Make static (preloaded) security state generation part of the build process.

net/BUILD.gn

 # Copyright (c) 2013 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
+import("//build/compiled_action.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/crypto.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//net/features.gni")
 import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 import("//third_party/icu/config.gni")
 import("//third_party/protobuf/proto_library.gni")
@@ skipping 81 matching lines @@
 }
 
 component("net") {
   sources = gypi_values.net_nacl_common_sources
   net_unfiltered_sources = []
 
   deps = [
     ":constants",
     ":net_resources",
     "//base",
+    "//net:generate_preload_domain_security_state",
     "//net/base/registry_controlled_domains",
     "//third_party/protobuf:protobuf_lite",
     "//url:url_features",
   ]
 
   public_deps = [
     ":net_quic_proto",
     "//crypto",
     "//crypto:platform",
   ]
@@ skipping 1960 matching lines @@
 if (host_toolchain == current_toolchain) {
   executable("domain_security_preload_generator") {
     sources = gypi_values.net_domain_security_state_generator_sources
     deps = [
       "//base",
       "//crypto",
       "//third_party/boringssl",
     ]
   }
 }
+
+compiled_action("generate_preload_domain_security_state") {
+  tool = "//net:domain_security_preload_generator"

[Ryan Sleevi, 2016/12/15 01:39:35]

Sorry, I missed this with agl@'s approval

For the BUILD.gn and related, you should considering adding brettw@ or dpranke@.
I believe we want to structure this more specifically to be

//net/tools/domain_security_preload_generator (with its own BUILD.gn) rather
than //net/BUILD.gn (but check with them), but that was their advice for the
registry controlled domain stuff.

From the error, it looks like it's propagating deps from //base(host_toolchain)
into //net(target_toolchain), and then virally on to remoting. (That is, the
glib dependencies in remoting - and the flags - are coming from //base), which
seems really weird/buggy.

+  inputs = [
+    "http/transport_security_state_static.json",
+    "http/transport_security_state_static.pins",
+  ]
+  outputs = [
+    "$target_gen_dir/http/transport_security_state_static.h",
+  ]
+  args = [
+    rebase_path("http/transport_security_state_static.json", root_build_dir),

[brettw, 2016/12/15 19:02:05]

I think it's bad for to duplicate the paths, and the .template file isn't listed
as an input so changes to that won't cause a rebuild. One way to address both of
these is:

# Inputs in order expected by the command line of the tool
inputs = [
  "http/transport_security_state_static.json",
  "http/transport_security_state_static.pins",
  "tools/domain_security_preload_generator/resources/transport_security_st
      ate_static.template"
]
outputs = ...

args = rebase_path(inputs, root_build_dir) + rebase_path(outputs,
root_build_dir)
  

[martijnc, 2016/12/16 22:32:45]

Done.

+    rebase_path("http/transport_security_state_static.pins", root_build_dir),
+    rebase_path(
+        "tools/domain_security_preload_generator/resources/transport_security_state_static.template",
+        root_build_dir),
+    rebase_path("$target_gen_dir/http/transport_security_state_static.h",
+                root_build_dir),
+  ]
+}