Mirror upstream's codesign requirements in BraveUpdater (#28591)

DEPS

@@ -90,7 +90,7 @@ hooks = [
     'pattern': '.',
     'condition': 'checkout_mac',
     'action': ['vpython3', 'build/download_dep.py',
-               'omaha4/BraveUpdater-132.1.76.11.zip',
+               'omaha4/BraveUpdater-136.1.79.71.zip',
                '//third_party/updater/chrome_mac_universal_prod/cipd'],
   },
   {

build/mac/BUILD.gn

@@ -13,8 +13,7 @@ import("//chrome/version.gni")
 import("//components/crx_file/crx3.gni")
 import("//third_party/widevine/cdm/widevine.gni")
 
-packaging_dir = "$root_out_dir/" +
-                string_replace("$chrome_product_full_name Packaging", " ", "_")
+packaging_dir = "$root_out_dir/$chrome_product_full_name Packaging"
 packaging_out_dir = "$root_out_dir/packaged"
 
 unsigned_app_path = "$root_out_dir/$brave_exe"
@@ -270,6 +269,18 @@ if (install_omaha4_with_pkg) {
   }
 }
 
+if (is_official_build && !skip_signing) {
+  if (is_release_channel) {
+    provisionprofile_basename = "release"
+  } else {
+    provisionprofile_basename = brave_channel
+  }
+  copy("copy_provisionprofile") {
+    sources = [ "${provisionprofile_basename}.provisionprofile" ]
+    outputs = [ "${packaging_dir}/${provisionprofile_basename}.9c57a508dc89402964eb013d30ef6df4da849aa9.provisionprofile" ]
+  }
+}
+
 action("package") {
   outputs = [
     upstream_dmg_path,
@@ -303,13 +314,14 @@ action("package") {
     "--identity=$mac_signing_identifier",
     "--installer-identity=$installer_identity",
   ]
-  if (is_official_build) {
-    deps += [ ":copy_provisionprofile" ]
-  } else {
+  if (!is_official_build) {
     args += [ "--development" ]
   }
   if (skip_signing) {
     args += [ "--skip_signing" ]
+  } else if (is_official_build) {
+    deps += [ ":copy_provisionprofile" ]
+    args += [ "--provisioning_profile_basename=$provisionprofile_basename" ]
   }
   if (notarize) {
     args += [ "--notarize" ]
@@ -376,18 +388,6 @@ copy("copy_helper_entitlements") {
   outputs = [ "$packaging_dir/{{source_file_part}}" ]
 }
 
-if (is_official_build) {
-  copy("copy_provisionprofile") {
-    if (is_release_channel) {
-      channel_nonempty = "release"
-    } else {
-      channel_nonempty = brave_channel
-    }
-    sources = [ "${channel_nonempty}.provisionprofile" ]
-    outputs = [ "${packaging_dir}/${channel_nonempty}.9c57a508dc89402964eb013d30ef6df4da849aa9.provisionprofile" ]
-  }
-}
-
 group("create_dist_mac") {
   deps = [
     ":copy_dmg",

build/mac/signing/internal_config.py

@@ -37,19 +37,9 @@ class InternalCodeSignConfig(ChromiumCodeSignConfig):
                          package_as_zip=True)
         ]
 
-    @property
-    def codesign_requirements_outer_app(self):
-        return 'designated => identifier "' + self.base_bundle_id + '"'
-
-    @property
-    def codesign_requirements_basic(self):
-        return 'and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = KL8N8XSYF4'  # pylint: disable=line-too-long
-
     @property
     def provisioning_profile_basename(self):
-        if not self.invoker.args.skip_signing:
-            return BRAVE_CHANNEL or 'release'
-        return None
+        return self.invoker.args.provisioning_profile_basename
 
     @property
     def run_spctl_assess(self):

build/mac/signing/internal_invoker.py

@@ -19,6 +19,7 @@ class Invoker(standard_invoker.Invoker):
         standard_invoker.Invoker.register_arguments(parser)
         parser.add_argument("--skip_signing", action="store_true")
         parser.add_argument("--universal", action="store_true")
+        parser.add_argument("--provisioning_profile_basename")
 
     def __init__(self, args, config):
         super().__init__(args, config)

chromium_src/chrome/updater/branding.gni

@@ -20,7 +20,7 @@ brave_updater_branding = {
   keystone_app_name = "BraveSoftwareUpdate"
   keystone_bundle_identifier = "com.brave.Keystone"
   mac_browser_bundle_identifier = "com.brave.Browser"
-  mac_updater_bundle_identifier = "com.brave.Updater"
+  mac_updater_bundle_identifier = "com.brave.BraveUpdater"
   privileged_helper_bundle_name = "BraveUpdaterPrivilegedHelper"
   privileged_helper_name = "com.brave.Browser.UpdaterPrivilegedHelper"
   updater_company_full_name = "Brave Software, Inc"

patches/chrome-installer-mac-BUILD.gn.patch

@@ -1,13 +0,0 @@
-diff --git a/chrome/installer/mac/BUILD.gn b/chrome/installer/mac/BUILD.gn
-index f78a598524075f819e03fc0521d8743b96e19432..2a78d6246853d0470e739b49542a77df194338c4 100644
---- a/chrome/installer/mac/BUILD.gn
-+++ b/chrome/installer/mac/BUILD.gn
-@@ -19,7 +19,7 @@ group("mac") {
-   public_deps = [ ":copies" ]
- }
- 
--_packaging_dir = "$root_out_dir/$chrome_product_full_name Packaging"
-+_packaging_dir = "$root_out_dir/" + string_replace("$chrome_product_full_name Packaging", " ", "_")
- 
- process_version_rc_template("sign_config") {
-   visibility = [ ":copy_signing" ]

patches/chrome-installer-mac-signing-config.py.patch

@@ -1,10 +0,0 @@
-diff --git a/chrome/installer/mac/signing/config.py b/chrome/installer/mac/signing/config.py
-index d3802b81bb01426bccae66cf644a838742bd6eb5..a91f2c592349d40fc10c836931fc7c564381b933 100644
---- a/chrome/installer/mac/signing/config.py
-+++ b/chrome/installer/mac/signing/config.py
-@@ -231,4 +231,4 @@ class CodeSignConfig(object):
-     @property
-     def packaging_dir(self):
-         """Returns the path to the packaging and installer tools."""
--        return '{.product} Packaging'.format(self)
-+        return '{}_Packaging'.format(self.product.replace(' ', '_'))

patches/chrome-installer-mac-signing-model.py.patch

@@ -1,13 +0,0 @@
-diff --git a/chrome/installer/mac/signing/model.py b/chrome/installer/mac/signing/model.py
-index cdae0e7f4847b8002ef4db23aabf75cc981ab3b4..42d9fe3848f817b0920765532b5742e4bbeb5751 100644
---- a/chrome/installer/mac/signing/model.py
-+++ b/chrome/installer/mac/signing/model.py
-@@ -464,7 +464,7 @@ class Paths(object):
-         Returns:
-             Path to the packaging directory.
-         """
--        return os.path.join(self.input, '{} Packaging'.format(config.product))
-+        return os.path.join(self.input, '{}_Packaging'.format(config.product.replace(' ', '_')))
- 
-     def replace_work(self, new_work):
-         """Creates a new Paths with the same input and output directories, but