Enable CMake projects to consume Sandboxed API via add_subdirectory()

This change moves away from a classical superbuild which downloads and builds at build time. Instead, we now follow a "Fetch Content" workflow (available as FetchContent in CMake 3.11+) and download dependencies at config time. Rationale: Superbuild projects have the disadvantage that projects cannot directly access their individual declared targets. This is not a problem with regular libraries, as those are usually/supposed to be installed. With Sandboxed API, this is not desirable, as it has dependencies like Abseil and glog, which are almost always consumed by including their source tree using add_subdirectory(). Fixes #10 and makes external embedding easier. PiperOrigin-RevId: 260129870 Change-Id: I70f295f29a6e4fc8c330512c94b01ef10c017166
2024-03-22 13:11:30 +08:00 · 2019-07-26 05:50:45 -07:00 · 2019-07-26 05:50:45 -07:00 · 3c51348aaf
commit 3c51348aaf
parent db0ebe3650
25 changed files with 580 additions and 267 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -14,41 +14,31 @@

 cmake_minimum_required(VERSION 3.10)

-option(SAPI_USE_SUPERBUILD "Whether or not a superbuild should be invoked" ON)
-if(SAPI_USE_SUPERBUILD)
-  project(superbuild NONE)
-  include(cmake/SapiSuperBuild.cmake)
-  return()
-endif()
-project(sandboxed_api C CXX ASM)
+project(SandboxedAPI C CXX ASM)

 # SAPI-wide setting for the language level
 set(SAPI_CXX_STANDARD 11)

+set(SAPI_BINARY_DIR "${PROJECT_BINARY_DIR}" CACHE INTERNAL "" FORCE)
+set(SAPI_SOURCE_DIR "${PROJECT_SOURCE_DIR}" CACHE INTERNAL "" FORCE)
+
 # Sapi CMake modules, order matters
-list(APPEND CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake")
+list(APPEND CMAKE_MODULE_PATH "${SAPI_SOURCE_DIR}/cmake")
 include(SapiOptions)
 include(SapiDeps)
 include(SapiUtil)
 include(SapiBuildDefs)

-include(GoogleTest)
-
 # Make Bazel-style includes work
 configure_file(cmake/libcap_capability.h.in
               libcap/include/sys/capability.h
               @ONLY)
-set(libunwind_INCLUDE_DIR
-    ${PROJECT_BINARY_DIR}/Dependencies/Source/libunwind/include)
-configure_file(cmake/libunwind_ptrace.h.in
-               libunwind-ptrace.h
-               @ONLY)

 # Library with basic project settings. The empty file is there to be able to
 # define header-only libraries without cumbersome target_sources() hacks.
-file(TOUCH ${PROJECT_BINARY_DIR}/sapi_base_force_cxx_linkage.cc)
+file(TOUCH ${SAPI_BINARY_DIR}/sapi_base_force_cxx_linkage.cc)
 add_library(sapi_base STATIC
-  ${PROJECT_BINARY_DIR}/sapi_base_force_cxx_linkage.cc
+  "${SAPI_BINARY_DIR}/sapi_base_force_cxx_linkage.cc"
 )
 add_library(sapi::base ALIAS sapi_base)
 set_target_properties(sapi_base PROPERTIES
@ -59,11 +49,9 @@ set_target_properties(sapi_base PROPERTIES
  POSITION_INDEPENDENT_CODE TRUE
 )
 target_include_directories(sapi_base INTERFACE
-  ${PROJECT_BINARY_DIR}
-  ${PROJECT_SOURCE_DIR}
-  ${Protobuf_INCLUDE_DIR}
-  # Need to reach into Abseil internal headers from a few targets.
-  ${PROJECT_BINARY_DIR}/Dependencies/Source/absl
+  "${SAPI_BINARY_DIR}"
+  "${SAPI_SOURCE_DIR}"
+  "${Protobuf_INCLUDE_DIR}"
 )
 if(UNIX)
  target_compile_options(sapi_base INTERFACE
@ -80,9 +68,11 @@ target_link_libraries(sapi_test_main INTERFACE
  sapi::base
 )

-# Setup tests to work like with Bazel
-create_directory_symlink(${PROJECT_BINARY_DIR} com_google_sandboxed_api)
-enable_testing()
+if(SAPI_ENABLE_TESTS)
+  include(GoogleTest)
+  # Setup tests to work like with Bazel
+  create_directory_symlink("${SAPI_BINARY_DIR}" com_google_sandboxed_api)
+  enable_testing()
+endif()

-add_subdirectory(cmake/libunwind)
 add_subdirectory(sandboxed_api)
--- a/cmake/SapiBuildDefs.cmake
+++ b/cmake/SapiBuildDefs.cmake
@ -20,33 +20,34 @@
 #   target the target binary is embedded instead.
 macro(sapi_cc_embed_data)
  cmake_parse_arguments(_sapi_embed "" "NAME;NAMESPACE" "SOURCES" ${ARGN})
-  foreach(src ${_sapi_embed_SOURCES})
-    if(TARGET ${src})
-      list(APPEND _sapi_embed_in ${CMAKE_CURRENT_BINARY_DIR}/${src})
+  foreach(src IN LISTS _sapi_embed_SOURCES)
+    if(TARGET "${src}")
+      list(APPEND _sapi_embed_in "${CMAKE_CURRENT_BINARY_DIR}/${src}")
    else()
-      list(APPEND _sapi_embed_in ${src})
+      list(APPEND _sapi_embed_in "${src}")
    endif()
  endforeach()
  file(RELATIVE_PATH _sapi_embed_pkg
-                     ${PROJECT_BINARY_DIR}
-                     ${CMAKE_CURRENT_BINARY_DIR})
+                     "${PROJECT_BINARY_DIR}"
+                     "${CMAKE_CURRENT_BINARY_DIR}")
  add_custom_command(
-    OUTPUT ${_sapi_embed_NAME}.h ${_sapi_embed_NAME}.cc
-    WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}
-    COMMAND filewrapper ${_sapi_embed_pkg}
-                        ${_sapi_embed_NAME}
+    OUTPUT "${_sapi_embed_NAME}.h"
+           "${_sapi_embed_NAME}.cc"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
+    COMMAND filewrapper "${_sapi_embed_pkg}"
+                        "${_sapi_embed_NAME}"
                        "${_sapi_embed_NAMESPACE}"
-                        ${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.h
-                        ${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.cc
+                        "${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.h"
+                        "${CMAKE_CURRENT_BINARY_DIR}/${_sapi_embed_NAME}.cc"
                        ${_sapi_embed_in}
    DEPENDS ${_sapi_embed_SOURCES}
    VERBATIM
  )
-  add_library(${_sapi_embed_NAME} STATIC
-    ${_sapi_embed_NAME}.h
-    ${_sapi_embed_NAME}.cc
+  add_library("${_sapi_embed_NAME}" STATIC
+    "${_sapi_embed_NAME}.h"
+    "${_sapi_embed_NAME}.cc"
  )
-  target_link_libraries(${_sapi_embed_NAME} PRIVATE
+  target_link_libraries("${_sapi_embed_NAME}" PRIVATE
    sapi::base
    absl::core_headers
  )
@ -135,7 +136,7 @@ function(add_sapi_library)
  add_custom_command(
    OUTPUT "${_sapi_gen_header}"
    COMMAND "${Python3_EXECUTABLE}" -B
-            "${PROJECT_SOURCE_DIR}/sandboxed_api/tools/generator2/sapi_generator.py"
+            "${SAPI_SOURCE_DIR}/sandboxed_api/tools/generator2/sapi_generator.py"
            "--sapi_name=${_sapi_LIBRARY_NAME}"
            "--sapi_out=${_sapi_gen_header}"
            "--sapi_embed_dir=${_sapi_embed_dir}"
@ -155,7 +156,7 @@ function(add_sapi_library)
    list(APPEND _sapi_SOURCES "${_sapi_force_cxx_linkage}")
  endif()
  add_library("${_sapi_NAME}" STATIC
-    ${_sapi_gen_header}
+    "${_sapi_gen_header}"
    ${_sapi_SOURCES}
  )
  target_link_libraries("${_sapi_NAME}" PRIVATE
--- a/cmake/SapiDeps.cmake
+++ b/cmake/SapiDeps.cmake
@ -12,39 +12,12 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-list(APPEND CMAKE_PREFIX_PATH
-  "${PROJECT_BINARY_DIR}/Dependencies/Build/gflags"
-  "${PROJECT_BINARY_DIR}/Dependencies/Build/glog"
-  "${PROJECT_BINARY_DIR}/Dependencies/Build/protobuf"
-)
-
-# Build Abseil directly, as recommended upstream
-find_path(absl_src_dir
-  absl/base/port.h
-  HINTS ${ABSL_ROOT_DIR}
-  PATHS ${PROJECT_BINARY_DIR}/Dependencies/Source/absl
-)
-set(_sapi_saved_CMAKE_CXX_STANDARD ${CMAKE_CXX_STANDARD})
-set(CMAKE_CXX_STANDARD ${SAPI_CXX_STANDARD})
-add_subdirectory(${absl_src_dir}
-                 ${PROJECT_BINARY_DIR}/Dependencies/Build/absl
-                 EXCLUDE_FROM_ALL)
-if(_sapi_saved_CMAKE_CXX_STANDARD)
-  set(CMAKE_CXX_STANDARD "${_sapi_saved_CMAKE_CXX_STANDARD}")
-endif()
-
-if(SAPI_ENABLE_TESTS)
-  # Build Googletest directly, as recommended upstream
-  find_path(googletest_src_dir
-    googletest/include/gtest/gtest.h
-    HINTS ${GOOGLETEST_ROOT_DIR}
-    PATHS ${PROJECT_BINARY_DIR}/Dependencies/Source/googletest
-  )
-  set(gtest_force_shared_crt ON CACHE BOOL "")
-  add_subdirectory(${googletest_src_dir}
-                   ${PROJECT_BINARY_DIR}/Dependencies/Build/googletest
-                   EXCLUDE_FROM_ALL)
-endif()
+function(check_target target)
+  if(NOT TARGET ${target})
+    message(FATAL_ERROR " SAPI: compiling Sandboxed API requires a ${target}
+                   CMake target in your project")
+  endif()
+endfunction()

 # Prefer to use static libraries
 set(_sapi_saved_CMAKE_FIND_LIBRARY_SUFFIXES ${CMAKE_FIND_LIBRARY_SUFFIXES})
@ -54,14 +27,47 @@ else()
  set(CMAKE_FIND_LIBRARY_SUFFIXES .a ${CMAKE_FIND_LIBRARY_SUFFIXES})
 endif()

-find_package(gflags REQUIRED)
-find_package(glog REQUIRED)
+if(SAPI_ENABLE_TESTS)
+  if(SAPI_USE_GOOGLETEST)
+    include(cmake/googletest/Download.cmake)
+  endif()
+  check_target(gtest)
+  check_target(gtest_main)
+  check_target(gmock)
+endif()
+
+if(SAPI_USE_ABSL)
+  include(cmake/abseil/Download.cmake)
+endif()
+check_target(absl::core_headers)
+
+if(SAPI_USE_LIBUNWIND)
+  include(cmake/libunwind/Download.cmake)
+endif()
+check_target(unwind_ptrace)
+check_target(unwind_ptrace_wrapped)
+
+if(SAPI_USE_GFLAGS)
+  include(cmake/gflags/Download.cmake)
+endif()
+check_target(gflags)
+
+if(SAPI_USE_GLOG)
+  include(cmake/glog/Download.cmake)
+endif()
+check_target(glog::glog)
+
+if(SAPI_USE_PROTOBUF)
+  include(cmake/protobuf/Download.cmake)
+endif()
+check_target(protobuf::libprotobuf)
+find_package(Protobuf REQUIRED)
+
 find_package(Libcap REQUIRED)
 find_package(Libffi REQUIRED)
 if(SAPI_ENABLE_EXAMPLES)
  find_package(ZLIB REQUIRED)
 endif()
-find_package(Protobuf REQUIRED)

 if(CMAKE_VERSION VERSION_LESS "3.12")
  # Work around FindPythonInterp sometimes not preferring Python 3.
--- a/cmake/SapiOptions.cmake
+++ b/cmake/SapiOptions.cmake
@ -12,5 +12,22 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

+# These options determine whether CMake should download the libraries that
+# Sandboxed API depends on at configure time.
+# The CMake script SapiDeps.cmake checks for the presence of certain build
+# targets to determine whether a library can be used. Disabling the options
+# below enables embedding projects to selectively override/replace these
+# dependencies. This is useful for cases where embedding projects already
+# depend on some of these libraries (e.g. Abseil).
+option(SAPI_USE_ABSL "Download Abseil at config time" ON)
+option(SAPI_USE_GOOGLETEST "Download googletest at config time" ON)
+option(SAPI_USE_GFLAGS "Download gflags at config time" ON)
+option(SAPI_USE_GLOG "Download glog at config time" ON)
+option(SAPI_USE_PROTOBUF "Download protobuf at config time" ON)
+option(SAPI_USE_LIBUNWIND "Download libunwind at config time" ON)
+# TODO(cblichmann): These two are not currently implemented
+option(SAPI_USE_LIBCAP "Download libcap at config time" ON)
+option(SAPI_USE_LIBFFI "Download libffi at config time" ON)
+
 option(SAPI_ENABLE_EXAMPLES "Build example code" ON)
 option(SAPI_ENABLE_TESTS "Build unit tests" ON)
--- a/cmake/SapiSuperBuild.cmake
+++ b/cmake/SapiSuperBuild.cmake
@ -1,88 +0,0 @@
-include(ExternalProject)
-
-set_property(DIRECTORY PROPERTY EP_BASE Dependencies)
-
-set(DEPENDENCIES)
-set(EXTRA_CMAKE_ARGS)
-
-ExternalProject_Add(absl
-  GIT_REPOSITORY https://github.com/abseil/abseil-cpp.git
-  GIT_TAG aa468ad75539619b47979911297efbb629c52e44  # 2019-05-07
-  # Just clone into directory
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES absl)
-
-ExternalProject_Add(gflags
-  GIT_REPOSITORY https://github.com/gflags/gflags.git
-  GIT_TAG 28f50e0fed19872e0fd50dd23ce2ee8cd759338e
-  CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-             -DCMAKE_POSITION_INDEPENDENT_CODE=ON
-             -DGFLAGS_IS_SUBPROJECT=TRUE
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES gflags)
-
-ExternalProject_Add(glog
-  DEPENDS gflags
-  GIT_REPOSITORY https://github.com/google/glog.git
-  GIT_TAG 41f4bf9cbc3e8995d628b459f6a239df43c2b84a
-  CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-             -DCMAKE_POSITION_INDEPENDENT_CODE=ON
-             "-DCMAKE_PREFIX_PATH=${PROJECT_BINARY_DIR}/Dependencies/Build/gflags"
-             # Disable symbolizer
-             -DUNWIND_LIBRARY=
-             # getpwuid_r() cannot be linked statically with glibc
-             -DHAVE_PWD_H=
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES glog)
-
-ExternalProject_Add(googletest
-  GIT_REPOSITORY https://github.com/google/googletest.git
-  GIT_TAG 8ffb7e5c88b20a297a2e786c480556467496463b  # 2019-05-30
-  # Just clone into directory
-  CONFIGURE_COMMAND ""
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ""
-)
-list(APPEND DEPENDENCIES googletest)
-
-ExternalProject_Add(libunwind
-  URL https://github.com/libunwind/libunwind/releases/download/v1.2.1/libunwind-1.2.1.tar.gz
-  URL_HASH SHA256=3f3ecb90e28cbe53fba7a4a27ccce7aad188d3210bb1964a923a731a27a75acb
-  # Need to invoke a custom build, so just download and extract
-  CONFIGURE_COMMAND ./configure
-                    --disable-documentation
-                    --disable-minidebuginfo
-                    --disable-shared
-                    --enable-ptrace
-  BUILD_COMMAND ""
-  INSTALL_COMMAND ""
-  BUILD_IN_SOURCE TRUE
-)
-list(APPEND DEPENDENCIES libunwind)
-
-ExternalProject_Add(protobuf
-  GIT_REPOSITORY https://github.com/protocolbuffers/protobuf.git
-  GIT_TAG e08f01ce6a78a6cf2834dfa37281eb366eb0c5c3  # 2019-06-05
-  PREFIX ${CMAKE_CURRENT_BINARY_DIR}/Dependencies/Build/protobuf
-  SOURCE_SUBDIR cmake
-  CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-             -DCMAKE_POSITION_INDEPENDENT_CODE=ON
-             -DCMAKE_INSTALL_PREFIX:PATH=<INSTALL_DIR>
-             -Dprotobuf_BUILD_TESTS=OFF
-             -Dprotobuf_BUILD_SHARED_LIBS=OFF
-             -Dprotobuf_WITH_ZLIB=OFF
-)
-list(APPEND DEPENDENCIES protobuf)
-
-ExternalProject_Add(sandboxed_api
-  DEPENDS ${DEPENDENCIES}
-  SOURCE_DIR ${PROJECT_SOURCE_DIR}
-  CMAKE_ARGS -DSAPI_USE_SUPERBUILD=OFF ${EXTRA_CMAKE_ARGS}
-  INSTALL_COMMAND ""
-  BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR}
-)
--- a/cmake/abseil/CMakeLists.txt.in
+++ b/cmake/abseil/CMakeLists.txt.in
@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(absl-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(absl
+  GIT_REPOSITORY    https://github.com/abseil/abseil-cpp
+  GIT_TAG           c6c3c1b498e4ee939b24be59cae29d59c3863be8  # 2019-07-18
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/absl-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/absl-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
--- a/cmake/abseil/Download.cmake
+++ b/cmake/abseil/Download.cmake
@ -0,0 +1,44 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks Abseil at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/absl-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(_sapi_saved_CMAKE_CXX_STANDARD ${CMAKE_CXX_STANDARD})
+set(CMAKE_CXX_STANDARD ${SAPI_CXX_STANDARD})
+set(ABSL_USE_GOOGLETEST_HEAD OFF CACHE BOOL "" FORCE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/absl-src"
+                 "${CMAKE_BINARY_DIR}/absl-build" EXCLUDE_FROM_ALL)
+
+if(_sapi_saved_CMAKE_CXX_STANDARD)
+  set(CMAKE_CXX_STANDARD "${_sapi_saved_CMAKE_CXX_STANDARD}")
+endif()
--- a/cmake/gflags/CMakeLists.txt.in
+++ b/cmake/gflags/CMakeLists.txt.in
@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(gflags-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(gflags
+  GIT_REPOSITORY    https://github.com/gflags/gflags.git
+  GIT_TAG           28f50e0fed19872e0fd50dd23ce2ee8cd759338e  # 2019-01-25
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/gflags-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/gflags-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
--- a/cmake/gflags/Download.cmake
+++ b/cmake/gflags/Download.cmake
@ -0,0 +1,39 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks gflags at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/gflags-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(GFLAGS_IS_SUBPROJECT TRUE)
+set(GFLAGS_INSTALL_SHARED_LIBS FALSE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/gflags-src"
+                 "${CMAKE_BINARY_DIR}/gflags-build" EXCLUDE_FROM_ALL)
--- a/cmake/glog/CMakeLists.txt.in
+++ b/cmake/glog/CMakeLists.txt.in
@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(glog-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(glog
+  GIT_REPOSITORY    https://github.com/google/glog.git
+  GIT_TAG           ba8a9f6952d04d1403b97df24e6836227751454e  # 2019-05-07
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/glog-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/glog-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
--- a/cmake/glog/Download.cmake
+++ b/cmake/glog/Download.cmake
@ -0,0 +1,46 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks glog at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/glog-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND "${CMAKE_COMMAND}" -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND "${CMAKE_COMMAND}" --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+# Force gflags from subdirectory
+set(WITH_GFLAGS OFF CACHE BOOL "" FORCE)
+set(HAVE_LIB_GFLAGS 1)
+
+set(UNWIND_LIBRARY FALSE)
+set(HAVE_PWD_H FALSE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/glog-src"
+                 "${CMAKE_BINARY_DIR}/glog-build" EXCLUDE_FROM_ALL)
+target_include_directories(glog PUBLIC
+  $<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/gflags-build/include>
+)
--- a/cmake/googletest/CMakeLists.txt.in
+++ b/cmake/googletest/CMakeLists.txt.in
@ -0,0 +1,28 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(googletest-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(googletest
+  GIT_REPOSITORY    https://github.com/google/googletest.git
+  GIT_TAG           2ef13f524b837a68bae27ae1123da0400dff6285  # 2019-07-18
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/googletest-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/googletest-build"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
--- a/cmake/googletest/Download.cmake
+++ b/cmake/googletest/Download.cmake
@ -0,0 +1,38 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks Googletest at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/googletest-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+
+add_subdirectory("${CMAKE_BINARY_DIR}/googletest-src"
+                 "${CMAKE_BINARY_DIR}/googletest-build" EXCLUDE_FROM_ALL)
--- a/cmake/libunwind/CMakeLists.txt.in
+++ b/cmake/libunwind/CMakeLists.txt.in
@ -0,0 +1,32 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(libunwind-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(libunwind
+  URL https://github.com/libunwind/libunwind/releases/download/v1.2.1/libunwind-1.2.1.tar.gz
+  URL_HASH SHA256=3f3ecb90e28cbe53fba7a4a27ccce7aad188d3210bb1964a923a731a27a75acb
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/libunwind-src"
+  CONFIGURE_COMMAND ./configure
+                    --disable-documentation
+                    --disable-minidebuginfo
+                    --disable-shared
+                    --enable-ptrace
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+  BUILD_IN_SOURCE TRUE
+)
--- a/cmake/libunwind/Download.cmake
+++ b/cmake/libunwind/Download.cmake
@ -12,10 +12,27 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.

-# Custom build for libunwind. We need this to remap libunwind symbols.
+# Downloads and unpacks libunwind at configure time

-set(_unwind_src ${PROJECT_BINARY_DIR}/Dependencies/Source/libunwind)
+set(workdir "${CMAKE_BINARY_DIR}/libunwind-download")

+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(_unwind_src "${CMAKE_BINARY_DIR}/libunwind-src")
 foreach(wrapped _wrapped "")
  add_library(unwind_ptrace${wrapped} STATIC
    # internal_headers
--- a/cmake/libunwind_ptrace.h.in
+++ b/cmake/libunwind_ptrace.h.in
@ -1,21 +0,0 @@
-// Copyright 2019 Google LLC. All Rights Reserved.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-#ifndef SANDBOXED_API_CMAKE_LIBUNWIND_PTRACE_H_
-#define SANDBOXED_API_CMAKE_LIBUNWIND_PTRACE_H_
-
-// Forward include to location set up by SuperBuild
-#include "@libunwind_INCLUDE_DIR@/libunwind-ptrace.h"
-
-#endif  // SANDBOXED_API_CMAKE_LIBUNWIND_PTRACE_H_
--- a/cmake/protobuf/CMakeLists.txt.in
+++ b/cmake/protobuf/CMakeLists.txt.in
@ -0,0 +1,29 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+cmake_minimum_required(VERSION 3.10)
+project(protobuf-download NONE)
+
+include(ExternalProject)
+ExternalProject_Add(protobuf
+  GIT_REPOSITORY    https://github.com/protocolbuffers/protobuf.git
+  GIT_TAG           e08f01ce6a78a6cf2834dfa37281eb366eb0c5c3  # 2019-06-05
+  SOURCE_DIR        "${CMAKE_BINARY_DIR}/protobuf-src"
+  BINARY_DIR        "${CMAKE_BINARY_DIR}/protobuf-build"
+  PATCH_COMMAND     "${CMAKE_COMMAND}" -E touch "${CMAKE_BINARY_DIR}/protobuf-src/src/google/protobuf/stubs/io_win32.h"
+  CONFIGURE_COMMAND ""
+  BUILD_COMMAND     ""
+  INSTALL_COMMAND   ""
+  TEST_COMMAND      ""
+)
--- a/cmake/protobuf/Download.cmake
+++ b/cmake/protobuf/Download.cmake
@ -0,0 +1,40 @@
+# Copyright 2019 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Downloads and unpacks Protobuf at configure time
+
+set(workdir "${CMAKE_BINARY_DIR}/protobuf-download")
+
+configure_file("${CMAKE_CURRENT_LIST_DIR}/CMakeLists.txt.in"
+               "${workdir}/CMakeLists.txt")
+execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "CMake step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+execute_process(COMMAND ${CMAKE_COMMAND} --build .
+                RESULT_VARIABLE error
+                WORKING_DIRECTORY "${workdir}")
+if(error)
+  message(FATAL_ERROR "Build step for ${PROJECT_NAME} failed: ${error}")
+endif()
+
+set(protobuf_BUILD_TESTS OFF CACHE BOOL "")
+set(protobuf_BUILD_SHARED_LIBS OFF CACHE BOOL "")
+set(protobuf_WITH_ZLIB OFF CACHE BOOL "")
+
+add_subdirectory("${CMAKE_BINARY_DIR}/protobuf-src/cmake"
+                 "${CMAKE_BINARY_DIR}/protobuf-build" EXCLUDE_FROM_ALL)
--- a/sandboxed_api/CMakeLists.txt
+++ b/sandboxed_api/CMakeLists.txt
@ -59,25 +59,26 @@ add_library(sapi_sapi STATIC
  transaction.h
 )
 add_library(sapi::sapi ALIAS sapi_sapi)
-target_link_libraries(sapi_sapi PRIVATE
-  absl::core_headers
-  absl::flat_hash_map
-  absl::memory
-  absl::str_format
-  absl::strings
-  absl::synchronization
-  sandbox2::bpf_helper
-  sandbox2::client
-  sandbox2::file_base
-  sandbox2::fileops
-  sandbox2::runfiles
-  sandbox2::sandbox2
-  sandbox2::strerror
-  sandbox2::util
-  sapi::base
-  sapi::embed_file
-  sapi::status
-  sapi::vars
+target_link_libraries(sapi_sapi
+  PRIVATE absl::flat_hash_map
+          absl::memory
+          absl::str_format
+          absl::strings
+          absl::synchronization
+          sandbox2::bpf_helper
+          sandbox2::file_base
+          sandbox2::fileops
+          sandbox2::runfiles
+          sandbox2::sandbox2
+          sandbox2::strerror
+          sandbox2::util
+          sapi::embed_file
+          sapi::status
+          sapi::vars
+  PUBLIC absl::core_headers
+         sandbox2::client
+         sapi::base
+         sapi::status
 )

 # sandboxed_api:call
--- a/sandboxed_api/examples/stringop/lib/CMakeLists.txt
+++ b/sandboxed_api/examples/stringop/lib/CMakeLists.txt
@ -23,9 +23,9 @@ add_library(sapi_stringop_params_proto OBJECT
  ${_sapi_stringop_params_pb_h}
 )
 add_library(sapi::stringop_params_proto ALIAS sapi_stringop_params_proto)
-target_link_libraries(sapi_stringop_params_proto PRIVATE
-  protobuf::libprotobuf
-  sapi::base
+target_link_libraries(sapi_stringop_params_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )

 # sandboxed_api/examples/stringop/lib:stringop
@ -33,10 +33,11 @@ add_library(sapi_stringop STATIC
  stringop.cc
 )
 add_library(sapi::stringop ALIAS sapi_stringop)
-target_link_libraries(sapi_stringop PRIVATE
-  $<TARGET_OBJECTS:sapi_stringop_params_proto>
-  sapi::base
-  sapi::lenval_core
+target_link_libraries(sapi_stringop
+  PRIVATE $<TARGET_OBJECTS:sapi_stringop_params_proto>
+          sapi::base
+          sapi::lenval_core
+  PUBLIC protobuf::libprotobuf
 )

 # sandboxed_api/examples/stringop/lib:stringop-sapi
--- a/sandboxed_api/examples/sum/lib/CMakeLists.txt
+++ b/sandboxed_api/examples/sum/lib/CMakeLists.txt
@ -23,9 +23,9 @@ add_library(sapi_sum_params_proto OBJECT
  ${_sapi_sum_params_pb_h}
 )
 add_library(sapi::sum_params_proto ALIAS sapi_sum_params_proto)
-target_link_libraries(sapi_sum_params_proto PRIVATE
-  protobuf::libprotobuf
-  sapi::base
+target_link_libraries(sapi_sum_params_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )

 # sandboxed_api/examples/sum/lib:sum
@ -34,10 +34,11 @@ add_library(sapi_sum STATIC
  sum_cpp.cc
 )
 add_library(sapi::sum ALIAS sapi_sum)
-target_link_libraries(sapi_sum PRIVATE
-  $<TARGET_OBJECTS:sapi_sum_params_proto>
-  glog::glog
-  sapi::base
+target_link_libraries(sapi_sum
+  PRIVATE $<TARGET_OBJECTS:sapi_sum_params_proto>
+          glog::glog
+          sapi::base
+  PUBLIC protobuf::libprotobuf
 )

 # sandboxed_api/examples/sum/lib:sum-sapi
--- a/sandboxed_api/sandbox2/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/CMakeLists.txt
@ -86,9 +86,9 @@ add_library(sandbox2_logserver_proto STATIC
  ${_sandbox2_logserver_pb_h}
 )
 add_library(sandbox2::logserver_proto ALIAS sandbox2_logserver_proto)
-target_link_libraries(sandbox2_logserver_proto PRIVATE
-  protobuf::libprotobuf
-  sapi::base
+target_link_libraries(sandbox2_logserver_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )

 # sandboxed_api/sandbox2:logserver
@ -102,7 +102,7 @@ target_link_libraries(sandbox2_logserver
          sandbox2::comms
          sandbox2::logserver_proto
          sapi::base
-  PUBLIC  glog::glog
+  PUBLIC glog::glog
 )

 # sandboxed_api/sandbox2:logsink
@ -117,7 +117,7 @@ target_link_libraries(sandbox2_logsink
          sandbox2::comms
          sandbox2::logserver_proto
          sapi::base
-  PUBLIC  glog::glog
+  PUBLIC glog::glog
 )

 # sandboxed_api/sandbox2:network_proxy_server
@ -221,6 +221,7 @@ add_executable(sandbox2::forkserver_bin ALIAS forkserver_bin)
 target_link_libraries(forkserver_bin PRIVATE
  absl::core_headers
  absl::strings
+  glog::glog
  sandbox2::client
  sandbox2::comms
  sandbox2::forkserver
@ -327,9 +328,9 @@ target_link_libraries(sandbox2_sandbox2
          sandbox2::util
          sandbox2::violation_proto
          sapi::base
-          sapi::status
          sapi::statusor
  PUBLIC  sapi::flags
+          sapi::status
          sandbox2::logsink
 )

@ -345,7 +346,6 @@ target_link_libraries(sandbox2_client
  PRIVATE absl::core_headers
          absl::memory
          absl::strings
-          sandbox2::comms
          sandbox2::file_helpers
          sandbox2::fileops
          sandbox2::logsink
@ -353,7 +353,8 @@ target_link_libraries(sandbox2_client
          sandbox2::strerror
          sapi::base
          sapi::raw_logging
-  PUBLIC  glog::glog
+  PUBLIC glog::glog
+         sandbox2::comms
 )

 # sandboxed_api/sandbox2:forkserver
@ -438,7 +439,7 @@ target_link_libraries(sandbox2_forkingclient
  PRIVATE absl::memory
          sandbox2::forkserver
          sapi::base
-  PUBLIC  sandbox2::client
+  PUBLIC sandbox2::client
 )

 # sandboxed_api/sandbox2:util
@ -447,17 +448,17 @@ add_library(sandbox2_util STATIC
  util.h
 )
 add_library(sandbox2::util ALIAS sandbox2_util)
-target_link_libraries(sandbox2_util PRIVATE
-  absl::core_headers
-  absl::str_format
-  absl::strings
-  sandbox2::file_base
-  sandbox2::fileops
-  sandbox2::strerror
-  sapi::base
-  sapi::raw_logging
-  sapi::status
-  sapi::statusor
+target_link_libraries(sandbox2_util
+  PRIVATE absl::core_headers
+          absl::str_format
+          absl::strings
+          sandbox2::file_base
+          sandbox2::fileops
+          sandbox2::strerror
+          sapi::base
+          sapi::raw_logging
+          sapi::statusor
+  PUBLIC sapi::status
 )
 target_compile_options(sandbox2_util PRIVATE
  # The default is 16384, however we need to do a clone with a
@ -518,20 +519,20 @@ add_library(sandbox2_comms STATIC
  comms.h
 )
 add_library(sandbox2::comms ALIAS sandbox2_comms)
-target_link_libraries(sandbox2_comms PRIVATE
-  absl::core_headers
-  absl::memory
-  absl::str_format
-  absl::strings
-  absl::synchronization
-  protobuf::libprotobuf
-  sandbox2::strerror
-  sandbox2::util
-  sapi::base
-  sapi::raw_logging
-  sapi::status
-  sapi::status_proto
-  sapi::statusor
+target_link_libraries(sandbox2_comms
+  PRIVATE absl::memory
+          absl::str_format
+          absl::strings
+          protobuf::libprotobuf
+          sandbox2::strerror
+          sandbox2::util
+          sapi::base
+          sapi::raw_logging
+          sapi::status_proto
+          sapi::statusor
+  PUBLIC absl::core_headers
+         absl::synchronization
+         sapi::status
 )

 # sandboxed_api/sandbox2:violation_proto
--- a/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/network/CMakeLists.txt
@ -28,6 +28,7 @@ target_link_libraries(sandbox2_network_sandbox PRIVATE
  sandbox2::runfiles
  sandbox2::sandbox2
  sapi::base
+  sapi::flags
 )

 # sandboxed_api/sandbox2/examples/network_bin:network_bin
@ -37,6 +38,8 @@ add_executable(network_bin
 add_executable(sandbox2::network_bin ALIAS network_bin)
 target_link_libraries(network_bin PRIVATE
  absl::str_format
+  glog::glog
+  gflags::gflags
  sandbox2::client
  sandbox2::comms
  sandbox2::fileops
--- a/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
+++ b/sandboxed_api/sandbox2/examples/network_proxy/CMakeLists.txt
@ -28,6 +28,7 @@ target_link_libraries(sandbox2_networkproxy_sandbox PRIVATE
  sandbox2::runfiles
  sandbox2::sandbox2
  sapi::base
+  sapi::flags
 )

 # sandboxed_api/sandbox2/examples/networkproxy_bin:networkproxy_bin
@ -37,6 +38,8 @@ add_executable(networkproxy_bin
 add_executable(sandbox2::networkproxy_bin ALIAS networkproxy_bin)
 target_link_libraries(networkproxy_bin PRIVATE
  absl::str_format
+  glog::glog
+  gflags::gflags
  sandbox2::client
  sandbox2::comms
  sandbox2::fileops
--- a/sandboxed_api/util/CMakeLists.txt
+++ b/sandboxed_api/util/CMakeLists.txt
@ -21,8 +21,9 @@ add_library(sapi_util_status_proto STATIC
  ${_sapi_util_status_pb_h}
 )
 add_library(sapi::status_proto ALIAS sapi_util_status_proto)
-target_link_libraries(sapi_util_status_proto PRIVATE
-  protobuf::libprotobuf
+target_link_libraries(sapi_util_status_proto
+  PRIVATE sapi::base
+  PUBLIC protobuf::libprotobuf
 )

 # sandboxed_api/util:status
@ -35,12 +36,12 @@ add_library(sapi_util_status STATIC
  status_macros.h
 )
 add_library(sapi::status ALIAS sapi_util_status)
-target_link_libraries(sapi_util_status PRIVATE
-  absl::core_headers
-  absl::strings
-  absl::type_traits
-  sapi::base
-  sapi::status_proto
+target_link_libraries(sapi_util_status
+  PRIVATE absl::core_headers
+          absl::strings
+          absl::type_traits
+          sapi::base
+  PUBLIC sapi::status_proto
 )

 # sandboxed_api/util:statusor
@ -62,7 +63,7 @@ add_library(sapi_util_flags STATIC
 )
 add_library(sapi::flags ALIAS sapi_util_flags)
 target_link_libraries(sapi_util_flags PUBLIC
-  gflags
+  gflags::gflags
 )

 # sandboxed_api/util:raw_logging