Implement Enterprise Key API.

chrome/app/policy/policy_templates.json

 {
 # policy_templates.json - Metafile for policy templates
 #
 # The content of this file is evaluated as a Python expression.
 #
 # This file is used as input to generate the following policy templates:
 # ADM, ADMX+ADML, MCX/plist and html documentation.
 #
 # Policy templates are user interface definitions or documents about the
 # policies that can be used to configure Chrome. Each policy is a name-value
@@ skipping 94 matching lines @@
 #   templates and documentation. The policy definition list that Chrome sees
 #   will include policies marked with 'future'. If a WIP policy isn't meant to
 #   be seen by the policy providers either, the 'supported_on' key should be set
 #   to an empty list.
 #
 # IDs:
 #   Since a Protocol Buffer definition is generated from this file, unique and
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 198
+#   For your editing convenience: highest ID currently used: 200
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
 #     $1 -> Google Chrome / Chromium
 #     $2 -> Google Chrome OS / Chromium OS
 #     $3 -> Google Chrome Frame / Chromium Frame
 #     $6 is reserved for doc_writer
 #
 # Device Policy:
 #   An additional flag device_only (optional, defaults to False) indicates
@@ skipping 4367 matching lines @@
       'example_value': 'restricted',
       'id': 196,
       'future': True,
       'caption': '''Set the restriction on the fetching of the Variations seed''',
       'desc': '''Add a parameter to the fetching of the Variations seed in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>.
 
       If specified, will add a query parameter called 'restrict' to the URL used to fetch the Variations seed. The value of the parameter will be the value specified in this policy.
 
       If not specified, will not modify the Variations seed URL.''',
     },
+    {
+      'name': 'Attestation',
+      'type': 'group',
+      'caption': 'Remote Attestation',
+      'desc': 'Configure the remote attestation with TPM mechanism.',
+      'policies': [
+        {
+          'name': 'AttestationEnabledForUser',
+          'type': 'main',
+          'schema': { 'type': 'boolean' },
+          'supported_on': ['chrome_os:28-'],
+          'features': {
+            'dynamic_refresh': True,
+            'per_profile': False,

[Mattias Nissler (ping if slow), 2013/04/04 12:51:34]

Any chance to make this per-profile?

[davidyu, 2013/04/09 09:30:08]

I'm not quite sure about the difference for this feature. This policy is
supposed to apply on the user account, no matter which machine it is used.

[Mattias Nissler (ping if slow), 2013/04/10 16:53:25]

The definition of this flag is: "Can we set the policy differently for different
Profiles that are loaded in the same browser instance?" On the technical level,
this means basically "are you reading the policy via Profile::GetPrefs()"?

[davidyu, 2013/04/11 07:04:21]

Got it. Changed to true.

+          },
+          'example_value': True,
+          'id': 199,
+          'caption': '''Enable remote attestation for the user.''',
+          'desc': '''Allow the user to remote attest using the device TPM.''',

[Mattias Nissler (ping if slow), 2013/04/04 12:51:34]

Please elaborate on the description. It should specify behavior for the
different boolean values and also for the case that the policy is not set.

[davidyu, 2013/04/09 09:30:08]

Done.

+        },
+        {
+          'name': 'AttestationExtensionWhitelist',
+          'type': 'list',
+          'schema': {
+            'type': 'array',
+            'items': { 'type': 'string' },
+          },
+          'supported_on': ['chrome_os:28-'],
+          'features': {
+            'dynamic_refresh': True,
+            'per_profile': False,

[Mattias Nissler (ping if slow), 2013/04/04 12:51:34]

ditto

[davidyu, 2013/04/11 07:04:21]

Done.

+          },
+          'example_value': ['ghdilpkmfbfdnomkmaiogjhjnggaggoi'],
+          'id': 200,
+          'caption': '''Extensions allowed to to use the remote attestation API.''',
+          'desc': '''Only extenions which are whitelisted can use the enterprise remote attestation API.''',

[Mattias Nissler (ping if slow), 2013/04/04 12:51:34]

ditto

[davidyu, 2013/04/09 09:30:08]

Done.

+        },
+      ],
+    },
   ],
   'messages': {
     # Messages that are not associated to any policies.
     'win_supported_winxpsp2': {
       'desc': '''A label specifying the oldest possible compatible version of Windows. This text will appear right next to a label containing the text 'Supported on:'.''',
       'text': '''Microsoft Windows XP SP2 or later'''
     },
     'mac_chrome_preferences': {
       'desc': '''A text indicating in Mac OS X Workgroup Manager, that currently the preferences of Chrome are being edited''',
       'text': '''<ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> preferences'''
@@ skipping 82 matching lines @@
       'desc': '''Text appended in parentheses to the policy name to indicate that it has been deprecated''',
       'text': 'deprecated',
     },
     'doc_recommended': {
       'desc': '''Text appended in parentheses next to the policies top-level container to indicate that those policies are of the Recommended level''',
       'text': 'Default Settings (users can override)',
     },
   },
   'placeholders': [],
 }