From b03e60a836547f6696974c7972a17998f6e0cfae Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 16 Sep 2025 22:07:19 +0200 Subject: [PATCH 1/5] Have --list print a relative path in the common case When the current directory is the project root, have `--list` print relative paths, rather than absolute paths that start with `build_treeguess_project_root()`. This is not only nice to humans, but also necessary for `make_generated_files.py --root DIR --check`: it calls this script with `--list` and expects a path that is relative to DIR, not an absolute path that is under the project root. Signed-off-by: Gilles Peskine --- scripts/mbedtls_framework/config_checks_generator.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/scripts/mbedtls_framework/config_checks_generator.py b/scripts/mbedtls_framework/config_checks_generator.py index 40b720e45..f55c061cb 100644 --- a/scripts/mbedtls_framework/config_checks_generator.py +++ b/scripts/mbedtls_framework/config_checks_generator.py @@ -208,6 +208,17 @@ def generate_header_files(branch_data: BranchData, def main(branch_data: BranchData) -> None: root = build_tree.guess_project_root() + # Is root the current directory? The safe default is no, so compare + # the paths, rather than calling `os.samefile()` which can have false + # positives and can fail in edge cases. + if root == os.getcwd(): + # Be nice and use a relative path when it's simple to do so. + # (build_tree.guess_project_root() should probably do this, actually.) + # This is not only nice to humans, but also necessary for + # `make_generated_files.py --root DIR --check`: it calls + # this script with `--list` and expects a path that is relative + # to DIR, not an absolute path that is under the project root. + root = os.curdir parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('--list', action='store_true', help='List generated files and exit') From 06f9c84203cf3a1af14b8777f653d3c4910fe179 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 17 Sep 2025 11:33:21 +0200 Subject: [PATCH 2/5] Friendlier error if a file doesn't exist Signed-off-by: Gilles Peskine --- scripts/make_generated_files.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/make_generated_files.py b/scripts/make_generated_files.py index cd60b087f..49c98a403 100755 --- a/scripts/make_generated_files.py +++ b/scripts/make_generated_files.py @@ -205,6 +205,8 @@ def check_generated_files(generation_scripts: List[GenerationScript], root: Path for generation_script in generation_scripts: for file in generation_script.files: file = root / file + if not file.exists(): + raise Exception(f"Expected generated file does not exist: {file}") bak_file = file.with_name(file.name + ".bak") if bak_file.exists(): bak_file.unlink() From e2c15fbd66ffe5063595d6f2a3ffdbe10124c3a8 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 17 Sep 2025 11:36:13 +0200 Subject: [PATCH 3/5] Allow some generated files not to exist When we add a new generation script in crypto, there is a transition period when mbedtls does not yet know that it has to run this script. For this transition period, we can declare the script as optional, and `make_generated_files.py --check` will not complain if the files are missing. Apply this, right now, to `scripts/generate_config_checks.py`, which is being introduced in TF-PSA-Crypto. Signed-off-by: Gilles Peskine --- scripts/make_generated_files.py | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/scripts/make_generated_files.py b/scripts/make_generated_files.py index 49c98a403..7f6bc7878 100755 --- a/scripts/make_generated_files.py +++ b/scripts/make_generated_files.py @@ -27,7 +27,8 @@ class GenerationScript: # pylint: disable=too-few-public-methods def __init__(self, script: Path, files: List[Path], output_dir_option: Optional[str] = None, - output_file_option: Optional[str] = None): + output_file_option: Optional[str] = None, + optional: bool = False): # Path from the root of Mbed TLS or TF-PSA-Crypto of the generation script self.script = script @@ -49,6 +50,12 @@ class GenerationScript: # positional argument. self.output_file_option = output_file_option + # Optional files are skipped in --check mode if they don't exist. + # This normally shouldn't happen, but it can happen during transition + # periods where we're adding a new script or a new file, and a + # consuming repository hasn't been updated yet. + self.optional = optional + def get_generation_script_files(generation_script: str): """ Get the list of the default paths of the files that a given script @@ -77,7 +84,8 @@ if os.path.exists("scripts/generate_config_checks.py"): COMMON_GENERATION_SCRIPTS.append(GenerationScript( Path("scripts/generate_config_checks.py"), get_generation_script_files("scripts/generate_config_checks.py"), - "", None)) + output_dir_option="", + optional=True)) if build_tree.looks_like_tf_psa_crypto_root("."): TF_PSA_CRYPTO_GENERATION_SCRIPTS = [ @@ -206,6 +214,13 @@ def check_generated_files(generation_scripts: List[GenerationScript], root: Path for file in generation_script.files: file = root / file if not file.exists(): + # If the script is just being added, allow its files not + # to exist. This can happen, at least, when adding a new + # generation script in crypto: until mbedtls is updated, + # the files from that script won't be present when + # the updated crypto is built from mbedtls development. + if generation_script.optional: + continue raise Exception(f"Expected generated file does not exist: {file}") bak_file = file.with_name(file.name + ".bak") if bak_file.exists(): From 302015e0d431b8b4325148347bb0ce5d821c09e5 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 17 Sep 2025 12:30:09 +0200 Subject: [PATCH 4/5] Silence pylint Signed-off-by: Gilles Peskine --- scripts/make_generated_files.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/make_generated_files.py b/scripts/make_generated_files.py index 7f6bc7878..5e94442cd 100755 --- a/scripts/make_generated_files.py +++ b/scripts/make_generated_files.py @@ -24,7 +24,7 @@ class GenerationScript: """ Representation of a script generating a configuration independent file. """ - # pylint: disable=too-few-public-methods + # pylint: disable=too-few-public-methods,too-many-arguments def __init__(self, script: Path, files: List[Path], output_dir_option: Optional[str] = None, output_file_option: Optional[str] = None, From 37f6573319f9b3df05ec3a8f597e68ba65940483 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 17 Sep 2025 13:09:00 +0200 Subject: [PATCH 5/5] Allow some generated files not to exist is bak Signed-off-by: Gilles Peskine --- scripts/make_generated_files.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/scripts/make_generated_files.py b/scripts/make_generated_files.py index 5e94442cd..42b7a7c54 100755 --- a/scripts/make_generated_files.py +++ b/scripts/make_generated_files.py @@ -239,6 +239,10 @@ def check_generated_files(generation_scripts: List[GenerationScript], root: Path for file in generation_script.files: file = root / file bak_file = file.with_name(file.name + ".bak") + if generation_script.optional and not bak_file.exists(): + # This file is optional and didn't exist before, so + # there's nothing to compare to, or clean up. + continue if not filecmp.cmp(file, bak_file): ref_file = file.with_name(file.name + ".ref") ref_file = root / ref_file