build/gn/BUILD.gn

# Copyright 2016 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import("//build/product.gni")
import("//build/python/python_action.gni")
import("//build/python/python_binary.gni")

if (use_bringup_assembly) {
  group("archives") {
  }
  group("package_archive") {
  }
} else {
  group("archives") {
    testonly = true
    deps = [ ":package_archive" ]
  }

  # Name and location of the TUF repository in our build.
  # The content should be laid out according to the specification at
  # https://theupdateframework.github.io/specification/latest/#the-repository
  tuf_repo_name = "amber-files"
  tuf_repo_dir = root_build_dir + "/" + tuf_repo_name

  # Generates an archive of package metadata.
  #
  # The archive will contain the following:
  #
  #   /pm: A copy of the host 'pm' tool.
  #
  #   /${tuf_repo_name}/keys/*.json
  #     A set of signing private and public keys for TUF metadata.
  #
  #   /${tuf_repo_name}/repository/*.json
  #     A set of TUF metadata files signed with the keys from
  #     the previous directory.
  #
  #   /${tuf_repo_name}/repository/blobs/<merkleroot>
  #     A set of files, named simply by their merkleroot value.
  #     This will contain all the blobs referenced by the
  #     package_manifest.json files that are listed in
  #     ${all_package_manifests_list} (see below).
  #
  #   /${tuf_repo_name}/repository/targets/<package>/<hash>.<version>
  #     These are copies of the archive's package meta.far, named
  #     according to their content. These correspond to entries
  #     in ${tuf_repo_name}/repository/targets.json which describe
  #     the <package>, <version>, <merkle> and <hash> for each one
  #     of these files.
  #
  #     Note that each of these files will also be in the archive as
  #     ${tuf_repo_name}/repository/blobs/<merkle>.
  #
  # NOTE: This is consumed by the system OTA tests. Please check in with the
  # software delivery team if you need to change this.
  pkg_archive = "$root_build_dir/packages.tar.gz"

  tuf_repo_files = [
    # TUF Signing keys. IMPORTANT: DO NOT INCLUDE root.json here!
    "keys/snapshot.json",
    "keys/targets.json",
    "keys/timestamp.json",

    # Extra metadata files for TUF-1.0 compliance (https://fxbug.dev/38262)
    "repository/1.root.json",
    "repository/2.root.json",
    "repository/3.root.json",
    "repository/4.root.json",
    "repository/5.root.json",
    "repository/6.root.json",
    "repository/7.root.json",
  ]

  # The top-level directory for tuf_repo_files entries
  rebased_tuf_repo_dir = rebase_path(tuf_repo_dir, root_build_dir)

  # How to build and locate the host 'tarmaker' tool used to create
  # the final compressed archive.
  tarmaker_tool = host_out_dir + "/tarmaker"
  tarmaker_tool_target = "//build/tools/tarmaker($host_toolchain)"

  # How to build and locate the host 'pm' tool.
  pm_tool = host_out_dir + "/pm"
  pm_tool_target = "//src/sys/pkg/bin/pm:pm_bin($host_toolchain)"

  # How to build and locate the all_package_manifests.list file.
  # This contains one package_manifest.json path per line and is parsed
  # to populate ${tuf_repo_name}/repository/blobs/ in the archive.
  all_package_manifests_list = root_build_dir + "/all_package_manifests.list"
  all_package_manifests_target =
      "//build/images/updates:all_package_manifests.list"

  # The top-level timestamp.json file which will be parsed to extract the
  # properly versioned snapshot.json file, which will itself will be parsed
  # to get the properly versioned root.json and targets.json.
  # Note that these files are created by //build/images/updates:publish, though it is
  # not properly listed as an output for its action.
  timestamp_json_file =
      "$root_build_dir/${tuf_repo_name}/repository/timestamp.json"

  python_binary("create_packages_archive") {
    main_source = "//build/gn/create_packages_archive.py"
    deps = [ "//build/python/modules/assembly" ]
  }

  python_action("package_archive") {
    testonly = true
    binary_label = ":create_packages_archive"
    tarmaker_manifest = "$target_gen_dir/$target_name.tarmaker.manifest"
    outputs = [
      pkg_archive,
      tarmaker_manifest,
    ]
    inputs = [
      all_package_manifests_list,
      pm_tool,
      tarmaker_tool,
    ]
    depfile = "$target_gen_dir/$target_name.d"
    args = [
      "--tuf-repo-name",
      tuf_repo_name,
      "--tarmaker",
      rebase_path(tarmaker_tool, root_build_dir),
      "--tarmaker-manifest",
      rebase_path(tarmaker_manifest, root_build_dir),
      "--output",
      rebase_path(outputs[0], root_build_dir),
      "--depfile",
      rebase_path(depfile, root_build_dir),
      "--package-manifests-list",
      rebase_path(all_package_manifests_list, root_build_dir),
      "--tuf-timestamp-json",
      rebase_path(timestamp_json_file, root_build_dir),
      "--files",
      "pm=" + rebase_path(pm_tool, root_build_dir),
    ]
    foreach(entry, tuf_repo_files) {
      args += [ "${tuf_repo_name}/${entry}=${rebased_tuf_repo_dir}/${entry}" ]
    }

    deps = [
      "//build/images/updates:publish",
      all_package_manifests_target,
      pm_tool_target,
      tarmaker_tool_target,
    ]

    metadata = {
      # Use by //:archives target to ensure this file is uploaded
      # to cloud storage after build completion.
      archives = [
        {
          name = "packages"
          path = rebase_path(outputs[0], root_build_dir)
          type = "tgz"
        },
      ]
    }
  }
}