This PR adds a hash constant to the Xcode toolchain script, similar to
how upstream `MAC_BINARIES_TAG` on their counterpart of this source.
With this change we check the hash sum when downloading the file to make
sure it matches the expected hash.
Prior to this change, the decision to download/extract a new SDK was
entirely based on the version of the SDK found in the destination path.
This has served us well, however is a weaker scheme for reproducibility
checks. With this change, it is being introduced a scheme, similar to
how this type of check is done in other places, where a sidecar file is
created based on the name of the toolchain to be downloaded, and that
sidecar file has a hashsum in it.
With this new verification scheme we can now detect accidental
overwrites of the toolchain, but we can also leave the door open to use
issue a new toolchain under a subversion in case of some emergency fix
for a toolchain file
Finally, this change also corrects a few things across this source that
are outdated, and do not conform to the python style guide currently
enforced in Chromium, in particular the naming convention that was being
used.
Bug: https://github.com/brave/brave-browser/issues/55812
This PR corrects corrects a problem where our
`download_hermetic_xcode.py` script was diverging from the upstream one
by early returning whenever it confirmed that the toolchain had already
been downloaded and not trying to accept the license. This has been
causing issues in CI, where nodes being used for different branches,
with different SDKs, are not properly going over the necessary plist
updates that they should have done.
This PR corrects this aspect of the behaviour, but it also makes this
particular script more alinged with the upstream script itself.
Eg. when installing from Brave-Browser-universal.pkg, the previous
implementation gave the following `postinstall` errors in
`/var/log/install.log`:
chmod: /Applications/Brave Browser universal.app: No such file or directory
chown: /Applications/Brave Browser universal.app: No such file or directory
chgrp: /Applications/Brave Browser universal.app: No such file or directory
We already supported the postinstall script. This just adds support for the new
preinstall script.
Chromium changes:
https://chromium.googlesource.com/chromium/src/+/020f74a05f2bfde21ea239cea02e53671c6ae506
commit 020f74a05f2bfde21ea239cea02e53671c6ae506
Author: Avi Drissman <avi@chromium.org>
Date: Fri Feb 6 10:54:22 2026 -0800
Harden the pkg with a pre-install script
If Installer.app finds an app with the correct name but an incorrect
bundle ID in the target installation directory, it misbehaves. Add a
pre-install script to the pkg to fail early if that is the case.
Fixed: 481590122
Change-Id: I47017e17d1506e0e0a17083842d3e4201710e127
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7544462
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Mark Mentovai <mark@chromium.org>
Auto-Submit: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1580983}
Simplify macOS packaging GN actions
The previous code was there to retain backwards-compatibility with
devops code that still expected the output files at the legacy paths.
Now, the devops code has been updated to use the new paths. It is
therefore no longer necessary to maintain copies of the output files at
the legacy paths.
Signing with `--skip_signing` stopped working on Mac due to the following
upstream commit. This happened because we override the behavior of `run_command`
to scrub signing-related commands/arguments from the command-line when
`--skip_signing` is passed. However, this upstream commit added a new async
function named `run_command_all_output_async` which also needs to be scrubbed.
Chromium change:
https://source.chromium.org/chromium/chromium/src/+/8062ee35c902563309983726a37b90d5ca10caed
commit 8062ee35c902563309983726a37b90d5ca10caed
Author: Joshua Pawlicki <waffles@chromium.org>
Date: Tue Jul 15 10:45:21 2025 -0700
mac signing: Parallelize some per-distribution operations.
This may speed up the per-distribution section of signing by up to 45%.
codesign --verify and spctl --assess will now run in parallel. This is
expected to provide a speed-up up to 20% depending on I/O throughput.
The app bundle needs to be zipped prior to notarization. Previously,
the execution would wait for zipping to be complete and then start
notarization in the background (while continuing in parallel with
processing the next distribution). Now, the zipping is also done in
the background while execution moves on to the next distribution. This
could provide a speed-up of up to 25% depending on I/O vs CPU
bottlenecks.
Bug: 426019706
Change-Id: I0a054c43c2b51f56abd0a94e78a9caf337a2a216
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6699494
Commit-Queue: Mark Mentovai <mark@chromium.org>
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Joshua Pawlicki <waffles@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1487061}
This PR is the run of `gn format` on all `gn` files. This is a
mechanical change done with:
```sh
git ls-files -- "*.gn" | xargs gn format
git ls-files -- "*.gni" | xargs gn format
```
This change has been motivated primarily by an improvement to the
formatters privided by `gn` correcting cases of redundant target naming,
i.e cases where `//foo:foo` is used, and should just be `//foo`.
For this particular `gn` change, see:
https://chromium.googlesource.com/chromium/src/+/c822490a82cdb6ad479159683a92858f7c6f0a58
Resolves https://github.com/brave/brave-browser/issues/48161
The previous original author of the affected line said he only commented
out some parts because they failed the signing process. Also, both
Chrome and Edge have the subject part that is being added here.
Flesh out Omaha 4 auto-updater on macOS
Before this commit, it was possible to update Brave on macOS with
Omaha 4 by enabling the `brave_enable_updater` build flag and manually
installing O4 on the user's system. After this PR, manually installing
O4 is no longer required for at least per-user installations.
This commit adds an implementation that replaces Sparkle by Omaha 4 for
on-demand updates. It is hidden behind a default-disabled GN arg and
is highly experimental: The user must manually install Omaha 4 by
executing a command. They must also manually create a JSON file that
tells Omaha that Brave is installed. Once they do that, the
implementation can update to a new version via brave://settings/help.
The associated "Brave was updated - relaunch?" button does not work.
Chromium changes:
https://chromium.googlesource.com/chromium/src/+/c1cad88d77340
commit c1cad88d773409e719de66c515e07fdef9db93e0
Author: Robert Sesek <rsesek@chromium.org>
Date: Wed Jul 12 23:02:59 2023 +0000
macOS Signing Scripts: Drop support for altool-based notarization
This also rolls the internal repo to remove references to
model.NotarizationTool:
Roll src/chrome/installer/mac/internal/ babcdbc1d..d7fb448e1 (1 commit)
https://chrome-internal.googlesource.com/chrome/installer/mac/internal.git/+log/babcdbc1d727..d7fb448e1fc8
Bug: 1449970
https://chromium.googlesource.com/chromium/src/+/b971bed75e187
commit b971bed75e1871651506bc8ebd13cb2fdf7b4496
Author: Robert Sesek <rsesek@chromium.org>
Date: Thu Jul 13 22:37:16 2023 +0000
macOS Signing Scripts: Remove explicit notarization auth arguments
Invokers of the signing scripts should now pass authentication
arguments like so:
--notary-arg=--keychain-profile --notary-arg MyKeychainProfile
The old arguments remain for temporary command-line backwards
compatibility, but they do not have any effect.
Bug: 1449970
Chromium change:
https://source.chromium.org/chromium/chromium/src/+/aab0c52c084142b14a4f7132b095088c4c823b68
commit aab0c52c084142b14a4f7132b095088c4c823b68
Author: Robert Sesek <rsesek@chromium.org>
Date: Tue May 30 19:09:47 2023 +0000
macOS Signing Scripts: Create the invoker module
This module provides an Invoker class as an abstraction between the
lower-level commands module and higher-level signing/notarization
operations.
Bug: 1442256
Michael Herrmann