Make static (preloaded) security state generation part of the build process.

net/BUILD.gn

Index: net/BUILD.gn
diff --git a/net/BUILD.gn b/net/BUILD.gn
index 02b77e24c9a4672499e36bebbe7f74e83fc2b920..64d8775be831f8293269cfb7cff97a61396a3124 100644
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
+import("//build/compiled_action.gni")
 import("//build/config/chromecast_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/crypto.gni")
@@ -104,6 +105,7 @@ component("net") {
     ":constants",
     ":net_resources",
     "//base",
+    "//net:generate_preload_domain_security_state",
     "//net/base/registry_controlled_domains",
     "//third_party/protobuf:protobuf_lite",
     "//url:url_features",
@@ -2084,3 +2086,23 @@ if (host_toolchain == current_toolchain) {
     ]
   }
 }
+
+compiled_action("generate_preload_domain_security_state") {
+  tool = "//net:domain_security_preload_generator"

[Ryan Sleevi, 2016/12/15 01:39:35]

Sorry, I missed this with agl@'s approval

For the BUILD.gn and related, you should considering adding brettw@ or dpranke@.
I believe we want to structure this more specifically to be

//net/tools/domain_security_preload_generator (with its own BUILD.gn) rather
than //net/BUILD.gn (but check with them), but that was their advice for the
registry controlled domain stuff.

From the error, it looks like it's propagating deps from //base(host_toolchain)
into //net(target_toolchain), and then virally on to remoting. (That is, the
glib dependencies in remoting - and the flags - are coming from //base), which
seems really weird/buggy.

+  inputs = [
+    "http/transport_security_state_static.json",
+    "http/transport_security_state_static.pins",
+  ]
+  outputs = [
+    "$target_gen_dir/http/transport_security_state_static.h",
+  ]
+  args = [
+    rebase_path("http/transport_security_state_static.json", root_build_dir),

[brettw, 2016/12/15 19:02:05]

I think it's bad for to duplicate the paths, and the .template file isn't listed
as an input so changes to that won't cause a rebuild. One way to address both of
these is:

# Inputs in order expected by the command line of the tool
inputs = [
  "http/transport_security_state_static.json",
  "http/transport_security_state_static.pins",
  "tools/domain_security_preload_generator/resources/transport_security_st
      ate_static.template"
]
outputs = ...

args = rebase_path(inputs, root_build_dir) + rebase_path(outputs,
root_build_dir)
  

[martijnc, 2016/12/16 22:32:45]

Done.

+    rebase_path("http/transport_security_state_static.pins", root_build_dir),
+    rebase_path(
+        "tools/domain_security_preload_generator/resources/transport_security_state_static.template",
+        root_build_dir),
+    rebase_path("$target_gen_dir/http/transport_security_state_static.h",
+                root_build_dir),
+  ]
+}