From 1258acfed33ec4c7dbd87d207548a2cdcf2d7430 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?M=C3=A5rten=20Kongstad?= <amhk@google.com>
Date: Mon, 18 Dec 2023 13:47:57 +0100
Subject: [PATCH] Only include exported flags in android-flags.jar

The android-flags.jar file is consumed by apps built outside the
platform. These apps should only have access to exported flags (as
defined by the flag_declaration `is_exported` field).

Teach soong to filter out non-exported flags when generating
android-flags.jar.

Bug: 311151343
Test: m sdk dist # manually verify that $(gettop)/out/dist/android-flags.jar only contains exported flags
Change-Id: If66321fcffd920040dae3d99bd7ef69ff6925b18
---
 aconfig/init.go | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/aconfig/init.go b/aconfig/init.go
index 05fab4ce5..52d075572 100644
--- a/aconfig/init.go
+++ b/aconfig/init.go
@@ -71,9 +71,17 @@ var (
 	// java_aconfig_libraries to be consumed by apps built outside the
 	// platform
 	exportedJavaRule = pctx.AndroidStaticRule("exported_java_aconfig_library",
+		// For each aconfig cache file, if the cache contains any
+		// exported flags, generate Java flag lookup code for the
+		// exported flags (only). Finally collect all generated code
+		// into the ${out} JAR file.
 		blueprint.RuleParams{
 			Command: `rm -rf ${out}.tmp` +
-				`&& for cache in ${cache_files}; do ${aconfig} create-java-lib --cache $$cache --out ${out}.tmp; done` +
+				`&& for cache in ${cache_files}; do ` +
+				`  if [[ -n "$$(${aconfig} dump --cache $$cache --filter=is_exported:true --format='{fully_qualified_name}')" ]]; then ` +
+				`    ${aconfig} create-java-lib --cache $$cache --mode=exported --out ${out}.tmp; ` +
+				`  fi ` +
+				`done` +
 				`&& $soong_zip -write_if_changed -jar -o ${out} -C ${out}.tmp -D ${out}.tmp` +
 				`&& rm -rf ${out}.tmp`,
 			CommandDeps: []string{