Sandbox the component updater's patcher utility process.

courgette/third_party/bsdiff/bsdiff.h

Index: courgette/third_party/bsdiff/bsdiff.h
diff --git a/courgette/third_party/bsdiff/bsdiff.h b/courgette/third_party/bsdiff/bsdiff.h
index a5da4ec9dd130d267868af0d546f1ed5426f73ca..c32fdd820f569f5706a36a260e0a6c75f4e377d5 100644
--- a/courgette/third_party/bsdiff/bsdiff.h
+++ b/courgette/third_party/bsdiff/bsdiff.h
@@ -46,6 +46,10 @@
 
 #include "base/files/file_util.h"
 
+namespace base {

[huangs, 2016/12/06 18:23:22]

You're not using File pointers, and looks like this works because file_util.h
includes file.h? Please:
- Remove the forward declaration here.
- #include "base/files/file.h"
- Remove the #include from bsdiff_apply.cc.

[waffles, 2016/12/06 19:18:45]

Done.

+class File;
+}  // namespace base
+
 namespace courgette {
 class SourceStream;
 class SinkStream;
@@ -81,6 +85,11 @@ BSDiffStatus ApplyBinaryPatch(const base::FilePath& old_stream,
                               const base::FilePath& patch_stream,
                               const base::FilePath& new_stream);
 
+// As above, but simply takes base::Files.

[huangs, 2016/12/06 18:10:40]

Please move this between the Stream version and FilePath version. Same in the
.cc file.

[waffles, 2016/12/06 19:18:45]

Done.

+BSDiffStatus ApplyBinaryPatch(base::File old_stream,
+                              base::File patch_stream,
+                              base::File new_stream);
+
 // The following declarations are common to the patch-creation and
 // patch-application code.