Turn on hermetic toolchain for all corp machines.

build/mac_toolchain.py

Index: build/mac_toolchain.py
diff --git a/build/mac_toolchain.py b/build/mac_toolchain.py
index 5728ab5e98f1253576a27b22c591a23f1652089b..aecd0ff0d9e865baf61bc652cda19b462906a08c 100755
--- a/build/mac_toolchain.py
+++ b/build/mac_toolchain.py
@@ -138,23 +138,42 @@ def AcceptLicense():
     subprocess.check_call(['sudo', '/usr/bin/xcode-select', '-s', old_path])
 
 
-def _UseLocalMacSDK():
-  force_pull = os.environ.has_key('FORCE_MAC_TOOLCHAIN')
-
-  # Don't update the toolchain if there's already one installed outside of the
-  # expected location for a Chromium mac toolchain, unless |force_pull| is set.
-  proc = subprocess.Popen(['xcode-select', '-p'], stdout=subprocess.PIPE)

[Nico, 2016/11/01 01:07:34]

(at least this is gone)

-  xcode_select_dir = proc.communicate()[0]
-  rc = proc.returncode
-  return (not force_pull and rc == 0 and
-          TOOLCHAIN_BUILD_DIR not in xcode_select_dir)
+def _UseHermeticToolchain():
+  current_dir = os.path.dirname(os.path.realpath(__file__))
+  script_path = os.path.join(current_dir, 'mac/should_use_hermetic_xcode.py')
+  proc = subprocess.Popen([script_path], stdout=subprocess.PIPE)

[Nico, 2016/11/01 01:07:34]

https://cs.chromium.org/chromium/tools/depot_tools/win_toolchain/get_toolchai...
also checks if a bot has access to src-internal, maybe we want that too (not
needed in this cl though)

[erikchen, 2016/11/01 19:33:48]

Hm.
"""
    if (HaveSrcInternalAccess() or
        LooksLikeGoogler() or
        CanAccessToolchainBucket()):
"""
It's not clear to me why we would want SrcInternalAccess to cause us to use
hermetic toolchain. 

+  return '1' in proc.stdout.readline()
+
+
+def RequestGsAuthentication():
+  """Requests that the user authenticate to be able to access gs://.
+  """
+  print 'Access to ' + TOOLCHAIN_URL + ' not configured.'
+  print '-----------------------------------------------------------------'
+  print
+  print 'You appear to be a Googler.'
+  print
+  print 'I\'m sorry for the hassle, but you need to do a one-time manual'
+  print 'authentication. Please run:'
+  print
+  print '    download_from_google_storage --config'
+  print
+  print 'and follow the instructions.'
+  print
+  print 'NOTE 1: Use your google.com credentials, not chromium.org.'
+  print 'NOTE 2: Enter 0 when asked for a "project-id".'
+  print
+  print '-----------------------------------------------------------------'
+  print
+  sys.stdout.flush()
+  sys.exit(1)
 
 
 def main():
   if sys.platform != 'darwin':
     return 0
 
-  if _UseLocalMacSDK():
+  if not _UseHermeticToolchain():
     print 'Using local toolchain.'
     return 0
 
@@ -166,8 +185,8 @@ def main():
     return 0
 
   if not CanAccessToolchainBucket():
-    print 'Cannot access toolchain bucket.'
-    return 0
+    RequestGsAuthentication()
+    return 1
 
   # Reset the stamp file in case the build is unsuccessful.
   WriteStampFile('')