Skip to content

Commit 5af0f81

Browse files
nglevinluispadron
nglevin
authored and
luispadron
committed
Add support for handling secure_features within test rules, and a small array of tests to verify that it's taking effect when the starlark build config to drop arm64e slices is active.
Cherry-pick: 83c9cd9
1 parent a6b2b94 commit 5af0f81

7 files changed

Lines changed: 193 additions & 4 deletions

File tree

‎apple/internal/rule_attrs.bzl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,12 @@ binaries/libraries will be created combining all architectures specified by
334334
def _test_bundle_attrs():
335335
"""Attributes required for rules that are built to support test rules like ios_unit_test."""
336336
return {
337+
"secure_features": attr.string_list(
338+
doc = """
339+
A list of strings representing Apple Enhanced Security crosstool features that should be enabled for
340+
this test bundle, independent of the test host (if any).
341+
""",
342+
),
337343
# We need to add an explicit output attribute so that the output file name from the test
338344
# bundle target matches the test name, otherwise, it we'd be breaking the assumption that
339345
# ios_unit_test(name = "Foo") creates a :Foo.zip target.

‎apple/internal/testing/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ bzl_library(
3636
"//apple/internal:providers",
3737
"//apple/internal:resources",
3838
"//apple/internal:rule_support",
39+
"//apple/internal:secure_features_support",
3940
"//apple/internal:swift_support",
4041
"//apple/internal/utils:clang_rt_dylibs",
4142
"@bazel_skylib//lib:types",

‎apple/internal/testing/apple_test_assembler.bzl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ _BUNDLE_ATTRS = {
3535
"linkopts",
3636
"provisioning_profile",
3737
"resources",
38+
"secure_features",
3839
"stamp",
3940
]
4041
}

‎apple/internal/testing/apple_test_bundle_support.bzl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ load(
7979
"//apple/internal:rule_support.bzl",
8080
"rule_support",
8181
)
82+
load(
83+
"//apple/internal:secure_features_support.bzl",
84+
"secure_features_support",
85+
)
8286
load(
8387
"//apple/internal:swift_support.bzl",
8488
"swift_support",
@@ -365,6 +369,7 @@ def _apple_test_bundle_impl(*, ctx, product_type):
365369
actions = ctx.actions
366370
apple_mac_toolchain_info = ctx.attr._mac_toolchain[AppleMacToolsToolchainInfo]
367371
apple_xplat_toolchain_info = ctx.attr._xplat_toolchain[AppleXPlatToolsToolchainInfo]
372+
cc_configured_features_init = features_support.make_cc_configured_features_init(ctx)
368373
cc_toolchain_forwarder = ctx.split_attr._cc_toolchain_forwarder
369374
executable_name = ctx.attr.executable_name
370375
features = features_support.compute_enabled_features(
@@ -395,6 +400,14 @@ def _apple_test_bundle_impl(*, ctx, product_type):
395400
test_host = test_host,
396401
)
397402

403+
# Check that the requested secure features are supported and enabled for the toolchain.
404+
secure_features_support.validate_secure_features_support(
405+
cc_configured_features_init = cc_configured_features_init,
406+
cc_toolchain_forwarder = cc_toolchain_forwarder,
407+
rule_label = label,
408+
secure_features = ctx.attr.secure_features,
409+
)
410+
398411
predeclared_outputs = ctx.outputs
399412
provisioning_profile = ctx.file.provisioning_profile
400413
resource_deps = ctx.attr.deps + ctx.attr.resources

‎test/starlark_tests/ios_ui_test_tests.bzl‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,9 +199,39 @@ def ios_ui_test_test_suite(name):
199199
tags = [name],
200200
)
201201

202-
# TODO: b/449684779 - Check how enhanced security entitlements propagate from test to test host.
202+
archive_contents_test(
203+
name = "{}_pointer_authentication_arm64e_device_archs_with_pointer_authentication_test".format(name),
204+
build_type = "device",
205+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_ui_test",
206+
cpus = {
207+
"ios_multi_cpus": ["arm64", "arm64e"],
208+
"watchos_cpus": [],
209+
},
210+
binary_test_file = "$BINARY",
211+
binary_test_architecture = "arm64e",
212+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
213+
tags = [name],
214+
)
215+
archive_contents_test(
216+
name = "{}_pointer_authentication_arm64_device_archs_with_pointer_authentication_test".format(name),
217+
build_type = "device",
218+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_ui_test",
219+
cpus = {
220+
"ios_multi_cpus": ["arm64", "arm64e"],
221+
"watchos_cpus": [],
222+
},
223+
binary_test_file = "$BINARY",
224+
binary_test_architecture = "arm64",
225+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
226+
tags = [name],
227+
)
203228

204-
# TODO: b/449684779 - Use arm64e support to test binary contents and how they propagate.
229+
analysis_failure_message_test(
230+
name = "{}_secure_features_disabled_at_rule_level_should_fail_test".format(name),
231+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_ui_test_with_rule_level_disabled_features",
232+
expected_error = "Attempted to enable the secure feature `trivial_auto_var_init` for the target at `//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_ui_test_with_rule_level_disabled_features.__internal__.__test_bundle`",
233+
tags = [name],
234+
)
205235

206236
native.test_suite(
207237
name = name,

‎test/starlark_tests/ios_unit_test_tests.bzl‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -312,9 +312,39 @@ def ios_unit_test_test_suite(name):
312312
tags = [name],
313313
)
314314

315-
# TODO: b/449684779 - Check how enhanced security entitlements propagate from test to test host.
315+
archive_contents_test(
316+
name = "{}_pointer_authentication_arm64e_device_archs_with_pointer_authentication_test".format(name),
317+
build_type = "device",
318+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_unit_test",
319+
cpus = {
320+
"ios_multi_cpus": ["arm64", "arm64e"],
321+
"watchos_cpus": [],
322+
},
323+
binary_test_file = "$BINARY",
324+
binary_test_architecture = "arm64e",
325+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
326+
tags = [name],
327+
)
328+
archive_contents_test(
329+
name = "{}_pointer_authentication_arm64_device_archs_with_pointer_authentication_test".format(name),
330+
build_type = "device",
331+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_unit_test",
332+
cpus = {
333+
"ios_multi_cpus": ["arm64", "arm64e"],
334+
"watchos_cpus": [],
335+
},
336+
binary_test_file = "$BINARY",
337+
binary_test_architecture = "arm64",
338+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
339+
tags = [name],
340+
)
316341

317-
# TODO: b/449684779 - Use arm64e support to test binary contents and how they propagate.
342+
analysis_failure_message_test(
343+
name = "{}_secure_features_disabled_at_rule_level_should_fail_test".format(name),
344+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_unit_test_with_rule_level_disabled_features",
345+
expected_error = "Attempted to enable the secure feature `trivial_auto_var_init` for the target at `//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_unit_test_with_rule_level_disabled_features.__internal__.__test_bundle`",
346+
tags = [name],
347+
)
318348

319349
native.test_suite(
320350
name = name,

‎test/starlark_tests/targets_under_test/ios/BUILD‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3667,6 +3667,58 @@ ios_ui_test(
36673667
],
36683668
)
36693669

3670+
ios_ui_test(
3671+
name = "simple_pointer_authentication_ui_test",
3672+
families = [
3673+
"iphone",
3674+
],
3675+
infoplists = [
3676+
"//test/starlark_tests/resources:Info.plist",
3677+
],
3678+
minimum_os_version = common.min_os_ios.baseline,
3679+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
3680+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
3681+
secure_features = [
3682+
"apple.xcode_26_minimum_opt_in",
3683+
"pointer_authentication",
3684+
],
3685+
tags = common.fixture_tags,
3686+
test_host = ":app",
3687+
deps = [
3688+
"//test/starlark_tests/resources:objc_test_lib",
3689+
],
3690+
)
3691+
3692+
ios_ui_test(
3693+
name = "simple_enhanced_security_ui_test_with_rule_level_disabled_features",
3694+
families = [
3695+
"iphone",
3696+
],
3697+
features = [
3698+
"-apple.xcode_26_minimum_opt_in",
3699+
"-trivial_auto_var_init",
3700+
],
3701+
infoplists = [
3702+
"//test/starlark_tests/resources:Info.plist",
3703+
],
3704+
minimum_os_version = common.min_os_ios.baseline,
3705+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
3706+
resources = [
3707+
"//test/starlark_tests/resources:example_filegroup",
3708+
"//test/starlark_tests/resources:resource_bundle",
3709+
],
3710+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
3711+
secure_features = [
3712+
"apple.xcode_26_minimum_opt_in",
3713+
"trivial_auto_var_init",
3714+
],
3715+
tags = common.fixture_tags,
3716+
test_host = ":app",
3717+
deps = [
3718+
"//test/starlark_tests/resources:objc_test_lib",
3719+
],
3720+
)
3721+
36703722
xctrunner(
36713723
name = "ui_test_xctrunner_app",
36723724
testonly = True,
@@ -3947,6 +3999,62 @@ ios_unit_test(
39473999
],
39484000
)
39494001

4002+
ios_unit_test(
4003+
name = "simple_pointer_authentication_unit_test",
4004+
families = [
4005+
"iphone",
4006+
],
4007+
infoplists = [
4008+
"//test/starlark_tests/resources:Info.plist",
4009+
],
4010+
minimum_os_version = common.min_os_ios.baseline,
4011+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
4012+
resources = [
4013+
"//test/starlark_tests/resources:example_filegroup",
4014+
"//test/starlark_tests/resources:resource_bundle",
4015+
],
4016+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
4017+
secure_features = [
4018+
"apple.xcode_26_minimum_opt_in",
4019+
"pointer_authentication",
4020+
],
4021+
tags = common.fixture_tags,
4022+
test_host = ":app",
4023+
deps = [
4024+
"//test/starlark_tests/resources:objc_test_lib",
4025+
],
4026+
)
4027+
4028+
ios_unit_test(
4029+
name = "simple_enhanced_security_unit_test_with_rule_level_disabled_features",
4030+
families = [
4031+
"iphone",
4032+
],
4033+
features = [
4034+
"-apple.xcode_26_minimum_opt_in",
4035+
"-trivial_auto_var_init",
4036+
],
4037+
infoplists = [
4038+
"//test/starlark_tests/resources:Info.plist",
4039+
],
4040+
minimum_os_version = common.min_os_ios.baseline,
4041+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
4042+
resources = [
4043+
"//test/starlark_tests/resources:example_filegroup",
4044+
"//test/starlark_tests/resources:resource_bundle",
4045+
],
4046+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
4047+
secure_features = [
4048+
"apple.xcode_26_minimum_opt_in",
4049+
"trivial_auto_var_init",
4050+
],
4051+
tags = common.fixture_tags,
4052+
test_host = ":app",
4053+
deps = [
4054+
"//test/starlark_tests/resources:objc_test_lib",
4055+
],
4056+
)
4057+
39504058
# ---------------------------------------------------------------------------------------
39514059
# Targets for the app/test resource deduping test.
39524060

0 commit comments

Comments
 (0)