Implement anonymous, opt-in, collection of OS X binary integrity incidents.

chrome/test/data/safe_browsing/mach_o/Makefile

 # Copyright 2015 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 KEYCHAIN_PASSWORD=g0atMaster
 # This must match the commonName in codesign.cfg.
 KEYCHAIN_IDENTITY=untrusted@goat.local
 
 executable32: src.c
         clang -m32 -o $@ $^
@@ skipping 39 matching lines @@
         security unlock-keychain -p $(KEYCHAIN_PASSWORD) \
                 $(PWD)/codesign.keychain
         codesign -s $(KEYCHAIN_IDENTITY) --keychain $(PWD)/codesign.keychain $@
 
 signedexecutablefat: executablefat codesign.keychain
         cp $< $@
         security unlock-keychain -p $(KEYCHAIN_PASSWORD) \
                 $(PWD)/codesign.keychain
         codesign -s $(KEYCHAIN_IDENTITY) --keychain $(PWD)/codesign.keychain \
                 $@ --all-architectures
+
+.PHONY: test-bundle.app
+test-bundle.app: signedexecutablefat libsigned64.dylib executable32
+        ditto base-bundle.app $@
+        ditto $< $@/Contents/MacOS/test-bundle
+        ditto $(word 2,$^) $@/Contents/Frameworks/$(word 2,$^)
+        ditto $(word 3,$^) $@/Contents/Resources/$(word 3,$^)
+        security unlock-keychain -p $(KEYCHAIN_PASSWORD) \
+                $(PWD)/codesign.keychain
+        codesign -f -s $(KEYCHAIN_IDENTITY) --keychain $(PWD)/codesign.keychain \
+                $@ --all-architectures --resource-rules ResourceRules
+
+.PHONY: modified-bundle.app
+modified-bundle.app: test-bundle.app codesign.cfg lib32.dylib executable64
+        ditto $< $@
+        ditto $(word 2,$^) $@/Contents/Resources/$(word 2,$^)
+        ditto $(word 3,$^) $@/Contents/Frameworks/libsigned64.dylib
+        ditto $(word 4,$^) $@/Contents/Resources/executable32
+        echo "foo" >> $@/Contents/Resources/Base.lproj/MainMenu.nib
+        security unlock-keychain -p $(KEYCHAIN_PASSWORD) \
+                $(PWD)/codesign.keychain
+        codesign -f -s $(KEYCHAIN_IDENTITY) --keychain $(PWD)/codesign.keychain \
+                $@/Contents/Resources/Base.lproj/MainMenu.nib
+
+.PHONY: modified-bundle-and-exec.app
+modified-bundle-and-exec.app: test-bundle.app codesign.cfg lib32.dylib \
+        executable64
+        ditto $< $@
+        ditto $(word 2,$^) $@/Contents/Resources/$(word 2,$^)
+        ditto $(word 3,$^) $@/Contents/Frameworks/libsigned64.dylib
+        ditto $(word 4,$^) $@/Contents/Resources/executable32
+        printf '\x31' | dd bs=1 seek=8097 count=1 conv=notrunc \
+                                                                                 of=$@/Contents/MacOS/test-bundle
+
+.PHONY: modified-main-exec32.app
+modified-main-exec32.app: test-bundle.app
+        ditto $< $@
+        printf '\x31' | dd bs=1 seek=8097 count=1 conv=notrunc \
+                                                                                 of=$@/Contents/MacOS/test-bundle

[Robert Sesek, 2015/10/08 19:20:06]

nit: something's off about this line (80 cols)

[Greg K, 2015/10/09 17:12:01]

Yes, that got messed up because Makefiles use real tabs. Fixed.

+
+.PHONY: modified-main-exec64.app
+modified-main-exec64.app: test-bundle.app
+        ditto $< $@
+        printf '\x31' | dd bs=1 seek=24448 count=1 conv=notrunc \
+                                                                                 of=$@/Contents/MacOS/test-bundle