Stand up the "secure_features" attribute for rules with comments, flagged behind "enable_wip_features", with TODOs to explain implementation to come.

As a prerequisite to that work, added support for entitlements to macos_dylib and macos_command_line_application.

Cherry-pick: f34a7b8

Author: nglevin

apple/internal/apple_framework_import.bzl

@@ -413,6 +413,9 @@ apple_dynamic_framework_import = rule(
     attrs = dicts.add(
         rule_attrs.common_tool_attrs(),
         {
+            # TODO: b/449684779 - Add an "expected_secure_features" attribute to declare what
+            # features are expected to be present in the precompiled framework, so the rules can
+            # validate against that and set required entitlements if necessary.
             "framework_imports": attr.label_list(
                 allow_empty = False,
                 allow_files = True,
@@ -482,6 +485,9 @@ apple_static_framework_import = rule(
     attrs = dicts.add(
         rule_attrs.common_tool_attrs(),
         {
+            # TODO: b/449684779 - Add an "expected_secure_features" attribute to declare what
+            # features are expected to be present in the precompiled framework, so the rules can
+            # validate against that and set required entitlements if necessary.
             "framework_imports": attr.label_list(
                 allow_empty = False,
                 allow_files = True,

apple/internal/apple_xcframework_import.bzl

@@ -753,6 +753,9 @@ objc_library(
     attrs = dicts.add(
         rule_attrs.common_tool_attrs(),
         {
+            # TODO: b/449684779 - Add an "expected_secure_features" attribute to declare what
+            # features are expected to be present in the precompiled framework, so the rules can
+            # validate against that and set required entitlements if necessary.
             "xcframework_imports": attr.label_list(
                 allow_empty = False,
                 allow_files = True,
@@ -826,6 +829,9 @@ objc_library(
     attrs = dicts.add(
         rule_attrs.common_tool_attrs(),
         {
+            # TODO: b/449684779 - Add an "expected_secure_features" attribute to declare what
+            # features are expected to be present in the precompiled framework, so the rules can
+            # validate against that and set required entitlements if necessary.
             "alwayslink": attr.bool(
                 default = False,
                 doc = """

apple/internal/entitlements_support.bzl

@@ -194,12 +194,14 @@ def _extract_signing_info(
 def _process_entitlements(
         actions,
         apple_mac_toolchain_info,
+        apple_xplat_toolchain_info,
         bundle_id,
         entitlements_file,
         platform_prerequisites,
         product_type,
         provisioning_profile,
         rule_label,
+        secure_features,
         validation_mode):
     """Processes the entitlements for a binary or bundle.
 
@@ -232,6 +234,8 @@ def _process_entitlements(
             from which entitlements will be extracted if `entitlements_file` is
             `None`. This argument may also be `None`.
         rule_label: The `Label` of the target being built.
+        secure_features: A list of strings representing Apple Enhanced Security crosstool features
+            that should be enabled for this target.
         validation_mode: A value from `entitlements_validation_mode` describing
             how the entitlements should be validated.
 
@@ -263,6 +267,14 @@ def _process_entitlements(
     if _include_app_clip_entitlements(product_type = product_type):
         app_clip = {"com.apple.developer.on-demand-install-capable": True}
         forced_plists.append(struct(**app_clip))
+    if secure_features:
+        if not apple_xplat_toolchain_info.build_settings.enable_wip_features:
+            fail("secure_features are still a work in progress and not yet supported in the rules.")
+
+        # TODO: b/449684779 - Have a mapping to declare which entitlements should be added for the
+        # given secure_features on Xcode 26.0 and later with validation against supported features.
+        # Create a new bzl (secure_features_support) to contain this mapping and validation and use
+        # it here.
 
     inputs = list(plists)
 

apple/internal/ios_rules.bzl

@@ -232,12 +232,14 @@ def _ios_application_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -624,12 +626,14 @@ def _ios_app_clip_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -1197,12 +1201,14 @@ def _ios_extension_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -1938,12 +1944,14 @@ def _ios_imessage_application_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -2146,12 +2154,14 @@ def _ios_imessage_extension_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -2418,12 +2428,14 @@ def _ios_sticker_pack_extension_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 

apple/internal/macos_rules.bzl

@@ -230,12 +230,14 @@ def _macos_application_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -543,12 +545,14 @@ def _macos_bundle_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -791,12 +795,14 @@ def _macos_extension_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -1073,12 +1079,14 @@ def _macos_quick_look_plugin_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -1320,12 +1328,14 @@ def _macos_kernel_extension_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -1571,12 +1581,14 @@ def _macos_spotlight_importer_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -1812,12 +1824,14 @@ def _macos_xpc_service_impl(ctx):
     entitlements = entitlements_support.process_entitlements(
         actions = actions,
         apple_mac_toolchain_info = apple_mac_toolchain_info,
+        apple_xplat_toolchain_info = apple_xplat_toolchain_info,
         bundle_id = bundle_id,
         entitlements_file = ctx.file.entitlements,
         platform_prerequisites = platform_prerequisites,
         product_type = rule_descriptor.product_type,
         provisioning_profile = provisioning_profile,
         rule_label = label,
+        secure_features = ctx.attr.secure_features,
         validation_mode = ctx.attr.entitlements_validation,
     )
 
@@ -2732,7 +2746,6 @@ Targets created with `macos_command_line_application` can be executed using
             platform_type = "macos",
         ),
         rule_attrs.signing_attrs(
-            supports_capabilities = False,
             profile_extension = ".provisionprofile",
         ),
         {
@@ -2789,7 +2802,6 @@ macos_dylib = rule_factory.create_apple_rule(
             platform_type = "macos",
         ),
         rule_attrs.signing_attrs(
-            supports_capabilities = False,
             profile_extension = ".provisionprofile",
         ),
         {

apple/internal/rule_attrs.bzl

@@ -473,6 +473,12 @@ the provisioning profile to ensure they are supported.
                     entitlements_validation_mode.skip,
                 ],
             ),
+            "secure_features": attr.string_list(
+                doc = """
+A list of strings representing Apple Enhanced Security crosstool features that should be enabled for
+this target.
+""",
+            ),
             "shared_capabilities": attr.label_list(
                 providers = [[AppleSharedCapabilityInfo]],
                 doc = """

apple/internal/testing/build_test_rules.bzl

@@ -97,6 +97,9 @@ def apple_build_test_rule(doc, platform_type):
     # libraries compiles.
     return rule(
         attrs = {
+            # TODO: b/449684779 - Add a "secure_features" attribute to set required Clang
+            # features for the purposes of build testing. Don't concern ourselves with setting
+            # entitlements as they should not be necessary for validating compile time behavior.
             "minimum_os_version": attr.string(
                 mandatory = True,
                 doc = """\

apple/internal/transition_support.bzl

@@ -454,6 +454,10 @@ def _apple_rule_base_transition_impl(settings, attr):
     minimum_os_version = attr.minimum_os_version
     platform_type = attr.platform_type
     building_apple_bundle = getattr(attr, "_building_apple_bundle", True)
+
+    # TODO: b/449684779 - Perform light validation to determine if the secure_features should be
+    # configured and amended to the existing set of features for this target so the crosstool can
+    # configure required Clang features, and determine if we should set arm64e as necessary.
     return _command_line_options(
         building_apple_bundle = building_apple_bundle,
         environment_arch = _environment_archs(platform_type, minimum_os_version, settings)[0],
@@ -473,6 +477,9 @@ _apple_rule_base_transition_inputs = _apple_rule_common_transition_inputs + [
     "//command_line_option:platforms",
     "//command_line_option:ios_multi_cpus",
     "//command_line_option:macos_cpus",
+    # TODO: b/449684779 - Add //command_line_option:features as a required input here. This is
+    # needed to allow the transition to see the current value of the --features flag so it can
+    # potentially amend it with secure_features if needed.
     "//command_line_option:tvos_cpus",
     "//command_line_option:watchos_cpus",
 ] + (["//command_line_option:visionos_cpus"] if _supports_visionos else [])
@@ -489,6 +496,8 @@ _apple_rule_base_transition_outputs = [
     "//command_line_option:compiler",
     "//command_line_option:cpu",
     "//command_line_option:fission",
+    # TODO: b/449684779 - Add //command_line_option:features as a required output here. Remember
+    # that `[]` can be passed through to indicate "make no changes to incoming --features".
     "//command_line_option:grte_top",
     "//command_line_option:ios_minimum_os",
     "//command_line_option:macos_minimum_os",
@@ -519,6 +528,10 @@ def _apple_platforms_rule_base_transition_impl(settings, attr):
     if not settings["//command_line_option:incompatible_enable_apple_toolchain_resolution"]:
         # Add fallback to match an anticipated split of Apple cpu-based resolution
         environment_arch = _environment_archs(platform_type, minimum_os_version, settings)[0]
+
+    # TODO: b/449684779 - Perform light validation to determine if the secure_features should be
+    # configured and amended to the existing set of features for this target so the crosstool can
+    # configure required Clang features, and determine if we should set arm64e as necessary.
     return _command_line_options(
         apple_platforms = settings["//command_line_option:apple_platforms"],
         building_apple_bundle = building_apple_bundle,
@@ -547,6 +560,10 @@ def _apple_platforms_rule_bundle_output_base_transition_impl(settings, attr):
             settings = settings,
             minimum_os_version = minimum_os_version,
         )
+
+    # TODO: b/449684779 - Perform light validation to determine if the secure_features should be
+    # configured and amended to the existing set of features for this target so the crosstool can
+    # configure required Clang features, and determine if we should set arm64e as necessary.
     return _command_line_options(
         apple_platforms = settings["//command_line_option:apple_platforms"],
         building_apple_bundle = building_apple_bundle,
@@ -730,6 +747,10 @@ _apple_platform_split_transition = transition(
 def _xcframework_base_transition_impl(settings, _):
     """Rule transition for XCFramework rules producing SDK-adjacent artifacts."""
 
+    # TODO: b/449684779 - Perform light validation to determine if the secure_features should be
+    # configured and amended to the existing set of features for this target so the crosstool can
+    # configure required Clang features, and determine if we should set arm64e as necessary.
+
     # For safety, lean on darwin_{default arch} with no incoming minimum_os_version to avoid
     # incoming settings meant for other platforms overriding the settings for the xcframework rule's
     # underlying actions, and allow for toolchain resolution in the future.
@@ -751,6 +772,10 @@ def _xcframework_split_transition_impl(settings, attr):
     """Starlark 1:2+ transition for generation of multiple frameworks for the current target."""
     output_dictionary = {}
 
+    # TODO: b/449684779 - Perform light validation to determine if the secure_features should be
+    # configured and amended to the existing set of features for this target so the crosstool can
+    # configure required Clang features, and determine if we should set arm64e as necessary.
+
     for platform_type in ["ios", "tvos", "watchos", "visionos", "macos"]:
         platform_attr = getattr(attr, platform_type, None)
         if not platform_attr: