Only accept the hermetic toolchain license if newer.

build/mac_toolchain.py

Index: build/mac_toolchain.py
diff --git a/build/mac_toolchain.py b/build/mac_toolchain.py
index e1f17e747bc0abd6e3e59268b97f9e769524773f..e92c323007c36ba2028969d5e042a4e02a2fd955 100755
--- a/build/mac_toolchain.py
+++ b/build/mac_toolchain.py
@@ -100,13 +100,19 @@ def CanAccessToolchainBucket():
 
 def AcceptLicense(directory):
   """Use xcodebuild to accept new toolchain license.  This only
-  works if xcodebuild and xcode-select are in sudoers."""
-  xcodebuild_dir = os.path.join(TOOLCHAIN_BUILD_DIR, 'Contents/Developer')
+  works if xcodebuild and xcode-select are passwordless in sudoers."""
+  build_dir = os.path.join(TOOLCHAIN_BUILD_DIR, 'Contents/Developer')
   old_path = subprocess.Popen(['/usr/bin/xcode-select', '-p'],
                                stdout=subprocess.PIPE).communicate()[0].strip()
-  subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', xcodebuild_dir])
-  subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
-  subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', old_path])
+  try:
+    subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', build_dir])
+    subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
+  finally:
+    # Normally accepting a toolchain license doesn't unaccept the other
+    # toolchain license. However, something about using passwordless sudo seems
+    # to do just that.  Re-accept the |old_path| toolchain just incase.

[erikchen, 2016/05/08 17:56:26]

accepting the old license doesn't unaccept the new license? Given the symmetry,
I don't see how this can be possible unless there's a third factor that we're
not taking into account. Could you do some more digging?

+    subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', old_path])
+    subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
 
 
 def UseLocalMacSDK():