Turn on hermetic toolchain for all corp machines.

build/mac_toolchain.py

 #!/usr/bin/env python
 # Copyright 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 """Download necessary mac toolchain files under certain conditions.  If
 xcode-select is already set and points to an external folder

[Nico, 2016/11/01 01:07:34]

This is no longer true now, right?

[erikchen, 2016/11/01 19:33:48]

Updated Comment.

 (e.g. /Application/Xcode.app), this script only runs if the GYP_DEFINE
 |force_mac_toolchain| is set.  To override the values in
 |TOOLCHAIN_REVISION|-|TOOLCHAIN_SUB_REVISION| below, GYP_DEFINE
 mac_toolchain_revision can be used instead.
 
 This script will only run on machines if /usr/bin/xcodebuild and
 /usr/bin/xcode-select has been added to the sudoers list so the license can be
 accepted.
 
 Otherwise, user input would be required to complete the script.  Perhaps future
@@ skipping 113 matching lines @@
   old_path = subprocess.Popen(['/usr/bin/xcode-select', '-p'],
                                stdout=subprocess.PIPE).communicate()[0].strip()
   try:
     build_dir = os.path.join(TOOLCHAIN_BUILD_DIR, 'Contents/Developer')
     subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', build_dir])
     subprocess.check_call(['sudo', '/usr/bin/xcodebuild', '-license', 'accept'])
   finally:
     subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', old_path])
 
 
-def _UseLocalMacSDK():
-  force_pull = os.environ.has_key('FORCE_MAC_TOOLCHAIN')
+def _UseHermeticToolchain():
+  current_dir = os.path.dirname(os.path.realpath(__file__))
+  script_path = os.path.join(current_dir, 'mac/should_use_hermetic_xcode.py')
+  proc = subprocess.Popen([script_path], stdout=subprocess.PIPE)

[Nico, 2016/11/01 01:07:34]

https://cs.chromium.org/chromium/tools/depot_tools/win_toolchain/get_toolchai...
also checks if a bot has access to src-internal, maybe we want that too (not
needed in this cl though)

[erikchen, 2016/11/01 19:33:48]

Hm.
"""
    if (HaveSrcInternalAccess() or
        LooksLikeGoogler() or
        CanAccessToolchainBucket()):
"""
It's not clear to me why we would want SrcInternalAccess to cause us to use
hermetic toolchain. 

+  return '1' in proc.stdout.readline()
 
-  # Don't update the toolchain if there's already one installed outside of the
-  # expected location for a Chromium mac toolchain, unless |force_pull| is set.
-  proc = subprocess.Popen(['xcode-select', '-p'], stdout=subprocess.PIPE)

[Nico, 2016/11/01 01:07:34]

(at least this is gone)

-  xcode_select_dir = proc.communicate()[0]
-  rc = proc.returncode
-  return (not force_pull and rc == 0 and
-          TOOLCHAIN_BUILD_DIR not in xcode_select_dir)
+
+def RequestGsAuthentication():
+  """Requests that the user authenticate to be able to access gs://.
+  """
+  print 'Access to ' + TOOLCHAIN_URL + ' not configured.'
+  print '-----------------------------------------------------------------'
+  print
+  print 'You appear to be a Googler.'
+  print
+  print 'I\'m sorry for the hassle, but you need to do a one-time manual'
+  print 'authentication. Please run:'
+  print
+  print '    download_from_google_storage --config'
+  print
+  print 'and follow the instructions.'
+  print
+  print 'NOTE 1: Use your google.com credentials, not chromium.org.'
+  print 'NOTE 2: Enter 0 when asked for a "project-id".'
+  print
+  print '-----------------------------------------------------------------'
+  print
+  sys.stdout.flush()
+  sys.exit(1)
 
 
 def main():
   if sys.platform != 'darwin':
     return 0
 
-  if _UseLocalMacSDK():
+  if not _UseHermeticToolchain():
     print 'Using local toolchain.'
     return 0
 
   toolchain_revision = os.environ.get('MAC_TOOLCHAIN_REVISION',
                                       TOOLCHAIN_VERSION)
   if ReadStampFile() == toolchain_revision:
     print 'Toolchain (%s) is already up to date.' % toolchain_revision
     AcceptLicense()
     return 0
 
   if not CanAccessToolchainBucket():
-    print 'Cannot access toolchain bucket.'
-    return 0
+    RequestGsAuthentication()
+    return 1
 
   # Reset the stamp file in case the build is unsuccessful.
   WriteStampFile('')
 
   toolchain_file = '%s.tgz' % toolchain_revision
   toolchain_full_url = TOOLCHAIN_URL + toolchain_file
 
   print 'Updating toolchain to %s...' % toolchain_revision
   try:
     toolchain_file = 'toolchain-%s.tgz' % toolchain_revision
     toolchain_full_url = TOOLCHAIN_URL + toolchain_file
     DownloadAndUnpack(toolchain_full_url, TOOLCHAIN_BUILD_DIR)
     AcceptLicense()
 
     print 'Toolchain %s unpacked.' % toolchain_revision
     WriteStampFile(toolchain_revision)
     return 0
   except Exception as e:
     print 'Failed to download toolchain %s.' % toolchain_file
     print 'Exception %s' % e
     print 'Exiting.'
     return 1

[Nico, 2016/10/26 20:12:08]

could this return the "are we using system" bit to gn? Then we'd save one python
invocation.

[erikchen, 2016/10/26 20:21:10]

This is invoked during "gclient sync", which is decoupled from gn args
generation. Either can be called without invoking the other. 

 
 if __name__ == '__main__':
   sys.exit(main())