build/images/custom_signing.gni

# Copyright 2018 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import("//build/config/fuchsia/zircon.gni")

declare_args() {
  # If non-empty, the given script will be invoked to produce a signed ZBI
  # image. The given script must accept -z for the input zbi path, and -o for
  # the output signed zbi path. The path must be in GN-label syntax (i.e.
  # starts with //).
  custom_signing_script = ""
}

# Template for producing signed ZBI images given a custom signing script.
# The signing script is required to accept two parameters:
#  -z  the path to the ZBI image to be signed
#  -o  the path to the image file to be output
#  -B  the path to the zircon build directory
#
# TODO(BLD-323): add flags for producing depfiles
# TODO(raggi): add support for custom flags (e.g. to switch keys)
#
# Paramters
#
#   output_name (optional, default: target_name)
#   output_extension (optional, default: signed)
#       [string] These together determine the name of the output file.
#       If `output_name` is omitted, then the name of the target is
#       used.  If `output_extension` is "" then `output_name` is the
#       file name; otherwise, `${output_name}.${output_extension}`;
#       the output file is always under `root_out_dir`.
#
#   zbi (required)
#       [list-of-strings] path to a ZBI image to be signed. Must only
#       contain a single entry.
#
#   deps (usually required)
#   visibility (optional)
#   metadata (optional)
#   testonly (optional)
#       Same as for any GN `action` target.  `deps` must list labels that
#       produce all the `inputs`, `cmdline_inputs`, and `ramdisk_inputs`
#       that are generated by the build (none are required for inputs that
#       are part of the source tree).
template("custom_signed_zbi") {
  if (defined(invoker.output_name)) {
    output_file = invoker.output_name
  } else {
    output_file = target_name
  }

  if (defined(invoker.output_extension)) {
    if (invoker.output_extension != "") {
      output_file += ".${invoker.output_extension}"
    }
  } else {
    output_file += ".signed"
  }

  action(target_name) {
    forward_variables_from(invoker,
                           [
                             "testonly",
                             "deps",
                             "zbi",
                             "metadata",
                           ])

    assert([ zbi[0] ] == zbi, "zbi parameter must contain a single entry")

    output_file = "$root_out_dir/$output_file"
    script = custom_signing_script

    inputs = zbi
    outputs = [
      output_file,
    ]
    args = [
      "-z",
      rebase_path(inputs[0], root_build_dir),
      "-o",
      rebase_path(outputs[0], root_build_dir),
      "-B",
      rebase_path(zircon_root_build_dir, root_build_dir),
    ]
  }
}