Discharge7443/brave-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Widevine signature_generator to Python 3 (#19437)

Browse Source
This commit is contained in:
Michael Herrmann
2023-07-27 23:55:10 +09:00
committed by GitHub
parent c8255221ca
commit 5dc3dcc00b
7 changed files with 64 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+2
View File
@@ -29,6 +29,8 @@ patches/**/*.patchinfo
/third_party/rust/kuchiki/v0_8/crate
/third_party/rust/futures_retry/v0_5/crate
/third_party/rust/star_constellation/v0_2/crate
/third_party/cryptography
/third_party/macholib
*.xcodeproj
*.swp
*.pyc
DEPS
+24 -1
View File
@@ -40,7 +40,10 @@ deps = {
"third_party/rust/futures_retry/v0_5/crate": "https://github.com/brave-intl/futures-retry.git@2aaaafbc3d394661534d4dbd14159d164243c20e",
"third_party/rust/kuchiki/v0_8/crate": "https://github.com/brave/kuchiki.git@589eadca2c1d06ddda2919354590bfe1ace88a43",
"third_party/rust/adblock/v0_7/crate": "https://github.com/brave/adblock-rust.git@444cde7f2be40e3725b13515d80aaff9e9a56987",
"third_party/macholib": {
"url": "https://github.com/ronaldoussoren/macholib.git@36a6777ccd0891c5d1b44ba885573d7c90740015",
"condition": "checkout_mac",
},
}
recursedeps = [
@@ -66,6 +69,26 @@ hooks = [
'condition': 'checkout_mac and download_prebuilt_sparkle',
'action': ['vpython3', 'build/mac/download_sparkle.py', '1.24.3'],
},
{
'name': 'update_pip',
'pattern': '.',
# Required for download_cryptography below. Specifically, newer versions of
# pip are required for obtaining binary wheels on Arm64 macOS.
'action': ['python3', '-m', 'pip', '-q', '--disable-pip-version-check', 'install', '-U', 'pip'],
},
{
'name': 'download_cryptography',
'pattern': '.',
# We don't include cryptography as a DEP because building it from source is
# difficult. We pin to a version >=37.0.2 and <38.0.0 to avoid an
# incompatibility with our pyOpenSSL version on Android. See:
# https://github.com/pyca/cryptography/issues/7126.
# We use python3 instead of vpython3 for two reasons: First, our GN actions
# are run with python3, so this environment mirrors the one in which
# cryptography will be used. Second, we cannot update pip in vpython3 on at
# least macOS due to permission issues.
'action': ['python3', '-m', 'pip', '-q', '--disable-pip-version-check', 'install', '-U', '-t', 'third_party/cryptography', '--only-binary', 'cryptography', 'cryptography==37.0.4'],
},
{
'name': 'wireguard_nt',
'pattern': '.',
browser/widevine/BUILD.gn
+6 -33
View File
@@ -90,43 +90,16 @@ source_set("browser_tests") {
}
if (is_win && !skip_signing) {
template("sig_file") {
assert(defined(invoker.flags), "Need flags in $target_name.")
action(target_name) {
forward_variables_from(invoker,
[
"sources",
"outputs",
"deps",
])
# It would be nice to just invoke the original signature_generator.py
# script here. But it uses Python 2 and expects the `cryptography`
# library to be installed. So we invoke this Python 3 helper here.
script = "signature_generator_python3.py"
inputs = [
"//brave/script/lib/widevine.py",
"//brave/script/lib/util.py",
"//brave/script/lib/config.py",
"//brave/script/lib/env_util.py",
]
args = [
rebase_path(sources[0], root_build_dir),
rebase_path(outputs[0], root_build_dir),
invoker.flags,
]
}
}
sig_file("brave_exe_sig") {
widevine_sign_file("brave_exe_sig") {
file = "$root_out_dir/presigned_binaries/brave.exe"
signature_file = "$root_out_dir/brave.exe.sig"
flags = "1"
sources = [ "$root_out_dir/presigned_binaries/brave.exe" ]
outputs = [ "$root_out_dir/brave.exe.sig" ]
deps = [ "//brave:signed_brave_exe" ]
}
sig_file("chrome_dll_sig") {
widevine_sign_file("chrome_dll_sig") {
file = "$root_out_dir/presigned_binaries/chrome.dll"
signature_file = "$root_out_dir/chrome.dll.sig"
flags = "0"
sources = [ "$root_out_dir/presigned_binaries/chrome.dll" ]
outputs = [ "$root_out_dir/chrome.dll.sig" ]
deps = [ "//brave:signed_chrome_dll" ]
}
}
browser/widevine/signature_generator_python3.py
-27
View File
@@ -1,27 +0,0 @@
#!/usr/bin/env python3
# Copyright (c) 2023 The Brave Authors. All rights reserved.
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this file,
# You can obtain one at https://mozilla.org/MPL/2.0/.
from argparse import ArgumentParser
from lib.widevine import generate_sig_file
def main():
args = parse_args()
generate_sig_file(args.input_file, args.output_file, args.flags)
def parse_args():
parser = ArgumentParser()
parser.add_argument('input_file')
parser.add_argument('output_file')
parser.add_argument('flags')
return parser.parse_args()
if __name__ == '__main__':
main()
build/commands/lib/config.js
+19 -9
View File
@@ -1063,16 +1063,26 @@ Config.prototype.getCachePath = function () {
Object.defineProperty(Config.prototype, 'defaultOptions', {
get: function () {
let env = Object.assign({}, process.env)
env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python-bin'), true)
env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python2-bin'), true)
env = this.addPathToEnv(env, path.join(this.srcDir, 'third_party', 'rust-toolchain', 'bin'), true)
env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python-bin'),
true)
env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python2-bin'),
true)
env = this.addPathToEnv(env, path.join(this.srcDir, 'third_party',
'rust-toolchain', 'bin'), true)
env = this.addPathToEnv(env, this.depotToolsDir, true)
env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'brave', 'chromium_src', 'python_modules'))
env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'brave', 'script'))
env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'tools', 'grit', 'grit', 'extern'))
env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'brave', 'vendor', 'requests'))
env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'build'))
env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'third_party', 'depot_tools'))
const pythonPaths = [
['brave', 'chromium_src', 'python_modules'],
['brave', 'script'],
['tools', 'grit', 'grit', 'extern'],
['brave', 'vendor', 'requests'],
['brave', 'third_party', 'cryptography'],
['brave', 'third_party', 'macholib'],
['build'],
['third_party', 'depot_tools'],
]
pythonPaths.forEach(p => {
env = this.addPythonPathToEnv(env, path.join(this.srcDir, ...p))
})
env.PYTHONUNBUFFERED = '1'
env.TARGET_ARCH = this.gypTargetArch // for brave scripts
env.RUSTUP_HOME = path.join(this.srcDir, 'third_party', 'rust-toolchain')
script/brave_license_helper.py
+11
View File
@@ -137,6 +137,17 @@ def AddBraveCredits(root, prune_paths, special_cases, prune_dirs,
"URL": "https://github.com/brave/Sparkle",
"License": "MIT",
},
os.path.join('brave', 'third_party', 'cryptography'): {
"Name": "cryptography",
"URL": "https://cryptography.io",
"License": "Apache-2.0",
"License File": "/brave/common/licenses/Apache-2.0",
},
os.path.join('brave', 'third_party', 'macholib'): {
"Name": "macholib",
"URL": "https://github.com/ronaldoussoren/macholib",
"License": "MIT",
},
})
# Don't recurse into these directories looking for third-party code.
script/lib/widevine.py
+2 -5
View File
@@ -6,6 +6,7 @@
from os.path import dirname, realpath, join, exists
import os
import sys
from lib.util import execute
@@ -24,12 +25,8 @@ def can_generate_sig_file():
def generate_sig_file(input_file, output_file, flags):
# N.B.: We are invoking Python 2 below because signature_generator.py still
# uses it. It also expects the `cryptography` library to be pre-installed.
# We should migrate the script to Python 3 and use .vpython3 files to fetch
# the library instead.
execute([
'python', SIGNATURE_GENERATOR_PY, '--input_file', input_file,
sys.executable, SIGNATURE_GENERATOR_PY, '--input_file', input_file,
'--output_file', output_file, '--flags', flags, '--certificate',
SIGN_WIDEVINE_CERT, '--private_key', SIGN_WIDEVINE_KEY,
'--private_key_passphrase', SIGN_WIDEVINE_PASSPHRASE