Add Widevine signature files into Mac build

chrome/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/buildflag_header.gni")
 import("//build/config/chrome_build.gni")
 import("//build/config/compiler/compiler.gni")
 import("//build/config/compiler/pgo/pgo.gni")
 import("//build/config/features.gni")
 import("//build/config/locales.gni")
@@ skipping 630 matching lines @@
       ":clean_up_old_versions",
 
       # keystone_registration_framework copies the framework into the framework
       # bundle via a script that performs additional actions, rather than
       # relying on a bundle_data to copy it.
       ":keystone_registration_framework",
 
       # verify_chrome_framework_order depends on :chrome_framework and, for
       # non-component builds, will ensure the export symbol table is correct.
       ":verify_chrome_framework_order",
+
+      # framework_signed_for_widevine depends on :chrome_framework as the
+      # framework needs to be linked before signing can occur.
+      ":framework_signed_for_widevine",
     ]
   }
 
   action("clean_up_old_versions") {
     script = "//chrome/tools/build/mac/clean_up_old_versions.py"
     outputs = [
       "$root_gen_dir/run_$target_name.stamp",
     ]
     args = [
              rebase_path("$root_out_dir/$chrome_product_full_name.app",
@@ skipping 181 matching lines @@
 
   _should_bundle_widevine =
       (is_chrome_branded || enable_widevine) && enable_pepper_cdms
   if (_should_bundle_widevine) {
     # The Widevine CDM and manifest are either the actual Widevine CDM and
     # manifest or stubs used for testing only. The choice is made within the
     # corresponding Widevine targets based on branding.
     bundle_data("widevine_cdm_library_binaries") {
       sources = [
         "$root_out_dir/$widevine_cdm_path/widevinecdmadapter.plugin",
         "$root_out_dir/libwidevinecdm.dylib",

[xhwang, 2017/01/26 01:22:56]

Is it possible to just bundle the cdm/adapter sig files here, then we don't need
widevine_copy_cdm_library_signature (I guess).

[jrummell, 2017/01/27 23:13:41]

Done. A little bit complicated since the .sigs are only there for chrome builds.

       ]
       outputs = [
         "{{bundle_root_dir}}/Libraries/$widevine_cdm_path/{{source_file_part}}",
       ]
       public_deps = [
         # Need this intermediate dependency because "widevinecdm" is a
         # shared_library if !is_chrome_branded, and then depending on
         # "widevinecdm" directly would cause it to be linked into the Chromium
         # Framework, which we don't want.
         ":widevine_cdm_library_copy",

[xhwang, 2017/01/26 01:22:56]

I wonder whether we could make widevinecdm always a copy target so that we don't
need this hack, i.e. when !is_chrome_branded, the CDM will be generated by a
shared_library(widevine_cdm_lib) target, followed by a target copy(widevinecdm)
which copies the file somewhere.

[jrummell, 2017/01/27 23:13:41]

A future CL. cdmadapter would need to link to the correct object. I assume today
the real CDM is linked via ldflags, while the stub one gets linked since it's a
library. If that's the correct understanding, lots of cleanup needed there.

         "//third_party/widevine/cdm:widevinecdmadapter",
       ]
     }
 
     copy("widevine_cdm_library_copy") {
       sources = [
         "$root_out_dir/$widevine_cdm_path/libwidevinecdm.dylib",
       ]
       outputs = [
         "$root_out_dir/{{source_file_part}}",
       ]
       deps = [
         "//third_party/widevine/cdm:widevinecdm",
       ]
     }
 
     bundle_data("widevine_cdm_library_manifest") {
       sources = [
         "$root_out_dir/WidevineCdm/manifest.json",
       ]
       outputs = [
         "{{bundle_root_dir}}/Libraries/WidevineCdm/{{source_file_part}}",
       ]
       public_deps = [
         "//third_party/widevine/cdm:widevine_cdm_manifest",
       ]
     }
+
+    # Bundle the signature files for Widevine and the CdmAdapter.

[xhwang, 2017/01/26 01:22:56]

nit: s/Widevine and the CdmAdapter/Widevine CDM and CDM adapter/

[jrummell, 2017/01/27 23:13:41]

Removed.

+    bundle_data("widevine_cdm_library_signatures") {
+      sources = [
+        "$root_out_dir/signatures/libwidevinecdm.dylib.sig",
+        "$root_out_dir/signatures/widevinecdmadapter.plugin.sig",
+      ]
+
+      # Signature files must end up in the same directory as the
+      # file they are created for.
+      outputs = [
+        "{{bundle_root_dir}}/Libraries/$widevine_cdm_path/{{source_file_part}}",
+      ]
+      public_deps = [
+        ":widevine_copy_cdm_library_signature",
+        ":widevine_generate_cdm_adapter_signature",
+      ]
+    }
+
+    copy("widevine_copy_cdm_library_signature") {
+      sources = [
+        "$root_out_dir/$widevine_cdm_path/libwidevinecdm.dylib.sig",
+      ]
+      outputs = [
+        "$root_out_dir/signatures/{{source_file_part}}",
+      ]
+      deps = [
+        "//third_party/widevine/cdm:widevinecdm",
+      ]
+    }
+
+    action("widevine_generate_cdm_adapter_signature") {
+      script = "//third_party/widevine/scripts/signature_generator.py"
+      plugin = "$root_out_dir/$widevine_cdm_path/widevinecdmadapter.plugin"
+      signature_file = "$root_out_dir/signatures/widevinecdmadapter.plugin.sig"

[xhwang, 2017/01/26 01:22:56]

Is it possible that we generate the sig file directly at
$root_out_dir/$widevine_cdm_path/widevinecdmadapter.plugin.sig?

[jrummell, 2017/01/27 23:13:41]

Done.

+      sources = [
+        "$plugin",
+      ]
+      outputs = [
+        "$signature_file",
+      ]
+      args = [
+        "--input_file",
+        rebase_path("$plugin", root_build_dir),
+        "--output_file",
+        rebase_path("$signature_file", root_build_dir),
+      ]
+      deps = [
+        "//third_party/widevine/cdm:widevinecdmadapter",
+      ]
+    }
+
+    # Bundle the framework signature. As the framework can only be signed once
+    # the framework has been linked, bundle it into the app as well as copy
+    # it next to the framework.
+    bundle_data("widevine_framework_signature") {
+      sources = [
+        "$root_out_dir/signatures/$chrome_framework_name.sig",
+      ]
+
+      # Signature files must end up in the same directory as the
+      # file they are created for.
+      outputs = [
+        "{{bundle_root_dir}}/Versions/$chrome_version_full/$chrome_framework_name.framework/{{source_file_part}}",
+      ]
+      public_deps = [
+        ":widevine_copy_framework_signature",
+        ":widevine_generate_framework_signature",
+      ]
+    }
+
+    # As the framework is signed after the local bundle is created, copy the
+    # signature into the local bundle.
+    copy("widevine_copy_framework_signature") {
+      sources = [
+        "$root_out_dir/signatures/$chrome_framework_name.sig",
+      ]
+      outputs = [
+        "$root_out_dir/$chrome_framework_name.framework/$chrome_framework_name.sig",
+      ]
+      public_deps = [
+        ":widevine_generate_framework_signature",
+      ]
+    }
+
+    action("widevine_generate_framework_signature") {
+      script = "//third_party/widevine/scripts/signature_generator.py"
+      framework = "$root_out_dir/$chrome_framework_name.framework/$chrome_framework_name"
+      signature_file = "$root_out_dir/signatures/$chrome_framework_name.sig"

[xhwang, 2017/01/26 01:22:56]

Is it possible to generate the framework sig file to the
$root_out_dir/$chrome_framework_name.framework folder directly? Then we don't
need the widevine_copy_framework_signature step.

[jrummell, 2017/01/27 23:13:41]

Done.

+      sources = [
+        "$framework",
+      ]
+      outputs = [
+        "$signature_file",
+      ]
+      args = [
+        "--input_file",
+        rebase_path("$framework", root_out_dir),
+        "--output_file",
+        rebase_path("$signature_file", root_out_dir),
+      ]
+      public_deps = [
+        ":chrome_framework",
+      ]
+    }
   }
 
   group("widevine_cdm_library") {
     if (_should_bundle_widevine) {
       deps = [
         ":widevine_cdm_library_binaries",
         ":widevine_cdm_library_manifest",
       ]
+
+      # Signatures are only generated for official chrome.
+      if (is_chrome_branded) {
+        deps += [ ":widevine_cdm_library_signatures" ]
+      }
+    }
+  }
+
+  group("framework_signed_for_widevine") {
+    # Only do this for official Chrome.
+    if (is_chrome_branded && _should_bundle_widevine) {
+      deps = [
+        ":widevine_framework_signature",
+      ]
     }
   }
 
   if (is_chrome_branded) {
     action("keystone_registration_framework") {
       script = "//chrome/tools/build/mac/copy_keystone_framework.py"
 
       framework_path = "//third_party/googlemac/Releases/Keystone/KeystoneRegistration.framework"
       output_path = "$root_out_dir/$chrome_framework_name.framework/Frameworks/"
 
@@ skipping 688 matching lines @@
       "//chrome/app/theme/$branding_path_component/product_logo_48.png",
       "//chrome/tools/build/linux/chrome-wrapper",
       "//third_party/xdg-utils/scripts/xdg-mime",
       "//third_party/xdg-utils/scripts/xdg-settings",
     ]
     outputs = [
       "$root_out_dir/{{source_file_part}}",
     ]
   }
 }