Move the GN exec_script whitelist for //build into //build.

.gn

 # This file is used by the GN meta build system to find the root of the source
 # tree and to set startup options. For documentation on the values set in this
 # file, run "gn help dotfile" at the command line.
 
 # The location of the build configuration file.
 buildconfig = "//build/config/BUILDCONFIG.gn"
 
 # The secondary source root is a parallel directory tree where
 # GN build files are placed when they can not be placed directly
 # in the source tree, e.g. for third party source trees.
@@ skipping 197 matching lines @@
 #    - It's easy to screw up. One common case is a build-time script that packs
 #      up a directory. The author notices that the script isn't re-run when the
 #      directory is updated, so adds a glob so all the files are listed as
 #      inputs. This seems to work great... until a file is deleted. When a
 #      file is deleted, all the inputs the glob lists will still be up to date
 #      and no command-lines will have been changed. The action will not be
 #      re-run and the build will be broken. It is possible to get this correct
 #      using glob, and it's possible to mess it up without glob, but globs make
 #      this situation much easier to create. if the build always lists the
 #      files and passes them to a script, it will always be correct.
-exec_script_whitelist = [
-  "//android_webview/BUILD.gn",
-  "//build_overrides/build.gni",
-  "//build/config/BUILD.gn",
-  "//build/config/android/config.gni",
-  "//build/config/android/internal_rules.gni",
-  "//build/config/android/rules.gni",
-  "//build/config/compiler/BUILD.gn",
-  "//build/config/gcc/gcc_version.gni",
-  "//build/config/ios/ios_sdk.gni",
-  "//build/config/linux/BUILD.gn",
-  "//build/config/linux/pkg_config.gni",
-  "//build/config/linux/atk/BUILD.gn",
-  "//build/config/mac/mac_sdk.gni",
-  "//build/config/mac/rules.gni",
-  "//build/config/posix/BUILD.gn",
-  "//build/config/sysroot.gni",
-  "//build/config/win/BUILD.gn",
-  "//build/config/win/visual_studio_version.gni",
-  "//build/toolchain/concurrent_links.gni",
-  "//build/toolchain/mac/BUILD.gn",
-  "//build/toolchain/nacl/BUILD.gn",
-  "//build/toolchain/toolchain.gni",
-  "//build/toolchain/win/BUILD.gn",
-  "//build/util/branding.gni",
-  "//build/util/version.gni",
-  "//chromeos/BUILD.gn",
 
-  # TODO(dgn): Layer violation but breaks the build otherwise, see
-  # https://crbug.com/474506
-  "//clank/java/BUILD.gn",
-  "//clank/native/BUILD.gn",
+# Pull in the stock list of exclusions for //build.
+import("//build/dot_gn.gni")

[brettw, 2016/11/18 22:12:00]

I'd prefer this goes at the top. I actually don't think you need the comment.

 
-  "//jingle/BUILD.gn",
-  "//net/BUILD.gn",
-  "//remoting/host/installer/linux/BUILD.gn",
-  "//remoting/remoting_version.gni",
-  "//remoting/host/installer/win/generate_clsids.gni",
-  "//third_party/angle/BUILD.gn",
-  "//third_party/angle/src/tests/BUILD.gn",
-  "//third_party/angle/src/vulkan_support/BUILD.gn",
-  "//third_party/catapult/tracing/BUILD.gn",
-  "//third_party/google_input_tools/inputview.gni",
-  "//third_party/skia/gn/shared_sources.gni",
+exec_script_whitelist =

[brettw, 2016/11/18 22:12:00]

I'd like a comment here instead saying that whitelist values for //build go in
that file for sharing with other projects, and these are the non-build ones for
the Chrome repo.

+    build_dot_gn.exec_script_whitelist + [

[Dirk Pranke, 2016/11/17 23:26:37]

We could generalize this pattern and provide build_dot_gn values for
buildconfig, check_targets, and secondary_source as well.

+      "//android_webview/BUILD.gn",
+      "//build_overrides/build.gni",
+      "//chromeos/BUILD.gn",
 
-  # CLD2 should be removed soon, delete this when we do.
-  "//third_party/cld_2/BUILD.gn",
-  "//tools/grit/grit_rule.gni",
+      # TODO(dgn): Layer violation but breaks the build otherwise, see
+      # https://crbug.com/474506
+      "//clank/java/BUILD.gn",
+      "//clank/native/BUILD.gn",
 
-  # Not gypi-to-gn.
-  "//google_apis/BUILD.gn",
-  "//printing/BUILD.gn",
-]
+      "//jingle/BUILD.gn",
+      "//net/BUILD.gn",
+      "//remoting/host/installer/linux/BUILD.gn",
+      "//remoting/remoting_version.gni",
+      "//remoting/host/installer/win/generate_clsids.gni",
+      "//third_party/angle/BUILD.gn",
+      "//third_party/angle/src/tests/BUILD.gn",
+      "//third_party/angle/src/vulkan_support/BUILD.gn",
+      "//third_party/catapult/tracing/BUILD.gn",
+      "//third_party/google_input_tools/inputview.gni",
+      "//third_party/skia/gn/shared_sources.gni",

[mtklein_C, 2016/11/18 00:19:43]

FWIW, this no longer execs any scripts.  We can probably remove it from the
whitelist whenever you like.

[Dirk Pranke, 2016/11/19 05:03:58]

Acknowledged.

+
+      # CLD2 should be removed soon, delete this when we do.
+      "//third_party/cld_2/BUILD.gn",
+      "//tools/grit/grit_rule.gni",
+
+      # Not gypi-to-gn.
+      "//google_apis/BUILD.gn",
+      "//printing/BUILD.gn",
+    ]