Only accept the hermetic toolchain license if newer.

build/mac_toolchain.py

 #!/usr/bin/env python
 # Copyright 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Download necessary mac toolchain files under certain conditions.  If
 xcode-select is already set and points to an external folder
 (e.g. /Application/Xcode.app), this script only runs if the GYP_DEFINE
 |force_mac_toolchain| is set.  To override the values in
 |TOOLCHAIN_REVISION|-|TOOLCHAIN_SUB_REVISION| below, GYP_DEFINE
@@ skipping 82 matching lines @@
 def CanAccessToolchainBucket():
   """Checks whether the user has access to |TOOLCHAIN_URL|."""
   proc = subprocess.Popen(['gsutil.py', 'ls', TOOLCHAIN_URL],
                            stdout=subprocess.PIPE)
   proc.communicate()
   return proc.returncode == 0
 
 
 def AcceptLicense(directory):
   """Use xcodebuild to accept new toolchain license.  This only
-  works if xcodebuild and xcode-select are in sudoers."""
-  xcodebuild_dir = os.path.join(TOOLCHAIN_BUILD_DIR, 'Contents/Developer')
+  works if xcodebuild and xcode-select are passwordless in sudoers."""
+  build_dir = os.path.join(TOOLCHAIN_BUILD_DIR, 'Contents/Developer')
   old_path = subprocess.Popen(['/usr/bin/xcode-select', '-p'],
                                stdout=subprocess.PIPE).communicate()[0].strip()
-  subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', xcodebuild_dir])
-  subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
-  subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', old_path])
+  try:
+    subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', build_dir])
+    subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
+  finally:
+    # Normally accepting a toolchain license doesn't unaccept the other
+    # toolchain license. However, something about using passwordless sudo seems
+    # to do just that.  Re-accept the |old_path| toolchain just incase.

[erikchen, 2016/05/08 17:56:26]

accepting the old license doesn't unaccept the new license? Given the symmetry,
I don't see how this can be possible unless there's a third factor that we're
not taking into account. Could you do some more digging?

+    subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', old_path])
+    subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
 
 
 def UseLocalMacSDK():
   force_pull = os.environ.has_key('FORCE_MAC_TOOLCHAIN')
 
   # Don't update the toolchain if there's already one installed outside of the
   # expected location for a Chromium mac toolchain, unless |force_pull| is set.
   proc = subprocess.Popen(['xcode-select', '-p'], stdout=subprocess.PIPE)
   xcode_select_dir = proc.communicate()[0]
   rc = proc.returncode
@@ skipping 37 matching lines @@
     print 'Toolchain %s unpacked.' % toolchain_revision
     WriteStampFile(toolchain_revision)
     return 0
   except:
     print 'Failed to download toolchain %s.' % toolchain_file
     print 'Exiting.'
     return 1
 
 if __name__ == '__main__':
   sys.exit(main())