all: add ts_omit_tailnetlock as a start of making it build-time modular

Updates #17115

Change-Id: I6b083c0db4c4d359e49eb129d626b7f128f0a9d2
Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>

cmd/tailscale/cli/cli.go

@@ -207,10 +207,14 @@ func noDupFlagify(c *ffcli.Command) {
 	}
 }
 
-var fileCmd func() *ffcli.Command
-var sysPolicyCmd func() *ffcli.Command
-var maybeWebCmd func() *ffcli.Command
-var maybeDriveCmd func() *ffcli.Command
+var (
+	fileCmd,
+	sysPolicyCmd,
+	maybeWebCmd,
+	maybeDriveCmd,
+	maybeNetlockCmd,
+	_ func() *ffcli.Command
+)
 
 func newRootCmd() *ffcli.Command {
 	rootfs := newFlagSet("tailscale")
@@ -257,7 +261,7 @@ change in the future.
 			nilOrCall(fileCmd),
 			bugReportCmd,
 			certCmd,
-			netlockCmd,
+			nilOrCall(maybeNetlockCmd),
 			licensesCmd,
 			exitNodeCmd(),
 			updateCmd,

cmd/tailscale/cli/network-lock.go

@@ -1,6 +1,8 @@
 // Copyright (c) Tailscale Inc & AUTHORS
 // SPDX-License-Identifier: BSD-3-Clause
 
+//go:build !ts_omit_tailnetlock
+
 package cli
 
 import (
@@ -27,6 +29,10 @@ import (
 	"tailscale.com/util/prompt"
 )
 
+func init() {
+	maybeNetlockCmd = func() *ffcli.Command { return netlockCmd }
+}
+
 var netlockCmd = &ffcli.Command{
 	Name:       "lock",
 	ShortUsage: "tailscale lock <subcommand> [arguments...]",

cmd/tailscaled/deps_test.go

@@ -77,3 +77,16 @@ func TestOmitDrive(t *testing.T) {
 		},
 	}.Check(t)
 }
+
+func TestOmitTailnetLock(t *testing.T) {
+	deptest.DepChecker{
+		GOOS:   "linux",
+		GOARCH: "amd64",
+		Tags:   "ts_omit_tailnetlock,ts_include_cli",
+		OnDep: func(dep string) {
+			if strings.Contains(dep, "cbor") {
+				t.Errorf("unexpected dep with ts_omit_tailnetlock: %q", dep)
+			}
+		},
+	}.Check(t)
+}