build/security/verifier/verify_kernel_cmdline.gni

# Copyright 2021 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import("//build/dev.gni")
import("//src/developer/ffx/build/ffx_action.gni")

# Check the kernel cmdline extracted from ZBI against a golden file.
#
# Parameters
#
#   zbi
#     Required: Path to the ZBI image to extract kernel cmdline from.
#   zbi_target
#     Required: The target to build the 'zbi'.
#   goldens
#     Required: Path to a list of golden files that contain golden kernel
#       cmdline in the format of one cmdline entry per line. The actual cmdline
#       must match either one of the goldens. There should be only one golden
#       file in this list for normal case and two golden files, one for the
#       old golden file, one for the new golden file during a soft transition.
#   deps, public_deps, data_deps (optional)
#     Usual GN meaning.

template("verify_kernel_cmdline") {
  ffx_action(target_name) {
    assert(defined(invoker.zbi), "verify_kernel_cmdline() must specify zbi")
    assert(defined(invoker.zbi_target),
           "verify_kernel_cmdline() must specify zbi_target")
    assert(defined(invoker.goldens),
           "verify_kernel_cmdline() must specify goldens")
    forward_variables_from(invoker,
                           [
                             "testonly",
                             "deps",
                             "public_deps",
                             "data_deps",
                             "visibility",
                           ])

    stamp_file = "$target_gen_dir/$target_name.verified"

    inputs = [ invoker.zbi ]
    inputs += invoker.goldens
    outputs = [ stamp_file ]

    args = [
      "scrutiny",
      "verify",
      "kernel-cmdline",
      "--zbi",
      rebase_path(invoker.zbi, root_build_dir),
      "--stamp",
      rebase_path(stamp_file, root_build_dir),
    ]
    foreach(golden, invoker.goldens) {
      args += [
        "--golden",
        rebase_path(golden, root_build_dir),
      ]
    }

    if (!defined(invoker.deps)) {
      deps = []
    }

    deps += [ invoker.zbi_target ]
  }
}