OLD | NEW |
1 #!/bin/bash -p | 1 #!/bin/bash -p |
2 | 2 |
3 # Copyright (c) 2012 The Chromium Authors. All rights reserved. | 3 # Copyright (c) 2012 The Chromium Authors. All rights reserved. |
4 # Use of this source code is governed by a BSD-style license that can be | 4 # Use of this source code is governed by a BSD-style license that can be |
5 # found in the LICENSE file. | 5 # found in the LICENSE file. |
6 | 6 |
7 # Using codesign, sign the application. After signing, the signatures on the | 7 # Using codesign, sign the application. After signing, the signatures on the |
8 # inner bundle components are verified, and the application's own signature is | 8 # inner bundle components are verified, and the application's own signature is |
9 # verified. Inner bundle components are expected to be signed before this | 9 # verified. Inner bundle components are expected to be signed before this |
10 # script is called. See sign_versioned_dir.sh. | 10 # script is called. See sign_versioned_dir.sh. |
(...skipping 25 matching lines...) Expand all Loading... |
36 # Use custom resource rules for the browser application. | 36 # Use custom resource rules for the browser application. |
37 script_dir="$(dirname "${0}")" | 37 script_dir="$(dirname "${0}")" |
38 browser_app_rules="${script_dir}/app_resource_rules.plist" | 38 browser_app_rules="${script_dir}/app_resource_rules.plist" |
39 | 39 |
40 versioned_dir="${app_path}/Contents/Versions/@VERSION@" | 40 versioned_dir="${app_path}/Contents/Versions/@VERSION@" |
41 | 41 |
42 browser_app="${app_path}" | 42 browser_app="${app_path}" |
43 framework="${versioned_dir}/@MAC_PRODUCT_NAME@ Framework.framework" | 43 framework="${versioned_dir}/@MAC_PRODUCT_NAME@ Framework.framework" |
44 crashpad_handler="${framework}/Helpers/crashpad_handler" | 44 crashpad_handler="${framework}/Helpers/crashpad_handler" |
45 helper_app="${versioned_dir}/@MAC_PRODUCT_NAME@ Helper.app" | 45 helper_app="${versioned_dir}/@MAC_PRODUCT_NAME@ Helper.app" |
46 helper_eh_app="${versioned_dir}/@MAC_PRODUCT_NAME@ Helper EH.app" | |
47 helper_np_app="${versioned_dir}/@MAC_PRODUCT_NAME@ Helper NP.app" | |
48 | 46 |
49 requirement_string="\ | 47 requirement_string="\ |
50 designated => \ | 48 designated => \ |
51 (identifier \"com.google.Chrome\" or identifier \"com.google.Chrome.canary\") \ | 49 (identifier \"com.google.Chrome\" or identifier \"com.google.Chrome.canary\") \ |
52 and certificate leaf = H\"85cee8254216185620ddc8851c7a9fc4dfe120ef\"\ | 50 and certificate leaf = H\"85cee8254216185620ddc8851c7a9fc4dfe120ef\"\ |
53 " | 51 " |
54 | 52 |
55 codesign --sign "${codesign_id}" --keychain "${codesign_keychain}" \ | 53 codesign --sign "${codesign_id}" --keychain "${codesign_keychain}" \ |
56 "${browser_app}" --resource-rules "${browser_app_rules}" \ | 54 "${browser_app}" --resource-rules "${browser_app_rules}" \ |
57 -r="${requirement_string}" | 55 -r="${requirement_string}" |
58 | 56 |
59 # Show the signature. | 57 # Show the signature. |
60 codesign --display -r- -vvvvvv "${browser_app}" | 58 codesign --display -r- -vvvvvv "${browser_app}" |
61 | 59 |
62 # Verify everything. Check the framework and helper apps to make sure that the | 60 # Verify everything. Check the framework and helper apps to make sure that the |
63 # signatures are present and weren't altered by the signing process. Don't use | 61 # signatures are present and weren't altered by the signing process. Don't use |
64 # --deep on the framework because Keystone's signature is in a transitional | 62 # --deep on the framework because Keystone's signature is in a transitional |
65 # state (radar 18474911). Use --no-strict on the app because it uses custom | 63 # state (radar 18474911). Use --no-strict on the app because it uses custom |
66 # resource rules. | 64 # resource rules. |
67 codesign --verify --deep -vvvvvv "${crashpad_handler}" | 65 codesign --verify --deep -vvvvvv "${crashpad_handler}" |
68 codesign --verify -vvvvvv "${framework}" | 66 codesign --verify -vvvvvv "${framework}" |
69 codesign --verify --deep -vvvvvv "${helper_app}" | 67 codesign --verify --deep -vvvvvv "${helper_app}" |
70 codesign --verify --deep -vvvvvv "${helper_eh_app}" | |
71 codesign --verify --deep -vvvvvv "${helper_np_app}" | |
72 codesign --verify --deep --no-strict -vvvvvv "${browser_app}" | 68 codesign --verify --deep --no-strict -vvvvvv "${browser_app}" |
73 | 69 |
74 # Verify with spctl, which uses the same rules that Gatekeeper does for | 70 # Verify with spctl, which uses the same rules that Gatekeeper does for |
75 # validation. | 71 # validation. |
76 spctl --assess -vv "${browser_app}" | 72 spctl --assess -vv "${browser_app}" |
OLD | NEW |