Add Widevine signature files into Mac build

chrome/BUILD.gn

Index: chrome/BUILD.gn
diff --git a/chrome/BUILD.gn b/chrome/BUILD.gn
index d6e93d34e896c90421074a595c7488e3c7b4859a..0816410bc5f4fd7af9aaefc9fa787e1d1340ef7e 100644
--- a/chrome/BUILD.gn
+++ b/chrome/BUILD.gn
@@ -648,6 +648,10 @@ if (is_win) {
       # verify_chrome_framework_order depends on :chrome_framework and, for
       # non-component builds, will ensure the export symbol table is correct.
       ":verify_chrome_framework_order",
+
+      # framework_signed_for_widevine depends on :chrome_framework as the
+      # framework needs to be linked before signing can occur.
+      ":framework_signed_for_widevine",
     ]
   }
 
@@ -862,12 +866,25 @@ if (is_win) {
         ":widevine_cdm_library_copy",
         "//third_party/widevine/cdm:widevinecdmadapter",
       ]
+
+      # Signatures are only generated for official chrome.
+      if (is_chrome_branded) {
+        sources += [
+          "$root_out_dir/$widevine_cdm_path/widevinecdmadapter.plugin.sig",
+          "$root_out_dir/libwidevinecdm.dylib.sig",
+        ]
+        public_deps += [ ":sign_cdm_adapter_for_widevine" ]
+      }
     }
 
     copy("widevine_cdm_library_copy") {
       sources = [
         "$root_out_dir/$widevine_cdm_path/libwidevinecdm.dylib",
       ]
+      if (is_chrome_branded) {
+        sources +=
+            [ "$root_out_dir/$widevine_cdm_path/libwidevinecdm.dylib.sig" ]
+      }
       outputs = [
         "$root_out_dir/{{source_file_part}}",
       ]
@@ -887,6 +904,36 @@ if (is_win) {
         "//third_party/widevine/cdm:widevine_cdm_manifest",
       ]
     }
+
+    widevine_sign_file("sign_cdm_adapter_for_widevine") {
+      file = "$root_out_dir/$widevine_cdm_path/widevinecdmadapter.plugin"
+      deps = [
+        "//third_party/widevine/cdm:widevinecdmadapter",
+      ]
+    }
+
+    # Bundle the Chrome framework signature into the app. As the framework can
+    # only be signed once the framework has been linked, this can't be bundled
+    # with the framework, so :widevine_generate_framework_signature adds the
+    # signature to the Chrome framework, and this bundles it with the app.
+    bundle_data("widevine_chrome_framework_signature") {
+      sources = [
+        "$root_out_dir/$chrome_framework_name.framework/$chrome_framework_name.sig",
+      ]
+      outputs = [
+        "{{bundle_root_dir}}/Versions/$chrome_version_full/$chrome_framework_name.framework/{{source_file_part}}",

[Robert Sesek, 2017/01/31 18:40:18]

I do not think this is going to work. The way bundle_data works means that this
rule will not be executed unless something causes chrome_app to need a rebuild.
If only something in chrome_framework changes, the Versions/X folder will be
removed and re-copied, and this rule will not re-run. This will cause the build
to fail to stabilize, which is not permitted.

You can test this like so:

% ninja -C out/release chrome
% touch out/release/Chromium\ Framework.framework/Chromium\ Framework
% ninja -C out/release chrome -v
% ls -l out/release/Chromium.app/Contents/Versions/Chromium\ Framework
# note that the file is not there
% ninja -C out/release chrome -v
# build does more stuff, not allowed because you chrome should have been built
completely at the last ninja invocation

[jrummell, 2017/02/02 23:04:55]

Updated. First -v build does sign the framework again (step 4/23), second -v
build says nothing to do.

+      ]
+      public_deps = [
+        ":sign_chrome_framework_for_widevine",
+      ]
+    }
+
+    widevine_sign_file("sign_chrome_framework_for_widevine") {
+      file = "$root_out_dir/$chrome_framework_name.framework/$chrome_framework_name"
+      deps = [
+        ":chrome_framework",
+      ]
+    }
   }
 
   group("widevine_cdm_library") {
@@ -898,6 +945,15 @@ if (is_win) {
     }
   }
 
+  group("framework_signed_for_widevine") {
+    # Only do this for official Chrome.
+    if (is_chrome_branded && _should_bundle_widevine) {
+      deps = [
+        ":widevine_chrome_framework_signature",
+      ]
+    }
+  }
+
   if (is_chrome_branded) {
     action("keystone_registration_framework") {
       script = "//chrome/tools/build/mac/copy_keystone_framework.py"