Move boot jars package check to Soong

$(call add_json_bool, Unbundled_build,                   $(TARGET_BUILD_UNBUNDLED))

$(call add_json_bool, Unbundled_build,                   $(TARGET_BUILD_UNBUNDLED))

$(call add_json_bool, Unbundled_build_apps,              $(TARGET_BUILD_APPS))

$(call add_json_bool, Unbundled_build_apps,              $(TARGET_BUILD_APPS))

$(call add_json_bool, Always_use_prebuilt_sdks,          $(TARGET_BUILD_USE_PREBUILT_SDKS))

$(call add_json_bool, Always_use_prebuilt_sdks,          $(TARGET_BUILD_USE_PREBUILT_SDKS))

$(call add_json_bool, Skip_boot_jars_check,              $(SKIP_BOOT_JARS_CHECK))

$(call add_json_bool, Debuggable,                        $(filter userdebug eng,$(TARGET_BUILD_VARIANT)))

$(call add_json_bool, Debuggable,                        $(filter userdebug eng,$(TARGET_BUILD_VARIANT)))

$(call add_json_bool, Eng,                               $(filter eng,$(TARGET_BUILD_VARIANT)))

$(call add_json_bool, Eng,                               $(filter eng,$(TARGET_BUILD_VARIANT)))

# Copyright (C) 2014 The Android Open Source Project

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#      http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#

# Rules to check if classes in the boot jars are from the list of allowed packages.

#

ifneq ($(SKIP_BOOT_JARS_CHECK),true)

ifdef PRODUCT_BOOT_JARS

intermediates := $(call intermediates-dir-for, PACKAGING, boot-jars-package-check,,COMMON)

stamp := $(intermediates)/stamp

# Convert the colon-separated components <apex>:<jar> to <jar>.<apex> names

# (e.g. com.android.media:updatable-media -> updatable-media.com.android.media).

# Special cases:

#   - for the "platform" or "system_ext" apex drop the .<apex> suffix

boot_jars := $(foreach pair,$(PRODUCT_BOOT_JARS) $(PRODUCT_UPDATABLE_BOOT_JARS), \

  $(eval apex := $(call word-colon,1,$(pair))) \

  $(eval jar := $(call word-colon,2,$(pair))) \

  $(eval q := :) \

  $(eval sfx := $(q).$(apex)$(q)) \

  $(eval sfx := $(subst $(q).platform$(q),$(q)$(q),$(sfx))) \

  $(eval sfx := $(subst $(q).system_ext$(q),$(q)$(q),$(sfx))) \

  $(eval sfx := $(patsubst $(q)%$(q),%,$(sfx))) \

  $(jar)$(sfx))

# Convert boot jar names to build paths.

built_boot_jars := $(foreach j, $(boot_jars), \

  $(call intermediates-dir-for, JAVA_LIBRARIES, $(j),,COMMON)/classes.jar)

script := build/make/core/tasks/check_boot_jars/check_boot_jars.py

allowed_file := build/make/core/tasks/check_boot_jars/package_allowed_list.txt

$(stamp): PRIVATE_BOOT_JARS := $(built_boot_jars)

$(stamp): PRIVATE_SCRIPT := $(script)

$(stamp): PRIVATE_ALLOWED := $(allowed_file)

$(stamp) : $(built_boot_jars) $(script) $(allowed_file)

	@echo "Check package name for $(PRIVATE_BOOT_JARS)"

	$(hide) $(PRIVATE_SCRIPT) $(PRIVATE_ALLOWED) $(PRIVATE_BOOT_JARS)

	$(hide) mkdir -p $(dir $@) && touch $@

.PHONY: check-boot-jars

check-boot-jars : $(stamp)

# Run check-boot-jars by default

droidcore : check-boot-jars

endif  # PRODUCT_BOOT_JARS

endif  # SKIP_BOOT_JARS_CHECK not true

#!/usr/bin/env python

"""

Check boot jars.

Usage: check_boot_jars.py <package_allow_list_file> <jar1> <jar2> ...

"""

import logging

import os.path

import re

import subprocess

import sys

# The compiled allow list RE.

allow_list_re = None

def LoadAllowList(filename):

  """ Load and compile allow list regular expressions from filename.

  """

  lines = []

  with open(filename, 'r') as f:

    for line in f:

      line = line.strip()

      if not line or line.startswith('#'):

        continue

      lines.append(line)

  combined_re = r'^(%s)$' % '|'.join(lines)

  global allow_list_re

  try:

    allow_list_re = re.compile(combined_re)

  except re.error:

    logging.exception(

        'Cannot compile package allow list regular expression: %r',

        combined_re)

    allow_list_re = None

    return False

  return True

def CheckJar(allow_list_path, jar):

  """Check a jar file.

  """

  # Get the list of files inside the jar file.

  p = subprocess.Popen(args='jar tf %s' % jar,

      stdout=subprocess.PIPE, shell=True)

  stdout, _ = p.communicate()

  if p.returncode != 0:

    return False

  items = stdout.split()

  classes = 0

  for f in items:

    if f.endswith('.class'):

      classes += 1

      package_name = os.path.dirname(f)

      package_name = package_name.replace('/', '.')

      if not package_name or not allow_list_re.match(package_name):

        print >> sys.stderr, ('Error: %s contains class file %s, whose package name %s is empty or'

                              ' not in the allow list %s of packages allowed on the bootclasspath.'

                              % (jar, f, package_name, allow_list_path))

        return False

  if classes == 0:

    print >> sys.stderr, ('Error: %s does not contain any class files.' % jar)

    return False

  return True

def main(argv):

  if len(argv) < 2:

    print __doc__

    return 1

  allow_list_path = argv[0]

  if not LoadAllowList(allow_list_path):

    return 1

  passed = True

  for jar in argv[1:]:

    if not CheckJar(allow_list_path, jar):

      passed = False

  if not passed:

    return 1

  return 0

if __name__ == '__main__':

  sys.exit(main(sys.argv[1:]))

# Boot jar package name allowed list.

# Each line is interpreted as a regular expression.

###################################################

# core-libart.jar & core-oj.jar

java\.awt\.font

java\.beans

java\.io

java\.lang

java\.lang\.annotation

java\.lang\.invoke

java\.lang\.ref

java\.lang\.reflect

java\.math

java\.net

java\.nio

java\.nio\.file

java\.nio\.file\.spi

java\.nio\.file\.attribute

java\.nio\.channels

java\.nio\.channels\.spi

java\.nio\.charset

java\.nio\.charset\.spi

java\.security

java\.security\.acl

java\.security\.cert

java\.security\.interfaces

java\.security\.spec

java\.sql

java\.text

java\.text\.spi

java\.time

java\.time\.chrono

java\.time\.format

java\.time\.temporal

java\.time\.zone

java\.util

java\.util\.concurrent

java\.util\.concurrent\.atomic

java\.util\.concurrent\.locks

java\.util\.function

java\.util\.jar

java\.util\.logging

java\.util\.prefs

java\.util\.regex

java\.util\.spi

java\.util\.stream

java\.util\.zip

# TODO: Remove javax.annotation.processing if possible, see http://b/132338110:

javax\.annotation\.processing

javax\.crypto

javax\.crypto\.interfaces

javax\.crypto\.spec

javax\.net

javax\.net\.ssl

javax\.security\.auth

javax\.security\.auth\.callback

javax\.security\.auth\.login

javax\.security\.auth\.x500

javax\.security\.cert

javax\.sql

javax\.xml

javax\.xml\.datatype

javax\.xml\.namespace

javax\.xml\.parsers

javax\.xml\.transform

javax\.xml\.transform\.dom

javax\.xml\.transform\.sax

javax\.xml\.transform\.stream

javax\.xml\.validation

javax\.xml\.xpath

jdk\.internal\.util

jdk\.internal\.vm\.annotation

jdk\.net

org\.w3c\.dom

org\.w3c\.dom\.ls

org\.w3c\.dom\.traversal

# OpenJdk internal implementation.

sun\.invoke\.util

sun\.invoke\.empty

sun\.misc

sun\.util.*

sun\.text.*

sun\.security.*

sun\.reflect.*

sun\.nio.*

sun\.net.*

com\.sun\..*

# TODO: Move these internal org.apache.harmony classes to libcore.*

org\.apache\.harmony\.crypto\.internal

org\.apache\.harmony\.dalvik

org\.apache\.harmony\.dalvik\.ddmc

org\.apache\.harmony\.luni\.internal\.util

org\.apache\.harmony\.security

org\.apache\.harmony\.security\.asn1

org\.apache\.harmony\.security\.fortress

org\.apache\.harmony\.security\.pkcs10

org\.apache\.harmony\.security\.pkcs7

org\.apache\.harmony\.security\.pkcs8

org\.apache\.harmony\.security\.provider\.crypto

org\.apache\.harmony\.security\.utils

org\.apache\.harmony\.security\.x501

org\.apache\.harmony\.security\.x509

org\.apache\.harmony\.security\.x509\.tsp

org\.apache\.harmony\.xml

org\.apache\.harmony\.xml\.dom

org\.apache\.harmony\.xml\.parsers

org\.json

org\.xmlpull\.v1

org\.xmlpull\.v1\.sax2

# TODO:  jarjar org.kxml2.io to com.android org\.kxml2\.io

org\.kxml2\.io

org\.xml

org\.xml\.sax

org\.xml\.sax\.ext

org\.xml\.sax\.helpers

dalvik\..*

libcore\..*

android\..*

com\.android\..*

###################################################

# android.test.base.jar

junit\.extensions

junit\.framework

android\.test

android\.test\.suitebuilder\.annotation

###################################################

# ext.jar

# TODO: jarjar javax.sip to com.android

javax\.sip

javax\.sip\.address

javax\.sip\.header

javax\.sip\.message

# TODO: jarjar org.apache.commons to com.android

org\.apache\.commons\.codec

org\.apache\.commons\.codec\.binary

org\.apache\.commons\.codec\.language

org\.apache\.commons\.codec\.net

org\.apache\.commons\.logging

org\.apache\.commons\.logging\.impl

org\.apache\.http

org\.apache\.http\.auth

org\.apache\.http\.auth\.params

org\.apache\.http\.client

org\.apache\.http\.client\.entity

org\.apache\.http\.client\.methods

org\.apache\.http\.client\.params

org\.apache\.http\.client\.protocol

org\.apache\.http\.client\.utils

org\.apache\.http\.conn

org\.apache\.http\.conn\.params

org\.apache\.http\.conn\.routing

org\.apache\.http\.conn\.scheme

org\.apache\.http\.conn\.ssl

org\.apache\.http\.conn\.util

org\.apache\.http\.cookie

org\.apache\.http\.cookie\.params

org\.apache\.http\.entity

org\.apache\.http\.impl

org\.apache\.http\.impl\.auth

org\.apache\.http\.impl\.client

org\.apache\.http\.impl\.client

org\.apache\.http\.impl\.conn

org\.apache\.http\.impl\.conn\.tsccm

org\.apache\.http\.impl\.cookie

org\.apache\.http\.impl\.entity

org\.apache\.http\.impl\.io

org\.apache\.http\.impl\.io

org\.apache\.http\.io

org\.apache\.http\.message

org\.apache\.http\.params

org\.apache\.http\.protocol

org\.apache\.http\.util

# TODO: jarjar gov.nist to com.android

gov\.nist\.core

gov\.nist\.core\.net

gov\.nist\.javax\.sip

gov\.nist\.javax\.sip\.address

gov\.nist\.javax\.sip\.clientauthutils

gov\.nist\.javax\.sip\.header

gov\.nist\.javax\.sip\.header\.extensions

gov\.nist\.javax\.sip\.header\.ims

gov\.nist\.javax\.sip\.message

gov\.nist\.javax\.sip\.parser

gov\.nist\.javax\.sip\.parser\.extensions

gov\.nist\.javax\.sip\.parser\.ims

gov\.nist\.javax\.sip\.stack

org\.ccil\.cowan\.tagsoup

org\.ccil\.cowan\.tagsoup\.jaxp

###################################################

# framework.jar

javax\.microedition\.khronos\.opengles

javax\.microedition\.khronos\.egl

android

###################################################

# apache-xml.jar

org\.apache\.xml\.res

org\.apache\.xml\.utils

org\.apache\.xml\.utils\.res

org\.apache\.xml\.dtm

org\.apache\.xml\.dtm\.ref

org\.apache\.xml\.dtm\.ref\.dom2dtm

org\.apache\.xml\.dtm\.ref\.sax2dtm

org\.apache\.xml\.serializer

org\.apache\.xml\.serializer\.utils

org\.apache\.xml\.serializer\.dom3

org\.apache\.xpath

org\.apache\.xpath\.operations

org\.apache\.xpath\.domapi

org\.apache\.xpath\.functions

org\.apache\.xpath\.res

org\.apache\.xpath\.axes

org\.apache\.xpath\.objects

org\.apache\.xpath\.patterns

org\.apache\.xpath\.jaxp

org\.apache\.xpath\.compiler

org\.apache\.xalan

org\.apache\.xalan\.res

org\.apache\.xalan\.templates

org\.apache\.xalan\.serialize

org\.apache\.xalan\.extensions

org\.apache\.xalan\.processor

org\.apache\.xalan\.transformer

org\.apache\.xalan\.xslt

###################################################

# Packages in the google namespace across all bootclasspath jars.

com\.google\.android\..*

com\.google\.vr\.platform.*

com\.google\.i18n\.phonenumbers\..*

com\.google\.i18n\.phonenumbers

###################################################

# Packages used for Android in Chrome OS

org\.chromium\.arc

org\.chromium\.arc\..*