Add a build flag to configure bundling of HSTS preload list

net/http/transport_security_state_static_unittest0.json

+// Copyright 2017 The Chromium Authors. All rights reserved.

[lgarron, 2017/07/11 19:29:04]

Could you add a comment about why such a large test is needed?

Also, is it possible to shorten it?

[xunjieli, 2017/07/11 20:27:34]

Done. These are mostly for tests in transport_security_state_unittests.cc which
depend on the default preload list being available. Some tests pick entries
rather arbitrarily (see TransportSecurityStateTest.Preloaded). I think relying
on the real preload list in unit tests is not a good idea. There are also
test-only domains (e.g. first 5 of the hsts entries) in the real preload list.
Ideally, we should move off these unit tests to not test arbitrary domains. 
These are needed by tests in transport_security_state_unittest.cc and 3 CT/HSTS
tests in url_request_unittest.cc. I have tried it to shorten it. I think this is
the shortest list.

+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This is a HSTS preloaded list used by the unittests. For more information
+// on the content and format see the comments in
+// transport_security_state_static.json.
+
+{
+  "pinsets": [
+    {
+      "name": "test",
+      "static_spki_hashes": [
+        "TestSPKI1"
+      ]
+    },
+    {
+      "name": "google",
+      "static_spki_hashes": [
+        "TestSPKI1"
+      ],
+      "report_uri": "http://clients3.google.com/cert_upload_json"
+    },
+    {
+      "name": "tor",
+      "static_spki_hashes": [
+        "TestSPKI1"
+      ]
+    },
+    {
+      "name": "twitterCom",
+      "static_spki_hashes": [
+        "TestSPKI1"
+      ],
+      "report_uri": "http://l.twimg.com/i/hpkp_report"
+    },
+    {
+      "name": "twitterCDN",
+      "static_spki_hashes": [
+        "TestSPKI1"
+      ],
+      "report_uri": "http://l.twimg.com/i/hpkp_report"
+    },
+    {
+      "name": "facebook",
+      "static_spki_hashes": [
+        "TestSPKI2"
+      ]
+    }
+  ],
+
+  "entries": [
+    { "name": "pinningtest.appspot.com", "include_subdomains": true, "pins": "test" },
+    { "name": "pinning-test.badssl.com", "include_subdomains": true, "pins": "test" },
+    { "name": "preloaded-expect-ct.badssl.com", "expect_ct": true, "expect_ct_report_uri": "https://clients3.google.com/ct_upload" },
+    { "name": "preloaded-expect-staple.badssl.com", "expect_staple": true, "expect_staple_report_uri": "https://report.badssl.com/expect-staple" },
+    { "name": "preloaded-expect-staple-include-subdomains.badssl.com", "expect_staple": true, "expect_staple_report_uri": "https://report.badssl.com/expect-staple", "include_subdomains_for_expect_staple": true },
+    { "name": "google", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "mail.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google", "expect_ct": true, "expect_ct_report_uri": "https://clients3.google.com/ct_upload" },
+    { "name": "accounts.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "appengine.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "checkout.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "chrome.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "docs.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "encrypted.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "hostedtalkgadget.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "play.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "plus.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "profiles.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "sites.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "spreadsheets.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "talkgadget.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "talk.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "wallet.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "apis.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "drive.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "googlecode.com", "include_subdomains": true, "pins": "google" },
+    { "name": "googlemail.com", "mode": "force-https", "pins": "google" },
+    { "name": "googleplex.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "groups.google.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "market.android.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "www.gmail.com", "mode": "force-https", "pins": "google" },
+    { "name": "www.googlemail.com", "mode": "force-https", "pins": "google" },
+    { "name": "google-analytics.com", "include_subdomains": true, "mode": "force-https", "pins": "google" },
+    { "name": "chart.apis.google.com", "include_subdomains": true, "pins": "google" },
+    { "name": "appspot.com", "include_subdomains": true, "pins": "google" },
+    { "name": "doubleclick.net", "include_subdomains": true, "pins": "google" },
+    { "name": "googleadservices.com", "include_subdomains": true, "pins": "google" },
+    { "name": "googleapis.com", "include_subdomains": true, "pins": "google" },
+    { "name": "google.com", "include_subdomains": true, "pins": "google" },
+    { "name": "googlegroups.com", "include_subdomains": true, "pins": "google", "expect_ct": true, "expect_ct_report_uri": "https://clients3.google.com/ct_upload" },
+    { "name": "googlesyndication.com", "include_subdomains": true, "pins": "google" },
+    { "name": "googleusercontent.com", "include_subdomains": true, "pins": "google" },
+    { "name": "gstatic.com", "include_subdomains": true, "pins": "google" },
+    { "name": "youtube.com", "include_subdomains": true, "pins": "google" },
+    { "name": "ytimg.com", "include_subdomains": true, "pins": "google" },
+    { "name": "learn.doubleclick.net", "include_subdomains": true },
+    { "name": "www.paypal.com", "mode": "force-https" },
+    { "name": "paypal.com", "mode": "force-https" },
+    { "name": "www.elanex.biz", "mode": "force-https" },
+    { "name": "sunshinepress.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "www.noisebridge.net", "mode": "force-https" },
+    { "name": "neg9.org", "mode": "force-https" },
+    { "name": "riseup.net", "include_subdomains": true, "mode": "force-https" },
+    { "name": "factor.cc", "mode": "force-https" },
+    { "name": "members.mayfirst.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "support.mayfirst.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "id.mayfirst.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "lists.mayfirst.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "aladdinschools.appspot.com", "mode": "force-https" },
+    { "name": "ottospora.nl", "include_subdomains": true, "mode": "force-https" },
+    { "name": "www.paycheckrecords.com", "mode": "force-https" },
+    { "name": "lastpass.com", "mode": "force-https" },
+    { "name": "www.lastpass.com", "mode": "force-https" },
+    { "name": "keyerror.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "entropia.de", "mode": "force-https" },
+    { "name": "www.entropia.de", "mode": "force-https" },
+    { "name": "romab.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "logentries.com", "mode": "force-https" },
+    { "name": "www.logentries.com", "mode": "force-https" },
+    { "name": "stripe.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "cloudsecurityalliance.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "login.sapo.pt", "include_subdomains": true, "mode": "force-https" },
+    { "name": "mattmccutchen.net", "include_subdomains": true, "mode": "force-https" },
+    { "name": "betnet.fr", "include_subdomains": true, "mode": "force-https" },
+    { "name": "uprotect.it", "include_subdomains": true, "mode": "force-https" },
+    { "name": "squareup.com", "mode": "force-https" },
+    { "name": "cert.se", "include_subdomains": true, "mode": "force-https" },
+    { "name": "simon.butcher.name", "include_subdomains": true, "mode": "force-https" },
+    { "name": "linx.net", "include_subdomains": true, "mode": "force-https" },
+    { "name": "dropcam.com", "mode": "force-https" },
+    { "name": "www.dropcam.com", "mode": "force-https" },
+    { "name": "ebanking.indovinabank.com.vn", "include_subdomains": true, "mode": "force-https" },
+    { "name": "epoxate.com", "mode": "force-https" },
+    { "name": "torproject.org", "mode": "force-https", "pins": "tor" },
+    { "name": "blog.torproject.org", "include_subdomains": true, "mode": "force-https", "pins": "tor" },
+    { "name": "check.torproject.org", "include_subdomains": true, "mode": "force-https", "pins": "tor" },
+    { "name": "www.torproject.org", "include_subdomains": true, "mode": "force-https", "pins": "tor" },
+    { "name": "www.moneybookers.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "ledgerscope.net", "mode": "force-https" },
+    { "name": "www.ledgerscope.net", "mode": "force-https" },
+    { "name": "app.recurly.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "api.recurly.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "greplin.com", "mode": "force-https" },
+    { "name": "www.greplin.com", "mode": "force-https" },
+    { "name": "luneta.nearbuysystems.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "ubertt.org", "include_subdomains": true, "mode": "force-https" },
+    { "name": "pixi.me", "include_subdomains": true, "mode": "force-https" },
+    { "name": "grepular.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "mydigipass.com", "mode": "force-https" },
+    { "name": "www.mydigipass.com", "mode": "force-https" },
+    { "name": "developer.mydigipass.com", "mode": "force-https" },
+    { "name": "www.developer.mydigipass.com", "mode": "force-https" },
+    { "name": "sandbox.mydigipass.com", "mode": "force-https" },
+    { "name": "www.sandbox.mydigipass.com", "mode": "force-https" },
+    { "name": "bigshinylock.minazo.net", "include_subdomains": true, "mode": "force-https" },
+    { "name": "crate.io", "include_subdomains": true, "mode": "force-https" },
+    { "name": "twitter.com", "mode": "force-https", "pins": "twitterCom" },
+    { "name": "www.twitter.com", "include_subdomains": true, "mode": "force-https", "pins": "twitterCom" },
+    { "name": "api.twitter.com", "include_subdomains": true, "pins": "twitterCDN" },
+    { "name": "oauth.twitter.com", "include_subdomains": true, "pins": "twitterCom" },
+    { "name": "mobile.twitter.com", "include_subdomains": true, "pins": "twitterCom" },
+    { "name": "dev.twitter.com", "include_subdomains": true, "pins": "twitterCom" },
+    { "name": "business.twitter.com", "include_subdomains": true, "pins": "twitterCom" },
+    { "name": "platform.twitter.com", "include_subdomains": true, "pins": "twitterCDN" },
+    { "name": "twimg.com", "include_subdomains": true, "pins": "twitterCDN" },
+    { "name": "facebook.com", "mode": "force-https", "include_subdomains_for_pinning": true, "pins": "facebook" },
+    { "name": "www.facebook.com", "include_subdomains": true, "mode": "force-https", "pins": "facebook" },
+    { "name": "recurly.com", "include_subdomains": true, "mode": "force-https" },
+    { "name": "crypto.is", "include_subdomains": true, "mode": "force-https", "expect_ct": true, "expect_ct_report_uri": "https://clients3.google.com/ct_upload" }
+  ]
+}
+