..system-verilog-unbalanced-endif-in-protected-envelope.md

slang solution1.sv --enable-legacy-protect -I . -Wno-protected-envelope
slang solution2.sv --enable-legacy-protect -I . -Wno-protected-envelope --translate-off-format slang_pragma,translate_off,translate_on

.envrc

use nix -p sv-lang

endif.inc

`endif

solution1.sv

// problem: the protected envelope (which we can't read) contains the `endif
// corresponding to the WHATEVER `ifdef
//
// we would like for slang to be able to _parse_ this file despite it not having
// the keys to decrypt and process this protected envelope
//
// however we want tools that are able to decrypt this protected envelope to
// continue to be able to parse this file
//
// we essentially want to "conditionally" insert an `endif
//
// note: some tools have explicit handling for this sort of thing (imo, a bug
// in system verilog "encryption" tools):
//  - https://eda.amiq.com/documentation/eclipse/sv/toc/application-notes/encrypted_vip.html
//    + see "Asymmetric encryption "
//  - (h/t: @scolem2)

/*
`ifdef WHATEVER

`protected
redacted
`endprotected
*/


// some ideas:
//   1. hide an `endif behind an `include; apply it conditionally
//   2. use `translate_off` pragmas
//      + i.e. `--translate-off-format slang_pragma,translate_off,translate_on`
//   3. have a followup encrypted block that only slang has the keys for?
//      + if other tools error on envelopes they can't decrypt this won't work

////////////////////////////////////////////////////////////////////////////////

`ifdef WHATEVER

`elsif __slang__
`include "endif.inc"

`protected
redacted
`endprotected

// NOTE: this is "unsafe" if the contents of the protected envelope don't begin
// with `endif or `elsif
//
// we'd be changing the semantics such that those leading tokens are now *not*
// applied when `WHATEVER` is set

////////////////////////////////////////////////////////////////////////////////

// alternative formulation:

`define __true
`ifdef __true

`ifdef WHATEVER

`protected
redacted
`endprotected

// at this point, from slang's perspective we're two conditionals deep
// from the perspective of a tool that can decrypt ^, we're 1 conditional deep

`elsif __slang__
//  slang will interpret ^ as attached to `WHATEVER`, causing it to follow the
//  include below
//
//  tools that can decrypt will interpret ^ as attached to `__true` causing it
//  to ignore the include below

`include "endif.inc"
//  at this point both slang and tools that can decrypt think we're 1 cond deep

`endif // fin

solution2.sv

// (see `solution1.sv` for context)

////////////////////////////////////////////////////////////////////////////////

// Solution 2:
// slang_pragma translate_off
`ifdef WHATEVER
// slang_pragma translate_on

`protected
redacted
`endprotected