| # Copyright 2021 The Fuchsia Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| |
| import("//build/dev.gni") |
| import("//src/developer/ffx/build/ffx_action.gni") |
| |
| # Validates that privileged component resolvers only resolve allowed static components, |
| # determined by the provided allowlist. |
| # |
| # Parameters |
| # |
| # update_package_target (required) |
| # [string] The target that builds the update package, including the update |
| # package blobfs archive file. |
| # |
| # image_assembler_target (required) |
| # [string] The target that assembles system images, including the system |
| # blobfs archive file. |
| # |
| # assembly_image_name (required) |
| # [string] The image_name designated in the system assembly associated with |
| # image_assembler_target. |
| # |
| # allowlist (required) |
| # [string] Path to the allowlist defining which component resolvers are |
| # privileged and which components are allowed to be resolved by them. |
| # |
| # deps, public_deps, data_deps (optional) |
| # Usual GN meaning. |
| |
| template("verify_component_resolvers") { |
| assert(defined(invoker.update_package_target), |
| "verify_component_resolvers() must specify update_package_target") |
| assert(defined(invoker.image_assembler_target), |
| "verify_component_resolvers() must specify image_assembler_target") |
| assert(defined(invoker.assembly_image_name), |
| "verify_component_resolvers() must specify assembly_image_name") |
| assert(defined(invoker.allowlist), |
| "verify_component_resolvers() must specify image_assembler_target") |
| |
| update_package_target_out_dir = |
| get_label_info(invoker.update_package_target, "target_out_dir") |
| update_package_target_name = |
| get_label_info(invoker.update_package_target, "name") |
| update_package_dir = |
| "$update_package_target_out_dir/$update_package_target_name" |
| |
| image_assembler_target_out_dir = |
| get_label_info(invoker.image_assembler_target, "target_out_dir") |
| assembly_image_name = invoker.assembly_image_name |
| image_assembler_dir = "$image_assembler_target_out_dir/$assembly_image_name" |
| |
| files = { |
| update_package = "$update_package_dir/update.far" |
| blobfs = [ |
| "$image_assembler_dir/blob.blk", |
| "$update_package_dir/gen/update.blob.blk", |
| ] |
| } |
| |
| ffx_action(target_name) { |
| forward_variables_from(invoker, |
| [ |
| "testonly", |
| "deps", |
| "public_deps", |
| "data_deps", |
| "visibility", |
| ]) |
| depfile = "$target_out_dir/$target_name.d" |
| stamp_file = "$target_gen_dir/$target_name.verified" |
| |
| inputs = [ |
| invoker.allowlist, |
| files.update_package, |
| ] + files.blobfs |
| outputs = [ stamp_file ] |
| |
| args = [ |
| "scrutiny", |
| "verify", |
| "--depfile", |
| rebase_path(depfile, root_build_dir), |
| "--stamp", |
| rebase_path(stamp_file, root_build_dir), |
| "component-resolvers", |
| "--build-path", |
| rebase_path(root_build_dir, root_build_dir), |
| "--update", |
| rebase_path(files.update_package, root_build_dir), |
| "--allowlist", |
| rebase_path(invoker.allowlist, root_build_dir), |
| ] |
| foreach(blobfs, files.blobfs) { |
| args += [ |
| "--blobfs", |
| rebase_path(blobfs, root_build_dir), |
| ] |
| } |
| |
| if (!defined(invoker.deps)) { |
| deps = [] |
| } |
| deps += [ |
| invoker.update_package_target, |
| invoker.image_assembler_target, |
| ] |
| } |
| } |