[MESOS-3395] In CMake build system, download third party dependencies from a "trusted channel" instead of from Mesos GitHub mirror

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.25.0
• Component/s: cmake
• Labels: build cmake mesosphere
• Target Version/s: 0.25.0
• Epic Link: cmake
• Assignee: Alex Clemmer
• Reporter: Alex Clemmer
• Shepherd: Joris Van Remoortere
• Created: 08/Sep/15 22:40
• Updated: 29/Apr/19 09:26
• Resolved: 26/Nov/18 12:20

Description

Right now in the `CMakeLists.txt` in `3rdparty/libprocess/3rdparty`, when we choose not to use the rebundled third-party dependencies, we download them from GitHub.

The problem is, we download them from the GitHub Mesos mirror, so if we were to suddenly remove one (or change the version of one, or really any number of other things), CMake would break for people who aren't using the rebundled version.

We should point these downloads at a "trusted channel" like the 3rdparty GitHub account (which we, the Mesos community, control).