Make static (preloaded) security state generation part of the build process.

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
+import("//build/compiled_action.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//net/features.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 import("//third_party/icu/config.gni")
 import("//third_party/protobuf/proto_library.gni")
@@ skipping 97 matching lines @@
     ":net_quic_proto",
     "//crypto",
     "//crypto:platform",
   ]
 
   if (!is_nacl) {
     sources += gypi_values.net_non_nacl_sources
 
     deps += [
       "//base/third_party/dynamic_annotations",
+      "//net:generate_preload_domain_security_state",

[Ryan Sleevi, 2016/12/15 01:39:35]

The problem here is that net/http/transport_security_state_static.h is still a
dependency of the .cc, and the .cc is compiled under the NaCl targets (
https://cs.chromium.org/chromium/src/net/http/transport_security_state.cc?rcl...
)

Option 1:
Since transport_security_state.cc is part of net_nacl_common_sources, make the
build step an unconditional dependency

Option 2:
Since compiling under NaCl results in an OS_NACL define, and since you won't be
generating the .h for non-NaCl builds, wrap the #include in:
if !defined(OS_NACL)
#include ".../transport_security_state_static.h"
#endif

(see places like net/cert/ct_known_logs.h/.cc for an example of a
shared-but-not-quite example)

Your PS#2 is effectively Option 1, and I think that's good/sane/OK for now
(there's a broader question of whether we can/should trim that for NaCl, and we
probably can, but I'm not trying to treat that in this CL)

[martijnc, 2016/12/16 22:32:45]

Thanks for your feedback! I'll go for Option 1 and try to fix the linker issues.

       "//sdch",
       "//third_party/zlib",
     ]
 
     if (!use_kerberos) {
       sources -= [
         "http/http_auth_handler_negotiate.cc",
         "http/http_auth_handler_negotiate.h",
       ]
     }
@@ skipping 1944 matching lines @@
 if (host_toolchain == current_toolchain) {
   executable("domain_security_preload_generator") {
     sources = gypi_values.net_domain_security_state_generator_sources
     deps = [
       "//base",
       "//crypto",
       "//third_party/boringssl",
     ]
   }
 }
+
+compiled_action("generate_preload_domain_security_state") {
+  tool = "//net:domain_security_preload_generator"
+  inputs = [
+    "http/transport_security_state_static.json",
+    "http/transport_security_state_static.pins",
+  ]
+  outputs = [
+    "$target_gen_dir/http/transport_security_state_static.h",
+  ]
+  args = [
+    rebase_path("http/transport_security_state_static.json", root_build_dir),
+    rebase_path("http/transport_security_state_static.pins", root_build_dir),
+    rebase_path(
+        "tools/domain_security_preload_generator/resources/transport_security_state_static.template",
+        root_build_dir),
+    rebase_path("$target_gen_dir/http/transport_security_state_static.h",
+                root_build_dir),
+  ]
+}