hopefully works

component/depot_tools/buildout.cfg

 [buildout]
+extends =
+  ../git/buildout.cfg
+
 parts =
   depot_tools
 

component/headless-chromium/buildout.cfg

 [buildout]
 extends =
-  ../bash/buildout.cfg
+# Build dependencies: note that bash, bzip2, getconf, grep, tar, and xz are already in /bin and /usr/bin
+# TODO: I think findutils is only here to expose xargs, which is already in /usr/bin, so see if we can get away with not requiring it
   ../coreutils/buildout.cfg
+  ../curl/buildout.cfg
   ../depot_tools/buildout.cfg
   ../git/buildout.cfg
   ../gperf/buildout.cfg
   ../pkgconfig/buildout.cfg
   ../python-2.7/buildout.cfg
   ../python3/buildout.cfg
+# Runtime dependencies:
+# TODO: add fonts here once the build works
+  ../fonts/buildout.cfg
+  ../fontconfig/buildout.cfg
   ../nspr/buildout.cfg
   ../nss/buildout.cfg
 
 parts =
-  chromium
+  chromium-wrapper
+
+# TODO: it may be more appropriate to manage our own copy of depot_tools, because I think some of the "gclient sync" commands may modify depot_tools, which could be problematic if other components or software releases depend on a shared copy, and at any rate it causes some build errors: when updating depot_tools, git complains because HEAD has been moved. Is there a way to guarantee a private copy? (This may be a moot point, since I don't think it's used by anything else, anyway, and trying again fixes the git issue.)
 
 # There's nothing special about version 91.0.4472.132. It just happened to be
 # the current Chromium stable version at the time of writing.
@@ -20,7 +28,6 @@ parts =
 [chromium-source]
 recipe = plone.recipe.command
 path = ${buildout:parts-directory}/${:_buildout_section_name_}
-url = https://chromium.googlesource.com/chromium/src.git
 version = 91.0.4472.132
 command =
   PATH=$PATH:${git:location}/bin
@@ -30,63 +37,100 @@ command =
   git clone \
     --branch ${:version} \
     --depth 1 \
-    ${:url}
+    https://chromium.googlesource.com/chromium/src.git
 
-# Syncing the build dependencies may take a while.
-[sync-dependencies]
-recipe = plone.recipe.command
-path = ${chromium-source:path}
+[chromium]
+recipe = slapos.recipe.cmmi
+path = ${chromium-source:path}/src
+location = ${buildout:parts-directory}/${:_buildout_section_name_}
+
+# Configuration file for GN, the tool to build the actual compilation configuration file.
 default-gclient-config =
   solutions = [
     {
       "name": "src",
-      "url": "${chromium-source:url}",
+      "url": "https://chromium.googlesource.com/chromium/src.git",
       "managed": False,
       "custom_deps": {},
       "custom_vars": {},
     },
   ]
-command =
-  cd ${chromium-source:path}
-  echo ${:default-gclient-config} > .gclient
-  gclient sync --revision ${chromium-source:version}
-  gclient runhooks
-# TODO: is this part necessary?
-environment =
-  PATH=$PATH:${depot_tools:location}
-
-[chromium]
-<part-dependencies> = sync-dependencies
-recipe = slapos.recipe.cmmi
-path = ${chromium-source:path}/src
-location = ${buildout:parts-directory}/${:_buildout_section_name_}
 
 # Libraries needed at runtime. When using the compiled headless shell, you should specify LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${libraries}.
 libraries = ${nspr:location}/lib:${nss:location}/lib
 
 # Create a headless build configuration.
 configure-command =
-# TODO: remove chromium-source/src/build/android to stop strip from complaining that it can't recognize the format
-#       (we don't need the Android/arm libraries when compiling for Linux)
-# TODO: Check if this first part is really necessary...
-#  if [ ! -e ${chromium-source:path}/src/buildtools/linux64/gn ]; then
-#    ln -s ${depot_tools:location}/gn ${chromium-source:path}/src/buildtools/linux64/gn
-#  fi
-#  if [ ! -e ${chromium-source:path}/src/buildtools/linux64/gn.py ]; then
-#    ln -s ${depot_tools:location}/gn.py ${chromium-source:path}/src/buildtools/linux64/gn.py
-#  fi
+# Sync build dependencies---this is a little finnicky.
+# NOTE: I'm not sure if a sync at the end is needed?
+  echo '${:default-gclient-config}' > ${chromium-source:path}/.gclient
+  gclient sync --revision ${chromium-source:version}
+  gclient runhooks
+# Generate build configuration files.
   mkdir -p ${:location}
   echo 'import("//build/args/headless.gn")' > ${:location}/args.gn
   echo 'is_debug = false' >> ${:location}/args.gn
-  ${depot_tools:location}/gn gen ${:location}
+# NOTE: I changed from ${depot_tools:location}/gn to gn, in case this change breaks something (really shouldn't)
+  gn gen ${:location}
 
 # You can run the headless Chromium shell using
 # ${:location}/headless-chromium --remote-debugging-port=1234
 # TODO: split this into make and make install?
 make-binary =
   autoninja -C ${:location} headless_shell
-  ln -s ${:location}/headless_shell ${:location}/headless-chromium
 environment =
-  PATH=${python2.7:location}/bin:${python3:location}/bin:${depot_tools:location}:${gperf:location}/bin:${pkgconfig:location}/bin:${coreutils:location}/bin:${bash:location}/bin:${git:location}/bin:$PATH
+# Possible foot-gun: if you specify PATH=...:$PATH, it will literally insert the string '$PATH' on your PATH; buildout won't do the expansion unless you use %(PATH)s
+# TODO: make sure it's appropriate for SlapOS components to depend on things in /bin, /usr/bin, etc.
+  PATH=${python2.7:location}/bin:${python3:location}/bin:${depot_tools:location}:${gperf:location}/bin:${pkgconfig:location}/bin:${coreutils:location}/bin:${git:location}/bin:${curl:location}/bin:%(PATH)s
+
+# A default font configuration to fall back on, same as the Firefox one.
+[default-font-config]
+recipe = slapos.recipe.template:jinja2
+template = ${template-fonts-conf:output}
+rendered = ${buildout:parts-directory}/${:_buildout_section_name_}/fonts.conf
+context =
+  key cachedir :cache-dir
+  key fonts :fonts
+  key includes :includes
+fonts =
+  ${liberation-fonts:location}
+includes =
+  ${fontconfig:location}/etc/fonts/conf.d
+cache-dir =
+  ~/.fontconfig-chromium/
+
+# Create a wrapper around the headless Chromium shell. The wrapper sets some default values for environment variables and is based on the Firefox one.
+[chromium-wrapper]
+wrapper-name = headless-chromium
+part = ${chromium:location}
+
+recipe = slapos.recipe.build
+location = ${buildout:bin-directory}/${:wrapper-name}
+
+install =
+  import os
+  chromium = options['part']
+  part = self.buildout[os.path.basename(chromium)]
+  with open(location, 'w') as f:
+    f.write("""#!/bin/sh -e
+  cd {}
+  export LD_LIBRARY_PATH={}
+  export PATH={}:$PATH
+  [ -z $FONTCONFIG_FILE ] && export FONTCONFIG_FILE=${default-font-config:rendered}
+  exec ${chromium:location}/headless_shell "$@"
+  """.format(
+    chromium,
+    ':'.join(part['library'].split()),
+    ':'.join(part['path'].split()),
+  ))
+    os.fchmod(f.fileno(), 0o755)
+
+# Runtime libraries
+libraries =
+  ${nspr:location}/lib
+  ${nss:location}/lib
 
-# TODO: move default fontconfig into here
+# Runtime path
+# TODO: see if this part is really necessary
+path =
+  ${fontconfig:location}/bin