optionally error on files outside of known roots

The goal of this change is to provide a means for disallowing
files outside of declared, known locations in order to better
enforce the hermeticy and in turn reproducability of builds.
Previously when encountering these files (typically via external
symlinks) we would add a dependency on build_id, now we can
optionally fail the build.

--
MOS_MIGRATED_REVID=90015665

1 files changed, 11 insertions, 4 deletions

diff --git a/src/main/java/com/google/devtools/build/lib/skyframe/DirectoryListingStateFunction.java b/src/main/java/com/google/devtools/build/lib/skyframe/DirectoryListingStateFunction.java
index 6e47a2d54b..b5a87a84ef 100644
--- a/src/main/java/com/google/devtools/build/lib/skyframe/DirectoryListingStateFunction.java
+++ b/src/main/java/com/google/devtools/build/lib/skyframe/DirectoryListingStateFunction.java
@@ -39,12 +39,15 @@ public class DirectoryListingStateFunction implements SkyFunction {
   public SkyValue compute(SkyKey skyKey, Environment env)
       throws DirectoryListingStateFunctionException {
     RootedPath dirRootedPath = (RootedPath) skyKey.argument();
-    externalFilesHelper.maybeAddDepOnBuildId(dirRootedPath, env);
-    if (env.valuesMissing()) {
-      return null;
-    }
+
     try {
+      externalFilesHelper.maybeHandleExternalFile(dirRootedPath, env);
+      if (env.valuesMissing()) {
+        return null;
+      }
       return DirectoryListingStateValue.create(dirRootedPath);
+    } catch (FileOutsidePackageRootsException e) {
+      throw new DirectoryListingStateFunctionException(e);
     } catch (IOException e) {
       throw new DirectoryListingStateFunctionException(e);
     }
@@ -64,5 +67,9 @@ public class DirectoryListingStateFunction implements SkyFunction {
     public DirectoryListingStateFunctionException(IOException e) {
       super(e, Transience.TRANSIENT);
     }
+
+    public DirectoryListingStateFunctionException(FileOutsidePackageRootsException e) {
+      super(e, Transience.PERSISTENT);
+    }
   }
 }