- Changes dependency from chrome_helper_app to chrome_helper_app_default
since there are now mulitple 'chrome_helper_app's.
- Clears output directory from path created by GN but not expected by the
signing script.
Chromium changes:
https://chromium.googlesource.com/chromium/src/+/4be2698e4784
commit 4be2698e4784b68198d1062a54942ae232c57c24
Author: Robert Sesek <rsesek@chromium.org>
Date: Mon Jun 17 17:41:28 2019 +0000
Create more Mac Helper application bundles.
In order to enable the hardened runtime, which restricts things such as
writable-executable memory and loading code signed by a different Team
ID, special code signing entitlements must be granted to the Helper.
To keep the capabilities scoped to the process types that require them,
this CL adds two new variants of the Helper app: one for renderers
and one for plugins.
Currently all three Helpers will be code signed in the same way without
any entitlements, but this will change in the future.
Tbr: dschuff@chromium.org
Bug: 850193
which is rolled into c76 with:
https://chromium.googlesource.com/chromium/src/+/194826d6f8a3a0d932e18ed0f5452fd5c488e490
commit 194826d6f8a3a0d932e18ed0f5452fd5c488e490
Author: Robert Sesek <rsesek@chromium.org>
Date: Wed Jul 17 22:28:42 2019 +0000
[BRANCH ONLY] Roll-up cherry pick of changes to notarize Chrome on macOS.
App notarization is going to be required on macOS 10.15, which is
expected to be released when M76 is on stable channel. This series of
changes makes modifications to Chrome's helper processes, adding
multiple variants with different code signing entitlements, as well as
changes to the signing scripts to support notarization.
This cherry-picks the following 15 commits to the M76/3809 branch:
7f66190e7365 [Mac] Stop pretending that browser_tests/InProcessBrowserTest are bundled.
ceaa2666e0eb Grant the browser several entitlements needed for the hardened runtime.
4be2698e4784 Create more Mac Helper application bundles.
3fa9da4e877a Give the new Mac helper variants the entitlements they require.
4aa3a22f4387 Code sign all Mac executables with the hardened runtime option.
4f72ae052e11 [Mac] Run the proxy_resolver service in the Renderer helper.
c2b068a99ae2 Copy KeystoneRegistration.framework with a bundle_data rule for the root.
4f6b2b188f29 [Mac] Delete CFBundleBlocker and third_party/mach_override.
2f8e936c6909 macOS Signing Scripts: Add module responsible for notarization.
62d2a3f09545 macOS Signing Scripts: Drop support for resource rules.
ec608fec2fd1 macOS Signing Scripts: Create the notarization sentinel file.
91b8140d5cb0 macOS Signing Scripts: Run the notarization stapler through xcrun.
4312c1f9a695 macOS Signing Scripts: Do not staple the AlertNotificationService.xpc bundle.
59347283139c macOS Signing Scripts: Write "yes-1" to the notarization sentinel file.
4d22852510f5 Mac: Sign the inner framework only once per bundle ID
Bug: 850199
This was a transitional flag in c75 and has now been removed.
Chromium change:
commit d24fe6f65d3e2fe6f214f007c7b9d4cc5c347065
Author: Robert Sesek <rsesek@chromium.org>
Date: Thu May 23 17:34:40 2019 +0000
Delete the new_mac_bundle_structure GN arg and associated build flag.
Bug: 958976
Bash scripts we used are no longer available. Switching to using a python script
copied from Chromium and modified to account for our provisining profiles.
Due to Chromium change:
commit 8be189cb183eabe41d4c9215837245ce5c73d9f8
Author: Robert Sesek <rsesek@chromium.org>
Date: Tue May 21 19:45:12 2019 +0000
[BRANCH ONLY] Roll-up cherry pick of new macOS signing scripts and bundle structure.
This is needed in M75 because it will take users at least two updates to
transition to the new bundle structure and clean up the old structure.
Completely switching to the new bundle structure is a prerequisite for
enabling the hardened runtime and notarizing the application. Therefore
it is ideal to move users to the new structure as soon as possible, so
that there is plenty of time to complete the transition.
This cherry-picks the following 21 commits to the M75/3770 branch:
e3e4057e71d3 macOS Signing Scripts: Add config and data model definitions.
b842129bffef macOS Signing Scripts: Configure unittests to run on CI.
64f6a26debbf macOS Signing Scripts: Rename test files to *_test.py.
07d33d550035 macOS Signing Scripts: Add module that performs the signing operations.
6d5735797ea1 macOS Signing Scripts: Add module that modifies the bundle for channels/distribution.
06ba91887ab7 macOS Signing Scripts: Add the pipeline module and invoker script.
e1315f263d56 macOS Signing Scripts: Add two missing bundle modifications.
ff10b5a46fe8 macOS Signing Scripts: Create the output directory if it does not exist.
6bb62be5b2ba macOS Signing Scripts: Delete the old scripts.
3fd5a144928b Dissemble the app_mode_loader.
07bd6b9ec034 Stage the new macOS bundle structure behind a flag.
49937668c336 With new_mac_bundle_structure=true, GetFrameworkBundlePath() returns the versioned dir.
eebc1c12af45 Teach the app shims about the new Chromium bundle structure.
a5ba0f4c9e0f Mac updater: support new on-disk layout
4602841f03fe [Mac] Flip new_mac_bundle_structure to true.
3e8b3ae021ad Fix binary diff updaters for macOS canaries
1390f8a0dd43 macOS Signing Scripts: Code sign options should be properties of parts, not config.
f57665949ac9 Fix class ServiceProcessControlBrowserTest with new_mac_bundle_structure.
9c3143e8fb76 Restore the "omit" code signature resource rule to new-layout installations
845d829c8b9c macOS Signing Scripts: Skip requirements strings if signing ad hoc.
0be3e8833605 Remove the old Contents/Versions folder in clean_up_old_versions.py.
Bug: 958976
https://bugs.chromium.org/p/chromium/issues/detail?id=958976&can=2&q=958976
bridiver