builder.py: use anchored globbing to match DEFAULT_INSTALL_MASK

We exclude files according to DEFAULT_INSTALL_MASK for binpkgs that
gmerge generates.  Using unanchored globbing for the exclusion results
in unwanted exclusion; for example, the entry "/firmware" will exclude
both "/firmware" and "/lib/firmware", the latter of which we want to
keep, as its prefix is not wildcarded.

This change adds the "--anchored" flag to the tar command to make sure
we match a prefix of the file's path.

BUG=chromium-os:21099 (firmware packaging issues)
TEST=local build, run on host machine

Change-Id: Iaf2fc8092ebd7a1bbaa6330d0d6035a651c1215f
Reviewed-on: https://gerrit.chromium.org/gerrit/44614
Commit-Queue: John Sheu <sheu@chromium.org>
Reviewed-by: John Sheu <sheu@chromium.org>
Tested-by: John Sheu <sheu@chromium.org>
diff --git a/builder.py b/builder.py
index 6e246fb..0530136 100644
--- a/builder.py
+++ b/builder.py
@@ -63,8 +63,8 @@
   # so that we delete the directory itself when the '/usr/include/' path is
   # given.
   masks = [mask.strip('/') for mask in masks]
-  masks = ['--exclude="' + mask + '"' for mask in masks]
-  excludes = ' '.join(masks)
+  masks = ['--exclude="./%s"' % mask for mask in masks]
+  excludes = '--anchored ' + ' '.join(masks)
 
   gmerge_dir = os.path.dirname(out_path)
   subprocess.check_call(['mkdir', '-p', gmerge_dir])