forked from chromium/chromium
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[email protected] BUG=524256 Review URL: https://codereview.chromium.org/1319543002 Cr-Commit-Position: refs/heads/master@{#345360}
- Loading branch information
Showing
11 changed files
with
435 additions
and
237 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,31 @@ | ||
| # Introduction | ||
|
|
||
| This page is meant to help keep track of [TPM](Glossary.md) use across the system. It may not be up-to-date at any given point, but it's a wiki so you know what to do. | ||
|
|
||
| # Details | ||
|
|
||
| * TPM ownership management: | ||
| > > http://git.chromium.org/gitweb/?p=chromiumos/platform/cryptohome.git;a=blob;f=README.tpm | ||
| * TPM\_Clear is done (as in vboot\_reference) but in the firmware code itself on switch between dev and verified modes and in recovery. (TODO: link code) | ||
|
|
||
| * TPM owner password clearing (triggered at sign-in by chrome): | ||
| > > http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=blob;f=chrome/browser/chromeos/login/login_utils.cc;h=9c4564e074c650bd91c27243c589d603740793bb;hb=HEAD#l861 | ||
| * PCR extend (no active use elsewhere): | ||
| > > http://git.chromium.org/gitweb/?p=chromiumos/platform/vboot_reference.git;a=blob;f=firmware/lib/tpm_bootmode.c | ||
| * NVRAM use for OS rollback attack protection: | ||
| > > http://git.chromium.org/gitweb/?p=chromiumos/platform/vboot_reference.git;a=blob;f=firmware/lib/rollback_index.c | ||
| * Tamper evident storage: | ||
| > > http://git.chromium.org/gitweb/?p=chromiumos/platform/cryptohome.git;a=blob;f=README.lockbox | ||
| * Tamper-evident storage for avoiding runtime device management mode changes: | ||
| > > http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=blob;f=chrome/browser/chromeos/login/enrollment/enterprise_enrollment_screen.cc | ||
| * User key/passphrase and cached data protection: | ||
| > > http://git.chromium.org/gitweb/?p=chromiumos/platform/cryptohome.git;a=blob;f=README.homedirs | ||
| * A TPM in a Chrome device has an EK certificate that is signed by an intermediate certificate authority that is dedicated to the specific TPMs allocated for use in Chrome devices. OS-level self-validation of the platform TPM should be viable with this or chaining any other trust expectations. | ||
|
|
||
| * TPM is used for per-user certificate storage (NSS+PKCS#11) using opencryptoki but soon to be replaced by chaps. Update links here when chaps stabilizes (Each user's pkcs#11 key store is kept in their homedir to ensure it is tied to the local user account) This functionality includes VPN and 802.1x-related keypairs. | ||
| # TPM Quick ref | ||
|
|
||
| TODO: this page looks very outdated. glossary.md does not exist, | ||
| git.chromium.org does not exist. Delete it? | ||
|
|
||
| This page is meant to help keep track of TPM use across the system. It may not | ||
| be up-to-date at any given point, but it's a wiki so you know what to do. | ||
|
|
||
| ## Details | ||
|
|
||
| * [TPM ownership management](http://git.chromium.org/gitweb/?p=chromiumos/platform/cryptohome.git;a=blob;f=README.tpm) | ||
| * TPM_Clear is done (as in vboot_reference) but in the firmware code itself on | ||
| switch between dev and verified modes and in recovery. (TODO: link code) | ||
| * [TPM owner password clearing](http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=blob;f=chrome/browser/chromeos/login/login_utils.cc;h=9c4564e074c650bd91c27243c589d603740793bb;hb=HEAD#l861) | ||
| (triggered at sign-in by chrome): | ||
| * [PCR extend](http://git.chromium.org/gitweb/?p=chromiumos/platform/vboot_reference.git;a=blob;f=firmware/lib/tpm_bootmode.c) | ||
| (no active use elsewhere): | ||
| * [NVRAM use for OS rollback attack protection](http://git.chromium.org/gitweb/?p=chromiumos/platform/vboot_reference.git;a=blob;f=firmware/lib/rollback_index.c) | ||
| * [Tamper evident storage](http://git.chromium.org/gitweb/?p=chromiumos/platform/cryptohome.git;a=blob;f=README.lockbox) | ||
| * [Tamper-evident storage for avoiding runtime device management mode changes](http://git.chromium.org/gitweb/?p=chromium/chromium.git;a=blob;f=chrome/browser/chromeos/login/enrollment/enterprise_enrollment_screen.cc) | ||
| * [User key/passphrase and cached data protection](http://git.chromium.org/gitweb/?p=chromiumos/platform/cryptohome.git;a=blob;f=README.homedirs) | ||
| * A TPM in a Chrome device has an EK certificate that is signed by an | ||
| intermediate certificate authority that is dedicated to the specific TPMs | ||
| allocated for use in Chrome devices. OS-level self-validation of the | ||
| platform TPM should be viable with this or chaining any other trust | ||
| expectations. | ||
| * TPM is used for per-user certificate storage (NSS+PKCS#11) using | ||
| opencryptoki but soon to be replaced by chaps. Update links here when chaps | ||
| stabilizes (Each user's pkcs#11 key store is kept in their homedir to ensure | ||
| it is tied to the local user account). This functionality includes VPN and | ||
| 802.1x-related keypairs. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,24 @@ | ||
| # Updating clang | ||
|
|
||
| 1. Sync your Chromium tree to the latest revision to pick up any plugin changes and test the new compiler against ToT | ||
| 1. Update clang revision in tools/clang/scripts/update.sh, upload CL to rietveld | ||
| 1. Run tools/clang/scripts/package.py to create a tgz of the binary (mac and linux) | ||
| 1. Do a local clobber build with that clang (mac and linux). Check that everything builds fine and no new warnings appear. (Optional if the revision picked in 1 was vetted by other means already.) | ||
| 1. Upload the binaries using gsutil, they will appear at http://commondatastorage.googleapis.com/chromium-browser-clang/index.html | ||
| 1. Run goma package update script to push these packages to goma, send email | ||
| 1. `git cl try -m tryserver.chromium.mac -b mac_chromium_rel_ng -b mac_chromium_asan_rel_ng -b mac_chromium_gn_dbg -b ios_rel_device_ninja && git cl try -m tryserver.chromium.linux -b linux_chromium_gn_dbg -b linux_chromium_chromeos_dbg_ng -b linux_chromium_asan_rel_ng -b linux_chromium_chromeos_asan_rel_ng -b android_clang_dbg_recipe -b linux_chromium_trusty32_rel -b linux_chromium_rel_ng && git cl try -m tryserver.blink -b linux_blink_rel` | ||
| 1. Commit roll CL from the first step | ||
| 1. The bots will now pull the prebuilt binary, and goma will have a matching binary, too. | ||
| 1. Sync your Chromium tree to the latest revision to pick up any plugin | ||
| changes and test the new compiler against ToT | ||
| 1. Update clang revision in tools/clang/scripts/update.sh, upload CL to | ||
| rietveld | ||
| 1. Run tools/clang/scripts/package.py to create a tgz of the binary (mac and | ||
| linux) | ||
| 1. Do a local clobber build with that clang (mac and linux). Check that | ||
| everything builds fine and no new warnings appear. (Optional if the | ||
| revision picked in 1 was vetted by other means already.) | ||
| 1. Upload the binaries using gsutil, they will appear at | ||
| http://commondatastorage.googleapis.com/chromium-browser-clang/index.html | ||
| 1. Run goma package update script to push these packages to goma, send email | ||
| 1. `git cl try -m tryserver.chromium.mac -b mac_chromium_rel_ng -b | ||
| mac_chromium_asan_rel_ng -b mac_chromium_gn_dbg -b ios_rel_device_ninja && | ||
| git cl try -m tryserver.chromium.linux -b linux_chromium_gn_dbg -b | ||
| linux_chromium_chromeos_dbg_ng -b linux_chromium_asan_rel_ng -b | ||
| linux_chromium_chromeos_asan_rel_ng -b android_clang_dbg_recipe -b | ||
| linux_chromium_trusty32_rel -b linux_chromium_rel_ng && git cl try -m | ||
| tryserver.blink -b linux_blink_rel` | ||
| 1. Commit roll CL from the first step | ||
| 1. The bots will now pull the prebuilt binary, and goma will have a matching | ||
| binary, too. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,32 +1,49 @@ | ||
| # Introduction | ||
| # Use FindBugs for Android | ||
|
|
||
| [FindBugs](http://findbugs.sourceforge.net) is an open source static analysis tool from the University of Maryland that looks for potential bugs in Java class files. We have some scripts to run it over the Java code at build time. | ||
| [FindBugs](http://findbugs.sourceforge.net) is an open source static analysis | ||
| tool from the University of Maryland that looks for potential bugs in Java class | ||
| files. We have some scripts to run it over the Java code at build time. | ||
|
|
||
| # How To Run | ||
| ## How To Run | ||
|
|
||
| For gyp builds, add `run_findbugs=1` to your `GYP_DEFINES`. | ||
|
|
||
| For gn builds, add `run_findbugs=true` to the args you pass to `gn gen`: | ||
|
|
||
| ``` | ||
| gn gen --args='target_os="android" run_findbugs=true' | ||
| ``` | ||
| gn gen --args='target_os="android" run_findbugs=true' | ||
|
|
||
| Note that running findbugs will add time to your build. The amount of additional time required depends on the number of targets on which findbugs runs, though it will usually be between 1-10 minutes. | ||
| Note that running findbugs will add time to your build. The amount of additional | ||
| time required depends on the number of targets on which findbugs runs, though it | ||
| will usually be between 1-10 minutes. | ||
|
|
||
| Some of the warnings are false positives. In general, they should be suppressed using [@SuppressFBWarnings](https://code.google.com/p/chromium/codesearch#chromium/src/base/android/java/src/org/chromium/base/annotations/SuppressFBWarnings.java). In the rare event that a warning should be suppressed across the entire code base, it should be added to the [exclusion file](https://code.google.com/p/chromium/codesearch#chromium/src/build/android/findbugs_filter/findbugs_exclude.xml) instead. If you modify this file: | ||
| Some of the warnings are false positives. In general, they should be suppressed | ||
| using | ||
| [@SuppressFBWarnings](https://code.google.com/p/chromium/codesearch#chromium/src/base/android/java/src/org/chromium/base/annotations/SuppressFBWarnings.java). | ||
| In the rare event that a warning should be suppressed across the entire | ||
| code base, it should be added to the | ||
| [exclusion file](https://code.google.com/p/chromium/codesearch#chromium/src/build/android/findbugs_filter/findbugs_exclude.xml) | ||
| instead. If you modify this file: | ||
|
|
||
| * Include a comment that says what you're suppressing and why. | ||
| * The existing suppressions should give you an idea of the syntax. See also the FindBugs documentation. Note that the documentation doesn't seem totally accurate (there's probably some version skew between the online docs and the version of FindBugs we're using) so you may have to experiment a little. | ||
| * Include a comment that says what you're suppressing and why. | ||
| * The existing suppressions should give you an idea of the syntax. See also | ||
| the FindBugs documentation. Note that the documentation doesn't seem totally | ||
| accurate (there's probably some version skew between the online docs and the | ||
| version of FindBugs we're using) so you may have to experiment a little. | ||
|
|
||
| # Chromium's [FindBugs](http://findbugs.sourceforge.net) plugin | ||
|
|
||
| We have [FindBugs plugin](https://code.google.com/p/chromium/codesearch#chromium/src/tools/android/findbugs_plugin/) to enforce chromium specific Java rules. It currently detects: | ||
| * Synchronized method | ||
| * Synchronized this | ||
| We have | ||
| [FindBugs plugin](https://code.google.com/p/chromium/codesearch#chromium/src/tools/android/findbugs_plugin/) | ||
| to enforce chromium specific Java rules. It currently detects: | ||
|
|
||
| * Synchronized method | ||
| * Synchronized this | ||
|
|
||
| # [FindBugs](http://findbugs.sourceforge.net) on the Bots | ||
|
|
||
| [FindBugs](http://findbugs.sourceforge.net) is configured to run on: | ||
| * [android\_clang\_dbg\_recipe](http://build.chromium.org/p/tryserver.chromium.linux/builders/android_clang_dbg_recipe) on the commit queue | ||
| * [Android Clang Builder (dbg)](http://build.chromium.org/p/chromium.linux/builders/Android%20Clang%20Builder%20(dbg)) on the main waterfall | ||
|
|
||
| * [android_clang_dbg_recipe](http://build.chromium.org/p/tryserver.chromium.linux/builders/android_clang_dbg_recipe) | ||
| on the commit queue | ||
| * [Android Clang Builder (dbg)](http://build.chromium.org/p/chromium.linux/builders/Android%20Clang%20Builder%20\(dbg\)) | ||
| on the main waterfall |
Oops, something went wrong.