
a third-party web-site.

We should probably also have - somewhere - an "upstream mirror" space,
where we have (at least bare) repos for all upstream projects we can
(using git's ways of pulling from cvs, svn, &c.) from which we update
our authoritative versions (preferably reasonably frequently).  Once
such a mirror is set up, it's easy for some cron jobs to keep it up to
date - and generate grumble mails to someone suitable when the upstreams
move, change version control system or do other disruptive things that
we'll need to keep track of if we're ever to update to a later version.

Whether that upstream space is just a branch name-space within the
authoritative repos or a separate directory of (perhaps bare) repos is
an implementation detail I leave to whoever might set it up.  It should
be visible to Maintainers generally, if only so that we can discover how
behind our "live" version has fallen.

> And I still have a general question:
>
> I have seen this new git submodule way in qtlocation, like
> http://code.qt.io/cgit/qt/qtlocation-mapboxgl.git/ .

In connection with that, I notice that
qtlocation/src/3rdparty/mapbox-gl-native/src/3rd_party/
(presumably the 3rdparty code of our 3rdparty code is at least 4th-party
for us) has several sub-directories, each with a .gitmodules that points
at https://github.com/mapbox/mason (sometimes with .git suffix,
sometimes without).  The duplication makes me twitchy (as does the
variation in url), but maybe it's needed ... and it's in third-party
components, so maybe this is just derived from their upstreams.

> So should we do a mirror in code.qt.io<http://code.qt.io> first and
> then add this in the modules? And there is common procedure for this
> purpose? for example, patches and qt_attribution.json file if upstream
> doesn't have it.

We could definitely benefit from some common process for maintaining our
mirrors of upstreams.

The qt_attribution.json should be present in our source tree;
see QUIP 4:
* https://codereview.qt-project.org/177201
* https://quips-qt-io.herokuapp.com/quip-0004.html

	Eddy.