Skip to content

Bug 41012: Add a "component" information to our projects and a script to create a dependency graph

Pier Angelo Vendrame requested to merge pierov/tor-browser-build:bug_41012 into main

Merge Info

Related Issues

  • tor-browser#xxxxx
  • mullvad-browser#xxxxx
  • #41012



  • Immediate: patchset needed as soon as possible
  • Next Minor Stable Release: patchset that needs to be verified in nightly before backport
  • Eventually: patchset that needs to be verified in alpha before backport
  • No Backport (preferred): patchset for the next major stable

(Optional) Justification

  • Emergency security update: patchset fixes CVEs, 0-days, etc
  • Censorship event: patchset enables censorship circumvention
  • Critical bug-fix: patchset fixes a bug in core-functionality
  • Consistency: patchset which would make development easier if it were in both the alpha and release branches; developer tools, build system changes, etc
  • Sponsor required: patchset required for sponsor
  • Other: please explain

Issue Tracking


Request Reviewer

  • Request review from an applications developer depending on modified system:
    • NOTE: if the MR modifies multiple areas, please /cc all the relevant reviewers (since gitlab only allows 1 reviewer)
    • accessibility : henry
    • android : clairehurst, dan
    • build system : boklm
    • extensions : ma1
    • firefox internals (XUL/JS/XPCOM) : ma1
    • fonts : pierov
    • frontend (implementation) : henry
    • frontend (review) : donuts, richard
    • localization : henry, pierov
    • macos : clairehurst, dan
    • nightly builds : boklm
    • rebases/release-prep : dan, ma1, pierov, richard
    • security : ma1
    • signing : boklm, richard
    • updater : pierov
    • misc/other : pierov, richard

/cc @richard

Change Description

I've created a script to create a dependency graph in the dot format.

I decided to group some dependencies together, so I added to each project (except for a few ones) a component information. Maybe we can discuss a few projects (e.g., node and cbindgen: they're toolchain, but used only by Firefox. Maybe nasm should be with them).

The script is set to ignore the dependency on some projects, notably:

  • container-image
  • binutils
  • compiler
  • go (at least until we have Namecoin dependencies instead of using go.mod/go.sum)

Also, the script ignores firefox-l10n because it isn't trivial to parse (but it's the only project, so not worth to implement a better parser only for it).

How Tested

Created this graph:



Graph without exceptions (for reference)


Merge request reports