Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 55 matching lines @@
           base::Bind(&DeviceLocalAccountPolicyStore::UpdatePolicy,
                      weak_factory_.GetWeakPtr()));
     } else {
       status_ = CloudPolicyStore::STATUS_PARSE_ERROR;
       NotifyStoreError();
     }
   }
 }
 
 void DeviceLocalAccountPolicyStore::UpdatePolicy(
+    const std::string& used_public_key,
     UserCloudPolicyValidator* validator) {
+  DCHECK(!used_public_key.empty());
+
   validation_status_ = validator->status();
   if (!validator->success()) {
     status_ = STATUS_VALIDATION_ERROR;
     NotifyStoreError();
     return;
   }
 
   InstallPolicy(std::move(validator->policy_data()),
-                std::move(validator->payload()));
+                std::move(validator->payload()), used_public_key);
   status_ = STATUS_OK;
   NotifyStoreLoaded();
 }
 
 void DeviceLocalAccountPolicyStore::StoreValidatedPolicy(
+    const std::string& used_public_key,
     UserCloudPolicyValidator* validator) {
   if (!validator->success()) {
     status_ = CloudPolicyStore::STATUS_VALIDATION_ERROR;
     validation_status_ = validator->status();
     NotifyStoreError();
     return;
   }
 
   std::string policy_blob;
   if (!validator->policy()->SerializeToString(&policy_blob)) {
@@ skipping 14 matching lines @@
     status_ = CloudPolicyStore::STATUS_STORE_ERROR;
     NotifyStoreError();
   } else {
     Load();
   }
 }
 
 void DeviceLocalAccountPolicyStore::CheckKeyAndValidate(
     bool valid_timestamp_required,
     std::unique_ptr<em::PolicyFetchResponse> policy,
-    const UserCloudPolicyValidator::CompletionCallback& callback) {
+    const ValidateCompletionCallback& callback) {
   device_settings_service_->GetOwnershipStatusAsync(
       base::Bind(&DeviceLocalAccountPolicyStore::Validate,
                  weak_factory_.GetWeakPtr(),
                  valid_timestamp_required,
                  base::Passed(&policy),
                  callback));
 }
 
 void DeviceLocalAccountPolicyStore::Validate(
     bool valid_timestamp_required,
     std::unique_ptr<em::PolicyFetchResponse> policy_response,
-    const UserCloudPolicyValidator::CompletionCallback& callback,
+    const ValidateCompletionCallback& callback,
     chromeos::DeviceSettingsService::OwnershipStatus ownership_status) {

[Thiemo Nagel, 2016/11/21 17:45:33]

Nit: Since you're touching this code, I'd suggest to rename to
|ownership_status_unused|.

[emaxx, 2016/11/21 20:04:58]

Done.

   DCHECK_NE(chromeos::DeviceSettingsService::OWNERSHIP_UNKNOWN,
             ownership_status);
   const em::PolicyData* device_policy_data =
       device_settings_service_->policy_data();
+  // Note that the key is obtained through the device settings service instead
+  // of using |public_key_| member, as the latter one is updated only after the
+  // successful installation of the policy.
   scoped_refptr<ownership::PublicKey> key =
       device_settings_service_->GetPublicKey();
   if (!key.get() || !key->is_loaded() || !device_policy_data) {
     status_ = CloudPolicyStore::STATUS_BAD_STATE;
     NotifyStoreLoaded();
     return;
   }
 
   std::unique_ptr<UserCloudPolicyValidator> validator(
       UserCloudPolicyValidator::Create(std::move(policy_response),
@@ skipping 14 matching lines @@
   // Validate the DMToken to match what device policy has.
   validator->ValidateDMToken(device_policy_data->request_token(),
                              CloudPolicyValidatorBase::DM_TOKEN_REQUIRED);
 
   // Validate the device id to match what device policy has.
   validator->ValidateDeviceId(device_policy_data->device_id(),
                               CloudPolicyValidatorBase::DEVICE_ID_REQUIRED);
 
   validator->ValidatePayload();
   validator->ValidateSignature(key->as_string());
-  validator.release()->StartValidation(callback);
+  validator.release()->StartValidation(base::Bind(callback, key->as_string()));
 }
 
 }  // namespace policy