Skip to content

Commit 8b89ef9

Browse files
nglevinluispadron
nglevin
authored and
luispadron
committed
Add support for handling secure_features within test rules, and a small array of tests to verify that it's taking effect when the starlark build config to drop arm64e slices is active.
Cherry-pick: 83c9cd9
1 parent 2a47374 commit 8b89ef9

7 files changed

Lines changed: 193 additions & 4 deletions

File tree

‎apple/internal/rule_attrs.bzl‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,12 @@ binaries/libraries will be created combining all architectures specified by
340340
def _test_bundle_attrs():
341341
"""Attributes required for rules that are built to support test rules like ios_unit_test."""
342342
return {
343+
"secure_features": attr.string_list(
344+
doc = """
345+
A list of strings representing Apple Enhanced Security crosstool features that should be enabled for
346+
this test bundle, independent of the test host (if any).
347+
""",
348+
),
343349
# We need to add an explicit output attribute so that the output file name from the test
344350
# bundle target matches the test name, otherwise, it we'd be breaking the assumption that
345351
# ios_unit_test(name = "Foo") creates a :Foo.zip target.

‎apple/internal/testing/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ bzl_library(
3636
"//apple/internal:providers",
3737
"//apple/internal:resources",
3838
"//apple/internal:rule_support",
39+
"//apple/internal:secure_features_support",
3940
"//apple/internal:swift_support",
4041
"//apple/internal/utils:clang_rt_dylibs",
4142
"@bazel_skylib//lib:types",

‎apple/internal/testing/apple_test_assembler.bzl‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ _BUNDLE_ATTRS = {
3535
"linkopts",
3636
"provisioning_profile",
3737
"resources",
38+
"secure_features",
3839
"stamp",
3940
]
4041
}

‎apple/internal/testing/apple_test_bundle_support.bzl‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,10 @@ load(
7979
"//apple/internal:rule_support.bzl",
8080
"rule_support",
8181
)
82+
load(
83+
"//apple/internal:secure_features_support.bzl",
84+
"secure_features_support",
85+
)
8286
load(
8387
"//apple/internal:swift_support.bzl",
8488
"swift_support",
@@ -365,6 +369,7 @@ def _apple_test_bundle_impl(*, ctx, product_type):
365369
actions = ctx.actions
366370
apple_mac_toolchain_info = ctx.attr._mac_toolchain[AppleMacToolsToolchainInfo]
367371
apple_xplat_toolchain_info = ctx.attr._xplat_toolchain[AppleXPlatToolsToolchainInfo]
372+
cc_configured_features_init = features_support.make_cc_configured_features_init(ctx)
368373
cc_toolchain_forwarder = ctx.split_attr._cc_toolchain_forwarder
369374
executable_name = ctx.attr.executable_name
370375
features = features_support.compute_enabled_features(
@@ -395,6 +400,14 @@ def _apple_test_bundle_impl(*, ctx, product_type):
395400
test_host = test_host,
396401
)
397402

403+
# Check that the requested secure features are supported and enabled for the toolchain.
404+
secure_features_support.validate_secure_features_support(
405+
cc_configured_features_init = cc_configured_features_init,
406+
cc_toolchain_forwarder = cc_toolchain_forwarder,
407+
rule_label = label,
408+
secure_features = ctx.attr.secure_features,
409+
)
410+
398411
predeclared_outputs = ctx.outputs
399412
provisioning_profile = ctx.file.provisioning_profile
400413
resource_deps = ctx.attr.deps + ctx.attr.resources

‎test/starlark_tests/ios_ui_test_tests.bzl‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -199,9 +199,39 @@ def ios_ui_test_test_suite(name):
199199
tags = [name],
200200
)
201201

202-
# TODO: b/449684779 - Check how enhanced security entitlements propagate from test to test host.
202+
archive_contents_test(
203+
name = "{}_pointer_authentication_arm64e_device_archs_with_pointer_authentication_test".format(name),
204+
build_type = "device",
205+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_ui_test",
206+
cpus = {
207+
"ios_multi_cpus": ["arm64", "arm64e"],
208+
"watchos_cpus": [],
209+
},
210+
binary_test_file = "$BINARY",
211+
binary_test_architecture = "arm64e",
212+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
213+
tags = [name],
214+
)
215+
archive_contents_test(
216+
name = "{}_pointer_authentication_arm64_device_archs_with_pointer_authentication_test".format(name),
217+
build_type = "device",
218+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_ui_test",
219+
cpus = {
220+
"ios_multi_cpus": ["arm64", "arm64e"],
221+
"watchos_cpus": [],
222+
},
223+
binary_test_file = "$BINARY",
224+
binary_test_architecture = "arm64",
225+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
226+
tags = [name],
227+
)
203228

204-
# TODO: b/449684779 - Use arm64e support to test binary contents and how they propagate.
229+
analysis_failure_message_test(
230+
name = "{}_secure_features_disabled_at_rule_level_should_fail_test".format(name),
231+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_ui_test_with_rule_level_disabled_features",
232+
expected_error = "Attempted to enable the secure feature `trivial_auto_var_init` for the target at `//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_ui_test_with_rule_level_disabled_features.__internal__.__test_bundle`",
233+
tags = [name],
234+
)
205235

206236
native.test_suite(
207237
name = name,

‎test/starlark_tests/ios_unit_test_tests.bzl‎

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -312,9 +312,39 @@ def ios_unit_test_test_suite(name):
312312
tags = [name],
313313
)
314314

315-
# TODO: b/449684779 - Check how enhanced security entitlements propagate from test to test host.
315+
archive_contents_test(
316+
name = "{}_pointer_authentication_arm64e_device_archs_with_pointer_authentication_test".format(name),
317+
build_type = "device",
318+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_unit_test",
319+
cpus = {
320+
"ios_multi_cpus": ["arm64", "arm64e"],
321+
"watchos_cpus": [],
322+
},
323+
binary_test_file = "$BINARY",
324+
binary_test_architecture = "arm64e",
325+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
326+
tags = [name],
327+
)
328+
archive_contents_test(
329+
name = "{}_pointer_authentication_arm64_device_archs_with_pointer_authentication_test".format(name),
330+
build_type = "device",
331+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_pointer_authentication_unit_test",
332+
cpus = {
333+
"ios_multi_cpus": ["arm64", "arm64e"],
334+
"watchos_cpus": [],
335+
},
336+
binary_test_file = "$BINARY",
337+
binary_test_architecture = "arm64",
338+
macho_load_commands_contain = ["cmd LC_BUILD_VERSION", "platform IOS"],
339+
tags = [name],
340+
)
316341

317-
# TODO: b/449684779 - Use arm64e support to test binary contents and how they propagate.
342+
analysis_failure_message_test(
343+
name = "{}_secure_features_disabled_at_rule_level_should_fail_test".format(name),
344+
target_under_test = "//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_unit_test_with_rule_level_disabled_features",
345+
expected_error = "Attempted to enable the secure feature `trivial_auto_var_init` for the target at `//test/starlark_tests/targets_under_test/ios:simple_enhanced_security_unit_test_with_rule_level_disabled_features.__internal__.__test_bundle`",
346+
tags = [name],
347+
)
318348

319349
native.test_suite(
320350
name = name,

‎test/starlark_tests/targets_under_test/ios/BUILD‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3649,6 +3649,58 @@ ios_ui_test(
36493649
],
36503650
)
36513651

3652+
ios_ui_test(
3653+
name = "simple_pointer_authentication_ui_test",
3654+
families = [
3655+
"iphone",
3656+
],
3657+
infoplists = [
3658+
"//test/starlark_tests/resources:Info.plist",
3659+
],
3660+
minimum_os_version = common.min_os_ios.baseline,
3661+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
3662+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
3663+
secure_features = [
3664+
"apple.xcode_26_minimum_opt_in",
3665+
"pointer_authentication",
3666+
],
3667+
tags = common.fixture_tags,
3668+
test_host = ":app",
3669+
deps = [
3670+
"//test/starlark_tests/resources:objc_test_lib",
3671+
],
3672+
)
3673+
3674+
ios_ui_test(
3675+
name = "simple_enhanced_security_ui_test_with_rule_level_disabled_features",
3676+
families = [
3677+
"iphone",
3678+
],
3679+
features = [
3680+
"-apple.xcode_26_minimum_opt_in",
3681+
"-trivial_auto_var_init",
3682+
],
3683+
infoplists = [
3684+
"//test/starlark_tests/resources:Info.plist",
3685+
],
3686+
minimum_os_version = common.min_os_ios.baseline,
3687+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
3688+
resources = [
3689+
"//test/starlark_tests/resources:example_filegroup",
3690+
"//test/starlark_tests/resources:resource_bundle",
3691+
],
3692+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
3693+
secure_features = [
3694+
"apple.xcode_26_minimum_opt_in",
3695+
"trivial_auto_var_init",
3696+
],
3697+
tags = common.fixture_tags,
3698+
test_host = ":app",
3699+
deps = [
3700+
"//test/starlark_tests/resources:objc_test_lib",
3701+
],
3702+
)
3703+
36523704
xctrunner(
36533705
name = "ui_test_xctrunner_app",
36543706
testonly = True,
@@ -3929,6 +3981,62 @@ ios_unit_test(
39293981
],
39303982
)
39313983

3984+
ios_unit_test(
3985+
name = "simple_pointer_authentication_unit_test",
3986+
families = [
3987+
"iphone",
3988+
],
3989+
infoplists = [
3990+
"//test/starlark_tests/resources:Info.plist",
3991+
],
3992+
minimum_os_version = common.min_os_ios.baseline,
3993+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
3994+
resources = [
3995+
"//test/starlark_tests/resources:example_filegroup",
3996+
"//test/starlark_tests/resources:resource_bundle",
3997+
],
3998+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
3999+
secure_features = [
4000+
"apple.xcode_26_minimum_opt_in",
4001+
"pointer_authentication",
4002+
],
4003+
tags = common.fixture_tags,
4004+
test_host = ":app",
4005+
deps = [
4006+
"//test/starlark_tests/resources:objc_test_lib",
4007+
],
4008+
)
4009+
4010+
ios_unit_test(
4011+
name = "simple_enhanced_security_unit_test_with_rule_level_disabled_features",
4012+
families = [
4013+
"iphone",
4014+
],
4015+
features = [
4016+
"-apple.xcode_26_minimum_opt_in",
4017+
"-trivial_auto_var_init",
4018+
],
4019+
infoplists = [
4020+
"//test/starlark_tests/resources:Info.plist",
4021+
],
4022+
minimum_os_version = common.min_os_ios.baseline,
4023+
provisioning_profile = "//test/testdata/provisioning:integration_testing_ios.mobileprovision",
4024+
resources = [
4025+
"//test/starlark_tests/resources:example_filegroup",
4026+
"//test/starlark_tests/resources:resource_bundle",
4027+
],
4028+
runner = "//test/starlark_tests/targets_under_test/apple:dummy_test_runner",
4029+
secure_features = [
4030+
"apple.xcode_26_minimum_opt_in",
4031+
"trivial_auto_var_init",
4032+
],
4033+
tags = common.fixture_tags,
4034+
test_host = ":app",
4035+
deps = [
4036+
"//test/starlark_tests/resources:objc_test_lib",
4037+
],
4038+
)
4039+
39324040
# ---------------------------------------------------------------------------------------
39334041
# Targets for the app/test resource deduping test.
39344042

0 commit comments

Comments
 (0)