Added support for signed policy blobs on desktop.

chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_cloud_policy_store_chromeos.h"
 
 #include "base/bind.h"
 #include "base/sequenced_task_runner.h"
 #include "chrome/browser/chromeos/policy/device_policy_decoder_chromeos.h"
 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
@@ skipping 28 matching lines @@
       device_settings_service_->GetOwnerKey());
   if (!install_attributes_->IsEnterpriseDevice() ||
       !device_settings_service_->policy_data() || !owner_key.get() ||
       !owner_key->public_key()) {
     status_ = STATUS_BAD_STATE;
     NotifyStoreError();
     return;
   }
 
   scoped_ptr<DeviceCloudPolicyValidator> validator(CreateValidator(policy));
-  validator->ValidateSignature(*owner_key->public_key(), true);
+
+  validator->ValidateSignature(owner_key->public_key_as_string(),
+                               GetPolicyVerificationKey(),

[Mattias Nissler (ping if slow), 2014/01/27 13:52:13]

So we actually do verification for Chrome OS? Didn't you mention elsewhere that
it is not?

[Andrew T Wilson (Slow), 2014/01/30 17:10:31]

The plumbing is in place, but GetPolicyVerificationKey() currently returns "no
key" on ChromeOS. At some point in the future we can turn it on by changing that
routine.

+                               std::string(),
+                               true);
   validator->ValidateAgainstCurrentPolicy(
       device_settings_service_->policy_data(),
       CloudPolicyValidatorBase::TIMESTAMP_REQUIRED,
       CloudPolicyValidatorBase::DM_TOKEN_REQUIRED);
   validator.release()->StartValidation(
       base::Bind(&DeviceCloudPolicyStoreChromeOS::OnPolicyToStoreValidated,
                  weak_factory_.GetWeakPtr()));
 }
 
 void DeviceCloudPolicyStoreChromeOS::Load() {
   device_settings_service_->Load();
 }
 
 void DeviceCloudPolicyStoreChromeOS::InstallInitialPolicy(
     const em::PolicyFetchResponse& policy) {
   // Cancel all pending requests.
   weak_factory_.InvalidateWeakPtrs();
 
   if (!install_attributes_->IsEnterpriseDevice() &&
       device_settings_service_->status() !=
           chromeos::DeviceSettingsService::STORE_NO_POLICY) {
     status_ = STATUS_BAD_STATE;
     NotifyStoreError();
     return;
   }
 
   scoped_ptr<DeviceCloudPolicyValidator> validator(CreateValidator(policy));
-  validator->ValidateInitialKey();
+  validator->ValidateInitialKey(GetPolicyVerificationKey());
   validator.release()->StartValidation(
       base::Bind(&DeviceCloudPolicyStoreChromeOS::OnPolicyToStoreValidated,
                  weak_factory_.GetWeakPtr()));
 }
 
 void DeviceCloudPolicyStoreChromeOS::OwnershipStatusChanged() {
   // Nothing to do.
 }
 
 void DeviceCloudPolicyStoreChromeOS::DeviceSettingsUpdated() {
@@ skipping 70 matching lines @@
     case chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR:
     case chromeos::DeviceSettingsService::STORE_TEMP_VALIDATION_ERROR:
       status_ = STATUS_LOAD_ERROR;
       break;
   }
 
   NotifyStoreError();
 }
 
 }  // namespace policy