diff --git a/CMakeLists.txt b/CMakeLists.txt
index 74e2058..e0b5acc 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -14,41 +14,31 @@
 
 cmake_minimum_required(VERSION 3.10)
 
-option(SAPI_USE_SUPERBUILD "Whether or not a superbuild should be invoked" ON)
-if(SAPI_USE_SUPERBUILD)
-  project(superbuild NONE)
-  include(cmake/SapiSuperBuild.cmake)
-  return()
-endif()
-project(sandboxed_api C CXX ASM)
+project(SandboxedAPI C CXX ASM)
 
 # SAPI-wide setting for the language level
 set(SAPI_CXX_STANDARD 11)
 
+set(SAPI_BINARY_DIR "${PROJECT_BINARY_DIR}" CACHE INTERNAL "" FORCE)
+set(SAPI_SOURCE_DIR "${PROJECT_SOURCE_DIR}" CACHE INTERNAL "" FORCE)
+
 # Sapi CMake modules, order matters
-list(APPEND CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake")
+list(APPEND CMAKE_MODULE_PATH "${SAPI_SOURCE_DIR}/cmake")
 include(SapiOptions)
 include(SapiDeps)
 include(SapiUtil)
 include(SapiBuildDefs)
 
-include(GoogleTest)
-
 # Make Bazel-style includes work
 configure_file(cmake/libcap_capability.h.in
                libcap/include/sys/capability.h
                @ONLY)
-set(libunwind_INCLUDE_DIR
-    ${PROJECT_BINARY_DIR}/Dependencies/Source/libunwind/include)
-configure_file(cmake/libunwind_ptrace.h.in
-               libunwind-ptrace.h
-               @ONLY)
 
 # Library with basic project settings. The empty file is there to be able to
 # define header-only libraries without cumbersome target_sources() hacks.
-file(TOUCH ${PROJECT_BINARY_DIR}/sapi_base_force_cxx_linkage.cc)
+file(TOUCH ${SAPI_BINARY_DIR}/sapi_base_force_cxx_linkage.cc)
 add_library(sapi_base STATIC
-  ${PROJECT_BINARY_DIR}/sapi_base_force_cxx_linkage.cc
+  "${SAPI_BINARY_DIR}/sapi_base_force_cxx_linkage.cc"
 )
 add_library(sapi::base ALIAS sapi_base)
 set_target_properties(sapi_base PROPERTIES
@@ -59,11 +49,9 @@ set_target_properties(sapi_base PROPERTIES
   POSITION_INDEPENDENT_CODE TRUE
 )
 target_include_directories(sapi_base INTERFACE
-  ${PROJECT_BINARY_DIR}
-  ${PROJECT_SOURCE_DIR}
-  ${Protobuf_INCLUDE_DIR}
-  # Need to reach into Abseil internal headers from a few targets.
-  ${PROJECT_BINARY_DIR}/Dependencies/Source/absl
+  "${SAPI_BINARY_DIR}"
+  "${SAPI_SOURCE_DIR}"
+  "${Protobuf_INCLUDE_DIR}"
 )
 if(UNIX)
   target_compile_options(sapi_base INTERFACE
@@ -80,9 +68,11 @@ target_link_libraries(sapi_test_main INTERFACE
   sapi::base
 )
 
-# Setup tests to work like with Bazel
-create_directory_symlink(${PROJECT_BINARY_DIR} com_google_sandboxed_api)
-enable_testing()
+if(SAPI_ENABLE_TESTS)
+  include(GoogleTest)
+  # Setup tests to work like with Bazel
+  create_directory_symlink("${SAPI_BINARY_DIR}" com_google_sandboxed_api)
+  enable_testing()
+endif()
 
-add_subdirectory(cmake/libunwind)
 add_subdirectory(sandboxed_api)
diff --git a/cmake/SapiBuildDefs.cmake b/cmake/SapiBuildDefs.cmake
index 1f6d512..f2ce1b8 100644
--- a/cmake/SapiBuildDefs.cmake
+++ b/cmake/SapiBuildDefs.cmake
@@ -20,33 +20,34 @@
 #   target the target binary is embedded instead.
 macro(sapi_cc_embed_data)
   cmake_parse_arguments(_sapi_embed "" "NAME;NAMESPACE" "SOURCES" ${ARGN})
-  foreach(src ${_sapi_embed_SOURCES})
-    if(TARGET ${src})
-      list(APPEND _sapi_embed_in ${CMAKE_CURRENT_BINARY_DIR}/${src})
+  foreach(src IN LISTS _sapi_embed_SOURCES)
+    if(TARGET "${src}")
+      list(APPEND _sapi_embed_in "${CMAKE_CURRENT_BINARY_DIR}/${src}")
     else()
-      list(APPEND _sapi_embed_in ${src})
+      list(APPEND _sapi_embed_in "${src}")
     endif()
   endforeach()
   file(RELATIVE_PATH _sapi_embed_pkg
-                     ${PROJECT_BINARY_DIR}
-                     ${CMAKE_CURRENT_BINARY_DIR})
+                     "${PROJECT_BINARY_DIR}"
+                     "${CMAKE_CURRENT_BINARY_DIR}")
   add_custom_command(
-    OUTPUT ${_sapi_embed_NAME}.h ${_sapi_embed_NAME}.cc
-    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-    COMMAND filewrapper ${_sapi_embed_pkg}
-                        ${_sapi_embed_NAME}
+    OUTPUT "${_sapi_embed_NAME}.h"
+           "${_sapi_embed_NAME}.cc"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    COMMAND filewrapper "${_sapi_embed_pkg}"
+                        "${_sapi_embed_NAME}"
                         "${_sapi_embed_NAMESPACE}"
-                        ${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.h
-                        ${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.cc
+                        "${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.h"
+                        "${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.cc"
                         ${_sapi_embed_in}
     DEPENDS ${_sapi_embed_SOURCES}
     VERBATIM
   )
-  add_library(${_sapi_embed_NAME} STATIC
-    ${_sapi_embed_NAME}.h
-    ${_sapi_embed_NAME}.cc
+  add_library("${_sapi_embed_NAME}" STATIC
+    "${_sapi_embed_NAME}.h"
+    "${_sapi_embed_NAME}.cc"
   )
-  target_link_libraries(${_sapi_embed_NAME} PRIVATE
+  target_link_libraries("${_sapi_embed_NAME}" PRIVATE
     sapi::base
     absl::core_headers
   )
@@ -135,7 +136,7 @@ function(add_sapi_library)
   add_custom_command(
     OUTPUT "${_sapi_gen_header}"
     COMMAND "${Python3_EXECUTABLE}" -B
-            "${PROJECT_SOURCE_DIR}/sandboxed_api/tools/generator2/sapi_generator.py"
+            "${SAPI_SOURCE_DIR}/sandboxed_api/tools/generator2/sapi_generator.py"
             "--sapi_name=${_sapi_LIBRARY_NAME}"
             "--sapi_out=${_sapi_gen_header}"
             "--sapi_embed_dir=${_sapi_embed_dir}"
@@ -155,7 +156,7 @@ function(add_sapi_library)
     list(APPEND _sapi_SOURCES "${_sapi_force_cxx_linkage}")
   endif()
   add_library("${_sapi_NAME}" STATIC
-    ${_sapi_gen_header}
+    "${_sapi_gen_header}"
     ${_sapi_SOURCES}
   )
   target_link_libraries("${_sapi_NAME}" PRIVATE
diff --git a/cmake/SapiDeps.cmake b/cmake/SapiDeps.cmake
index 5a47103..ad7654e 100644
--- a/cmake/SapiDeps.cmake
+++ b/cmake/SapiDeps.cmake
@@ -12,39 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-list(APPEND CMAKE_PREFIX_PATH
-  "${PROJECT_BINARY_DIR}/Dependencies/Build/gflags"
-  "${PROJECT_BINARY_DIR}/Dependencies/Build/glog"
-  "${PROJECT_BINARY_DIR}/Dependencies/Build/protobuf"
-)
-
-# Build Abseil directly, as recommended upstream
-find_path(absl_src_dir
-  absl/base/port.h
-  HINTS ${ABSL_ROOT_DIR}
-  PATHS ${PROJECT_BINARY_DIR}/Dependencies/Source/absl
-)
-set(_sapi_saved_CMAKE_CXX_STANDARD ${CMAKE_CXX_STANDARD})
-set(CMAKE_CXX_STANDARD ${SAPI_CXX_STANDARD})
-add_subdirectory(${absl_src_dir}
-                 ${PROJECT_BINARY_DIR}/Dependencies/Build/absl
-                 EXCLUDE_FROM_ALL)
-if(_sapi_saved_CMAKE_CXX_STANDARD)
-  set(CMAKE_CXX_STANDARD "${_sapi_saved_CMAKE_CXX_STANDARD}")
-endif()
-
-if(SAPI_ENABLE_TESTS)
-  # Build Googletest directly, as recommended upstream
-  find_path(googletest_src_dir
-    googletest/include/gtest/gtest.h
-    HINTS ${GOOGLETEST_ROOT_DIR}
-    PATHS ${PROJECT_BINARY_DIR}/Dependencies/Source/googletest
-  )
-  set(gtest_force_shared_crt ON CACHE BOOL "")
-  add_subdirectory(${googletest_src_dir}
-                   ${PROJECT_BINARY_DIR}/Dependencies/Build/googletest
-                   EXCLUDE_FROM_ALL)
-endif()
+function(check_target target)
+  if(NOT TARGET ${target})
+    message(FATAL_ERROR " SAPI: compiling Sandboxed API requires a ${target}
+                   CMake target in your project")
+  endif()
+endfunction()
 
 # Prefer to use static libraries
 set(_sapi_saved_CMAKE_FIND_LIBRARY_SUFFIXES ${CMAKE_FIND_LIBRARY_SUFFIXES})
@@ -54,14 +27,47 @@ else()
   set(CMAKE_FIND_LIBRARY_SUFFIXES .a ${CMAKE_FIND_LIBRARY_SUFFIXES})
 endif()
 
-find_package(gflags REQUIRED)
-find_package(glog REQUIRED)
+if(SAPI_ENABLE_TESTS)
+  if(SAPI_USE_GOOGLETEST)
+    include(cmake/googletest/Download.cmake)
+  endif()
+  check_target(gtest)
+  check_target(gtest_main)
+  check_target(gmock)
+endif()
+
+if(SAPI_USE_ABSL)
+  include(cmake/abseil/Download.cmake)
+endif()
+check_target(absl::core_headers)
+
+if(SAPI_USE_LIBUNWIND)
+  include(cmake/libunwind/Download.cmake)
+endif()
+check_target(unwind_ptrace)
+check_target(unwind_ptrace_wrapped)
+
+if(SAPI_USE_GFLAGS)
+  include(cmake/gflags/Download.cmake)
+endif()
+check_target(gflags)
+
+if(SAPI_USE_GLOG)
+  include(cmake/glog/Download.cmake)
+endif()
+check_target(glog::glog)
+
+if(SAPI_USE_PROTOBUF)
+  include(cmake/protobuf/Download.cmake)
+endif()
+check_target(protobuf::libprotobuf)
+find_package(Protobuf REQUIRED)
+
 find_package(Libcap REQUIRED)
 find_package(Libffi REQUIRED)
 if(SAPI_ENABLE_EXAMPLES)
   find_package(ZLIB REQUIRED)
 endif()
-find_package(Protobuf REQUIRED)
 
 if(CMAKE_VERSION VERSION_LESS "3.12")
   # Work around FindPythonInterp sometimes not preferring Python 3.
diff --git a/cmake/SapiOptions.cmake b/cmake/SapiOptions.cmake
index 99d89f2..5e0d3b7 100644
--- a/cmake/SapiOptions.cmake
+++ b/cmake/SapiOptions.cmake
@@ -12,5 +12,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# These options determine whether CMake should download the libraries that
+# Sandboxed API depends on at configure time.
+# The CMake script SapiDeps.cmake checks for the presence of certain build
+# targets to determine whether a library can be used. Disabling the options
+# below enables embedding projects to selectively override/replace these
+# dependencies. This is useful for cases where embedding projects already
+# depend on some of these libraries (e.g. Abseil).
+option(SAPI_USE_ABSL "Download Abseil at config time" ON)
+option(SAPI_USE_GOOGLETEST "Download googletest at config time" ON)
+option(SAPI_USE_GFLAGS "Download gflags at config time" ON)
+option(SAPI_USE_GLOG "Download glog at config time" ON)
+option(SAPI_USE_PROTOBUF "Download protobuf at config time" ON)
+option(SAPI_USE_LIBUNWIND "Download libunwind at config time" ON)
+# TODO(cblichmann): These two are not currently implemented
+option(SAPI_USE_LIBCAP "Download libcap at config time" ON)
+option(SAPI_USE_LIBFFI "Download libffi at config time" ON)
+
 option(SAPI_ENABLE_EXAMPLES "Build example code" ON)
 option(SAPI_ENABLE_TESTS "Build unit tests" ON)
diff --git a/cmake/SapiSuperBuild.cmake b/cmake/SapiSuperBuild.cmake
deleted file mode 100644
index 2019274..0000000
--- a/cmake/SapiSuperBuild.cmake
+++ /dev/null
@@ -1,88 +0,0 @@
-include(ExternalProject)
-
-set_property(DIRECTORY PROPERTY EP_BASE Dependencies)
-
-set(DEPENDENCIES)
-set(EXTRA_CMAKE_ARGS)
-
-ExternalProject_Add(absl
-  GIT_REPOSITORY https://github.com/abseil/abseil-cpp.git
-  GIT_TAG aa468ad75539619b47979911297efbb629c52e44  # 2019-05-07
-  # Just clone into directory
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES absl)
-
-ExternalProject_Add(gflags
-  GIT_REPOSITORY https://github.com/gflags/gflags.git
-  GIT_TAG 28f50e0fed19872e0fd50dd23ce2ee8cd759338e
-  CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-             -DCMAKE_POSITION_INDEPENDENT_CODE=ON
-             -DGFLAGS_IS_SUBPROJECT=TRUE
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES gflags)
-
-ExternalProject_Add(glog
-  DEPENDS gflags
-  GIT_REPOSITORY https://github.com/google/glog.git
-  GIT_TAG 41f4bf9cbc3e8995d628b459f6a239df43c2b84a
-  CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-             -DCMAKE_POSITION_INDEPENDENT_CODE=ON
-             "-DCMAKE_PREFIX_PATH=${PROJECT_BINARY_DIR}/Dependencies/Build/gflags"
-             # Disable symbolizer
-             -DUNWIND_LIBRARY=
-             # getpwuid_r() cannot be linked statically with glibc
-             -DHAVE_PWD_H=
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES glog)
-
-ExternalProject_Add(googletest
-  GIT_REPOSITORY https://github.com/google/googletest.git
-  GIT_TAG 8ffb7e5c88b20a297a2e786c480556467496463b  # 2019-05-30
-  # Just clone into directory
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES googletest)
-
-ExternalProject_Add(libunwind
-  URL https://github.com/libunwind/libunwind/releases/download/v1.2.1/libunwind-1.2.1.tar.gz
-  URL_HASH SHA256=3f3ecb90e28cbe53fba7a4a27ccce7aad188d3210bb1964a923a731a27a75acb
-  # Need to invoke a custom build, so just download and extract
-  CONFIGURE_COMMAND ./configure
-                    --disable-documentation
-                    --disable-minidebuginfo
-                    --disable-shared
-                    --enable-ptrace
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ""
-  BUILD_IN_SOURCE TRUE
-)
-list(APPEND DEPENDENCIES libunwind)
-
-ExternalProject_Add(protobuf
-  GIT_REPOSITORY https://github.com/protocolbuffers/protobuf.git
-  GIT_TAG e08f01ce6a78a6cf2834dfa37281eb366eb0c5c3  # 2019-06-05
-  PREFIX ${CMAKE_CURRENT_BINARY_DIR}/Dependencies/Build/protobuf
-  SOURCE_SUBDIR cmake
-  CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-             -DCMAKE_POSITION_INDEPENDENT_CODE=ON
-             -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
-             -Dprotobuf_BUILD_TESTS=OFF
-             -Dprotobuf_BUILD_SHARED_LIBS=OFF
-             -Dprotobuf_WITH_ZLIB=OFF
-)
-list(APPEND DEPENDENCIES protobuf)
-
-ExternalProject_Add(sandboxed_api
-  DEPENDS ${DEPENDENCIES}
-  SOURCE_DIR ${PROJECT_SOURCE_DIR}
-  CMAKE_ARGS -DSAPI_USE_SUPERBUILD=OFF ${EXTRA_CMAKE_ARGS}
-  INSTALL_COMMAND ""
-  BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR}
-)
diff --git a/cmake/abseil/CMakeLists.txt.in b/cmake/abseil/CMakeLists.txt.in
new file mode 100644
index 0000000..b9f4558
--- /dev/null
+++ b/cmake/abseil/CMakeLists.txt.in
@@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(absl-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(absl
+  GIT_REPOSITORY    https://github.com/abseil/abseil-cpp
+  GIT_TAG           c6c3c1b498e4ee939b24be59cae29d59c3863be8  # 2019-07-18
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/absl-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/absl-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
diff --git a/cmake/abseil/Download.cmake b/cmake/abseil/Download.cmake
new file mode 100644
index 0000000..2f78a42
--- /dev/null
+++ b/cmake/abseil/Download.cmake
@@ -0,0 +1,44 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks Abseil at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/absl-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(_sapi_saved_CMAKE_CXX_STANDARD ${CMAKE_CXX_STANDARD})
+set(CMAKE_CXX_STANDARD ${SAPI_CXX_STANDARD})
+set(ABSL_USE_GOOGLETEST_HEAD OFF CACHE BOOL "" FORCE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/absl-src"
+                 "${CMAKE_BINARY_DIR}/absl-build" EXCLUDE_FROM_ALL)
+
+if(_sapi_saved_CMAKE_CXX_STANDARD)
+  set(CMAKE_CXX_STANDARD "${_sapi_saved_CMAKE_CXX_STANDARD}")
+endif()
diff --git a/cmake/gflags/CMakeLists.txt.in b/cmake/gflags/CMakeLists.txt.in
new file mode 100644
index 0000000..6b1248f
--- /dev/null
+++ b/cmake/gflags/CMakeLists.txt.in
@@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(gflags-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(gflags
+  GIT_REPOSITORY    https://github.com/gflags/gflags.git
+  GIT_TAG           28f50e0fed19872e0fd50dd23ce2ee8cd759338e  # 2019-01-25
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/gflags-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/gflags-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
diff --git a/cmake/gflags/Download.cmake b/cmake/gflags/Download.cmake
new file mode 100644
index 0000000..39ac7a3
--- /dev/null
+++ b/cmake/gflags/Download.cmake
@@ -0,0 +1,39 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks gflags at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/gflags-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(GFLAGS_IS_SUBPROJECT TRUE)
+set(GFLAGS_INSTALL_SHARED_LIBS FALSE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/gflags-src"
+                 "${CMAKE_BINARY_DIR}/gflags-build" EXCLUDE_FROM_ALL)
diff --git a/cmake/glog/CMakeLists.txt.in b/cmake/glog/CMakeLists.txt.in
new file mode 100644
index 0000000..3df548f
--- /dev/null
+++ b/cmake/glog/CMakeLists.txt.in
@@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(glog-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(glog
+  GIT_REPOSITORY    https://github.com/google/glog.git
+  GIT_TAG           ba8a9f6952d04d1403b97df24e6836227751454e  # 2019-05-07
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/glog-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/glog-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
diff --git a/cmake/glog/Download.cmake b/cmake/glog/Download.cmake
new file mode 100644
index 0000000..8280ca8
--- /dev/null
+++ b/cmake/glog/Download.cmake
@@ -0,0 +1,46 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks glog at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/glog-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND "${CMAKE_COMMAND}" -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND "${CMAKE_COMMAND}" --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+# Force gflags from subdirectory
+set(WITH_GFLAGS OFF CACHE BOOL "" FORCE)
+set(HAVE_LIB_GFLAGS 1)
+
+set(UNWIND_LIBRARY FALSE)
+set(HAVE_PWD_H FALSE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/glog-src"
+                 "${CMAKE_BINARY_DIR}/glog-build" EXCLUDE_FROM_ALL)
+target_include_directories(glog PUBLIC
+  $<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/gflags-build/include>
+)
diff --git a/cmake/googletest/CMakeLists.txt.in b/cmake/googletest/CMakeLists.txt.in
new file mode 100644
index 0000000..5582ae7
--- /dev/null
+++ b/cmake/googletest/CMakeLists.txt.in
@@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(googletest-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(googletest
+  GIT_REPOSITORY    https://github.com/google/googletest.git
+  GIT_TAG           2ef13f524b837a68bae27ae1123da0400dff6285  # 2019-07-18
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/googletest-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/googletest-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
diff --git a/cmake/googletest/Download.cmake b/cmake/googletest/Download.cmake
new file mode 100644
index 0000000..65c7d72
--- /dev/null
+++ b/cmake/googletest/Download.cmake
@@ -0,0 +1,38 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks Googletest at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/googletest-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/googletest-src"
+                 "${CMAKE_BINARY_DIR}/googletest-build" EXCLUDE_FROM_ALL)
diff --git a/cmake/libunwind/CMakeLists.txt.in b/cmake/libunwind/CMakeLists.txt.in
new file mode 100644
index 0000000..4ad3f27
--- /dev/null
+++ b/cmake/libunwind/CMakeLists.txt.in
@@ -0,0 +1,32 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(libunwind-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(libunwind
+  URL https://github.com/libunwind/libunwind/releases/download/v1.2.1/libunwind-1.2.1.tar.gz
+  URL_HASH SHA256=3f3ecb90e28cbe53fba7a4a27ccce7aad188d3210bb1964a923a731a27a75acb
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/libunwind-src"
+  CONFIGURE_COMMAND ./configure
+                    --disable-documentation
+                    --disable-minidebuginfo
+                    --disable-shared
+                    --enable-ptrace
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+  BUILD_IN_SOURCE TRUE
+)
diff --git a/cmake/libunwind/CMakeLists.txt b/cmake/libunwind/Download.cmake
similarity index 87%
rename from cmake/libunwind/CMakeLists.txt
rename to cmake/libunwind/Download.cmake
index 5342154..ad16035 100644
--- a/cmake/libunwind/CMakeLists.txt
+++ b/cmake/libunwind/Download.cmake
@@ -12,10 +12,27 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Custom build for libunwind. We need this to remap libunwind symbols.
+# Downloads and unpacks libunwind at configure time
 
-set(_unwind_src ${PROJECT_BINARY_DIR}/Dependencies/Source/libunwind)
+set(workdir "${CMAKE_BINARY_DIR}/libunwind-download")
 
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(_unwind_src "${CMAKE_BINARY_DIR}/libunwind-src")
 foreach(wrapped _wrapped "")
   add_library(unwind_ptrace${wrapped} STATIC
     # internal_headers
diff --git a/cmake/libunwind_ptrace.h.in b/cmake/libunwind_ptrace.h.in
deleted file mode 100644
index a7f8af9..0000000
--- a/cmake/libunwind_ptrace.h.in
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2019 Google LLC. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef SANDBOXED_API_CMAKE_LIBUNWIND_PTRACE_H_
-#define SANDBOXED_API_CMAKE_LIBUNWIND_PTRACE_H_
-
-// Forward include to location set up by SuperBuild
-#include "@libunwind_INCLUDE_DIR@/libunwind-ptrace.h"
-
-#endif  // SANDBOXED_API_CMAKE_LIBUNWIND_PTRACE_H_
diff --git a/cmake/protobuf/CMakeLists.txt.in b/cmake/protobuf/CMakeLists.txt.in
new file mode 100644
index 0000000..8092973
--- /dev/null
+++ b/cmake/protobuf/CMakeLists.txt.in
@@ -0,0 +1,29 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(protobuf-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(protobuf
+  GIT_REPOSITORY    https://github.com/protocolbuffers/protobuf.git
+  GIT_TAG           e08f01ce6a78a6cf2834dfa37281eb366eb0c5c3  # 2019-06-05
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/protobuf-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/protobuf-build"
+  PATCH_COMMAND     "${CMAKE_COMMAND}" -E touch "${CMAKE_BINARY_DIR}/protobuf-src/src/google/protobuf/stubs/io_win32.h"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
diff --git a/cmake/protobuf/Download.cmake b/cmake/protobuf/Download.cmake
new file mode 100644
index 0000000..bd43583
--- /dev/null
+++ b/cmake/protobuf/Download.cmake
@@ -0,0 +1,40 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks Protobuf at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/protobuf-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(protobuf_BUILD_TESTS OFF CACHE BOOL "")
+set(protobuf_BUILD_SHARED_LIBS OFF CACHE BOOL "")
+set(protobuf_WITH_ZLIB OFF CACHE BOOL "")
+
+add_subdirectory("${CMAKE_BINARY_DIR}/protobuf-src/cmake"
+                 "${CMAKE_BINARY_DIR}/protobuf-build" EXCLUDE_FROM_ALL)
diff --git a/sandboxed_api/CMakeLists.txt b/sandboxed_api/CMakeLists.txt
index 98552ea..0b8869a 100644
--- a/sandboxed_api/CMakeLists.txt
+++ b/sandboxed_api/CMakeLists.txt
@@ -59,25 +59,26 @@ add_library(sapi_sapi STATIC
   transaction.h
 )
 add_library(sapi::sapi ALIAS sapi_sapi)
-target_link_libraries(sapi_sapi PRIVATE
-  absl::core_headers
-  absl::flat_hash_map
-  absl::memory
-  absl::str_format
-  absl::strings
-  absl::synchronization
-  sandbox2::bpf_helper
-  sandbox2::client
-  sandbox2::file_base
-  sandbox2::fileops
-  sandbox2::runfiles
-  sandbox2::sandbox2
-  sandbox2::strerror
-  sandbox2::util
-  sapi::base
-  sapi::embed_file
-  sapi::status
-  sapi::vars
+target_link_libraries(sapi_sapi
+  PRIVATE absl::flat_hash_map
+          absl::memory
+          absl::str_format
+          absl::strings
+          absl::synchronization
+          sandbox2::bpf_helper
+          sandbox2::file_base
+          sandbox2::fileops
+          sandbox2::runfiles
+          sandbox2::sandbox2
+          sandbox2::strerror
+          sandbox2::util
+          sapi::embed_file
+          sapi::status
+          sapi::vars
+  PUBLIC absl::core_headers
+         sandbox2::client
+         sapi::base
+         sapi::status
 )
 
 # sandboxed_api:call
diff --git a/sandboxed_api/examples/stringop/lib/CMakeLists.txt b/sandboxed_api/examples/stringop/lib/CMakeLists.txt
index 4120788..813105f 100644
--- a/sandboxed_api/examples/stringop/lib/CMakeLists.txt
+++ b/sandboxed_api/examples/stringop/lib/CMakeLists.txt
@@ -23,9 +23,9 @@ add_library(sapi_stringop_params_proto OBJECT
   ${_sapi_stringop_params_pb_h}
 )
 add_library(sapi::stringop_params_proto ALIAS sapi_stringop_params_proto)
-target_link_libraries(sapi_stringop_params_proto PRIVATE
-  protobuf::libprotobuf
-  sapi::base
+target_link_libraries(sapi_stringop_params_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )
 
 # sandboxed_api/examples/stringop/lib:stringop
@@ -33,10 +33,11 @@ add_library(sapi_stringop STATIC
   stringop.cc
 )
 add_library(sapi::stringop ALIAS sapi_stringop)
-target_link_libraries(sapi_stringop PRIVATE
-  $<TARGET_OBJECTS:sapi_stringop_params_proto>
-  sapi::base
-  sapi::lenval_core
+target_link_libraries(sapi_stringop
+  PRIVATE $<TARGET_OBJECTS:sapi_stringop_params_proto>
+          sapi::base
+          sapi::lenval_core
+  PUBLIC protobuf::libprotobuf
 )
 
 # sandboxed_api/examples/stringop/lib:stringop-sapi
diff --git a/sandboxed_api/examples/sum/lib/CMakeLists.txt b/sandboxed_api/examples/sum/lib/CMakeLists.txt
index a064f9c..b02c152 100644
--- a/sandboxed_api/examples/sum/lib/CMakeLists.txt
+++ b/sandboxed_api/examples/sum/lib/CMakeLists.txt
@@ -23,9 +23,9 @@ add_library(sapi_sum_params_proto OBJECT
   ${_sapi_sum_params_pb_h}
 )
 add_library(sapi::sum_params_proto ALIAS sapi_sum_params_proto)
-target_link_libraries(sapi_sum_params_proto PRIVATE
-  protobuf::libprotobuf
-  sapi::base
+target_link_libraries(sapi_sum_params_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )
 
 # sandboxed_api/examples/sum/lib:sum
@@ -34,10 +34,11 @@ add_library(sapi_sum STATIC
   sum_cpp.cc
 )
 add_library(sapi::sum ALIAS sapi_sum)
-target_link_libraries(sapi_sum PRIVATE
-  $<TARGET_OBJECTS:sapi_sum_params_proto>
-  glog::glog
-  sapi::base
+target_link_libraries(sapi_sum
+  PRIVATE $<TARGET_OBJECTS:sapi_sum_params_proto>
+          glog::glog
+          sapi::base
+  PUBLIC protobuf::libprotobuf
 )
 
 # sandboxed_api/examples/sum/lib:sum-sapi
diff --git a/sandboxed_api/sandbox2/CMakeLists.txt b/sandboxed_api/sandbox2/CMakeLists.txt
index f05191c..d0ddfb4 100644
--- a/sandboxed_api/sandbox2/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/CMakeLists.txt
@@ -86,9 +86,9 @@ add_library(sandbox2_logserver_proto STATIC
   ${_sandbox2_logserver_pb_h}
 )
 add_library(sandbox2::logserver_proto ALIAS sandbox2_logserver_proto)
-target_link_libraries(sandbox2_logserver_proto PRIVATE
-  protobuf::libprotobuf
-  sapi::base
+target_link_libraries(sandbox2_logserver_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )
 
 # sandboxed_api/sandbox2:logserver
@@ -102,7 +102,7 @@ target_link_libraries(sandbox2_logserver
           sandbox2::comms
           sandbox2::logserver_proto
           sapi::base
-  PUBLIC  glog::glog
+  PUBLIC glog::glog
 )
 
 # sandboxed_api/sandbox2:logsink
@@ -117,7 +117,7 @@ target_link_libraries(sandbox2_logsink
           sandbox2::comms
           sandbox2::logserver_proto
           sapi::base
-  PUBLIC  glog::glog
+  PUBLIC glog::glog
 )
 
 # sandboxed_api/sandbox2:network_proxy_server
@@ -221,6 +221,7 @@ add_executable(sandbox2::forkserver_bin ALIAS forkserver_bin)
 target_link_libraries(forkserver_bin PRIVATE
   absl::core_headers
   absl::strings
+  glog::glog
   sandbox2::client
   sandbox2::comms
   sandbox2::forkserver
@@ -327,9 +328,9 @@ target_link_libraries(sandbox2_sandbox2
           sandbox2::util
           sandbox2::violation_proto
           sapi::base
-          sapi::status
           sapi::statusor
   PUBLIC  sapi::flags
+          sapi::status
           sandbox2::logsink
 )
 
@@ -345,7 +346,6 @@ target_link_libraries(sandbox2_client
   PRIVATE absl::core_headers
           absl::memory
           absl::strings
-          sandbox2::comms
           sandbox2::file_helpers
           sandbox2::fileops
           sandbox2::logsink
@@ -353,7 +353,8 @@ target_link_libraries(sandbox2_client
           sandbox2::strerror
           sapi::base
           sapi::raw_logging
-  PUBLIC  glog::glog
+  PUBLIC glog::glog
+         sandbox2::comms
 )
 
 # sandboxed_api/sandbox2:forkserver
@@ -438,7 +439,7 @@ target_link_libraries(sandbox2_forkingclient
   PRIVATE absl::memory
           sandbox2::forkserver
           sapi::base
-  PUBLIC  sandbox2::client
+  PUBLIC sandbox2::client
 )
 
 # sandboxed_api/sandbox2:util
@@ -447,17 +448,17 @@ add_library(sandbox2_util STATIC
   util.h
 )
 add_library(sandbox2::util ALIAS sandbox2_util)
-target_link_libraries(sandbox2_util PRIVATE
-  absl::core_headers
-  absl::str_format
-  absl::strings
-  sandbox2::file_base
-  sandbox2::fileops
-  sandbox2::strerror
-  sapi::base
-  sapi::raw_logging
-  sapi::status
-  sapi::statusor
+target_link_libraries(sandbox2_util
+  PRIVATE absl::core_headers
+          absl::str_format
+          absl::strings
+          sandbox2::file_base
+          sandbox2::fileops
+          sandbox2::strerror
+          sapi::base
+          sapi::raw_logging
+          sapi::statusor
+  PUBLIC sapi::status
 )
 target_compile_options(sandbox2_util PRIVATE
   # The default is 16384, however we need to do a clone with a
@@ -518,20 +519,20 @@ add_library(sandbox2_comms STATIC
   comms.h
 )
 add_library(sandbox2::comms ALIAS sandbox2_comms)
-target_link_libraries(sandbox2_comms PRIVATE
-  absl::core_headers
-  absl::memory
-  absl::str_format
-  absl::strings
-  absl::synchronization
-  protobuf::libprotobuf
-  sandbox2::strerror
-  sandbox2::util
-  sapi::base
-  sapi::raw_logging
-  sapi::status
-  sapi::status_proto
-  sapi::statusor
+target_link_libraries(sandbox2_comms
+  PRIVATE absl::memory
+          absl::str_format
+          absl::strings
+          protobuf::libprotobuf
+          sandbox2::strerror
+          sandbox2::util
+          sapi::base
+          sapi::raw_logging
+          sapi::status_proto
+          sapi::statusor
+  PUBLIC absl::core_headers
+         absl::synchronization
+         sapi::status
 )
 
 # sandboxed_api/sandbox2:violation_proto
diff --git a/sandboxed_api/sandbox2/examples/network/CMakeLists.txt b/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
index bb03c56..e35be66 100644
--- a/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
@@ -28,6 +28,7 @@ target_link_libraries(sandbox2_network_sandbox PRIVATE
   sandbox2::runfiles
   sandbox2::sandbox2
   sapi::base
+  sapi::flags
 )
 
 # sandboxed_api/sandbox2/examples/network_bin:network_bin
@@ -37,6 +38,8 @@ add_executable(network_bin
 add_executable(sandbox2::network_bin ALIAS network_bin)
 target_link_libraries(network_bin PRIVATE
   absl::str_format
+  glog::glog
+  gflags::gflags
   sandbox2::client
   sandbox2::comms
   sandbox2::fileops
diff --git a/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt b/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
index efae2dd..229a5a0 100644
--- a/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
@@ -28,6 +28,7 @@ target_link_libraries(sandbox2_networkproxy_sandbox PRIVATE
   sandbox2::runfiles
   sandbox2::sandbox2
   sapi::base
+  sapi::flags
 )
 
 # sandboxed_api/sandbox2/examples/networkproxy_bin:networkproxy_bin
@@ -37,6 +38,8 @@ add_executable(networkproxy_bin
 add_executable(sandbox2::networkproxy_bin ALIAS networkproxy_bin)
 target_link_libraries(networkproxy_bin PRIVATE
   absl::str_format
+  glog::glog
+  gflags::gflags
   sandbox2::client
   sandbox2::comms
   sandbox2::fileops
diff --git a/sandboxed_api/util/CMakeLists.txt b/sandboxed_api/util/CMakeLists.txt
index caa9b65..a50a488 100644
--- a/sandboxed_api/util/CMakeLists.txt
+++ b/sandboxed_api/util/CMakeLists.txt
@@ -21,8 +21,9 @@ add_library(sapi_util_status_proto STATIC
   ${_sapi_util_status_pb_h}
 )
 add_library(sapi::status_proto ALIAS sapi_util_status_proto)
-target_link_libraries(sapi_util_status_proto PRIVATE
-  protobuf::libprotobuf
+target_link_libraries(sapi_util_status_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )
 
 # sandboxed_api/util:status
@@ -35,12 +36,12 @@ add_library(sapi_util_status STATIC
   status_macros.h
 )
 add_library(sapi::status ALIAS sapi_util_status)
-target_link_libraries(sapi_util_status PRIVATE
-  absl::core_headers
-  absl::strings
-  absl::type_traits
-  sapi::base
-  sapi::status_proto
+target_link_libraries(sapi_util_status
+  PRIVATE absl::core_headers
+          absl::strings
+          absl::type_traits
+          sapi::base
+  PUBLIC sapi::status_proto
 )
 
 # sandboxed_api/util:statusor
@@ -62,7 +63,7 @@ add_library(sapi_util_flags STATIC
 )
 add_library(sapi::flags ALIAS sapi_util_flags)
 target_link_libraries(sapi_util_flags PUBLIC
-  gflags
+  gflags::gflags
 )
 
 # sandboxed_api/util:raw_logging