build/security.gni

# Copyright 2021 The Fuchsia Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# A collection of GN arguments that are used for security purpose.

declare_args() {
  # An optional golden file for fuchsia.zbi kernel cmdline args. If specified,
  # this golden file would be compared against fuchsia.zbi kernel cmdline during
  # build time.
  fuchsia_zbi_kernel_cmdline_golden = ""

  # An optional golden file for recovery.zbi kernel cmdline args. If specified,
  # this golden file would be compared against recovery.zbi kernel cmdline
  # during build time.
  recovery_zbi_kernel_cmdline_golden = ""

  # An optional golden file for fuchsia.zbi bootFS file list. If specified,
  # this golden file would be compared against fuchsia.zbi bootFS file list
  # during build time.
  fuchsia_zbi_bootfs_filelist_golden = ""

  # An optional golden file for recovery.zbi bootFS file list. If specified,
  # this golden file would be compared against recovery.zbi bootFS file list
  # during build time.
  recovery_zbi_bootfs_filelist_golden = ""

  # Whether to allow testonly=true targets in fuchsia ZBI or base/cache packages.
  #
  # Possible values are
  #   "all": Allow testonly=true target in fuchsia ZBI and base/cache packages.
  #   "all_but_base_cache_packages": Do not allow testonly=true target in
  #      base/cache packages, but allow in other fuchsia ZBI dependencies.
  #   "none": Do not allow testonly=true target in all ZBI dependencies
  #      including base/cache packages.
  #
  # Default value is 'all', it is preferable to set to 'none' for production
  #   image to avoid accidental inclusion of testing targets.
  testonly_in_containers = "all"
}

# Whether to allow testonly=true in base_packages/cache_packages.
base_cache_packages_testonly = false
if (testonly_in_containers == "all") {
  # If we allow testonly=true for all containers, then we allow it for
  # base/cache packges.
  base_cache_packages_testonly = true
}

# Whether to allow testonly=true in zbi("fuchsia") and all its dependencies
# except base_packages/cache_packages.
fuchsia_zbi_testonly = false
if (testonly_in_containers == "all" ||
    testonly_in_containers == "all_but_base_cache_packages") {
  fuchsia_zbi_testonly = true
}